Mothership C2

$\textcolor{red}{\text{DISCLAIMER!}}$

$\textcolor{red}{\text{THIS TOOL IS FOR ETHICAL USE ONLY!}}$

Description

Mothership C2 is a command and control server written in python

Features

• Supports end-to-end encryption for sending and receiving commands
• Uses HTTP for everything
• Currently supports Linux (windows support is being tested)
• Uses DragonflyDB (a faster alternative to Redis)

Frontend

here is a sample screenshot of the frontend. Builtin terminal and way for creating and deleting agents! To run the frontend go into webapp and run docker compose up

Client Docs

client documentation

API Docs

documentation for the API

Client side routes:

All endpoints for the client side require the admin JWT.

POST /api/config

configure the database if database is on another host other than the default

{
  "host": "localhost",
  "port": "6379",
  "db": "0"
}

example response:

{"response": "config updated!"}

GET /api/db/priv_key

get the private key for the database to allow for decrypting of command responses.

Example response:

{"response": "server private key"}

POST /api/connections/<agent_id>/command

send a command to an agent.

{
  "command": "string",
  "directory": ""
}

Example output: 200

GET /api/connections/list

list all connections in the database.

Example response:

{"response": ["agent1", "agent2"]}

GET /api/connections/<agent_id>/output

Get the output of the command.

Example response:

{"response": decrypted}

GET /api/connections/<agent_id>/close

Close a connection with an agent.

Example response:

{"response": "deleted agent123!"}

GET /api/connections/create

Create a new agent ID for a new agent to connect with.

Example response:

{"response": "a52a7cca-5ca9-46ed-98c0-3ee694a97e45"}

GET /api/connections/<agent_id>/info

Get info on a connection such as OS, public key, command, command output, command history, server side public key.

Example response:

{"response": 
    {
        "history": "", 
        "OS": "linux",
        "pubKey": "0x000000",
        "serverKey": "0x00000"
    }
}

Agent Endpoints

POST /api/connections/register

Register an agent

{
  "hashedID": "string",
  "public_key": "string",
  "target_os": "string"
}

GET /api/connections/<hashed_agent_id>/command

Agent gets shell command to execute. Commands that the agent gets are encrypted see the code for the agent on how it decrypts commands.

Example response:

{"response": "command"}

POST /api/connections/<hashed_agent_id>/output

Send the command output, outputs are encrypted and decrypted by the API when a client requests for them.

{
  "command_output": "string"
}