3xpl01tc0d3r

Hello All, Performing Red Team assessments are becoming challenging day by day. In mature environments we see a lot of custom tool development and new techniques are getting discovered by the community to overcome various challenges. While thinking about such challenges, I came up with the idea of creating a tool that can leverage legitimate services for establishing command & control communication channel which is likely to be whitelisted or are less monitored due to the nature of services used by the corporate environments. This is not a new technique, we have already seen similar projects that were developed to leverage legitimate services for command & control. Communication channels such as Slackor for Slack C2, DaaC2 for Discord C2 or  Domain Fronting techniques etc. In this post I will introduce you to a tool called "Callidus" which I created to learn & to improve my knowledge about developing custom toolset in C# and learning how to leverage ...

Hello All, In this post we will cover how can we leverage GadgetToJScript for generating payload in various supported format such as HTA, JS, VBS & VBA(macro) which will execute our covenant grunt(Grunt is the implant for  Covenant  C2 framework). Wondering why are we using  GadgetToJScript  tool to generate  Covenant  payload in hta / js format wherein  Covenant  has default launcher to generate hta / js payload ? Covenant  uses  DotNetToJScript  for generating payloads in hta / js format which indeed doesn't work well with Windows 10 environment. We can see the note in the description field. DotNetToJScript  - A tool to generate a JScript which bootstraps an arbitrary .NET Assembly and class. GadgetToJScript  - A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS based scripts....

Hello All, Wondering where is the part IV of the process injection blog post series ? The part IV of this series was written by Renos  on  Parent PID Spoofing  technique. Parent PID Spoofing technique is useful for evading detection. In this post I will cover about Asynchronous Procedure Calls (APC) Queue Process Injection technique. Parent PID Spoofing can also be used with APC Queue Process Injection. The tool can be found on my github repo . What is Asynchronous Procedure Calls (APC) ? This is best described by Microsoft in their documentation . Below is the short brief about APC from the Microsoft Docs. An asynchronous procedure call (APC) is a function that executes asynchronously in the context of a particular thread. When an APC is queued to a thread, the system issues a software interrupt. The next time the thread is scheduled, it will run the APC function. An APC generated by the system is called a kernel-mode APC. An APC generated by an application i...

Hi Guys, It been long time since my last post. Recently I came across and amazing blog  post which made me forced to replicate the scenario in my lab. But I made additional changes in the lab where we can learn few more cool things. So let create a fictional story which will make us feel more excited. So lets assume we have got an assignment where we are suppose to perform an external Red Team assessment and our goal is to gain access on the domain controller. As this is a lab environment for demonstration, let's consider this 10.0.2.6 IP as an external IP system/address Step 1: Let scan the IP address on port 8080 for Apache tomcat Step 2: As we see we need an login credentials to access the tomcat manager. So lets try to brute force using Metasploit auxiliary module. Hurrah we got the credential for the tomcat manager tomcat:tomcat Step 3: Lets create a normal webshell and generate the war file for uploading it on tomcat. You can read this...

Hello All, Security landscape is changing very quickly wherein security researchers have to be more dynamic and innovative to improve the security posture of the organizations. In this post I will cover the concept on how we can develop a DLL with exported function in C#. Note:- I am not the first person to develop this tool or technique. Thanks to Nikhil Mittal for giving me the idea and encouraging me to develop and play with Exported DLL functions in C#. Also thanks to Adam Chester for writing an amazing blog post on this technique. What is DLL ? Dynamic Link Library (DLL) is a file which contains the code and is been loaded by the program to perform one or more actions during run time. Introduction DLL files are very commonly used during red teaming exercise or while simulating attacks / threat actors. There are multiple ways by which we can execute the arbitrary DLL's. LOLBAS project has documented most of those techniques which can also be used for bypassin...

Hello All, Finally I have got one contributor ( Renos ) who has added process hollowing technique to the Process Injection tool which I wrote for learning about various Process Injection techniques and to enhance my knowledge about C# and Windows API. In this post I will cover about the Process Hollowing technique. The tool can be found on my github repo . What is Process Hollowing ? Process hollowing occurs when a process is created in a suspended state and the executable section of the legitimate process in the memory is unmapped and replaced with malicious executable (Shellcode in our case). This technique allows an attacker to disguise his malware as a legitimate process and execute malicious code. As a result, attacker may evade defenses and endpoint detection. In this Process Hollowing technique 10 Windows API are used. ZwCreateSection - The ZwCreateSection function creates a section object that represents a section of memory that can be shared. A process c...