Red › Module 5 › Lesson 4
Lab — C2 Baseline
Pack C2 literacy — names, beacon concepts, lab-only checklist — literacy file only, dest $LAB_RT.
Visual · rt_c2_lab
Lab: write C2 pack. $LAB_RT only. Original Cyberlium.
Opening
C2 pack before any listener — names, beacons, checklist on paper first.
Lessons 5-1 through 5-3 covered C2 names, beacon concepts, and lab-only boundaries. This lab merges them into one C2 literacy pack for $LAB_RT. Optional: note planned detection correlation — no unauthorized listener required. No production callbacks. No kit cracks. Next: Quiz — C2 Literacy.
1. Lab contract: write the C2 literacy pack
Create $HOME/cyberlium-lab/t21-m05-l04-c2-lab.txt merging C2 name table, beacon glossary, lab C2 checklist, and NEVER production/classmate lines.
Cross-reference emulation plan and RoE pack for $LAB_RT C2 constraints.
Command guide
Try these commands — Lab contract: write the C2 literacy pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
C2 baseline — https://attack.mitre.org/tactics/TA0011/ (listeners on YOUR lab) Mythic C2 docs — https://docs.mythic-c2.net/ (literacy only) Sigma rules — https://sigmahq.io/ (detect beacon-like traffic patterns)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
Command — copy this
sudo apt install curl
macOS: Use: netstat
Windows: Use: netstat Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t21-rt/lab.env" 2>/dev/null || true ss -tulpn 2>/dev/null | tee "$HOME/cyberlium-lab/t21-rt/c2-baseline-ss.txt" | grep LISTEN | head -10 journalctl --no-pager -n 30 2>/dev/null | grep -iE 'listen|bind|socket' | head -8 || journalctl --no-pager -n 15 2>/dev/null | tail -5 curl -sS https://attack.mitre.org/tactics/TA0011/ | head -5 grep -i refuse "$HOME/cyberlium-lab/t21-rt/roe.txt" 2>/dev/null | head -2 || echo 'refuse: production C2 against strangers'
Primary tools to practice this lesson: ss, journalctl, curl. Reference sites: C2 baseline (https://attack.mitre.org/tactics/TA0011/); Mythic C2 docs (https://docs.mythic-c2.net/); Sigma rules (https://sigmahq.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check C2 misuse patterns
Grep for CS crack links, production IP listeners, or classmate targets — delete. Tutorials showing real C2 campaigns get trimmed to detection literacy for $LAB_RT only.
Classmates write their own C2 packs for their $LAB_RT.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Persistence Literacy.
C2 literacy feeds persistence module — stay lab-bound throughout.
4. What you ship: C2 literacy pack for $LAB_RT
Names + beacon glossary + lab checklist merged. $LAB_RT named. No cracks/production. chmod 600.
5. What you record before the next lesson
Date. C2 pack path. $LAB_RT named. File t21-m05-l04-c2-lab.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Add CS crack download to pack. Document production listener IP.
Right
Write YOUR C2 literacy pack for $LAB_RT. chmod 600. Next: Quiz — C2 Literacy.
Mission: freeze YOUR C2 pack on disk
1) Merge C2 names, beacon glossary, lab checklist. 2) Link RoE and plan pack paths. 3) chmod 600. Never include crack links or stranger callbacks.
Stuck? Ask Cyberlium AI Mentor
C2 packs document what blue should see — not how to hide from strangers.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: C2 pack should include lab-only checklist.
True or False
Knowledge Check
APPLY: Sliver/Mythic/CS in pack are for:
Multiple choice