11 days ago
[This post was last modified: 5 days ago by ryanVV ]
SpecterInsight is a cross-platform post-exploitation Command and Control (C2) framework built on .NET, designed for red teaming, threat simulation, and training.
Fast | Powerful | Usable
![[Image: Command-and-Control.png?resize=1600%2C67...=100&ssl=1]](https://i0.wp.com/practicalsecurityanalytics.com/wp-content/uploads/2023/10/Command-and-Control.png?resize=1600%2C675&quality=100&ssl=1)
![[Image: scripts-main-page.png?resize=1600%2C957&...=100&ssl=1]](https://i0.wp.com/practicalsecurityanalytics.com/wp-content/uploads/2023/10/scripts-main-page.png?resize=1600%2C957&quality=100&ssl=1)
Fast | Powerful | Usable
Download Link:
Gofile: https://gofile.io/d/BVgZWQ
OneDrive: https://1drv.ms/u/c/dfa08dfa1b37689d/IQB...o?e=Jfc4oe
Mega: https://mega.nz/folder/vgxTkKDA#3tjlHTkJj0JCSRySTFhx7g
Archive Password:
Installation Manual
https://practicalsecurityanalytics.com/s...tallation/
ARCHITECTURE & FEATURES
* C2 Server
The C2 server is written in .NET and is cross-platform. It provides a multi-threaded Web API to manage Specter implants, handle data storage, perform data enrichment, and generate payloads.
• Multi-User Support: Collaborative C2 server capabilities.
• OS Support: Compatible with Windows 10+ and Linux.
• Listeners & Protocols: Supports multiple listener types and protocols.
• Unique Profiles: Generates unique C2 profiles for each implant build.
• Certificate Management: Upload, store, or generate SSL/TLS certificates (supports Let's Encrypt).
• Data Management: Manages exfiltrated files.
• On-Demand Updates: Dynamically update products and SpecterScripts.
• Evasion Pipeline: Implements detection-resistant payload obfuscation.
* Implants (Specters)
The core implant is a .NET 2.0+ compatible binary with a built-in PowerShell 2.0+ interpreter. It comes with various droppers designed to load the implant on target systems using different defense evasion techniques.
• OS Support: Compatible with Windows Vista+ and Linux.
• Environment: Supports .NET 2.0+ and PowerShell 2.0+.
• Communication: Beacon-style communications over HTTP/S.
• Object-Oriented Output: Serializes command output into objects across the C2 channel for easier parsing and analysis.
• Concurrency: Supports asynchronous background commands to run multiple tasks simultaneously.
• File Transfer: Upload and download files tunneled through the C2 channel.
• Defense Evasion:
AMSI bypass
PowerShell logging suppression
Multiple process injection techniques
Various persistence mechanisms
• Modular Architecture: Load and execute arbitrary .NET assemblies directly in memory.
* Graphical User Interface (GUI)
SpecterInsight features a fully cross-platform GUI built on AvaloniaUI and SignalR, providing real-time C2 management. The interface is clean and modern, supporting plaintext, JSON, and tabular output formats.
• OS Support: Compatible with Windows 10+ and Linux.
• Security: Uses HTTPS with username/password authentication.
• Management:
Generate implants and configure listeners.
Manage SSL/TLS certificates (with Let's Encrypt support).
View exfiltrated files.
• Operational Awareness:
Countdown timers showing the next callback for each active session.
Real-time updates and output tracking.
Command history log with support for text, JSON, and table views.
• Scripting Integration: Build SpecterScripts directly in the UI, with quick search and insertion features for scripts and documentation.
* Analytics & ELK Integration
The core implant serializes command output into JSON, automatically enriches the data, and forwards it to a pre-configured ELK (Elastic) stack for analysis via built-in dashboards.
• Data Enrichment: Automatically appends GeoIP details to command outputs.
• Ingestion: Collects event logs and command outputs and sends them to Elasticsearch.
• Visualization:
Built-in Kibana dashboards.
Generates network graphs based on host or network output.
Tracks all credential harvesting and persistence deployments.
Monitors lateral movement events.
• Remediation: Generates cleanup/uninstall scripts for every deployed persistence technique.
• Framework Mapping: Maps events and commands directly to the MITRE ATT&CK framework.
CORE CAPABILITIES
* SpecterScripts
SpecterInsight includes pre-built TTPs (Tactics, Techniques, and Procedures) covering lateral movement, C2, discovery, reconnaissance, defense evasion, persistence, and exfiltration.
• Pre-built Scripts: 110
* Scripts & Filters
SpecterScripts are PowerShell scripts used to control deployed Specters. The implants feature built-in cmdlets that allow operators to perform advanced actions, such as loading modules from the C2, exfiltrating data, or changing configurations.
* Elasticsearch Integration
Because Specter implant outputs are structured JSON fields, they integrate cleanly with Elasticsearch. The pre-configured dashboards cover operations, reconnaissance, and reporting.
• Pre-configured Dashboards: 6
• Pre-configured Visualizations: 32
Included Categories:
• Command and Control (C2)
• Network Discovery
• Persistence (including detailed breakdowns)
• Infrastructure
• Credentials
The dashboards provide a chronological timeline of Specter implant events (such as registration, callbacks, and result uploads) and visualize global access points using IP geolocation.
* Session & Interface Management
• Sessions Page: Displays critical information for active or archived sessions, including host identifiers, hostnames, domains, usernames, architecture, and the countdown to the next callback.
* Operator Interface
• Supports JSON and plaintext command outputs.
• Maintains command history and provides detailed error logging.
• Includes built-in TTP lookup and documentation.
• The command console accepts raw PowerShell without requiring character escaping.
* Defense Evasion
SpecterInsight integrates multiple evasion techniques to provide a safer execution environment during engagements:
• AMSI and logging bypasses.
• Integrated PowerShell obfuscation tools and multiple PowerShell cradles.
• Integrated C# obfuscator.
• Multiple process injection techniques.
• Payload generation via HTTP endpoints.
• Support for C# Native AOT compilation and obfuscation.
• Ability to integrate custom payloads into the generation pipeline.
* Payload Generation Pipeline
Operators can write scripts to define obfuscated .NET and PowerShell payloads. When the pipeline script is triggered, it generates a new obfuscated payload utilizing randomized defense evasion techniques, templates, and obfuscation methods.
