FindObjects-BOF - A Cobalt Strike Beacon Object File (BOF) Project Which Uses Direct System Calls To Enumerate Processes For Specific Loaded Modules Or Process Handles

A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific modules or process handles.What is this repository for? Use direct systems calls within Beacon Object files to enumerate processes for specific loaded modules (e.g. winhttp.dll, amsi.dll or clr.dll). Use direct systems calls within Beacon Object files to enumerate processes for specific process handles (e.g. lsass.exe). Avoid using the Windows and Native APIs as much as possible (to avoid userland hooks). Execute this code within the beacon process using Beacon object files to avoid fork&run. Why do i need this? Utilizing direct systems calls via inline assembly in BOF code provides a more opsec safe way of interacting with the system. Using direct system calls avoids AV/EDR software intercepting user-mode API calls. The FindModule bof can be used to identify processes which have a certain module loaded, for example the .NET runtime clr.dll or the winhttp.dll module. This information can be used to select a more opsec safe spawnto candidate when using Cobalt Strike's execute-assembly or before injecting an exfill beacon shellcode using the shinject command. The FindProcHandle bof can be used to identify processes with a specific process handle in use, for example processes using a handle to the lsass.exe process. If there's a process within the system with a lsass.exe process handle, we could use this existing process/handle to read or write memory without opening a new process handle. This bypasses certain AV/EDR's capabilities of detecting and blocking LSASS process/memory access. How do I set this up? We will not supply compiled binaries. You will have to do this yourself: Clone this repository. Make sure you have the Mingw-w64 compiler installed. On Mac OSX for example, you can use the ports collection to install Mingw-w64 (sudo port install mingw-w64). Run the make command to compile the Beacon object file. Within Cobalt Strike use the Script Manager to load the FindObjects.cna script. Within a Cobalt Strike beacon context use the FindProcHandle or FindModule command with the required parameters (e.g. module or process name). Download FindObjects-BOF
Read more...

hacking: security in practice
Does anyone have a download for Ice IX?

-11-

dm on discord if you have a version, im also looking for a copy of Zeus. My discord is "#8537Deadpoppin"

submitted by /u/PMsweden
[link] [comments]

Resources to train an amazing hacker — Part 2
https://thexssrat.medium.com/resources-to-train-an-amazing-hacker-part-2-90a5814f7e3c?source=rss------bug_bounty-5

In this chapter we will go deeper into hacking resourcesContinue reading on Medium » (https://thexssrat.medium.com/resources-to-train-an-amazing-hacker-part-2-90a5814f7e3c?source=rss------bug_bounty-5)

Any African-American physical penetration testers?
https://www.reddit.com/r/Pentesting/comments/oft56q/any_africanamerican_physical_penetration_testers/

<!-- SC_OFF -->I've been listening to the Darknet Diaries episodes on physical penetration testers and it seems like there's a few intense moments with police but officers usually end up very curious rather than aggressive. I was wondering if there were any phys-pen professionals who were African-American and what their experiences were like in this field since for the general population, it seems that officers are generally more aggressive towards black people in America. <!-- SC_ON --> submitted by /u/B00OBSMOLA (https://www.reddit.com/user/B00OBSMOLA)
[link] (https://www.reddit.com/r/Pentesting/comments/oft56q/any_africanamerican_physical_penetration_testers/) [comments] (https://www.reddit.com/r/Pentesting/comments/oft56q/any_africanamerican_physical_penetration_testers/)

FindObjects-BOF - A Cobalt Strike Beacon Object File (BOF) Project Which Uses Direct System Calls To Enumerate Processes For Specific Loaded Modules Or Process Handles
http://www.kitploit.com/2021/07/findobjects-bof-cobalt-strike-beacon.html

A Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) Beacon Object File (BOF) project which uses direct system calls (https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/) to enumerate processes for specific modules or process handles.
What is this repository for?
Use direct systems calls within Beacon Object files to enumerate processes for specific loaded modules (e.g. winhttp.dll, amsi.dll or clr.dll). Use direct systems calls within Beacon Object files to enumerate processes for specific process handles (e.g. lsass.exe). Avoid using the Windows (https://www.kitploit.com/search/label/Windows) and Native APIs as much as possible (to avoid userland (https://www.kitploit.com/search/label/UserLAnd) hooks). Execute this code within the beacon process using Beacon object files (https://www.cobaltstrike.com/help-beacon-object-files) to avoid fork&run.
Why do i need this?
Utilizing direct systems calls via inline (https://outflank.nl/blog/2020/12/26/direct-syscalls-in-beacon-object-files/)assembly (https://www.kitploit.com/search/label/Assembly) in BOF code provides a more opsec safe way of interacting with the system. Using direct system calls avoids AV/EDR software intercepting user-mode API calls. The FindModule bof can be used to identify processes which have a certain module loaded, for example the .NET runtime clr.dll or the winhttp.dll module. This information can be used to select a more opsec safe spawnto candidate when using Cobalt Strike's execute-assembly or before injecting an exfill beacon shellcode using the shinject command.

The FindProcHandle bof can be used to identify processes with a specific process handle in use, for example processes using a handle to the lsass.exe process. If there's a process within the system with a lsass.exe process handle, we could use this existing process/handle to read or write memory without opening a new process handle. This bypasses certain AV/EDR's capabilities of detecting and blocking LSASS process/memory access.

How do I set this up?
We will not supply compiled binaries. You will have to do this yourself: Clone this repository. Make sure you have the Mingw-w64 compiler (https://www.kitploit.com/search/label/Compiler) installed. On Mac OSX for example, you can use the ports collection to install Mingw-w64 (sudo port install mingw-w64). Run the make command to compile the Beacon object file. Within Cobalt Strike use the Script Manager to load the FindObjects.cna script. Within a Cobalt Strike beacon context use the FindProcHandle or FindModule command with the required parameters (e.g. module or process name).

Download FindObjects-BOF (https://github.com/outflanknl/FindObjects-BOF)

Resources to train an amazing hacker — Part 2

In this chapter we will go deeper into hacking resourcesContinue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours

Automation allowed a REvil affiliate to move from exploitation of vulnerable servers to installing ransomware on downstream companies faster than most defenders could react.

Dark Reading: Attacks/Breaches
Fake Android Apps Promise Cryptomining Services to Steal Funds

Researchers discover more than 170 Android apps that advertise cloud cryptocurrency mining services and fail to deliver.

KitPloit - PenTest Tools!
FindObjects-BOF - A Cobalt Strike Beacon Object File (BOF) Project Which Uses Direct System Calls To Enumerate Processes For Specific Loaded Modules Or Process Handles

http://1.bp.blogspot.com/-OOZR209Jz84/YNkP2SrwTmI/AAAAAAAAeqY/LYN79sEKYR4JkJD7KGv5J7a61KjlAQtHgCK4BGAYYCw/w640-h348/FindObjects-BOF_1_FindObjects-700101.png A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific modules or process handles. What is this repository for?* Use direct systems calls within Beacon Object files to enumerate processes for specific loaded modules (e.g. winhttp.dll, amsi.dll or clr.dll).
* Use direct systems calls within Beacon Object files to enumerate processes for specific process handles (e.g. lsass.exe).
* Avoid using the Windows and Native APIs as much as possible (to avoid userland hooks).
* Execute this code within the beacon process using Beacon object files to avoid fork&run. Why do i need this?Utilizing direct systems calls via inline assembly in BOF code provides a more opsec safe way of interacting with the system. Using direct system calls avoids AV/EDR software intercepting user-mode API calls.

*
The FindModulebof can be used to identify processes which have a certain module loaded, for example the .NET runtime clr.dllor the winhttp.dllmodule. This information can be used to select a more opsec safe spawnto candidate when using Cobalt Strike's execute-assemblyor before injecting an exfill beacon shellcode using the shinjectcommand. http://1.bp.blogspot.com/-OOZR209Jz84/YNkP2SrwTmI/AAAAAAAAeqY/LYN79sEKYR4JkJD7KGv5J7a61KjlAQtHgCK4BGAYYCw/s320/FindObjects-BOF_1_FindObjects-700101.png *
The FindProcHandlebof can be used to identify processes with a specific process handle in use, for example processes using a handle to the lsass.exeprocess. If there's a process within the system with a lsass.exeprocess handle, we could use this existing process/handle to read or write memory without opening a new process handle. This bypasses certain AV/EDR's capabilities of detecting and blocking LSASS process/memory access. http://3.bp.blogspot.com/-HoWr_06DQJ0/YNkP4FDXFEI/AAAAAAAAeqo/gEDukpNxbp8HrkUZfC3dWy77WV4_pCYwgCK4BGAYYCw/s320/FindObjects-BOF_2_FindProcHandle-706958.png How do I set this up?We will not supply compiled binaries. You will have to do this yourself:

* Clone this repository.
* Make sure you have the Mingw-w64 compiler installed. On Mac OSX for example, you can use the ports collection to install Mingw-w64 (sudo port install mingw-w64).
* Run the makecommand to compile the Beacon object file.
* Within Cobalt Strike use the Script Managerto load the FindObjects.cna script.
* Within a Cobalt Strike beacon context use the FindProcHandleor FindModulecommand with the required parameters (e.g. module or process name). Download FindObjects-BOF

Hacking on Medium
Instructions to Hack WPA/WPA2 PSK Enabled WiFi Password using Kali Linux

https://cdn-images-1.medium.com/max/1400/0*UCufyF7qUFSFsghF.png
by using Wordlist Method

Continue reading on Medium »