# C2 Command & Control Framework

## Overview

This is a **pet project** designed for learning and experimentation with **Command & Control (C2) frameworks**. But I'm not excluding the possibility of truning it into a full-scale usabe C2 for my future Penetration Testing experience. It features a secure C2 server written in Go and a Windows-based agent written in C. The project focuses on encrypted communication, implant management, task execution, data exfiltration and overall stealthy operations.

> ⚠️ **Disclaimer:** This project is for educational purposes only. Unauthorized deployment or usage is strictly prohibited.

## Current Features

### 🔹 Server & Client (Go)

- Secure communication using **mTLS**
- Authentication
- Agent management
- Task management
- Tab-completion
- Dynamic implant generation
- Modules

### 🔹 Beacon (C) Stage 0

- mTLS and HTTP communication channels
- Shellcode in-memory decryption
- Shellcode injection in remote process or spawning a new process

### 🔹 Agent (C) Stage 1

- **Small footprint** achieved with modularity and ~~SSL library for embedded devices~~ native Windows SSL API
- TCP and mTLS communication channels with round robin logic
- **Task execution**:
  - Execute CMD or Powershell commands
  - Adjustable connection interval, configurable start-up delay
  - Download files/directories from target, upload files to target
  - File system navigation
  - System information collection
  - &#x20;Keylogger
  - Auto persistence
  - SOCKS5 proxy to tunnel traffic through target
  - Execute exe, dll (currently from disk)
  - **In-memory** shellcode decryption and execution
    - Inject into remote process
    - Spawn a new process with custom ppid and inject into it
  - Cleanup and self deletion

## **Setup**

### 🔹 (optional) **Compiling WolfSSL for MinGW**

Old versions of implants used WolfSSL library for communication. Modern versions use Windows Native Security API for communication. But you can still generate the agent, 
that will use WolfSSL libray. You must compile WolfSSL for MinGW and put in correct folder and use make utility:  

```sh
cd wolfssl-5.7.6
./configure --host=x86_64-w64-mingw32 --enable-static --prefix=/home/user/Sigma-C2/agent/lib/wolfssl-compiled
make -j 4
make install
```

After compilation, the **compiled library** should be located in:  
```sh
Sigma-C2/agent/lib/wolfssl-compiled
```
Now you should manually edit domain and port in agent.c :)  
And then use make: 
```sh
cd agent/
make USE_WOLFSSL=TRUE
```

---

### 🔹 **Server & Client (Tested on Kali, Debian and Ubuntu)**
Quickstart for testing. These will start server and client on localhost in developer mode. To see all options use -h flag.

1. Install dependencies:  
   ```sh
   sudo apt install golang mingw-w64 make xxd openssl
   ```  
2. Generate TLS certificates using provided script:  
   ```sh
   bash generate_certs.sh
   ```  
3. Start server on localhost  
   ```sh
   bash start_server.sh
   ```  
4. Start operator console:  
   ```sh
   bash operator/start_client.sh
   ```  
---


### 🔹 **Payload Generation**

1. Create a listener:  
   ```sh
   listen -t ssl -h domain1.com,domain2.com -p 8443 -n test_listener1
   ```  

2. Generate the agent payload:  
   ```sh
   generate agent <listener_name> [flags]
   ```  
   - Replace `<listener_name>` with the desired listener (tab completed).  
   - Some optional flags:  
     - `--auto-persistence` - Automatically enable persistence on start-up.  
     - `--auto-keylogger` - Automatically enable keylogger on start-up.  
     - `--interval` Set interval between connections in seconds (default 5)
     - `--delay` Set startup delay

3. The implant will be saved to the **"agent"** folder.

## To-Do List

🛠 **Planned Improvements**
- ~~Beacon with VM detection~~
- ~~Basic tasks execution (cmd, powershell, sleep, load dll/shellcode, cleanup)~~
- ~~Context switching in terminal~~
- ~~File download/upload~~
- ~~Encrypting shellcode and delay before execution~~
- ~~HTTPS listener with profiles~~
- ~~File system navigation~~
- HTTP communication channel for agent
- HTTP profiles loading
- Covert DNS communication channel for beacon
- Encrypted local storage (for agent's DB and loot)
- ~~SOCK5 proxy on infected machines~~
- ~~Beacon: rewrite to C and implement~~
- Implement staging logic for beacon and separate stager
- One line web-delivery
- VBS macro stager
- Agent: buffering, shutdown detection and manual reporting for keylogger
- Installation script
- Detailed documentation with nice screenshots
- Docker image
- GUI

## License

📜 **All Rights Reserved**  

This project is proprietary and confidential. Unauthorized copying, distribution, modification, or public sharing of this codebase is strictly prohibited.  

> ⚠️ **Usage is permitted only for personal learning and experimentation. Redistribution or commercial use is forbidden.**

## Changelog

📌 **Latest Version:** `v0.5.0` — *2025-07-13*

#### v0.5.0
### The moment ~~You all've been waiting for~~ I was delaying for two monthes already!
- Beacon in GO got fully replaced with Beacon written in C. Old beacon files removed.
- Added HTTP listener to server and HTTP communication channel to beacon. This was actually pretty hard for me to implement. I learned more about interfaces and abstractions in C - that's basically how I was able to add a request-response HTTP protocol to my transport abstraction, which was initially created for stream-based protocols.
- Changed project folder structure a bit. And will continue doing so, untill my internal perfectionist is satisfied.
- Small fixes like: task result parsing and reporting, cosmetic adjustments, taskID fixes, pid and ppid fixes in injection logic, 
- A lot of new ideas have came to my mind since last version. I have a working prototype of DLL unhooking and API hashing, so there is a possibility of adding those soon. But, of course, first I need to polish HTTP listener's profiles logic.
#### v0.4.3
- Added size optimization flags to payload generator
- Fixed preprocessor macros for transport selection 
- Https implants now send all messages via GET and big messages via POST
- Move target cookies and headers inside of domain profiles
- Added task ID reporting by client, which helps identify operator who issued command. In next version task result will be reported selectively to operator who sent command

#### v0.4.2
- Added https listener prototype to server

#### v0.4.1
- New beacon now supports Win Schannel TLS only (no wolfssl)
- Flag --devel now skip mTLS

#### v0.4.0
- Added Windows Schannel TLS transport, no more overhead caused by Wolfss. However, you can still use Wolfssl.
- Fixed flags and macros from testing build
- Prototyped https listener. Currently working on it.

#### v0.3.2
- Fixed injection logic for new beacon
- Added new beacon to repo

#### v0.3.1
- Sysinfo command now follows new task result sending logic.
- Fixed keylogger and persistence commands by passing a dummy buffer.

#### v0.3.0
- Refactored task result sending logic. Now it's cleaner and more flexible.
- Fixed proxy bug which prevented it from stopping after stop command received.

#### v0.2.2
- No hardcoded keys - one-time ecnryption key generation and transfer to agents. Key are cleared after use. Makes it harder to catch shellcode.

#### v0.2.1
- Added missing header files to get rid of compiler warnings
- Added compile flags to Makefile

#### v0.2.0
- Removed unnecessary WSACleanUp, which prevented agent from reconnection after server went offline and back online.
- Rewrote some blocks to use sync.Map instead of mutex.
- Added PID and process name retrieving for "ps" command.
- Added nice output for "ps" command and it is now handled separately, like sysinfo and keylogger.
- Devel mode: if message is bigger than 512 chars, console will print only 512 chars.
Laying the foundation for new task-result logic in future: 
- Task handler: now generates task id for every task.
- Task handler: does not delete task after sending to agent, but just marks it as dispatched.
- Task handler: operator conn and ID retrieval by task id.

#### v0.1.0
- Decided to keep track of changes
- Added "inject" command to write shellcode into process by PID
- Added "spawn" command to start new suspended process and write shellcode into it. Optional: specify PPID.
- Modulesa are now not hardcoded, but loaded dynamically from folder.
- Shellcode is encrypted before task handler, decrypted right before writing to memory and cleared right after it.
TODO:
- Persistence and staging mechanism for new beacon.
- Self injection for new beacon