Penetration Testing Lab
Articles from the Pentesting Field
Home Pentesting Distros Resources Submissions Toolkit Contact the Lab
Hijack Digital Signatures – PowerShell Script Search the Lab
Search...
Command and Control – WMI
Author
November Command and Control – Website
14, 2017
netbiosX Red Team C2, Command and Control, Red Team, Trevor Leave a
comment
netbiosX
Covering arbitrary commands through legitimate traffic is a must for every red team
engagement. The majority of the command and control tools are implementing a stealthy Follow PenTest Lab
technique that it will allow red teams to hide their activities as data exfiltration is part of the
goals. Enter your email address to follow this blog and
receive notifications of new posts by email.
David Kennedy developed a command and control tool called TrevorC2 that can be used
to execute commands via legitimate HTTP traffic. The URL attribute on the Join 1,667 other followers
trevorc2_server.py needs to be modified to a website of choice.
Enter your email address
Follow
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Recent Posts
Command and Control – Browser
SPN Discovery
Situational Awareness
Lateral Movement – WinRM
AppLocker Bypass – CMSTP
TrevorC2 – Server Configuration
The implant (trevorc2_client.py or trevorc2_client.ps1) has a SITE_URL attribute. This Categories
needs to be changed with the IP address of the command and control server. When the
command and control server file will run it will start to clone the website. Coding (10)
Defense Evasion (20)
Exploitation Techniques (19)
External Submissions (3)
General Lab Notes (21)
Information Gathering (12)
Infrastructure (2)
Maintaining Access (4)
Mobile Pentesting (7)
Network Mapping (1)
TrevorC2 – Server
Post Exploitation (12)
Privilege Escalation (14)
There are two implants to be used one based in python and one in PowerShell. From the
moment that the implant will be executed a connection will be established with the Red Team (27)
command and control server. Social Engineering (11)
Tools (7)
VoIP (4)
Web Application (14)
Wireless (2)
TrevorC2 – PowerShell Implant
Archives
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Commands can be sent from the server to the clients: June 2018
May 2018
April 2018
January 2018
December 2017
November 2017
October 2017
TrevorC2 – Commands September 2017
August 2017
The commands will be sent encrypted via HTTP/S protocol. TrevorC2 is using AES July 2017
encryption with the following cipher. Encrypted commands will be inserted into the fake June 2017
website inside the oldcss parameter: May 2017
April 2017
March 2017
February 2017
January 2017
November 2016
September 2016
February 2015
TrevorC2 – Encryption Key and Data Location January 2015
July 2014
The fake website will be hosted into the same system as the command and control server
April 2014
and it will look exactly as the original.
June 2013
May 2013
April 2013
March 2013
February 2013
January 2013
December 2012
November 2012
October 2012
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
September 2012
August 2012
July 2012
June 2012
April 2012
March 2012
February 2012
@ Twitter
#BSidesLDN2018 was great so far! Many thanks to
@dradisfw for the ticket #dradis #greatproduct
6 hours ago
Great talk by @john_shier about Dark Web!
#BSidesLDN2018 https://t.co/1yC8lVKn3X
7 hours ago
TrevorC2 – Cloned Website RT @myexploit2600: I be talking at 14:00 in track 2
@BSidesLondon #BsidesLDN2018 7 hours ago
However examining the source code the oldcss parameter will contain the encrypted Finally a social engineering talk #BSidesLDN2018
command. https://t.co/jMMk4lvbcH 7 hours ago
[New Post] Command and Control - Browser
pentestlab.blog/2018/06/06/com… #pentestlab
#Redteam 9 hours ago
Follow @netbiosX
Pen Test Lab Stats
TrevorC2 – Encrypted Command
3,030,594 hits
By doing traffic inspection it is visible that the executed commands are covered through
legitimate HTTP traffic. Blogroll
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Packetstorm Exploits,Advisories,Tools,Whitepapers
0
Metasploit Latest news about Metasploit Framework
and tutorials 0
0x191unauthorized Tutorials 0
The home of WeBaCoo Information about the
WeBaCoo and other tutorials 0
Command Line Kung Fu Command Line Tips and
Tricks 0
Exploit Databases
Exploit Database Exploits,PoC,Shellcodes,Papers
0
Metasploit Database Exploit & Auxiliary Modules 0
Inj3ct0r Database Remote,Local,Web
TrevorC2 – Wireshark Traffic Apps,Shellcode,PoC 0
References Pentest Blogs
https://www.trustedsec.com/2017/10/trevorc2-legitimate-covert-c2-browser-emulation/
Carnal0wnage Ethical Hacking Tutorials 0
https://github.com/trustedsec/trevorc2 Coresec Pentest tutorials,Code,Tools 0
Notsosecure From Pentesters To Pentesters 0
Pentestmonkey Cheatsheets,Tools and SQL
Injection 0
Pentester Web Application Testing,Tips,Testing
Tools 0
Packetstorm Exploit Files 0
room362 Blatherings of a Security Addict 0
darkoperator Shell is only the Beginning 0
Irongeek Hacking Videos,Infosec Articles,Scripts 0
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Advertisements Professional
The Official Social Engineering Portal Information
about the Social Engineering Framework,Podcasts
and Resources 0
Next Conference
Security B-Sides London
April 29th, 2014
The big day is here.
Facebook Page
Penetrati…
9.9K likes
Like Page
Be the first of your friends to
like this
Rate this:
1 Vote
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Advertisements
Share this:
Twitter Facebook 95 LinkedIn Pinterest
Reddit Tumblr Google
Like
Be the first to like this.
Related
Command and Control - Command and Control - Command and Control -
Browser Gmail DNS
In "Red Team" In "Red Team" In "Red Team"
Leave a Reply
Enter your comment here...
Hijack Digital Signatures – PowerShell Script
Command and Control – WMI
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Create a free website or blog at WordPress.com.
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
