ENDGAME C2 FRAMEWORK

ENDGAME is a professional command and control framework built for authorized red team engagements, penetration testing, and educational security research. Designed to simulate realistic adversary techniques, assess detection coverage, and help security teams understand their defensive gaps — with a built-in AI Console that turns natural language into executed commands and automatically analyzes every result.

Hecho con IA, pensado y dirigido por un humano.

🌐 endgamec2framework.com  ·  📄 Documentation

Quick Start

git clone https://github.com/endgamec2framework/endgame
cd endgame
./install.sh

Re-run ./install.sh to update — it will pull the latest code and rebuild while preserving certificates and operator profiles.

Full setup guide: Documentation → Installation

🤖 AI Console — Natural Language Red Teaming

ENDGAME's AI Console is a first-class feature that brings an AI co-pilot directly into the operator workflow. It's not a chatbot tacked on the side — it lives in the same panel as your agent terminals, knows the full C2 command set, and has real-time context about the target: hostname, OS, user, privileges, and transport.

How it works

1. Right-click any agent in the Agents table → Open AI Console
2. An 🤖 tab opens in the bottom console pane — side by side with your regular terminal tabs
3. Describe your objective in natural language (in any language)
4. The AI suggests one or more C2 commands, each wrapped in a ▶ Ejecutar execute card
5. Confirm execution — the task is dispatched to the real agent
6. The output comes back and the AI automatically analyzes the result and proposes the next step

 
Left: right-click menu · Right: AI Console tab open in the console pane (qwen3.6)

Command executed on a real mTLS agent · AI analyzes output and suggests SHELL tasklist /v for SYSTEM-privilege process enumeration

Key capabilities

Supported models (Ollama)

Any model available in your Ollama instance works. Recommended for red team context:

• qwen3.6:latest — default · fast · good instruction following
• qwen3.6:35b-a3b-coding-mxfp8 — larger · stronger code/command reasoning
• deepseek-r1:8b / deepseek-r1:32b — reasoning models · good at multi-step attack chains
• Any Anthropic Claude model via the Claude API

What's inside

Agent capabilities

✓ = implemented · 🔧 = in progress / planned · — = not available

Platform support

Building for Linux (from a Linux host — agents are compiled natively):

# Go
GOOS=linux GOARCH=amd64 go build -o agent_linux .

# Rust
cargo build --release --target x86_64-unknown-linux-gnu

# C
make -f Makefile.linux AGENT_SERVER_URL=https://<c2>:<port>

# Nim
./build_linux.sh

Agent transports: HTTP · HTTPS · mTLS · DNS · DoH · SMB pipe · TCP

Mesh relay: agents can register as HTTP or TCP pivots; when an agent loses direct connectivity to the teamserver (≥ 3 consecutive beacon failures), it automatically falls back to any known peer and relays its beacon through that agent's existing transport. The teamserver distributes the peer list in every beacon response so agents always have a current fallback. Unlike fully decentralised P2P overlays (libp2p/DHT), relay paths in ENDGAME are operator-designated and logged — the operator decides which agent acts as pivot, and the relay chain is always explicit and stoppable on demand.

Evasion: AMSI (VEH/DR0) · ETW blind · NTDLL unhook · Ekko XOR sleep masking · indirect syscalls (Hell's Gate) · stack spoofing · API hashing (PEB walk) · PPID spoof · anti-sandbox · header wipe · UDRL phantom DLL · BLOCKDLLS · DNS canary burn detection

Injection: remote thread · APC early-bird · thread hijack · fork-and-run · hollowing

Post-ex: screenshot · keylogger · clipboard · LSASS dump · token theft · UAC bypass · persistence

Network discovery: ARP (returns MAC, no elevation on Windows) · ICMP ping sweep · TCP probe — selectable per scan

Lateral movement: psexec · smbexec · atexec · wmi · dcom · winrm · ssh

MITRE ATT&CK: 50+ commands mapped across 12 tactics · Navigator layer export · technique matrix in GUI

See the full documentation for commands, API reference, IOC list, and operator guide.

Architecture notes

ENDGAME implements controlled mesh relay rather than a fully decentralised P2P overlay. Relay paths are operator-designated: the operator chooses which agent acts as pivot, and the relay chain is explicit, stoppable on demand, and logged — no dependency on public DHT infrastructure like libp2p that enterprise firewalls routinely block.

Cross-platform agents: All four agents now support Windows and Linux. The Go agent additionally supports macOS. Platform-specific features (Windows evasion, AMSI/ETW patching, Hell's Gate syscalls, stack spoofing, token theft, PE injection) are Windows-only and are compiled out on Linux; the Linux build retains the full beacon, shell, file ops, SOCKS5, port scan, persistence, credential harvesting, and pivot functionality. See the Platform support matrix below for per-feature detail and the build_linux.sh script in each agent directory for Linux compilation.

DNS canaries: each payload build embeds a unique per-build canary subdomain. When a sandbox or AV scanner dynamically analyses the binary, the agent's startup DNS lookup resolves canary.<token>.<c2_domain> — intercepted by the C2's authoritative DNS server — and the operator receives a real-time burn alert via the events stream. Canaries are tracked per-build in the database and never reused.

Indirect syscalls + stack spoofing (Nim): syscalls.nim resolves SSNs at runtime via Hell's Gate (reads mov eax,SSN from ntdll stubs) with Halo's Gate fallback for EDR-patched stubs. When both a syscall;ret gadget and a call rel32;ret gadget are found in ntdll .text, the agent upgrades to 110-byte spoofed stubs that plant the gadget address at [RSP] before the syscall — making the call-stack visible to EDR appear to originate from within ntdll rather than agent code.

API hashing (C): api_resolve.c uses DJB2 hashing and a PEB InLoadOrderModuleList walk to resolve 33 sensitive WinAPI functions at runtime. None of these functions appear in the binary's import table.

Screenshots

Graph view + AI Console — query: "Who are the domain administrators?" · response identifies tywin.lannister, robert.baratheon, petyer.baelish, lord.varys in SEVENKINGDOMS.LOCAL

🎯 Vector 1: Registry AutoLogon (CRÍTICO) — AI Console docked to the right panel identifies plaintext credentials stored in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon after running SharpUp. No exploit required.

Legal Notice

This tool is for authorized security testing, educational use, and lab environments only. Use against systems without explicit written authorization is illegal and strictly prohibited. By using this software you agree to the Ethical Use Policy.

Please do not open issues regarding EDR/AV detection. Default builds include known IOCs — see IOC documentation. Operators should recompile with custom certs, build flags, and malleable profiles for authorized engagements.