Gui-poc-test

Gui-poc-test Uno strumento di test per CobaltStrike-RCE:CVE-2022-39197; Weblogic-RCE:CVE-2023-21839; MinIO:CVE-2023-28432 Strumento di rilevamento e sfruttamento delle vulnerabilità con interfaccia grafica per queste tre vulnerabilità. Avvertenze 1. Per eseguire il jar è necessario Java 8. 2...

SeeProxy

SeeProxy Proxy inverso in Golang con validazione del profilo malleabile CobaltStrike. La premessa di questo strumento è di non esporre il tuo teamserver al mondo ma a una singola istanza di SeeProxy. In questo modo ogni richiesta che raggiunge il tuo teamserver è traffico C2 legittimo. Esempio di...

MemFiles

MemFiles DICHIARAZIONE DI NON RESPONSABILITÀ: Questo progetto è complesso e se non si capisce come funziona e non lo si testa adeguatamente, si rischia di mandare in crash i Beacon e perdere l'accesso! Ti consiglio vivamente di leggere tutta la documentazione fino alla sezione "Dettagli tecnici,...

CoercedPotatoRDLL

Coerced Potato Reflective DLL Elevazione dei privilegi da NT Service a SYSTEM sfruttando il privilegio SeImpersonateToken e le funzioni MS-RPRN. Fortemente basato su https://github.com/Prepouce/CoercedPotato Reflective Loader da https://github.com/stephenfewer/ReflectiveDLLInjection. Installazion...

RedWarden

RedWarden - Redirector malleabile flessibile per CobaltStrike precedentemente noto come plugin malleableredirector di proxy2 Alziamo l'asticella nella resilienza IR dei redirector C2, che ne dite? Il settore del Red Teaming ha visto diverse differenti ottime idee su come combattere gli incident...

CVE-2022-23317

CobaltStrike =4.5 HTTPS listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL...

EUVD-2022-28399

Malicious code in bioql PyPI...

Exploit for Link Following in Microsoft

CVE-2023-36874 Windows Error Reporting LPE BOF Introductio...

Rheinmetall attacked by BlackBasta ransomware

On Friday May 19, 2023, the German arms producer Rheinmetall acknowledged a cyber-incident at one of its subsidiaries in the private sector. The BlackBasta ransomware group has already claimed responsibility for the attack through its leak-site. Entry for Rheinmetall on BlackBasta leak site...

Sandman - NTP Based Backdoor For Red Team Engagements In Hardened Networks

Sandman is a backdoor that is meant to work on hardened networks during red team engagements. Sandman works as a stager and leverages NTP a protocol to sync time & date to get and run an arbitrary shellcode from a pre-defined server. Since NTP is a protocol that is overlooked by many defenders...

TrickBot Gang Shifted its Focus on "Systematically" Targeting Ukraine

In what's being described as an "unprecedented" twist, the operators of the TrickBot malware have resorted to systematically targeting Ukraine since the onset of the war in late February 2022. The group is believed to have orchestrated at least six phishing campaigns aimed at targets that align...

NimPackt-v1 - Nim-based Assembly Packer And Shellcode Loader For Opsec And Profit

ByCas van Cooten @chvancooten With special thanks to Marcello Salvati @byt3bl33der and Fabian Mosch @S3cur3Th1sSh1t Description Update: NimPackt-v1 is among the worst code I have ever written I was just starting out learning Nim. Because of this, I started on a full rewrite of NimPackt, dubbed...

CobaltBus - Cobalt Strike External C2 Integration With Azure Servicebus, C2 Traffic Via Azure Servicebus

Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus Setup 1. Create an Azure Service Bus 2. Create a Shared access policy Connection string that can only Send and Listen 3. Edit the static connectionString variable in Beacon C projects to match the "Primar...

New UAC-0056 activity: There’s a Go Elephant in the room

This blog post was authored by Ankur Saini, Roberto Santos and Hossein Jazi. UAC-0056 also known as SaintBear, UNC2589 and TA471 is a cyber espionage actor that has been active since early 2021 and has mainly targeted Ukraine and Georgia. The group is known to have performed a wiper attack in...

CVE-2022-23317

CobaltStrike =4.5 HTTPS listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL...

Design/Logic Flaw

CobaltStrike =4.5 HTTPS listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL...

CVE-2022-23317

CVE-2022-23317 concerns the Cobalt Strike HTTP(S) listener. The root cause is that the listener fails to determine whether the request URL begins with a “/”, allowing an attacker to obtain information by crafting the URL. Affected: Cobalt Strike versions

CVE-2022-23317

CobaltStrike =4.5 HTTPS listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL...

SAS 2021: Learning to ChaCha with APT41

Straight from the sunny UK to the stage of SAS-at-Home 2021, John Southworth PwC will be giving some insights about the threat actor APT41, also known as Red Kelpie and Winnti. Starting with APT10 Red Apollo, the presentation will dance you through the malware used by APT41 – the Motnug loader an...

CobaltStrikeParser - Python parser for CobaltStrike Beacon's configuration

Python parser for CobaltStrike Beacon's configuration Description Use parsebeaconconfig.py for stageless beacons, memory dumps or C2 urls with metasploit compatibility mode default true. Many stageless beacons are PEs where the beacon code itself is stored in the .data section and xored with 4-by...