{"id":30305521,"url":"https://github.com/idigitalflame/thunderstorm","last_synced_at":"2025-08-17T08:09:48.081Z","repository":{"id":43457992,"uuid":"389687874","full_name":"iDigitalFlame/ThunderStorm","owner":"iDigitalFlame","description":"Golang C2 Server and Agents using XMT (https://github.com/iDigitalFlame/xmt)","archived":false,"fork":false,"pushed_at":"2024-11-10T22:38:44.000Z","size":912,"stargazers_count":34,"open_issues_count":1,"forks_count":8,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-04-19T13:45:38.212Z","etag":null,"topics":["c2","ctf","go","golang","golang-application","hacking","offensive-security","python","python3","redteam"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/iDigitalFlame.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":"iDigitalFlame","ko_fi":"idflame"}},"created_at":"2021-07-26T15:50:42.000Z","updated_at":"2025-03-30T00:52:08.000Z","dependencies_parsed_at":"2024-06-18T17:12:07.491Z","dependency_job_id":"abeb3d13-07d8-4069-8ec7-2186f1f85e3e","html_url":"https://github.com/iDigitalFlame/ThunderStorm","commit_stats":null,"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/iDigitalFlame/ThunderStorm","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iDigitalFlame%2FThunderStorm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iDigitalFlame%2FThunderStorm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iDigitalFlame%2FThunderStorm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iDigitalFlame%2FThunderStorm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/iDigitalFlame","download_url":"https://codeload.github.com/iDigitalFlame/ThunderStorm/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iDigitalFlame%2FThunderStorm/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":270820793,"owners_count":24651534,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-17T02:00:09.016Z","response_time":129,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["c2","ctf","go","golang","golang-application","hacking","offensive-security","python","python3","redteam"],"created_at":"2025-08-17T08:09:47.065Z","updated_at":"2025-08-17T08:09:48.062Z","avatar_url":"https://github.com/iDigitalFlame.png","language":"Python","funding_links":["https://github.com/sponsors/iDigitalFlame","https://ko-fi.com/idflame","https://ko-fi.com/Z8Z4121TDS"],"categories":[],"sub_categories":[],"readme":"# The ThunderStorm Project\n\n[![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)\n[![Latest](https://img.shields.io/github/v/tag/iDigitalFlame/ThunderStorm)](https://github.com/iDigitalFlame/ThunderStorm/releases)\n\n![cirrus](icons/cirrus.png) ![doppler](icons/doppler.png) ![bolt](icons/bolt.png) ![stormfront](icons/stormfront.png) ![jetstream](icons/jetstream.png) ![flurry](icons/flurry.png) ![cloudseed](icons/cloudseed.png)\n\n---\n\nGolang Full C2 Solution using [XMT](https://github.com/iDigitalFlame/xmt)\n\nThunderStorm is made up of multiple components that work together.\n\n[Documentation repository](docs) is live with new stuff, including:\n\n- The [Quickstart Guide](docs/Quickstart.md)!\n- [Bolt Console Command Line Reference](docs/Commands.md) guide.\n- [Data Identifiers Reference](docs/Identifiers.md) guide.\n\n## ![cirrus](icons/cirrus.png) Cirrus\n\n*I smell a storm comming*\n\nCirrus is a ReST cradle for XMT and acts as the primary \"teamserver\". This can\nbe used to control and task Bolts (implants).\n\nCirrus will automatically capture Jobs and new Bolts and has a websocket interface\nthat can be used to get quick up-to-date information on what's happening.\n\n__ReST documentation is in progress (I swear!)__\n\n## ![bolt](icons/bolt.png) Bolt\n\n*Sometimes lighting does strike twice*\n\nA Bolt is a basic implant that can be used on any client device. Bolts can be\nbuilt in multiple modes and will initially talk to the C2 with whatever their\nbuilt-in Profile is.\n\nBolts can be customized to run as services/daemons or as DLLs.\n\n## ![jetstream](icons/jetstream.png) JetStream\n\n*Fly Forward, Fast*\n\nJetStream is a compact, complex Bolt builder engine. JetStream is able to create\nnew Bolts for many different platforms (including Windows DLLs) and can obfuscate,\nencrypt, sign and pack binaries easily.\n\n## ![cloudseed](icons/cloudseed.png) CloudSeed\n\n*Let it Pour*\n\nCloudSeed complements JetStream and is able to build Bolts and Flurries in batches.\nUsing JetStream, CloudSeed can build hundreds of instances ready to be deployed.\n\nIt's __OUR__ answer to Defense-in-Depth.\n\n## ![flurry](icons/flurry.png) Flurry\n\n*Just layer it on*\n\nFlurry (old name Launcher) taps into the Guardian function of XMT and can automatically\nresurrect a killed or crashed Bolt in a dirrent process. These rely on a configured Guardian\ntype and a list of stored filesystem paths (or URLS!) to get a Bolt from.\n\n## ![doppler](icons/doppler.png) Doppler\n\n*You gotta find the eye of the Storm to know where the action is*\n\nDoppler is a Python frontend CLI that can be used to interact with Cirrus. Doppler\nsupports multiple users at once (it can be run multiple times) and uses the Cirrus\nwebsocket to get real time data on Jobs and Bolts.\n\nThe layout of how commands work is similar to the PowerShell Empire format (except\nexiting the shell doesn't kill the server). Doppler will automatically manage\nfilepaths for you (for downloads, uploads, shellcode) and can manage multiple Bolts\n\nDoppler can take command-line arguments, environment variables, or even a config file!\n\nThe layout of the config file with the matching env and arguments is below:\n\n```json\n{\n    \"cirrus\": \"http://localhost:7777\", // env:DOPPLER_HOST args:[-a, --api]\n    \"cirrus_password\": \"\u003cpassword\u003e\", //env:DOPPLER_PW args:[-p, --password]\n    \"default_exec\": true, // env:DOPPLER_NO_EMPTY args:[-N, ==no-empty]\n    \"default_asm\": \"\u003cpath_to_asm_file\u003e\", // env:DOPPLER_ASM args:[-A, --as,]\n    \"default_dll\": \"\u003cpath_to_dll_file\u003e\", // env:DOPPLER_DLL args:[-D, --dll]\n    \"default_pipe\": \"\u003cmigrate_spawn_pipe_name\u003e\" // env:DOPPLER_PIPE args:[-P, --pipe]\n}\n```\n\nActual JSON config file:\n\n```json\n{\n    \"cirrus\": \"http://localhost:7777\",\n    \"cirrus_password\": \"\u003cpassword\u003e\",\n    \"default_exec\": true,\n    \"default_asm\": \"\u003cpath_to_asm_file\u003e\",\n    \"default_dll\": \"\u003cpath_to_dll_file\u003e\",\n    \"default_pipe\": \"\u003cmigrate_spawn_pipe_name\u003e\"\n}\n```\n\n## TODOs:\n\n*Updated 02/24/23*\n\n- Write Cirrus API documentation\n- WC2 Setup / Config API\n- Interactive way to create Profiles\n\n__DISCLAIMER: Please use for legal reasons only. I'm not responsible if you get__\n__in trouble for using this improperly or if someone owns your environment and is__\n__using ThunderStorm (or a derivative of it).__\n\n[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Z8Z4121TDS)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fidigitalflame%2Fthunderstorm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fidigitalflame%2Fthunderstorm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fidigitalflame%2Fthunderstorm/lists"}