PoshCord-C2
MAIN SCRIPT HERE - https://github.com/beigeworm/PoshCord-C2
SYNOPSIS
Using a Discord webhook and a hosted text file to Act as a Command and Control Platform.
INFORMATION
This script will wait until it notices a change in the contents of a text file hosted online (eg. github/pastebin). Every 10 seconds it will check a file for a change in the file contents and interpret it as a custom command / module.
Using github to host your command file will take up to 5 minutes to run each module command - Use pastebin (account needed) OR your own server to host the txt file for instant response
SETUP
- Goto https://pastebin.com and make an account..
- Create an empty paste/file and copy the RAW url.
- Change YOUR_FILE_URL to the RAW url eg. https://pastebin.com/QeCLTdea -OR- http://your.server.ip.here/files/file.txt
- Change YOUR_WEBHOOK_URL to your webhook eg. https://discord.com/api/webhooks/123445623531/f4fw3f4r46r44343t5gxxxxxx
USAGE
- Setup the script
- Run the script on a target.
- Check discord for 'waiting to connect..' message.
- Edit the contents of your hosted file to contain 'options' to get a list of modules
- Do the same with any other command listed - To run that module.
MODULES
Message: Send a message window to the Users desktop.SpeechToText: Send microphone audio transcript to DiscordScreenshot: Sends a screenshot of the desktop to Discord.KeyCapture: Capture Keystrokes and send to Discord. (see ExtraInfo for usage.)Exfiltrate: Send various files to Discord zipped in 25mb files. (see ExtraInfo for usage.)Upload: Upload a file to Discord. (see ExtraInfo for usage.)Systeminfo: Send System information as text file to Discord. (takes a few minutes to gather data)RecordAudio: Record microphone to Discord (RecordAudio -t 100) in secondsRecordScreen: Record Screen to Discord (RecordScreen -t 100) in secondsTakePicture: Send a webcam picture to Discord. (can take a few minutes..)FolderTree: Save folder trees to file and send to Discord.FakeUpdate: Spoof windows update screen.Nearby-Wifi: Show nearby wifi networksSend-Hydra: Never ending popups (use killswitch)AddPersistance: Add this script to the startup folder.RemovePersistance: Remove this script from the startup folder.IsAdmin: Check if the session is admin.AttemptElevate: Attempt to restart script as admin. (displays a UAC prompt to User)EnumerateLAN: Show all devices on the network (see ExtraInfo for usage.) (can take a few miniutes to complete)Close: Close this SessionOptions: Show the Module menuExtraInfo: Show extra Module information
FEATURES
Custom Scripting
Edit the hosted file contents to any custom powershell script or command to run custom powershell.
Killswitch
Save a hosted file contents as 'kill' to stop 'KeyCapture' or 'Exfiltrate' command and return to waiting for commands.