C3 Custom Command and Control

C3 (Custom Command and Control) is a tool that allows Red Teams to rapidly develop and utilise esoteric command and control channels (C2). It’s a framework that extends other red team tooling, such as the commercial Cobalt Strike (CS) product via ExternalC2, which is supported at release. It allows the Red Team to concern themselves only with the C2 they want to implement; relying on the robustness of C3 and the CS tooling to take care of the rest. This efficiency and reliability enable Red Teams to operate safely in critical client environments (by assuring a professional level of stability and security); whilst allowing for safe experimentation and rapid deployment of customised Tactics, Techniques and Procedures (TTPs). Thus, empowering Red Teams to emulate and simulate an adaptive real-world attacker.

Attackers must establish command and control (C2) to gain influence within their target environments in order to pursue their goals and objectives. It is therefore arguably one of the most important parts of the cyber kill chain because without it any payloads that are successfully delivered operate blindly, cannot provide network level pivoting and near real-time interaction. It is no surprise then that organisations have been imposing more controls against what types of communications are allowed from systems and a priority has been placed on defensive teams to be able to effectively detect C2. This is emphasised by two out of the twelve columns of Mitre ATT&CK being related to this area, ‘Command and Control’ and ‘Exfiltration’.

The first proof of concept of C3 was presented at BlueHat v18 by William Knowles and Dave Hartley. Since then it has been refactored and some aspects reimagined into what it is today by a team of developers heavily influenced by members of the MWR Red Team.

Practical Usage

C3 is designed to be an easy and intuitive interface that allows users to form complex paths during adversarial simulations. This section provides an in-depth guide of how to use C3, from compilation through to code execution.

Usage

See this blog post for a detailed tutorial.

For contribution guide (how to develop a Channel tutorials), see this page.

Glossary

The most commonly used terms in C3:

• Relays - stand-alone pieces of C3 Networks. They communicate using Interfaces. There are two types of Relays: Gate Relays (or Gateways) and Node Relays.
• Gateway - a special Relay that controls one C3 Network. A C3 Network cannot operate without an operational Gateway. The Gateway is the bridge back to the attacker’s infrastructure from Node Relays. It’s also responsible for communicating back to a third-party C2 server (such as Cobalt Strike’s Teamserver). Gateways should always be hosted within attacker-controlled infrastructure.
• Node Relay - an executable to be launched on a compromised host. Node Relays communicate through Devices either between one another or back to the Gateway.
• Interface - a high level name given to anything that facilitates the sending and receiving of data within a C3 network. They are always connected to some Relay and their purpose is to extend Relay's capability. Currently there are three types of Interfaces: Channels, Peripherals and Connectors.
• Devices - common name for Channels and Peripherals. This abstraction is created to generalize Interfaces that are able to be used on Node Relays.
• Channel - an Interface used to transport data between two Relays. Channels works in pairs and do not support the one-to-many transmission (see Negotiation Channels).
• Negotiation Channel - a special Channel capable of establishing regular Channel connections with multiple Relays. The negotiation process is fully automatic. Negotiation Channels support only negotiation protocol and cannot be used in any other transmission.
• Gateway Return Channel (GRC) - the configured Channel that a Relay will use to send data back to the Gateway. GRC may be a route through another Relay. The first Channel (initial) on a Node Relay is automatically set as GRC for that Node Relay.
• C3 Minimal MTU - the minimal portion of data that every C3 Channel is required to be able to send. Currently C3 Minimal MTU is equal to 64 bytes. Unless a chunk shorter than 64 bytes contains a complete packet, receiver Relay ignores it and sender Relay tries and re-sends last portion of data.
• Peripherals - a third-party implant of a command and control framework. Peripherals talk to their native controllers via a Controller. For example, Cobalt Strike’s SMB beacon.
• Connectors - an integration with a third-party command and control framework. For instance the ‘External C2’ interface exposed by Cobalt Strike’s Teamserver through the externalc2_start command.
• Binders - common name for Peripherals and Connectors.
• Device ID - a dynamic ID that uniquely addresses one Device on a Relay.
• Agent ID - a dynamic ID that uniquely addresses a Node Relay. Node Relays instantiated from the same executable will have different Agent IDs.
• Build ID - a static ID that is built into every Relay. Stays unchanged over reboots.
• Route ID - a pair of an Agent ID and a Device ID. Used to describe one “path” to a Node Relay (Node Relays might be reachable via many Routes).
• Route - a “path” to a Node Relay. Every Relay keeps a table of all of their child Relays (and grandchildren, grand-grandchildren, and so on) along with Channel Device IDs used to reach that particular Relay (see Route ID). When a packet from the Gateway arrives to a Node Relay, routing table is used to choose appropriate Channel to send the packet through to the recipient.
• Update Delay Jitter - delay between successive updates of an Interface (in case of Channels - calls to OnReceiveFromChannel method). Can be set to be randomized in provided range of time values.