Try Hack Me: Intro To C2

Name: Try Hack Me: Intro To C2
Uploaded: 2022-09-16T18:00:17.000Z
Duration: 1 h 8 min 20 s

Introduction to Command and Control (C2)

Overview of C2

The speaker introduces the topic of Command and Control (C2), expressing excitement about the series and encouraging viewers to subscribe.

C2 is defined as a server that commands and controls various operations, not limited to botnets but applicable in many types of attacks.

Understanding Botnets and C2

While botnets are associated with C2, they are not the only application; C2 can also be used for long-term attacks involving single hosts.

The speaker emphasizes that a botnet simply means controlling multiple bots, but a C2 server can operate independently without them.

Components of a C2 Framework

A basic structure is presented where victims (agents) call back to the command and control server, which directs their actions.

Terminology introduced includes "agents" (programs calling back to the server), "listeners" (waiting for connections), and "beacons" (the process of agents communicating with listeners).

Callback Mechanisms

Agents periodically send beacons to indicate they are active, which can be set at regular intervals or randomized for stealth.

The concept of Jitter is introduced; it refers to varying callback times to avoid detection by security systems.

Advanced Techniques in Callbacks

Advanced Persistent Threats (APTs) utilize sophisticated callback strategies, such as infrequent communication patterns over extended periods.

These techniques help evade detection by making callbacks appear sporadic rather than predictable.

Payload Types in C2 Operations

Understanding Malware Delivery Mechanisms

The Role of Droppers in Malware Distribution

A dropper is a small piece of malware that connects back to its server to download additional malicious payloads, often using encrypted connections like HTTPS to evade detection by antivirus software.

Unlike known malware with identifiable signatures that can be blocked by firewalls, droppers can masquerade as non-malicious files, making them easier to deliver without raising alarms.

The size advantage of droppers (e.g., 10 MB) over larger malware packages (e.g., 500 MB) allows for stealthier delivery and reduces the likelihood of detection during transmission.

Payload Formats and Execution Methods

Various payload formats exist beyond traditional Windows executables; these include PowerShell scripts, HTA files, JScript, and Visual Basic scripts which can execute on Windows systems without needing an executable file.

Post-exploitation modules are utilized after gaining control over a system. These modules allow attackers to gather more information or pivot to other machines within the network.

Command and Control (C2) Server Considerations

Exposing a C2 server directly to the internet poses significant operational security risks. Detection leads to immediate blocking of IP addresses associated with malicious activities.

Using intermediaries like Cloudflare helps obscure the true location of the C2 server. If one intermediary gets blocked, others can be quickly set up without compromising the main C2 infrastructure.

Benefits of Using Intermediaries

An intermediary protects the primary C2 server from being flagged as malicious. This allows for continued operations even if one access point is compromised.

If an attack fails due to blocking at an intermediary level, it does not necessarily compromise the entire operation; attackers can simply switch intermediaries and attempt again.

Communication Techniques in Malware Operations

Changing request headers when communicating with intermediaries like Cloudflare ensures that only specific requests are forwarded to the C2 server while masking regular traffic.

The agent component on victim machines is responsible for calling back to the C2 server. Understanding this mechanism is crucial for recognizing how commands are executed remotely.

Key Terms in Malware Delivery

"Jitter" refers to random delays introduced in beaconing options which help avoid detection by making communication patterns less predictable.

SMB Beaconing is mentioned as a method that may allow access into restricted network segments, highlighting potential vulnerabilities within network defenses.

C2 Frameworks and Setup Process

Overview of C2 Environments

The speaker discusses their experience with Command and Control (C2) environments, emphasizing the control over multiple machines.

Armitage is introduced as a user-friendly tool for C2 operations, though it is described as somewhat outdated compared to other options like Powershell Empire.

Cobalt Strike is highlighted as the leading paid option in the market, while Covenant is noted as a preferred free alternative.

Setting Up Armitage

The setup process for Armitage involves cloning the repository and changing directories to run necessary scripts.

Users must ensure they input their actual IP address instead of localhost (127.0.0.1), which is blocked by default in Armitage.

PostgreSQL needs to be set up for Metasploit framework functionality; users are advised to change default settings for security.

Running Commands and User Management

After setting up, users will run specific commands to initiate Armitage, ensuring they are logged in under appropriate user permissions (root vs. Ubuntu).

A thumbprint generated during connection serves as a verification method for server integrity; losing this could indicate potential security issues.

Operational Security Considerations

Basic operational security practices are discussed, including altering identifiable features of C2 servers to avoid detection.

The importance of changing default configurations is emphasized; even small changes can significantly enhance security against fingerprinting attacks.

Secure Access Techniques

Understanding Port Forwarding and Listeners in SSH

Importance of Port Forwarding

Port forwarding allows users to host resources on a remote machine or access local resources from a remote server, effectively circumventing firewalls that block specific ports.

The process involves specifying which port to use for SSH connections, enhancing the basic concept of port forwarding.

Setting Up Listeners

Listeners are essential as they wait for incoming connections; users can set up reverse listeners to accept connections back from compromised machines.

When dealing with devices that have limited internet access, DNS is recommended as it is commonly allowed through firewalls.

Choosing the Right Listener

For restricted network segments, SMB (Server Message Block) is highlighted as a suitable listener option.

HTTPS traffic is often permitted by firewalls due to its necessity for general internet connectivity, making it another viable choice for listeners.

Using Armitage for Scanning and Exploiting

Initial Setup with Armitage

Users begin by scanning hosts using Armitage's built-in tools; an example IP address (10.146.249) is used for demonstration purposes.

The scan results indicate the version of Windows running on the target machine, providing critical information for exploitation.

Selecting Payloads and Exploits

Users navigate through payload options in Armitage to find relevant exploits; EternalBlue is identified as a well-known attack method against Windows systems.

By dragging and launching the exploit, users can take control of the target system effectively.

Gaining Shell Access and Locating Flags

Establishing Shell Connections

After successfully exploiting the target, multiple shell sessions may be established; users are advised to manage these sessions carefully.

Interacting with the newly acquired shell allows users to execute commands directly on the compromised system.

Finding Administrative Flags

Commands like "whoami" confirm administrative access (SYSTEM authority), enabling further exploration within the file system.

How to Obtain NTLM Hashes Using Metasploit

Introduction to NTLM Hash Extraction

The speaker discusses the need to obtain NTLM hashes from a machine, suggesting that while they can be found directly on the machine, using Metasploit is a more efficient method.

Setting Up Meterpreter Session

The recommendation is made to run the multi-manage shell within a Meterpreter session for better control over the target machine.

The speaker clarifies that they are currently using a regular shell and not a Meterpreter shell, which limits functionality.

Executing Hash Dump Commands

After establishing a Meterpreter session, the command dump hashes is introduced as a way to extract password hashes from the target system.

If initial attempts fail, it’s suggested to pass the session correctly since generic sessions may not work due to configuration issues.

Troubleshooting Session Issues

The speaker encounters errors when trying to execute commands due to session misconfiguration and emphasizes troubleshooting steps like passing sessions properly.

Acknowledgment of persistent errors leads to suggestions for killing existing sessions and re-establishing connections for successful hash extraction.

Final Steps and Considerations

It’s noted that if an interpreter session does not work initially, users should ensure they pass their sessions correctly; this is crucial for obtaining NTLM hashes effectively.

Discussion about Armitage as a C2 server reveals its limitations compared to other tools. The speaker highlights potential issues with EternalBlue exploits being finicky in certain environments.

Redirector Setup Insights

The importance of setting up redirectors on separate machines rather than on the same machine as the C2 server is emphasized; this prevents both from being blocked simultaneously.

Understanding HTTP User Agent Modification

Importance of Modifying HTTP User Agents

The discussion highlights the use of msf Venom, emphasizing the need to change the HTTP user agent to avoid detection. The example presented is somewhat humorous, illustrating how a default user agent can be easily recognized and blocked.

It is crucial to modify the HTTP user agent because using a default setting may lead to quick identification and blocking by security systems. By mimicking whitelisted applications, one can enhance stealth during penetration testing.

Setting Up Exploits and Frameworks

The session covers setting up a rewrite engine and an exploit multi-handler, which are essential skills for participants. Understanding these setups is vital for effective red teaming exercises.

Key settings discussed include modifying the HTTP user agent and host header. These adjustments are critical for evading detection while conducting tests on target systems.

Choosing a C2 Framework