Pentesting & Exploit Dev
Blog Contributors: Adeeb Shah @hyd3sec & John Jackson(@johnjhacking) About A while ago I took up the challenge to get Offensive Security Web Expert (OSWE) certified. During this journey I learned many awesome things. The most important lesson learned was that with source code and a debugger, I could find vulnerabilities exponentially faster than by using traditional Blackbox/Bug-Bounty methods.…
Overview This is a walkthrough of creating the Cobalt Strike Beacon Object File (BOF) “Where Am I?” This idea was inspired by Matt Eidelberg’s DEF CON 29 talk Operation Bypass Catch My Payload If You Can . In this talk, Matt shows how EDR heuristics can detect Cobalt Strike beacons based on their behavior. Matt uses an example where after the beacon compromises the endpoint, the first thing it…
Blog Contributors: Bobby Cooke(Boku/@0xBoku) , Stephan Borosh(rvrsh3ll/@424f424f) , Adeeb Shah(@hyd3sec) , Octavio Paguaga(@oakTree__) , John Jackson(@johnjhacking) , Matt Kingstone(@n00bRage) , Jose Plascencia(@_GRIM3_) TokenTactics Creators: Bobby Cooke(Boku/@0xBoku) , Stephan Borosh(rvrsh3ll/@424f424f) Shout-Outs: Charles Hamilton (@Mr.Un1k0d3r) , Dr. Nestori Syynimaa(@DrAzureAD) , Nikhil…
Overview Techniques gathered to bypass PHP file upload filters.
Overview The second part of the first assignment of SLAE64 was to remove the nulls from the bindshell provided by Pentester Academy. Compiling & Testing Original - With GCC in C Host Program root@zed# ./shellcode Shellcode Length: 2 We can see here that these nulls truncate our shellcode when executed in a host program. This is because \x00 will terminate a string in the host program. Most of the…
Overview The second part of the second assignment of SLAE64 was to remove the nulls from the reverse-shell provided by Pentester Academy. Compiling & Testing Original - With NASM & LD The shellcode works great if it is compiled and ran as its own program. This means the shellcode logic is good. Terminal 1 Start a netcat listener on port 4444 before executing the shellcode. root# nc -nvlp 4444…
Overview For the seventh assignment of the SLAE64, I created an Add Cryptor and a companion Sub Decryptor. Any shellcode or encryption key can be placed in the python Add Cryptor. The Add Cryptor will output an assembly file decrypt.asm . This assembly file is shellcode that will decrypt the payload in memory and then execute it. Contents 1. The Python Cryptor 2. Configurable Payload 3.…
Overview For the third assignment of the SLAE64 course I created a 64 bit egghunter. To check if the memory is readable, the egghunter uses the link() system call. The egghunter scans the hosts process memory, byte by byte, in search for the egg. Once the egghunter finds the egg, it will check to see if there is 2 eggs or only one instance of the egg. If there is only 1 instance of the egg, then…
Overview For the fourth assignment of the SLAE64 I created a Rotate Left (ROL) Encoder and a Rotate Right (ROR) decoder. The ROL encoder is a python program that rotates every byte of the payload to the left by 1 bit. The companion ROR decoder rotates every byte of the payload to the right by 1 bit, and then passes execution to the decoded payload. The example payload is an execve shellcode that…
Overview For the fifth assignment of the SLAE64, I analyzed three payloads from msfvenom. This is the third payload, linux/x64/shell_bind_tcp . Bind Shell Anaylsis We will be analyzing the msfvenom non-staged bind shell payload. Generating the MSFVenom Payload Here we generate the payload on Kali Linux and output it to the C format. This allows us to easy add it to our host shellcode.c program.…