C2 Framework

Minimal Windows C2 (command-and-control) framework written in C89/C90, no external dependencies, VC2008 compatible.

This project is provided solely for authorized security research, testing, and educational use in systems and environments that you own or are explicitly permitted to assess. You are solely responsible for complying with all applicable laws, regulations, and policies. The authors and contributors disclaim liability for any misuse, damage, or legal consequences resulting from the use of this software.

• Transport: AES-256-GCM (random 12-byte IV per packet, 16-byte auth tag)
• Key exchange: RSA-2048 OAEP (SHA-1 MGF1) - agent/controller each encrypt their AES-256 session key with their respective RSA public key; server decrypts with private key
• Keys: generated at build time by keygen.exe, embedded as C arrays in common/keys_agent.h, common/keys_ctrl.h, common/keys_server.h

Requires Visual C++ (VC2008 or later) and nmake.

nmake all

This will:

1. Build tools/keygen.exe
2. Run keygen to produce common/keys_*.h
3. Build agent.exe, server.exe, controller.exe

Clean:

nmake clean

1. Run server.exe on your C2 server (listens on ports 4444 for agents, 4445 for controllers)
   • The listener uses exclusive port binding on Windows. Starting a second server.exe while one is already bound to 4444 or 4445 now fails at startup with an explicit address already in use error.
2. Deploy agent.exe on target - connects back to example.com:4444, runs as a hidden background process (no console window)
3. Run controller.exe on operator machine - connects to example.com:4445

agents                    list connected agents
use <id>                  select agent by session id
ls [path]                 list directory on agent
cd [path]                 change agent working directory (no path: show cwd)
pwd                       print agent working directory
cat <path>                print file contents from agent
exec <cmd>                execute shell command on agent
shell                     open interactive shell (type ~. to detach)
upload <local> <remote>   upload file to agent
download <remote> <local> download file from agent
socks <port>              start local SOCKS5 proxy tunneled through agent
ping                      ping selected agent
exit                      quit

Remote relative paths are resolved against a per-controller working directory on the agent. cd updates that directory, pwd prints it, and ls, cat, exec, shell, upload, and download all use it.

[4 bytes]  plaintext length (big-endian)
[12 bytes] AES-GCM IV (random per packet)
[N bytes]  AES-256-GCM ciphertext  (PKT_HDR + payload)
[16 bytes] GCM authentication tag

The entire packet header (PKT_HDR) is included in the ciphertext. Key exchange packets (sent once at connection start) are plaintext RSA-encrypted blobs.

Detailed design documentation for each module: