Slack-links-preview-C2

KO | EN

gitlite — search

#javascript #python #hacktoberfest #ai #typescript #go #machine-learning #rust #deep-learning #docker #macos #awesome #cli #pytorch

Slack-links-preview-C2

(★ 18)

Smuggling C2 comms through links previews

Slack-links-preview-C2 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Proof-of-Concept demonstrating the use of links previews in Slack to smuggle C2 communications, even in hardened environments where Slack traffic is restricted to the corporate workspace only.

Blog article to follow on [rwxstoned.github.io](https://rwxstoned.github.io/).

TLDR: locked-down corporate environment can restrict the Slack traffic only to the authorized company's Slack workspace (via the Slack-supported `X-Slack-Allowed-Workspaces-Requester` header). However, links previews in Slack messages can be used to smuggle information in and out because the actual HTTP request is performed by Slack's backend on your behalf - NOT by your machine. This provides the two building blocks required to establish a full-fledged C2 channel.

The PoC demonstrates this over Mythic, via a modified version of `Medusa` and `http` C2 profile. It does so by stealthily posting links as DM to yourself (the ping from the implant to the C2) and reading the preview (the response from the C2), before deleting the message for stealth.

![](https://raw.githubusercontent.com/RWXstoned/Slack-links-preview-C2/main/img/demo.gif)

---

# Prerequisites

1. `docker`

2. A Slack account, with a user token (either [stolen by your implant](https://specterops.io/blog/2023/11/09/abusing-slack-for-offensive-operations-part-2), or, like for this demo, one generated with the IM and chat write permissions).

# Installation

1. Install Mythic, and clone this repo.

2. Install the `httpget` C2 profile, and the `Medusa` version, from this repo:

`sudo ./mythic-cli install folder /path/to/Slack-links-preview-C2/Medusa`

`sudo ./mythic-cli install folder /path/to/Slack-links-preview-C2/httpget`

3. Build them locally (unlike the official `http`, etc, these are not available and published on an online registry):

`sudo docker compose -f /path/to/Mythic/docker-compose.yml build --no-cache httpget medusa`

3. Start Mythic and confirm that both `medusa` and `httpget` are up:

`./mythic-cli start`

`./mythic-cli status`

# Implant Creation

I used a Cloudflare tunnel to get a public URL for this. Fill in the payload creation as shown below, and disable the obfuscation if you want to easily see the resulting Python payload.

![](https://raw.githubusercontent.com/RWXstoned/Slack-links-preview-C2/main/img/params1.png)

More parameters:

![](https://raw.githubusercontent.com/RWXstoned/Slack-links-preview-C2/main/img/params2.png)

Note: be sure to specify your callback on port 443.

Generate, run, and get your callback !

Slack-links-preview-C2

Slack-links-preview-C2 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Slack-links-preview-C2

Slack-links-preview-C2 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README