Termux ID: TrevorC2 -->

    Social Items

Home / TrevorC2

WSC2 is a PoC of using the WebSockets and a browser process to serve as a C2 communication channel between an agent, running on the target system, and a controller acting as the actuel C2 server.

Background information
Check this blog post to get some context and insight on the developpment of this tool:
Using WebSockets and IE/Edge for C2 communications

Architecture
WSC2 is composed of:
  • a controller, written in Python, which acts as the C2 server
  • an agent running on the target system, delivered to the target system via various initial stagers
  • various flavors of initial stages (created from the controller interface) used for the initial compromission of the target system.

Features
WSC2 main features:
  • Various stager (powershell one liner, various JScript file) - this is not limited, you can easily come up with your own stagers, check the templates folder to get an idea
  • Interactive shell (with environment persistency)
  • File transfer back and forth between the agent and C2
  • Multiple agents support

Installation & Configuration
Installation is pretty straight forward:
  • Git clone this repository: git clone https://github.com/Arno0x/WSC2 WSC2
  • cd into the WSC2 folder: cd WSC2
  • Install the python dependencies: pip install -r requirements.txt
  • Give the execution rights to the main script: chmod +x wsc2.py
Check the configuration file config.py and ensure the default config fits your needs.
Start the controller by typing: ./wsc2.py.

Compiling your own agent
The JScript agent (stager 'jscript1') doesn't need to be compiled.
The 'jscript2', 'jscript3' and 'psoneliner' stagers are based on a .Net assembly DLL that you can choose to build on your own/modify, based on the source code provided.
Although it is perfectly OK to use the provided wsc2.dll, you can very easily compile your own agent, from the source code provided. You'll need Visual Studio installed.
Create a .Net (Visual C#) Class Libray projet. Add the wsc2Agent.cs source file as the main source code file.
Add the following references to your project:
  1. Microsoft HTML Object Library (MSHTML)
  2. Microsoft Internet Controls (SHDocVw)
Build !

Author: Arno0x0x - @Arno0x0x

WSC2 - A WebSocket C2 Tool


TrevorC2 is a client/server model for masking command and control through a normally browsable website. Detection becomes much harder as time intervals are different and does not use POST requests for data exfil.

There are two components to TrevorC2 - the client and the server. The client can be configured to be used with anything. In this example it's coded in Python but can easily be ported to C#, PowerShell, or whatever you want. Currently the trevorc2_client.py supports Windows, MacOS, and Linux. You can always byte compile the Windows one to get an executable, but preference would be to use Windows without having to drop an executable as a stager.

The way that the server works is by tucking away a parameter thats right before the parameter. This is completely configurable, and it's recommended you configure everything to be unique in order to evade detection. Here is the workflow:
1. trevor2_server.py - edit the file first, and customize, what website you want to clone, etc. The server will clone a website of your choosing and stand up a server. This server is browsable by anyone and looks like a legitimate website. Contained within the source is parameter that (again is configurable), which contains the instructions for the client. Once a client connects, it searches for that parameter, then uses it to execute commands.
2. trevor2_client.py - all you need in any configurable option is the ability to call out to a website, parse some basic data, and then execute a command and then put the results in a base64 encoded query string parameter to the site. That's it, not hard.

Installation
pip install -r requirements.txt

Usage
First edit the trevor2_server.py - change the configuration options and site to clone.
python trevor2_server.py

Next, edit the trevor2_client.py - change the configuration and system you want it to communicate back to.
python trevor2_client.py



TrevorC2 - Command and Control via Legitimate Behavior over HTTP

Subscribe to: Posts (Atom)