Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire.
The major difference is that Koadic does most of its operations using Windows Script Host (a.k.a. JScript/VBScript), with compatibility in the core to support a default installation of Windows 2000 with no service packs (and potentially even versions of NT4) all the way through Windows 10.
It is possible to serve payloads completely in memory from stage 0 to beyond, as well as use cryptographically secure communications over SSL and TLS (depending on what the victim OS has enabled).
Currently the tool provide the following options:
- Hooks a zombie
- Elevates integrity (UAC Bypass)
- Dumps SAM/SECURITY hive for passwords
- Scans local network for open SMB
- Pivots to another machine
This tool will be mostly used by RedTeam to test security controls and if the BlueTeam will be able to detect , prevent or react to the attack. The detection / protection should be placed on the endpoint and network level.
You can read more and download this tool over here: https://github.com/zerosum0x0/koadic
