
By Adam Rose Recently, I was troubleshooting some Cobalt Strike C2 infrastructure in a Windows VM lab. To get a deeper understanding of the bugs I
Continue Reading
In the previous PersistAssist post, we looked at how to create a new persistence module to automate backdooring a PSProfile at a user level. In this
Continue ReadingBy Adam Rose - During recent research into C2 traffic redirection techniques, we found the process of manually editing serverless cloud function code and configuration files
Continue Reading
IntroductionIn a previous article Maldoc Transfers in the Google Cloud, I wrote about using a Google Cloud Provider serverless function to serve malicious documents from a
Continue Reading
IntroductionTwo years ago I decided I wanted to be a penetration tester. Judging by the hundreds of posts I see on subreddits and Discord servers, this
Continue Reading
On a recent red team engagement, we faced the challenge of serving a backdoored Excel document as part of a social engineering campaign against an environment
Continue Reading
In our previous blog post, we introduced PersistAssist and briefly covered how to extend it. In this post, we'll go into more detail and walk through
Continue Reading
We've been on penetration tests before and have found the need to find a system that doesn't have a user currently logged in. Why, you might
Continue Reading
Persistence is a vital aspect of a pentest or red team and ensures you don't lose your access after you've worked so hard to get it.
Continue Reading
On a penetration test, we were performing for a customer, an odd scenario popped up, which caused us to write some code. We found an account
Continue Reading
tl;dr: Quickly and easily convert your raw binary output from Cobalt Strike (or any other source) into a variety of shellcode formats with either script
Continue Reading
tl;dr: Python script that automates removing comments and newlines from PowerShell scripts https://github.com/FortyNorthSecurity/RandomScripts/blob/main/Cobalt Scripts/remove_comments.py It's
Continue Reading
tl;dr If you want an updated and working copy of httpsc2doneright, grab it here - https://github.com/FortyNorthSecurity/RandomScripts/blob/main/Cobalt Scripts/httpsc2doneright.
Continue Reading
Are you ready for further C2Concealer customization? Let's dive in.
Continue Reading
About a year ago, we publicly released our C2 malleable profile generator for Cobalt Strike, C2Concealer. You can read the initial blog post here. In the
Continue Reading
There's many different techniques that an offensive security professional could use to try to have their code avoid detection by various AV and EDR products. Various
Continue Reading
Check out our repo which has multiple F# injection routines, evasion techniques, and an unmanaged F# loader.
Continue Reading
Before we begin, I know, yet another "guide to creating a hash cracker in [insert popular cloud service here]". Well, I was on a
Continue Reading
PowerView is by and far the defacto domain enumeration tool. We still use it on assessments and will likely do so where appropriate in the future.
Continue Reading
This is the last part in the three part series on CIMplant. If you haven't seen the previous two, you can find them here: CIMplant Part
Continue Reading
Penetration testing and other offensive cybersecurity assessments form an important component of most enterprise information security programs; indeed, many cybersecurity frameworks, such as PCI, require the
Continue Reading
In the second part of our CIMplant series we'll take a deeper dive into the code of CIMplant and go over some of the more interesting
Continue Reading
Introduction Windows Management Instrumentation (WMI) has been around for several years as a way to gather information from and manage remote or local computers. WMImplant written
Continue Reading
Domain fronting has been around for some time now. It has its legitimate use cases for bypassing censorship along with use by pen testers, red teams,
Continue Reading
What would you say the difference between an "operational" summary and an "executive" summary is? Find out our take on it in this quick read.
Continue Reading