professionallyevil / c4

Cyberdelia, a Collection of Command and Control frameworks

C4

Cyberdelia, a Collection of Command and Control frameworks

Table of Contents

• C4
  • Table of Contents
  • What is this?
  • Cyberdelia?
    • What is a C2 (framework)?
  • Why create this repo?
  • Format
    • Plan for this repo
    • Github Specific content
      • Contribute to project
        • Resources used

What is this?

This is a very fluid (as in continuously changing) github repo that will do comparisons of prominent Command and Control (C2) frameworks in the red team/pentesting industry.

Cyberdelia?

Cyberdelia is a place from the movie Hackers that all the main actors would go to meetup and hangout. While there, they would trade tips, tricks, and knowledge about their trade, which is what I hope this repo will be.

What is a C2 (framework)?

Rather than try and explain everything about what a C2 is, just checkout this YouTube video. @monoxgas gives an in depth explaination about what a C2 is and what it should do during his talk Flying a False Flag

Why create this repo?

For a long time Powershell Empire was known as the standard for open-source C2 frameworks, and since they have now discontinued the project this repo will be a landing for others to keep track of new frameworks.

Format

note: for a comprehensive list of all the C2 frameworks we will cover here please visit the frameworks folder.

This format/layout is absolutly subject to change, and if you think there is a better way to present this content please message me in the Professionally Evil Slack. I am gathering all this information to try and help compare and contrast the strong and weak points of different C2 frameworks, so whatever helps the presentation of that material the better! This repo will try to have releases, to better help solidfy when content is better solidified for consumtion, but it will not have Development Stages (i.e. alpha, beta, etc...) in release tags since the information is constantly evolving (unless someone thinks it should, and tell me how they think it should work).

Plan for this repo

Hopefully this repo can be similar to an awesome list, but be better in that we can aggregate video reviews of C2 frameworks, comparison points, and best use cases for when to use specific C2 frameworks. Currently the plan will be that I get the current list of C2 frameworks figured out for a v0.1.0 release, and I would love community help in making sure all information is accurate and informative!

Github Specific content

All github specific content is in the .github folder. (i.e. Code of Conduct, Contributing Guidelines, etc...)

Contribute to project

If you would like to submit a contribution (i.e. correction, improvement, or alteration) to the project checkout the CONTRIBUTING.md

Resources used

Research

c4's Issues

[NFS] Apfell

checklist

necessary github issues or actions that need to get created/executed are as follows:

• video
• comparison points
• meta
  • label
  • milestone
  • folder to organize in repo

name

Apfell

url

https://github.com/its-a-feature/Apfell

Additional context

currently have notes, and will add them soon.

[NFS] FactionC2

checklist

necessary github issues or actions that need to get created/executed are as follows:

• video
• comparison points
• meta
  • label
  • milestone
  • folder to organize in repo

name

FactionC2

url

https://github.com/FactionC2/Faction

Additional context

have notes, will post soon

[NFS] PoshC2_Python

checklist

necessary github issues or actions that need to get created/executed are as follows:

• video
• comparison points
• meta
  • label
  • milestone
  • folder to organize in repo

name

PoshC2_Python

url

https://github.com/nettitude/PoshC2_Python

Additional context

have notes, will post soon

[VIDEO] sliver

C2 framework name

sliver

url

#5

Additional context

[VIDEO] Covenant

C2 framework name

Covenant

url

#3

Additional context

[NFS] SILENTTRINITY

checklist

necessary github issues or actions that need to get created/executed are as follows:

• video
• comparison points
• meta
  • label
  • milestone
  • folder to organize in repo

name

SILENTTRINITY

url

https://github.com/byt3bl33d3r/SILENTTRINITY

Additional context

have notes, will add

[NFS] koadic

checklist

necessary github issues or actions that need to get created/executed are as follows:

• video
• comparison points
• meta
  • label
  • milestone
  • folder to organize in repo

name

koadic

url

https://github.com/zerosum0x0/koadic

Additional context

[VIDEO] SILENTTRINITY

C2 framework name

SILENTTRINITY

url

#9

Additional context

[VIDEO] Apfell

C2 framework name

Apfell

url

#1 (comment)

Additional context

[VIDEO] PoshC2_Python

C2 framework name

PoshC2_Python

url

#11

Additional context

[NFS] merlin

checklist

necessary github issues or actions that need to get created/executed are as follows:

• video
• comparison points
• meta
  • label
  • milestone
  • folder to organize in repo

name

merlin

url

https://github.com/Ne0nd0g/merlin

Additional context

I have notes, will post soon

[VIDEO] koadic

C2 framework name

koadic

url

#15

Additional context

[VIDEO] SILENTTRINITY demo by author

C2 framework name

SILENTTRINITY

url

https://youtu.be/0_b3A1SOyVw

Additional context

found here

NOTE: have to register to view video

[NFS] Covenant

checklist

necessary github issues or actions that need to get created/executed are as follows:

• video
• comparison points
• meta
  • label
  • milestone
  • folder to organize in repo

name

Covenant

url

https://github.com/cobbr/Covenant

Additional context

already have notes, will add soon

[NFS] sliver

checklist

necessary github issues or actions that need to get created/executed are as follows:

• video
• comparison points
• meta
  • label
  • milestone
  • folder to organize in repo

name

sliver

url

https://github.com/BishopFox/sliver

Additional context

I have notes already, will post soon

[FEATURE] Automated information

Is your feature request related to a problem? Please describe.

No

Describe the solution you'd like

Use the script: https://github.com/ProfessionallyEvil/C4/blob/master/repo_scripts/github_to_md.sh
to automatically generate information about each project. Place this info under the frameworks folder to a file called autogen-info.md.

Describe alternatives you've considered

Manually = 👎

Additional context

I will also document the script, but till then @elreydetoda will have to do this one.

Files used in script

https://github.com/ProfessionallyEvil/C4/blob/master/frameworks/urls

[FEATURE] Automating NFS submissions

What?

I would like to create an automated way that when someone submits a NFS (new framework submission), that it will automatically create a the necessary other issues (currently video).
During the automatic creation of the github issues it also fills in the necessary information.

• name (same as the name submitted from NFS)
• url (url of the NFS github issue)
• other (any other information needed depending on the type of issue

With?

I would like to keep this as much of a github thing as possible, so please checkout github actions/workflows (can't really tell which one is the name): https://help.github.com/en/articles/configuring-a-workflow .
Also, please keep things as files as much as possible, because that will allow for easy audit-ability and reproducibility (i.e. github issue templates).

[VIDEO] merlin

C2 framework name

merlin

url

#13

Additional context

[FEATURE] Automating shellcheck

Is your feature request related to a problem? Please describe.

Not really, but mainly just to ensure quality of shell script submitted.

Describe the solution you'd like

Using github workflow to use the shellcheck command ensuring all submitted shell scripts are up to standard.

Describe alternatives you've considered

I mainly want to keep this as much of a github only project as possible, so it all information about the project is visible to new people without having to leave the repo. Alternative are using the following of course.

• circleci
• travisci

Additional context

[VIDEO] FactionC2

C2 framework name

FactionC2

url

#7

Additional context