{% extends "BaseNavbar.html" %} {% block main %}
This documentation may contain incomplete information, as well as partial documentation on unimplemented features.
Adding a new user account can be done by any admin in the global settings, found here: /settings
Each campaign contains its own set of user permissions which control user interaction. User can have read-only or read/write permissions allowing them to send commands to active implants. These settings can be found within the campaign settings, under /[campaign id]/settings
Resetting a users password can be achieve in the global settings. This will generated a one-time password, which the user will change on first logon. (Not yet implemented)
/settings
Active implants have a number of builtin commands designed to perform common actions, such as harvestings host information. These built in commands are invoked by pre-fixing ::
to the required command. If no pre-fix is used the implant will try to execute anything else using Powershell.
:: sys_info
:: enable_persistence
HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\
:: export_clipboard
:: load_module [target script]
:: exec_module [loaded module name]
:: list_modules
:: download_file [[ path ] target ]
:: upload_file [local filename] [[path] filename ]
Under development:
:: play_audio [target audio file]
:: screenshot
Listeners are the mechanisms by which active implants and the FudgeC2 server communicate, sending commands and responses between them. Configuring listeners requires admin privileges.
Caution: When stopping a listener it will impact all implants using the FudgeC2 server, not just those from your own campaign. Communicate to your wider teams.
When configuring new implants you can configure them to run over a variety of protocols. Each of these protocols have an associated listener which will need to be created.
Once a listener has been set up for a given protocol and port it does not need to be done against for a separate campaign. All campaign which used an identical implant configuration will use this listener.
Common examples of shared listeners are HTTP on port 80, or HTTPS on port 443. Once a listener has been set up, all implant, for all campaign can use it (and once stopped, it will stop for all).
When creating listeners you have the option to auto-start a listener, this will enable the listener upon creation.
Listeners can be configured here:
/listeners
Implants are categorised into two types, implant templates, and active implants. Implant templates are a unique base configuration for implants, while active implants are generated upon a stager calling back.
An implant template is used to create a base configuration - Once a new implant template is created you can find it's unique stager inside the campaign stagers page.
Every time a stager is triggered it will callback to the C2 Server and a new active implant will be generated based on the implant templates configuration.
Active implants are the result of a stager successfully calling home to the C2 server. Once an implant has been activated it will show up inside the main campaign page, allowing users with write permissions to register commands to be executed.
If a stager is triggered twice two different active implants will be generated - while they will similar properties (such as callback domain/IP, and comms channels) if they have any form of obfuscation enabled the implant generator will create uniquely obfuscated implants.
Active implants will be named according to their implant name, and will have a 6 digit number appended for uniqueness.