1. HAVOC C2
1.1 OVERVIEW
With a plethora of attack frameworks available (https://howto.thec2matrix.com), the most important requirement is malleability/customizability. Commonly known frameworks such as Metasploit, Cobalt Strike, Empire (Starkiller GUI), BruteRatel, Mythic C2, Covenant and Sliver come to mind.
In this training we'll be using a rather new, Cobalt Strike-like framework called Havoc C2.
https://github.com/voidvxvt/Havoc/blob/main/README.md
1.2 ATTACK FRAMEWORK COMPONENTS
Attack frameworks typically all consist of the following elements:
Teamserver
The central C2 server that receives C2 traffic from implants on its listeners (i.e. LHOST in metasploit), management connections from the client as well as it typically also hosts payloads.
Client
This is the operator console that connects to the teamserver and allows the adversary to manage listeners, malleable profiles, payloads and implants.
Demon (implant)
This is the actual malicious code that communicates back over a C2 channel to the teamserver, very often this is primarily a stager/loader (a tiny program that will download the actual malicious code and typically inject it in to memory of a current or remote process.) - attack frameworks will provide a payload generator that can build different types of payloads (Exe's, dll's, shellcode, etc...).
The most known is probably MSFVenom from the Metasploit Framework.
C2 Redirectors
We won't be using this in the lab, but in real world scenarios these function as proxies between the victim and the C2/team-server (It's easier to pop up a new proxy, than a completely new C2/team-server)
Payload hosting
This is where the payloads are hosted for download by the implant, typically this is done over HTTP/S or DNS, and not from the teamserver itself. In our lab we'll be hosting the payloads directly on the teamserver, which is not recommended in a real-world scenario.
1.3 COMMON ACRONYMS
- Beacon, Implant, Demon: An implant that "calls home" to a C2 server at regular intervals (check-in)
- C2: Command and Control server, the server that manages implants
- EDR: Endpoint Detection and Response, a type of security solution that monitors endpoints for suspicious activity
- IOC: Indicator of Compromise, a piece of data that indicates a potential security breach
- TTP: Tactics, Techniques, and Procedures, the behavior or modus operandi of threat actors
1.4 CONCLUSION
Havoc C2 is the framework we will be using in this training, however the techniques we'll be using can be utilized in each of the beforementioned frameworks.
Let's discover Havoc in the next lab!