Jump to content
Sign in to follow this  
General_SynAckbar

C2 https port change

Recommended Posts

Is it possible to change the https port the C2 server listens on? I only see the option for the http port (-listenport). I wanted to use tcp/443 for the ssh port since most layer 4 firewalls will allow tcp/443 out and not tcp/2022.

Share this post


Link to post
Share on other sites

Hi Syn,

I'd recommend sticking with the default port number of 443. Obfuscation is not considered to be a valid form of cybersecurity or defense. You should attempt instead to use other means of hardening.

-VB

Share this post


Link to post
Share on other sites
On 6/28/2020 at 6:46 PM, Void-Byte said:

Hi Syn,

I'd recommend sticking with the default port number of 443. Obfuscation is not considered to be a valid form of cybersecurity or defense. You should attempt instead to use other means of hardening.

-VB

I know obfuscation isn't secure, along with everyone else in InfoSec. I think you misunderstood my post. It's about increasing the chance of the device being able to phone back home to the C2 server for SSH. I'd rather just use the ssh console in the C2 server since it's a feature, so why not use it? Most organizations aren't going to allow tcp/2022 outbound, so making the outbound SSH connection from say a lan-turtle that's on-prem using tcp/2022 to the C2 server has a very high likelihood of being blocked. If I can change the ssh listen port on the C2 server to say 443, I'm going to have a much higher chance of it being permitted out, and I can't do that if I can't change the ssl port for the web service.

And before anyone else mentions it, I know that if the org has a layer 7 firewall like a palo, it won't work because it'll identify traffic as ssh instead of ssl going out on 443.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...