GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → enkomio → AlanFramework

enkomio / AlanFramework

Licence: other
A C2 post-exploitation framework

Programming Languages

assembly
5116 projects
c
50402 projects - #5 most used programming language
shell
77523 projects
C#
18002 projects
python
139335 projects - #7 most used programming language
F#
602 projects

Labels

securityhackingpost-exploitationhacking-toolred-teamc2red-teamingsecurity-tool

Projects that are alternatives of or similar to AlanFramework

Bifrost
Bifrost C2. Open-source post-exploitation using Discord API
Stars: ✭ 37 (-90.86%)
Mutual labels:  post-exploitation, red-team, c2
hackarsenaltoolkit
Hacking arsenal. This script download the latest tools, wordlists, releases and install common hacking tools
Stars: ✭ 39 (-90.37%)
Mutual labels:  hacking-tool, red-team, red-teaming
palinka c2
Just another useless C2 occupying space in some HDD somewhere.
Stars: ✭ 14 (-96.54%)
Mutual labels:  red-team, c2, red-teaming
InlineWhispers2
Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2
Stars: ✭ 156 (-61.48%)
Mutual labels:  red-team, red-teaming
Teardroid-phprat
🇮🇳 🤖 It's easy to use android botnet work without port forwarding, vps and android studio
Stars: ✭ 417 (+2.96%)
Mutual labels:  post-exploitation, hacking-tool
venus
A Visual Studio Code Extension agent for Mythic C2
Stars: ✭ 47 (-88.4%)
Mutual labels:  post-exploitation, c2
Dumpsterfire
"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
Stars: ✭ 775 (+91.36%)
Mutual labels:  hacking-tool, red-team
Merlin
Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
Stars: ✭ 3,522 (+769.63%)
Mutual labels:  post-exploitation, c2
AdbNet
A tool that allows you to search for vulnerable android devices across the world and exploit them.
Stars: ✭ 112 (-72.35%)
Mutual labels:  post-exploitation, hacking-tool
JALSI
JALSI - Just Another Lame Shellcode Injector
Stars: ✭ 29 (-92.84%)
Mutual labels:  red-team, red-teaming
Hacker Roadmap
📌 Your beginner pen-testing start guide. A guide for amateur pen testers and a collection of hacking tools, resources and references to practice ethical hacking and web security.
Stars: ✭ 7,752 (+1814.07%)
Mutual labels:  post-exploitation, hacking-tool
MacOS-WPA-PSK
PoC script showing that MacOS leaves the wireless key in NVRAM, in plaintext and accessible to anyone.
Stars: ✭ 29 (-92.84%)
Mutual labels:  post-exploitation, red-team
XENA
XENA is the managed remote administration platform for botnet creation & development powered by blockchain and machine learning. Aiming to provide an ecosystem which serves the bot herders. Favoring secrecy and resiliency over performance. It's micro-service oriented allowing for specialization and lower footprint. Join the community of the ulti…
Stars: ✭ 127 (-68.64%)
Mutual labels:  post-exploitation, red-team
Blackmamba
C2/post-exploitation framework
Stars: ✭ 544 (+34.32%)
Mutual labels:  post-exploitation, red-team
Proton
Proton Framework is a Windows post-exploitation framework similar to other Windows post-exploitation frameworks. The major difference is that the Proton Framework does most of its operations using Windows Script Host, with compatibility in the core to support a default installation of Windows 2000 with no service packs all the way through Windows 10.
Stars: ✭ 142 (-64.94%)
Mutual labels:  post-exploitation, hacking-tool
Cloakify
CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings, using Text-Based Steganography; Evade DLP/MLS Devices, Defeat Data Whitelisting Controls, Social Engineering of Analysts, Evade AV Detection
Stars: ✭ 1,136 (+180.49%)
Mutual labels:  hacking-tool, red-team
Windows Post Exploitation
Windows post-exploitation tools, resources, techniques and commands to use during post-exploitation phase of penetration test. Contributions are appreciated. Enjoy!
Stars: ✭ 296 (-26.91%)
Mutual labels:  post-exploitation, hacking-tool
SpyGen
Trojan 🐍 (keylogger, take screenshots, open your webcam) 🔓
Stars: ✭ 115 (-71.6%)
Mutual labels:  hacking-tool, security-tool
Paradoxiarat
ParadoxiaRat : Native Windows Remote access Tool.
Stars: ✭ 395 (-2.47%)
Mutual labels:  hacking-tool, red-team
Emp3r0r
linux post-exploitation framework made by linux user
Stars: ✭ 419 (+3.46%)
Mutual labels:  post-exploitation, hacking-tool
View All Similar Projects ➔

Alan Framework

Alan Framework is a post-exploitation framework useful during red-team activities.

If you find my tool useful, please consider to sponsor me.

⚠⚠⚠ Disclaimer ⚠⚠⚠

The creation of this kind of software has always caused controversies. If you're wondering why I decided to create this tool, it's because I'm convinced that the ultimate learning experience is implementing what you learned. During the reverse engineering process, many small details are overlooked. Little by little, these details prevent the researcher from having a complete picture of what is going on. Finally, I'm a programmer first, and I love to develop this kind of program 😄

Download

Download Alan C2 Framework

Notable Features

  • You can run your preferred tool directly in-memory
  • JavaScript script execution (in-memory without third party dependency)
  • Fully compliant SOCKS5 proxy
  • Supported agent types: Powershell (x86/x64), DLL (x86/x64), Executable (x86/x64), Shellcode (x86/x64)
  • Server.exe can be executed in Linux (via dotnet core)
  • The network communication is fully encrypted with a session key not recoverable from the agent binary or from a traffic dump
  • Communication performed via HTTP/HTTPS
  • No external dependencies or libraries need to be installed
  • A powerful command shell
  • The agent configuration can be updated on the fly (you can change port and protocol too)

Documentation:

Blog posts

For more information on its usage please read the documentation.

Compile the source code

To compile Alan the following actions must be performed:

  • Ensure that you have installed cmake and that it is in the PATH (run cmake --help to see if it works)
  • Install Visual Studio 2022 (the Community Edition is fine). These steps were tested against version VS 2022 17.3.1
  • Be sure that .NET Desktop Development, Desktop development with C++ and the F# language are installed as part of the Visual Studio suite
  • Install .NET libraries by running: ./src/server/paket.exe install
  • Open the file .src/server/ServerSln.sln in Visual Studio. Set the ServerBuilder project as the main one (right click -> Set as Startup Project)
  • Run the ServerBuilder which will compile everything
  • If the compilation ended succesfully, the Alan .zip file will be located in the newly created directory Misc/out/release

Videos:

Demo videos

Alan v7.0.514.10 - SOCKS5 Proxy Alan C2 Framework v7.0, codename: Hyper-Pivoting Alan v6.0.511.28 - JS Execution Alan C2 Framework 6.0 - Alan + JavaScript = ♡ Alan v5.0.509.20 - In-Memory Execution Alan 5.0 C2 Framework - All You Can In-Memory Edition
Alan v4.0.0 - x64 Agent && Inject Alan post-exploitation framework v4.0 demo Alan v3.0.0 - Misc Commands Alan v3.0 - Post-Exploitation Framework Alan v2.0.500.23 Alan post-exploitation framework - Update the agent profile at runtime
Alan v1.0.0 Alan v1.0 - A Post-Exploitation Framework

Changelog

v7.0.514.10 - 15/05/2022

  • Implemented proxy command for pivoting
  • The info and info++ commands display if the agent is using a proxy
  • Fixed bug on network communication (Issue 2)
  • Fixed error in PE loader when function are import via ordinal
  • Fixed JS module causing memory free ahead of time
  • Fixed error in run command that cause the & option to not work
  • The log messages are now saved to file alan.log
  • All the generated output and user input is logged to an evidence file inside the evidences folder
  • Added machine ID information to info command
  • Added Vanilla package type for agent creation. This allows a better integration of custom packer.

v6.0.511.28 24/02/2022

  • x86/x64 PE loaders modified to update the PEB->Ldr field. This allows the system to call DLL_PROCESS_DETACH on the injected DLL.
  • Increase max response size to 1GB. This fix the download of big files.
  • Added agent expiration date to the configuration.
  • The run was extended to support the execution of Javascript files.
  • info++ command now shows the Volume label and the FS type.

v5.0.509.20 - 13/12/2021

  • Implemented run command
  • Implemented kill command
  • Implemented exec command
  • Removed inject message since it can be achieved with the run command in background
  • Created stager and PE loader to make the agent stealthier. Each generated agent file has a different hash
  • Improved code injection to bypass Dynamic Code Policy Mitigation
  • It is now possible to specify the agent file name to create during the wizard
  • Fixed error in upload and download commands
  • Fixed error in shell creation. The command shell process token did not have the same agent integrity level
  • Removed exported function from DLL agent artifact
  • Added current working directory to info command
  • Extended shell command to execute a single command

v4.0.0 - 26/09/2021

  • Added inject command. This command allows the operator to inject code into a remote process
  • Added sleep command performed in short sleep of 400 msec each.
  • Introduced Jitter concept in sleep
  • Ported agent to x64 bit (included PE32+ loader)
  • Fixed errors in x86 PE loader
  • .NET agent runner is now executed in a stealthier way to avoid detection
  • It is now possible to specify a custom Web server in the HTTP/S listener response
  • Removed command listeners since superfluous
  • Improved info command with more information
  • Error message are more explanatory
  • Added information on process token type (elevated or not)
  • Added information on process token privileges
  • Added information on process token groups

v3.0.0 - 15/05/2021

  • Renamed agent shell quit command to exit
  • Implemented agent migration via migrate command
  • Fixed error in retrieving OS version
  • Added DLL as agent format in the creation wizard.
  • Implemented ps command to list the currently running processes
  • Implemented download command to locally download a file or an entire directory
  • Implemented upload command to upload files to the compromised host
  • Implemented SuccessRequest as HTTP server response option to customize the http/s listener response
  • Implemented ErrorRequest to customize the http/s listener response for bad requests
  • Implemented prepend and append as HTTP server request option to specify in the agent prof

v2.0.500.23 - 20/03/2021

  • Implemented agent detach command to temporary exit from a joined agent
  • Implemented shell detach command to temporary exit from a command shell
  • Implemented listeners command to list the available listeners
  • Implemented HTTPS listener to communicatewith the agent via TLS
  • Implemented get-config command to download the current agent configuration
  • Implemented update command to update the agent configuration
  • Windows7 is now supported

v1.0.0 - 22/02/2021

  • First Release
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].