Advanced Hacking Frameworks - Building Custom C2
1. Why Custom C2?
Commercial C2 frameworks (Cobalt Strike, Metasploit, Sliver) have known signatures. EDR products fingerprint their beacons, HTTP profiles, and certificate patterns. Building your own C2 gives complete control over communication profile and makes detection significantly harder.
2. Architecture Patterns
- Classic: Implant -> HTTP/S -> Redirectors -> Team Server. Well-signatured.
- Domain Fronting: Hide C2 inside CDN traffic. C2 domain different from visible.
- P2P Mesh: Implants talk to each other. No central server. Hardest to takedown.
- Social Media C2: Commands in profile descriptions, tweets, comments.
- Dead Drop: Implants use Pastebin, GitHub gist, Google Docs as message boards.
3. Team Server Design
Code:
from flask import Flask, request, jsonify
from cryptography.fernet import Fernet
app = Flask(__name__)
cipher = Fernet(Fernet.generate_key())
@app.route("/api/beacon", methods=["POST"])
def beacon():
data = json.loads(cipher.decrypt(request.get_data()))
response = handle_task(data)
return cipher.encrypt(json.dumps(response).encode())4. Redirector Infrastructure
- Nginx reverse proxy: Forward specific paths to C2, rest to legitimate site.
- Cloudflare Workers: Serverless redirectors. Hard to block Cloudflare.
- AWS Lambda + API Gateway: Pay-per-use, blends with normal AWS traffic.
- Domain Fronting: Google App Engine, Azure CDN, Cloudfront with alt domain.
5. OpSec for C2 Operators
- Team server never accessed directly - always through redirectors.
- Different VPS providers for different layers (redirector != team server).
- Register domains with different registrars, WHOIS privacy, payment methods.
- Rotate SSL certificates weekly (automate with LetsEncrypt).
- Monitor C2 as if you are the blue team.
- Have a burn plan - know what to do when infrastructure is compromised.
Custom C2 is an arms race. Every bypass works until it does not. Stay ahead by evolving communication profiles constantly.