Guide Shows How to Hunt Exposed C2 Panels Using Web Fingerprints
Summary
A practical guide demonstrates how defenders can identify exposed Supershell, HookBot, Chaos RAT, UnamWebPanel, Metasploit, and Mythic panels using URL paths, page titles, favicon hashes, and other web artifacts, then block and report exposed instances.
Key points
- The guide uses Hunt.io datasets and HuntSQL to search web telemetry, URL indexes, and crawled page artifacts for exposed panels.
- Example fingerprints include Supershell’s login path, HookBot’s page title and favicon hash, and Chaos RAT’s HTML hash and GitHub reference.
- It also gives search patterns for UnamWebPanel, Metasploit, and Mythic dashboards.
- Exposed panels can let operators manage compromised hosts, issue commands, and handle stolen data or payloads.
- Recommended responses include adding fingerprints to monitoring and blocking rules, recording passive evidence, and reporting findings to providers or a CERT.
- The guide advises against logging in to or interacting with discovered panels.
Article Details
- Defense Focus
- Identify and track exposed command-and-control panels using web fingerprints and passive internet-scan telemetry, then block or report confirmed exposure.
- Detection Methods
- Search URL paths such as /supershell/login/ and panel-specific page titles, including Supershell, HOOKBOT PANEL, Unam Web Panel, Metasploit, and Mythic.
- Pivot on the HookBot favicon MD5 and the Chaos RAT HTML-body SHA-256 hash.
- Use redirect paths such as /login and /new/login together with page titles to improve panel identification.
- Search panel HTML for the Chaos RAT repository reference and correlate related pages.
- Validate candidates using page snapshots, scripts, favicons, embedded resources, response patterns, and hosting metadata.
- Data Sources
- HTTP response headers and page content (httpv2)
- URL index (urlx)
- Crawler page snapshots and artifacts, including scripts, favicons, and embedded resources (crawler)
- TLS certificates and hosting metadata
- Rule Types
- HuntSQL queries filtering URL paths, HTML titles, redirects, favicon hashes, HTML-body hashes, and repository references
- IDS/IPS signatures
- SIEM rules
- WAF and firewall rules
- Monitoring alerts and blocklists
- Platforms
- HuntSQL
- Defensive Actions
- Block confirmed exposed panels at the network edge using WAF or firewall rules.
- Add panel fingerprints to IDS/IPS signatures, SIEM rules, monitoring pipelines, and blocklists.
- Enrich findings with ASN or IP metadata and monitor relevant callback activity.
- Record passive evidence, including the exact timestamp and URL; do not attempt to log in or interact with an exposed panel.
- Report findings to the hosting provider or relevant CERT.
- Share indicators through controlled channels or redact sensitive details to avoid enabling abuse.
- For Chaos RAT, monitor suspicious crontab entries, scheduled tasks, and abnormal reverse-shell activity; favor behavioral detection over static signatures.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]234[.]16[.]100 | Listed as an IP observed hosting or linked to an exposed C2 dashboard. |
| IPV4 | 134[.]122[.]207[.]42 | Listed as an IP observed hosting or linked to an exposed C2 dashboard. |
| IPV4 | 38[.]55[.]199[.]160 | Listed as an IP observed hosting or linked to an exposed C2 dashboard. |
| IPV4 | 4[.]210[.]171[.]193 | Listed as an IP observed hosting or linked to an exposed C2 dashboard. |
| IPV4 | 62[.]60[.]245[.]136 | Listed as an IP observed hosting or linked to an exposed C2 dashboard. |
| IPV4 | 74[.]48[.]140[.]110 | Listed as an IP observed hosting or linked to an exposed C2 dashboard. |
| MD5 | 5d17fbecdbd631b16214c7d7d0d71ff9 | HookBot panel favicon hash used as a hunting fingerprint. |
| SHA256 | b78ec7d301f2d25c974800c136c583b7b5a25ec5ec13dbf04cae9817fa8045aa | HTML-body hash used to hunt for Chaos RAT control panels. |
MITRE ATT&CK
T1053 · Scheduled Task/JobThe article describes scheduled tasks on Windows as a believed Chaos RAT persistence mechanism.T1053.003 · CronThe article describes modifying /etc/crontab on Linux to regularly fetch Chaos RAT payloads.T1055 · Process InjectionHookBot overlays fake login screens on legitimate apps to harvest credentials.T1059 · Command and Scripting InterpreterChaos RAT control panels allow operators to execute commands on compromised Windows and Linux hosts.T1547.001 · Registry Run Keys / Startup FolderThe article describes registry Run keys as a believed Chaos RAT persistence mechanism on Windows.
CVE
CVE-2024-30850and control sessions. However, it has been plagued by vulnerabilities such as command injection (CVE-2024-30850) and XSS flaws (CVE-2024-31839) that could be exploited against the operators themselves.CVE-2024-31839it has been plagued by vulnerabilities such as command injection (CVE-2024-30850) and XSS flaws (CVE-2024-31839) that could be exploited against the operators themselves.
Malware
Chaos RATThis guide looks at some of the most common panels seen online today: Supershell, HookBot, Chaos RAT, UnamWebPanel, Metasploit, and Mythic. Each one has fingerprints that give it away, whether it's a URL path, a title,HookBotThis guide looks at some of the most common panels seen online today: Supershell, HookBot, Chaos RAT, UnamWebPanel, Metasploit, and Mythic. Each one has fingerprints that give it away, whether it's a URL path, a title,SilentCryptoMinerUnamWebPanel is an open-source PHP-based web control panel developed by Unam Sanctam for monitoring and managing cryptocurrency mining operations, primarily the SilentCryptoMiner.
Vendors
Products
HuntSQLFigure 16: HuntSQL results where title contains "Metasploit" and the server redirects to /loginFinally, let's look at Mythic, a modern C2 framework whose powerful web interface makes exposed instances particularly riskyMetasploitat some of the most common panels seen online today: Supershell, HookBot, Chaos RAT, UnamWebPanel, Metasploit, and Mythic. Each one has fingerprints that give it away, whether it's a URL path, a title, a faviconMythicthe most common panels seen online today: Supershell, HookBot, Chaos RAT, UnamWebPanel, Metasploit, and Mythic. Each one has fingerprints that give it away, whether it's a URL path, a title, a favicon hash, or even aSupershellThis guide looks at some of the most common panels seen online today: Supershell, HookBot, Chaos RAT, UnamWebPanel, Metasploit, and Mythic. Each one has fingerprints that give it away, whether it's a URL path, a title,UnamWebPanelThis guide looks at some of the most common panels seen online today: Supershell, HookBot, Chaos RAT, UnamWebPanel, Metasploit, and Mythic. Each one has fingerprints that give it away, whether it's a URL path, a title,
Tools
Chaos RATThis guide looks at some of the most common panels seen online today: Supershell, HookBot, Chaos RAT, UnamWebPanel, Metasploit, and Mythic. Each one has fingerprints that give it away, whether it's a URL path, a title,HuntSQLFigure 16: HuntSQL results where title contains "Metasploit" and the server redirects to /loginFinally, let's look at Mythic, a modern C2 framework whose powerful web interface makes exposed instances particularly risky