The FindProcHandle bof can be used to identify processes with a specific process handle in use, for example processes using a handle to the lsass.exe process. If there's a process within the system with a lsass.exe process handle, we could use this existing process/handle to read or write memory without opening a new process handle. This bypasses certain AV/EDR's capabilities of detecting and blocking LSASS process/memory access.
How do I set this up?
We will not supply compiled binaries. You will have to do this yourself: Clone this repository. Make sure you have the Mingw-w64 compiler (https://www.kitploit.com/search/label/Compiler) installed. On Mac OSX for example, you can use the ports collection to install Mingw-w64 (sudo port install mingw-w64). Run the make command to compile the Beacon object file. Within Cobalt Strike use the Script Manager to load the FindObjects.cna script. Within a Cobalt Strike beacon context use the FindProcHandle or FindModule command with the required parameters (e.g. module or process name).
Download FindObjects-BOF (https://github.com/outflanknl/FindObjects-BOF)
We will not supply compiled binaries. You will have to do this yourself: Clone this repository. Make sure you have the Mingw-w64 compiler (https://www.kitploit.com/search/label/Compiler) installed. On Mac OSX for example, you can use the ports collection to install Mingw-w64 (sudo port install mingw-w64). Run the make command to compile the Beacon object file. Within Cobalt Strike use the Script Manager to load the FindObjects.cna script. Within a Cobalt Strike beacon context use the FindProcHandle or FindModule command with the required parameters (e.g. module or process name).
Download FindObjects-BOF (https://github.com/outflanknl/FindObjects-BOF)
Resources to train an amazing hacker — Part 2
In this chapter we will go deeper into hacking resourcesContinue reading on Medium »
Read more...
In this chapter we will go deeper into hacking resourcesContinue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Automation allowed a REvil affiliate to move from exploitation of vulnerable servers to installing ransomware on downstream companies faster than most defenders could react.
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Automation allowed a REvil affiliate to move from exploitation of vulnerable servers to installing ransomware on downstream companies faster than most defenders could react.
Dark Reading: Attacks/Breaches
Fake Android Apps Promise Cryptomining Services to Steal Funds
Researchers discover more than 170 Android apps that advertise cloud cryptocurrency mining services and fail to deliver.
Fake Android Apps Promise Cryptomining Services to Steal Funds
Researchers discover more than 170 Android apps that advertise cloud cryptocurrency mining services and fail to deliver.
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
FindObjects-BOF - A Cobalt Strike Beacon Object File (BOF) Project Which Uses Direct System Calls To Enumerate Processes For Specific Loaded Modules Or Process Handles
http://1.bp.blogspot.com/-OOZR209Jz84/YNkP2SrwTmI/AAAAAAAAeqY/LYN79sEKYR4JkJD7KGv5J7a61KjlAQtHgCK4BGAYYCw/w640-h348/FindObjects-BOF_1_FindObjects-700101.png A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific modules or process handles. What is this repository for?* Use direct systems calls within Beacon Object files to enumerate processes for specific loaded modules (e.g. winhttp.dll, amsi.dll or clr.dll).
* Use direct systems calls within Beacon Object files to enumerate processes for specific process handles (e.g. lsass.exe).
* Avoid using the Windows and Native APIs as much as possible (to avoid userland hooks).
* Execute this code within the beacon process using Beacon object files to avoid fork&run. Why do i need this?Utilizing direct systems calls via inline assembly in BOF code provides a more opsec safe way of interacting with the system. Using direct system calls avoids AV/EDR software intercepting user-mode API calls.
*
The
The
* Clone this repository.
* Make sure you have the Mingw-w64 compiler installed. On Mac OSX for example, you can use the ports collection to install Mingw-w64 (
* Run the
* Within Cobalt Strike use the
* Within a Cobalt Strike beacon context use the
FindObjects-BOF - A Cobalt Strike Beacon Object File (BOF) Project Which Uses Direct System Calls To Enumerate Processes For Specific Loaded Modules Or Process Handles
http://1.bp.blogspot.com/-OOZR209Jz84/YNkP2SrwTmI/AAAAAAAAeqY/LYN79sEKYR4JkJD7KGv5J7a61KjlAQtHgCK4BGAYYCw/w640-h348/FindObjects-BOF_1_FindObjects-700101.png A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific modules or process handles. What is this repository for?* Use direct systems calls within Beacon Object files to enumerate processes for specific loaded modules (e.g. winhttp.dll, amsi.dll or clr.dll).
* Use direct systems calls within Beacon Object files to enumerate processes for specific process handles (e.g. lsass.exe).
* Avoid using the Windows and Native APIs as much as possible (to avoid userland hooks).
* Execute this code within the beacon process using Beacon object files to avoid fork&run. Why do i need this?Utilizing direct systems calls via inline assembly in BOF code provides a more opsec safe way of interacting with the system. Using direct system calls avoids AV/EDR software intercepting user-mode API calls.
*
The
FindModulebof can be used to identify processes which have a certain module loaded, for example the .NET runtime clr.dllor the winhttp.dllmodule. This information can be used to select a more opsec safe spawnto candidate when using Cobalt Strike's execute-assemblyor before injecting an exfill beacon shellcode using the shinjectcommand. http://1.bp.blogspot.com/-OOZR209Jz84/YNkP2SrwTmI/AAAAAAAAeqY/LYN79sEKYR4JkJD7KGv5J7a61KjlAQtHgCK4BGAYYCw/s320/FindObjects-BOF_1_FindObjects-700101.png * The
FindProcHandlebof can be used to identify processes with a specific process handle in use, for example processes using a handle to the lsass.exeprocess. If there's a process within the system with a lsass.exeprocess handle, we could use this existing process/handle to read or write memory without opening a new process handle. This bypasses certain AV/EDR's capabilities of detecting and blocking LSASS process/memory access. http://3.bp.blogspot.com/-HoWr_06DQJ0/YNkP4FDXFEI/AAAAAAAAeqo/gEDukpNxbp8HrkUZfC3dWy77WV4_pCYwgCK4BGAYYCw/s320/FindObjects-BOF_2_FindProcHandle-706958.png How do I set this up?We will not supply compiled binaries. You will have to do this yourself:* Clone this repository.
* Make sure you have the Mingw-w64 compiler installed. On Mac OSX for example, you can use the ports collection to install Mingw-w64 (
sudo port install mingw-w64).* Run the
makecommand to compile the Beacon object file.* Within Cobalt Strike use the
Script Managerto load the FindObjects.cna script.* Within a Cobalt Strike beacon context use the
FindProcHandleor FindModulecommand with the required parameters (e.g. module or process name). Download FindObjects-BOF
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Resources to train an amazing hacker — Part 2
https://cdn-images-1.medium.com/max/2600/0*pe5hvo-LFf-ABJjm
In this chapter we will go deeper into hacking resources
Continue reading on Medium »
Resources to train an amazing hacker — Part 2
https://cdn-images-1.medium.com/max/2600/0*pe5hvo-LFf-ABJjm
In this chapter we will go deeper into hacking resources
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
The 3 Best Websites to Find Hackathons to Attend
https://cdn-images-1.medium.com/max/1403/1*Sl49lucX8ZrKWy2Yyt9PiQ.jpeg
Below are several websites to help you find quality hackathons that will give you a positive hackathon experience.
Continue reading on Medium »
The 3 Best Websites to Find Hackathons to Attend
https://cdn-images-1.medium.com/max/1403/1*Sl49lucX8ZrKWy2Yyt9PiQ.jpeg
Below are several websites to help you find quality hackathons that will give you a positive hackathon experience.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Start your journey in Cyber security from today
https://cdn-images-1.medium.com/max/1920/1*oaBqFaQ4whbxQrq1HhpIgQ.png
Cyber Security is often thought to be a magical process that can only be done by the elite, and TryHackMe shows you that’s not the case…
Continue reading on Medium »
Start your journey in Cyber security from today
https://cdn-images-1.medium.com/max/1920/1*oaBqFaQ4whbxQrq1HhpIgQ.png
Cyber Security is often thought to be a magical process that can only be done by the elite, and TryHackMe shows you that’s not the case…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Deep Web
So a young man kills 2, as part of a deal with the devil. While reading article, I realized that this fool was lurking in the deepest and the darkest part of the web; there he failed to bargain with the devil, got assigned a very tough job, got caught, and will now suffer, while the devil laughs.
Here is the article you might want to read.
Stay safe out there. Remember to never trust Iblis. Just don't try to ever initiate contact. You will suffer in this world and the hereafter.
submitted by /u/Makarov_NoRussian
[link] [comments]
So a young man kills 2, as part of a deal with the devil. While reading article, I realized that this fool was lurking in the deepest and the darkest part of the web; there he failed to bargain with the devil, got assigned a very tough job, got caught, and will now suffer, while the devil laughs.
Here is the article you might want to read.
Stay safe out there. Remember to never trust Iblis. Just don't try to ever initiate contact. You will suffer in this world and the hereafter.
submitted by /u/Makarov_NoRussian
[link] [comments]
Params — Discovering Hidden Treasure in WebApps
Hey Guys!! What's Going on? 👋 I was thinking of Tweeting about parameter discovery in web apps lately, however, while I was composing the…Continue reading on Medium »
Read more...
Hey Guys!! What's Going on? 👋 I was thinking of Tweeting about parameter discovery in web apps lately, however, while I was composing the…Continue reading on Medium »
Read more...