☘️ { 𝔖𝔠𝔞𝔯𝔩𝔢𝔱𝔱𝔞'𝔰 𝔏𝔬𝔲𝔫𝔤𝔢 } ☘️

C2 Development in C# | ZeroPointSecurity 👍Getting Started 👍Team Server 👍Agent 👍Testing 👍Final Code

✔️

should i share for the dating game? maybe useful lessons

😈 Common Malicious Uses of PowerShell Attackers exploit PowerShell for various malicious purposes. Some of the most common activities include: ❌ Command-and-Control Operations: Attackers use PowerShell to execute commands on compromised systems remotely. ❌ Lateral Movement: PowerShell scripts help attackers move laterally within a network to compromise additional systems. ❌ Establishing Persistence: Attackers use PowerShell to ensure their malicious code remains on a system even after reboots. ❌ Credential Theft: PowerShell can extract and exfiltrate credentials from compromised systems. ❌ Data Exfiltration: Attackers use PowerShell to transfer stolen data out of the network. 🛑 How to stop this ? https://www.zdnet.com/article/nsa-cisa-say-dont-block-powershell-heres-what-to-do-instead/

🔴Click Connect, and you'll be prompted to enter the password we just decrypted. If you didn't save the password, you can repeat the steps to decrypt it from the instance page. 🔴When connecting, you'll be presented with a popup warning that the identity of the remote computer cannot be verified, simply click the Yes button, as we know what system we're connecting to. 🔴Once connected, we'll automatically get logged in as we've already provided the username and password for the RDP connection, and we're presented with the desktop! 👏 Congratulations, you've created your Windows Server VM (EC2) in AWS! In the next section, we'll cover how to stop your VM, take snapshots, and learn more about connection settings. ✍️ Note: If you are planning to build a local VM on a hypervisor (e.g., VMWare or Virtual Box), download the ISO file in the Materials section below. Windows 10 ISO: https://www.microsoft.com/en-us/software-download/windows10iso

Click Cancel, and use the Windows Start menu on your host PC to open Remote Desktop Connection. When the program opens, click Show Options in the bottom left, and click the "Open…" button, then select the .rdp file we just downloaded.

This will take us back to the previous page, and show the randomly-generated password. Copy this, and don't worry, we can change it later.

On this next page you'll need to upload the .pem file we downloaded earlier when we set the Key pair for this virtual machine, then click Decrypt password.

Select the "RDP client" tab, and download the remote desktop file using the button. Next, we need to decrypt the administrator password so we can log in. At the bottom of the page, click "Get password".

Connect to Your VM 📶 To connect to our Windows VM using Remote Desktop Protocol (RDP) to provide us with a graphical interface as if we're sitting at the computer, click the Connect button at the top of the page.

Below this section, we have several tabs, with each displaying relevant information. Take some time to review what these tabs tell us about the virtual machine!

In the Instance ID column, we can click the hyperlinked instance ID value to view that virtual machine. In the top section of this page, we are presented with lots of useful information, such as: 🔴The public IP address of our instance (in our case, 18.170.43.165) 🔴The instance state (which is now Running) 🔴The private IP address of our instance would be important if we're trying to connect multiple VMs to each other (in our case, 172.31.0.247)

Accessing the EC2 ✅ Open the left-hand navigation menu, and go to Instances > Instances. You'll be able to see your EC2 listed here. In the screenshot below, we can see our Instance state is "Pending", this is because our VM is still being provisioned, and will take a few minutes before it's ready.

And finally, we'll configure the storage. We'll leave this as the default value of 30 GB gp2.

This will download a file to your machine in the format (KeyPairNameHere).pem. Keep this file for later. For Network settings, we need to make a very important change. By default, the entire internet is able to connect to our EC2 using RDP (source IP of 0.0.0.0/0, referred to as "Anywhere"). We need to change this so only our IP address can RDP to the machine to ensure no one else gains access. On the dropdown, change this to "My IP" which will automatically grab your IP address.

Enter a name for the key pair, and leave the other settings as they are.

To access our EC2, we need to create a key pair so we can log in. We'll need this key pair to decrypt the administrator password so we can use Remote Desktop Protocol (RDP) to connect and log in to Windows. On the right-hand side, select Create new key pair.

After the OS, we need to select the instance type, which defines what resources that VM has. By default, the t2.micro free tier is displayed. If you don't want to pay, keep this set as t2.micro, or if you want a bigger VM, change this to t2.medium (or any type you want, just remember about the pricing!).