Overview
The WLKOM C2 (Command & Control) is a web-based interface that allows an attacker to authenticate to and control a machine infected with the epirootkit module. It acts as the bridge between the attacker's browser and the kernel module running on the target.
Server Internals
The C2 server (server.js) is the relay between the attacker's browser and the rootkit kernel module. It manages three concurrent services in a single process.
Web Interface
The WLKOM C2 Web UI is a single-page application (public/index.html) that provides a terminal-like interface for interacting with the rootkit. It communicates with the C2 server over WebSocket.