https://github.com/trustedsec/trevorc2

TrevorC2 is a legitimate website (browsable) that tunnels client/server communications for covert command execution.
https://github.com/trustedsec/trevorc2

Last synced: 10 days ago
JSON representation

TrevorC2 is a legitimate website (browsable) that tunnels client/server communications for covert command execution.

• Host: GitHub
• URL: https://github.com/trustedsec/trevorc2
• Owner: trustedsec
• License: other
• Created: 2017-10-27T15:59:28.000Z (about 7 years ago)
• Default Branch: master
• Last Pushed: 2022-01-31T20:16:24.000Z (almost 3 years ago)
• Last Synced: 2024-10-01T18:23:57.482Z (about 1 month ago)
• Language: C
• Size: 125 KB
• Stars: 1,212
• Watchers: 58
• Forks: 252
• Open Issues: 2
• Metadata Files:
  • Readme: README.md
  • Changelog: CHANGELOG.txt
  • License: LICENSE.txt

Awesome Lists containing this project

• awesome-command-control - Trevor C2
• awesome-network-stuff - **596**星

README

        
trevorc2

=======

# TrevorC2 - Command and Control via Legitimate Behavior over HTTP

Written by: Dave Kennedy (@HackingDave)

Website: https://www.trustedsec.com

Note that this is a very early release - heavy randomization and encryption to be added soon.

TrevorC2 is a client/server model for masking command and control through a normally browsable website. Detection becomes much harder as time intervals are different and does not use POST requests for data exfil. 

           ,  .'''''.  ...    ''''',  .'           

            ','     ,.MMMM;.;'      '.             

             ;;    ;MMMMMMMMM;     ;;'             

            :'M:  ;MMMMMMMMMMM;.  :M':             

            : M:  MMMMMMMMMMMMM:  :M  .           

           .' M:  MMMMMMMMMMMMM:  :M. ;           

           ; :M'  :MMMMMMMMMMMM'  'M: :           

           : :M: .;"MMMMMMMMM":;. ,M: :           

           :  ::,MMM;.M":::M.;MMM ::' :           

         ,.;    ;MMMMMM;:MMMMMMMM:    :,.         

         MMM.;.,MMMMMMMM;MMMMMMMM;.,;.MMM         

         M':''':MMMMMMMMM;MMMMMMMM: "': M         

         M.:   ;MMMMMMMMMMMMMMMMMM;   : M         

         :::   MMMMMMMMMMM;MMMMMMMM   ::M         

        ,'';   MMMMMMMMMMMM:MMMMMMM   :'".         

      ,'   :   MMMMMMMMMMMM:MMMMMMM   :   '.       

     '     :  'MMMMMMMMMMMMM:MMMMMM   ;     '     

     ,.....;.. MMMMMMMMMMMMM:MMMMMM ..:....;.     

     :MMMMMMMM MMMMMMMMMMMMM:MMMMMM MMMMMMMM:     

     :MM''':"" MMMMMMMMMMMMM:MMMMMM "": "'MM:     

      MM:   :  MMMMMMMMMMMMM:MMMMMM  ,'  :MM       

      'MM   :  :MMMMMMMMMMMM:MMMMM:  :   ;M:       

       :M;  :  'MMMMMMMMMMMMMMMMMM'  :  ;MM       

       :MM. :   :MMMMMMMMMM;MMMMM:   :  MM:       

        :M: :    MMMMMMMMM'MMMMMM'   : :MM'       

        'MM :    "MMMMMMM:;MMMMM"   ,' ;M"         

         'M  :    ""''':;;;'''""    :  M:         

         ;'  :     "MMMMMMMM;."     :  "".         

       ,;    :      :MMMMMMM:;.     :    '.       

      :'     :    ,MM'''""''':M:    :     ';       

     ;'      :    ;M'         MM.   :       ;.     

There are two components to TrevorC2 - the client and the server. The client can be configured to be used with anything. In this example it's coded in Python but can easily be ported to C#, PowerShell, or whatever you want. Currently the trevorc2_client.py supports Windows, MacOS, and Linux. You can always byte compile the Windows one to get an executable, but preference would be to use Windows without having to drop an executable as a stager.

The way that the server works is by tucking away a parameter thats right before the