This year it happened. What started as a spare time hobby and fun project became a commercial product for the Offensive Security community. I founded a company,
@MSecOps
. And this company will sell a Packer to Red Teams or Pentesters. (1/x) 🔥
🔥 Introducing RustPack 🔥 . RustPack is an evasive Packer/Loader, that is capable of bypassing common AV/EDR vendors.
It accepts user-provided known malicious input payloads, such as shellcode, C# assemblies or portable executables (PE).
Those inputs are encrypted, and
Searching for DLL Sideloading binaries? A short Powershell Script in combination with Siofra will give you thousands of possible combinations.
Either try to replace any Windows DLL Import with your payload DLL or search for Phantom DLLs.
My team mate
@m_fielenbach
recently created a python script to automate the process of discovering and exploiting ESC1 & ESC8 ADCS vulnerabilities: 🙌
So if you want to save some minutes of time in your next projects feel free to test it out. 🔥
I really like DeepL for translations. But I also like the fact, that when using the Desktop APP is makes use of an signed executable named CreateDump.exe in %APPDATA%, which can dump e.g. LSASS 🧐🤩
Just added the two new AMSI bypass PoC's via Provider Patching into my Amsi-Bypass-Powershell repo. Plus one PoC in Nim as pull request for OffensiveNim:
Tested both, works perfectly fine. 👌
(1/2)
The last two weekends plus some evenings I spend my time writing a Nim Packer/Loader, which will be provided to Sponsors only via private repo. It's capable of packing C# Assemblies, Shellcode or PE-Files. (1/3)
Just updated Rubeus, Seatbelt, Certify, Invoke-Privesccheck in PowersharpPack and WinPwn. It was time again.
Also WinPwn now uses the C# Inveigh version with way more features enabled.👌
Bypass conditional access policies for Azure? Try changing the user agent to mobile devices. 🙈 didn’t know that one before today - one colleague found this 🙌
Today I built a custom Mimikatz Version with "only" the misc modules embedded (less AV signatures). Created a Invoke-Mimikatz like Powershell script for
@topotam77
's Petitpotam afterwards:
Easy in memory execution is possible now 🍻
Added to Amsi Bypass Powershell! :-)
Plus another one from
@cybersectroll
, wich uses reflection to update the ScanContent method with a self defined function.
ScriptBlock Smuggling is a new technique, developed by
@_Hubbl3
&
@Cx01N_
that allows that allows for the spoofing of PowerShell security logs & bypasses AMSI without the need for reflection or memory patching. Learn all about in our new blog post!
Didn't check the code yet, but looks like SilverPotato and CertifiedDCOM have a working public weaponized tool by now:
That's huge news from my perspective🔥
Today I needed to decrypt Veeam stored credentials. As existing toolings failed and/or manual decryption for a lot of passwords was too much effort I wrote a small assembly to do the whole job:
Sweet reminder. If you already compromised one inbox (OWA or O365) you can use Office Macro documents for internal phishing, as MOTW is not applied for internal E-Mails 😇
Super cool post from my teammate
@WolfieMcFly
about NetNTLMv1 Downgrade attacks! 🙌
Also includes the lesser known exploitation for any other vulnerable server/client via Silver Ticket instead of exploitation for DC's only 🔥🔥
Just finished the talk "Playing Chess as Red-Teams"
@MCTTP_Con
! 🔥 Time to release my PoC to avoid Kernel Callback / ETWti triggered memory scans for process injection - Caro-Kann:
Defender in memory scan -
Hasta la vista, baby! 🥳
DInvoke Syscalls to avoid hooking + Sleeps for the DLL imports. Both trigger a scan, so doing only one won´t help. Only needs an amsi.dll patch bypass before.
Let´s see how long this will last 😬
Just finished my very first PIC C-Project, which is Shellcode blocking any DLL, e.G. amsi.dll from being loaded in the process in which it's injected into. That took several days but I learned a lot and am proud about it 🥳🤓
No amsi.dll Patching, no Hardware Breakpoints.🔥
I'm proud, that the latest Packer release 2.1 now includes:
1) Module Stomping (remote&local)
2) ThreadlessInject
3) Caro-Kann
The combination of these three leads to no more alert for remote injection by (I guess) most EDRs. 🔥🤓
You want to check all Processes for an AV/EDR DLL not being loaded? Maybe a good process to inject into or force Load your implant into?
Maybe there are even exclusions for some Processes due to false positive rates?
Here's a Script for it:
Found an vhdx/vmdk/vhd file in a network share? Volumiser from
@_EthicalChaos_
gets you covered to exfiltrate e.G. SAM/SYSTEM to compromise the system via Administrator Pass-The-Hash:
Really easy and intuitive to use 👏
Last year we did analyse malware from a group targeting malware devs and or offensive security people. Here’s the story, which is also our first technical blog post - more to follow 🙌:
Hours of troubleshooting and some more evenings went into a Nim port of reflective PE loading. Learned a lot porting that one, special thanks to
@am0nsec
and
@_EthicalChaos_
for answering all my questions regarding to issues! 🤓
In addition NanoDump is now integrated into PowerSharpPack & WinPwn, Credit to
@s4ntiago_p
for the tool and hints for memory loading! Easy peasy LSASS dumping from memory. 🔥
Source code for the Assembly + instructions in the comments can be found here (1/2):
TokenManipulation got flagged by AV/EDR? Most public tools don't use Syscalls here. The last days I therefore ported SharpImpersonation (mainly) to Syscalls 🔥😎
Thanks to
@tiraniddo
and
@_EthicalChaos_
for helping me out.
This should cover detections!
I recently asked ChatGPT wheather it can provide me a Powershell Script to dump cleartext Credential-Manager Creds. It at some point hinted me to a Module named CredentialManager, which can do that in a very few lines of code:
Just made PowerSharpPack public:
Many offensive C# binaries now usable from within powershell.
If some important are missing just tell me and i´ll take a look at it.
NimGetSyscallStub is now public, the first public fully working (didn't find another myself) Nim imlementation + PoC to grab fresh Syscalls from disk on runtime:
@chvancooten
even with a yara rule (with your template 🤓)
I dont add Exploits to PowerSharppack but this exploit by
@exploitph
, automated by
@cube0x0
deserves to be easily exploitable from memory via Powershell so here is a gist for it:
Enjoy responsibly 👌
Wooho, just got local PTH for an interactive shell working! All other PTH tools can only be used for network auth. as far as I can tell. I used a modified Invoke-SMBExec from
@kevin_robertson
and a modified RoguePotato from
@splinter_code
and
@decoder_it
. Blog post will follow!
Pentest/Red-Team tip: Never trust in BH-Information if you didn't enumerate them with an administrative user. Session infos are not complete, Local Group information may be missing. Low priv users cannot enumerate that anymore for updated systems. 🧐
An relatively easy way to use stack encryption for your implant?
@SolomonSklash
‘s SleepyCrypt can easily be used from any language:
This for example is how to do it with Nim:
Can also be used for Nim C2 implants as Sleep 🔥😎
Fun fact: some AV/EDR vendors don’t inject their AMSI provider into Powershell.exe when it’s reflectively loaded.
So reflective Powershell.exe -> unprotected
At least I verified this for one vendor yesterday. Most likely this won’t apply to that many, but who knows. 🤷♂️
Reversing a legitimate signed binary to (ab)use it for process injection without alerts was a nice small project today with
@eversinc33
🙃Always good to have alternatives.
TokenManipulation got flagged by AV/EDR? Most public tools don't use Syscalls here. The last days I therefore ported SharpImpersonation (mainly) to Syscalls 🔥😎
Thanks to
@tiraniddo
and
@_EthicalChaos_
for helping me out.
This should cover detections!
Some more EDR Evasion and a PoC for another idea I had - this time to bypass kernel based (ETWti or Kernel Callback) shellcode detections - will be presented and released 🙂🔥
#mcttp
.
Blog post time: About some common reflective PE-Loading "problems" and ways to solve them on a high level / examples with
@itm4n
's PPlDump,
@s4ntiago_p
's nanodump and
@codewhitesec
's Handlekatz.
So Saturday 2 pm CET I’m gonna show my approach and tools for Powershell AV Evasion. The videos will be uploaded afterwards, so if you don’t find the time - no problem👌 let’s see how this goes 🤘
Wasn't able to add all my new stars yet but it's a lot for the moment. The same amount will follow in the next days, too many good new tools in the last 7 months.
I was tired of manually creating wordlists or having to rely on python for pre2k sprays, so did some small adjustments to
@dafthack
's DomainPasswordSpray to run pre2k password spraying on all computer objects of a domain.
I created this quick and dirty Powershell script to check your current system drivers against the awesome list from
@M_haggis
@_josehelps
@nas_bench
Hope you find it useful
Finallly. Got D/Invoke in Nim working 😎 Hell of an effort for me but I learned a lot about the PEB structure and the export of DLL functions without GetProcAddress 🔥
This will be made public in 1-2 months and is Sponsorware from today on. 🍻
WinPwn now checks all domain controllers of the current domain for zerologon - CVE-2020-1472 🥳
So easy to exploit and so many companies don´t patch. Forget one DC and the domain is compromised.
Just did a small video on how to find suitable targets for ThreadlessInject technique by
@_EthicalChaos_
- plus some recommendations on how to even improve it with Module Stomping && Caro-Kann:
Awesome talk by
@thefLinkk
for all those interested in malware dev 👏:
Plus the tool release Lastenzug/SpiderPIC, used that just today and it works like a charm. No socks module in your C2? This can be used as burnable standalone shellcode 🔥 really cool!
My DInvoke implementation in Nim is now also public:
Feel free with testing and have fun! 🍻👌
Challenge: who modifies the Nim compiler for DInvoke usage?🤓