diff --git a/Post Exploitation/C2.md b/Post Exploitation/C2.md new file mode 100644 index 0000000..4b43462 --- /dev/null +++ b/Post Exploitation/C2.md @@ -0,0 +1,45 @@ +# Command and Control + +* [Matrix](https://www.thec2matrix.com/) +* [bcsecurity](https://www.bc-security.org/) maintains Empire 4 +* [Empire](https://github.com/BC-SECURITY/Empire.git) +* [Armitage](https://gitlab.com/kalilinux/packages/armitage.git) +* [Covenant](https://github.com/cobbr/Covenant) +* [Sliver](https://github.com/BishopFox/sliver) + +* Server + * Listener +* Payloads/Agents + * Staged/Dropper + * Stageless +* Beacons from Agents, disguised through jitter +* Modules + * Post Exploitation + * Pivoting + +## Domain Fronting + +* Use a Domain on the C2 server +* User Cloudflare to proxy the request and responses to and from the target +* Use HTTPs for channel encryption + +## Profiles + +* Server evaluates by custom user-agents to identify agents + +## Types + +* Std listener, TCP or UDP +* HTTP/HTTPS, counter FW +* DNS, if internet access of the target is flaky +* SMB, counter network segments + +## Redirector + +* Apache or nginx as reverse proxy in front of the c2 server +* FW is still needed in front of the redirector +* These get burned instead of the c2 + + + + diff --git a/Post Exploitation/Empire.md b/Post Exploitation/Empire.md new file mode 100644 index 0000000..7edb7fe --- /dev/null +++ b/Post Exploitation/Empire.md @@ -0,0 +1,82 @@ +# Empire C2 + +* [Empire Repo](https://github.com/BC-SECURITY/Empire.git) + +## Start Client and Server +```sh +poetry run python empire --server --rest --notifications +poetry run python empire.py client +``` + +## Parts +* __Listeners__ receive connections from stagers +* __Stagers__ payloads generated, for example a reverse, delivery mechanism for agents +* __Agents__ remote on target device tasks +* __Modules__ use modularized payload on agents +* __Credentials__ +* __Report__ information on devices + +* Results are stored in a DB + +## Commands +### uselistener +* Example +```sh +uselistener http +``` +* msf like commands, run listener +```sh +set