Locked IERat - A basic C2 Framework with an internet explorer based agent

[itsMe]

This is the hidden content, please

• Sign In
• or
• Sign Up

A simple C2 framework against browser isolation proxies

(for testing / research purposes only!)

About The Project

While I was penetration testing networks that use browser isolation proxies, I noticed that my malware is unable to communicate with its C2 server, although I used a cloudfront.com domain using domain fronting. I could access it via a web browser without any problem. After a little research on browser isolation products, I found that these proxy servers inject JavaScript files to the browser, enforcing their policy and changing the entire structure of the DOM. Therefore, the server responses will go through the proxy and will be re-rendered as images/SVG so only the browser will be able to understand them.

But, I noticed that what’s inside the tag, such as the page title and tags will remain untouched (not tested yet on all solutions) There, a possible C2 communication would be:

Client-> HTTP requests via browser automation -> C2 server -> HTTP page with a payload inside the headtag, e.g. favicon value -> browser isolation proxy -> browser controllered by client -> client

The client uses a COM object and sends requests using Internet explorer, then extracts the favicon base64 value from the C2 server responses, which is controlled by the user to send commands through a simple console UI. This can be further developed to upload/download files, use HTTPS, and convert the client to a PowerShell script.

This is the hidden content, please

• Sign In
• or
• Sign Up