Web Interface
The WLKOM C2 Web UI is a single-page application (public/index.html) that provides a terminal-like interface for interacting with the rootkit. It communicates with the C2 server over WebSocket.
Views
The UI has two views that switch based on authentication state:
Login View
The initial screen shown when opening the UI. It features:
- ASCII art logo with a CRT scanline and vignette effect.
- Status indicator: a colored dot showing whether the rootkit is connected to the C2 server (green = connected, red = waiting).
- Password field: the attacker enters the plain-text password here. The C2 server handles hashing before sending it to the rootkit.
- Authenticate button: triggers the authentication flow. Shows a spinner while waiting for a response, with a 7-second timeout fallback.
The login button is always clickable, but authentication will fail with an error message if the rootkit is not connected.
Terminal View
Shown after successful authentication. It provides a full terminal-like experience:
- Top bar: displays the WLKOM logo, connection status with the rootkit's IP, a CLR (clear) button, and an EXIT (logout) button.
- History bar: shows clickable chips of the last 8 commands. Clicking a chip fills the input field with that command.
- Disconnection banner: appears as a red warning bar when the rootkit loses connection mid-session.
- Output area: scrollable terminal output with color-coded lines (see below).
- Input bar: command input with a
WLKOM>prompt and a SEND button. - Status bar: shows cipher type, protocol, command count, and history count.
Output Line Types
Terminal output is color-coded by type:
| Type | Appearance | Used for |
|---|---|---|
sys | Dim/muted | System messages (welcome banner, session info) |
echo | Green with $ | Command echo (shows what was sent) |
data | Default text | Command output from the rootkit |
error | Red | Error messages |
warn | Yellow | Warnings (WebSocket disconnection, etc.) |
sep | Dim, small | Separator lines (connection changes, clear) |
Keyboard Shortcuts
| Key | Action |
|---|---|
Enter | Send command (terminal) or authenticate (login) |
Arrow Up | Navigate to previous command in history |
Arrow Down | Navigate to next command in history |
Ctrl+L | Clear terminal output |
WebSocket Reconnection
The browser automatically reconnects to the C2 server if the WebSocket connection drops, with a 2-second delay between attempts. This is independent of the rootkit connection — even if the rootkit disconnects, the browser stays connected to the server and receives status updates.
Session Management
- Logout (EXIT button) resets all client-side state: authentication, command history, terminal output, and counters. It returns to the login view.
- Session state is entirely client-side: the server does not track authenticated sessions. If the browser reconnects after a WebSocket drop, it returns to the login screen.
- Multi-client support: multiple browser tabs can connect simultaneously. Commands and output are broadcast to all connected clients.