DIY C2 - Malleable Agent Config

[@Nikolas-mq8bp]

I always watch the videos, but I never comment, that type of video is gold! Please continue!

[@ippsec]

Thanks for the comment!

[@gokul6120]

Absolutely... Conceptual.. 👍👍👍👍

[@ns-yz1hj]

Awesome video! The way you explain things is interesting and easy to understand. It's sometimes hard to find content that talks about more advanced concepts. You can find a million videos and articles on "how to make a meterpreter backdoor" but your videos are in depth.

[@TheBrowserPirates]

This is pure gold content, thanks for making these kind of videos

[@wkppp4732]

Back to back ippsec vid! Nice. Thanks for the vid ipp!

[@jeffstanley2972]

Cool video! I’ve been working with my company to try and implement C2 infrastructure using MQTT.

[@rara4]

Very interesting video, the quality never ceases to amaze me

[@playmaker1011]

Thanks a lot IppSec, awesome content!🔥🔥🔥

[@Pernat1y]

I recently tried to patch binary files using Python, so the video is really useful. Thanks :)

[@chai116]

2 problems with the decrypt function in the agent: should be modulo 256, otherwise both 0 and 0xff become 0. And it's currently impossible to encrypt the character Q because that will xor into a zero byte and stop the decrypt early. Maybe encode a length field at the start of the string so you know how far to decrypt? Or just decrypt the whole 2000 everytime?

[@amieemaya9472]

Liking without seeing the video first!!!

[@emilsrbrden2987]

Yes! Great job, looking forward to more

[@surenavdalyan6036]

Ippsec Rocks!!!!!!!!!!

[@fowzmasood23]

Bestttttttttt. Ippsec Rocks 👌👌👌🔥🔥🔥😍😍😍

[@krisztiankovacs5221]

Thanks for the video man! Hope you'll stick with the idea and make more reverse engineering/DIY low level coding! Much obliged!

[@deansmith5007]

Whoop whoop

[@deansmith5007]

1st comment

[@oscare2676]

A simpler way to loop through the config string in your xor function would be using a while loop, this way you can loop through the string until it hit the null terminator and doesn't require you to add the 0xFF byte and overcomplicate it. Also to add there is no need to modulus the XOR'd character as it is impossible for it to go over 0xFF. while( char c = *encString++) decString += ( c ^ key );

[@ippsec]

Yeah the downside is the xor can create the null that you want. The snippet is mostly from another piece of code but I removed the multibyte key and detection. For this your method is probably better, and I want to say I chose this way purposely but in reality I was just pulling from some previous code of mine, then making it less dangerous

[@cybersecurity3523]

Good job bro

[@varunkumar6223]

char str[2000] is same as const std::string str(2000); at the core both are arrays

[@maoropizzagalli4153]

Great video series concept I love it ! I am a vim lover don't get me wrong but it would be way easier in codium or something

[@hellsing0999999999]

Heymen! I'm trying to learn to code but just wanted to let you know, your voice is really, REALLY similar to another youtuber called ChainBrain, a rocksmith streamer lol.

[@zuiokopl2256]

Whats happening in this video?

[@xdgtwjk23_rtfd]

Would I be right if I think this is inspired from the recent C2 drama on Twitter?

[@ippsec]

If you go through my tweets even before the drama, I've been pretty vocal over my dislike of the "pay for opsec" companies (ex: twitter.com/ippsec/status/1378521632814288904). This is trying to provide help to the people on the receiving end of that software.

[@satanicdominion666]

this could be an interesting thing to turn into options rather than configs lol

[@thev01d12]

I tried googling for some resources to develop c2 but couldn't find anything, anyone have any resources to learn the fundamentals about these things so i could get started

[@theseenandunseen]

Could you please reference the fork you mention at 2:48? Looks very familiar. Thanks.

[@ippsec]

I was just saying the base webapp theme came from a SilentBreakSecurity course, by fork I meant its just my private copy that I continued playing with after the course. It was an extremely basic stage1, I redid the agent but haven't got a chance to redoing the website because I hate creating gui's/websites. If I remember correctly, I added the malleable config/file hosting and changed how module loading operates. The agent was a complete redesign to better evade AV/EDR.

[@theseenandunseen]

@@ippsec I see. Well, I hate creating gui's as well. Thank you for your input. Keep up the great work

[@stock99]

can this be rewritten in different language such as python or js and achieving the similar result?

[@BLACK10GHOST]

I just like this shit!

[@N4dirCh]

Sunday Live Night

[@devotee9606]

does c2 means Command and control server?

[@ippsec]

Yes

[@mohameai5997]

0 dislikes 👌

[@alessandrodegregori4525]

When I will take the OSCP exam, I will write "PleaseSubscribe" everywhere! and I will use as payload "echo \"Thank You for subscribing to ippsec channel and leave a comment\""