trustedsec/trevorc2 trustedsec/trevorc2

  • Stars
    star
    1,210
  • Rank 38,721 (Top 0.8 %)
  • Language
    C
  • License
    Other
  • Created about 7 years ago
  • Updated almost 3 years ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
trustedsec/trevorc2
github

trustedsec

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

TrevorC2 is a legitimate website (browsable) that tunnels client/server communications for covert command execution.

trevorc2

TrevorC2 - Command and Control via Legitimate Behavior over HTTP

Written by: Dave Kennedy (@HackingDave) Website: https://www.trustedsec.com

Note that this is a very early release - heavy randomization and encryption to be added soon.

TrevorC2 is a client/server model for masking command and control through a normally browsable website. Detection becomes much harder as time intervals are different and does not use POST requests for data exfil.

       ,  .'''''.  ...    ''''',  .'           
        ','     ,.MMMM;.;'      '.             
         ;;    ;MMMMMMMMM;     ;;'             
        :'M:  ;MMMMMMMMMMM;.  :M':             
        : M:  MMMMMMMMMMMMM:  :M  .           
       .' M:  MMMMMMMMMMMMM:  :M. ;           
       ; :M'  :MMMMMMMMMMMM'  'M: :           
       : :M: .;"MMMMMMMMM":;. ,M: :           
       :  ::,MMM;.M":::M.;MMM ::' :           
     ,.;    ;MMMMMM;:MMMMMMMM:    :,.         
     MMM.;.,MMMMMMMM;MMMMMMMM;.,;.MMM         
     M':''':MMMMMMMMM;MMMMMMMM: "': M         
     M.:   ;MMMMMMMMMMMMMMMMMM;   : M         
     :::   MMMMMMMMMMM;MMMMMMMM   ::M         
    ,'';   MMMMMMMMMMMM:MMMMMMM   :'".         
  ,'   :   MMMMMMMMMMMM:MMMMMMM   :   '.       
 '     :  'MMMMMMMMMMMMM:MMMMMM   ;     '     
 ,.....;.. MMMMMMMMMMMMM:MMMMMM ..:....;.     
 :MMMMMMMM MMMMMMMMMMMMM:MMMMMM MMMMMMMM:     
 :MM''':"" MMMMMMMMMMMMM:MMMMMM "": "'MM:     
  MM:   :  MMMMMMMMMMMMM:MMMMMM  ,'  :MM       
  'MM   :  :MMMMMMMMMMMM:MMMMM:  :   ;M:       
   :M;  :  'MMMMMMMMMMMMMMMMMM'  :  ;MM       
   :MM. :   :MMMMMMMMMM;MMMMM:   :  MM:       
    :M: :    MMMMMMMMM'MMMMMM'   : :MM'       
    'MM :    "MMMMMMM:;MMMMM"   ,' ;M"         
     'M  :    ""''':;;;'''""    :  M:         
     ;'  :     "MMMMMMMM;."     :  "".         
   ,;    :      :MMMMMMM:;.     :    '.       
  :'     :    ,MM'''""''':M:    :     ';       
 ;'      :    ;M'         MM.   :       ;.

There are two components to TrevorC2 - the client and the server. The client can be configured to be used with anything. In this example it's coded in Python but can easily be ported to C#, PowerShell, or whatever you want. Currently the trevorc2_client.py supports Windows, MacOS, and Linux. You can always byte compile the Windows one to get an executable, but preference would be to use Windows without having to drop an executable as a stager.

The way that the server works is by tucking away a parameter thats right before the parameter. This is completely configurable, and it's recommended you configure everything to be unique in order to evade detection. Here is the workflow:

1. trevor2_server.py - edit the file first, and customize, what website you want to clone, etc. The server will clone a website of your choosing and stand up a server. This server is browsable by anyone and looks like a legitimate website. Contained within the source is parameter that (again is configurable), which contains the instructions for the client. Once a client connects, it searches for that parameter, then uses it to execute commands.
2. trevor2_client.py - all you need in any configurable option is the ability to call out to a website, parse some basic data, and then execute a command and then put the results in a base64 encoded query string parameter to the site. That's it, not hard. 
3. trevor2_client.ps1 - powershell implementation of trevor2_client.py, this allows you to use native PowerShell to interact with Trevor2_Server.

Installation

pip install -r requirements.txt

Usage

First edit the trevor2_server.py - change the configuration options and site to clone.

python trevor2_server.py

Next, edit the trevor2_client.py or ps1 - change the configuration and system you want it to communicate back to.

python trevor2_client.py or .\trevor2_client.ps1

Session Management

TrevorC2 supports the ability to handle multiple shells coming from different hostnames. The way TrevorC2 works is it will identify new hostnames as sessions. You can interact with the sessions once you execute a command. If you have multiple sessions, you can type a command and interact with that session based on the session number stored globally.

When first starting TrevorC2, you can type help or ? for additional information. Basic command usage is "list" which will list any active shells or none at all, or "interact <session_id>" to interact with the shell you want.

You can always type back/exit within a shell, it will still remain active and not actually kill the shell.

Example below:

root@stronghold:/home/relik/Desktop/git/trevorc2# python trevorc2_server.py 

TrevorC2 - Legitimate Website Covert Channel
Written by: David Kennedy (@HackingDave)
https://www.trustedsec.com
[*] Cloning website: https://www.google.com
[*] Site cloned successfully.
[*] Starting Trevor C2 Server...
[*] Next, enter the command you want the victim to execute.
[*] Client uses random intervals, this may take a few.
[*] Type help for usage. Example commands, list, interact.

Trevor C2 shell
trevorc2>help

Documented commands (type help <topic>):
========================================
exit  help  interact  list  servercmd

trevorc2>help list
Description: Lists all available agents
Usage: list

trevorc2>list
No available Agents. :-(

trevorc2>
*** Received connection from 127.0.0.1 and hostname stronghold with communication sid pSNIRFgTuZnCdHN for TrevorC2.

trevorc2>list
id  hostname                ip address        communication_sessionid
1   stronghold              127.0.0.1         pSNIRFgTuZnCdHN

trevorc2>help interact
Description: Starts an interactive shell with agent
Usage: interact <id>

trevorc2>interact 1
[*] Dropping into trevorc2 shell...
[*] Use exit or back to select other shells
stronghold:trevorc2>ifconfig
[*] Waiting for command to be executed, be patient, results will be displayed here...
[*] Received response back from client...
=-=-=-=-=-=-=-=-=-=-=
(HOSTNAME: stronghold
CLIENT: 127.0.0.1)
ens33     Link encap:Ethernet  HWaddr 00:0c:29:63:7c:67  
          inet addr:172.16.37.132  Bcast:172.16.37.255  Mask:255.255.255.0
          inet6 addr: fe80::4b6b:fb52:f109:a7af/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1400907 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2588882 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:835091244 (835.0 MB)  TX bytes:2623070556 (2.6 GB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:453640 errors:0 dropped:0 overruns:0 frame:0
          TX packets:453640 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:211565776 (211.5 MB)  TX bytes:211565776 (211.5 MB)


stronghold:trevorc2>back

trevorc2>help servercmd
Description: Run command on the server
Usage: servercmd <command>
Example: servercmd ifconfig

trevorc2>servercmd hostname
PwnServer

trevorc2>exit
[*] Exiting TrevorC2...

Dockerfile

Uses an alpine-based Dockerfile to deploy trevorC2, handy for quick deployment on cloud providers.
Example below:

git clone https://github.com/trustedsec/trevorc2.git
cd trevorc2
# At this point, setting up docker-machine to remotly deploy works great
docker build -t trevorc2 . 
docker run -it -p 80:80 -p 443:443 trevorc2

Variables configuration

It is important to change the variables that are presented in each of the scripts. Especially the SITE_PATH_QUERY and encryption key. I would also recommend looking at the REDIRECT option. Instead of cloning a website, you have another option which will redirect the victim host that may be browsing the site to investigate to the legitimate site. Basically when someone visits the site, it'll just redirect them to the site you want cloned. Change the cloned site from google for example to a different site and turn redirect to ON.

TODO

Add ability for longer than 2048 data output. Query string parameter length limited size length.

Add do_POST support for POST exfil on longer data.

Add upload/download functionality.

More Repositories

1

social-engineer-toolkit

The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
Python
10,592
star
2

ptf

The Penetration Testers Framework (PTF) is a way for modular support for up-to-date tools.
Python
5,071
star
3

unicorn

Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.
Python
3,694
star
4

hate_crack

A tool for automating cracking methodologies through Hashcat from the TrustedSec team.
Python
1,628
star
5

CS-Situational-Awareness-BOF

Situational Awareness commands implemented using Beacon Object Files
C
1,230
star
6

SysmonCommunityGuide

TrustedSec Sysinternals Sysmon Community Guide
CSS
1,119
star
7

CS-Remote-OPs-BOF

C
745
star
8

cve-2019-19781

This is a tool published for the Citrix ADC (NetScaler) vulnerability. We are only disclosing this due to others publishing the exploit code first.
Python
572
star
9

meterssh

MeterSSH is a way to take shellcode, inject it into memory then tunnel whatever port you want to over SSH to mask any type of communications as a normal SSH connection. The way it works is by injecting shellcode into memory, then wrapping a port spawned (meterpeter in this case) by the shellcode over SSH back to the attackers machine. Then connecting with meterpreter's listener to localhost will communicate through the SSH proxy, to the victim through the SSH tunnel. All communications are relayed through the SSH tunnel and not through the network.
Python
521
star
10

physical-docs

This is a collection of legal wording and documentation used for physical security assessments. The goal is to hopefully allow this as a template for other companies to use and to protect themselves when conducting physical security assessments.
469
star
11

COFFLoader

C
462
star
12

nps_payload

This script will generate payloads for basic intrusion detection avoidance. It utilizes publicly demonstrated techniques from several different sources. Written by Larry Spohn (@Spoonman1091) Payload written by Ben Mauch (@Ben0xA) aka dirty_ben
Python
434
star
13

tap

The TrustedSec Attack Platform is a reliable method for droppers on an infrastructure in order to ensure established connections to an organization.
Python
376
star
14

orpheus

Bypassing Kerberoast Detections with Modified KDC Options and Encryption Types
Python
360
star
15

hardcidr

hardCIDR is a Linux Bash script, but also functions under macOS. Your mileage may vary on other distros. The script with no specified options will query ARIN and a pool of BGP route servers. The route server is selected at random at runtime.
Shell
356
star
16

egressbuster

Egressbuster is a method to check egress filtering and identify if ports are allowed. If they are, you can automatically spawn a shell.
Python
341
star
17

artillery

The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
326
star
18

spraywmi

SprayWMI is an easy way to get mass shells on systems that support WMI. Much more effective than PSEXEC as it does not leave remnants on a system.
Python
253
star
19

ELFLoader

C
246
star
20

ridenum

Rid_enum is a null session RID cycle attack for brute forcing domain controllers.
Python
228
star
21

The_Shelf

Retired TrustedSec Capabilities
Python
216
star
22

Obsidian-Vault-Structure

213
star
23

SeeYouCM-Thief

HTML
178
star
24

User-Behavior-Mapping-Tool

Python
159
star
25

specula

Python
158
star
26

spoonmap

Python
147
star
27

SliverKeylogger

C++
141
star
28

pivoter

Pivoter is a proxy tool for pentesters to have easier lateral movement.
C
139
star
29

CrackHound

Python
132
star
30

PPLFaultDumpBOF

C
131
star
31

cors-poc

HTML
128
star
32

SHIPS

The Shared Host Integrated Password System (SHIPS) is a solution to provide unique and rotated local super user or administrator passwords for environments where it is not possible or not appropriate to disable these local accounts. Clients may be configured to rotate passwords automatically. Stored passwords can be retrieved by desktop support personnel as required, or updated when a password has to be manually changed in the course of system maintenance. By having unique passwords on each machine and logging of password retrievals, security can be improved my making networks more resistant to lateral movement by attackers and enhancing the ability to attribute actions to individual persons.
JavaScript
127
star
33

CS_COFFLoader

C#
122
star
34

quicksql

QuickSQL is a simple MSSQL query tool that allows you to connect to MSSQL databases and does not require administrative level rights to use.
Python
100
star
35

tscopy

Python
88
star
36

HoneyBadger

Ruby
81
star
37

conqr

ConQR is an open source ticketing system for conferences to issue QRCode's in a quick, efficient, and easy manner.
Python
74
star
38

auto_SettingContent-ms

This is a quick POC for using the Matt Nelson (enigma0x3) technique for generating a malicious .SettingContent-ms extension type for remote code execution. This automates generating an HTA downloader and embeds it in the SettingContent-ms file for you and starts Apache.
Python
49
star
39

defensive-scripts

PowerShell
45
star
40

wpupdate

WPUpdate is a simple Linux service that automatically checks for a new version of Wordpress each night at 2AM.
Python
37
star
41

proxy_helper

Proxy Helper is a WiFi Pineapple module that will automatically configure the Pineapple for use with a proxy such as Burp Suite.
JavaScript
32
star
42

Windows-MS-LSAT-RPC-Example

Windows RPC example calling stubs generated from MS-LSAT and MS-LSAD
C
24
star
43

hash_parser

This is a hash parser that will export a rc file compatible with Metasploit. This is useful when compromising a separate domain and want to see if any of the credentials work on another domain or other systems.
Python
22
star
44

Zoinks

Manage Engine Decrypter
Python
22
star
45

VerifyELF

C
21
star
46

inProc_Evade_Get-InjectedThread

PoC code from blog
C
15
star
47

scriptkiddie-wmi-provider

C#
13
star
48

TCS_InjectionTechniques

C
12
star
49

RisingSun

RisingSun: Decoding SUNBURST C2 to identify infected hosts without network telemetry.
Go
9
star
50

LLVM-Obfuscation-Experiments

C
7
star