.webp "Arena-Hard-Auto : Advancing LLM Evaluation With Style Control Integration")
.webp "How To Install/Run – Streamlining OSINT Workflows For Enhanced Capabilities")
Setting up a Command and Control (C2) server is a critical step in establishing a robust red team infrastructure.
This guide provides a detailed walkthrough on how to install and configure your C2 server, ensuring seamless integration with tools like Filebeat and RedELK.
Follow these essential steps to enhance your cybersecurity testing capabilities.
In Short
- extract
c2servers.tgzon your C2 server. - Run the installer for your C2 servers with parameters, i.e.
install-c2server.sh $FilebeatID $ScenarioName $IP/DNS:PORT
In Detail
Copy and extract c2servers.tgz on your C2 server as part of your red team infra deployment procedures. Run the installer for your C2 server, i.e.: install-c2server.sh $FilebeatID $ScenarioName $IP/DNS:POR
- $FilebeatID is the identifier of this teamserver within filebeat.
- $ScenarioName is the name of the attack scenario this teamserver is used for.
- $IP/DNS:PORT is the IP or DNS name and port where filebeat logs are shipped to, this would be the IP/DNS of your RedELK server. Even if you use the default port (TCP/5044) you need to provide this as a parameter.
See Naming requirements for detailed info on naming requirements.
This script will warn if filebeat is already installed (important as ELK and filebeat sometimes are very picky about having equal versions), install required certificates, adjust the filebeat configuration, start filebeat, create a local user ‘scponly’ and limit that user to SSH key-based auth via scp/sftp/rsync.
Debugging
Having issues? Check the following:
- The installer output in
redelk-install.log. - Filebeat errors in its log file (
/var/log/filebeatorfilebeatmentioned in/var/log/syslogdepending on your Linux flavour used).- You want to make sure it is tracking the right log files. And you want to make sure it can connect to the RedELK server.
- If no connection is established, this is often due to firewall issues or due to incorrect SSL parameters given in the
certs/config.cfgfile.
- If no connection is established, this is often due to firewall issues or due to incorrect SSL parameters given in the
- You want to make sure it is tracking the right log files. And you want to make sure it can connect to the RedELK server.
- Check for issues in the background scripts in
/var/log/redelk/*.
 server is a critical step in establishing a robust red team infrastructure. This guide provides a){kind=link}