# RedditC2 | Abusing Reddit API To Host The C2 Traffic

**URL:** <https://onehack.st/t/redditc2-abusing-reddit-api-to-host-the-c2-traffic/235979>\
**Category:** Tools & Scripts\
**Tags:** seo, tools, freebies, social-media\
**Created:** [April 4, 2023, 11:56am UTC](https://onehack.st/t/redditc2-abusing-reddit-api-to-host-the-c2-traffic/235979 "2023-04-04T11:56:31Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\
**Post date:** [April 4, 2023, 11:56am UTC](https://onehack.st/t/redditc2-abusing-reddit-api-to-host-the-c2-traffic/235979/1 "2023-04-04T11:56:31Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/1/e/1e70832a3e0eff60f18f0df283a26c70ba3b4ed2.png)

# RedditC2

Abusing Reddit API to host the C2 traffic, since most of the blue-team members use Reddit, it might be a great way to make the traffic look legit.

[![](https://user-images.githubusercontent.com/37262788/205896739-7feb0cea-cf04-4011-aa6b-66ba5b82b9ba.png)](https://user-images.githubusercontent.com/37262788/205896739-7feb0cea-cf04-4011-aa6b-66ba5b82b9ba.png)

* * *

> 🚫 [Disclaimer]: Use of this project is for **Educational/ Testing purposes only**. Using it on **unauthorised machines** is **strictly forbidden**. If somebody is found to use it for **illegal/ malicious intent** , author of the repo will **not** be held responsible.

* * *

## Requirements

Install **PRAW** library in python3:

pip3 install praw

## Quickstart

See the [Quickstart guide](https://github.com/kleiton0x00/RedditC2/wiki/Setup) on how to get going right away!

## Demo

reddit\_c2\_demo.mp4

## Workflow

### Teamserver

1. Go to the specific Reddit Post & post a new comment with the command ("in: ")
2. Read for new comment which includes the word “out:”
3. If no such comment is found, go back to step 2
4. Parse the comment, decrypt it and read it’s output
5. Edit the existing comment to “executed”, to avoid reexecuting it

### Client

1. Go to the specific Reddit Post & read the latest comment which includes “in:”
2. If no new comment is detected, go back to step 1
3. Parse the command out of the comment, decrypt it and execute it locally
4. Encrypt the command’s output and reply it to the respective comment (“out:” )

Below is a demonstration of the XOR-encrypted C2 traffic for understanding purposes:  
[![Screenshot from 2022-12-15 10-58-34](https://user-images.githubusercontent.com/37262788/207849406-6c221102-9352-46dc-a461-947b66e3a712.png)](https://user-images.githubusercontent.com/37262788/207849406-6c221102-9352-46dc-a461-947b66e3a712.png)

## Scanning results

Since it is a custom C2 Implant, it doesn’t get detected by any AV as the bevahiour is completely legit. [![](https://user-images.githubusercontent.com/37262788/205900070-783c65b3-4d83-4d5e-82e3-c20571b403e1.png)](https://user-images.githubusercontent.com/37262788/205900070-783c65b3-4d83-4d5e-82e3-c20571b403e1.png)

## TO-DO

- Teamserver and agent compatible in Windows/Linux
- Make the traffic encrypted
- Add upload/download feature
- Add persistence feature
- Generate the agents dynamically (from the TeamServer)
- Tab autocompletion

## Credits

Special thanks to [@T4TCH3R](https://github.com/T4TCH3R/) for working with me and contributing to this project.

## GitHub:

> **[GitHub - kleiton0x00/RedditC2: Abusing Reddit API to host the C2 traffic, since...](https://github.com/kleiton0x00/RedditC2)**
>
> Abusing Reddit API to host the C2 traffic, since most of the blue-team members use Reddit, it might be a great way to make the traffic look legit.