Chapter 12: Delving into Command and Control Tactics

This chapter focuses on the Command and Control (C2) stage of the Cyber Kill Chain, which then leads to the threat actor completing the Actions on Objective phase of the cyber-attack. As an aspiring penetration tester, it's vital to understand the fundamentals of performing C2 operations from a threat actor's perspective. This technique also helps penetration testers to determine whether their clients' security solutions are fine-tuned to detect a real-world cyber-attack and stop a C2 operation being performed by a threat actor.

During the course of this chapter, you will understand the fundamentals of C2 operations during a cyber-attack and how penetration testers can utilize such techniques during their penetration test exercises during a real-world assessment. Furthermore, you will gain the skills for setting up your C2 server and performing post-exploitation techniques on a compromised host on a network.

...

Technical requirements

To follow along with the exercises in this chapter, please ensure that you have met the following hardware and software requirements:

• Kali Linux 2021.2: https://www.kali.org/get-kali/
• Empire: https://github.com/BC-SECURITY/Empire
• Starkiller: https://github.com/BC-SECURITY/Starkiller
• Windows Server 2019: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2019

Understanding C2

The battle between cybersecurity professionals and threat actors is always a continuous race against time on whether the threat actors are going to discover a security vulnerability on a system and exploit it before the cybersecurity professionals are able to do so and implement countermeasures to prevent a cyber-attack. As each day goes by, we commonly either read or listen to cybersecurity-related news about how organizations are discovering their systems and networks have been compromised and they are working on eradicating the threat such as malware and recovering their systems to a working state. However, while organizations are not always able to detect security incidents in real time and stop the attack, threat actors are able to live on their targets' networks and systems for a very long time. This allows threat actors to move around the network using lateral and vertical movement, exfiltrate the organization's data, install additional malware on...

Setting up C2 operations

As an aspiring penetration tester, it's vital that you learn and gain the skillset of using popular C2 tools to help you improve your penetration testing skills and strategies during a real-world exercise. Within the cybersecurity industry, Empire 4 is a post-exploitation framework that allows penetration testers and red teamers to set up C2 operations during their penetration test on an organization. Currently, a security group known as BC Security (www.bc-security.org) is maintaining a forked version of the original PowerShell Empire framework since the original developers have achieved the original PowerShell Empire project. However, BC Security has been continuously providing updates and new features that allow penetration testers to perform never-before-seen techniques during their live penetration test on their clients' networks.

Empire 4 allows penetration testers to set up an Empire server that functions as a C2 server and agents are installed...

Post-exploitation using Empire

In this section, you will learn how to set up Empire to perform post-exploitation techniques on a compromised host on a network. Additionally, you will learn how to establish C2 connections between an agent on the compromised host and the Empire server.

To get started with performing post-exploitation using Empire, please use the following guidelines:

1. Power on both your Kali Linux and Windows Server 2019 virtual machines within the Red Team Lab topology.
2. On Kali Linux, open Terminal and use the following command to start the Empire server:

   kali@kali:~$ sudo powershell-empire server

3. On the same Kali Linux, open another Terminal window and use the following command to start the Empire client:

   kali@kali:~$ sudo powershell-empire client

4. Once the client starts, it will attempt to automatically connect to the local Empire server. Therefore, it's vital you start the Empire server before enabling the Empire client.
5. Any commands...

Working with Starkiller

Starkiller is the official graphical user interface created to allow multiple penetration testers to connect and control the Empire server. Similar to working with the Empire client, which provides command-line access, using Starkiller provides a graphical interface that helps penetration testers to work more efficiently.

The following diagram shows a typical deployment of Starkiller and the Empire server:

Figure 12.26 – Starkiller deployment model

During this exercise, we will be using a single Kali Linux machine that will be running the Empire server with Starkiller. The target will be Windows Server 2019 on the Red Team Lab topology.

Part 1 – starting Starkiller

To get started with this exercise, please use the following instructions:

1. Power on both your Kali Linux and Windows Server 2019 virtual machines.
2. On Kali Linux, open Terminal and use the following command to start the Empire server:

   kali...

Summary

During the course of this chapter, you have learned how threat actors use C2 operations to maintain and control multiple compromised hosts simultaneously. Furthermore, you have discovered how cybersecurity professionals such as penetration testers and even red teaming professionals can use C2 operations to improve their security testing and emulate real-world cyber-attacks on their target's network. You have gained the skills for setting up Empire 4 using Kali Linux and have learned how to perform post-exploitation tasks on a compromised system. Additionally, you have discovered how to work with Starkiller as a graphical interface for Empire 4 to simplify many tasks on the Empire server.

I hope this chapter has been informative for you and is helpful in your journey as an aspiring penetration tester learning how to simulate real-world cyber-attacks to discover security vulnerabilities and perform exploitation using Kali Linux. In the next chapter, Chapter 13, Advanced...

Further reading

To learn more about the topics covered in this chapter, you can refer to the following links:

• Overview of Empire 4: https://www.bc-security.org/post/overview-of-empire-4-0-and-c/
• Empire wiki: https://bc-security.gitbook.io/empire-wiki/
• Empire: Malleable C2 Profiles: https://www.bc-security.org/post/empire-malleable-c2-profiles/