search

Und3rf10w / external_c2_framework

Python api for usage with cobalt strike's External C2 specification
223 stars 95 forks source link

Implement a subreddit transport #8

Open GaelTadh opened 6 years ago

GaelTadh commented 6 years ago

It would be nice to have a subreddit based c2 support. This should avoid the challenges posed by twitter. While still being just as reliable.

Und3rf10w commented 6 years ago

I agree, this would likely be a much lower level of effort that Twitter as well. I'll begin researching options

Und3rf10w commented 6 years ago

Commit 9f0d36b is a working implementation of this using reddit PMs. While this does not fulfill the the specified "subreddit" request, this is a good first proof of concept that demonstrates this is possible and fairly straightforward.

The sample_server-gmail.py script works perfectly for this without modification as intended. To utilize this script, simply modify config.py to have these values:

ENCODER_MODULE = "encoder_b64url"
TRANSPORT_MODULE = "transport_reddit"

You will need to register a reddit app (as a script), install the praw module, then populate the proper values in server/utils/transports/transport_reddit.py and client/reddit/reddit_client.py

Currently, there is a bug that will be encountered if the data being sent is greater than 10k characters in length. I will resolve this, but one can load the stager manually (e.g. from a text file) for debugging purposes and verify that this does in fact work as a transport mechanism. This should be fairly straightforward if we go the route of adding a beginning and ending delimiter between transmissions.

Und3rf10w commented 6 years ago

In 4fc3399, renaming sample_server-gmail.py to server.py to signify that it doesn't require any modification.

Und3rf10w commented 6 years ago

Moving development tracking of reddit PM transport to #9

Und3rf10w commented 6 years ago

Adding to backlog for now, will revisit after beta release, see #23 and Milestone 3.