Adventures in developing a C2 framework

The talk traces how a penetration testing firm's remote-testing setup grew into an in-house command and control framework. It started in 2020, when travel restrictions made internal network tests hard to run. The team built a tool that tunneled UDP over HTTPS so testers could work inside customer networks without firewall changes. During an engagement with strict internal segmentation, that tunnel was repurposed to deliver a shell out to the internet, which pushed the project toward a full C2 framework.

The middle of the talk covers the design. The framework separates connectors, a multiplexer and applications, so new features do not need to handle transport. Supported channels include HTTPS, DNS, ICMP, SMB named pipes, WebSockets, file shares and Gmail drafts. The speaker describes the difficulties of reliable transport, including congestion control and connection teardown bugs. End-to-end encryption uses a TLS 1.2-style handshake with ChaCha20-Poly1305, which the team chose despite the usual advice against rolling your own crypto. Other features include operator-approved staging, in-memory assembly loading in separate AppDomains, Beacon Object File support, and obfuscation and D/Invoke techniques to reduce static detection.

The closing section covers deployment, including a tool that checks implant hashes against VirusTotal to get early warning when defenders upload samples. The main takeaway is that custom tooling can be extended quickly during engagements and helps emulate advanced adversaries, but it demands sustained engineering investment.