Closed security lab

Small C2 learning project

I built a small Python-based command-and-control lab because I wanted to understand what is happening underneath a C2 framework instead of only learning how to operate an existing tool.

Scope

This project stayed inside a closed homelab. The point was to understand the basic architecture and the traffic patterns, not to build something for use against systems I do not own.

What I modeled

The project kept the design intentionally simple: test clients checked in to a server, the server kept track of endpoint state, and a small operator-side interface could view those systems and basic tasking.

Implementation

A Raspberry Pi hosted the Linux/Python backend and local data. I used a basic command-line interface for the operator side so I could focus on how the check-ins, state, and tasking worked rather than spending most of the project on a front end.

Python C2 server script in the homelab
Part of the Python server implementation used in the closed lab.
C2 listener waiting for a test beacon
Listening for a test beacon inside the lab.
SSH access to the lab C2 host
Managing the Raspberry Pi host over SSH.

Why I built it

Building the pieces myself made concepts such as beacon timing, endpoint registration, tasking, and server-side state much easier to understand. Those same concepts matter when looking at C2 traffic from the defensive side, which is one reason I still find the project useful.