kaliExploration C2 TeamServer
What it is
Exploration is a rudimentary red team command and control framework.
This repository contains the Team Server and the GUI to communicate with the Team Server.
This development is an educational exercise to tackle well know red teaming concepts.
Dependencies:
Sumbodule & External Projects:
- Donut: Creat shellcode from PE files.
- cpp-httplib: Http and Https Listener.
- CoffLoader: Run object files from CS-Situational-Awareness-BOF.
- MemoryModule: Load DLL at runtime.
- UnmanagedPowerShell: Powershell for unmanaged code.
- cpp-base64: base64.
- json: json parser.
Compilation
Build the TeamServer
- apt install cmake
- apt install golang-cfssl #(self sign cert for client server grpc communications)
- pip install conan==1.59
- pip install grpcio
- pip install PyQt5
- pip install pyqtdarktheme
- pip install protobuf
git submodule update --init
mkdir buildLinux
cd buildLinux
cmake ..
make -j4
The TeamServer binary is in Release/TeamServer
it's launched using './TeamServer'
The Python GUI is in Release/Client
It's launched using 'python3 GUI.py'
Windows Beacon
Beacons and command modules are compiled separately in another project, but the current version is provided in ./Release to be able to use it directly.
Two side projects can be used to deliver the beacons:
Command and Control
The Team Server is a stand alone application which communicates with a client with GRPC channel (SSL). The Teamserver handle listeners.
Implant run on the target host. Each implant or beacon which connects back to the Team Server open a session. The session is used to control the implant, send commands and receive results.
A listener and implant/beacon can run on TCP, SMB, HTTP and HTTPS
Windows beacon uses primarily windows API and start with no module loaded. Modules are loaded at runtime using "MemoryModule" project to load DLL sent by the server to the beacon.
Moreover, the module AssemblyExec & Inject use Donut to give a lot of flexibility to the user, allowing him to launch whatever EXE or DLL he wants on the remote host.
Coff Module is used to run Coff files.
Modules List
| Module |
|---|
| assemblyExec |
| upload |
| download |
| run |
| script |
| inject |
| pwd |
| cd |
| ls |
| ps |
| makeToken |
| rev2self |
| stealToken |
| coffLoader |
| loadModule |
| powershell |
| kerberosUseTicket |
| psExec |
| wmiExec |
| spawnAs |
| chisel |
| tree |