Skip to main content

Attacker UI — C2 Protocol Reference

This page documents the two link layers between the attacker and the kernel module:

  • The TCP protocol used between the kernel module (rootkit) and the C2 server (default port: 4242).
  • The WebSocket / JSON messages used between the browser Web UI and the C2 server (default port: 8080).

TCP (module ↔ C2)​

  • Transport: plain TCP.
  • Encoding: every byte transmitted over TCP is transformed with a ROT64 operation (byte = (byte + 64) mod 256). The receiver applies the inverse transform (byte = (byte - 64 + 256) mod 256).
  • Line-based messages: messages are newline-terminated (\n). The server and module parse incoming streams by splitting on \n.

Authentication​

  • The C2 sends the expected credential (the SHA-256 digest) as a line to the module. The module compares the 64-char hex string to its internal password_hash using a constant-time comparison.
  • Module responses:
    • "[+] Authentification réussie" — authentication success (module may also send an English equivalent).
    • "[-] Mot de passe incorrect" — authentication failure.

Command / Output​

  • After successful authentication, the module accepts command lines (UTF-8 text) and executes them via a user-mode helper. The command output is captured, ROT64-encoded and sent back as newline-terminated blocks.

WebSocket (browser ↔ C2)​

  • Transport: WebSocket over HTTP (served on port 8080 by default).
  • The C2 server exposes a minimal JSON message schema. Each message is a JSON object; the server relays messages between browser and rootkit.

Messages from browser → C2​

  • {"type":"auth","password":"<plain-password>"} — request authentication. The server hashes the password with SHA-256 and forwards the hex digest to the rootkit over TCP.
  • {"type":"command","cmd":"<shell command>"} — execute a command on the infected host. The server will echo the command to UIs and forward it (ROT64-encoded) to the rootkit.

Messages from C2 → browser​

  • {"type":"rootkit_status","connected":true|false,"ip":"x.x.x.x"} — connection state updates.
  • {"type":"output","data":"<line>"} — a line of output received from the rootkit (after decoding on the C2 side).
  • {"type":"auth_result","success":true|false} — result of an authentication attempt.
  • {"type":"error","message":"..."} — errors such as unreachable host, missing password, etc.

Example flow​

  1. Browser sends { "type": "auth", "password": "hunter2" }.
  2. C2 hashes hunter2 → ab12... and forwards the hash over TCP to the module.
  3. Module replies "[+] Authentification réussie" → C2 broadcasts { "type": "auth_result", "success": true }.
  4. Browser sends { "type": "command", "cmd": "id" } → C2 forwards ROT64-encoded id\n to module.
  5. Module executes and returns output lines, C2 relays each as { "type": "output", "data": "uid=0(root) gid=0(root)" }.

Security notes​

  • ROT64 is an obfuscation, not a secure encryption. It only deters casual inspection; it does not provide confidentiality or integrity.
  • Passwords are hashed with SHA-256 before being sent to the module; however, the transport between the C2 and module is not authenticated or encrypted.