Development and operations a practical guide
Establishing a C Infrastructure
Download 4.62 Mb. View original pdf
|
| Establishing a C Infrastructure A well thought out and designed C plan can make the difference between a successful or a failed engagement. The C environment is the heart and lifeline for all threat communications. As part of creating and maintaining an infrastructure for your Red Team operations, you will need the following at a minimum: ● A variety of domain names—preferably com, net, and org sites related to the organizations) being assessed Ensure domains are properly categorized (BlueCoat, WebPulse, OpenDNS, PhishTank) Use Top Level Domains (TLD) common to your target area or usage ● Valid SSL certificates for those domains ● Internet-accessible servers (VPS or physical) Separated for phishing, redirecting, and C servers ● Installed and configured C platforms For more information, detailed C design information is maintained regularly by Jeff Dimmock (@bluescreenofjeff [17] ) can be found at the following: ● Designing Effective Covert Red Team Attack Infrastructure – https://bluescreenofjeff.com/2017-12-05-designing-effective-covert-red-team-attack- infrastructure/#references Red Team Infrastructure Wiki – https://github.com/bluscreenofjeff/Red-Team-Infrastructure- Wiki C2 Tools Although Red Teams use similar offensive security tools as that of penetration testers, there are tools more emphasized by Red Teams—specifically, when it comes to Command and control. While other security testers may use Command and Control tools, as well, a Red Team’s goals are typically heavily dependent on a solid C infrastructure and toolset. Some of the most popular C toolsets have been Cobalt Strike, PowerShell Empire, and Metasploit. All the tools share a heavy emphasis on supporting post-exploitation. Although the tools may have an exploitation capability, a Red Team’s focus is on their use for post-exploitation and use of C for the duration needed. Download 4.62 Mb. Share with your friends:
|