Vulnerabilities in Open Source C2 Frameworks

The article discusses the various security vulnerabilities identified in open-source command and control (C2) frameworks. The author identified RCE vulnerabilities in Mythic, Sliver, Havoc, Ninja, Covenant and Shad0w. The PoCs are published on GitHub. Their write-ups show that Ninja and SHAD0W can be hacked back by a malicious agent without any authentication, while the Sliver, Havoc and Covenant exploits need a low-privileged operator or user account on the teamserver. Havoc’s default profile contains hardcoded passwords, so running it unchanged on a public network is an open invitation. Havoc had already been in the spotlight in August, when CVE-2024-41570 described an unauthenticated server-side request forgery in its demon callback handling that lets attackers send arbitrary network traffic from the team server.