π½Sliver Red Team Infrastructure
Overall concept, securely setup Red Team C2 infrastructure the right way. OPSEC!!
Before going any further you must consider how important it is to practice good Operational Security "OPSEC". Creating secure channels, storing sensitive files in the right location, and redirecting C2 traffic so as not to burn your C2 are all aspects of practicing good OPSEC.
These are reflect what we are trying to accomplish in the picture below.
Essentially, we want to create a nebula VPN mesh network which will allow our three instances to communicate securely while at the same time redirecting C2 traffic to our listening post via socat. The nebula integration is so that we can practice safe OPSEC locally between our Red Team infrastructure before deploying it out in the wild.
Big shout out to Husky Hacks for putting this blog post together. I pretty much followed every step but decided to host my Red Team infrastructure locally in my home lab so that I could capture the traffic with Security Onion.
My go to choice of C2 is "Sliver". If you haven't had a chance to play around with it I highly advise you check it out. Link below. https://github.com/BishopFox/sliver
These notes along with various screenshots are very rough at the moment when writing this post. I'm terrible at documenting so I have to quickly note down everything once I'm done testing. To successfully mimic the basic setup of one ubuntu listening post, ubuntu lighthouse, and C2 server you'll need a minimum of three VM's. As you can see below my kali instance in on the right and my two ubuntu servers are on the left. After you've setup your virtual machines it's time to pull down all the packages you'll need. A great resource for how to setup sliver as a service can be found in the link below. https://dominicbreuker.com/post/learning_sliver_c2_01_installation/ Also, I highly recommend using tmux so your not fumbling around 100 different ssh sessions. If you unfamiliar on how to use tmux TryHackMe has a great room you can spin up for free. https://tryhackme.com/room/rptmux
Let's create an ssh key pair that we'll use to setup socat between our C2 and listening post. This will ensure we create a secure connection between our listening post when we forward traffic to our C2. Download nebula and socat. Repeat these steps on your other two instances for socat and nebula, not the ssh key gen step.
After pulling down socat lets cat our id_rsa.pub key and paste it into id_rsa.pub on our listening post as seen below.
cat the public key into your authorized keys. cat id_rsa.pub >> authorized_keys
Next, from our kali instance, let's create nebula certs and configurations that will be used to stand up a mesh like VPN network between our clients in our C2 infrastructure.
Here is the original source for how we want to setup our yaml files for the nebula network. However, in Husky's blog post, he made it super simple so we'll just follow along with that for now.
Below you can see that we have everything pointing towards our lighthouse IP. This is so that it can relay how our listening post can communicate to our C2 server through a VPN like connection.
After everything has been properly copied over to their respective locations we can begin firing up our nebula connections. It would be best to go ahead and begin creating your tmux sessions so that you can switch between multiple panes.
First, fire up your lighthouse so that the listening post will know how to connect to your C2 server. Next, fire up your listening post and lastly fire up your teamserver as seen below. tmux will come in handy after this. Simply press ctrl - b and c to create a new pane in each session.
Let's get this show on the road and create some socat connections. See the syntax and images below for reference. One thing to note. When issuing this commands the terminal seems like it hangs but trust me its not. This is why its good to have everything running in tmux so we can manage multiple panes in one session.
Next, let's create some certificates and spin up sliver. We'll point sliver to our listening post IP and set the certs for HTTPs communication.
Next, on our kali teamserver, lets spin up sliver and point our https listeners to out newly created certs.
Last updated
Was this helpful?