Are you looking for a proxy‑aware command and control framework to
leverage against remote hosts during an attack engagement?
Hello, and welcome to Command and Control with PoshC2.
I'm Jeff Stein, and in this course,
I will take you through how you can use PoshC2 to engage in
a number of post‑exploitation activities in a red team
environment against your target.
We will walk through system enumeration techniques to help plan our
attack and apply our findings towards data exfiltration,
harvesting credentials for privilege escalation,
and moving laterally through our victim network.
Before we get started, let's jump into a quick overview of what PoshC2 is.
PoshC2 is a command and control framework used to assist with red teaming,
post exploitation, and lateral movement.
It was created by the team at Nettitude,
and I want to thank them for their efforts in developing and maintaining
the framework. PoshC2 has many different features,
but overall was designed for penetration testers to leverage during post
exploitation while offering them the ability to customize or extend the C2
framework to suit their needs and environment.
PoshC2 is an open source tool available on GitHub and can be either
cloned or installed via an install script. In addition to the core
functionality of the tool, one of the great aspects of the project
is the modular approach that extends the PoshC2 command and control
capabilities.
Scripts can be written or customized and then loaded into the PoshC2
framework as modules to run during your attack engagement.
Also, the framework leverages a configurable implant beacon feature,
which allows you to effectively evade defensive measures while working
with the implants running on a compromised host.
Now that we have a good idea of how we will utilize PoshC2, let's
take a look at where the tool falls on the kill chain. If you're
familiar with the Cyber Kill Chain,
you will see that the features of PoshC2 can be used post exploitation and
continue on through the remaining phases of the kill chain.
If we map the techniques we will learn during this
course to the MITRE ATT&CK framework,
we will be covering two of the attack framework categories, in Discovery,
including Account Discovery with coverage of the Local Account sub‑technique,
as well as Command & Control, with Application Layer Protocols using the Web
Protocols sub‑technique and Remote Access Software.
Now let's quickly review how our attack scenario will look with PoshC2. We
will start by targeting the email system of Globomantics,
an evil corporation to gain initial access leveraging a spear‑phishing
attack to carry our PoshC2 payload to our target.
Once we have an implant loaded on our victim,
we will begin our command and control communication
channel to leverage in exfiltrating data,
gaining privileged access, and finally, moving laterally through the
Globomantics network as we continue our attack.