marcos.luna
93 lines
2.8 KiB
Markdown
93 lines
2.8 KiB
Markdown
+++
|
|
title = "Cazalla"
|
|
chapter = true
|
|
weight = 100
|
|
+++
|
|
|
|
**Cazalla** is a lightweight Windows implant written in C, designed for the [Mythic C2 Framework](https://github.com/its-a-feature/Mythic).
|
|
|
|
|
|
|
|
## Overview
|
|
|
|
Cazalla provides essential post-exploitation capabilities including:
|
|
|
|
- **File System Operations** - Navigate, read, write, and manage files
|
|
- **Process Management** - Enumerate, terminate, and interact with processes
|
|
- **Token Manipulation** - Steal and impersonate security tokens
|
|
- **Network Tunneling** - SOCKS5 proxy and reverse port forwarding
|
|
- **Credential Harvesting** - Automatic credential detection from files
|
|
- **Keylogging** - Low-level keyboard input capture
|
|
- **Full Mythic Integration** - Process Browser, File Browser, OPSEC checking
|
|
|
|
## Command Categories
|
|
|
|
### File System (9 commands)
|
|
- `ls` - List directory contents
|
|
- `cd` - Change directory
|
|
- `pwd` - Print working directory
|
|
- `cat` - Read file contents
|
|
- `cp` - Copy files
|
|
- `mkdir` - Create directory
|
|
- `rm` - Delete file/directory
|
|
- `download` - Download file from target
|
|
- `upload` - Upload file to target
|
|
|
|
### Process Management (2 commands)
|
|
- `ps` - List processes
|
|
- `kill` - Terminate process
|
|
|
|
### Token Operations (5 commands)
|
|
- `list_tokens` - Enumerate tokens
|
|
- `steal_token` - Steal process token
|
|
- `make_token` - Create token from credentials
|
|
- `rev2self` - Revert to original token
|
|
- `whoami` - Display current context
|
|
|
|
### Network Tunneling (2 commands)
|
|
- `socks` - Start/stop SOCKS5 proxy
|
|
- `rpfwd` - Start/stop reverse port forwarding
|
|
|
|
### System Operations (4 commands)
|
|
- `shell` - Execute shell commands
|
|
- `screenshot` - Capture desktop screenshot
|
|
- `keylog_start` - Start keylogger
|
|
- `keylog_stop` - Stop keylogger
|
|
|
|
### Control (2 commands)
|
|
- `sleep` - Adjust beacon interval
|
|
- `exit` - Terminate agent
|
|
|
|
## Key Features
|
|
|
|
### Process Browser Integration
|
|
Cazalla automatically updates Mythic's Process Browser, allowing you to interact with processes directly from the UI.
|
|
|
|
### File Browser Integration
|
|
Seamlessly browse the target's file system through Mythic's File Browser.
|
|
|
|
### OPSEC Checking
|
|
Built-in operational security checking warns operators before executing risky commands.
|
|
|
|
### Context Tracking
|
|
Automatic tracking and display of current working directory and active token impersonation.
|
|
|
|
## Installation
|
|
|
|
See the [Getting Started Guide] for installation and setup instructions.
|
|
|
|
## Documentation
|
|
|
|
- **Commands Reference** - Complete documentation of all commands
|
|
- **Getting Started** - Installation and first steps
|
|
- **Features Overview** - Detailed feature explanations
|
|
- **OPSEC Guide** - Operational security considerations
|
|
- **Logging & Syslog** - System logging and syslog configuration
|
|
- **Usage Examples** - Practical examples and use cases
|
|
- **Troubleshooting** - Common issues and solutions
|
|
|
|
---
|
|
|
|
**Developed by:** Kaseya OFSTeam
|
|
|