Walk through eight C2 tools in 40 mins
Synopsis
Understanding Command-and-control
C2 allows attackers to control infected systems and maintain persistence. Communications are designed to blend in with legitimate traffic; thus, recognizing these channels is crucial.
Intro to The C2 Matrix
Tool-1: Metasploit
Overview
-MSFvenom
-Pivoting, and integration with 3rd-party tools
-C2-callbacks illustration
Meterpreter features
GUI: Armitage
Summary
-Lacks flexibility in callback granularity
-Highly recommended for beginners
-RCE vuln exploitation
-Meterpreter for deeper control
-Lateral movement via pivoting
Tool-2: Merlin
Overview
-Supports HTTP/1.1 to HTTP/3
-Profile flexibility:
-URL, User-agent, and HTTP headers
-Callback interval, jitter
-JA3
-Pivoting: SOCKS
C2-callbacks illustration
Characteristics for IPS sigs
Summary
-HTTP/2 and HTTP/3 supported are relatively unique
-Static patterns observed
Tool-3: Sliver
Overview
-Supports HTTP(S), DNS, mTLS, and WireGuard
-Pivoting: SOCKS5, (reverse) port forwarding
C2-callbacks illustration
Suspicious 100 words in Request body
Summary
-Growing Threat Actor Usage
-High variety of C2 channels and cross-platform compatibility
-The 100-word and status-202 make its C2 traffic special
Tool-4: Mythic
Overview
-Modular & Extensible
-Rest APIs
-Payload types, and ATT&CK mapping
Features
-Agent types
-C2 protocol types
C2-callbacks illustration
Dissecting Athena C2 over Websocket
Summary
-20+ agents supported
-Multi-user and ATT&CK mapping make it competitive
Tool-5: Brute Ratel
Overview
-Built towards evasion and not just simulation
-Malleable C2 profiles
-Supports HTTP(S), DNS, DoH, TCP,and SMB
-API support and ATT&CK mapping
C2-callbacks illustration
DoH Topology
C2 over DoH visualized
Summary
-DoH is rarely supported by C2 tools
-C2 request and response are highly configurable
-Gaining momentum from threat actors
Tool-6: Wikipedia-C2
Intro to LOLC2, a collection of cloud-based C2 frameworks
Traditional C2 vs. Cloud-based C2
-Scalability
-Accessibility
-Reliability
API calls in a 10-min window
-Statistics of APIs being called
-Data types stored on cloud services
Summary
-Cloud service API abuse
-Great accessibility
-Highly affected by service providers
Tool-7: Saucepot C2
Overview
-Inspired by Port-Knocking
-Port Knocking and Knocking Sequences
Data Exfiltration over SrcPorts
-Formula converting SrcPort value to actual data
Screenshot showing data exfiltration over SrcPorts
Summary
-A PoC to demonstrate C2 or data exfil over TCP side channels
-High volume of connection attempts
-See “Abusing Ephemeral Ports for Data Exfil and C2” for details
Tool-8: Cobalt Strike
Overview
-A well-known adversary simulation framework used by both red teams and threat actors
-Highly customizable with Malleable C2 framework
Aggressor Script
-Event driven scripting
-Automating recon, lateral movement, beacon mgmt, and reporting
C2-callbacks illustration
Malleable C2 Profiles
-How C2 traffic blends in like legit one
Summary
-One of the most adopted adversary simulation tools of all time
-Malleable C2 profiles with long-haul callback settings make detection a challenge