Command and Control (C2) Tactics

This chapter focuses on the Command and Control (C2) stage of the Cyber Kill Chain, which then leads to the threat actor completing the Actions on Objective phase of the cyber-attack. As an aspiring penetration tester, it is essential to understand the fundamentals of performing C2 operations from a threat actor’s perspective. This technique also helps penetration testers determine whether their clients’ security solutions are sufficient to detect a real-world cyber-attack and stop a threat actor’s C2 operation. ...

Threat actors and Advanced Persistent Threat (APT) groups are always thinking about clever techniques and strategies to compromise their next target. A technique that is commonly used by threat actors is implementing C2 operations to centrally manage compromised hosts over the internet. A threat actor will set up one or more C2 servers on the internet that serve the purpose of centrally managing infected and compromised systems, uploading data from the compromised hosts, and downloading additional malware onto newly infected devices. Note These C2 servers also serve as update servers for malware such as ransomware. When ransomware infects a new device, most malware is designed to establish a connection to designated C2 servers on the internet to download updates, which ensures cybersecurity professionals are not able to eradicate/remove the malware infection from the host. ...

C2 OPERATION: Power on the main Kali Linux virtual machine (not the clone), open the Terminal, and use the ifconfig eth0{whatever interface you are having as NAT} command to determine the IP address on the eth0 interface as shown below: This ip address will act as an empire server , while the clone vm will act as a empire client . Start the maria DB service in the kali vm(not the clone) : Next, use the following commands to start the Empire server on the main Kali Linux virtual machine: sudo powershell-empire server 5. Next, power on the Empire Client (clone of Kali Linux) virtual machine and use the following commands to edit the Empire client configuration file to insert the Empire server information: ...

Graphical User Interface for Empire server, useful for collaboration during a pentest. In this section we will be using the main kali linux machine and the target will be same windows server 2019 Credentials and reporting: