Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials InlineExecute-Assembly : A PoC Beacon Object File (BOF) That Allows Security Professionals To Perform In Process .NET Assembly Execution InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals…

e

Execute .NET assembly with arguments

Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –assemblyargs AntiVirus AppLocker

Use Case

Execute .NET assembly with arguments and disable AMSI

Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –assemblyargs AntiVirus AppLocker –amsi

Use Case

Execute .NET assembly with arguments and disable ETW

Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –assemblyargs AntiVirus AppLocker –etw

Use Case

Execute .NET assembly with arguments and redirect output via mailslots instead of the default named pipe

Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –mailslot

Use Case

Execute .NET assembly with arguments and change the default named pipe name set in the aggressor script

Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –pipe forRealLegit

Use Case

Execute .NET assembly and change the default app domain set in the aggressor script Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –appdomain forRealLegit

Use Case

Execute .NET assembly with Main() entry point instead of the default Main(string[] args) Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/simpleMain.exe –main

Use Case

Go HAM Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –assemblyargs AntiVirus AppLocker –amsi –etw –appdomain forRealLegit –mailslot forRealLegit

Caveats

* While I have tried to make this as stable as possible, there are no guarantees things will never crash and beacons won’t die. We don’t have the added luxury of fork and run where if something goes wrong our beacon lives. This is the tradeoff with BOFs. With that said, I can’t stress how important it is that you test your assemblies beforehand to make sure they will work properly with the tool.
* Since the BOF is executed in process and takes over the beacon while running, this should be taken into account before being used for long running assemblies. If you choose to run something that will take a long time to get back results, your beacon will not be active to run more commands till the results come back and your assembly finishes running. This also doesn’t adhere to sleep set. For example, if your sleep is set at 10 minutes and you run the BOF, you will get results back as soon as the BOF finishes executing.
* Unless modification is done to tools that load PE’s in memory (e.g., SafetyKatz), these will most likely kill your beacon. Many of these tools work fine with execute assembly because they are able to send their console output from the sacrificial process before exiting. When they exit via our in process BOF, they kill our process, which kills our beacon. These can be modified to work but I would advise running these types of assemblies via execute assembly since other non-OPSEC friendly things could be loaded into your process that don’t get removed.
* If your assembly uses Environment.Exit this will need to be removed as it will kill the process and beacon.
* Named pipes and mail slots need to be unique. If you don’t receive data back and your beacon is still alive, the issue is most likely you need to select a different named pipe or mail slot name. Detection

Some detection and mitigation strategies that could be used:

* Uses PAGE_EXECUTE_READWRITE when performing AMSI and ETW memory patching. This was done on purpose and should be a red flag as very few programs have memory ranges with the memory protection of PAGE_EXECUTE_READWRITE.
* Default name of named pipe created is totesLegit. This was done on purpose and signature detections could be used to flag this.
* Default name of mailslot created is totesLegit. This was done on purpose and signature detections could be used to flag this.
* Default name of AppDoma[...]

___________________________
@hacking_Attack
@Hacking_Video

7 viewsedited 12:36

Hacking Articles Tips Tricks Videos Tutorials

in loaded is totesLegit. This was done on purpose and signature detections could be used to flag this.
* Good tips on detecting malicious use of .NET (by @bohops) here, (by F-Secure) here, and here
* Looking for .NET CLR loading into suspicious processes, such as unmanaged processes which should never have the CLR loaded.
* Event Tracing here
* Looking for other known Cobalt Strike Beacon IOC’s or C2 egress/communication IOC’s. Download

___________________________
@hacking_Attack
@Hacking_Video

8 viewsedited 12:36

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Attempted hack of unknown email address

Last night I had notifications of login attempts to my email from various places around the world. It was clearly a hacking attempt.

However, the strange thing is that I only use this address for iCloud, Amazon, and PayPal. None of which I believe to have had a leak, and confirmed this morning on Have I Been Pwned.

Fortunately, I use 2FA and change my PW frequently, so they failed to get in. However, I am perplexed at the source of the attack.

Unless it was targeted by someone who knows me (somewhat unlikely), how did they get this email address?

submitted by /u/ozzurfer
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Attempted hack of unknown email address

Last night I had notifications of login attempts to my email from various places around the world. It was clearly a hacking attempt. However,...

7 viewsedited 13:22

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
TryHackMe - Opinion

Hi All,

Just looking to get some opinions on TryHackMe, is its premium subscription worth the price, is it useful for the beginner/pro alike? Or is best to stay away?

Any opinions would be helpful.

Thanks.

submitted by /u/komorebi-iberomok
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video