WEBVTT

00:00:00.340 --> 00:00:01.590
In this demonstration,

00:00:01.960 --> 00:00:06.710
we will set up a C2 channel using the HTTP protocol; however,

00:00:06.720 --> 00:00:09.550
we will set this up over a non‑standard port.

00:00:09.940 --> 00:00:11.510
As we revisit the diagram,

00:00:11.890 --> 00:00:15.580
the C2 channel, using the non‑standard port, will be set up between the

00:00:15.580 --> 00:00:18.590
IT administrator's machine and our Kali Linux machine.

00:00:19.540 --> 00:00:24.340
The IT administrator will be connected from a 192.168.94.165

00:00:24.340 --> 00:00:28.380
address, and the destination will be our Kali machine,

00:00:28.550 --> 00:00:34.900
which sets at the 192.168.94.140 address, and the communication will happen

00:00:34.900 --> 00:00:41.630
using the HTTP protocol over port 53. Many APT groups have used Empire to

00:00:41.630 --> 00:00:44.820
establish C2 channels over a non‑standard port.

00:00:45.140 --> 00:00:52.260
For example, we will use an HTTP listener over port 53, which is used for DNS.

00:00:52.600 --> 00:00:56.360
To kick this off, I will set up a listener using HTTP.

00:00:56.590 --> 00:01:01.030
I'm going to set the name of this listener to http_53.

00:01:01.280 --> 00:01:06.810
I'll set the port to 53, and I'll execute. Now my

00:01:06.810 --> 00:01:08.660
listener is successfully started.

00:01:09.440 --> 00:01:09.880
Next,

00:01:09.880 --> 00:01:14.270
I need to set up a stager, which will use this listener. I will use a

00:01:14.270 --> 00:01:18.760
stager for Windows, and I will use the dll stager.

00:01:19.610 --> 00:01:23.120
I'll take a look at the information that's required, and I need to set the

00:01:23.120 --> 00:01:29.310
listener, which should be the one that I've just created, using port 53, and

00:01:29.310 --> 00:01:31.660
I'm going to change the directory for the output file.

00:01:32.830 --> 00:01:36.990
I will execute this, and now I've got my dll stager,

00:01:37.140 --> 00:01:39.470
which is ready to be deployed to the target.

00:01:40.040 --> 00:01:43.760
I'm going to go ahead now and execute the stager on the target machine.

00:01:44.540 --> 00:01:47.670
Now that the stager is successfully executed, we now have

00:01:47.670 --> 00:01:49.710
an agent, which has been established.

00:01:50.140 --> 00:01:53.600
I'm going to interact with this agent, and I'll type info, and

00:01:53.600 --> 00:01:56.740
now I can see that I've got an established session with this

00:01:56.740 --> 00:02:00.370
agent using the listener http_53.

00:02:01.210 --> 00:02:04.160
Let's jump, now, to the Wireshark capture to see

00:02:04.160 --> 00:02:06.170
what the traffic flow looked like.

00:02:07.540 --> 00:02:09.600
Alright, so looking at the Wireshark capture,

00:02:09.610 --> 00:02:12.210
we can see the traffic flow between the Windows 10

00:02:12.210 --> 00:02:14.860
machine and our Kali Linux machine.

00:02:15.240 --> 00:02:19.750
You'll notice that this traffic has been established over the TCP protocol,

00:02:19.760 --> 00:02:21.450
but using port 53.

00:02:22.340 --> 00:02:25.940
Let's look at the netstat output. Here,

00:02:25.940 --> 00:02:31.390
I've issued the command netstat ‑a ‑n, and now I can see an active,

00:02:31.390 --> 00:02:35.460
established session between the Windows 10 machine and

00:02:35.460 --> 00:02:38.480
my Kali Linux machine over port 53.

00:02:38.890 --> 00:02:41.840
We have successfully established a C2 channel using

00:02:41.840 --> 00:02:44.570
HTTP over a non‑standard port.

00:02:45.110 --> 00:02:49.540
This is a common technique, which is used in the real world by multiple APT

00:02:49.540 --> 00:02:55.570
groups using common ports such as port 8080, 443, 53, and more.