The Portability Problem in External C2

▶ Watch (2:01)

External C2 uses trusted third-party sites (GitHub, OneDrive, Google Calendar, even Counter-Strike servers) to relay commands. The LOL C2 project documented many such sites. Threat actors and red teams both use these, as MITRE ATT&CK added the technique in 2017. But each C2 framework (Cobalt Strike, Mythic) offers only a few compatible profiles. Porting a custom profile from one framework to another is difficult. Taylor aimed to solve that.

WebAssembly and Extism as the Bridge

▶ Watch (6:09)

Taylor turned to WebAssembly runtimes outside the browser. With WASI, WebAssembly modules can interact with the OS: read/write files, get system time, make network requests. Extism, a universal plugin system by Dylibso, supports multiple languages on the plugin and host side. Taylor wrote his C4 plugins in Rust, compiled them to .wasm, and loaded them in Python, .NET, and other agent languages. A six-line “hello world” proved the concept. Next, he confirmed HTTP requests returned status 200 from each host language.

C4 Plugins: AWS S3 in Practice

▶ Watch (11:17)

Each C4 plugin has two actions: send and receive. For AWS S3, sending means uploading a JSON file to a bucket; receiving means downloading and deleting it. Taylor handles multiple agents by organizing messages into folders per agent. Files are named by system time to avoid overwrites. AWS S3 supports large file exfiltration. The plugin parameters include access key, secret key, bucket name, and region. Loading the plugin in Python requires only pip install extism, enabling WASI and HTTP permissions in a manifest, then calling the plugin with a JSON blob.

Results and Future Plans

▶ Watch (15:36)

C4 currently ships plugins for AWS S3, Confluence, and GitHub Gist. Taylor plans to add more external C2 channels. He encouraged attendees to explore WebAssembly and Extism, which are rapidly evolving. “Start downloading some C4 plugins and loading them up in your malware today,” he said. The code is published on GitHub under the C4 project.

Notable Quotes

it’s challenging to take some of these really custom C2 profiles that are specific to a framework and port it to other frameworks. Scott “ScottCTaylor12” Taylor · ▶ 03:52

the problem is for web assembly, you know, this instance, this is all in the browser, but us red team operators, we’re on the operating system. Scott “ScottCTaylor12” Taylor · ▶ 07:01

I have multiple plugins. I support AWS S3, Confluence, everyone’s favorite documentation site, and GitHub gist. Scott “ScottCTaylor12” Taylor · ▶ 15:42

Key Takeaways

  • C4 uses WebAssembly and Extism to run one C2 plugin across multiple agent languages.
  • The tool currently provides external C2 channels for AWS S3, Confluence, and GitHub Gist.
  • Taylor plans to expand the plugin library and encourages community adoption of WASM-based C2.

About the Speaker

Scott Taylor is a Senior Red Team Operator on Sony’s Global Threat Emulation team. He previously worked at MITRE Corporation and T. Rowe Price, focusing on adversary emulation. He started his career as a Linux system administration intern before moving into offensive security. He researches command and control infrastructure for red team operations and has published open-source custom C2 channels and cloud-based C2 automation.