AdaptixC2: An Extensible C2 Framework That Grows With Your Needs
If you've spent any time in red teaming, you know the drill: you find a C2 framework you like, only to hit a wall when you need something custom. Maybe you want a new listener protocol, a different agent behavior, or a way to integrate a tool you've built. Most frameworks force you to modify core code or fork the entire project. That's where AdaptixC2 comes in—it's built from the ground up with extensibility as a first-class feature, not an afterthought.
AdaptixC2 v1.2 is an open-source post-exploitation and adversarial emulation framework designed for authorized penetration testing. The server runs on Golang, while the GUI client is built with C++ and Qt, giving you a cross-platform interface that works on Linux, Windows, and macOS.
What It Does
At its core, AdaptixC2 uses a server/client architecture that supports multiple operators working together on the same engagement. The GUI client connects to the Golang server, and all communication between them is fully encrypted. This separation means you can run the server on one machine while operators connect from their own workstations, which is a huge plus for team-based operations.
The framework comes with a solid set of built-in features that cover the essentials of post-exploitation work. You get task and job storage, a credentials manager, and a targets manager to keep your operational data organized. There's a remote terminal and shell, plus file and process browsers for interacting with compromised hosts. For network pivoting, you have SOCKS4 and SOCKS5 support (including authenticated SOCKS5), along with both local and reverse port forwarding.
You'll also find Beacon Object File (BOF) support, including asynchronous BOFs, which is a big deal if you're used to working with tools like Cobalt Strike. The framework can link agents and sessions into a visual graph, making it easier to understand your foothold and move laterally. There's an agent health checker, and you can set kill dates and working time windows to control when your agents are active.
Why It's Cool
The standout feature here is the plugin architecture. Listeners and agents are implemented as extenders, meaning you're not locked into whatever comes pre-installed. The current extenders include HTTP/S, DNS/DoH, SMB, and TCP beacon listeners, plus a TCP/mTLS Gopher listener. On the agent side, you have the standard Beacon agent and a Gopher agent. But the real value is that you can write your own.
The official Extension-Kit repository provides the tools and templates you need to build custom listeners and agents. This is a thoughtful design choice—instead of bloating the core framework with every possible protocol, AdaptixC2 keeps the base lean and lets you add what you need. That's a refreshing approach in a space where many frameworks try to be everything to everyone.
The agent support is also worth noting. You get Windows, Linux, and macOS agents, which covers the realistic spread of operating systems you'll encounter in enterprise environments. Combined with the health checker and the ability to link agents into a graph, you have a clear picture of your operation at any given moment.
Another nice touch is the AxScript Engine, which gives you scripting capabilities within the framework. While the README doesn't go deep into what you can do with it, having a scripting engine baked in means you can automate repetitive tasks and create custom workflows without leaving the platform.
How to Try It
Getting started with AdaptixC2 is straightforward, though you'll want to read the full documentation before diving in. The project has a comprehensive wiki that covers installation and getting started.
Head over to the AdaptixC2 repository and clone it. The installation guide is in the wiki at https://adaptix-framework.gitbook.io/adaptix-framework/adaptix-c2/getting-starting/installation.
Once you have it running, you'll connect to the server through the Qt-based client. From there, you can configure listeners, deploy agents, and start managing your engagement. If you want to build your own extenders, check out the Extension-Kit repository for templates and examples.
One thing to keep in mind: this is a tool for authorized security testing only. The README makes that clear, and you should take it seriously. Unauthorized use can land you in legal trouble, so make sure you have proper authorization before using it on any systems.
Final Thoughts
AdaptixC2 is a solid choice if you're looking for a C2 framework that won't box you in. The plugin architecture is genuinely useful—you can start with the built-in listeners and agents, then build custom ones as your needs evolve. The cross-platform client is a practical advantage, especially if your team works across different operating systems.
It's not the most beginner-friendly tool out there; you'll want some familiarity with C2 concepts and post-exploitation workflows. But if you're comfortable with the space and you value extensibility, this is worth a serious look. The fact that it's open source means you can dig into the code, contribute improvements, and make it work exactly the way you need it to.
Follow @githubprojects for more developer tools and open source projects.