In this lab, I will configure my environment to begin testing a C2 Framework! I will learn about C2 Frameworks and understand the different Tactics, Techniques, and Procedures (TTPs) used by threat actors so we can build better detection capabilities.

For this lab, I will be using the following VMs:

• GOAD Windows VMs
• Kali = 10.2.10.116
• Ubuntu = 10.2.10.140

I will be utilizing the following services:

• Sliver C2
• SysInternals
• Sysmon

To begin, I installed Sliver C2 on Kali.

I opened two new tabs within the console (use Ctrl+Shift+T!). One of them will be used for accessing the Sliver server and the other will be for accessing the Sliver client.

On the first tab, I ran the following command, which runs the C2 Sliver server and gives the following greeting message:

Before I connect my first operator to the server, I need to enable the multi-player mode on the Sliver server. This is done by using the multiplayer command as seen below:

The jobs command shows that the server is ready and that operators can begin connecting to it. The server is running on tcp and is on port 31337!

Now, moving to my third tab, I can try to run the sliver client. As shown below, it does not currently allow my connection.

To fix this, I need to define a new operator:

Now, going back to the client tab, I can import the Sliver client configuration.

I made a new sliver directory and moved the config file there from my home dir!

I am now able to access the Sliver client! Before moving forward, I quickly checked if there were any current sessions running, just to be safe:

With this confirmed, I can continue.

I will begin by creating my profiles and two different types of implants: sessions and beacons. Profiles will allow me to build implants much easier, as I can use the profiles as bases.

I started by creating the profile that I needed using the command below:

Now, I created my beacon profile:

seconds is the duration to connect back to the C2 and jitter randomizes the call back to home!

Below shows the successful creation of my two profiles!

I used the below commands to generate a session and beacon implant:

Before I host them to be used, I navigated to the ~/Public directory and check the type of the implants I just created:

As shown, they are both Windows executables!

To install my web server, I ran the following command:

After this, I started the server and checked the status:

Now that I have all of the files that I need, I copied the files to the Apache Web Server root directory. I first created a directory called files for organizational purposes. I did this below:

In this task, I will interact with my Sliver sessions. On the server client, I ran the sessions command to see what sessions are available:

Still none!

Before downloading and running my implants, I activated the MTLS listener using the mtls command. I am now able to see the below jobs:

Now that I have the listener and the files I need to go to the victim system to test, I used the web browser on my Windows 11 VM to navigate to my Kali System's IP/Apache site. I downloaded the implants I created.

Now, on my victim, I right-clicked implant.exe and ran the executable as an administrator. After this is done, the implant should start is execution and connect back to my C2. I went back to my Kali system and checked my sessions:

Yay! I can now check that I have successfully connected to the host system via ifconfig:

This is the IP for my Windows 11 VM, meaning I have a successful connection!

Supposed I want to spoof explorer.exe (common parent process for user-initiated applications) as the parent of mspaint.exe:

On Sliver, I used the ps command to list processes:

Found one! The left column is the PID and the middle is the PPID. The PID of explorer.exe is 5352.

Now to spoof! To perform PPID spoofing in Sliver C2, I can run a command with the following syntax:

execute -p <PPID> "<path_to_exe>"

In my Sliver session I can do:

This spawns calc.exe with the parent process ID set to 5352. An alternative way to do this is to seatbelt to run the command from within Sliver. In my Sliver server, I typed the following:

I then, from my Sliver client, ran the following command:

Note: I couldn't get seatbelt to print an output, but the first way worked perfectly for me!

To confirm that the PPID spoofing worked, I went to my Windows 11 VM and checked the Process Explorer/Task Manager:

It can be seen that my process of choice, calc.exe, is running with a parent process of explorer.exe!

To detect PPID spoofing, I can configure Sysmon to log ProcessCreate events and monitor for anomalies in the ParentProcessId field. Detecting PPID spoofing using Sysmon can be tricky because Sysmon does not directly log the PPID (Parent Process ID) in a straightforward way. However, I can configure Sysmon to log ProcessCreate events and analyze the ParentProcessId field to detect anomalies:

After this, I applied the configuration settings:

Now that Sysmon is configured, I can analyze the logs to detect PPID spoofing. Below are the main things to look for:

• Unexpected Parent Processes: Look for processes with unusual parent processes. For example, if mspaint.exe is spawned by a non-standard parent (e.g., cmd.exe instead of explorer.exe), it could indicate PPID spoofing.

• Anomalies in Parent-Child Relationships: Investigate processes where the parent process does not typically spawn the child process. For example, explorer.exe is a common parent for user-initiated applications like mspaint.exe. If mspaint.exe is spawned by svchost.exe, it could be suspicious.

• Detecting PPID Spoofing: To detect PPID spoofing, you need to have a good Baseline of Normal Behavior:

Understand the typical parent-child relationships on your system. For example:

explorer.exe often spawns user-initiated applications like mspaint.exe, notepad.exe, etc.

svchost.exe or services.exe typically spawns system services.

• Identify Anomalies: Look for processes where the parent process does not match the expected behavior. For example:

If mspaint.exe is spawned by cmd.exe or powershell.exe, it could indicate PPID spoofing.

If a system service is spawned by explorer.exe, it could be suspicious.

Now, I am going to repeat my process and spoof notepad.exe to run out of svchost.exe. I first checked the running processes again:

Using this instance of svchost.exe (PID 164), I ran the PPID spoofing technique:

...and it didn't work with notepad.exe:( I tried again with calc.exe and it worked first try:

I believe this is my calculator instance via Sysmon logs:

Now, I tried running the following command:

This might be the command, I could not find the parameters within Sysmon:

To enable Command Line Process Auditing from the command line, I did the following tasks below. This will allow Event ID 4688 (A new process has been created) logs full command-line detail for processes.

I ran the following command as Administrator:

This enables the logging of Event ID 4688.

By default, Event ID 4688 doesn't capture the full command line. To enable it, I modified the registry:

This ensures command-line arguments are included in Event ID 4688 logs.

To check if Process Creation Auditing is enabled, run:

To verify the command line logging registry setting:

Both returned the expected outputs!

I applied the Group Policy refresh to apply the change immediately without a restart!

I tested by creating a process again:

I can now see the Command Line Parameters!

I am going to exclude procexp64.exe from Sysmon before moving on. I did this by changing my sysmonconfig.xml config:

I made sure to apply it using the sysmon -c sysmonconfig.xml command.

Now to try different process injection techniques :)

Before starting, I uploaded the beacon.exe file to the target and named it OneDrive.exe. I did this using the below command in Sliver:

We uploaded the beacon.exe file to the Public directory so that it can be used across users, not just on the current user.

Now that the beacon is ready, I first migrated to another process and executed to my OneDrive.exe from there. I did this as so:

I now need to change to the new session using the use command. After this is done, I launched the new OneDrive.exe from the new process migrated to. I can see this process within Process Explorer!

I had no difficulty migrating to running in session -1 and migrating to the process. I am not sure if I was supposed to run into issues doing this.

It is a bit hard to wrap my head around exactly what a session is in terms to Windows, but from my broad understanding, it seems to be a kernel object that shares resources between a group of processes. Sessions are usually created via remote or local interactive logon. A process is part of a session and cannot change sessions (technically).

Overall, this lab was extremely insightful! I learned a lot about the process of utilizing Sliver C2 and hope to continue to use this tool more! As always, one of the greatest challenges of the lab was getting Windows to work well with me, as I always find it difficult to find information, such as through Windows Event Logs/Sysmon. I also could not get seatbelt to work at all for me, but that is something I will hopefully work on more in the future labs.

In terms of what went well, being able to spoof PIDs and PPIDs was extremely simple and very cool to be able to see in real time on my Windows 11 VM! Lastly, Sliver configuration and setup was very simple and straightforward.