https://github.com/calebstewart/pwncat-windows-c2
pwncat windows c2 components
https://github.com/calebstewart/pwncat-windows-c2
Last synced: 19 days ago
JSON representation
pwncat windows c2 components
- Host: GitHub
- URL: https://github.com/calebstewart/pwncat-windows-c2
- Owner: calebstewart
- Created: 2021-01-09T23:05:50.000Z (over 4 years ago)
- Default Branch: master
- Last Pushed: 2021-06-21T01:10:25.000Z (almost 4 years ago)
- Last Synced: 2025-03-27T02:02:17.395Z (about 1 month ago)
- Language: C#
- Size: 78.1 KB
- Stars: 19
- Watchers: 5
- Forks: 3
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# Command and Control for pwncat on Windows
This repository houses the stage one and stage two C2 libraries used by `pwncat` to
operate on a Windows target. When `pwncat` starts, "Stage Zero" is either `cmd.exe`
or `powershell.exe`. We assume we have all protections in place including Constrained-
Language Mode, AppLocker, and Defender. With this in mind, `pwncat` first uploads the
`loader.dll` file to a safe directory and executes it reflectively with `Install-Util`.
After `loader.dll` is running, it will reflectively load `stagetwo.dll` which is the
primary C2 mechanism for `pwncat`.
## Protocol
This is not the best C2, but it works. It can be improved in multiple areas. Namely,
the communication standard is not consistent. Some methods take input as a Gzip/base64
blob while others take plaintext. At it's core, you can execute any public/static methods
within any type in `StageTwo.dll` by sending two lines of text. The first being the name
of the type, and the second being the name of the method. No arguments are passed to the
method. All methods then read their arguments directly from `stdin`. For example, to open
a file for reading, you would send the following payload:
```
File
open
C:\Windows\System32\drivers\etc\hosts
r
```
The output of individual methods are sent of `stdout`. In the case of `File.open`, a file
handle is written to `stdout` followed by a newline. If an error occurs or an excpetion is
caught, then a line beginning with `E:` is printed. Normally, the exception message follows.
## Features
In general this C2 supports the following features. These are subject to change frequently.
It's worth noting that during startup, a PowerShell `ConsoleHost` is started. `PSLogging` and
Constrained-Language Mode is disabled in this session regardless of system settings. This session
is persistent throughout the C2 execution, even across interactive sessions. It **does not** start
`powershell.exe`.
- Executing arbitrary processes (`Process.start`)
- Killing processes (`Process.kill`)
- Polling process state (`Process.poll`)
- Open/Close/Read/Write files (`File.open`, `File.close`, `File.read`, `File.write`)
- Compiling and executing arbitrary C# (`Reflection.compile`)
- Side-loading PowerShell Modules (`PowerShell.run`)
- Executing arbitrary PowerShell code and receiving JSON serialized PSObject and Exception results.
- Interactive Full Language Mode PowerShell session without `powershell.exe`
## Improvements
As I said before, this is not a great C2. I'm open to an improvements or suggestions. As I stated,
the actual API for making requests and passing arguments should probably be soldified and documented.
In the meantime, the `Windows` platform implementation in `pwncat` supports all the features outlined
above.