pax_global_header 0000666 0000000 0000000 00000000064 14712433340 0014513 g ustar 00root root 0000000 0000000 52 comment=6d05d35d55a03c0974e9f28d7bf7eba8f14005c5
convoC2-0.1.0-alpha/ 0000775 0000000 0000000 00000000000 14712433340 0014105 5 ustar 00root root 0000000 0000000 convoC2-0.1.0-alpha/.gitignore 0000664 0000000 0000000 00000000010 14712433340 0016064 0 ustar 00root root 0000000 0000000 /build/
convoC2-0.1.0-alpha/LICENSE 0000664 0000000 0000000 00000002057 14712433340 0015116 0 ustar 00root root 0000000 0000000 MIT License
Copyright (c) 2024 Fabio Cinicolo
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
convoC2-0.1.0-alpha/README.md 0000664 0000000 0000000 00000015275 14712433340 0015376 0 ustar 00root root 0000000 0000000 convoC2
## Table of Contents
- [Introduction](#introduction)
- [Demo](#demo)
- [Usage](#usage)
- [Requirements](#requirements)
- [Inspiration](#inspiration)
- [Contribute](#contribute)
## Introduction
Command and Control infrastructure that allows Red Teamers to execute system commands on compromised hosts through Microsoft Teams.
It infiltrates data into hidden span tags in Microsoft Teams messages and exfiltrates data by embedding command outputs in Adaptive Cards image URLs, triggering out-of-bound requests to a C2 server.
The lack of direct communication between the victim and the attacker, combined with the fact that the victim only sends http requests to Microsoft servers and antiviruses don't look into MS Teams log files, makes detection more difficult.
## Demo
The following video demonstrates the use of the server to control two compromised hosts: one running the new Teams on Windows 11 and the other running the old Teams on Windows 10. In the first case, the attacker is not in the same org as the victim.
https://github.com/user-attachments/assets/d9fcccc1-de73-49cd-aaa7-df53303dbc6a
**Note:** In the first case the victim already accepted the chat with the external attacker, but in a real scenario where the attacker starts the chat with the victim for the first time, the victim would need to confirm the chat with the attacker. This is not a problem: because messages are being cached in the log file anyways, the **commands are received and executed even if the victim has not visualized or accepted the chat yet**.
## Usage
**Server**
```
root@convoC2-server-VPS:~# ./convoC2_server_amd64 -h
Usage of convoC2 server:
-t, --msgTimeout How much to wait for command output (default 30 s)
-b, --bindIp Bind IP address (default 0.0.0.0)
```
**Agent**
```
C:\Windows>convoC2_agent.exe -h
Usage of convoC2 agent:
-v, --verbose Verbose logging (default false)
-s, --server C2 server URL (i.e. http://10.11.12.13/)
-t, --timeout Teams log file polling timeout [s] (default 1)
-w, --webhook Teams Webhook POST URL
-r, --regex Regex to match command (default "]*aria-label=\"([^\"]*)\"[^>]*>")
```
## Requirements
To get it working, you will need to set up a few things:
- [**Create Teams channel with Workflow Incoming Webhook**](#Create-Teams-channel-with-Workflow-Incoming-Webhook): this is the place where the adaptive cards containing the output will be received. **Note**: **It is important to keep a browser window with this channel opened while using the server**, otherwise the server will not receive messages from the agents.
- [**Fetch Ids and Auth Token**](#Fetch-Ids-And-Auth-Token): Teams initializes a chat with a POST to `https://teams.microsoft.com/api/chatsvc/emea/v1/threads` with the unique ids of the victim and the attacker in the body. In the response, the threadId will be returned in the path of the Location header url.
The Bearer token of the same request is used to authenticate to `https://teams.microsoft.com/api/chatsvc/emea/v1/users/ME/conversations//messages`, which is the endpoint for sending messages. So we just need to grab these three things and the server will take care of the rest.
- Make sure you have a public facing host allowing inbound HTTP traffic on port 80.
- Teams needs to be running on the victim host, in the background is fine too.
After starting the server you can receive new agents and control them, using the data previously obtained for authentication. Check the demo out for a usage example.
### Create Teams channel with Workflow Incoming Webhook
First of all, you will need to create a Teams channel.
Right click on the three dots, then click on "Workflows".
In the search bar type "Webhook" and click on the "Post to a channel when a webhook request is received".
Continue with the default settings and finally copy the url.
### Fetch Ids and Auth Token
Start by looking for the victim.
After selecting the victim account, with the web proxy intercepting the requests, you can send a dummy message.
Save the two ids present in the `api/chatsvc/emea/v1/threads` request then DROP the request. The auth token will be the Bearer token of the same request.
## Inspiration
This infrastructure was inspired by the [Teams GIFShell research](https://medium.com/@bobbyrsec/gifshell-covert-attack-chain-and-c2-utilizing-microsoft-teams-gifs-1618c4e64ed7) made by [Bobbyrsec](https://www.linkedin.com/in/bobby-rauch/).
Initially my purpose was to replicate the issue, but the solution appeared to be partially fixed. The research involved injecting commands into Base64-encoded GIFs, but these were no longer being displayed correctly: an icon of corrupted image would appear in the chat instead, resulting in the victim protentially starting to suspect.
After testing various methods, I noticed that it was possible to **embed commands directly into messages rather than in GIFs or images**: sending multiple images is more likely to raise suspicion compared to sending simple messages, right?
Initially I considered embedding commands in tags like `