KittyStager - KittyStager is a simple stage 0 C2. It is made of

项目说明

<h1 align="center">
KittyStager
</h1>

<p align="center">
<a href="" rel="noopener">
<img width=150px height=150px src="./img/black-cat.png"> </a>
</p>

KittyStager is a stage 0 C2 comprising an API, client, and malware. The API is responsible for deli basic tasks and shellcode to be injected into memory by the malware. The client also connects to the API and allows for interaction with the malware by creating tasks. The goal of KittyStager is to deploy a simple stage 0 payload onto the target system and gather enough information to adapt the payload to the specific target. As the stage 0 payload is intended to be as stealthy as possible, it does not include any command execution capabilities.

> This project is made for educational purpose only. I am not responsible for any damage caused by this project.

Features

A simple cli to interact with the implant

API :

- [x] A web server to host your kittens
- [x] HTTPS
- [x] Yours files in /upload are a on /upload

Reconnaissance :

- [x] Hostname, domain, pid, ip...
- [x] AV or EDR solution with wmi
- [x] Process list

Encryption :

- [x] Key exchange with Opaque
- [x] Chacha20 encryption

Malware capabilities :

- [x] Create thread injection
- [x] Bananaphone (Hell's gate )
- [x] Halo's gate
- [x] ETW patching
- [x] Sleep with jitter
- [x] Remove of the binary from disk

Sandbox :

- [x] Check ram
- [x] Check a none existing website

Payload :

- [x] Raw shellcode
- [x] Hex shellcode

Build :

- [x] Generate the kitten from the config file
- [ ] Compile the kitten with go & garble
- [ ] Sign the kitten with a copied certificate
- [ ] Generate description

> Some settings can be changed in the config file

Quick start

1. Clone repository

2. Config file

Edit the config file :

Check the ip/port

HTTPS/HTTP

Sleep time

#### HTTPS
How to generate certificate for https with openssl

3. Build

Build the server :

Build the client

The server need to be running

Then start the server, the client and run the kitten on the target.

Usage

start server

The client will connect to 127.0.0.1:1337. If your not on the server, you will need to use an ssh tunnel.

List kittens

!img.png

Get logs

!img_1.png

Print config

!img_2.png

Interact with a kitten

!img.png

Get tasks

!img_3.png

Inject shellcode

!img_5.png

Change sleep time

!img_6.png

Get process list

!img_7.png

Get AV/EDR with wmi

!img_8.png

Get pri & integrity level

!img_9.png

Get kitten infos

!img_10.png

Kill kitten

!img_11.png

Remo from disk

!img.png

Custom kitten

You can customise the kitten code from the config file.

Compilation and obfuscation part, is not implemented yet.
!img.png
Compile exe :

Compile dll :
You need to change the execType in config.yaml

Architecture

The projet is divided in 3 parts :

The client

The server

The kitten

The crypto part, kitten, config, tasks struct are in internal.

Contributing

Pull requests are welcome. Feel free to open an issue if you want to add other features.

Contact

Enelg#9993 on discord

Credits

... and many others

项目信息

开发语言：Go

Star 数：226

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕KittyStager is a simple stage 0 C2. It is made of a web server to host the shellcode and an implant, called kitten. The purpose of this project is to be able to have a web server and some kitten and be able to use the with any shellcode.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。