Intro Covenant v0.5 is being released today and includes a set of new features, a major UI update, and lots of bug fixes. This will be a short post documenting some of the major feature updates. Blazor: Front-End C# The largest update in v0.5 is migrating the interface over to the Blazor framework. Blazor…

As of Covenant v0.4, Covenant provides options that allow developers to integrate custom C2 communication protocols into an operation within Covenant. This post provides a guide for Listener development, introduces the new C2Bridge project, and describes how C2Bridges can be used within Covenant. HTTP Protocol For C2 (Command and Control), we require…

Intro Covenant v0.3 is being released today and includes a brand new web-based interface. In this post, we will discuss Covenant’s new interface and other important usability features. Covenant has been under development for over a year, and the initial public release was over seven months ago. Development has been primarily…

In this post we will discuss the design and implementation of peer-to-peer command and control protocols in general, as well as the concrete example of the peer-to-peer design implemented in Covenant, an open-source command and control framework, as of v0.2 (released today), which I will refer to often. Command and Control To start…

I’ve slowly been open sourcing .NET tradecraft that I’ve been working on for some time, including the SharpSploit, SharpGen, and SharpShell projects. All of these projects have originated from supporting development on a larger project that I’ve been working on over the last year, Covenant. Covenant is a .NET command…

In my last post I introduced SharpGen, a .NET Core console application that utilizes the Roslyn C# compiler to quickly cross-compile .NET Framework console applications and libraries. In this post I’ll introduce a very similar, but slightly different tool: SharpShell! To preface, I view SharpShell mostly as a fun proof-of-concept…

As offensive toolsets continue to move towards using C# as the language of choice for post-exploitation, I thought it’d be useful to think about some of the operational challenges associated with using C# offensively, especially as compared with PowerShell. PowerShell has many operational and convenience benefits for offensive operators that…

Today, I’m releasing SharpSploit, the first in a series of offensive C# tools I have been writing over the past several months. SharpSploit is a .NET post-exploitation library written in C# that aims to highlight the attack surface of .NET and make the use of offensive .NET …