pine.space
← Back to blog

2024-09-10

How C2 frameworks work

C2 — command and control — is the machinery a red teamer uses to talk to compromised machines. Strip away the tooling and it's four parts talking to each other.

The pieces

  • C2 server — the central point agents call back to, and where the operator issues commands.
  • Agent / payload — a program running on the compromised host that calls home. It usually does far more than a plain reverse shell.
  • Listener — a program on the C2 server waiting for callbacks over a given port or protocol.
  • Beacon — the act of an agent calling back to a listener.

Hiding the callbacks

Beacons are the giveaway. If an agent phones home on a fixed cadence, an analyst or a security product spots the pattern quickly. Two techniques break it up:

  • Sleep timers — the agent waits a set period before beaconing.
  • Jitter — random variation added to that sleep, so the interval between callbacks is never the same twice.

Modules

Modules extend what an agent and server can do. Common ones handle post-exploitation and pivoting — routing traffic through a compromised host to reach machines you couldn't otherwise touch.

The frameworks

A lot of C2 work is picking a framework and standing it up.

  • Metasploit
  • Armitage
  • PowerShell Empire / Starkiller
  • Covenant
  • Sliver
  • Cobalt Strike
  • Brute Ratel

The C2 Matrix is a good map of what's out there.

Standing up Armitage

Armitage sits on top of Metasploit, so the database has to be initialized first.

Initialize the Metasploit database before starting Armitage:

bash
systemctl start postgresql && systemctl status postgresql;
msfdb --use-defaults delete;
msfdb --use-defaults init;

Start the team server with the server IP and a shared password, then connect a client:

bash
# start the team server
cd /opt/armitage/release/unix && ./teamserver <ip_address> <password>

# connect a client

cd /opt/armitage/release/unix && ./armitage

The username at the client prompt is just a nickname — the shared password is what actually authenticates you to the server.

That's the skeleton. Everything fancy a C2 framework does — obfuscation, malleable profiles, in-memory execution — hangs off these same four parts.

Further reading