A Next-Generation Command & Control Framework with Advanced GUI and Multi-Platform Support
Built after doing the SANS SEC670 Course, may be buggy and unsafe, will not update or fix anything. But can be used as something to build from.
- Cursor-Inspired Interface: Professional IDE-like experience with movable dock widgets
- Real-Time Monitoring: Live beacon status updates and network visualization using D3.js
- Integrated Terminal: Built-in command execution with syntax highlighting
- AI Assistant: Integrated Claude/OpenAI support for intelligent operations
- Command Palette: Quick access to all framework functions (Ctrl+Shift+P)
- Network Visualization: Interactive network topology and beacon relationships
- Multi-Protocol Support: HTTP/HTTPS, DNS-over-HTTPS, SMB, SOCKS5 proxy protocols
- Real-Time Communication: WebSocket-based live updates and notifications
- Robust Database: SQLite backend with comprehensive beacon and operation tracking
- JWT Authentication: Secure multi-client access with session management
- Health Monitoring: Built-in system monitoring and performance metrics
- Multi-Platform: Windows C++ and Android Kotlin implementations
- Protocol Flexibility: HTTP, HTTPS, DNS tunneling, SMB, SOCKS5 with HMAC authentication
- BOF Integration: 100+ pre-built Beacon Object Files from industry-standard collections
- Modular Generation: Template-based beacon creation with customizable features
- AI-Powered Generation: Automated beacon creation with 10+ implementation variants
- CS-Situational-Awareness-BOF: Complete collection of reconnaissance modules
- Extension-Kit: Advanced post-exploitation capabilities
- Argument Generation: Intelligent parameter parsing and validation
- Custom BOF Support: Framework for developing and integrating custom modules
┌─────────────────────────────────────────────────────────────┐
│ NekomataC2 Framework │
├─────────────────┬─────────────────┬─────────────────────────┤
│ GUI Client │ Team Server │ Beacons │
│ (PyQt6) │ (Flask) │ (Multi-Platform) │
├─────────────────┼─────────────────┼─────────────────────────┤
│ • Dock Widgets │ • REST API │ • Windows C++ │
│ • D3.js Viz │ • WebSocket │ • Android Kotlin │
│ • AI Assistant │ • SQLite DB │ • HTTP/HTTPS/DNS │
│ • Terminal │ • JWT Auth │ • SMB/SOCKS5 │
│ • Cmd Palette │ • Multi-Client │ • BOF Integration │
└─────────────────┴─────────────────┴─────────────────────────┘
- Python 3.8+ with pip package manager
- Visual Studio 2022 (recommended) or MinGW for beacon compilation
- Windows 10/11 (primary support) or Linux (experimental)
-
Clone the repository:
git clone https://github.com/puffert/NekomataC2.git cd NekomataC2 -
Install Python dependencies (each component has its own requirements file):
pip install -r nekomata_c2_server/requirements.txt # team server pip install -r nekomata_c2_client/requirements.txt # GUI client pip install -r requirements.txt # beacon/AI tooling (optional)
-
Start the team server. There are no default credentials — the server refuses to start without an admin password and secret key:
# Linux/macOS: export ADMIN_PASSWORD="choose-a-strong-password" export NEKOMATA_SECRET_KEY="$(python -c 'import secrets; print(secrets.token_hex(32))')" # Windows (PowerShell): # $env:ADMIN_PASSWORD = "choose-a-strong-password" # $env:NEKOMATA_SECRET_KEY = python -c "import secrets; print(secrets.token_hex(32))" python nekomata_c2_server/teamserver.py
On first run the server creates the
adminaccount with the password fromADMIN_PASSWORD. For a guided production setup, runpython nekomata_c2_server/setup_server.pyinstead. -
Launch the GUI client:
python nekomata_c2_client/main.py
-
Access the interface:
- Connect to
https://localhost:5000in the client - Log in with the
adminaccount created in step 3
- Connect to
Comprehensive documentation is available in the /docs directory:
- Installation Guide - Complete setup and configuration
- User Guide - GUI operations and workflows
- Architecture - Technical system design
- Beacon Development - Custom beacon and BOF development
- API Reference - REST API and WebSocket documentation
- HTTP/HTTPS: Standard web-based communication with TLS encryption
- DNS-over-HTTPS: Covert DNS tunneling through legitimate DoH providers
- SMB: Named pipe communication for internal lateral movement
- SOCKS5: Proxy capabilities with HMAC-SHA256 authentication
- BOF Support: Execute Beacon Object Files with argument generation
- HTTP/HTTPS: Mobile beacon implementation in Kotlin
- Background Operations: Persistent operation with minimal battery impact
- Stealth Features: Anti-detection and evasion capabilities
- CS-Situational-Awareness-BOF: 58 reconnaissance and discovery modules
- Extension-Kit: Advanced post-exploitation capabilities including:
- Active Directory enumeration and exploitation
- Credential harvesting and manipulation
- Privilege escalation techniques
- Lateral movement capabilities
- Process and memory manipulation
- Template System: Standardized BOF development framework
- Argument Parser: Automated parameter handling and validation
- Integration Tools: Seamless deployment and execution pipeline
- Multiple LLM Support: Claude, OpenAI GPT-4, and local models
- Variant Generation: Creates 10+ unique implementation approaches
- Security Analysis: Automated OPSEC review and recommendations
- Build Integration: Direct Visual Studio project generation
- Command Suggestions: Context-aware operation recommendations
- Automated Reporting: AI-generated operation summaries and documentation
- Threat Modeling: Dynamic assessment of deployment scenarios
- TLS Encryption: End-to-end encrypted communications
- JWT Authentication: Secure multi-client session management
- HMAC Validation: Message authentication for critical operations
- Certificate Pinning: Protection against man-in-the-middle attacks
- Operational Security: Built-in OPSEC guidelines and warnings
Visual Studio 2022 integration provides automated beacon compilation:
# Generate and build HTTP beacon
python beacon_generator.py --protocol http --target windows
# Output: Compiled beacon ready for deployment// Example BOF implementation
#include "beacon.h"
void go(char* args, int len) {
// Your custom functionality here
BeaconOutput(CALLBACK_OUTPUT, "Custom BOF executed", 22);
}We welcome contributions to NekomataC2! Please see our contributing guidelines and ensure all security best practices are followed.
This framework is intended for authorized security testing and red team operations only. Users are responsible for ensuring compliance with all applicable laws and regulations. Unauthorized use of this software is strictly prohibited.
NekomataC2 is released under the MIT License. See LICENSE for details.
NekomataC2 - Advanced C2 Framework for Professional Security Operations