Google Calendar RAT is a PoC of Command&Control (C2) over Google Calendar Events, This tool has been developed for those circumstances where it is difficult to create an entire red teaming infrastructure.
To use GRC, only a Gmail account is required. The script creates a ‘Covert Channel’ by exploiting the event descriptions in Google Calendar. The target will connect directly to Google.”
It could be considered as a layer 7 application Covert Channel (but some friends would say it cannot be 🙂 very thanks to my mates “Tortellini”
GCR attempt to connect to a valid shared Google Calendar link and after generating a unique ID check for any yet-to-be-executed commands.
If it is not able to find any command, it creates a new one (fixed to “whoami”) as a proof of connection. Every event is composed by two part:
3. The Description, which contains the command to execute and the base64 encoded output using the pipe symbol as separator “|”
Focusing specifically on the network aspect, the only connections established will be to Google’s servers, making the connection appear completely legitimate. Let’s check with process hacker:
which results in this
Introduction Bash scripting is a powerful way to automate Linux tasks, but writing a script…
Introduction A self-signed SSL certificate is a certificate that is created and signed by the…
Introduction Debugging is an important part of Bash scripting. When a script does not work…
Introduction Cron jobs are used in Linux to run commands or Bash scripts automatically at…
Introduction Pipes are an important feature in Linux and Bash scripting. A pipe allows you…
Introduction The grep, awk, and sed commands are powerful text-processing tools in Linux. They are…