Cybersecurity News

Part 1 - Processes and technology needed to extract Cobalt Strike implant beacons

Learn how Elastic Endpoint Security and Elastic SIEM can be used to hunt for and detect malicious persistence techniques at scale.

As the saying goes, a picture is worth a thousand words. In order to improve your documentation and uplevel red team and pentest reporting, it’s useful to add date and time information to screenshots and script logs. This helps the Blue Team (and yourself) reviewing past activity, reports and when deconflicting activity is required. Depending on the shell that is used there are different ways to go about it. Let’s cover three common ones.

Elastic Security has opened its detection rules repository to the world. We will develop rules in the open alongside the community, and we’re welcoming your community-driven detections. This is an opportunity to share collective security knowledge.

In this post, we’ll examine how GPT-3 could be used by red teams or adversaries to perform successful phishing attacks. We’ll also discuss some potential countermeasures that organizations can take to protect themselves against this type of threat. What is GPT-3? GPT-3 is a neural network-based machine learning system that was developed by OpenAI, a research lab focused on artificial intelligence. It is designed to generate text that sounds realistic and human-like, and it has been trained on a large corpus of text, including billions of words from the internet.

Information for red teaming macOS and info on real world TTPs are still a bit sparse. That makes it difficult for defenders to know what attackers do on macOS compared to Windows. Some organizations might have a bigger blind spot when it comes to macOS. This post describes how an adversary can grab hashes from a macOS machine, how to convert it to a hashcat friendly format and use hashcat to crack it.

After a bit of a delay my Flipper Zero finally arrived in the mail. If you are not familiar with Flipper Zero at all, check out the original Kickstarter page from a few years back. This is what the package looks like after opening. It contains the device, a USB cable, a quick start manual (mostly pointing you to the Flipper Zero website), and a Flipper “Hack the planet” sticker.

One area that I have encountered quite often over the years is that during recon phase of a bug bounty hunt or pentest a set of AWS access keys are being discovered. Let’s say you found 50 AWS access keys by drooling and hunting through public Github repos and using other nifty tricks and means. How do you go about checking their validity? And what do they have access to and provide the Bug Bounty Program or Blue Team the dates, times, and IP address when those keys were used?

Although Gitlab is not as popular as Github, it’s common to run across it these days. Especially after Microsoft acquired Github it seemed more individuals and organizations flocked over to Gitlab. In this post I want to document a couple of recon commands that are useful post-exploitation, and for blue teamers to watch out for. Let’s assume one has access to a Gitlab Token as a precursor. Let’s walk through some interesting commands and script snippets to leverage to find out more.

The last weeks of 2021 got quite interesting for security professionals and software engineers. Apache’s log4j library and its now prominent Java Naming and Directory Interface support, which enables easy remote code execution, made the news across the industry. What makes Log4Shell scary is the widespread adoption of the Log4j library amongst Java applications, and the ease of remote exploitation. A dangerous combination. Patches got released, bypasses were discovered more patches were released and so forth.

Cybersecurity breaches follow common patterns and stages - from an initial Beachhead to accomplishing Objectives. This video gives an overview of the anatomy of a compromise: Cheers. @wunderwuzzi23

This post is part of a series about Offensive BPF to learn how BPFs use will impact offensive security, malware, and detection engineering. Click the “ebpf” tag to see all relevant posts. Building advanced BPF programs So far in this Offensive BPF series the focus was on bpftrace to build and run BPF programs. The next thing I wanted to investigate is what options are available to modify data structures during BPF execution. This is where I hit limitations with bpftrace.

This post is part of a series about Offensive BPF that I’m working on to learn how BPFs use will impact offensive security, malware, and detection engineering. Click the “ebpf” tag to see all relevant posts. One of the issues I ran into when trying out sslsniff-bpfcc was that it did not work with Firefox or Chrome traffic. This post is about me learning how to hook user space APIs with bpftrace using uprobes.

Today you are in for a special treat. Did you know that an adversary can hide a smaller image within a larger one? This video demonstrates how a small image becomes magically visible when the computer resizes the large image, and also how to mitigate the vulnerability. This is possible when vulnerable code uses insecure interpolation. If you like this one check out the overall Machine Learning Attack Series.

Tabnabbing is a web application security vulnerability that can be used to perform phishing attacks, so its important to be aware of it as a developer and penetration tester. It is easy to mitigate and in this short video we cover both attacks and mitigations. Thanks for reading and happy hacking! @wunderwuzzi23

This post is part of a series about Offensive BPF that I’m working on to learn about BPF to understand attacks and defenses. Click the “ebpf” tag to see all relevant posts. In the previous posts I spend time learning about bpftrace which is quite powerful. This post is focused on basics and using existing BPF tools, rather then building new BPF programs from scratch. Living off the land: bpfcc-tools Performance and observability teams are pushing for BPF tooling to be present in production. Due to its usefulness, this is likely going to increase.

This post is part of a series about Offensive BPF that I’m working on to learn how BPFs use will impact offensive security, malware and detection engineering. Click the “ebpf” tag to see all relevant posts. In the last few posts, we talked about a bpftrace and how attackers can use it to their advantage. This post is about my initial ideas and strategies to detecting malicious usage. Detecting BPF misuse There are a set of detection ideas for Blue Teams. Since we primarily talked about bpftrace so far, let’s explore that angle.

This post is part of a series about Offensive BPF that I’m working on to learn how BPFs use will impact offensive security, malware and detection engineering. Click the “ebpf” tag to see all relevant posts. In the last post we talked about a basic bpftrace script to install a BPF program that runs commands upon connecting from a specific IP with a specific magic source port. This post will dive into this idea more by leveraging more a complex solution.

This post is part of a series about Offensive BPF that I’m working on to learn about BPF to understand attacks and defenses, click the “ebpf” tag to see all relevant posts. I’m learning BPF to understand how its use will impact offensive security, malware, and detection engineering. One offsec idea that quickly comes to mind with BPF is to observe network traffic and act upon specific events. So, I wanted to see if/how bpftrace, a popular tool for running BPF programs, can be used to create potential backdoors, and what evidence to look for as defenders.

Over the last few years eBPF has gained a lot of traction in the Linux community and beyond. eBPF’s offensive usage is also slowly getting more attention. So, I decided to dive into the topic from a red teaming point of view to learn about it to raise awareness and share the journey. Similar to the format of my Machine Learning Attack Series, there will be a serious of posts around BPF usage in offensive settings, and also how its misuse can be detected.

In this 25 minute video I’m explaining the foundations of Web Application Security. The video covers the basic building blocks of web applications, such as HTML, HTTP, JavaScript and Cookies. Furthermore core web applications security concepts such as the Same-Origin Policy are discussed in detail. The goal is to provide foundational knowledge to help grasp security vulnerabilities, such as XSS, CSRF, SQLi, tab-nabbing, etc. later on. In the past I have trained and presented content like this to thousands of engineers at large organizations and cloud providers, hence its quite optimized for best learning and comprehension outcome.

On Unix/Linux users with a uid=0 are root. This means any security checks are bypassed for them. An adversary might go ahead and create a new account, or set an existing account’s user identifier (uid) or group identifier to zero. A simple way to do this is to update /etc/passwd of an account, or use usermod -u 0 -o mallory. Let’s create a new user named mallory: wuzzi@saturn:/$ sudo adduser mallory [...] wuzzi@saturn:/$ cat /etc/passwd | grep mallory mallory:x:1001:1001::/home/mallory:/bin/sh Observe that the user has the uid 1001.

This post is part of the machine learning attack series. It’s been a while that I did a Husky AI and offensive machine learning related post. This weekend I had some time to try out Counterfit. My goal was to understand what Counterfit is, how it works, and use it to turn Shadowbunny into a husky. Let’s get started. What is Counterfit? With Counterfit you can test your machine learning models and endpoints for specific adversarial attacks.

I like using procdump on Windows. It’s quite handy for software development when systems have memory leaks or performance issues, procdump allows to set thresholds to trigger creation of a core dump. BUT, it’s also super useful to search processes for secrets and other information. For instance, this one liner will dump the memory of all processes to hard disk and then you can search them as you see fit.

In this very short post I wanna talk mention The Silver Searcher, which I just learned about a few weeks ago. In the past I have written quite a bit about the importance of credential hunting for your organization and some cool built-in operating system indexing features that can be used as well. Of course grep and findstr are also in every red teamers toolbox. As part of a coding project I recently learned about “The Silver Searcher”, which is very fast and has some neat features built it. It’s focus is source code searching.

Many Windows applications and services are implemented using an automation infrastructure called Component Object Model (COM). COM has been around for decades and its useful for programming, sharing of code at binary level, usage from scripting languages, and well, red teaming. Wide Usage of Component Object Model Many products are implemented as COM objects, including Microsoft Office. Using PowerShell (or other languages) COM objects can be created to fully automate applications and services.

Until the Apple Airtag came out a few months ago I hadn’t really looked into the tag tracking market. Turns out there were already quite a lot of offerings available before Apple joined the market, most notably Tile. However, I wanted to try out the Airtag and ended up ordering a few. This post will explore three things: Removing the speaker of my Airtag Using Browser APIs to scan for Airtags (if you don’t have an iPhone but someone tries to stalk you this might be handy) Explore data exfiltration via Airtags and Apple’s “Find My” network By the way, when you order your Airtags online you can customize them. So, I have some cool icons on mine, like this one:

This rather lengthy post goes into reasons for having an offensive security program and in particular, on how a red team can help improve the immune system of your organization. This is the high-level outline of the post: Security breaches cannot be entirely prevented Implications of a breach Automated malware can hit your organization at any time Security investments - run as fast as you can, just to stay in place The immune system of your organization Embracing the red With regular cadence companies are compromised and suffer breaches. Organizations do not realize a compromise until many days, months, sometimes even years later.

Recently Google’s FLoC proposal has been making the rounds in the news. FLoC stands for “federated learning of cohorts” and is Google’s vision how to perform user profiling in Chrome going forward. Currently user tracking and profiling happens (mostly) via cookies, but many browser vendors have been supportive of protection of their users and started blocking third party and tracking cookies - or at least offer features in their browser to enable blocking.

A nifty way for adversaries to acquire passwords during post-exploitation is to spoof credential dialogs and perform a local phishing attack. This means tricking a user on a compromised computer to enter their password. Unfortunately, users are conditioned to enter their credentials frequently and therefore don’t question random passwords prompts too much. Long, long time ago… but nothing has changed The idea to spoof a credential dialog is one of the most simple ideas one might come up with.