A collection of projects

Skip to main content

Search This Blog

Home

Showing posts from May, 2022

View all

Posts

Hiding In Alternate Data Streams

on May 05, 2022

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Covenant In 2022

Intro What great timing, s3cur3th1ssh1t just made a post on stageless vs staged Grunts in Covenant . Check it out! A quick background before diving in. What is Covenant? Covenant is one of the easiest post exploitation frameworks to spin up. It uses .NET, which is a just-in-time compiled language, to generate "grunts" that connect back to the C2 in order to receive commands. The commands can be received either through PUSH or PULL methods depending on how you want the network traffic to look and the traffic can be further obfuscated through header modification, among other methods, by playing with different profiles. Covenant makes it simple to change almost every aspect of how commands are fetched. In this write up though, we will focus primarily on customizing our grunt delivery. How Do The Grunts Hold Up? Generating simple grunts with Covenant out of the box is quick and modification of their underlying code is fairly easy. There are a few Python scripts to obfusc

Lessons In C2 From The CIA

Intro I've always wanted to make my own C2 framework but have never really found the inspiration to, until I came across a post from Byt3bl33d3r talking about modernizing the CIA's C2 framework . This was somehow the first time I had come across a paper regarding Switchblade and Hive and I wanted to try and set up a mock version for myself. A Quick Review Of mTLS Before getting into the gritty details of this, let's review/introduce mTLS. mTLS stands for mutual authentication TLS. This is often implemented in zero-trust environments so that the client knows the server is who they say they are and vice-versa. Where a server normally only presents its certificate to connecting clients and then completes connections, mTLS adds the extra step of the client presenting their certificate so that the server can then verify them. The CIA developed Switchblade to use mTLS to authenticate beacon requests to the C2 server and send everyone else to a fake cover site. It can be seen in t

Hiding In Alternate Data Streams

While reading Gray Hat Python, I came across another interesting tactic of hiding files in what's known as alternate data streams. I had previously seen this used by Microsoft to tag files downloaded from the internet with MOTW in the Zone.Identifier so that macros don't execute, and I've seen it used to hide simple txt files inside of another. Gray Hat Python though was using an ADS to hide a full on executable. This seemed like a nifty way to bypass detection since it didn't change the file hash but I had trouble maintaining the ADS when copying the file to another victim machine. This is a common issue. The workaround that I came up with was to convert the executable that I want to hide into bytecode, serve it on a simple HTTP server, then have the victim machine write the code to disk in an invalid format to evade detection before moving it into an ADS. I found a handy tip on Stackoverflow to do just this. First up, on our C2, we must get the bytes c

Labels

c2
container
docker
graphana
jira
nessus
nuages

Report Abuse

Powered by Blogger