A tiny command-and-control framework built to learn how a C2 is shaped — and therefore how to detect one. A team server tracks agents, queues tasks for them, and collects results; agents beacon back on an interval and run what they're told. That beacon-and-tasking loop is the thing every blue-team analyst needs to recognise.
This is a lab / coursework tool, and safe by design.
- Agents run only a benign whitelist —
sysinfo,whoami,pwd,ls,echo,sleep. There is deliberately no arbitrary shell execution, no file transfer, and no way to run a payload. The server refuses to queue anything off the whitelist.- Everything is meant for localhost / an authorised lab you own. It exists to teach the architecture, not to attack anything.
- Encrypted beacons — an HMAC-SHA256 keyed stream cipher so check-ins aren't plaintext (illustrative; a real C2 would use TLS + a vetted AEAD).
- A team server — register agents, queue tasks, deliver them FIFO on beacon, clear the queue, collect results.
- A benign executor — the whitelist above, nothing else.
py test_c2.py # crypto round-trip, whitelist enforcement, tasking/beacon
core.py— the whole model: crypto, benign executor, and the team servertest_c2.py— tests for the crypto, the whitelist, and FIFO tasking