CrystalForge

CrystalForge is a custom AdaptixC2 agent that modifies the default beacon agent to support a Crystal Palace based UDRL pipeline.

The goal is simple: make it easier to bring custom Crystal Palace loaders into AdaptixC2 payload generation.

Features

• Custom AdaptixC2 agent plugin
• Crystal Palace-based UDRL integration
• DLL and shellcode payload generation
• Custom Crystal Palace spec selection during payload generation
• Multi-transport beacon support inherited from the Adaptix beacon
• Default AdaptixC2 beacon feature set preserved

Installation

Add CrystalForge to your AdaptixC2 extenders:

git clone https://github.com/k1ng0fn0th1ng/CrystalForge AdaptixC2/AdaptixServer/extenders/CrystalForge
cd AdaptixC2/AdaptixServer
go work use extenders/CrystalForge
go work sync
cd ..
make extenders

Add CrystalForge to Adaptix profile

Open your Adaptix profile.yaml and add CrystalForge under the extenders section:

extenders:
  - "extenders/CrystalForge/config.yaml"

Or insert it automatically from the Adaptix server directory:

awk '
/extenders:/ && !done {
  print
  print "    - \"extenders/CrystalForge/config.yaml\""
  done=1
  next
}
{ print }
' profile.yaml > tmp && mv tmp profile.yaml

Register CrystalForge in Extension-Kit

If you use the Adaptix Extension-Kit, register CrystalForge as a supported agent:

./add_agent.sh CrystalForge

Then reload the Extension-Kit AXScript from the Adaptix client.

Usage

When generating a CrystalForge payload from Adaptix, select the desired output format:

• DLL
• Shellcode

DLL output returns the default Adaptix DLL.

Shellcode output uses Crystal Palace to process the intermediate DLL through the selected .spec file.

Bring your Crystal Palace UDRL

The UI allows you to specify a Crystal Palace .spec file. If no custom spec is provided, the default loader spec is used.

The loader referenced by the spec must already be compiled. CrystalForge links the intermediate DLL with Crystal Palace, but it does not build arbitrary external loader projects automatically.

Design Goals

• Provide custom UDRL to AdaptixC2 to increase evasion
• Provide an easy way to integrate Crystal Palace loaders with AdaptixC2
• Make Crystal Palace easier to use from a public C2 workflow
• Define a flexible loader code to implement any technique easily
• Preserve the Adaptix beacon workflow where possible
• Provide a flexible base for experimenting with custom loader techniques

Limitations

• EXE and service executable outputs are not implemented yet.
• Dynamically resolved APIs are not hooked; only functions resolved via the IAT are affected.
• Crystal Palace loader components must be built before they are referenced by a spec file.

Roadmap

• Add EXE output
• Add service executable output
• Expand API hooking coverage inside the Adaptix beacon path

References & Credits

• AdaptixC2 - original beacon and extender model
• Crystal Palace - core framework
• Rasta Mouse - Crystal-Kit, LibGate, CRTL research inspiration
• Draugr - stack spoofing

Disclaimer

This project is intended for security research, development, and educational purposes in authorized environments only.

Unauthorized use against systems you do not own or do not have explicit permission to test is illegal.

License

This project is licensed under the MIT License.

See the LICENSE file for more details.