The Art of Compromising C2 Servers: A Web App Vulns Perspective
Vangelis Stykas demonstrates how typical web application flaws in abandoned malware C2 infrastructure allow researchers to compromise admin panels and identify threat actors.
Summary
Targeting Abandoned Command and Control Servers
Command-and-control (C2) servers deployed by mobile and Windows malware operators are frequently abandoned after campaigns conclude. Vangelis Stykas investigates the attack surface of exposed C2 backends to uncover adversary infrastructure and operator identities.
Web Application Flaws in Malicious Infrastructure
While reverse engineering malware payloads requires specialized skills, exploiting C2 administrative panels often relies on fundamental web application vulnerabilities easily surfaced by automated security scanners.
Extracting Malware Source Code and Threat Intelligence
Exploiting low-hanging fruit in web panels yields administrative access across botnet endpoints, revealing proprietary malware source code and actionable attribution data regarding cybercrime rings.
Related talks
Main Stage·44 min
Joseph McCray
Joseph McCray explores advanced sql injection at DEF CON 17, examining sql-injection and practical defenses.
Main Stage·39 min
Chris Gates · Mario Ceballos
Chris Gates and Mario Ceballos explores breaking the unbreakable oracle with metasploit at DEF CON 17, examining sql-injection and practical defenses.
Main Stage·45 min
RJ McDown
RJ McDown presents Obligato, a covert implant communication framework that abuses legacy Windows session architectures to decouple C2 traffic from malware processes.