Covenant : A .NET Command & Control Framework That Aims To Highlight The Attack Surface

Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.

Covenant is an ASP.NET Core, cross-platform application that includes a web-based interface that allows for multi-user collaboration.

Also Read – Hacktronian : All in One Hacking Tool for Linux & Android

Installation

Be sure to clone Covenant recursively to initialize the git submodules: 

git clone –recurse-submodules https://github.com/cobbr/Covenant

Option 1 – Dotnet Core

The easiest way to use Covenant is by installing dotnet core. You can download dotnet core for your platform from here.

Once you have installed dotnet core, we can build and run Covenant using the dotnet CLI:

$ ~ > git clone –recurse-submodules https://github.com/cobbr/Covenant
$ ~ > cd Covenant/Covenant
$ ~/Covenant/Covenant > dotnet build
$ ~/Covenant/Covenant > dotnet run

Option 2 – Docker

Covenant can also be run with Docker. There are a couple of gotchas with Docker, so we only recommend using docker if you are familiar with docker or are willing to learn the subtle gotchas.

First, build the docker image:

$ ~ > git clone –recurse-submodules https://github.com/cobbr/Covenant
$ ~ > cd Covenant/Covenant
$ ~/Covenant/Covenant > docker build -t covenant

Now, run Covenant within the Docker container (be sure to replace the “</absolute/path/to/Covenant/Covenant/Data>” with your own absolute path!):

$ ~/Covenant/Covenant > docker run -it -p 7443:7443 -p 80:80 -p 443:443 –name covenant -v :/app/Data covenant

The -it parameter is a Docker parameter that indicates that we should begin Covenant in an interactive tty, and can be excluded if you would not like to attach to the tty.

The -p parameters expose ports to the Covenant Docker container. You must expose port 7443 and any other ports you would like to start listeners on.

The -v parameter creates a shared Data directory between the host and the container. Be sure to specify an absolute path to your data directory, a relative path will not work.

Once Covenant has been started, you can disconnect from the interactive interface at any time by pressing Ctrl+p and Ctrl+q consecutively.

To stop the container, you can run:

$ ~/Covenant/Covenant > docker stop covenant

And to restart Covenant interactively (with all data saved), you can run:

$ ~/Covenant/Covenant > docker start covenant -ai

Alternatively, to remove all Covenant data and restart fresh, you can remove and run again (again, be sure to replace the “</absolute/path/to/Covenant/Covenant/Data>” with your own absolute path!):

$ ~/Covenant/Covenant > docker rm covenant
$ ~/Covenant/Covenant > docker run -it -p 7443:7443 -p 80:80 -p 443:443 –name covenant -v :/app/Data covenant –username AdminUser –computername 0.0.0.0

Registration

After starting Covenant, you must register an initial user through the web interface. Navigating to the web interface will allow you to register the initial user:

Once the initial user has been registered, open registration will be closed, and new users will have to be created by an Administrative user.

Features

Covenant has several key features that make it useful and differentiate it from other command and control frameworks:

• Intuitive Interface – Covenant provides an intuitive web application to easily run a collaborative red team operation.
• Multi-Platform – Covenant targets .NET Core, which is multi-platform. This allows Covenant to run natively on Linux, MacOS, and Windows platforms. Additionally, Covenant has docker support, allowing it to run within a container on any system that has docker installed.
• Multi-User – Covenant supports multi-user collaboration. The ability to collaborate has become crucial for effective red team operations. Many users can interact with the same Covenant server and operate independently or collaboratively.
• API Driven – Covenant is driven by an API that enables multi-user collaboration and is easily extendible. Additionally, Covenant includes a Swagger UI that makes development and debugging easier and more convenient.
• Listener Profiles – Covenant supports listener “profiles” that control how the network communication between Grunt implants and Covenant listeners look on the wire.
• Encrypted Key Exchange – Covenant implements an encrypted key exchange between Grunt implants and Covenant listeners that is largely based on a similar exchange in the Empire project, in addition to optional SSL encryption. This achieves the cryptographic property of forward secrecy between Grunt implants.
• Dynamic Compilation – Covenant uses the Roslyn API for dynamic C# compilation. Every time a new Grunt is generated or a new task is assigned, the relevant code is recompiled and obfuscated with ConfuserEx, avoiding totally static payloads. Covenant reuses much of the compilation code from the SharpGen project, which I described in much more detail in a previous post.
• Inline C# Execution – Covenant borrows code and ideas from both the SharpGen and SharpShell projects to allow operators to execute C# one-liners on Grunt implants. This allows for similar functionality to that described in the SharpShell post, but allows the one-liners to be executed on remote implants.
• Tracking Indicators – Covenant tracks “indicators” throughout an operation, and summarizes them in the Indicators menu. This allows an operator to conduct actions that are tracked throughout an operation and easily summarize those actions to the blue team during or at the end of an assessment for deconfliction and educational purposes. This feature is still in it’s infancy and still has room for improvement.
• Developed in C# – Personally, I enjoy developing in C#, which may not be a surprise for anyone that has read my latest blogs or tools. Not everyone might agree that development in C# is ideal, but hopefully everyone agrees that it is nice to have all components of the framework written in the same language. I’ve found it very convenient to write the server, client, and implant all in the same language. This may not be a true “feature”, but hopefully it allows others to contribute to the project fairly easily.