Nimbo-C2 - Nimbo-C2 is yet another (simple and lightweight) C

项目说明

Nimbo-C2

<p align="center">
<img alt="Nimbo" src="/assets/nimbo.png">
</p>

Nimbo-C2

About

Features

Installation

- Easy Way
- Easier Way

Usage

Limitations, Warnings, Notes

Contribution

About

*Nimbo-C2 is yet another (simple and lightweight) C2 framework.*


Nimbo-C2 agent supports x64 Windows & Linux. It's written in Nim, with some usage of .NET on Windows (by dynamically loading the CLR to the process). Nim is powerful, but interacting with Windows is much easier and robust using Powershell, hence this combination is made. The Linux agent is slimier and capable only of basic commands, including ELF loading using the memfd technique.

All ser are written in Python:

HTTP listener that manages the agents.

Builder that generates the agent payloads.

Nimbo-C2 is the interactive C2 component that rule'em all!

My work wouldn't be possible without the previous great work done by others, listed under credits.

Features

Build EXE, DLL, ELF payloads.

Encrypted implant configuration and strings using NimProtect.

Packing payloads using UPX and obfuscate the PE section names (UPX0, UPX1) to make detection and unpacking harder.

Encrypted HTTP communication (AES in CBC mode, key hardcoded in the agent and configurable by the config.jsonc).

Auto-completion in the C2 Console for con interaction.

File & Registry commands.

In-memory Powershell commands execution.

File download and upload commands.

Built-in discovery commands.

Screenshot taking, clipboard stealing, audio recording, and keylogger.

ETW & AMSI patching using indirect syscalls.

LSASS and SAM hashes dumping.

Shellcode injection using indirect syscalls.

Inline .NET assemblies execution.

Persistence capabilities.

UAC bypass methods.

Token impersonation and getsystem.

Setting implant process as critical (BSOD on termination).

(Linux) ELF loading using memfd in 2 modes.

And more !

Installation

Warning: Nimbo-C2 is meant to be run only within the provided Docker container

Easy Way

> Note that installing this way may cause problems or incompatibility in the future as the Docker image now doesn't enforces languages and libraries , so consider skipping to the next method.

1. Clone the repository and cd in

2. Build the docker image

3. cd again into the source files and run the docker image interactively, expose port 80 and mount Nimbo-C2 directory to the container (so you can easily access all project files, modify config.jsonc, download and upload files from agents, etc.). For Linux replace ${pwd} with $(pwd).

Easier Way

> Here we're using the already built, tested and stored Docker image - recommended.

For Linux replace ${pwd} with $(pwd).

Usage

First, edit config.jsonc for your needs.

Then run with: python3 Nimbo-C2.py

Use the help command for each screen, and tab completion.

Limitations, Warnings, Notes

E the HTTP communication is encrypted, the 'user-agent' header is in plain text and it carries the real agent id, which some products may flag it suspicious.

Wrap paths or arguments with spaces with double quoutes.

CLR works with primary access token so impersonate/getsys don't affect iex/assembly.

audio, lsass (except the E Twin method) commands temporarily sa to disk before exfiltrate and delete them.

If you tunnel the Nimbo server (e.g. if you expose it via Pinggy), use TCP, not HTTP.

Contribution

This software may be buggy or unstable in some use cases as it not being fully and constantly tested.
Feel free to open issues, PR's, and contact me for any reason at (Gmail | Linkedin)

项目信息

开发语言：Nim

Star 数：447

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Nimbo-C2 is yet another (simple and lightweight) C2 framework展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。