GPEN Command and Control — 15 Questions

Question 1

Which THREE techniques are commonly used by attackers to hide C2 traffic within legitimate network protocols?

Accepted Answer

Embedding data in DNS TXT records.. Attackers disguise C2 traffic to blend in with normal organizational traffic, reducing the probability of detection by security teams. By leveraging protocols that are already allowed through firewalls, they ensure reliable communication while remaining stealthy. Understanding these masking techniques allows testers to develop more effective detection rules, focusing on content inspection and behavioral analysis rather than simple port blocking, which is often bypassed by these sophisticated methods.

Answer

Modifying the TTL field in IP headers.

Answer

Replacing the TCP/IP stack with a custom version.

Question 2

During an authorized penetration test, you successfully establish an interactive command and control shell via DNS tunneling. However, you notice that large data exfiltration queries are frequently failing or timing out due to upstream DNS server payload restrictions and strict rate limiting. Which action should you take to optimize reliability while maintaining covert persistence?

Accepted Answer

Delegate an authoritative nameserver for your testing domain and configure direct query routing over alternative record types.. Switching to a stateful protocol like HTTPS or utilizing DNS direct-server communication via a designated authoritative nameserver bypasses recursive resolver payload ceilings. This technique ensures reliable fragmentation and chunking of large files without triggering anomalous query rates or dropping packets at intermediary caching servers during penetration testing operations.

Answer

Increase the TXT record payload size to the absolute maximum allowed by the protocol standard to accelerate data transfer rates.

Answer

Configure the tunneling tool to query the domain directly through the compromised host's primary corporate recursive DNS server.

Answer

Disable data compression algorithms entirely to reduce the processing overhead on the target operating system's network stack.

Question 3

You are conducting a penetration test and have established a C2 channel using the Metasploit Framework's Meterpreter payload. You need to maintain persistence on the compromised Windows host while ensuring that the C2 communication survives reboots and user logoffs. Which two techniques can you use with Meterpreter to achieve this? (Choose two.)

Accepted Answer

Use the 'schtasks' command to create a scheduled task that runs the payload at system startup.. The two techniques that provide persistence for a Meterpreter session are using the 'persistence' module to create a registry key and using 'schtasks' to create a scheduled task. Both ensure that the payload runs automatically at startup or logon, re-establishing the C2 channel. Migration, RDP, and keylogging do not provide automatic reconnection after a reboot.

Answer

Use the 'keyscan_start' command to capture keystrokes and store them for later retrieval.

Answer

Use the 'migrate' command to move the Meterpreter session into a long-running process such as explorer.exe.

Answer

Use the 'getgui' command to enable Remote Desktop and then reconnect via RDP.

Question 4

During an authorized penetration test, you have established a Meterpreter session to a Windows 10 target over TCP port 443. The client's egress firewall begins inspecting TLS certificates and blocking self-signed certificates. Your session dies. You need a new payload that can survive this inspection while still using port 443. Which Metasploit payload is best suited?

Accepted Answer

windows/meterpreter/reverse_https with a valid certificate. The firewall blocks self-signed certificates. Using reverse_https with a valid certificate makes the TLS handshake appear legitimate, allowing the payload to traverse the firewall on port 443. Other options either still use self-signed certificates or abandon TLS entirely, which may trigger other blocks. This approach mimics legitimate HTTPS traffic, a common technique in penetration testing.

Answer

windows/meterpreter/reverse_tcp

Answer

windows/meterpreter/reverse_winhttps

Answer

windows/meterpreter/reverse_https

Question 5

During a penetration test, you have compromised a host in a restricted network that only allows outbound DNS traffic. You need to establish a C2 channel. Which of the following techniques would be most effective for maintaining a reliable, low-bandwidth C2 channel over DNS?

Accepted Answer

Using DNS TXT records to encode and transmit command output from the compromised host to the C2 server.. DNS TXT records are the most effective for DNS-based C2 because they can carry arbitrary data and are often allowed through firewalls. Encoding command output in TXT queries or responses enables bidirectional communication. Other DNS record types like A, PTR, or MX are limited in their ability to carry data or are not typically allowed for arbitrary use, making them less suitable for a reliable C2 channel.

Answer

Using DNS A records to transmit data by encoding information in the subdomain of the query.

Answer

Using DNS PTR records to send commands from the C2 server to the compromised host by encoding them in reverse DNS lookups.

Answer

Using DNS MX records to establish a direct TCP connection back to the C2 server over port 25.

Question 6

During a penetration test, you have established a C2 session with a target host using a Meterpreter reverse HTTPS payload. You want to maintain access even if the user logs off or the system reboots. Which of the following methods is the MOST reliable for achieving persistence on a Windows host?

Accepted Answer

Create a new scheduled task that runs the payload at system startup with highest privileges.. For reliable persistence on Windows that survives reboots and does not depend on user logon, a scheduled task set to run at system startup with highest privileges is the best choice. It executes with SYSTEM rights and runs regardless of user interaction. The other options either depend on user logon (HKCU Run key, Startup folder) or use a less reliable automated method (Meterpreter persistence command) that may not configure the task optimally.

Answer

Place a shortcut to the payload in the Startup folder for the current user.

Answer

Add a registry Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Answer

Use the 'persistence' command in Meterpreter to create a backdoor service that runs on boot.

Question 7

Which TWO methods are commonly used to achieve C2 persistence while ensuring the communication remains resilient against infrastructure takedowns?

Accepted Answer

Implementing Domain Generation Algorithms (DGA).. Resilient C2 infrastructure often relies on decentralized or dynamic components to ensure that the connection remains viable even if individual nodes are identified and blocked. By utilizing domain generation algorithms and cloud-based relay services, attackers create a moving target that is difficult for incident responders to fully dismantle in a timely manner. Mastery of these techniques is essential for assessing the robust nature of an organization's defense-in-depth posture.

Answer

Hardcoding the IP address of the C2 server.

Answer

Using unencrypted HTTP for all C2 traffic.

Answer

Requiring manual operator interaction for beaconing.

Question 8

Refer to the exhibit. What is the primary purpose of the 'jitter' parameter in this C2 configuration?

Accepted Answer

To prevent detection via traffic pattern analysis.. The jitter parameter introduces a random percentage of variation into the beacon interval, preventing the C2 traffic from appearing as a perfectly rhythmic heartbeat. Static intervals are highly detectable through statistical analysis, as they create distinct patterns in network traffic logs. Introducing jitter makes the C2 communication appear more organic and unpredictable, complicating efforts by defenders to identify the malicious connection using simple frequency-based anomaly detection algorithms.

Answer

To reduce the CPU overhead on the infected host.

Answer

To synchronize beaconing across multiple infected hosts.

Answer

To increase the throughput of the C2 channel.

Question 9

Which term best describes the stage of a cyberattack where a compromised host signals a remote server to request instructions or transmit stolen data?

Accepted Answer

Command and control. The command and control (C2) phase represents the ongoing communication channel between the attacker's infrastructure and the compromised system. It is the tactical link that allows the adversary to remotely manage the infection, deploy additional tools, and exfiltrate information. Recognizing C2 traffic is fundamental to incident response because it is the primary vector for controlling the adversary's actions within the network environment.

Answer

Privilege escalation

Answer

Reconnaissance

Answer

Log clearing

Question 10

When analyzing C2 traffic, which characteristic of a TLS/SSL certificate is most indicative of a potentially malicious beaconing endpoint?

Accepted Answer

The certificate uses a self-signed or invalid chain.. Malicious C2 infrastructure often uses self-signed certificates or certificates issued by untrusted/free Certificate Authorities to encrypt traffic. In a professional environment, legitimate services typically use well-known, trusted CAs. When a penetration tester sees an endpoint using a certificate with a random common name, short expiration period, or invalid chain, it serves as a strong indicator that the connection is intended for unauthorized command and control purposes.

Answer

The certificate uses a 2048-bit RSA key.

Answer

The certificate is signed by a reputable public CA.

Answer

The certificate includes a valid Subject Alternative Name.

Question 11

Refer to the exhibit. What does this error log suggest regarding the C2 connection attempt?

Accepted Answer

The client system does not trust the C2 server's certificate.. The 'tlsv1 alert unknown ca' error indicates that the client rejected the server's certificate because it was not signed by a trusted root CA. In the context of C2, this often happens when an automated beacon tries to connect to an infrastructure node using a self-signed certificate, and the host's security policy or a proxy is performing SSL inspection and fails the trust validation process.

Answer

The C2 server is unreachable due to a network outage.

Answer

The C2 server is performing a man-in-the-middle attack.

Answer

The C2 server has exhausted its connection limit.

Question 12

Which of the following is a classic characteristic of 'beaconing' behavior observed in C2 traffic?

Accepted Answer

Consistent, periodic intervals between connections.. Beaconing is characterized by the repeated, predictable nature of the connection attempts from a compromised host to an external server. By analyzing network traffic, one can identify these 'heartbeats' that occur at fixed intervals. This pattern is often the first red flag that a system has been compromised, as legitimate user activity is typically irregular and bursty compared to the methodical, automated nature of a C2 beacon.

Answer

High-volume data exfiltration during business hours.

Answer

Randomized connections to various global IP addresses.

Answer

Traffic that exclusively utilizes UDP transport.

Question 13

What is the primary risk of using 'Domain Fronting' in a C2 architecture during a penetration test?

Accepted Answer

It can cause accidental disruption to legitimate services.. Domain fronting relies on the trust placed in large Content Delivery Networks (CDNs). If a penetration tester uses a high-traffic, reputable CDN for C2, the organization's defense team may be unable to block the C2 traffic without also blocking legitimate business services that share the same CDN infrastructure. This creates a significant conflict between security needs and operational availability, which must be carefully managed during the engagement.

Answer

It will trigger an immediate alert on all EDR agents.

Answer

It is easily detectable by standard firewall port filtering.

Answer

It forces the malware to use a non-standard protocol.

Question 14

Why do many C2 frameworks include a 'sleep' command that can be configured by the operator?

Accepted Answer

To minimize the visibility of the C2 beacon.. The 'sleep' command allows an operator to control the frequency of beaconing manually. This is useful for balancing the need for responsiveness with the need for stealth. By increasing the sleep time, the operator makes the beacon less frequent, which reduces the chance of detection by network anomaly systems. This flexibility is a core feature of modern C2 suites, enabling operators to manage the trade-off between active engagement and operational security.

Answer

To allow the malware to clear its memory footprint.

Answer

To bypass the need for a persistent connection.

Answer

To prevent the target from shutting down the system.

Question 15

When evaluating the security of an organization's C2 detection capabilities, which log source is the most valuable for detecting DNS-based C2?

Accepted Answer

Centralized DNS query logs.. DNS query logs are the primary data source for identifying DNS-based C2. By analyzing these logs, security teams can identify anomalies such as high volumes of queries to a specific domain, unusual record types like TXT or NULL records, or domains with extremely high entropy. Without centralized DNS logging, detecting this specific type of C2 becomes nearly impossible, as the traffic occurs at the infrastructure level rather than the end-host level.

Answer

Endpoint system event logs.

Answer

Firewall traffic logs (Layer 4).

Answer

Antivirus detection logs.