Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
Aggrokatz - An Aggressor Plugin Extension For Cobalt Strike Which Enables Pypykatz To Interface With The Beacons Remotely

http://1.bp.blogspot.com/-kPjciEdIEPA/YMZ_kNnATEI/AAAAAAAAabo/CEIa5NhZjT0xgDNoWb2RxLlpQqr1GRoQwCK4BGAYYCw/w640-h320/aggrokatz_1-717180.jpeg aggrokatzis an Aggressor plugin extension for CobaltStrikewhich enables pypykatzto interface with the beacons remotely.
The current version of aggrokatzallows pypykatzto parse LSASS dump files and Registry hive files to extract credentials and other secrets stored without downloading the file and without uploading any suspicious code to the beacon (Cobalt Strike is already there anyhow). In the future this project aims to provide additional features for covert operations such as searching and decrypting all DPAPI secrets/kerberoasting/etc.

We have published a short blog postfor this tool release which also includes some screenshots. IMPORTANT NOTES - PLEASE READ THISLSASS/Registry dumping is not the goal of this project, only parsing. Reasons:

1. Multiple techniques for dumping are already implemented from Cobalt Strike (CS) and widely available to the public. Recently we switched to using a modified version of CredBanditthat dumps the raw bytes to disk instead of base64. Cool tool, check it out.
2. We want to keep our dumping technique private.

In CS client, do not use "reload" nor try to manually unload then reload the script if you modified it. You MUST unload it, close the client and start it anew, then load the modified script. Otherwise you will have multiple versions running simultaneously and a ton of errors and weird behaviours will happen!
While parsing LSASS/registry files on the remote end please don't interact with the specific beacon you started the script on. Normally it wouldn't cause any problems, but I can't give any guarantees. Install* You will need pycobaltinstalled and set up. There is a readme on their github page.
* You will need to install pypykatzversion must be >=0.4.8* You will need Cobalt Strike Setup* make sure that pycobalt's aggressor.cnafile is set up and is aware of your python interpreter's location
* Change the pycobalt_path in aggrokatz.cnato point to pycobalt.cna* in CS use the View > Script Consoleand Cobalt Strike > Script Managerwindows. Using Script Managerload the aggkatz.cnascript. Usage* If the aggkatz.cnascript loaded successfully you will have a new menu item pypykatzwhen right-clicking on a beacon.
* During parsing you will see debug messages in Script Consolewindow.
* After parsing is finished, the results will be displayed in both Script Consolewindow and the Beacon's own window. LSASS dump parse menu parameters* LSASS file: The location of the lsass.dmpfile on the remote computer. You can also use UNC paths to access shared lsass.dmpfiles over SMB
* chunksize: The maximum amount that will be read in one go
* BOF file: The BOF file (Beacon Object File) which allows chunked reads. This file will be uploaded and executed (in-memory) each time a new chunk is being read.
* (module): Specifies which modules will be parsed. Default: all* Output: Specifies the output format(s)
* Populate Credential tab: After a sucsessful parsing all obtained credentials will be available on the Cobalt Srike's Credential tab. This feature is in beta
* Delete remote file after parsing: After a sucsessful parsing the LSASS dump file will be removed from the targe[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Aggrokatz - An Aggressor Plugin Extension For Cobalt Strike Which Enables Pypykatz To Interface With The Beacons Remotely

5 viewsedited 23:07

KitPloit - PenTest Tools!
Aggrokatz - An Aggressor Plugin Extension For Cobalt Strike Which Enables Pypykatz To Interface With The Beacons Remotely

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Aggrokatz - An Aggressor Plugin Extension For Cobalt Strike Which Enables Pypykatz To Interface With The Beacons Remotely

5 viewsedited 23:07

Hacking Articles Tips Tricks Videos Tutorials

4 views23:09

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Hacking 2021

https://cdn-images-1.medium.com/max/2600/1*Zz0ztGgICt0z192EqInOWg.jpeg
Probably most of the hacking techniques that are common in hacking methods are getting more and more sophisticated.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Hacking 2021

Probably most of the hacking techniques that are common in hacking methods are getting more and more sophisticated. Hackers are continually…

4 viewsedited 23:09

Hacking Articles Tips Tricks Videos Tutorials

Aggrokatz - An Aggressor Plugin Extension For Cobalt Strike Which Enables Pypykatz To Interface With The Beacons Remotely
http://www.kitploit.com/2021/06/aggrokatz-aggressor-plugin-extension.html

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Aggrokatz - An Aggressor Plugin Extension For Cobalt Strike Which Enables Pypykatz To Interface With The Beacons Remotely

4 viewsedited 23:13

Hacking Articles Tips Tricks Videos Tutorials

5 views23:13

Hacking Articles Tips Tricks Videos Tutorials

Limitations
The file read BOF currently supports file reads up to 4Gb. This can be extended with some modifications but so far such large files haven't been observed.
How it works

TL;DR
Normally pypykatz's parser performs a series of file read operations on disk, but with the help of aggrokatz these read operations are tunneled to the beacon using a specially crafted BOF (Beacon Object File) which allows reading the remote file contents in chunks. This allows pypykatz to extract all secrets from the remote files without reading the whole file, only grabbing the necessary chunks where the secrets are located.
In-depth
To get the full picture of the entire process, there are two parts we'd need to highlight: how pypykatz integrates with CobaltStrike how pypykatz performs the credential extraction without reading the whole file
pypykatz integration to CobaltStrike
CobaltStrike (agent) is written in Java, pypykatz is written in python. This is a problem. Lucky for us an unknown entity has created pycobalt which provides a neat interface between the two worlds complete with usefule APIs which can be invoked directly from python. Despite pycobalt being a marvellous piece of engineering, there are some problems/drawbacks with it that we need to point out: About trusting the pycobalt project: We have tried to reach out to the author but we got no reply. We cannot guarantee that the pycobalt project will be maintained in the future. We do not control any aspect of pycobalt's development. About technical issues observed: Generally there are some encoding issues between pycobalt and CobaltSrike. This results in some API calls which would return bytes that can't be used because some bytes get mangled by the encoder. By checking the code we conclude that most encoding/decoding issues are because pycobalt uses STDOUT/STDIN to communicate with the Java process Specifically the bof_pack API call which is crucial for this project had to be implemented as a pure-aggressor script and only invoked from python using basic data structures (string and int) and not using bytes. Only blocking APIs provided by the pycobalt package without threading support. Well, at least we observed that threading breaks randomly, but we kinda expected this. Blocking API + no threading + relying on callbacks = we had to employ some weird hacks to get it right.
Credential parsing on a stack of cards
pypykatz and it's companion module minidump had to be modified to allow a more efficient chunked parsing than what was implemented before, but this is a topic for another day.
After pypykatz was capable to interface with CobaltStrike via pycobalt the next step was to allow chunked file reading. Sadly this feature is not available by-default on any of the C2 solutions we have seen, so we had to implement it. The way we approached this problem is by implementing chunked reading via the use of CobaltStrike's Beacon Object Files interface (https://www.cobaltstrike.com/help-beacon-object-files), BOF for short. BOFs are C programs that run on the beacon not as a separate executable but as a part of the already running beacon. This interface is super-useful because it makes BOFs much stealthier since all of the code executes in memory without anything being written to disk.
Our BOF solution is a simple function and takes 4 arguments: fileName : Full file path of the LSASS dump file or registry hive (on the remote end) buffsize : Amount (in bytes) to be read from the file seekSize : The position where the file read operation should start from (from the beginning of the file) rplyid : An identification number to be incorporated in the reply to avoid possible collisions With these parameters, pypykatz (running on the agent) can issue file read operations on the beacon (target computer) that specifically target certain parts of the file.

___________________________
@hacking_Attack
@Hacking_Video

6 viewsedited 23:13

About

Blog

Apps

Platform