Many tools are written in PowerShell especially for red team activities as the majority of modern Windows are having PowerShell and usually administrators don’t restrict access to the PowerShell console for normal users. This give a great advantage to an attacker especially if PowerShell usage is not monitored by the blue team.
PoshC2 is a proxy aware C2 framework that utilises Powershell and/or equivalent (System.Management.Automation.dll) to aid penetration testers with red teaming, post-exploitation and lateral movement. Powershell was chosen as the base implant language as it provides all of the functionality and rich features without needing to introduce multiple third party libraries to the framework.
In addition to the Powershell implant, PoshC2 also has a basic dropper written purely in Python that can be used for command and control over Unix based systems such as Mac OS or Ubuntu.
The server-side component is written in Python for cross-platform portability and speed, a Powershell server component still exists and can be installed using the ‘Windows Install’ as shown below but will not be maintained with future updates and releases.
Features
PoshC2 has a large array of features. The following is a flavor of the kind of features you will find:
- Open Source
- Written in Powershell
- Proxy Aware
- Daisy Chaining of implants
- Team server allowing multiple operators access to implants
- Encrypted transport
- Domain fronting support
- SOCKS Proxy builtin
- Custom payload construction
- Task automation via auto runs
- Automigration on succesful delivery of new implant
- Multiple migration methods
- Fast C# based internal network port scanner
- Solid reporting capabilities
Linux Install of PoshC2_Python
Install using curl & bash
curl -sSL https://raw.githubusercontent.com/nettitude/PoshC2_Python/master/Install.sh | bash
Manual install
wget https://raw.githubusercontent.com/nettitude/PoshC2_Python/master/Install.sh
chmod +x ./Install.sh
./Install.sh
Windows Install of PoshC2
powershell -exec bypass -c "IEX (New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/nettitude/PoshC2/master/C2-Installer.ps1')"
Documentation
We maintain PoshC2 documentation over at https://poshc2.readthedocs.io/en/latest/
You can read more and download POSHC2 over here – https://github.com/nettitude/PoshC2
