nathanlopez/Stitch
Stitch
Stitch is a command and control framework and post-exploitation toolkit designed for managing multiple remote systems from a central server. It functions as a remote administration tool and payload builder, enabling the execution of commands and the deployment of agents across different operating systems.
The project features a cross-platform builder for generating custom executable agents with configurable network bindings and boot behaviors. It utilizes encrypted communication channels to secure traffic between the controller and remote clients, and it supports the execution of dynamic scripts to extend agent functionality at runtime without recompiling binaries.
The framework covers a range of remote administration and system manipulation capabilities, including credential and data exfiltration, keystroke recording, and screen capturing. It provides tools for maintaining a persistent presence on target machines through platform-specific installers and the modification of system registry values and files.
Features
- C2 Infrastructure Managers - Provides a central server to manage the entire command and control infrastructure, including listeners, agents, and encrypted channels.
- Command and Control - Implements a central server to manage remote agents and secure communication via encrypted channels.
- Malware Builders - Ships a utility for generating custom executable agents with platform-specific boot behaviors.
- Payload Builders - Provides a cross-platform builder for custom agents with configurable network and boot settings.
- C2 Payload Generators - Builds cross-platform executable agents with configurable network bindings and boot-time behaviors.
- Command And Control Frameworks - Functions as a comprehensive platform for managing remote access and post-exploitation activities.
- Credential and Data Extraction - Provides capabilities for harvesting password hashes and browser credentials from target systems.
- Payload Generation - Includes a cross-platform builder for creating custom executable agents with configurable network bindings.
- Concurrent Remote Session Managers - Manages multiple simultaneous network connections to remote targets to provide a command shell for parallel execution.
- Cross-Platform Binary Generation - Includes a builder tool that generates platform-specific executable agents for various operating systems and architectures.
- Encrypted Tunneling - Implements secure, encrypted connections between the controller and agents to bypass network detection and prevent interception.
- Runtime Script Execution - Enables the execution of dynamic scripts on remote agents to add new capabilities without recompiling the binary.
- Post-Exploitation Frameworks - Offers a framework for exfiltrating credentials and manipulating system configurations on compromised machines.
- Post-Exploitation Toolkits - Provides a toolkit for escalating privileges, maintaining persistence, and gathering data after initial compromise.
- Remote Access Payloads - Generates custom payloads designed to establish an initial persistent remote connection to a target system.
- Remote Administration Tools - Enables monitoring of user activity through keystroke recording and remote screen capturing.
- Module Functionality Extenders - Provides mechanisms to add custom methods and capabilities to agents via scripts sent from the control server.
- Remote Administration Servers - Provides a master interface to maintain active connections and execute commands or transfer files on remote servers.
- Remote Administration Tools - Enables executing commands and managing device configurations on distant machines through encrypted connections.
- Remote Agent Administration - Provides a centralized interface for commanding and managing multiple remote endpoints from a single point of control.
- Remote Command Execution - Executes commands and manipulates system settings on target machines via a remote network connection.
- Installation Persistence - Implements mechanisms to save software installations to non-volatile storage to ensure persistent access across sessions.
- Persistence Installers - Wraps payloads in platform-specific installers to automate installation and ensure persistence across system boots.
- Secure Communication Channels - Establishes encrypted tunnels that protect data streams between the controller and target from interception.
- Communication Encryption - Implements protocols for securing data transmission between the control server and remote agents.
- Data Exfiltration Tools - Includes utilities for retrieving sensitive system data, such as password hashes and browser credentials, from restricted environments.
- Remote Access Trojans - Facilitates the deployment of persistent agents that provide covert remote control and monitoring.
- User Activity Monitoring - Monitors user activity through background services that record keystrokes and capture screen snapshots.
- System Registry Manipulation - Interacts directly with the operating system registry and system files to modify settings and maintain stealth.
- Registry Configuration Automators - Uses programmatic scripts to modify system registry values to manage software states and hide activity.
