Koadic C: Windows COM Command & Control Framework
Post-exploitation tool using COM objects and Windows Script Host with compatibility to Windows 2000.
Summary
COM-Based Post Exploitation
Koadic C3 is a Windows post-exploitation tool similar to Meterpreter and PowerShell Empire. The key difference is using Windows Script Host (JScript/VBScript) for operations.
Wide Compatibility
Compatibility spans from Windows 2000 without service packs to Windows 10. COM object availability on all versions enables universal deployment.
COM Object Exploration
Default COM objects provide large, underexplored attack surface. Numerous Windows scripting quirks with interesting workarounds were discovered during development.
Capabilities
Payloads serve completely in memory from stage 0 onward. Cryptographically secure communications over SSL/TLS work depending on victim OS availability. Multiple fork-to-shellcode methods work despite traditional limitations. Development builds on work by engima0x3, subTee, and other researchers.
Related talks
Main Track 1·20 min
Dor Azouri
Exploiting Windows BITS service state files to inject jobs and execute code as NT AUTHORITY/SYSTEM.
Main Track 1·40 min
Marina Simakov, Igal Gofman
Lesser-known persistence mechanisms using Kerberos delegation and advanced authentication abuse.
Main Track 1·18 min
William Knowles
Six Office-based persistence mechanisms using add-ins and extensibility features.