Nighthawk C2 Framework v1.0 Apex (Fixed API & Setup Scripts)

[ksbicorporation]

Hey RevTeam community,


Following some earlier reports regarding API startup issues, the startup scripts and API server backend configuration have been fully patched. Below is the release package along with technical documentation and setup details for Nighthawk C2.

---

Framework Overview & Architecture​

Nighthawk C2 is a commercial Command and Control framework designed for high-OpSec red team operations and adversary simulation. It provides modular staging, custom agent integration, and flexible automation interfaces.

Key Technical Capabilities:​

• Cross-Platform Avalonia UI: Features a native operator client written in Avalonia that runs seamlessly on both Windows and Linux. Includes side-by-side split console views for parallel tasking and customizable XML-driven UI themes.
• JSON RPC API & Automation: Backend operations are instrumented through a JSON RPC web service API supporting HTTPS and WebSocket real-time event notifications. Official Python (nighthawk_api) and .NET SDK libraries are provided to automate beacon tasking, BOF execution, payload generation, and host triage.
• Client-Side Python Modules: Integrated directly into the UI via PythonNet, allowing operators to execute Python scripts, register custom commands, and chain post-exploitation execution.
• Open Agent Architecture: Allows operators to develop and integrate custom implants (such as Python pyHawk or .NET SharpHawk) communicating over Nighthawk’s native wire protocol directly into the teamserver and UI.
• Stager Kit & Multi-Stage Staging: Supports a 3-stage deployment workflow: Stage 0 (NHLoader PE loader), Stage 1 (NHStager SMB/TCP stagers), and Stage 2 (Nighthawk implant) for minimal initial footprint.
• Advanced Memory Evasion & CET Stack Masking: Features CET-compliant call stack spoofing using Counterfeit Object-Oriented Programming (COOP) gadgets and User Defined Synthetic Frames for monitored NT APIs (e.g., NtMapViewOfSection, NtCreateThreadEx). Includes IAT hooking, indirect syscall execution, threadpool proxying, user-mode unhooking, and module stomping with exception unwind metadata.
• NHConfigurator: A built-in configuration wizard for rapid profile generation, custom network profile creation, and EDR evasion preset selection.

---

Installation & Setup Guide​

1. Prerequisites: Ensure Python 2.7 runtime is installed for the backend API server and the OPENSSL_BINARY environment variable is exported/defined.
2. Launch Services: Execute the main launcher script (start_nighthawk.bat or Start-Nighthawk.ps1) located in the root directory.
3. Default Connection Endpoints & Credentials:
   • API Server:
     Please, Log in to view URLs content!
   • Listener Service:
     Please, Log in to view URLs content!
     (test_listener)
   • Default Credentials: admin / pwned123

---

Operational Security Reminder​

Always execute post-exploitation software and C2 infrastructure within isolated virtual machines or Docker containers disconnected from local network resources.

---

Please, Log in to view URLs content!