What is JustC2

Overview#

JustC2 is a post-exploitation command-and-control (C2) framework that enables security professionals to manage compromised hosts during authorized penetration tests and red team exercises. It consists of three main components:

1. JustServer — A Go-based teamserver that manages agents, listeners, tasks, and operator connections
2. JustClient — A C++ Qt6 desktop application that provides a rich graphical interface for operators
3. Extenders — Go plugin modules (.so shared libraries) that implement listeners and agent types

Capabilities#

Agent Management#

• Deploy Beacon agents on Windows, Linux, and macOS targets
• Deploy lightweight Gopher agents on Linux targets
• Runtime payload compilation with configurable parameters (sleep, jitter, kill date, working hours)
• Session tracking with detailed host information (OS, architecture, user, process, network)

Communication Protocols#

• HTTP/HTTPS — Beacon agents communicate over HTTP with configurable profiles
• Raw TCP — Both Beacon and Gopher agents support TCP connections
• SMB — Beacon agents can communicate over named pipes for internal pivoting
• DNS — Beacon agents support DNS-based C2 channels for restricted environments

Post-Exploitation Operations#

• File Browser — Navigate and transfer files on compromised hosts
• Process Browser — View and interact with running processes
• Interactive Terminals — Launch interactive shell sessions
• Tunneling — SOCKS4, SOCKS5 (with optional authentication), local port forwarding, and reverse port forwarding
• Screenshots — Capture remote desktop screenshots
• Credential Harvesting — Collect and manage discovered credentials
• Target Tracking — Map the network and track discovered hosts
• Pivoting — Chain agents through parent-child relationships

Collaboration#

• Multiple operators can connect simultaneously to the same teamserver
• Real-time synchronization of sessions, tasks, and data via WebSocket
• Built-in operator chat
• Subscription-based event notifications — operators choose which categories of events they receive

Extensibility#

• Plugin architecture based on Go shared libraries
• Custom listeners and agent types via the extender interface
• AxScript extension system for custom automation
• Dynamic endpoint registration for listener-specific HTTP routes

Intended Use#

JustC2 is designed exclusively for authorized security testing. It should only be used:

• During contracted penetration test engagements with written authorization
• In red team exercises with proper scope and rules of engagement
• In isolated lab environments for security research and training
• In CTF (Capture The Flag) competitions

Unauthorized use of this tool against systems you do not own or have explicit permission to test is illegal and unethical.

Project Structure#

JustC2/
├── JustServer/           # Go teamserver
│   ├── core/
│   │   ├── connector/    # REST API and WebSocket handlers
│   │   ├── database/     # SQLite persistence
│   │   ├── eventing/     # Event bus for real-time notifications
│   │   ├── extender/     # Plugin loader and manager
│   │   ├── profile/      # Configuration parser
│   │   ├── server/       # Core teamserver logic
│   │   └── utils/        # Crypto, logging, token management
│   ├── extenders/        # Extender source code
│   └── profile.yaml      # Default configuration
├── JustClient/           # Qt6 desktop client
│   ├── Source/
│   │   ├── Agent/        # Agent interaction logic
│   │   ├── Client/       # Core client logic
│   │   ├── UI/           # User interface components
│   │   ├── Utils/        # Utility functions
│   │   └── Workers/      # Background workers (WebSocket, downloads)
│   └── Resources/        # Icons, themes, fonts
├── axc2/                 # Shared type definitions (Go module)
├── Makefile              # Build system
└── docker-compose.yml    # Docker build and runtime configs