Alan Framework is a post-exploitation framework useful during red-team activities.
If you find my tool useful, please consider to sponsor me.
If you are a company and want to take part to the Alan early adopter program, read this. Early adopters have access to the Alan agent source code and much more.
- You can run your preferred tool directly in-memory
- JavaScript script execution (in-memory without third party dependency)
- Fully compliant SOCKS5 proxy
- Supported agent types: Powershell (x86/x64), DLL (x86/x64), Executable (x86/x64), Shellcode (x86/x64)
- Server.exe can be executed in Linux (via dotnet core)
- The network communication is fully encrypted with a session key not recoverable from the agent binary or from a traffic dump
- Communication performed via HTTP/HTTPS
- No external dependencies or libraries need to be installed
- A powerful command shell
- The agent configuration can be updated on the fly (you can change port and protocol too)
Blog posts
- Alan c2 Framework v7.0: Hyper-Pivoting
- Alan c2 Framework v6.0: Alan + JavaScript = ♡
- Alan c2 Framework v5.0 - All you can in-memory edition
- Alan post-exploitation framework v4.0 released
- Alan - A post exploitation framework
For more information on its usage please read the documentation.
Demo videos
Alan v7.0.514.10 - SOCKS5 Proxy | Alan v6.0.511.28 - JS Execution | Alan v5.0.509.20 - In-Memory Execution |
---|---|---|
Alan v4.0.0 - x64 Agent && Inject | Alan v3.0.0 - Misc Commands | Alan v2.0.500.23 |
Alan v1.0.0 |
- Implemented
proxy
command for pivoting - The
info
andinfo++
commands display if the agent is using a proxy - Fixed bug on network communication (Issue 2)
- Fixed error in PE loader when function are import via ordinal
- Fixed JS module causing memory free ahead of time
- Fixed error in
run
command that cause the&
option to not work - The log messages are now saved to file
alan.log
- All the generated output and user input is logged to an evidence file inside the
evidences
folder - Added machine ID information to
info
command - Added
Vanilla
package type for agent creation. This allows a better integration of custom packer.
- x86/x64 PE loaders modified to update the PEB->Ldr field. This allows the system to call DLL_PROCESS_DETACH on the injected DLL.
- Increase max response size to 1GB. This fix the download of big files.
- Added agent expiration date to the configuration.
- The
run
was extended to support the execution of Javascript files. info++
command now shows the Volume label and the FS type.
- Implemented
run
command - Implemented
kill
command - Implemented
exec
command - Removed
inject
message since it can be achieved with therun
command in background - Created stager and PE loader to make the agent stealthier. Each generated agent file has a different hash
- Improved code injection to bypass Dynamic Code Policy Mitigation
- It is now possible to specify the agent file name to create during the wizard
- Fixed error in
upload
anddownload
commands - Fixed error in shell creation. The command shell process token did not have the same agent integrity level
- Removed exported function from DLL agent artifact
- Added current working directory to
info
command - Extended
shell
command to execute a single command
- Added
inject
command. This command allows the operator to inject code into a remote process - Added
sleep
command performed in short sleep of 400 msec each. - Introduced Jitter concept in
sleep
- Ported agent to x64 bit (included PE32+ loader)
- Fixed errors in x86 PE loader
- .NET agent runner is now executed in a stealthier way to avoid detection
- It is now possible to specify a custom Web server in the HTTP/S listener response
- Removed command
listeners
since superfluous - Improved
info
command with more information - Error message are more explanatory
- Added information on process token type (elevated or not)
- Added information on process token privileges
- Added information on process token groups
- Renamed agent shell
quit
command toexit
- Implemented agent migration via
migrate
command - Fixed error in retrieving OS version
- Added DLL as agent format in the creation wizard.
- Implemented
ps
command to list the currently running processes - Implemented
download
command to locally download a file or an entire directory - Implemented
upload
command to upload files to the compromised host - Implemented
SuccessRequest
as HTTP server response option to customize the http/s listener response - Implemented
ErrorRequest
to customize the http/s listener response for bad requests - Implemented
prepend
andappend
as HTTP server request option to specify in the agent prof
- Implemented agent
detach
command to temporary exit from a joined agent - Implemented shell
detach
command to temporary exit from a command shell - Implemented
listeners
command to list the available listeners - Implemented HTTPS listener to communicatewith the agent via TLS
- Implemented
get-config
command to download the current agent configuration - Implemented
update
command to update the agent configuration - Windows7 is now supported
- First Release