-
Notifications
You must be signed in to change notification settings - Fork 395
C2 server installation
Marc Smeets edited this page Mar 18, 2021
·
2 revisions
- extract
teamservers.tgz - Run the installer for your C2 servers with parameters, i.e.
install-teamserver.sh $FilebeatID $ScenarioName $IP/DNS:PORT
Copy and extract teamservers.tgz on your C2 server as part of your red team infra deployment procedures.
Run the installer for your C2 server, i.e.: install-teamserver.sh $FilebeatID $ScenarioName $IP/DNS:PORT
- $FilebeatID is the identifier of this teamserver within filebeat.
- $ScenarioName is the name of the attack scenario this teamserver is used for.
- $IP/DNS:PORT is the IP or DNS name and port where filebeat logs are shipped to, this would be the IP/DNS of your RedELK server. Even if you use the default port (TCP/5044) you need to provide this as a parameter.
See Naming requirements for detailed info on naming requirements.
This script will warn if filebeat is already installed (important as ELK and filebeat sometimes are very picky about having equal versions), install required certificates, adjust the filebeat configuration, start filebeat, create a local user 'scponly' and limit that user to SSH key-based auth via scp/sftp/rsync.