gloxec/CrossC2
Freegenerate CobaltStrike's cross-platform payload
FreeFree tier
About gloxec/CrossC2
CrossC2 is an open-source framework that extends CobaltStrike's capabilities to support security assessment of non-Windows platforms, including Linux, macOS, and other Unix-like systems. It provides tools for generating cross-platform beacons (payloads), custom C2Profile traffic protocol configurations, and memory loading via the CrossC2Kit extension. The framework supports multiple CobaltStrike versions (CS3.14, CS4.0, CS4.X) and includes an Aggressor Script-based expansion kit (CrossC2Kit) for automating red team operations and post-penetration module development on Unix platforms. It is intended for internal use by enterprises and organizations for authorized security testing.
Key Features
Generate beacons for Linux, macOS, and other Unix-like platforms
Supports CobaltStrike versions CS3.14, CS4.0, CS4.X (4.1~4.8)
Custom C2Profile traffic protocol via dynamic library or profile file
One-click online script generation for easy deployment
Memory loading support via CrossC2Kit_Loader.cna
Environment variable configuration for beacon working directory, protocol library, and C2 settings
DEBUG mode for monitoring beacon online status
CrossC2Kit extension with Aggressor Script API for Unix post-penetration automation
File management and process listing functions for cs4.x (via Loader)
Supports rebind library for custom protocol dynamic libraries
Pros & Cons
Pros
- Extends CobaltStrike to support non-Windows platforms, filling a critical gap in security testing
- Open-source and free to use (with enterprise/internal restrictions)
- Supports multiple CobaltStrike versions (CS3.14, CS4.0, CS4.X)
- Highly customizable with custom C2Profile traffic protocols and dynamic libraries
- Includes CrossC2Kit for automation and extended API on Unix beacons
- Memory loading capability for stealthier payload execution
Cons
- Intended only for internal use by enterprises and organizations; non-professionals are not allowed
- Certain instability noted by the developer; may require careful configuration
- Depends on CobaltStrike, which is a commercial tool (not included)
- Lacks some native CobaltStrike features on Unix (e.g., file management, process listing) without additional loader
- Documentation and support may be limited compared to mainstream tools
Best For
Security assessment of Linux, macOS, and other Unix-like systems using CobaltStrikeRed team operations requiring cross-platform beaconsPost-penetration module development and automation for Unix platformsTesting custom C2 communication profiles in non-Windows environments
FAQ
What is CrossC2?
CrossC2 is an open-source framework that generates cross-platform payloads (beacons) for CobaltStrike, enabling security assessments on Linux, macOS, and other Unix systems.
Which versions of CobaltStrike does CrossC2 support?
It supports CS3.14 (with bug fixes), CS4.0, and CS4.X (4.1 through 4.8).
How do I generate a beacon with CrossC2?
Use the genCrossC2 command-line tool, specifying the listener IP/domain, port, beacon keys, optional protocol library or C2Profile, target platform, and architecture.
What is CrossC2Kit?
CrossC2Kit is an expansion pack that provides an Aggressor Script engine for automating red team operations and extending CobaltStrike's client to control Unix platform beacons.
Is CrossC2 free?
Yes, it is open-source and free to use, but it is restricted to internal use by enterprises and organizations for authorized security testing.