{"id":8560,"date":"2020-02-17T12:56:10","date_gmt":"2020-02-17T10:56:10","guid":{"rendered":"http:\/\/tajdini.net\/blog\/?p=8560"},"modified":"2020-12-20T11:17:55","modified_gmt":"2020-12-20T09:17:55","slug":"hosting-and-hiding-your-c2-with-docker-and-socat","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/cisco-and-networking\/hosting-and-hiding-your-c2-with-docker-and-socat\/","title":{"rendered":"Hosting and hiding your C2 with Docker and Socat"},"content":{"rendered":"\n

Abstract<\/h2>\n\n\n\n

We want to run a simple C2 that is not exposed to the internet, with multiple socats redirecting our payload delivery<\/strong> and session handling<\/strong> correctly. All this with the help of Docker.
\nIt\u2019s straightforward once you\u2019ve gotten the grip.<\/p>\n\n\n\n

Why<\/strong><\/p>\n\n\n\n

Using containers means we get the \u201cit always works\u201d factor, compared \nto manual installs. Since each Docker image is already built, we can \njust pull it and have everything working out of the box.
\nDocker greatly facilitates abstraction of networking and volumes, and makes for easy repeatable deployments.<\/p>\n\n\n\n

To quote a seasoned professional:<\/p>\n\n\n\n

How<\/strong><\/p>\n\n\n\n

We\u2019re ideally running our Docker host on a VPS, that we can ssh into. A simple Ubuntu + Docker CE<\/a> will suffice. There are some free or very cheap options out there.<\/p>\n\n\n\n

We wish to keep our C2 container in a segmented Docker network, isolated<\/strong> from the outside. Two socat routes to it are needed.<\/p>\n\n\n\n

Route<\/th>Outside port<\/th>C2 port<\/th><\/tr><\/thead>
Payload delivery<\/td>443<\/td>8080<\/td><\/tr>
Session handling<\/td>80<\/td>4444<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

For our C2, we\u2019re going to use Metasploit with the reverse_http meterpreter.<\/p>\n\n\n\n

\u2b50 These instructions also work with the meterpreter_reverse_https<\/code> and meterpreter_reverse_tcp<\/code> payloads as is.<\/strong><\/p>\n\n\n\n

We\u2019re using the http variant so as to see all the traffic in \ncleartext at each step for live fiddling. Prefer encrypted channels when\n performing exercises.<\/p>\n\n\n\n

In our case, the payload is served on port 443, but using http. You can add an SSL certificate, explained later in this article.<\/p>\n\n\n\n

Setup \ud83d\udd27<\/h2>\n\n\n\n

Docker<\/h3>\n\n\n\n

This post won\u2019t introduce Docker as there are plenty of excellent \nwrite-ups. For this post, you need to have a grasp on Docker networks \nand volumes.<\/p>\n\n\n\n

Try running the hello-world<\/code> container to check:<\/p>\n\n\n\n

$ docker run hello-world # Hello from docker\n<\/code><\/pre>\n\n\n\n
Let\u2019s create our isolated network first:<\/p>\n\n\n\n
$ docker network create c2-net\n<\/code><\/pre>\n\n\n\n
Socat<\/h3>\n\n\n\n
We\u2019re now going to create two different socat containers, one for each route.
\nWe\u2019re going to launch our two socat containers as daemons.<\/p>\n\n\n\n
Socat will natively resolve the msf<\/code> container hostname since they will all be in the internal c2-net<\/em> network.<\/p>\n\n\n\n
\ud83d\udd39 The first one, redirecting port 443 to our Metasploit web_delivery server on port 8080:<\/p>\n\n\n\n
$ docker run --rm -d -p 443:443 --network=c2-net --name socat_delivery alpine\/socat -v TCP4-LISTEN:443,fork TCP4:msf:8080\n<\/code><\/pre>\n\n\n\n
\ud83d\udd39 The second one for our meterpreter session, from port 80 to the Metasploit handler on port 4444:<\/p>\n\n\n\n
$ docker run --rm -d -p 80:80 --network=c2-net --name socat_handler alpine\/socat -v TCP4-LISTEN:80,fork TCP4:msf:4444\n<\/code><\/pre>\n\n\n\n
The containers are now running in the background. I\u2019ve launched them with the optional verbose argument for easier fiddling.<\/p>\n\n\n\n
To view the logs, you can either:<\/p>\n\n\n\n