PoshC2 - A proxy aware C2 framework used to aid red teamers

项目说明

!PoshC2 Logo

!Docker Image CI

PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral
mo.

PoshC2 is primarily written in Python3 and follows a modular format to enable users to add their own modules and tools,
allowing an extendible and flexible C2 framework. Out-of-the-box PoshC2 comes PowerShell/C# and Python2/Python3 implants
with payloads written in PowerShell v2 and v4, C++ and C# source code, a of executables, DLLs and raw shellcode
in addition to a Python2/Python3 payload. These enable C2 functionality on a wide range of devices and operating
systems, including Windows, *nix and OSX.

Other notable features of PoshC2 include:

* Consistent and Cross-Platform support using Docker.
* Highly configurable payloads, including default beacon times, jitter, kill dates, user agents and more.
* A large number of payloads generated out-of-the-box which are frequently updated.
* Shellcode containing in-build AMSI bypass and ETW patching for a high success rate and stealth.
* Auto-generated Apache Rewrite rules for use in a C2 proxy, protecting your C2 infrastructure and maintaining good
operational security.
* A modular and extensible format allowing users to create or edit C#, PowerShell or Python3 modules which can be run
in-memory by the Implants.
* Notifications on receiving a successful Implant or Slack.
* A comprehensive and maintained contextual help and an intelligent prompt with contextual auto-completion, history and
suggestions.
* Fully encrypted communications, protecting the confidentiality and integrity of the C2 traffic even when communicating
over HTTP.
* Client/Ser allowing multiple team members to utilise a single C2 server.
* Extensi. Every action and response is timestamped and stored in a database with all relevant information
such as user, host, implant number etc. In addition to this the C2 ser is directly logged to a separate
file.
* PowerShell-less implants that do not use System.Management.Automation.dll using C# or Python2/Python3.
* A free and open-source SOCKS Proxy using SharpSocks
* HTTP(S) and SMB named-pipe comms for implants combined with Implant Daisy-chaining for reaching networks that do not
ha to the internet

Documentation

We maintain PoshC2 documentation over at

Find us on #Slack - poshc2.slack.com (to request an invite send an email to )

Install

You can install PoshC2 directly or use the Docker images, instructions for both are below.

Direct install on Kali hosts

An install script is provided for installing PoshC2:

Elevated pri are required as the install script performs apt updates and installations.

Alternatively the repository can be cloned down and the install script manually run.

You can manually set the PoshC2 installation directory by passing it to the Install.sh script as the -p argument. The
default is /opt/PoshC2:

Cutting Edge Features

We want to keep the master branch stable to ensure that users are able to rely on it when required and for this reason
changes can often be feature-complete but not yet present on master as they have not been tested completely and
signed-off yet.

If you want to look at upcoming features in PoshC2 you can check out the dev branch, or any indi feature
branches branched off of dev.

As features are tested before they are merged into dev this branch should still be fairly stable and operators can
opt in to using this branch or a particular feature branch for their engagement.
This does trade stablity for new features however so do it at your own discretion.

To use dev or a feature branch pass the branch name to the Install.sh script as the -b argument:

Note the URL includes the branch name also (here dev instead of master).

Installing for Docker

You can also run PoshC2 using Docker, this allows more stable and running and enables PoshC2 to easily run on other
operating systems.

The Docker install does not clone PoshC2 as the PoshC2 images on Docker Hub are used, so only a minimal install of some
dependencies and scripts are performed.

To start with, install Docker on the host and then add the PoshC2 projects directory to Docker as a shared directory if
required for your OS. By default this is / on *nix and /private/ on Mac.

Kali based hosts

Install script:

Elevated pri are required as the install script performs script installations.

To use the dev or feature branches with Docker curl down the Install-for-Docker.sh on the appropriate branch and
pass the branch name as an argument:

Windows

On Windows, import the PoshC2.psm1 PowerShell module.

Running PoshC2

Create a new project:

Projects can be switched to or listed using this script:

Edit the configuration for your project:

Launch the PoshC2 server:

Alternatively start it as a service:

Separately, run the ImplantHandler for interacting with implants:

See for full documentation on PoshC2.

Specifying a Docker tag

If you are using Docker you can specify the Docker image tag to run with the -t option to posh-server and posh.

E.g.

Updating PoshC2 Installations

**It is not recommended to update PoshC2 during an engagement. Incoming changes may be incompatible with an existing
project and can result in erratic behaviour.**

When using a git cloned of PoshC2 you can update your PoshC2 installation using the following command:

Using older

You can use an older of PoshC2 by referencing the appropriate tag. Note this only works if you ha down
the repository.
You can list the tags for the repository by issuing:

If you have a local clone of PoshC2 you can change the that is in use while offline by just checking out the
you want to use:

For example:

However note that this will o any local changes to files, such as changes to the configuration files, and you
may have to re-run the install script for that or re-setup the en appropriately.

License / Terms of Use

This software should only be used for authorised testing activity and not for malicious use.

By downloading this software you are accepting the terms of use and the licensing agreement.

项目信息

开发语言：PowerShell

Star 数：2139

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A proxy aware C2 framework used to aid red teamers with post-exploitation and lateral movement.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。