thesubtlety

Natlas/Docker Install

https://github.com/natlas/natlas/blob/main/natlas-server#installation-production https://github.com/natlas/natlas/blob/main/natlas-agent#installation-production

You should probably read the above instructions but if you just want to get up and running, this should do it.

Install Docker, configure directories

apt install docker.io

thesubtlety

function Get-GroupsRec {
  [CmdletBinding()] 
  param 
  (
  [Parameter(Mandatory)] 
  [string]$User 
  )
 
  $dn = (Get-ADUser $User).DistinguishedName
  Get-ADGroup -LDAPFilter ("(member:1.2.840.113556.1.4.1941:={0})" -f $dn) | select -expand Name | sort Name

thesubtlety

# CNA script to alert on dead beacons. Doesn't repeat messages.
# author: noah @thesubtlety
# credit https://github.com/bluscreenofjeff/AggressorScripts/blob/master/stale-beacon-notifier.cna - bluescreenofjeff

$webhook_url = "https://hooks.slack.com/services/xxxxx";
$slack_channel = "#crackers";
%beacon_status = %();

# default stale value of 5 minutes (300000ms)
$stale_value = 300000;

thesubtlety

#!/usr/bin/env ruby

require 'base64'
require 'digest'
require 'openssl'

# Author: @thesubtlety
# Decrypts Jenkins 2 encrypted strings, code change introduced around Jenkins ver 2.44
# Based off work by juyeong, https://gist.github.com/juyeong/081379bd1ddb3754ed51ab8b8e535f7c

thesubtlety

Rundeck Compromise

Reference notes to run commands on nodes controlled by Rundeck given a valid API token.

RUNDECK="https://host"
TOKEN="x-rundeck-auth-token:<secret>"

# Identify projects
curl -H $TOKEN $RUNDECK/api/16/projects/ -H accept:application/json | jq  .

thesubtlety

[List.Rules:Try]
cAz"[0-9]"
cAz"[£!$@#-=_]"
cAz"[0-9][0-9]"
cAz"[0-9][£!$@#-=_]"
cAz"[£!$@#-=_][0-9]"
cAz"[0-9][0-9][0-9]"
cAz"[0-9][0-9][0-9][0-9]"
cA0"[0-9]"
cA0"[£!$@#-=_]"

thesubtlety

Let's turn Any .NET Application into an LOL Bin

We can do this by experimenting with .config files.

Many defenders catch/detect files that are renamed, they do this by matching Original Filename to Process Name

In this example, we don't have to rename anything. We simple coerce a trusted signed app to load our Assembly.

We do this by directing the application to read a config file we provide.

thesubtlety

#!/usr/bin/env python3

import os
import sys
import time
import shodan
import netaddr
import ipaddress

'''

thesubtlety

function Get-Exports {
<#
.SYNOPSIS
Get-Exports, fetches DLL exports and optionally provides
C++ wrapper output (idential to ExportsToC++ but without
needing VS and a compiled binary). To do this it reads DLL
bytes into memory and then parses them (no LoadLibraryEx).
Because of this you can parse x32/x64 DLL's regardless of
the bitness of PowerShell.

thesubtlety

#import <Foundation/Foundation.h>
#import <Appkit/AppKit.h>
#import <CoreFoundation/CoreFoundation.h>
#import <OSAKit/OSAKit.h>
#import <Cocoa/Cocoa.h>
#import <OSAKit/OSALanguage.h>
#import <Foundation/NSString.h>
#include <string.h>

//jxarunner file.js