19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
Key Takeaways
- C2 frameworks are a category, not a branded recipe: agents beacon to a team server, jitter randomizes sleep, and HTTPS often hides the channel in web traffic — C2 is command tasking, not 5.3 exfiltration.
- A web shell is a command page on a web server that persists over HTTP as the application identity; 4.5 was how it was planted, 5.1 is why it remains after the first shell dies.
- A Trojan is malware disguised as legitimate software on an endpoint; a rootkit conceals files, processes, or sockets at user mode or kernel mode and is high-risk, often out of RoE.
- Browser extensions persist inside a user browser profile on workstations — cookie and SSO stay — and are not server-side web shells.
- Tampering with security controls (disable logging, AV, or EDR) is high-risk and often forbidden because it fail-closes or pages the SOC; document every implant so 5.4 can remove it.
The rest of PT0-003 5.1 is how testers keep a channel and hide that they did: command-and-control (C2) frameworks, backdoors (web shells and Trojans), rootkits, browser extensions, and tampering with security controls. Domain 5 is still 14 percent. 19.1 covered tasks, services, accounts, shells, and Run keys. This section is the framework and concealment half. CompTIA wants categories and risks, not implant source code. Nothing here is a build tutorial.
Persistence of this kind is still RoE-gated and still a 5.4 removal problem. A C2 beacon you cannot list is a leftover implant. A disabled EDR agent you cannot re-enable is an outage. If the statement of work forbids tampering or kernel work, you do not do it to be thorough.
C2 frameworks as a category
C2 frameworks are platforms that keep a control channel to compromised hosts: a team server the tester holds, and agents or beacons on targets that check in. CompTIA lists them as a category, not as a branded recipe. You should recognize the behaviors, not ship a profile.
Beaconing is periodic check-in. The host sleeps, wakes, asks the team server whether there is work, then sleeps again. Defenders hunt regular beacons — every 60 seconds to the same host is a square wave.
Jitter randomizes the sleep so the interval is not a perfect metronome. A 60-second beacon with 20 percent jitter is harder to spot with a simple every-60-seconds detector. Exam trap: jitter as encryption. Jitter is timing. Encryption is a different control.
HTTPS (and HTTP) C2 hides the channel in web traffic: port 443, TLS, a domain that looks like a content delivery network or software-as-a-service site. DNS or raw TCP C2 exists in the wild; the exam picture for looks-like-browsing is HTTPS. When you pick C2: the stem is a long-lived callback channel, multiple hosts, tasking from a team server, or beacon with jitter over 443. When you do not: a one-off reverse shell you will not reuse (19.1 shells), or a static web shell you browse by hand (backdoor). Exam trap: naming a specific commercial implant as the only 5.1 answer. The bullet is the category. Trap two: calling C2 exfiltration. 5.3 is how data leaves (staging, covert channels). C2 is how commands arrive and small results return. They can share HTTPS; the job differs.
C2 still needs an allowed redirector and an in-scope target list. Beaconing the payroll VLAN because the framework's default profile includes it is an RoE break. Record the team-server URI, the redirector, the beacon interval, and the host list so 5.4 can pull the agents.
Backdoors: web shell versus Trojan
A backdoor is a hidden way back in. CompTIA names two: web shell and Trojan.
A web shell is a command page on a web server — PHP, ASPX, JSP, or similar — that runs OS commands or database queries when the tester requests it. Objective 4.5 was how file inclusion or upload planted that page. 5.1 is why it is persistence: after the first shell dies, https://intranet.example.com/uploads/help.aspx still executes as the application-pool identity. It lives in the web root or an upload directory. When you pick it: the foothold is an application server, the artifact is a page, and access is over HTTP(S) with a browser or Burp Suite. When you do not: a workstation with no web server (look at tasks, Run keys, or a Trojan), or a kernel hide (rootkit). Exam trap: scoring every web shell as 4.5 on a post-exploit stem. If the question is how the tester returns next week, it is 5.1 persistence. Trap two: calling a web shell a reverse shell. A web shell is inbound HTTP to the app. A reverse shell is outbound from the host.
A Trojan is a program that looks legitimate — an updater, a PDF reader, a VPN client — and also gives the tester control. Users or software-deployment tools run it. Persistence is then the Trojan's own autostart (service, Run key, scheduled task) plus the disguise. When you pick it: endpoint users, a dropped legitimate-looking binary, a social or software-delivery path. When you do not: a command page on IIS or Apache (web shell), or a kernel module that hides processes (rootkit). Exam trap: Trojan equals rootkit. Trojans deceive the user. Rootkits hide from the OS.
Rootkits
A rootkit conceals presence at user mode or kernel mode. User-mode rootkits hook libraries so ps, Task Manager, or netstat omit the tester's process. Kernel rootkits run with ring-0 (or equivalent) rights and can hide files, processes, and sockets from everyone, including many security tools. When you pick it: the stem is hiding artifacts, not merely relaunching a callback; especially if kernel, boot, or nothing-shows-in-Task-Manager is on the page. When you do not: a visible scheduled task, a web shell you can request by URL, or a browser extension.
Rootkits are high-impact and high-risk. They can destabilize the host, break endpoint detection and response (EDR), and be ugly to reverse in 5.4. Many RoE forbid kernel implants on production. Conceptual identification only — this guide will not describe how to write one. Exam trap: answering rootkit for every hide stem. Process hollowing (4.4) hides code in a process name. A rootkit hides the process from inventory. Trap two: treating a rootkit as a C2 framework. C2 is the channel. A rootkit is the concealment layer.
Browser extensions
Browser extensions persist on user endpoints inside Chrome, Edge, or Firefox profiles. A malicious or tester-controlled extension can read pages, steal cookies or passwords, inject scripts, and survive as long as the browser profile does — including roaming profiles. They do not need SYSTEM. They need the user's browser. When you pick it: knowledge workers, single sign-on in the browser, cookie theft that should outlive a tab, or persist on the workstation without a new Windows service. When you do not: servers without interactive browsers, or kernel hiding.
Exam trap: calling a browser extension a web shell. The web shell lives on the server. The extension lives in the client browser. Trap two: treating extensions as 4.8 phishing only. Phishing may deliver the extension; 5.1 is why it stays. Record the extension ID and the browser profile path so 5.4 can remove it.
Tampering with security controls
Tampering with security controls means disabling or weakening the things that would catch the rest of 5.1: turning off antivirus or EDR, stopping the event log service, clearing audit policy, unloading Sysmon, or adding exclusions so the beacon is ignored. Objective 4.4 already named circumventing security tools during a host attack. 5.1 is the persistence-flavored version: you tamper so you can stay, not only so one dump succeeds.
This bullet is high-risk and often forbidden. Many statements of work want you to prove that EDR would have seen the scheduled task, not to kill EDR. Tampering fail-closes: the host loses the session, a watchdog reinstalls the agent and pages the security operations center (SOC), or you leave the estate undefended after you go home. When you pick it: the stem explicitly allows disabling a named control, or asks you to identify the risk of doing so. When you do not: RoE is silent or forbids it — document the detection gap instead. Exam trap: always disable Defender first so persistence works. That is a lab habit, not the PT0-003 default. Trap two: answering 5.4 whenever logs are mentioned. Clearing logs during the test to hide a beacon is tampering (and overlaps 4.4 log tampering). Restoring logging at the end is 5.4.
Always leave a removal map
C2 listeners, web shells, Trojan autostarts, rootkit modules, browser extensions, and any allowed control change belong in the same engagement log as 19.1 tasks. Objective 5.4 will remove persistence mechanisms, revert configuration changes, remove tester-created credentials, and restore security tools. If you cannot name the team-server URI, the web-shell path, the extension ID, and whether EDR was stopped, you cannot clean example.com.
| 5.1 item | What it is | Typical home | Pick when | Exam trap |
|---|---|---|---|---|
| C2 framework | Team server plus beaconing agents | Channel, often HTTPS with jitter | Long-lived tasking, not a one-off shell | C2 as 5.3 exfil; jitter as encryption |
| Web shell | Command page on a web app | Server web root or uploads | Return via HTTP as the app-pool identity | Scoring it only as 4.5 after the plant |
| Trojan | Malware disguised as legitimate software | User-run endpoint binary | Deception plus autostart | Trojan equals rootkit |
| Rootkit | User- or kernel-mode concealment | OS internals | Hide processes or files from inventory | Rootkit as C2; hollowing as rootkit |
| Browser extension | Persistence in the browser profile | User endpoint | Cookie or SSO stay on a workstation | Extension as a server web shell |
| Tamper security controls | Disable logging, AV, or EDR | Host security stack | Only if RoE allows; often forbidden | Always-disable-Defender as the 5.1 default |
Worked example.com
The tester already has j.smith on WS-042 and a web foothold on intranet.example.com. RoE allows user-level persistence and a documented web shell; it forbids kernel rootkits and forbids disabling EDR. The durable channel is a C2 beacon over HTTPS with jitter, launched from the 19.1 logon task — not a bind shell through NAT. The intranet box keeps a web shell in the authorized upload path, not a Trojan posed as chrome.exe. No rootkit. A browser extension is in play only if the stem shifts to cookie-replay from the user's Chrome profile. EDR stays up; the finding is that the beacon was or was not seen. Everything is named so 5.4 can pull the task, the page, the extension, and the team-server redirector.
The tester needs a long-lived tasking channel to several hosts. Callbacks should look like web traffic and should not arrive on a perfect 60-second metronome. Which 5.1 category match is that?
The tester planted a PHP page under an intranet upload folder and can still run commands as the app pool by requesting that URL after the first reverse shell died. Which 5.1 backdoor is that, and what is it not?
RoE for example.com allows user-level persistence and a documented web shell but is silent on disabling EDR. The tester wants the beacon to survive. What is exam-correct about tampering with security controls?