How C2 frameworks work

C2 means command and control. It lets an operator send tasks to compromised machines and receive results.

These notes are based on the C2 sections of TryHackMe's Red Team Fundamentals module. They cover the topics included here, not every part of C2.

The pieces

• C2 server: infrastructure the operator uses to send tasks and receive results.
• Agent: software running on a compromised host.
• Payload: code delivered for execution. It may be the agent, or it may install one.
• Listener: a configured service or endpoint that accepts a connection or callback.
• Beacon or check-in: a callback made on a schedule.

Names vary by framework. Cobalt Strike calls its agent payload Beacon.

Hiding the callbacks

Regular callbacks can create a recognizable pattern. Two techniques make the timing less predictable:

• Sleep timers: the agent waits a set period before checking in.
• Jitter: random variation added to that sleep, so the interval between callbacks is less predictable.

Modules

Modules extend what an agent and server can do. Some support work after initial access. Others support pivoting, which routes traffic through a compromised host to reach another network.

The frameworks

Several frameworks provide these parts:

The C2 Matrix is a good map of what's out there.

Standing up Armitage

Before starting Armitage, initialize the Metasploit database.

systemctl start postgresql && systemctl status postgresql;
msfdb --use-defaults delete;
msfdb --use-defaults init;

# start the team server
cd /opt/armitage/release/unix && ./teamserver <ip_address> <password>

# connect a client

cd /opt/armitage/release/unix && ./armitage

The username at the client prompt is a nickname. The shared password is what authenticates the connection.

Further reading

• Red Team Fundamentals is the TryHackMe module these notes come from.
• RedFox Security: intro to C2 frameworks
• A C2 framework overview