jakobfriedl/conquest is a Nim-based command & control and post-exploitation framework for penetration testing and adversary simulation against systems you are explicitly authorized to test.
| Tool | jakobfriedl/conquest — feature-rich, malleable C2/post-exploitation framework written entirely in Nim for authorized penetration testing |
| Category | Command & control framework / adversary simulation tooling |
| Primary Use | Operating authorized red team engagements: managing HTTP/SMB listeners, generating Monarch agent payloads, and orchestrating post-exploitation from a multi-user operator client |
| Safe Use | Strictly for educational purposes, research, and authorized security testing of systems you own or have explicit written permission to attack, as stated in the project's own caution notice |
| Telemetry Note | The Monarch agent's sleep obfuscation, AMSI/ETW patching, and encrypted ChaCha20-Poly1305 channel challenge defenders; hunt angles include hardware breakpoint exceptions on amsi.dll/ntdll ETW paths, SMB pipe anomalies, and process/token manipulation telemetry |
conquest sits squarely in the crowded but still-growing niche of open-source adversary simulation frameworks, and its most immediate distinguishing trait is that every component — the team server, the operator client, and the implant — is written in Nim. That language choice is not cosmetic: Nim compiles through C and produces native binaries that are less represented in AV/EDR signature corpora than C++ or C#, and the project leans on established Nim Windows bindings like winim and prior art like OffensiveNim, NimPlant, and Nimhawk. With 421 stars and a BSD-3-Clause license, the project is young but visibly committed, and the README's caution notice explicitly scopes it to education, research, and authorized testing of systems you own or are permitted to attack. This article is a documentary analysis of that public README for defensive professionals and authorized operators, not an operational guide.
Architecturally, conquest follows the classic three-tier C2 model, which the README describes in plain terms. The team server hosts listeners and coordination state, the operator client is a multi-user GUI, and the Monarch agent is the Windows-focused implant that runs on target endpoints during authorized engagements. The team server supports HTTP and SMB listener types, a pairing that gives operators both egress-oriented and lateral, named-pipe-based channels — a combination familiar from commercial frameworks like Cobalt Strike, which the author openly lists as an inspiration alongside Havoc and AdaptixC2. That acknowledgement section is unusually candid and useful for analysts mapping this tool into the broader ecosystem: it is honest about its lineage rather than pretending novelty.
The network layer is where the framework's malleability claim is substantiated. conquest implements an advanced malleable profile system configured in TOML (v1.1), letting red teams customize how C2 traffic looks on the wire within environments they are authorized to test. Beneath the profile layer, communications are protected with an X25519 key exchange followed by symmetric ChaCha20-Poly1305 encryption, which means session traffic is authenticated and confidential rather than merely obfuscated. From a defensive research standpoint, this means plaintext signature-based network detection is largely off the table; monitoring effort shifts to behavioral indicators — beacon periodicity, URI structure anomalies, and JA3/TLS fingerprinting of the HTTP transport where applicable.
The operator experience is a Dear ImGui-based GUI connected over WebSockets, with multi-client support and password-based user authentication — a design that reflects team-oriented engagement workflows where several operators share one engagement. The README lists a graph view for agent sessions, file and process browser components, console history with auto-complete, and console search with Regex support. Loot management on the server side covers downloads, screenshots, and credentials, and all operator activity is logged. That audit trail matters more than it might appear: in professional authorized engagements, the operator action log is a core deliverable for reconstruction and client debriefing, and its presence signals the project's serious rather than toy intent.
Extensibility is delivered through a Python scripting API for creating commands, backed by what the README calls a battle-tested module ecosystem hosted in a separate jakobfriedl/conquest-modules repository. Splitting modules from the core is a sensible hygiene decision — it lets the framework core evolve independently and lets the community contribute capability without touching the server. For defenders, that split is also worth watching, because the module repository effectively documents which post-exploitation behaviors the framework is likely to exercise against lab or engagement targets.
The Monarch agent is the most technically dense part of the README and the part with the clearest detection implications. It supports x64 and x86 architectures and generates .exe, .dll, and .svc.exe payload types — the latter two enabling DLL side-loading scenarios and service-based persistence in emulation exercises. Sleep obfuscation is implemented via the Ekko, Zilean, or Foliage techniques with call stack spoofing, a modern stack designed to defeat memory scanning of dormant implants and to make unbacked sleep frames look legitimate to EDR hook inspection.
Execution capability inside Monarch is broad: a stable COFF/BOF loader with support for asynchronous BOFs, in-memory execution of .NET assemblies, and in-memory DLL execution. Evasion features include AMSI and ETW patching implemented via hardware breakpoints rather than the more commonly signatured byte-patching approach, compile-time string obfuscation, execution guardrails, dynamic network profile switching, and self-destruct functionality. Operational lifecycle controls — agent kill dates and working hours — round out the feature set, letting engagements time-box implants so nothing outlives the authorized scope window.
For defenders, the evasion inventory doubles as a detection research checklist. Hardware-breakpoint-based AMSI/ETW tampering can be surfaced by monitoring for debug register modification and single-step exceptions in protected processes; sleep obfuscation families like Ekko/Foliage rely on ROP-driven calls to VirtualProtect, SetEvent, and thread timer APIs that leave distinctive syscall patterns; and asynchronous BOF loading tends to produce thread pool and callback-based execution artifacts. The token vault and token manipulation features imply DuplicateTokenEx-driven activity that identity-centric EDR telemetry can correlate. None of this is a detection recipe, but it indicates where lab research should be aimed.
Practically, the README directs users to docs/1-INSTALLATION.md and notes that the team server and operator client are intended for Ubuntu/Debian hosts. Getting started means building the components from source on a Linux box — something like git clone https://github.com/jakobfriedl/conquest followed by the documented build steps — with the agent payloads then generated through the client's payload generation dialog with per-module selection. We deliberately do not walk further into payload generation or listener configuration here; that territory is engagement-specific and belongs inside authorized scopes with proper authorization documentation.
Positioning-wise, conquest is best read as a Nim-native answer to Havoc — smaller, newer, and more opinionated about its language stack, but hitting the same architectural notes: malleable profiles, a GUI client, BOF loading, sleep obfuscation, and a scripting API. Its 421 stars suggest genuine community traction rather than a weekend experiment, and the documentation structure (docs/ covering installation, architecture, and usage) indicates maintenance discipline. For purple teams, it is a useful emulation substrate precisely because its feature set mirrors contemporary tradecraft; for detection engineers, studying its public README and module ecosystem is a low-cost way to anticipate what an authorized engagement using this framework will look like in telemetry — and to build coverage before the engagement, not during it.
jakobfriedl/conquest.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.