grines / goc2

MacOS C2 Framework

goc2

c2 client/server/paylod

GoC2 - MacOS Post Exploitation C2 Framework

Custom C2 for bypassing EDR and ease of use.

Status

• This is still an active work in progress (Not ready for production use.. I made it in a weekend.. has bugs.)

Features

• Terraform deployment
• Command History
• Remote Command Completion (yes this works!)
• JXA execution (cocoa api)
• Clipboard (cocoa api)
• cat / curl (cocoa api)
• add Doom persistence list
• Add Slack integration
• Add ++ persistence
• Add + privesc
• Encrytpion
• variable callback timeout
• Authentication
• Custom JXA paylaods storage

Prereqs

• install mongodb on c2 server ** sudo apt install mongodb * required

Getting Started (C2 Server)

• go get github.com/goc2
• sudo apt install mongodb || brew install mongodb
• ./goc2 --web

CLI

• ./goc2 --cli --c2 http://c2.server

Payloads

• grab a goc2-agent macos payload
• edit c2 ip before compiling
• ./agent