{% extends "BaseNavbar.html" %} {% block main %}
Help Overview

FudgeC2 Documentation

This documentation may contain incomplete information, as well as partial documentation on unimplemented features.

Configuration

User Account

Add user

Adding a new user account can be done by any admin in the global settings, found here: /settings

Configure campaign users

Each campaign contains its own set of user permissions which control user interaction. User can have read-only or read/write permissions allowing them to send commands to active implants. These settings can be found within the campaign settings, under /[campaign id]/settings

Password Reset

Resetting a users password can be achieve in the global settings. This will generated a one-time password, which the user will change on first logon. (Not yet implemented)
/settings



Implant commands

Active implants have a number of builtin commands designed to perform common actions, such as harvestings host information. These built in commands are invoked by pre-fixing :: to the required command. If no pre-fix is used the implant will try to execute anything else using Powershell.

:: sys_info
Collects username, hostname, domain, and local IP
:: enable_persistence
Enables persistence by embedding a stager payload into the following autorun register key:
HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\
:: export_clipboard
Attempts to collect any text data stored in the users clipboard.
:: load_module [target script]
This will load external powershell modules, such as JAWS.
:: exec_module [loaded module name]
Executes a specific function of a loaded module.
:: list_modules
Lists all loaded modules by the implant.
:: download_file [[ path ] target ]
Downloads a file from the infected host. Downloads wil be placed in the directory set in the settings file.
:: upload_file [local filename] [[path] filename ]
Uploads a target file to the supplied directory. All target upload files should be placed in:
{installation dir}/FudgeC2/Storage/implant_resources/
Under development:
:: play_audio [target audio file]
This will simply play audio on the target host, assuming the target has an audio device. Simply for PoC demonstrations. It should be noted that this will create a temp file.
:: screenshot
captures the users screen if possible


Listeners

Listeners are the mechanisms by which active implants and the FudgeC2 server communicate, sending commands and responses between them. Configuring listeners requires admin privileges.

Caution: When stopping a listener it will impact all implants using the FudgeC2 server, not just those from your own campaign. Communicate to your wider teams.

When configuring new implants you can configure them to run over a variety of protocols. Each of these protocols have an associated listener which will need to be created.

Once a listener has been set up for a given protocol and port it does not need to be done against for a separate campaign. All campaign which used an identical implant configuration will use this listener.

Common examples of shared listeners are HTTP on port 80, or HTTPS on port 443. Once a listener has been set up, all implant, for all campaign can use it (and once stopped, it will stop for all).

When creating listeners you have the option to auto-start a listener, this will enable the listener upon creation.

Listeners can be configured here:
/listeners

Implants

Implants are categorised into two types, implant templates, and active implants. Implant templates are a unique base configuration for implants, while active implants are generated upon a stager calling back.

Implant templates

An implant template is used to create a base configuration - Once a new implant template is created you can find it's unique stager inside the campaign stagers page.

Every time a stager is triggered it will callback to the C2 Server and a new active implant will be generated based on the implant templates configuration.

Active implants

Active implants are the result of a stager successfully calling home to the C2 server. Once an implant has been activated it will show up inside the main campaign page, allowing users with write permissions to register commands to be executed.

If a stager is triggered twice two different active implants will be generated - while they will similar properties (such as callback domain/IP, and comms channels) if they have any form of obfuscation enabled the implant generator will create uniquely obfuscated implants.

Active implants will be named according to their implant name, and will have a 6 digit number appended for uniqueness.

{% endblock %}