The short-term C2 gap and what a good channel requires

▶ Watch (00:27)

“we didn’t feel like we had a good covert command and control channel for what I would call short-term command and control” — Adam Crosser

Short-term C2 handles the high-bandwidth work on a red team: SOCKS proxying, hidden VNC, remote port forwarding. Long-term C2 survives reboots. Crosser’s team ran both, but the short-term slot was empty. A good channel for that role needs four things: low latency (commands arrive fast), high throughput (data moves freely), reach (allowed on most enterprise networks), and trust (allowed-listed or excluded from inspection). No channel they evaluated hit all four — until they looked at web conferencing.

Why web conferencing infrastructure beats every alternative

▶ Watch (03:53)

DNS-over-HTTP has low latency but caps out fast. Sending 20 GB through Google’s DNS servers looks wrong, and most enterprises run their own internal DNS anyway. Cloud file storage has decent throughput but sluggish latency — too slow for browsing Confluence. Custom domains score well on speed but fail on trust: anything connecting to attacker-owned infrastructure is compromised by definition. Email and Slack miss on throughput.

Web conferencing clears every bar. Calls require low latency because humans are on the line. Multiple video streams demand high throughput. Post-pandemic, Zoom and Teams are present across nearly every enterprise. And the trust story is baked in by the vendors themselves: Microsoft recommends excluding Teams traffic from full-tunnel VPNs and from TLS inspection. Zoom publishes the same guidance. The inspection gap that makes these platforms work is precisely what makes them useful for C2.

WebRTC internals and TURN credential discovery

▶ Watch (07:59)

Most platforms share the same plumbing: a control plane allocates a media server, STUN/TURN handles NAT traversal, and TURNS over 443 TCP carries traffic when egress is restricted. Google Meet uses stock WebRTC with DTLS and SRTP. Zoom wraps RTP in a custom header but falls through the same relay chain. Crosser reverse-engineered Zoom’s JavaScript client and pulled TURN credentials from a ~1,200-byte response during meeting join — sitting on a zoom.us subdomain excluded from TLS inspection. Teams exposes an unauthenticated endpoint returning equivalent credentials with no join required. Neither set is tied to a call. Both stay valid for days.

TurnToTurn Tunneler: architecture, use cases, and live demo

▶ Watch (18:33)

TurnToTurn Tunneler runs a controller on the operator and a relay on the victim. The controller generates a WebRTC offer; the relay pastes it in and the tunnel opens over vendor TURN. From there: SOCKS proxying, port forwarding, file transfer. The Zoom TURN credential extraction via Burp Suite (24:44) needs no victim action. Proxy Chrome, join a meeting, grab the ~1,200-byte response. A file download over Zoom TURN tunnel at 8–10 MB/s (25:49) follows. Teams automates credential retrieval. The Microsoft Teams remote port forward demo (27:55) ends with a victim VM in GCP exposing the attacker’s Python server on port 880.

Defensive posture, vendor mitigations, and future research

▶ Watch (30:27)

Network-level detection is a poor investment here. Traffic over 443 TCP to teams.microsoft.com subdomains looks identical whether someone is on a real call or tunneling secretsdump through it. Crosser recommends skipping process-to-IP correlation entirely and focusing instead on the tooling run through the channel — NLM relay, credential dumpers, internal recon.

Zoom pushed a server-side mitigation days before the talk, restricting TURN credentials so they can only reach Zoom’s own media infrastructure. Microsoft Teams remained open. Vendors that route TURN traffic exclusively through centralized media servers have a path to the same fix; those that rely on TURN for peer-to-peer calls face a harder tradeoff. Crosser flagged canary tokens on internal assets as a practical detection complement, and identified expanding TURN credential extraction to Google Meet, Webex, and Cloudflare’s managed TURN service as the clearest next research target.

Notable Quotes

we didn’t feel like we had a good covert command and control channel for what I would call short-term command and control Adam Crosser · ▶ 0:36

at the network level it might look for a couple of hours it might look like you’re on a video call but you’re actually just routing traffic through that provider’s infrastructure Adam Crosser · ▶ 19:08

I will say I did find out on Sunday that they actually pushed a mitigation for this on on the zoom side Adam Crosser · ▶ 26:18

Key Takeaways

  • Abuse TURN credentials from Zoom or Teams to tunnel red-team traffic through vendor-trusted, TLS-inspection-exempt infrastructure.
  • Detect the tooling run through the tunnel — secretsdump, NLM relay — not the tunnel itself; network-layer detection is a poor investment.
  • Every major web conferencing provider exposes TURN infrastructure; expanding credential extraction is a low-barrier research entry point.