external_c2

简介 Cobalt Strike 包含一个名为 externalc2 的新 / 实验性功能。它绕过了可塑性配置（mallable profiles），并允许开发者自定义自己的通信通道。该代码是一个概念验证（POC），最终成为了解决实际问题的方案。 代码内容 c2file.c：一个 C 语言实现的客户端（与 Beacon 通信的进程） c2filedll.c, c2filedll.h, c2file.py：一个 Python 语言实现的客户端（使用 DLL，与 Beacon 通信的进程），便于快速开发复杂通道 pythonc2ex.py：与团队服务器 externalc2 插件通信的服务端...

ExternalC2

ExternalC2 A library for integrating communication channels with the Cobalt Strike External C2 server This library provides an implementation of the Cobalt Strike External C2 spec, including a basic web channel and a websocket channel. The codebase has been documented and designed to allow...

Black Hat 2021: Rapid7 Experts Share Key Day 2 Takeaways

Here we are again, back for another day of Rapid7 expert debriefings and analysis for some of the most talked-about Black Hat sessions of this year. So without further delay, let’s take it away! Get more DEF CON 2021 insights from our Research team on Tuesday, August 10 Sign up for our What...

Holy water: ongoing targeted water-holing attack in Asia

On December 4, 2019, we discovered watering hole websites that were compromised to selectively trigger a drive-by download attack with fake Adobe Flash update warnings. This campaign has been active since at least May 2019, and targets an Asian religious and ethnic group. The threat actor's...

SILENTTRINITY - A Post-Exploitation Agent Powered By Python, IronPython, C#/.NET

A post-exploitation agent powered by Python, IronPython, C/.NET. Requirements Server requires Python = 3.7 SILENTTRINITY C implant requires .NET = 4.5 How it works Notes .NET runtime support The implant needs .NET 4.5 or greater due to the IronPython DLLs being compiled against .NET 4.0, also the...

Threat Analysis: Carbon Black Threat Research Dissects PNG Dropper

UPDATE 8/14/17: After posting the original analysis, the Carbon Black Threat Research team received numerous requests for the tools to extract the second stage payload from the initial PNGdropper file. As a result, the source code and compiled binaries are being made public and are posted to the...