phoenixc2/phoenixc2

Command & Control-Framework created for collaboration in python3

PhoenixC2

An Open-Source C2-Framework written in pure Python3.

Disclaimer

This project is still in development and not ready for professional use. The author and its affiliates do not endorse or condone any illegal or malicious activity conducted with this framework. Users of this framework are solely responsible for ensuring that their use of this framework is in compliance with all applicable laws and regulations.

Features

• Modern Web-Interface
• Built for Teams and Organizations (Multi-User)
• Customizable (Plugins, Modules, Kits)
• Easy to use
• Easy to extend
• Supports different languages (Python, Go, ...)

Planned Features

• Finished Web-Interface
• CLI-Interface
• Multi-Language Loaders
• More standard modules/kits/plugins
• Better documentation
• More tests

Installation

Installation from source.

Requirements

• Python3.11 =<
• Go 1.15 =<

Command Line

git clone https://github.com/screamz2k/PhoenixC2.git
cd PhoenixC2
python3 -m pip install poetry
poetry install

Usage

Local

Start the server

poetry run phserver

The Web-Interface is available at http://localhost:8080 by default.

Start the client

The client is not yet available.

Docker

# server
docker run --network host screamz2k/phoenixc2 phserver

Documentation

The documentation is available here

Contributing

Contributions are welcome! Please read the contribution guidelines first.

Please vote in the Discussion Tab for development choices and new features.

LICENSE

View license here

Star History

• 08/04/23 Thank you all for over 50 stars in just two days :)
• 09/04/23 100 stars! In just 3 days. Thanks for the great support!

phoenixc2's Issues

remove external js files for if their functions aren't used by other templates than the their corresponding template

Unable to create a stager in Chrome Ubuntu

Description

I'm unsure whether its browser related, using Chrome Version 113.0.5672.92 (Official Build) (64-bit) on an Azure Ubuntu Linux VM but I'm unable to create a stager. It seems to just say a name is required but there is no option to do this in the UX.

Reproduction

Steps to reproduce the behavior:

1. Go to 'Stagers' in menu
2. Click on 'Create a new stager'
3. Select the listener name
4. Then there is no option to select the type of stager or to input the name
5. Error message 'Name is required' occurs when you click create

Expected behavior

Ability to select stager type and name the stager available in the UX.

Screenshots/Output (Optional)

Client Desktop:

• OS: Azure Ubuntu Linux VM
• Browser Chrome Version 113.0.5672.92 (Official Build) (64-bit)
• Version of the Framework 1.01

bypasses page with ability to manage chains or run single bypasses on a payload

Page similar to the modules page where you can view all bypasses but also create chains which act as persistent ways of adding the same bypasses to a payloadd

"Name is required" when trying to create stager

Description

Cant create new stager because there is no name input.

Reproduction

Steps to reproduce the behavior:

1. Go to 'Stagers'
2. Click on 'Create a new stager'
3. Click on 'Create'
4. See error

Expected behavior

Option to enter a name

Screenshots/Output (Optional)

edit for stagers

Stager edit function needs to be updated to the new attributes and payload options of the stager model, to fill into the edit form.

whats the username and password

upon executing it gives a key and says it created a super user
i dont know whats the user name and password

add frontend submodule as plugin from the phoenix-frontend repo

markdown editor for operations

Markdown editor is already installed in the js files, just needs to be imported and initialize, if a user wants to create or edit the description for his operation.

device modal showing infos and possible executable tasks

Modal showing information about the selected device and the actions which can be executed like sending commands, viewing the file system, downloading, executing modules, etc...

Fix XSS Vulnerability in almost all pages

The frontend is not defended against XSS.
Possible solutions:

• Escape all input
• Escape all output
• Add security headers

Operations test missing

Test for listing with fronted & json
Add simulation of creation changing adding users deleting

add creation/editing for credentials

can't create stager

Can't create a stagers
When I try, "name is required"
But where I can write it???

user editing in the frontend

Ability to edit users, like their name, password and profile picture

render payload options using jinja

working image upload preview for operations

Basically the same functionality as for users profile picture preview just needs to be ported to the operations page

implement function to switch payload and show its options in the creation modal

Function which takes the value from the payload select input, and renders the corresponding form with the options of the payload into the creation modal and edit modal, where the payload is already defined.