Nightcrawler
An open-source command & control framework for red team operators and security researchers. Modular, async, and built by the community.
Overview
What is Nightcrawler?
Nightcrawler is a fully async, modular command & control framework designed for professional red team engagements and offensive security research. It abstracts the infrastructure complexity so operators can focus on the mission.
Every component — listeners, implants, modules, and the operator console — is independently extensible. The project is fully open source and welcomes contributions from the security community.
View source$ nightcrawler server start --config lab.yml
[*] Nightcrawler C2 v0.1.0
[+] HTTPS listener :443
[+] DNS listener :53
[+] SMB listener active
[+] Teamserver ready — waiting for agents
nc> agents
ID HOSTNAME OS PID LAST
01 DC01 Win2025 4892 1s
02 WS01 Win2025 7104 4s
nc> interact 01
[*] Session opened → DC01 (SYSTEM)
nc(DC01)> load kerberoast
[+] Module loaded
nc(DC01)> kerberoast --all
$krb5tgs$23$*svc_sql$CORP.LAB...
nc(DC01)>
Capabilities
What it does
Async C2 Model
Non-blocking, async-first communication between operator, teamserver, and implants. No wait states.
Modular Implants
Drop-in payload module system. Write a module once, load it into any active session at runtime.
Multi-Protocol
HTTP/S, DNS, and SMB listener support out of the box. Channel selection per implant at deploy time.
OPSEC-Aware
Built-in controls for sleep jitter, malleable C2 profiles, and traffic shaping to reduce detection surface.
Operator Console
CLI-first interface with tab completion, session management, and a structured command API.
Multi-Operator
Team-aware teamserver with per-operator session views, shared event log, and role-based access.
Design
Architecture
Four loosely-coupled components. Each layer communicates over a well-defined interface, making individual pieces independently replaceable.
CLI console — session control, tasking, module loading
Central broker — listener management, agent registry, event bus
HTTP/S · DNS · SMB — protocol handlers, malleable profiles
Async agent — check-in loop, module execution, OPSEC controls
Open Source
Built in the open
Nightcrawler is community-driven. Whether you want to write a new module, improve the implant, harden the teamserver, or fix a bug — contributions are welcome. Open an issue or send a pull request.