8. RAT/C2 Tool Development
8.1 CobaltStrike: In-the-Field Feature Removal for Evasion
Plugin Development (BOF/CNA)
| Tool | Function |
|---|---|
| LSTAR | Comprehensive reconnaissance |
| OperatorsKit | Ops tooling |
| CS-AutoPostChain | Automated post-exploitation |
| Ghosting-BOF | - |
| WindowSpy | Window monitoring |
| CS-Remote-OPs-BOF | Remote operations |
| PrivKit | Privilege escalation |
| PPEnum | Permission enumeration |
| Chisel-Strike | Tunneling |
| cmstplua-uac-bypass | UAC bypass |
| CSx4Ldr | Loader |
| AceLdr | Position-independent code loading |
| bof-vs | VS BOF template |
| No-Consolation | Console hiding |
| BOF-patchit | In-memory patching |
| ScreenShot-BOF | Screenshot |
| SCMUACBypass | SCM UAC bypass |
| Slacker | - |
| Mockingjay_BOF | - |
| ScreenshotBOFPlus | - |
| DropSpawn_BOF | - |
| HiddenDesktop | Hidden desktop |
| whereami | Geolocation |
| Cookie-and-Handle-Stealer | Credential theft |
BOF development reference: bof_helper / Visual-Studio-BOF-template
Server Configuration
- Disable ping:
/etc/sysctl.conf→net.ipv4.icmp_echo_ignore_all=1 - CDN: free Cloudflare account
Beacon Modification
Core fingerprint modification:
1. Modify the key: OriginKey → CustomizeKey
2. Profile:
- strrep "beacon.x64.dll" "" (modify the keyword)
- set magic_mz_x86 "1234"; set magic_mz_x64 "5678" (modify the MZ header)
- set magic_pe "BB" (modify the PE header)
- set cleanup "true" (remove the original Beacon DLL)
- set obfuscate "true" (strip the DLL header)
- set userwx "false" (no writable memory)
3. SleepMask: modify the key and XOR logic
- change the key in my_mask_section to "cf81d743beef8422"
- modify the MSSE pipe signature
4. Beacon replacements: [geacon_plus](https://github.com/Z3ratu1/geacon_plus) / [beacon-rust](https://github.com/b1tg/cobaltstrike-beacon-rust) / [Beacon.dll](https://github.com/NoOne-hub/Beacon.dll)(light reverse engineering) / [Beacon_Source](https://github.com/kyxiaxiang/Beacon_Source)
Profile tools: Burp2Malleable / C2concealer / GraphStrike / goMalleable / pyMalleableC2 / JustC2file
BeaconEye detection signature: 6A 00
8.2 Secondary Development of Traffic Forwarding Tools
Modification methods:
| Aspect | Specific operation |
|------|---------|
| Modify UA header | UA reference / User-Agent Switcher and Manager extension |
| Config file self-deletion | Hardcode config into main (XOR-encrypt ip/port) / os.Remove(cfgFile) after config |
| Remote config loading | - |
| TLS fingerprint | burp-awesome-tls / frp pkg/util/net/tls.go |
| Domain fronting | pkg/util/net/websocket.go + CDN configured to fall back to origin HTTP |
| Uncommon outbound protocol | QUIC: transport.protocol = "quic" |
| Protobuf plugin | frp protobuf support |
| Custom encryption | ChaCha20 / XOR / complex encryption for config file auth + simple traffic packet encryption (otherwise it lags) |
| Remove hardcoding | salt/json data → may crash, needs dynamic debugging / auth fingerprint (models/msg/msg.go) / FrpWebsocketPath = "/~!frp" |
| Compile-time obfuscation and packing | UPX / garble / go-strip |
| DLL loading | - |
| Signature spoofing | Sign-Sacker |
Framework structure learning approach (using fscan as an example):
common → data parsing / structs / variable storage
plugins → plugins (start understanding the project by writing plugins)
webscan → web scanning (framework fingerprinting / dispatch flow)
Key functions: read the framework logic forward (modify the framework) → set breakpoints and trace calls backward (modify plugins)
Dynamic debugging + encryption/decryption with log output
8.3 Godzilla Feature Removal
Custom traffic encryption: - Remove MD5 check: core/ApplicationConfig.java - Remove HTTP header fingerprint - Change key to last 16 characters: ShellEntity.getSecretKeyX + encryption class .generate
Custom command execution: - Modify execCommand: copy cmd to a temp directory, execute, and delete - Modify default variable names - Recompile then replace payload.dll - Modify ShellExecCommandPanel default command
WebShell feature removal: - Modify reflection Load method name and GetMethod to bypass signatures (same for Java/C#) - Modify other variables freely - Modify template/base64.bin according to the GenerateShellShellLoder padding approach - Modify shell.aspx to strip header and footer - ILspy decompile payload.dll, export source, modify file name and class name
Plugin development:
- Modify the packaged jar to replace the original jar in lib
- Godzilla API
- Package name: shells.plugins.* + PluginnAnnotation annotation + Plugin interface
- Swing UI design
- Menu registration: MainActivity.registerJMenu/registerPluginJMenuItem/registerShellViewJMenuItem (must be in a static code block)
Required tools: JETBRAIN IDEA / RIDER / ILspy / sqlitestudio / Visual Studio 2022