Automating C2 Infrastructure with Terraform, Nebula, Caddy and Cobalt Strike This guide demonstra

Automating C2 Infrastructure with Terraform, Nebula, Caddy and Cobalt Strike

This document outlines how to automate the deployment of a complete Command-and-Control (C2) infrastructure using Terraform, Nebula, Caddy, and Cobalt Strike. The objective is to achieve rapid, repeatable, and resilient infrastructure deployment for red team operations.

---

Overview

The automation covers:

• Cloud virtual machine provisioning

• DNS configuration

• Encrypted overlay networking

• HTTPS reverse proxy

• Cobalt Strike team server deployment

• Secure operator access

This setup enables fast infrastructure spin-up and teardown with minimal manual effort.

---

Prerequisites

• Linux system (Kali Linux recommended)

• Terraform installed

• Python 3 installed

• Cloud provider account (e.g., Linode)

• Domain name

• Valid Cobalt Strike license

---

Project Structure

src/
├── config/
│   └── network.yaml
├── templates/
│   ├── certificates/
│   ├── configs/
│   │   ├── nebula/
│   │   └── web/
│   ├── files/
│   └── keys/

---

Terraform Setup

Download and install Terraform:

wget https://releases.hashicorp.com/terraform/1.2.9/terraform_1.2.9_linux_amd64.zip
unzip terraform_1.2.9_linux_amd64.zip
sudo mv terraform /usr/local/bin/
terraform version

Initialize and manage infrastructure:

terraform init
terraform apply
terraform destroy

---

Terraform Templates

Core Terraform files used:

• providers.tf

• variables.tf

• security.tf

• dns.tf

• lighthouse.tf

• team-server.tf

• edge-redirectors.tf

• internal-redirectors.tf

• output.tf

---

DNS Configuration

Terraform automatically manages DNS records for HTTPS and DNS-based C2 traffic.

---

Nebula Overlay Network

Nebula creates an encrypted overlay network between all infrastructure components.

Nodes include Lighthouse, Team Server, Redirectors, and Operator.

---

Caddy HTTPS Setup

Caddy is used as a reverse proxy with automatic TLS using ACME.

---

Cobalt Strike Setup

Convert TLS certificates:

openssl pkcs12 -inkey domain.key -in domain.crt -export -out acme.pkcs12 -passout pass:password

Convert to Java Keystore:

keytool -importkeystore -srckeystore acme.pkcs12 -destkeystore cobaltstrike.store -deststorepass password

Start the team server:

./teamserver 192.168.100.10 password profile.profile

---

Python Wrapper

Install dependencies:

pip install pyyaml python-terraform

Example configuration:

linode_api_key: YOUR_API_KEY
domain: your-domain.com

---

Summary

Automating C2 infrastructure ensures consistency, speed, and improved operational security for red team engagements.