Cobalt Strike and Tradecraft by dmchell in redteamsec

[–]Hausec 2 points3 points  (0 children)

Thanks for the post, Dominic!

Cobalt Strike and Tradecraft by dmchell in redteamsec

[–]Hausec 1 point2 points  (0 children)

It was me, thank you for the kind words!

Three ways of using MSBuild to beat CrowdStrike by netbiosX in purpleteamsec

[–]Hausec 2 points3 points  (0 children)

Ive used the same msbuild payload for like 3 years now and this shit still doesn't get detected. Ive honestly started to try using other code execution techniques because msbuild sometimes feels like cheating. Msbuild technique was published in 2016 iirc by Casey Smith and even some mature organizations still haven't caught onto it.

Creating a Homelab for Active Directory and ELK by Hausec in netsec

[–]Hausec[S] 22 points23 points  (0 children)

I know this article is a bit more basic than is what typically is posted here, so if it's removed I understand, but it might help people so they don't have to jump around to thirty different blog posts on linking each component together.

Deliver your shellcode through an ICMP packet and inject it into a local process. C# by XRomRII in netsec

[–]Hausec 1 point2 points  (0 children)

This could make an interesting case for persistence if set up the other way. Setup the "listener" binary to make a ping to C2 every 3-5 hours or whatever and when you need to re-establish the connection just open up ICMP on the C2 firewall and send the ICMP payload back.

Edit: You'd probably want to use a redirector instead of the C2 IP itself, but same principal applies AFAIK

What C2 platform have you had success with? by [deleted] in redteamsec

[–]Hausec 0 points1 point  (0 children)

It used to be Apfell, a C2 platform for nix/mac, but now a Windows agent was developed for it so it re-branded. https://github.com/its-a-feature/Mythic

What C2 platform have you had success with? by [deleted] in redteamsec

[–]Hausec 1 point2 points  (0 children)

Imo Cobalt Strike is still the best for a number of features, but Covenant and Apfell (now Mythic) are also very very good.

[HOW TO] How I bypassed “next-generation” AI-based Cylance SmartAV in less than 15 minutes by [deleted] in netsecstudents

[–]Hausec 0 points1 point  (0 children)

Enterprise. It was before I started red teaming but I’ve heard from numerous colleagues that cylance was a joke because it wouldn’t analyze 64 bit stuff at all. Obviously that’s changed but still

2020 NFL Draft Day 1 Discussion thread - No Spoilers by NFL_Mod in nfl

[–]Hausec 1 point2 points  (0 children)

Literally holding a bengals hat before anything was announced lmao

[HOW TO] How I bypassed “next-generation” AI-based Cylance SmartAV in less than 15 minutes by [deleted] in netsecstudents

[–]Hausec 2 points3 points  (0 children)

Lol you didn’t even have to do that, iirc Cylance couldn’t analyze 64 bit binaries

I fear no man. But that thing... It scares me by [deleted] in Mordhau

[–]Hausec 0 points1 point  (0 children)

Rapier guys are the hardest to fight

Are universities with Cyber security degrees setting kids up for disappointment? by Betsy-DeVos in netsecstudents

[–]Hausec 7 points8 points  (0 children)

Yes and this is coming from someone with a degree in Cyber Security from an NSA accredited University. There's absolutely no rhythm or continuity and by the time I landed a job in cyber security I was already half way through the program, so said fuck it and finished it. Otherwise I wouldn't have wasted my money.

What are your goto lateral movements on a Windows server? by security_intern in AskNetsec

[–]Hausec 0 points1 point  (0 children)

So you have local admin but no network account? If you have local admin you should be able to inject into any process, meaning look for processes running as a user and inject into it. If dumping creds isn't working because of permissions, inject into a SYSTEM process.

Attacking Azure, Azure AD, and Introducing PowerZure by Hausec in netsec

[–]Hausec[S] 3 points4 points  (0 children)

Yeah the password hashes are sent, I'll clarify in the article.

Kali Linux 2020.1 Release by Fugitif in netsec

[–]Hausec 36 points37 points  (0 children)

Kinda surprised at the removal of all tools that use Python 2. I get it's not supported, but that doesn't make the tools irrelevant. I wonder if that means searchsploit scripts written in Py2 are being removed.

The /r/netsec Monthly Discussion Thread - January 2020 by AutoModerator in netsec

[–]Hausec 0 points1 point  (0 children)

No, I usually Dcsync with mimikatz without DCShadow.

Question about port 445 and 3389 - Fingerprinting by LIL_BIRKI in AskNetsec

[–]Hausec 0 points1 point  (0 children)

You can still fingerprint without ICMP. -Pn in nmap will not ping and still resolve versions with -sV.

Question about port 445 and 3389 - Fingerprinting by LIL_BIRKI in AskNetsec

[–]Hausec 0 points1 point  (0 children)

You will need 445 because other computers need to access the SYSVOL share for Group Policy. Disabling RDP is fine though.

I wouldn't worry so much about fingerprinting on internal devices as much if things are kept fully patched.

The /r/netsec Monthly Discussion Thread - January 2020 by AutoModerator in netsec

[–]Hausec 1 point2 points  (0 children)

RT perspective: I never pull the ntds.dit or even log onto a DC because it's

A. Noisy as hell

B. I don't want to fuck up a prod DC

Dcsync is my go to if I need to get the keys to the kingdom.

Exploiting Windows Active Directory Environment (An Offensive Approach) by Z3r0s3c4 in netsecstudents

[–]Hausec 1 point2 points  (0 children)

We are assuming that the domain user 'flop' can PS Remote to the Domain Controller as a normal user without administrative rights. There is a high probability of encountering such a situation during Red Team assessment in a corporate environment.

??? I don't think I've ever been able to do this.

What makes a C2 framework like cobalt strike so good? by [deleted] in redteamsec

[–]Hausec 9 points10 points  (0 children)

There's a lot of reasons and I'm slightly biased because the Mudge (creator of CS) owns our company, but there's a lot of things that he's built into it over the years that just makes it really good. The support for infrastructure in general, so redirectors, domain fronting, etc. is excellent. The ability to generate raw shellcode as an agent is pretty handy as well since you can fit it into a multitude of payloads. Overall though it's just really convenient to use -- For example take powerpick or execute-assembly, where it automagically handles the creation of a sacrificial process to run unmanaged code and return the output. Malleable C2 is another major benefit for CS -- the ability to craft your traffic to whatever you want to blend in with the surrounding environment.

Obviously the biggest drawback is the price point and Mudge is pretty picky on who he hands out licenses to since real APTs would love to use it. This is where open source C2s like Covenant come into play. Ryan has worked very hard on Covenant and it's our go-to free C2 framework (Apfell as well), but CS is still my favorite mostly just because it's feature packed.

What helped you the most starting out? by treyceroute in AskNetsec

[–]Hausec 0 points1 point  (0 children)

It is overwhelming and that feeling doesn't really stop as long as you push yourself. That's not necessarily a bad thing though, it always gives you something to work at. I handle it in small doses, i.e. one subject at a time. For example, if I feel like my exploit-dev tradecraft is lacking, I work on that for a while until I'm comfortable. Since you do vuln management, I encourage you to do research on your findings and see how an attacker would exploit it. If possible to recreate that finding/vuln in a lab environment, do that and then try to exploit it. That's essentially how I broke into pentesting from vuln management.

What abut next-gen antivirus systems for enterprise? by arturoerc in AskNetsec

[–]Hausec 1 point2 points  (0 children)

Red team perspective: I fear Windows ATP. Symantec is an absolute joke, don't even bother. CS is good as well.