In this demonstration,
we will set up a C2 channel using the HTTP protocol; however,
we will set this up over a non‑standard port.
As we revisit the diagram,
the C2 channel, using the non‑standard port, will be set up between the
IT administrator's machine and our Kali Linux machine.
The IT administrator will be connected from a 192.168.94.165
address, and the destination will be our Kali machine,
which sets at the 192.168.94.140 address, and the communication will happen
using the HTTP protocol over port 53. Many APT groups have used Empire to
establish C2 channels over a non‑standard port.
For example, we will use an HTTP listener over port 53, which is used for DNS.
To kick this off, I will set up a listener using HTTP.
I'm going to set the name of this listener to http_53.
I'll set the port to 53, and I'll execute. Now my
listener is successfully started.
Next,
I need to set up a stager, which will use this listener. I will use a
stager for Windows, and I will use the dll stager.
I'll take a look at the information that's required, and I need to set the
listener, which should be the one that I've just created, using port 53, and
I'm going to change the directory for the output file.
I will execute this, and now I've got my dll stager,
which is ready to be deployed to the target.
I'm going to go ahead now and execute the stager on the target machine.
Now that the stager is successfully executed, we now have
an agent, which has been established.
I'm going to interact with this agent, and I'll type info, and
now I can see that I've got an established session with this
agent using the listener http_53.
Let's jump, now, to the Wireshark capture to see
what the traffic flow looked like.
Alright, so looking at the Wireshark capture,
we can see the traffic flow between the Windows 10
machine and our Kali Linux machine.
You'll notice that this traffic has been established over the TCP protocol,
but using port 53.
Let's look at the netstat output. Here,
I've issued the command netstat ‑a ‑n, and now I can see an active,
established session between the Windows 10 machine and
my Kali Linux machine over port 53.
We have successfully established a C2 channel using
HTTP over a non‑standard port.
This is a common technique, which is used in the real world by multiple APT
groups using common ports such as port 8080, 443, 53, and more.