LittleCorporal assembles the .NET thread hijacking artifact using .NET v2. Please make sure .NET v2 is installed on the machine you are generating the Word document with (make sure C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ exists) and on the target machine you plan to run the document on. You must also have Office installed on the machine you plan on running LittleCorporal.exe on. This is because LittleCorporal needs to interact via COM with Word. Please also note that the generated Word doc pulls down a blank image from the internet - meaning you will need to have internet access on the computer you run LittleCorproal with and on the remote machiny you plan to detonate the Word doc on. Unfortunately, LittleCorporal can only be used with 64-bit versions of Word. Why is this? Only a 64-bit system can identify structures used in the thread hijacking loader capability - such as a 64-bit CONTEXT structure, which has 64-bit specific data types. This is because thread hijacking is currently only supported on 64-bit systems, as it requires custom shellcode which adheres specifically to the __fastcall calling convention. I do not plan to implement a 32-bit version of the thread hijacking capability, but if there is eventually a pull request for 32-bit support, as many installations of Microsoft Word are 32-bit, I would not totally count this out of the realm of possibility. It currently shouldn't be a big fix from a logical perspective, this issue becomes the burden and hassle of maintaining track of the stack when moving from __fastcall to __stdcall and computing new offsets. This isn't complex from a technic al perspective, but is a bit arduous. The thread hijacking code first performs a check to see if the machine executing the Word document is domain joined. If running on a non-domain joined machine, please edit this line of code (https://github.com/connormcgarr/LittleCorporal/blob/main/LittleCorporal/LittleCorporal.Loader/Loader.cs#L266) to bool FUNC1 = true; before running LittleCorporal.exe to generate a Word document
Recommendations
If you plan on using this project for active red team operations, please consider setting the "Exit" functionality of your shellcode to perform a "clean" exit with a thread exit, instead of completely killing the process in which the shellcode resides in. This can be configured with msfvenom via EXITFUNC=thread, and can also be configured in Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) as such via Aggressor.
Usage
YOU MUST FETCH THE ENTIRE PROJECT IN ORDER TO USE! LittleCorporal uses relative paths for additional resources, such as Donut. Once obtaining the entire project, change your working directory to the bin\Release directory (cd C:\Path\to\LittleCorporal\bin\Release). It is recommended that if you choose to re-compile this project that you use a Release build instead of a Debug build. Specify the path to your shellcode file on the machine you are executing LittleCorporal.exe from and the already running process on the machine which you would like to execute the Word document on. (LittleCorporal.exe C:\Path\To\Shellcode.bin explorer.exe) LittleCorporal will then output the path to the final Word document To "clean" the Artifacts directory, use the following command: LittleCorporal.exe clean

Download LittleCorporal (https://github.com/connormcgarr/LittleCorporal)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Part 3: Pen Test DropBox — Adding a Cellar Backlink

https://cdn-images-1.medium.com/max/624/1*QE3AAyRLjqZRlGyPgu-qPg.png
Install Required dependencies for the Cellular Card

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Part 2: Build the Pen Test Drop Box

https://cdn-images-1.medium.com/max/600/1*EPcgL9P7Ogo2iNa0mni-Fw.png
Order the parts

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Part 1: Build a Cloud based Command and Control Server, and Attack Drop Box with a Cellular…

https://cdn-images-1.medium.com/max/600/1*07lJWyXOHpVPUL2RUvuNCg.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The boring side of testing people should be talking about more!

https://cdn-images-1.medium.com/max/937/0*WzX4UhCuwXy0IEg3
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Easy Security — Hunting IOCs or Effects?

https://cdn-images-1.medium.com/max/1024/1*SNXZJUpgUjyob9sXLIAeZw.gif
Do Both!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
LittleCorporal - A C# Automated Maldoc Generator

https://1.bp.blogspot.com/-85hOqgWFZr0/YUu1xAdZ6pI/AAAAAAAAvTM/846i2ZxHqRIkL0aY2E1ywmPR5UdrE9OkQCNcBGAsYHQ/w400-h400/maldoc.png LittleCorporal: A C# Automated Maldoc Generator C:\LittleCorporal\bin\Release>LittleCorporal.exe C:\beacon.bin explorer.exe
.____ .__ __ __ .__ _________ .__
| | |__|/ |__/ |_| | ____ \_ ___ \ _________________ ________________ | |
| | | \ __\ __\ | _/ __ \/ \ \/ / _ \_ __ \____ \ / _ \_ __ \__ \ | |
| |___| || | | | | |_\ ___/\ \___( <_) | \/ |_> > <_) | \// __ \| |__
| _______ \__||__| |__| |____/\___ >\______ /\____/|__| | __/ \____/|__| (____ /____/
\/ \/ \/ |__| \/
________
/ \
__ / (o)\__
/ ______\ \ I am the strongest debater in the whole Conseil.
| ____/__ __\____| I let myself be attacked, because I know how to defend myself.
[ --~~-- ] - Napoleon Bonaparte
| ( L )|
___----\ __ /----___
/ | < \____/ > | \
/ | < \--/ > | \
|||||| \ \/ / ||||||
| \ / o |
| | \/ === | |
| | |o ||| | |
| \______| +#* | |
| |o | |
\ | / /
|\__________|o / /
| | / /

[+] Parsed Arguments:
[>] Shellcode Path: C:\beacon.bin
[>] Target Process: explorer.exe

[+] Embedded shellcode in Loader.cs!
[+] Generated C# Loader artifact!
[+] Ran the .NET assembly through Donut!
[+] Donut artifact is located at: C:\LittleCorporal\Artifacts\payload.bin
[+] Path to Word document: C:\LittleCorporal\Artifacts\Form.doc PLEASE READ THE ENTIRE README BEFORE USAGE! How It Works?LittleCorporal accepts a user-supplied argument for a process to inject into on a remote machine, in which you plan to execute the malicious Word document on, and also accepts a path to a local shellcode file stored in .binformat - such as a Beacon Stageless shellcode blob on the machine you are running LittleCorporal from. So, if you would like to use the maldoc generated from this project, you will need to specify an already running process on the machine you intend to run the maldoc on (be it the local machine or a different machine. explorer.exeis always going to have one instance, so use this if you do not care about which process you inject into).

LittleCorporal embeds the shellcode and the target process name into Loader.cs, compiles Loader.cson the fly into a .NET .exeartifact, and then utilizes thread hijacking to perform remote process injection. The .NET .exeartifact, which is the thread hijacking loader, is sent through Donut to generate position independent shellcode, which will execute the .exe. The shellcode generated by Donut is then base64 encoded, a Word document is generated, and the final Donut blob is stored in an InlineShape.AlternativeText Word property, which is able to hold the entire payload. This is done by inserting an image (currently a blank image, giving the document a "blank" look) property into the Word document, as alternative text on the image, which contains the payload. LittleCorporal then leverages a VBA "template", contained in this project as a text file, and injects this Macro into the newly generated Word document. The Macro is named autoopen, so it opens upon the document opening, and then is configured to extract the value of the alternative text of the previously generated image, which contains the final payload, base64 decodes it, and [...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
LittleCorporal - A C# Automated Maldoc Generator

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Most Large Enterprises Fail to Protect Their Domain Names

Of the largest 2,000 companies in the world, 81% fail to take simple security measures, such as locking their domain with the registrar, leaving them open to domain shenanigans.

Dark Reading: Attacks/Breaches
Outsourced Software Pose Greater Risks to Enterprise Application Security

In the wake of SolarWinds and other third-party attacks, security teams worry that outsourced applications pose risks to the organization's application security, according to Dark Reading's recent "How Enterprises Are Developing Secure Applications" report.

Dark Reading: Attacks/Breaches
75K Email Inboxes Hit in New Credential Phishing Campaign

Attacker used a legitimate — but likely deprecated — domain to sneak malicious emails past security filters, vendor says.

Dark Reading: Attacks/Breaches
NSA, CISA Issue Guidelines for Selecting and Securing VPNs

Joint document includes configuration recommendations for hardening VPNs, and recommendations on how to select the most secure ones.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
PS2EXE : Module To Compile Powershell Scripts To Executables

PS2EXE is a Module To Compile Powershell Scripts To Executables. Overworking of the great script of Ingo Karstein with GUI support. The GUI output and input is activated with one switch, real windows executables are generated. With Powershell 5.x support and graphical front end.

Module version.

You find the script based version here (https://github.com/MScholtes/TechNet-Gallery) and here: PS2EXE-GUI: “Convert” PowerShell Scripts to EXE Files with GUI.

Author: Markus Scholtes

Version: 1.0.10

Date: 2021-04-10

Installation

PS C:> Install-Module ps2exe

(on Powershell V4 you may have to install PowershellGet before) or download from here: https://www.powershellgallery.com/packages/ps2exe/.

Usage

Invoke-ps2exe .\source.ps1 .\target.exe

or

ps2exe .\source.ps1 .\target.exe

compiles “source.ps1” into the executable target.exe (if “.\target.exe” is omitted, output is written to “.\source.exe”).

or start Win-PS2EXE for a graphical front end with

Win-PS2EXE

Parameter

ps2exe [-inputFile] ” [[-outputFile] ”] [-prepareDebug]
[-x86|-x64] [-lcid ] [-STA|-MTA] [-noConsole] [-UNICODEEncoding]
[-credentialGUI] [-iconFile ”] [-title ”] [-description ‘ 260 characters) if enabled on OS (works only with Windows 10)

A generated executable has the following reserved parameters:

-debug Forces the executable to be debugged. It calls “System.Diagnostics.Debugger.Launch()”.
-extract: Extracts the powerShell script[...]

___________________________
@hacking_Attack
@Hacking_Video

inside the executable and saves it as FILENAME.
The script will not be executed.
-wait At the end of the script execution it writes “Hit any key to exit…” and waits for a key to be pressed.
-end All following options will be passed to the script inside the executable.
All preceding options are used by the executable itself and will not be passed to the script. Download

___________________________
@hacking_Attack
@Hacking_Video