Show more

: day 32 : Moved C2 server vm from old hacktop to new hacktop. Updated the vm. Went looking for resources for aggressor scripts and C2 profiles. Near and intermediate planned exercises will use https, but the use of DNS is still looking too much like a dark art. I've got the pieces I can put together to do it, but I'm still fuzzy on how to put them together. It isn't urgent, so I'll block a couple of days down the road to lab it up.

: day 31 : Forgot to post yesterday. Pretty busy day. Got caught up on @thegrugq newsletters--I was a couple of days behind. Also read a recent Bellingcat newsletter and article. Octosuite looks interesting: bellingcat.com/resources/2023/ Might be useful for internal appsec and dfir teams, as well.

: day 30d : Pretty busy day, putting pressure on hacking for myself. Looked into "coding". Red Teamers have to code? I'm down with bash and fairly comfortable with python and PowerShell. After looking at CobaltStrike, I can kind of connect the dots. So, nim, .Net/C#, go, rust? I'm not diving into c/c++, looked at Kernighan and Ritchie ages ago and it didn't take. Thinking about .Net/C#, it is the "guts" of PowerShell and Windows.

ath0 boosted

: Put a filter hashtag and/or a warning on your rageposts and/or hide them behind that Sensitive Content blocky thing. I mean, well, unless you're fine with folks blocking you, which I know or have at least been assured some people do not mind at all. Coming in like it's time for a showdown at the OK Corral will set you apart quick, fast, and in a hurry, except of course on Reddit or Truth Social... or Tweetar these days. That will not be fun for anyone.

: day 29d : Bashed at new hacktop's wifi. Going in to work tomorrow, chance to isolate issue to laptop or my network and their interaction--other devices are behaving as expected. Watched a bit of @Alh4zR3d@twitter's N00bie Tuesday. Also found this site: zaproxy.org/docs/docker/webswi Which means I don't have to pollute the new hacktop w/Java! Another opp to get more touches w/#docker.

: day 28d : Doing some Attack Chain threat modeling. After getting a and playing with BadUSB, I've gotten my hands on a Rubber Duckie. Looking at I notice the only BadUSB references are in footnotes! I think it fits as either Hardware Additions or as a Phishing technique. What say you and , since it's not explicitly called out as a technique, do I infer this as "not likely"?

: day 27d : Took another look at the new release. Making some progress.

: day 26d : New release on , but it's not coming easily. Found a thing to help with enumeration, but I need to do some more reading on php to get to the next bit.

: day 25d : New hacktop from work today. Setting it up, trying stuff out. WSL is still sub-optimal. Gonna work on getting more facile w/Docker and Ubuntu's Multipass. Oh, something interesting... ...an EICAR dropped into a WSL image doesn't get flagged by Defender.

: day 24d: Today was research day. Attended a webinar on web hacking with some good links to resources. This one gave me a lot of good threads: github.com/dafthack/CloudPente Which is good, I've got some scope to nail down the next week or so, so this should help.

: day 23d : Confirmed pktmon was not going to be in-play for my objective tooling. Wireshark is in the software catalog, so explored ways to use sccm at the command line. Still have a ways to go. Was able to enumerate part of the software catalog, but a lot of it wasn't visible. Including wireshark--I think tshark is installed with it, so that's my goal.

: day 22d : Figured out my goof on 4800/4801. It's Lock/Unlock. Played around with schedtask to get a valid task on unlock. Took some experimentation, but got there. Got a good example exported as xml, so the next trick is writing a script to establish persistence after initial access. Concurrently I need to write the info gathering script(s).

Dunno if folks have been following the Institute for the Study of War (ISW) on the Russo-Ukranian war: understandingwar.org/backgroun They have daily updated maps. Along the northern half of the front, there are some probes getting close to some critical junctions. Wagner Group is also getting a bit of a smack down. Slava Ukraini!

ath0 boosted

If I were Santos’ publicist, I’d tell him to start ending every interview with “Yeah, that’s the ticket!”

: day 21d : Tinkered with schedtask and eventviewer. Exported a task set to go off of 4801 (Previous post said 4800, because another Windows 10 used this. So, gonna have to unpack that weirdness...) I imported it on another box, but no joy. Perms issue. Redid it in the context of the schedtask app and import worked, but stuck it in an unexpected location. Tried to run as system instead of my defined user... ...so, that's interesting. ...?

: day 20d : Worked on Jet fortress. Got another flag. More php tricks.

: day 19d : Worked on new release, investigation and managed to get user and root. I used to be strong in perl... ...it was in the last century, though! LOL.

ath0 boosted

: day 18d : Looked at MITRE ATT&CK technique T1547.001 (attack.mitre.org/techniques/T1) for more scoop on scheduled tasks and run keys. Poked at schedtsk and powershell commands for tasks. Not seeing how to use cli to set up a task triggering off of eventid 4800. I found this article, cyber.wtf/2022/06/01/windows-r, which suggests doing it manually on a lab box, export it, and then import via cli on the target. So, this will be something to lab up.

: day 17d : Poking around some more at . Scheduled Tasks is fun. Out of the box, users can do this. Should they in a business environment? Extra fun, via Scheduled Tasks or via Event Viewer, a task can be set up to trigger of Event IDs. Like event id 4800, which is when a user unlocks their workstation... Me likey.

Show more

ath0

CounterSocial is the first Social Network Platform to take a zero-tolerance stance to hostile nations, bot accounts and trolls who are weaponizing OUR social media platforms and freedoms to engage in influence operations against us. And we're here to counter it.