C2 Communication Protocol Library
$99.99
C2 Communication Library — HTTPS / DNS / ICMP
Reusable Python 3 library for C2 traffic over three transports with one unified API (send, receive, register, heartbeat), plus a server-side handler with an interactive console.
- HTTPS channel: POST/GET with domain-fronting support.
- DNS channel: TXT/A queries; v1.9 fixed the chunking bug — 39-byte chunks keep every base32 label under the 63-character DNS limit (the v1.8 45-byte chunks encoded to 72 characters and silently broke every query).
- ICMP channel: echo request/reply payloads; requires raw sockets (root/admin).
- Crypto: AES-256-GCM authenticated encryption, per-message sequence numbers (anti-replay), PBKDF2 key derivation from a shared passphrase.
- Task delivery (fixed in v1.9): POST /api/submit responses are captured and delivered; recv_raw() polls GET /api/status?id=<agent_id> and the handler serves that agent's queued task encrypted — tasks now actually reach the agent.
- Handler: interactive console with per-agent queues; silent and robust against malformed tokens (200 + empty data).
- Timing: configurable beacon interval with jitter.
Scope: this release is Python 3.8+ (client + handler). No C implant is included in the package.
Key Features
- Multi-protocol C2 with unified API: HTTPS (domain fronting), DNS (TXT/A), ICMP
- AES-256-GCM authenticated encryption with sequence numbers (anti-replay)
- PBKDF2 key derivation from passphrase
- Fixed DNS fragmentation: 39-byte chunks fit the 63-char label limit (v1.8 broke every query with 72-char labels)
- Task delivery fixed end-to-end: POST responses captured and GET /api/status?id= serves queued tasks
- Server handler with interactive console and per-agent task queues
- Configurable jitter (timing evasion)
Requirements
- Python 3.8+
- requests (HTTPS channel), dnspython (DNS channel)
- root/admin for raw ICMP
Changelog
- 1.9 (2026-10-19): DNS chunk-size fix (45->39), task delivery fixed (pending capture + agent-id polling), robust malformed-token handling; verified end-to-end over real HTTP
- 1.8 (2025-04-20): store release
Package Contents
Exact contents of the download archive (4 files):
| c2_handler.py | 9,565 B |
| README.md | 2,338 B |
| c2_protocol.py | 26,984 B |
| requirements.txt | 60 B |
Related Tools
Malware Development
Process Hollowing Injector (C)
Malware Development
Reflective DLL Injection Template
Malware Development
Python RAT Core Module
Malware Development