What is Command and Control Server?

[DeepTow]

Command and Control server [C2]
​

[C2 stands for Command and Control Server]
C2 is the server set up by the attacker
the attacker needs to be able to perform more reboots, execute commands, elevate privileges, steal data and move more across the network.


The C2 system is one of the best ways to achieve this. C2 (also known as CnC) stands for command and control, a means by which malware is directed and controlled by its owner/attacker to perform various activities.


The commands are nothing but actions that the malware receives on the victim's device. Commands can range from requiring the malware to load credentials and other victim data, to launching a DDOS attack on another victim/server on the Internet.

A C2 system typically has a proxy running on the victim's machine where it receives commands from the attacker, executes the commands, and then displays the results.


Most C2 systems have three components: an agent that runs on the compromised system, a server that acts as an intermediary between the attacker and the compromised host, and a piece of management software that allows the attacker to issue commands. Proxies can talk over many different protocols, depending on the part of the C2 software, but the common ones are HTTP, HTTPS, DNS, SMB, TCP, and RPC. Once the attacker runs the proxy on the compromised system, the proxy will check the server and send the victim's basic details to the system, such as the victim's privilege level, system information, applications, and so on.


All C2 systems have different features, but some common features include the ability to create proxy payloads, the ability to execute commands and get results, and the ability to upload and download files. There are free versions of community-supported C2 tools, such as Metasploit and PowerShell Empire. There are also commercial tools such as Cobalt Strike and INNUENDO that have support. Your choice of C2 system should be dictated by your needs. Once the malware infects the victim's machine, it may need to use the network for various reasons. Some motives for the attacker to use C2 and communicate with the victim via the communication channel:

A banking malware needs to send the victim's credentials to the attacker. Ransomware may need to send the encryption key used in the file encryption process back to the attacker.

- The attacker may want to take control of the victim's system remotely using RATs. Malware may wish to infect other systems on the network.
- The malware may be part of an APT attack where the actual target of the cyberattack/infection may be another device on the network, which the malware attempts to locate and infect.
Based on these use cases,
the types of communication used by malware can be categorized into the following broad categories.

Click to read more...