From d991a4ef81a072e3c439a8b187ae98f122343cc0 Mon Sep 17 00:00:00 2001 From: ek0ms savi0r Date: Wed, 10 Jun 2026 17:14:52 +0000 Subject: [PATCH] Upload files to "rtc-c2" --- rtc-c2/LICENSE | 21 +++++ rtc-c2/Makefile | 47 ++++++++++ rtc-c2/README.md | 226 +++++++++++++++++++++++++++++++++++++++++++++++ rtc-c2/go.mod | 32 +++++++ rtc-c2/go.sum | 58 ++++++++++++ 5 files changed, 384 insertions(+) create mode 100644 rtc-c2/LICENSE create mode 100644 rtc-c2/Makefile create mode 100644 rtc-c2/README.md create mode 100644 rtc-c2/go.mod create mode 100644 rtc-c2/go.sum diff --git a/rtc-c2/LICENSE b/rtc-c2/LICENSE new file mode 100644 index 0000000..0bbfbfe --- /dev/null +++ b/rtc-c2/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 ek0ms savi0r + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/rtc-c2/Makefile b/rtc-c2/Makefile new file mode 100644 index 0000000..e5b36a2 --- /dev/null +++ b/rtc-c2/Makefile @@ -0,0 +1,47 @@ +.PHONY: all clean build build-linux build-windows test run-operator run-beacon deps + +# Default +all: build + +# Build all targets +build: build-linux build-windows + +build-linux: + @echo "Building Linux binaries..." + GOOS=linux GOARCH=amd64 go build -o bin/beacon ./cmd/beacon/ + GOOS=linux GOARCH=amd64 go build -o bin/operator ./cmd/operator/ + +build-windows: + @echo "Building Windows binaries..." + GOOS=windows GOARCH=amd64 go build -o bin/beacon.exe ./cmd/beacon/ + GOOS=windows GOARCH=amd64 go build -o bin/operator.exe ./cmd/operator/ + +# Cross-compile +build-arm64: + GOOS=linux GOARCH=arm64 go build -o bin/beacon-arm64 ./cmd/beacon/ + GOOS=linux GOARCH=arm64 go build -o bin/operator-arm64 ./cmd/operator/ + +build-darwin: + GOOS=darwin GOARCH=amd64 go build -o bin/beacon-darwin ./cmd/beacon/ + GOOS=darwin GOARCH=amd64 go build -o bin/operator-darwin ./cmd/operator/ + +# Quick dev test +test: + @echo "Running tests..." + go test ./... + +# Run in two terminals +run-operator: + ./bin/operator -sig-addr :9090 -session rtc-c2-test + +run-beacon: + ./bin/beacon -signaller http://127.0.0.1:9090 -session rtc-c2-test + +# Clean artifacts +clean: + rm -rf bin/ + +# Dependencies +deps: + go mod tidy + go mod verify diff --git a/rtc-c2/README.md b/rtc-c2/README.md new file mode 100644 index 0000000..85ac53a --- /dev/null +++ b/rtc-c2/README.md @@ -0,0 +1,226 @@ +# rtc-c2 + +work in progress...check back for updates xo.... + +**WebRTC-based Command & Control framework.** Direct TCP forward over encrypted WebRTC data channels — like SSH `-L` style port forwarding, but nested inside DTLS tunnels. + +```text +┌─────────────────┐ ┌──────────────────────┐ ┌──────────────────┐ +│ Operator │ │ TURN/STUN Relay │ │ Beacon │ +│ (C2 Server) │───▶│ (Provider Infra) │◀───│ (Implant) │ +│ │ │ ── DTLS tunnel ──▶ │ │ │ +│ - Direct fwd │ │ Encrypted WebRTC │ │ - Task executor │ +│ - Task disptch │ │ data channel │ │ - Tunnel fwd │ +│ - Console │ │ Indistinguishable │ │ - Persistence │ +│ - WS signaller │ │ from video calls │ │ │ +└─────────────────┘ └──────────────────────┘ └──────────────────┘ +``` +# Disclaimer: For authorized security testing or educational purposes only. + +--- + +## Features + +| Component | Means | +|-----------|-------| +| Transport | Pion WebRTC + Google STUN | +| Signaller | HTTP or **WebSocket** rendezvous (WS = stealthier) | +| Tunnel | **Direct TCP forward** over WebRTC | +| Protocol | JSON envelope over DTLS | + +### Ghost Calls (Roadmap) + +| Component | Means | +|-----------|-------| +| Transport | Provider TURN (Zoom/Google/Teams) | +| Signaller | Meeting invitation protocol | +| Tunnel | Direct TCP over provider media relay | +| Auth | Meeting join credentials (ephemeral) | +| Infra | **Zero** — no VPS, no domains, no certs | + +## Requirements + +- Go 1.21+ + +## Build + +```bash +git clone https://github.com/h0mi3e/rtc-c2 +cd rtc-c2 +make build +``` + +Windows/Linux/macOS binaries in `bin/`. + +## Quick Start + +**Terminal 1 — Operator:** + +```bash +./bin/operator -sig-addr :9090 -session my-session +``` + +**Terminal 2 — Beacon:** + +```bash +./bin/beacon -signaller http://127.0.0.1:9090 -session my-session +``` + +Once a beacon connects: + +``` +=== rtc-c2 Operator Console === + +> beacons +Connected beacons (1): +------------------------------------------------------------ +Beacon ID User@Host OS Arch +------------------------------------------------------------ +hostname-1234... user@host linux amd64 + +> use hostname-1234 +[+] Using beacon abc123def456 (user@host) + + > exec whoami + [*] Task sent + + > exec uname -a + + > info + + > back +``` + +## Direct TCP Forward + +Use the `forward` command for **direct TCP forwarding** through the beacon: + +```bash +# In operator console: +> forward 127.0.0.1:4444 10.0.1.100:80 +[+] Forward: 127.0.0.1:4444 -> 10.0.1.100:80 (via active beacon) + +> forwards +Active forwards: + 127.0.0.1:4444 -> 10.0.1.100:80 (via beacon) +``` + +Then in another terminal: + +```bash +# Point your browser/tool at localhost:4444 +curl http://127.0.0.1:4444/resource + +# Or use --resolve for clean hostnames +curl http://internal.corp/resource --resolve internal.corp:80:127.0.0.1 +``` + +Manage forwards: + +```bash +> forwards # list active forwards +> stop-forward :4444 # stop a forward +``` + +What's happening: +1. Operator listens on `127.0.0.1:4444` +2. Raw TCP data gets wrapped in WebRTC messages → sent to beacon +3. Beacon connects to `10.0.1.100:80` and bridges the connection + +## WebSocket Signaller + +For stealthier SDP exchange, use WebSocket instead of HTTP polling: + +```bash +# Operator +./bin/operator -sig-addr :9090 -session stealth -ws + +# Beacon +./bin/beacon -signaller http://127.0.0.1:9090 -session stealth -ws +``` + +WebSocket signaller keeps a persistent connection — looks like a normal web app data feed instead of HTTP polling. Harder to detect as C2 traffic. + +## Commands + +### Operator Console + +| Command | Description | +|---------|-------------| +| `beacons` | List connected beacons | +| `use ` | Open interactive session with beacon | +| `forward ` | Direct TCP forward (SSH -L style) | +| `forwards` | List active forwards | +| `stop-forward ` | Stop a forward listener | +| `help` | Show help | +| `exit` | Shut down | + +### Beacon Session + +| Command | Description | +|---------|-------------| +| `exec ` | Run command on beacon | +| `info` | Get system info | +| `whoami` | Get user identity | +| `download ` | Download file from beacon | +| `back` | Return to main menu | + +## Project Structure + +``` +rtc-c2/ +├── cmd/ +│ ├── operator/ # C2 server binary +│ │ └── main.go +│ └── beacon/ # Implant binary +│ ├── main.go +│ └── util.go +├── pkg/ +│ ├── transport/ # WebRTC peer connection +│ │ ├── config.go +│ │ └── peer.go +│ ├── signaller/ # SDP exchange (HTTP + WebSocket) +│ │ ├── signaller.go +│ │ └── websocket.go +│ ├── protocol/ # C2 message protocol +│ │ ├── message.go +│ │ └── task.go +│ └── tunnel/ # Direct TCP forward over WebRTC +│ ├── listener.go # Operator-side forward listener +│ └── forward.go # Beacon-side connection forwarder +├── bin/ # Build output +├── Makefile +├── go.mod / go.sum +└── README.md +``` + +## Ghost Calls Roadmap + +The long game is zero-infrastructure C2 by piggybacking on provider WebRTC infra: + +- **Google Meet:** Create meeting via API → beacon joins → Google's TURN relays issued → everything runs through Google's infrastructure +- **Jitsi Meet:** Self-hosted WebRTC — free, open, full control +- **Zoom:** Reverse-engineer proprietary WebRTC auth flow +- **Teams:** SAML/OAuth token → TURN relay auth + +| Phase | What | Infra Needed | +|-------|------|-------------| +| 1 | Dev mode (HTTP/WS signaller) | LAN or same VPC | +| 2 | Self-hosted TURN (coturn) | VPS with UDP open | +| 3 | Jitsi Meet integration | Jitsi server or meet.jit.si | +| 4 | Google Meet integration | None — just a Gmail bot | +| 5 | Zoom + Teams | None — join existing infra | + +## Adding New Task Types + +1. Add a `TaskType` constant in `pkg/protocol/task.go` +2. Add args struct if needed +3. Add handler case in `beacon/main.go`'s `executeTask()` + +--- + +Built by **ek0ms** — Church of Malware + +## DISCLAIMER + +For authorized Security Testing or Educational Purposes only. diff --git a/rtc-c2/go.mod b/rtc-c2/go.mod new file mode 100644 index 0000000..beefcd3 --- /dev/null +++ b/rtc-c2/go.mod @@ -0,0 +1,32 @@ +module github.com/ek0ms/rtc-c2 + +go 1.26.2 + +require ( + github.com/gorilla/websocket v1.5.3 + github.com/pion/webrtc/v4 v4.2.12 +) + +require ( + github.com/google/uuid v1.6.0 // indirect + github.com/pion/datachannel v1.6.0 // indirect + github.com/pion/dtls/v3 v3.1.2 // indirect + github.com/pion/ice/v4 v4.2.5 // indirect + github.com/pion/interceptor v0.1.44 // indirect + github.com/pion/logging v0.2.4 // indirect + github.com/pion/mdns/v2 v2.1.0 // indirect + github.com/pion/randutil v0.1.0 // indirect + github.com/pion/rtcp v1.2.16 // indirect + github.com/pion/rtp v1.10.1 // indirect + github.com/pion/sctp v1.9.5 // indirect + github.com/pion/sdp/v3 v3.0.18 // indirect + github.com/pion/srtp/v3 v3.0.10 // indirect + github.com/pion/stun/v3 v3.1.2 // indirect + github.com/pion/transport/v4 v4.0.1 // indirect + github.com/pion/turn/v5 v5.0.3 // indirect + github.com/wlynxg/anet v0.0.5 // indirect + golang.org/x/crypto v0.48.0 // indirect + golang.org/x/net v0.50.0 // indirect + golang.org/x/sys v0.41.0 // indirect + golang.org/x/time v0.14.0 // indirect +) diff --git a/rtc-c2/go.sum b/rtc-c2/go.sum new file mode 100644 index 0000000..d023e01 --- /dev/null +++ b/rtc-c2/go.sum @@ -0,0 +1,58 @@ +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg= +github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= +github.com/pion/datachannel v1.6.0 h1:XecBlj+cvsxhAMZWFfFcPyUaDZtd7IJvrXqlXD/53i0= +github.com/pion/datachannel v1.6.0/go.mod h1:ur+wzYF8mWdC+Mkis5Thosk+u/VOL287apDNEbFpsIk= +github.com/pion/dtls/v3 v3.1.2 h1:gqEdOUXLtCGW+afsBLO0LtDD8GnuBBjEy6HRtyofZTc= +github.com/pion/dtls/v3 v3.1.2/go.mod h1:Hw/igcX4pdY69z1Hgv5x7wJFrUkdgHwAn/Q/uo7YHRo= +github.com/pion/ice/v4 v4.2.5 h1:5umUQy4hX6HwMsCnJ0SX337YYCeTWDgC9JWyvUqHIHs= +github.com/pion/ice/v4 v4.2.5/go.mod h1:aaABRaykEYnNjccjbiimuYxViaASeuv5mk9BpplUxK0= +github.com/pion/interceptor v0.1.44 h1:sNlZwM8dWXU9JQAkJh8xrarC0Etn8Oolcniukmuy0/I= +github.com/pion/interceptor v0.1.44/go.mod h1:4atVlBkcgXuUP+ykQF0qOCGU2j7pQzX2ofvPRFsY5RY= +github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8= +github.com/pion/logging v0.2.4/go.mod h1:DffhXTKYdNZU+KtJ5pyQDjvOAh/GsNSyv1lbkFbe3so= +github.com/pion/mdns/v2 v2.1.0 h1:3IJ9+Xio6tWYjhN6WwuY142P/1jA0D5ERaIqawg/fOY= +github.com/pion/mdns/v2 v2.1.0/go.mod h1:pcez23GdynwcfRU1977qKU0mDxSeucttSHbCSfFOd9A= +github.com/pion/randutil v0.1.0 h1:CFG1UdESneORglEsnimhUjf33Rwjubwj6xfiOXBa3mA= +github.com/pion/randutil v0.1.0/go.mod h1:XcJrSMMbbMRhASFVOlj/5hQial/Y8oH/HVo7TBZq+j8= +github.com/pion/rtcp v1.2.16 h1:fk1B1dNW4hsI78XUCljZJlC4kZOPk67mNRuQ0fcEkSo= +github.com/pion/rtcp v1.2.16/go.mod h1:/as7VKfYbs5NIb4h6muQ35kQF/J0ZVNz2Z3xKoCBYOo= +github.com/pion/rtp v1.10.1 h1:xP1prZcCTUuhO2c83XtxyOHJteISg6o8iPsE2acaMtA= +github.com/pion/rtp v1.10.1/go.mod h1:rF5nS1GqbR7H/TCpKwylzeq6yDM+MM6k+On5EgeThEM= +github.com/pion/sctp v1.9.5 h1:QoSFB/drmAsmSeSFNQNI3xx010nW4HsycCZckRVWWag= +github.com/pion/sctp v1.9.5/go.mod h1:N20Dq6LY+JvJDAh9VVh1JELngb2rQ8dPgds5yBWiPgw= +github.com/pion/sdp/v3 v3.0.18 h1:l0bAXazKHpepazVdp+tPYnrsy9dfh7ZbT8DxesH5ZnI= +github.com/pion/sdp/v3 v3.0.18/go.mod h1:ZREGo6A9ZygQ9XkqAj5xYCQtQpif0i6Pa81HOiAdqQ8= +github.com/pion/srtp/v3 v3.0.10 h1:tFirkpBb3XccP5VEXLi50GqXhv5SKPxqrdlhDCJlZrQ= +github.com/pion/srtp/v3 v3.0.10/go.mod h1:3mOTIB0cq9qlbn59V4ozvv9ClW/BSEbRp4cY0VtaR7M= +github.com/pion/stun/v3 v3.1.2 h1:86IhD8wFn6IDW4b1/0QzoQS+f5PeA8OHHRn8UZW5ErY= +github.com/pion/stun/v3 v3.1.2/go.mod h1:H7gDic7nNwlUL05pbs6T1dtaBehh/KjupxfWw3ZI7cA= +github.com/pion/transport/v3 v3.1.1 h1:Tr684+fnnKlhPceU+ICdrw6KKkTms+5qHMgw6bIkYOM= +github.com/pion/transport/v3 v3.1.1/go.mod h1:+c2eewC5WJQHiAA46fkMMzoYZSuGzA/7E2FPrOYHctQ= +github.com/pion/transport/v4 v4.0.1 h1:sdROELU6BZ63Ab7FrOLn13M6YdJLY20wldXW2Cu2k8o= +github.com/pion/transport/v4 v4.0.1/go.mod h1:nEuEA4AD5lPdcIegQDpVLgNoDGreqM/YqmEx3ovP4jM= +github.com/pion/turn/v4 v4.1.4 h1:EU11yMXKIsK43FhcUnjLlrhE4nboHZq+TXBIi3QpcxQ= +github.com/pion/turn/v4 v4.1.4/go.mod h1:ES1DXVFKnOhuDkqn9hn5VJlSWmZPaRJLyBXoOeO/BmQ= +github.com/pion/turn/v5 v5.0.3 h1:I+Nw0fQgdPWF1SXDj0egWDhCkcff7gWiigdQpOK52Ak= +github.com/pion/turn/v5 v5.0.3/go.mod h1:fs4SogUh/aRGQzonc4Lx3Jp4EU3j3t0PfNDEd9KcD/w= +github.com/pion/webrtc/v4 v4.2.12 h1:ux8i+aJxu0OdhcAcVO39JEeodWugD0wdVJoRDtXk1CY= +github.com/pion/webrtc/v4 v4.2.12/go.mod h1:M/DeGZkhdWZVmVgGr34HOD9yUDekVJtz9c9PGO18urQ= +github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU= +github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA= +golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts= +golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos= +golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60= +golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM= +golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= +golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= +golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=