Upload files to "rtc-c2"
This commit is contained in:
@@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2026 ek0ms savi0r
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
@@ -0,0 +1,47 @@
|
||||
.PHONY: all clean build build-linux build-windows test run-operator run-beacon deps
|
||||
|
||||
# Default
|
||||
all: build
|
||||
|
||||
# Build all targets
|
||||
build: build-linux build-windows
|
||||
|
||||
build-linux:
|
||||
@echo "Building Linux binaries..."
|
||||
GOOS=linux GOARCH=amd64 go build -o bin/beacon ./cmd/beacon/
|
||||
GOOS=linux GOARCH=amd64 go build -o bin/operator ./cmd/operator/
|
||||
|
||||
build-windows:
|
||||
@echo "Building Windows binaries..."
|
||||
GOOS=windows GOARCH=amd64 go build -o bin/beacon.exe ./cmd/beacon/
|
||||
GOOS=windows GOARCH=amd64 go build -o bin/operator.exe ./cmd/operator/
|
||||
|
||||
# Cross-compile
|
||||
build-arm64:
|
||||
GOOS=linux GOARCH=arm64 go build -o bin/beacon-arm64 ./cmd/beacon/
|
||||
GOOS=linux GOARCH=arm64 go build -o bin/operator-arm64 ./cmd/operator/
|
||||
|
||||
build-darwin:
|
||||
GOOS=darwin GOARCH=amd64 go build -o bin/beacon-darwin ./cmd/beacon/
|
||||
GOOS=darwin GOARCH=amd64 go build -o bin/operator-darwin ./cmd/operator/
|
||||
|
||||
# Quick dev test
|
||||
test:
|
||||
@echo "Running tests..."
|
||||
go test ./...
|
||||
|
||||
# Run in two terminals
|
||||
run-operator:
|
||||
./bin/operator -sig-addr :9090 -session rtc-c2-test
|
||||
|
||||
run-beacon:
|
||||
./bin/beacon -signaller http://127.0.0.1:9090 -session rtc-c2-test
|
||||
|
||||
# Clean artifacts
|
||||
clean:
|
||||
rm -rf bin/
|
||||
|
||||
# Dependencies
|
||||
deps:
|
||||
go mod tidy
|
||||
go mod verify
|
||||
@@ -0,0 +1,226 @@
|
||||
# rtc-c2
|
||||
|
||||
work in progress...check back for updates xo....
|
||||
|
||||
**WebRTC-based Command & Control framework.** Direct TCP forward over encrypted WebRTC data channels — like SSH `-L` style port forwarding, but nested inside DTLS tunnels.
|
||||
|
||||
```text
|
||||
┌─────────────────┐ ┌──────────────────────┐ ┌──────────────────┐
|
||||
│ Operator │ │ TURN/STUN Relay │ │ Beacon │
|
||||
│ (C2 Server) │───▶│ (Provider Infra) │◀───│ (Implant) │
|
||||
│ │ │ ── DTLS tunnel ──▶ │ │ │
|
||||
│ - Direct fwd │ │ Encrypted WebRTC │ │ - Task executor │
|
||||
│ - Task disptch │ │ data channel │ │ - Tunnel fwd │
|
||||
│ - Console │ │ Indistinguishable │ │ - Persistence │
|
||||
│ - WS signaller │ │ from video calls │ │ │
|
||||
└─────────────────┘ └──────────────────────┘ └──────────────────┘
|
||||
```
|
||||
# Disclaimer: For authorized security testing or educational purposes only.
|
||||
|
||||
---
|
||||
|
||||
## Features
|
||||
|
||||
| Component | Means |
|
||||
|-----------|-------|
|
||||
| Transport | Pion WebRTC + Google STUN |
|
||||
| Signaller | HTTP or **WebSocket** rendezvous (WS = stealthier) |
|
||||
| Tunnel | **Direct TCP forward** over WebRTC |
|
||||
| Protocol | JSON envelope over DTLS |
|
||||
|
||||
### Ghost Calls (Roadmap)
|
||||
|
||||
| Component | Means |
|
||||
|-----------|-------|
|
||||
| Transport | Provider TURN (Zoom/Google/Teams) |
|
||||
| Signaller | Meeting invitation protocol |
|
||||
| Tunnel | Direct TCP over provider media relay |
|
||||
| Auth | Meeting join credentials (ephemeral) |
|
||||
| Infra | **Zero** — no VPS, no domains, no certs |
|
||||
|
||||
## Requirements
|
||||
|
||||
- Go 1.21+
|
||||
|
||||
## Build
|
||||
|
||||
```bash
|
||||
git clone https://github.com/h0mi3e/rtc-c2
|
||||
cd rtc-c2
|
||||
make build
|
||||
```
|
||||
|
||||
Windows/Linux/macOS binaries in `bin/`.
|
||||
|
||||
## Quick Start
|
||||
|
||||
**Terminal 1 — Operator:**
|
||||
|
||||
```bash
|
||||
./bin/operator -sig-addr :9090 -session my-session
|
||||
```
|
||||
|
||||
**Terminal 2 — Beacon:**
|
||||
|
||||
```bash
|
||||
./bin/beacon -signaller http://127.0.0.1:9090 -session my-session
|
||||
```
|
||||
|
||||
Once a beacon connects:
|
||||
|
||||
```
|
||||
=== rtc-c2 Operator Console ===
|
||||
|
||||
> beacons
|
||||
Connected beacons (1):
|
||||
------------------------------------------------------------
|
||||
Beacon ID User@Host OS Arch
|
||||
------------------------------------------------------------
|
||||
hostname-1234... user@host linux amd64
|
||||
|
||||
> use hostname-1234
|
||||
[+] Using beacon abc123def456 (user@host)
|
||||
|
||||
> exec whoami
|
||||
[*] Task sent
|
||||
|
||||
> exec uname -a
|
||||
|
||||
> info
|
||||
|
||||
> back
|
||||
```
|
||||
|
||||
## Direct TCP Forward
|
||||
|
||||
Use the `forward` command for **direct TCP forwarding** through the beacon:
|
||||
|
||||
```bash
|
||||
# In operator console:
|
||||
> forward 127.0.0.1:4444 10.0.1.100:80
|
||||
[+] Forward: 127.0.0.1:4444 -> 10.0.1.100:80 (via active beacon)
|
||||
|
||||
> forwards
|
||||
Active forwards:
|
||||
127.0.0.1:4444 -> 10.0.1.100:80 (via beacon)
|
||||
```
|
||||
|
||||
Then in another terminal:
|
||||
|
||||
```bash
|
||||
# Point your browser/tool at localhost:4444
|
||||
curl http://127.0.0.1:4444/resource
|
||||
|
||||
# Or use --resolve for clean hostnames
|
||||
curl http://internal.corp/resource --resolve internal.corp:80:127.0.0.1
|
||||
```
|
||||
|
||||
Manage forwards:
|
||||
|
||||
```bash
|
||||
> forwards # list active forwards
|
||||
> stop-forward :4444 # stop a forward
|
||||
```
|
||||
|
||||
What's happening:
|
||||
1. Operator listens on `127.0.0.1:4444`
|
||||
2. Raw TCP data gets wrapped in WebRTC messages → sent to beacon
|
||||
3. Beacon connects to `10.0.1.100:80` and bridges the connection
|
||||
|
||||
## WebSocket Signaller
|
||||
|
||||
For stealthier SDP exchange, use WebSocket instead of HTTP polling:
|
||||
|
||||
```bash
|
||||
# Operator
|
||||
./bin/operator -sig-addr :9090 -session stealth -ws
|
||||
|
||||
# Beacon
|
||||
./bin/beacon -signaller http://127.0.0.1:9090 -session stealth -ws
|
||||
```
|
||||
|
||||
WebSocket signaller keeps a persistent connection — looks like a normal web app data feed instead of HTTP polling. Harder to detect as C2 traffic.
|
||||
|
||||
## Commands
|
||||
|
||||
### Operator Console
|
||||
|
||||
| Command | Description |
|
||||
|---------|-------------|
|
||||
| `beacons` | List connected beacons |
|
||||
| `use <id>` | Open interactive session with beacon |
|
||||
| `forward <local> <remote>` | Direct TCP forward (SSH -L style) |
|
||||
| `forwards` | List active forwards |
|
||||
| `stop-forward <local>` | Stop a forward listener |
|
||||
| `help` | Show help |
|
||||
| `exit` | Shut down |
|
||||
|
||||
### Beacon Session
|
||||
|
||||
| Command | Description |
|
||||
|---------|-------------|
|
||||
| `exec <cmd>` | Run command on beacon |
|
||||
| `info` | Get system info |
|
||||
| `whoami` | Get user identity |
|
||||
| `download <path>` | Download file from beacon |
|
||||
| `back` | Return to main menu |
|
||||
|
||||
## Project Structure
|
||||
|
||||
```
|
||||
rtc-c2/
|
||||
├── cmd/
|
||||
│ ├── operator/ # C2 server binary
|
||||
│ │ └── main.go
|
||||
│ └── beacon/ # Implant binary
|
||||
│ ├── main.go
|
||||
│ └── util.go
|
||||
├── pkg/
|
||||
│ ├── transport/ # WebRTC peer connection
|
||||
│ │ ├── config.go
|
||||
│ │ └── peer.go
|
||||
│ ├── signaller/ # SDP exchange (HTTP + WebSocket)
|
||||
│ │ ├── signaller.go
|
||||
│ │ └── websocket.go
|
||||
│ ├── protocol/ # C2 message protocol
|
||||
│ │ ├── message.go
|
||||
│ │ └── task.go
|
||||
│ └── tunnel/ # Direct TCP forward over WebRTC
|
||||
│ ├── listener.go # Operator-side forward listener
|
||||
│ └── forward.go # Beacon-side connection forwarder
|
||||
├── bin/ # Build output
|
||||
├── Makefile
|
||||
├── go.mod / go.sum
|
||||
└── README.md
|
||||
```
|
||||
|
||||
## Ghost Calls Roadmap
|
||||
|
||||
The long game is zero-infrastructure C2 by piggybacking on provider WebRTC infra:
|
||||
|
||||
- **Google Meet:** Create meeting via API → beacon joins → Google's TURN relays issued → everything runs through Google's infrastructure
|
||||
- **Jitsi Meet:** Self-hosted WebRTC — free, open, full control
|
||||
- **Zoom:** Reverse-engineer proprietary WebRTC auth flow
|
||||
- **Teams:** SAML/OAuth token → TURN relay auth
|
||||
|
||||
| Phase | What | Infra Needed |
|
||||
|-------|------|-------------|
|
||||
| 1 | Dev mode (HTTP/WS signaller) | LAN or same VPC |
|
||||
| 2 | Self-hosted TURN (coturn) | VPS with UDP open |
|
||||
| 3 | Jitsi Meet integration | Jitsi server or meet.jit.si |
|
||||
| 4 | Google Meet integration | None — just a Gmail bot |
|
||||
| 5 | Zoom + Teams | None — join existing infra |
|
||||
|
||||
## Adding New Task Types
|
||||
|
||||
1. Add a `TaskType` constant in `pkg/protocol/task.go`
|
||||
2. Add args struct if needed
|
||||
3. Add handler case in `beacon/main.go`'s `executeTask()`
|
||||
|
||||
---
|
||||
|
||||
Built by **ek0ms** — Church of Malware
|
||||
|
||||
## DISCLAIMER
|
||||
|
||||
For authorized Security Testing or Educational Purposes only.
|
||||
@@ -0,0 +1,32 @@
|
||||
module github.com/ek0ms/rtc-c2
|
||||
|
||||
go 1.26.2
|
||||
|
||||
require (
|
||||
github.com/gorilla/websocket v1.5.3
|
||||
github.com/pion/webrtc/v4 v4.2.12
|
||||
)
|
||||
|
||||
require (
|
||||
github.com/google/uuid v1.6.0 // indirect
|
||||
github.com/pion/datachannel v1.6.0 // indirect
|
||||
github.com/pion/dtls/v3 v3.1.2 // indirect
|
||||
github.com/pion/ice/v4 v4.2.5 // indirect
|
||||
github.com/pion/interceptor v0.1.44 // indirect
|
||||
github.com/pion/logging v0.2.4 // indirect
|
||||
github.com/pion/mdns/v2 v2.1.0 // indirect
|
||||
github.com/pion/randutil v0.1.0 // indirect
|
||||
github.com/pion/rtcp v1.2.16 // indirect
|
||||
github.com/pion/rtp v1.10.1 // indirect
|
||||
github.com/pion/sctp v1.9.5 // indirect
|
||||
github.com/pion/sdp/v3 v3.0.18 // indirect
|
||||
github.com/pion/srtp/v3 v3.0.10 // indirect
|
||||
github.com/pion/stun/v3 v3.1.2 // indirect
|
||||
github.com/pion/transport/v4 v4.0.1 // indirect
|
||||
github.com/pion/turn/v5 v5.0.3 // indirect
|
||||
github.com/wlynxg/anet v0.0.5 // indirect
|
||||
golang.org/x/crypto v0.48.0 // indirect
|
||||
golang.org/x/net v0.50.0 // indirect
|
||||
golang.org/x/sys v0.41.0 // indirect
|
||||
golang.org/x/time v0.14.0 // indirect
|
||||
)
|
||||
@@ -0,0 +1,58 @@
|
||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
|
||||
github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
|
||||
github.com/pion/datachannel v1.6.0 h1:XecBlj+cvsxhAMZWFfFcPyUaDZtd7IJvrXqlXD/53i0=
|
||||
github.com/pion/datachannel v1.6.0/go.mod h1:ur+wzYF8mWdC+Mkis5Thosk+u/VOL287apDNEbFpsIk=
|
||||
github.com/pion/dtls/v3 v3.1.2 h1:gqEdOUXLtCGW+afsBLO0LtDD8GnuBBjEy6HRtyofZTc=
|
||||
github.com/pion/dtls/v3 v3.1.2/go.mod h1:Hw/igcX4pdY69z1Hgv5x7wJFrUkdgHwAn/Q/uo7YHRo=
|
||||
github.com/pion/ice/v4 v4.2.5 h1:5umUQy4hX6HwMsCnJ0SX337YYCeTWDgC9JWyvUqHIHs=
|
||||
github.com/pion/ice/v4 v4.2.5/go.mod h1:aaABRaykEYnNjccjbiimuYxViaASeuv5mk9BpplUxK0=
|
||||
github.com/pion/interceptor v0.1.44 h1:sNlZwM8dWXU9JQAkJh8xrarC0Etn8Oolcniukmuy0/I=
|
||||
github.com/pion/interceptor v0.1.44/go.mod h1:4atVlBkcgXuUP+ykQF0qOCGU2j7pQzX2ofvPRFsY5RY=
|
||||
github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8=
|
||||
github.com/pion/logging v0.2.4/go.mod h1:DffhXTKYdNZU+KtJ5pyQDjvOAh/GsNSyv1lbkFbe3so=
|
||||
github.com/pion/mdns/v2 v2.1.0 h1:3IJ9+Xio6tWYjhN6WwuY142P/1jA0D5ERaIqawg/fOY=
|
||||
github.com/pion/mdns/v2 v2.1.0/go.mod h1:pcez23GdynwcfRU1977qKU0mDxSeucttSHbCSfFOd9A=
|
||||
github.com/pion/randutil v0.1.0 h1:CFG1UdESneORglEsnimhUjf33Rwjubwj6xfiOXBa3mA=
|
||||
github.com/pion/randutil v0.1.0/go.mod h1:XcJrSMMbbMRhASFVOlj/5hQial/Y8oH/HVo7TBZq+j8=
|
||||
github.com/pion/rtcp v1.2.16 h1:fk1B1dNW4hsI78XUCljZJlC4kZOPk67mNRuQ0fcEkSo=
|
||||
github.com/pion/rtcp v1.2.16/go.mod h1:/as7VKfYbs5NIb4h6muQ35kQF/J0ZVNz2Z3xKoCBYOo=
|
||||
github.com/pion/rtp v1.10.1 h1:xP1prZcCTUuhO2c83XtxyOHJteISg6o8iPsE2acaMtA=
|
||||
github.com/pion/rtp v1.10.1/go.mod h1:rF5nS1GqbR7H/TCpKwylzeq6yDM+MM6k+On5EgeThEM=
|
||||
github.com/pion/sctp v1.9.5 h1:QoSFB/drmAsmSeSFNQNI3xx010nW4HsycCZckRVWWag=
|
||||
github.com/pion/sctp v1.9.5/go.mod h1:N20Dq6LY+JvJDAh9VVh1JELngb2rQ8dPgds5yBWiPgw=
|
||||
github.com/pion/sdp/v3 v3.0.18 h1:l0bAXazKHpepazVdp+tPYnrsy9dfh7ZbT8DxesH5ZnI=
|
||||
github.com/pion/sdp/v3 v3.0.18/go.mod h1:ZREGo6A9ZygQ9XkqAj5xYCQtQpif0i6Pa81HOiAdqQ8=
|
||||
github.com/pion/srtp/v3 v3.0.10 h1:tFirkpBb3XccP5VEXLi50GqXhv5SKPxqrdlhDCJlZrQ=
|
||||
github.com/pion/srtp/v3 v3.0.10/go.mod h1:3mOTIB0cq9qlbn59V4ozvv9ClW/BSEbRp4cY0VtaR7M=
|
||||
github.com/pion/stun/v3 v3.1.2 h1:86IhD8wFn6IDW4b1/0QzoQS+f5PeA8OHHRn8UZW5ErY=
|
||||
github.com/pion/stun/v3 v3.1.2/go.mod h1:H7gDic7nNwlUL05pbs6T1dtaBehh/KjupxfWw3ZI7cA=
|
||||
github.com/pion/transport/v3 v3.1.1 h1:Tr684+fnnKlhPceU+ICdrw6KKkTms+5qHMgw6bIkYOM=
|
||||
github.com/pion/transport/v3 v3.1.1/go.mod h1:+c2eewC5WJQHiAA46fkMMzoYZSuGzA/7E2FPrOYHctQ=
|
||||
github.com/pion/transport/v4 v4.0.1 h1:sdROELU6BZ63Ab7FrOLn13M6YdJLY20wldXW2Cu2k8o=
|
||||
github.com/pion/transport/v4 v4.0.1/go.mod h1:nEuEA4AD5lPdcIegQDpVLgNoDGreqM/YqmEx3ovP4jM=
|
||||
github.com/pion/turn/v4 v4.1.4 h1:EU11yMXKIsK43FhcUnjLlrhE4nboHZq+TXBIi3QpcxQ=
|
||||
github.com/pion/turn/v4 v4.1.4/go.mod h1:ES1DXVFKnOhuDkqn9hn5VJlSWmZPaRJLyBXoOeO/BmQ=
|
||||
github.com/pion/turn/v5 v5.0.3 h1:I+Nw0fQgdPWF1SXDj0egWDhCkcff7gWiigdQpOK52Ak=
|
||||
github.com/pion/turn/v5 v5.0.3/go.mod h1:fs4SogUh/aRGQzonc4Lx3Jp4EU3j3t0PfNDEd9KcD/w=
|
||||
github.com/pion/webrtc/v4 v4.2.12 h1:ux8i+aJxu0OdhcAcVO39JEeodWugD0wdVJoRDtXk1CY=
|
||||
github.com/pion/webrtc/v4 v4.2.12/go.mod h1:M/DeGZkhdWZVmVgGr34HOD9yUDekVJtz9c9PGO18urQ=
|
||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
|
||||
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
|
||||
github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
|
||||
github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
|
||||
golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
|
||||
golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
|
||||
golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
|
||||
golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
|
||||
golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
|
||||
golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
|
||||
golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
|
||||
golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
Reference in New Issue
Block a user