How I Built a C2 Server in a Few Hours — Part I

I work in cybersecurity and have more than ten years of experience in software development. Over the years I have tried to apply my programming background to cybersecurity problems in order to automate tasks and build new tools for research and experimentation.

In this article I want to describe how I built a simple Command-and-Control (C2) server for educational and research purposes, with the help of Claude Code.

Inspired by tools such as Cobalt Strike, my goal was to emulate some of the core concepts using my own lightweight implementation. The system consists of a backend developed in Python and a web-based frontend built with React.

I chose Python and React because I already have extensive experience with both technologies, and they allow me to build prototypes very quickly.

I asked Claude Code to generate the initial implementation of a C2 server supporting two communication channels: HTTP and DNS. After a device registers with the server, it can receive instructions and execute fileless payloads delivered from the C2 infrastructure.

After several cycles of code review and bug fixing, Claude Code produced a working prototype consisting of:

a C2 server with a simple but effective web dashboard;
a builder interface to generate agents for target systems;
a scaffold for the C2 agent that can be compiled after configuring parameters such as the server address.

┌─────────────────────────────────────────────────────┐
│                   C2 Server                         │
│  ┌──────────┐  ┌──────────┐  ┌──────────────────┐   │
│  │ React UI │  │ FastAPI  │  │   PostgreSQL     │   │
│  │ :3000    │→ │ :8000    │→ │   :5432          │   │
│  └──────────┘  └────┬─────┘  └──────────────────┘   │
│                     │                               │
│         ┌───────────┼───────────┐                   │
│         │ HTTP      │ DNS       │                   │
│         │ Polling   │ TXT       │                   │
└─────────┼───────────┼───────────┼───────────────────┘
          │           │           │
    ┌─────┴─────┐  ┌──┴────┐  ┌───┴───┐
    │  Implant  │  │Implant│  │Implant│
    │  (Python) │  │ (C++) │  │ (C#)  │
    │  Win/Lin  │  │ Linux │  │  Win  │
    └───────────┘  └───────┘  └───────┘

The server supports two communication channels: HTTP and DNS.

Commands are scheduled on the server and executed by connected agents. When an agent checks for pending commands, it executes them and sends the results back to the server.

In HTTP mode, communication works through a polling mechanism:

GET requests are used to retrieve pending commands
POST requests are used to send execution results back to the server

In DNS mode, the system uses TXT record queries as a covert communication channel.

In the following screenshots you can see the current state of the prototype. In the next part of this article, I will dive deeper into the system architecture and explain how the agent communicates with the C2 server.

The full source code of the project is publicly available on GitHub, so anyone interested can explore the implementation or experiment with it:
https://github.com/antonino-tocco/C2.

Continua a leggere

How I Built a C2 Server in a Few Hours — Part II