Black Hat is around the corner, and that can only mean one thing: NimPlant v1.4! This version introduces a fully-featured Rust implant and much more.
Catch me yapping about it on Wednesday, August 7 (1:55pm-3:10pm) at Arsenal Station 4!
Release here:
Want to crack some hashes but your VM is too slow? Here's a cool tip: you can (ab)use Google's Colaboratory to spin up two beefy graphics cards to do the cracking for you. It's free, and works really well! Get started here:
Everyone likes a good hacking story right? I have just the thing for you. Let me tell you about that time I โaccidentallyโ hacked a four-story display next to one of the biggest highways in the Netherlands ๐
๐งต
In light of my upcoming OSEP exam I've given my AD cheat sheet some of the care it deserves! Added more content and commands, brushed up existing content. Improved:
- AD delegation
- Lateral movement with MSSQL
- LAPS
- Inter-forest exploitation
- More!
๐
After almost 2 years of working on NimPlant as a personal side project, Iโm proud to release it to the public! NimPlant is a light-weight, first-stage C2 implant written in Nim, with a supporting Python server and Next.JS web GUI.
Available here now! ๐
Kicked off my "MalDev for Dummies" workshop successfully yesterday, which means the repo is now public! Slides, exercises, example code and resources to get you started on your malware development journey. C# and Nim supported for now. Enjoy!!
You all know about `ssh -D [port]` opening up a SOCKS proxy, but did you know that `ssh -R [port]` opens up a reverse socks proxy on the target? I sure didn't ๐คฏ
Disclaimerยฒ: Normally I wouldn't share such vulns before the vendor has had a chance to mitigate. However, I chose differently in this case because
1) The issue is already very widespread
2) I likely wasn't the first one to tell Apple
3) It's a prime example of how deep this goes
Got sidetracked by a fun little Terraform + Ansible project which I dubbed 'CloudLabs AD'. It provisions a small AD lab in the cloud that has some dummy data to play with and is enrolled in Elastic Endpoint Security.
Just open sourced it here ๐
You know what time it is? โฐIt's Active Directory o'clock! I updated my AD Exploitation Cheat Sheet based on (among others) techniques discussed in the CRTO course.
New: DPAPI & GPO Abuse
Improved: LAPS, AppLocker/CLM, PowerView/Rubeus refs, many more
๐
Figured it was high time for another update to my AD cheat sheet! Pushed some new techniques, and made changes to the Defender evasion, RBCD, Domain Enumeration, Rubeus, and Mimikatz sections as well as fixing some whoopsies ๐
Just published a quick and dirty Python script to replicate the full 'Follina' Office RCE vulnerability for (local) testing on Github. Not suitable for production use, but should help in quickly identifying exposure.
Disclaimer: I'm fairly sure I'm not the first one to have tried this but I flagged it with Apple's product security team either way. I'm sure they are busy enough patching their systems ๐
Operating in an environment with strict applocker rules, but Python is whitelisted? You can use Python to bypass applocker, or even AV/EDR ๐
Here's a nice and simple way to execute an unmanaged DLL file by calling its entrypoint. Code will execute inside of 'python.exe'.
Today I am open souring NimPackt-v1, the first version of my Nim-based packer and shellcode loader. It's old and the code is ugly, but it still works well. I think it also shows how versatile Nim can be. Enjoy!
(To my blue friends: Yara rule included ๐ต๏ธโโ๏ธ)
Operating from a restricted environment without outbound connectivity? Venom allows for port reuse and even works on Windows (to my surprise). Now you can set up a SOCKS proxy without disturbing the original service!
Check it out ๐
Found a Gitlab instance on a penetration test or red teaming engagement? If the version is <12.9.1, chances are you can get (unauthenticated) RCE by chaining some under-the-radar vulnerabilities! Info in thread ๐
#infosec
#redteam
#bugbountytips
#hacking
#gitlab
When discussing ADCS attacks, particularly ESC8, most go straight for the DC$ account. If you can for some reason not coerce machine auth, targeting users may be just as profitable!
1. Run responder to poison your way to some hashes
2. Relay to ADCS & grab user cert
3. Profit!
They took my report very well, they were very intrigued about what had happened and interested in learning more about the potential fix (and how they can prevent similar issues in the future).
So a great story, and made the world a bit more secure as a result ๐ฏ
/fin
Back at having fun with Nim! Started a full rewrite of NimPackt, a versatile and AV/EDR safe packer and shellcode loader. Starting from scratch gave me a lot of flexibility to roll out shiny new techniques ๐
I published a technical blog post about using Nim for offensive tooling, focusing on my Nimplant project. It includes many lessons learnt and tips & tricks. The blog setup is quite different than what I'm used to writing, so let me know if you like it!
I finally got around to polishing my Windows / Active Directory exploitation cheat sheet & command reference! It's in no way an exhaustive list, but it should hopefully be a useful resource (especially for CRTP/CRTE)!
Additions very welcome.
In preparation of my
@x33fcon
workshop and by popular demand I have added the Rust language to my 'MalDev for Dummies' workshop! ๐ฆ
Having played with Rust a fair bit now, I included some thoughts in this thread ๐งต
Check it out ๐
As promised, I just uploaded my first blog post of 2021: A course review of the PEN-300 course and OSEP certification by
@offsectraining
!
Find the blog post below, and let me know what you think!
Last November, colleagues organized a meeting that would be the start of my obsession with hacking. Since then, I've completed >90 HTB machines, completed Offshore, attained my OSCP, CRTP, CRTE, published a HTB machine, and joined the red team. Have to say it was a good year! :)
Spent some time last week on something entirely different - frontend development! Created a new interface for Nimplant from scratch to teach myself the ropes of Next.JS and Typescript. Not gonna lie, pretty proud of what I achieved in a week (GIF below ๐)
@notshenetworks
That's a pretty deep rabbit hole but something like covers a lot of them. If you want something a bit more straightforward my own cheat sheet may be helpful:
Bruh, Sliver's SOCKS5-over-WireGuard proxy is so performant that I was just able to get a leaderboard spot on via an RDP session tunneled over my implant. This is sick ๐ฅ
.
@Wietze
rocking it on stage and launching , a community-driven project that maintains a repository of binaries vulnerable to variety of different DLL hijacks ๐ฅ
2021 was another crazy year! I did some cool certs (OSEP, CRTO, PACES), presented at a con, built cool tools, even made the news with some dumb security "research".
Here's to 2022 bringing more cool challenges! Starting with my new job as red teamer
@ABNAMRO
per the 1st of Jan ๐ฅณ
Playing with Elastic Security a bit and it's pretty dope. A lot of nice rules to play with out of the box ๐คค
Would love to provision it in my labs with Ansible but automating the installation in a headless fashion is gonna be a pain lol
As promised - here's my blog post on the excellent "Red Team Ops" course and CRTO certification by
@_RastaMouse
/
@zeropointsecltd
. Hopefully helpful for people interested in taking these course, it comes recommended for sure! See why inside ๐
Yay! Passed the 2k with the help of some awesome folks (you know who you are! ๐).
As promised it's time to celebrate, so I will be giving away a 1mo HTB VIP+ subscription (courtesy of the ๐ฏ folks at
@hackthebox_yow
), AND a 1mo TryHackMe voucher! Like this tweet to participate!
CRTO II is in the pocket! For sure a fun course with some pragmatic and actionable insights for more advanced red team operations. Can't say I was a big fan of the restricted exam environment with browser access and slow machines, but the exam had some fun challenges nonetheless!
My second Github repo to (almost) hit 1k stars โจ Awesome to see community contributions get so much positive response!
Give it a looksie if you're interested in malware dev in Nim, Go, or C#, but don't know where to start! ๐
Since people seem to have (re-)discovered Bring-your-own-Python, here's what happens if you embed Python + Impacket within a Rust binary. It works, but turns out almost as thicc as a Go binary (73MB ๐คค) lol. Feasible? You be the judge ๐
Just shut down my laptop, and won't turn it back on again until December! Will be leaving on a three-month trip in Southeast Asia with my girlfriend.
That also means you won't hear much from me - look forward to catching up with y'all's great research when I get back tho! Ciao ๐
When you're re-watching
@Flangvik
's PoshC2 stream and he suddenly uses your site as a reference ๐
P.S. You didn't completely bork the pronunciation ๐คฃ
What do we say to the Gods of dependency issues? Docker!
I published a Docker image to conveniently compile all my Nim-based tools without installation or dependency issues. Updated the readme of NimPackt-v1 to include this compilation method as well!
Not ashamed to admit that
@nikhil_mitt
whooped my ass with some of these pivots, but at least I'm now getting somewhere with the GCB labs! Much much more to go :D
I published my notable OSEP code on Github. It's nothing too fancy, mostly what the course discusses with some extra polishing and functionality here and there :). Perhaps it's helpful to someone!
(Note: Spoilers inside if you want to follow the OSEP ๐)
Pushed a pretty cool update to my BugBountyScanner. It now supports multiple domains, uses
@pdnuclei
to scan for known vulns/misconfigs, queries the Wayback Machine, and identifies interesting URL params. Includes a helper for BurpSuite too!
#BugBountyTips
My first response was thinking โwow, really irresponsible of them to put up an ad this bright in the middle of the nightโ. Then I got a better look, and I damn near ran my car off the road when I realized that right there, four stories tall, was the SIGN I POSTED JUST THEN ๐คฏ
๐ณ๐ฑ Als 'expert' meedoen aan Het Klokhuis is toch wel een soort kinderdroom die in vervulling gaat ๐ค. Trots op het resultaat, een mooie focus op het ethische deel van ethisch hacken! En "legend van de dag" kan ik in m'n zak steken ๐
Elk systeem kan gehackt worden. Ethische hackers helpen een bedrijf om zichzelf beter te beveiligen. Janouk gaat mee met ethisch hacker Cas, die een school gaat hacken om te laten zien hoe dit in zijn werk gaat. De Boze man ontmoet twee ethische hackers.
That's a wrap! Happy to have been invited to present Nimplant (and its new Rust version ๐ฆ) at Black Hat Arsenal. The slides are available here, hopefully I can share the video version soon for those who missed it!
I'm back! ๐ฅณ
After three fantastic months of travelling Southeast Asia (Indonesia, Philippines, Vietnam & Thailand), I am now back on my regular bullshit (F's in the chat). Look forward to catching up on the cool stuff you folks have been doing in the meantime!
Got confirmation this morning that I am now officially a Certified Red Team Professional! ๐
To celebrate, a new blog for anyone interested in pursuing CRTP.
"Getting the CRTP Certification: โAttacking and Defending Active Directoryโ Course Review"
@shivangx01b
@D0rkerDevil
Sounds like you're doing something awfully similar to BugBountyScanner (), feel free to contribute if you have cool additions!
Something about Crowdstrike being a pain in the behind about people testing with their product combined with their engineers freely snooping on dev machines of their clients doesn't sit right with me ๐ค
I'm all for transparency but it isn't a one-way street
It's so great to see
@ippsec
, who for a large part inspired and most definitely educated my own hacking career, tackle a machine I created! Glad to see my puns were well-received lol. Same goes for the walkthroughs by
@_johnhammond
,
@0xdf_
,
@xct_de
& others. Hope y'all liked it!
#HackTheBox
Laboratory video is now online! An easy box that involved exploiting an old Gitlab instance. My favorite part was using the gitlab console to play with user permissions -
Celebrated my 30th birthday on a boat, and then spent it on a jungle island at the bottom of a volcano amidst the rice fields.
#afk
life is pretty good ๐
Gave BugBountyScanner some of the long overdue love it deserved. Updated tools to the latest version, various enhancements and tweaks w.r.t. performance. Go try it out and grab some bounties!
It's been a while - but I just tagged NimPlant version 1.3! This one has been lingering on the dev branch for quite some time. No major new features, but a lot of code refactoring and various enhancements. Special thanks to some wonderful contributors! ๐
Added a second execution mode ('command' vs 'binary') to my
#Follina
exploit script, and added some arguments to customize the behavior. I guess that's enough for now since the vuln will be patched soon anyway ๐
Just published a quick and dirty Python script to replicate the full 'Follina' Office RCE vulnerability for (local) testing on Github. Not suitable for production use, but should help in quickly identifying exposure.
When I got home, I immediately logged back in and turned off the screen due to the potential risk of blinding drivers (keep in mind these were two BIG signs, next to a huge highway - made a bit more clear by street view). The upside was that I now knew who this sign belonged to!
A couple of months ago I was bored, and this tweet by
@pry0cc
triggered a Shodan safari (as one does on a Friday night). I went looking, and sure enough I found exactly one exposed IP here in the Netherlands. It looked like a digital display of sorts.
If you want to find these kinds of signs on Shodan, just look for โDaktronicsโ theyโre usually unsecured with default passwordsโฆ and attached to hospitals and schools entrance.
Nimplant in Rust? Yessir ๐ซก. I will be presenting the new version at BH Arsenal this year, and share how you can utilize Rust features for enhanced opsec(โข๏ธ).
See you in Vegas!
If you don't know about yet, you should! Easy and quick to query from the command line (without any installation), and oftentimes provides a quicker and more usable quick reference than e.g. manpages or --help.
And that's a wrap for the
#OSEP
challenge labs! Had a lot of fun struggling my way through various machines in the 6 distinct lab environments.
Now to finalize my notes and codebase, do a few more practice runs to iron out the kinks, and then go for the exam I suppose ๐ฅณ
NimPlant will be ready for release in about 2 weeks! Since I would like to release it as responsibly as possible, I'm looking to give one or a few defensive practitioners early access in exchange for some detection rules I can release with the project or indicators I can build in
Touchdown in Vegas! If you're around hit me up and let's grab a drink in the next few days ๐
First order of business is to sleep off the jetlag tho ๐ด
And that's a wrap for the
#OSEP
exam! I have to say, the exam lab environment was a lot of fun to work through. Shame I didn't get to exploit all the exploitation paths, but still had a blast getting the 'secret.txt' objective. Fingers crossed for the result!
So taking hacking exams with a slight fever (thanks Pfizer...) turns out not to be the best idea, but I made it! All four flags for the
@zeropointsecltd
CRTO certification exam submitted ๐
Very fun course and exam, especially the last flag was worth it. Blog post soonโข!
HmmmMMMM a new, statically typed, compiled, Python-based programming language with low level functionality and native cpython support? Are you thinking what I'm thinking? ๐
It also has emoji file extensions lol ๐ฅ๐ฅ๐ฅ
For those that are dabbling in Rust ๐ฆ like myself: make sure to change your IDE's linter from 'cargo check' to 'clippy'. It's much more performant and will help you write better, faster, and more idiomatic code. A great way to learn!๐ฅ