PoshC2 - Powershell C2 Server and Implants

PoshC2 – Powershell C2 Server and Implants

August 9, 2019 Comments Off

Many tools are written in PowerShell especially for red team activities as the majority of modern Windows are having PowerShell and usually administrators don’t restrict access to the PowerShell console for normal users. This give a great advantage to an attacker especially if PowerShell usage is not monitored by the blue team.

PoshC2 is a proxy aware C2 framework that utilises Powershell and/or equivalent (System.Management.Automation.dll) to aid penetration testers with red teaming, post-exploitation and lateral movement. Powershell was chosen as the base implant language as it provides all of the functionality and rich features without needing to introduce multiple third party libraries to the framework.

In addition to the Powershell implant, PoshC2 also has a basic dropper written purely in Python that can be used for command and control over Unix based systems such as Mac OS or Ubuntu.

The server-side component is written in Python for cross-platform portability and speed, a Powershell server component still exists and can be installed using the ‘Windows Install’ as shown below but will not be maintained with future updates and releases.

Features

PoshC2 has a large array of features. The following is a flavor of the kind of features you will find:

Open Source
Written in Powershell
Proxy Aware
Daisy Chaining of implants
Team server allowing multiple operators access to implants
Encrypted transport
Domain fronting support
SOCKS Proxy builtin
Custom payload construction
Task automation via auto runs
Automigration on succesful delivery of new implant
Multiple migration methods
Fast C# based internal network port scanner
Solid reporting capabilities

Linux Install of PoshC2_Python

Install using curl & bash

curl -sSL https://raw.githubusercontent.com/nettitude/PoshC2_Python/master/Install.sh | bash

Manual install

wget https://raw.githubusercontent.com/nettitude/PoshC2_Python/master/Install.sh
chmod +x ./Install.sh
./Install.sh

Windows Install of PoshC2

powershell -exec bypass -c "IEX (New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/nettitude/PoshC2/master/C2-Installer.ps1')"