GC2-sheet - GC2 is a Command and Control application that allo

项目说明

GC2

<p align="center">
<img alt="Logo" src="img/GC2.png" height="30%" width="30%">
</p>

GC2 (Google Command and Control) is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet or Microsoft SharePoint List and exfiltrate files using Google Drive or Microsoft SharePoint Document.

Why

This project has been de to provide a command and control that does not require any particular set up (like: a custom domain, VPS, CDN, ...) during Red Teaming acti.

Furthermore, the program will interact only with Google and Microsoft's domains (like *.google.com) to make network detection more difficult.

Workflow

Google

<p align="center">
<img alt="Work Flow" src="img/Google_workflow.png" height="60%" width="60%">
</p>

Microsoft

<p align="center">
<img alt="Work Flow" src="img/Microsoft_workflow.png" height="60%" width="60%">
</p>

Features

Command execution using Google Sheet or Microsoft SharePoint List as a console

Download files on the target using Google Drive or Microsoft SharePoint Document

Data exfiltration using Google Drive or Microsoft SharePoint Document

Self-kill switch and auto-delete from the target machine

Command execution

Google

A Google Sheet will be automatically created by the C2. Once created you can interact with the compromised system as shown below.

<p align="center">
<img alt="Sheet Permission" src="img/Google_usage.png" height="60%" width="60%">
</p>

Microsoft

A Microsoft SharePoint List will be automatically created by the C2. Once created you can interact with the compromised system as shown below.

<p align="center">
<img alt="Sheet Permission" src="img/Microsoft_usage.png" height="60%" width="60%">
</p>

Data exfiltration file

Special command is reserved to exfiltrate files form the target system.

Note: files with the same name are automatically o.

Download file

Special command is reserved to download files to the target system.

#### Google

#### Microsoft
Note: Files need to be saved in the SharePoint root folder, usually "Documents"

Exit

By sending the *exit* command, the C2 will kill and delete itself from the target system.

PS: From *os* documentation:
*If a symlink was used to start the process, depending on the operating system, the result might be the symlink or the path it pointed to*. In this case, the symlink is deleted.

Set up

This C2 support both Google (Google Sheet + Google Drive) and Microsoft (SharePoint Lists + SharePoint Document) services. To use the C2 you need to set up both the local and cloud configuration.

Cloud config

Google

1. Create a new Google "service account"

Create a new Google "service account" using create a .json key file for the service account.

2. Enable Google Sheet API and Google Drive API

Enable Google Drive API and Google Sheet API

3. Set up Google Sheet and Google Drive

Create a new Google Sheet and share it (as Editor) with the Service Account (by using its email).

<p align="center">
<img alt="Sheet Permission" src="img/Google_Sheet_permissions.png" height="60%" width="60%">
</p>

Create a new Google Dri and share it (as Editor) with the Service Account (by using its email).

<p align="center">
<img alt="Sheet Permission" src="img/Google_Dri.png" height="60%" width="60%">
</p>

Microsoft

To interact with Microsoft services you will first need a Business subscription (you can get one for free for the first 30 days).

1. Create an Azure Application

Create a new Azure Aapplication as described here

<p align="center">
<img alt="Sheet Permission" src="img/Microsoft_Azure_application.png" height="60%" width="60%">
</p>

After creating the new application, enable the following Graph APIs:
- Sites.ReadWrite.All
- Files.ReadWrite.All

<p align="center">
<img alt="Sheet Permission" src="img/Microsoft_Azure_application_API.png" height="60%" width="60%">
</p>

Local config

1. Download the C2

The C2 can be cloned directly from GitHub:

5. Configure the C2

To configure the C2 you need to modify the cmd/options.yml file. The C2 supports both Google and Microsoft services, mixing them is also possible.

*Only Google services*

Your Google service account key must be escaped before pasting it in the configuration file. You can use the following command to escape it:

*Only Microsoft services*

*Mixing Google and Microsoft services*

6. Build the executable

Few examples on how cross compile the C2 for different OS and architecture.

7. Run

After compiling execute it.

The beacon will automatically create a new Google Sheet or Microsoft SharePoint List accordingly to your configuration.

Troubleshooting

Most of the errors can be detected by setting the flag to true. By default, the C2 does not generate any output or error information.

DEF CON Slides + demo

DEF CON Slide

Demo

Demo by Grant Collins

Disclaimer

The owner of this project is not responsible for any illegal usage of this program.

This is an open source project meant to be used with authorization to assess the security posture and for research purposes.

The final user is solely responsible for their actions and decisions. The use of this project is at your own risk. The owner of this project does not accept any liability for any loss or damage caused by the use of this project.

Support the project

Pull request or ![paypal]()

Contributors

Paolo Conizzoli

Articles related to this tool

DEF CON 32; DEF CON 32 Reddit

Google

The Hacker News

Reddit

LinkedIn

Bleeping Computer

Security Affairs

Icrewplay

Information Security Buzz

Hackdig

Hakin9

RedPacketSecurity

Cyware

Kitploit

News mentioning malware using the same concept:

The Hacker News -
Bleeping Computer -

项目信息

开发语言：Go

Star 数：658

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕GC2 is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet or Microsoft SharePoint List and exfiltrate files using Google Drive or Microsoft SharePoint Document.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。