PortBender

개요 PortBender는 TCP 포트 리디렉션 유틸리티로서, 레드팀 운영자가 하나의 TCP 포트예: 445/TCP로 들어오는 트래픽을 다른 TCP 포트예: 8445/TCP로 리디렉션할 수 있도록 해줍니다. PortBender는 운영자가 Cobalt Strike와 도구를 통합할 수 있도록 하는 어그레서 스크립트를 포함합니다. 그러나 이 도구는 리플렉티브 DLL로 구현되어 있기 때문에 "ReflectiveLoader" 인터페이스1를 통해 모듈을 로드하는 모든 C2 프레임워크와 통합될 수 있습니다. 또한 이 도구는 운영자가 Duq...

SharpRelay

사용법 이 공격이 작동하기 위한 유일한 요구사항은 로컬 관리자 권한이 있거나 드라이버를 로드할 수 있는 비콘beacon을 보유하는 것입니다. SharpRelay를 사용한 공격은 다음과 같이 작동합니다: 서명된 WinDivert 드라이버를 손상된 호스트의 임의 폴더에 업로드합니다 SharpRelay를 실행하여 포트 445로 들어오는 패킷의 대상 포트를 수정하고 다른 포트예: 8445로 리디렉션합니다 비콘에서 Cobalt Strike의 rportfwd 명령을 실행하여 손상된 호스트의 포트 8445를 팀서버의 포트 445로 전달합니...

redsails

Redsails 소개 다음 기능을 갖춘 사후 침투 도구: 피해 머신에서 지속성 유지 다수의 일반적인 호스트 이벤트 로그네트워크 및 계정 로그인 모두 우회 거짓 로그/네트워크 트래픽 생성 다음에 기반: PyDivert https://github.com/ffalcinelli/pydivert. 이는 WinDivert를 위한 Python 바인딩으로, Windows 네트워크 스택으로/로부터 전송되는 네트워크 패킷을 캡처/수정/드롭할 수 있도록 사용자 모드 애플리케이션을 허용하는 Windows 드라이버입니다. Vista 및 Windows...

EDRPrison

EDRPrison 共著者: @oops4githttps://github.com/oops4git EDRPrison は、正規の WFP コールアウトドライバである WinDivert を活用して、EDR システムを効果的に沈黙させます。Shutter、FireBlock、EDRSilencer などのツールから着想を得ており、このプロジェクトはネットワークベースの回避技術に焦点を当てています。先行ツールとは異なり、EDRPrison は組み込みの WFP のみに依存するのではなく、外部の正規 WFP コールアウトドライバをインストールして読み込みます。さらに、EDR...

Experts Discover Backdoor Deployed on the U.S. Federal Agency's Network

A U.S. federal government commission associated with international rights has been targeted by a backdoor that reportedly compromised its internal network in what the researchers described as a "classic APT-type operation." "This attack could have given total visibility of the network and complet...

PortBender - TCP Port Redirection Utility

PortBender is a TCP port redirection utility that allows a red team operator to redirect inbound traffic destined for one TCP port e.g., 445/TCP to another TCP port e.g., 8445/TCP. PortBender includes an aggressor script that operators can leverage to integrate the tool with Cobalt Strike. Howeve...

Divergent: "Fileless" NodeJS Malware Burrows Deep Within the Host

Update 09/27/2019: Additional information regarding the malware interaction with various online advertisements has been included to highlight the click-fraud related network communications associated with Divergent. Executive summary Cisco Talos recently discovered a new malware loader being used...

Microsoft Warns of a New Rare Fileless Malware Hijacking Windows Computers

Watch out Windows users! There's a new strain of malware making rounds on the Internet that has already infected thousands of computers worldwide and most likely, your antivirus program would not be able to detect it. Why? That's because, first, it's an advanced fileless malware and second, it...

Thousands of PCs Affected by Nodersok/Divergent Malware

New malware identified by Microsoft and Cisco Talos has affected thousands of PCs in the United States and Europe and turns systems into proxies for performing malicious activity, the companies said. The fileless threat—called Nodersok by Microsoft and Divergent by Cisco Talos—has many of its own...

Bring your own LOLBin: Multi-stage, fileless Nodersok campaign delivers rare Node.js-based malware

We’ve discussed the challenges that fileless threats pose in security, and how Microsoft Defender Advanced Threat Protection Microsoft Defender ATP employs advanced strategies to defeat these sophisticated threats. Part of the slyness of fileless malware is their use of living-off-the-land...

New FakeNet-NG Feature: Content-Based Protocol Detection

I Matthew Haigh recently contributed to FLARE’s FakeNet-NG network simulator by adding content-based protocol detection and configuration. This feature is useful for analyzing malware that uses a protocol over a non-standard port; for example, HTTP over port 81. The new feature also detects and...

TorWall - Transparent Tor for Windows

Tallow is a small program that redirects all outbound traffic from a Windows machine via the Tor anonymity network. Any traffic that cannot be handled by Tor, e.g. UDP, is blocked. Tallow also intercepts and handles DNS requests preventing potential leaks. Tallow has several applications,...

Windows Packet Divert: WinDivert

Windows Packet Divert WinDivert is a user-mode packet capture-and-divert package for Windows Vista, Windows 2008, Windows 7, Windows 8 and Windows 10. WinDivert allows usermode programs to capture/modify/drop network packets sent to/from the Windows network stack. In summary, WinDivert can captur...