Architecture

The following diagrams show how things work in NorthStar C2 and how the NorthStar Stager interacts with C2.

NorthStar Stager Registration Workflow

The stager registration process consists of 2 phases;

First phase:

1. NorthStar Stager sends an unique id value to login.php with HTTP POST method. This value is XORed with a hard-coded key and is in base64 format.
2. The C2 Server decrypts this value and checks if the unique id starts with a "N", ends with a "q" and is less than 20 characters.If everything checks out, the value is registered into the C2 database.
3. A second XOR key, which will be used for communications, is transferred from NorthStar C2 Server to NorthStar Stager.
4. NorthStar Stager receives and registers the XOR key.

Second phase:

1. NorthStar Stager sends a HTTP POST request to /update.php. This request contains information about the victim machine including hostname, username, user privileges and working directory.The data sent is encrypted with the XOR key taken in the previous phase and is in base64 format.
2. NorthStar C2 server decrypts the incoming data, checks the id value and saves the information on the database and returns "HTTP 200 OK" response to the NorthStar Stager.
3. NorthStar Stager receives the response and registration is complete.

Command & Control Workflow

1. User issues a command to the NorthStar Stager from C2 server by sending a HTTP POST request to /interact.php
2. Stager receives the command from /smanage.php
3. Stager sends the output of the command to /smanage.php
4. The command output is inserted into the database on the server side
5. Command output can be seen in interact.php
6. In each new command, the output of the old command is deleted from the database.