An information security blog by penetration tester and red teamer Jeff Dimmock. https://bluescreenofjeff.com https://bluescreenofjeff.com https://bluescreenofjeff.com/favicon.ico 64 64 I’ve written rather extensively about the use of redirectors and how they can strengthen your red team assessments. Since my first post on the topic, the question I’ve received most frequently is about how to do the same thing with HTTPS traffic. In this post, I will detail different HTTPS... Thu, 12 Apr 2018 00:00:00 +0000 https://bluescreenofjeff.com/2018-04-12-https-payload-and-c2-redirectors/ https://bluescreenofjeff.com/2018-04-12-https-payload-and-c2-redirectors/ Penetration tests and red team assessments often require operators to work multiple potential attack paths or perform multiple checks concurrently. Cultivating these myriad paths is what often leads operators to success in achieving their objectives. However, this execution method can also lead to an operator making a simple mistake, like... Tue, 23 Jan 2018 00:00:00 +0000 https://bluescreenofjeff.com/2018-01-23-cobalt-strike-opsec-profiles/ https://bluescreenofjeff.com/2018-01-23-cobalt-strike-opsec-profiles/ Covert red team attack infrastructure is a topic I’ve covered many times before, but always only in part. I’ve wanted to write about the thought process behind the design process of attack infrastructure for a while. In October, I had the privilege of covering that very topic at ArcticCon in... Tue, 05 Dec 2017 00:00:00 +0000 https://bluescreenofjeff.com/2017-12-05-designing-effective-covert-red-team-attack-infrastructure/ https://bluescreenofjeff.com/2017-12-05-designing-effective-covert-red-team-attack-infrastructure/ In a previous post, we (@Sw4mp_f0x and I) discussed the importance of data parsing skills for penetration testers and detailed the basics of how to get started with it. We covered a few tools, but only scraped the surface of what’s possible with two very powerful tools: awk and sed.... Tue, 03 Oct 2017 00:00:00 +0000 https://bluescreenofjeff.com/2017-10-03-f-awk-yeah-advanced-sed-and-awk-usage-parsing-for-pentesters-3/ https://bluescreenofjeff.com/2017-10-03-f-awk-yeah-advanced-sed-and-awk-usage-parsing-for-pentesters-3/ Malleable Command and Control (C2) profiles provide red teamers and penetration testers with a wealth of options to modify how Cobalt Strike both appears on the wire and on the compromised host. Malleable C2 can be used to impersonate actual threat actors or normal web traffic. As with every advancement... Wed, 30 Aug 2017 00:00:00 +0000 https://bluescreenofjeff.com/2017-08-30-randomized-malleable-c2-profiles-made-easy/ https://bluescreenofjeff.com/2017-08-30-randomized-malleable-c2-profiles-made-easy/ This post was co-written by Steve Borosh (@424f424f) and Jeff Dimmock (@bluscreenofjeff). Monitoring attack infrastructure can prove to be as important as our attacking. Quickly hiding from investigating blue teamers can mean the difference between keeping our interactive command and control (C2) sessions and burning our infrastructure. If you’ve read... Tue, 08 Aug 2017 00:00:00 +0000 https://bluescreenofjeff.com/2017-08-08-attack-infrastructure-log-aggregation-and-monitoring/ https://bluescreenofjeff.com/2017-08-08-attack-infrastructure-log-aggregation-and-monitoring/ As testers, we sometimes need some good, old-fashioned trial and error to get things working. Phishing is one of the attacks that commonly takes more than one attempt to get payloads and command and control (C2) working properly. This post covers how to help effectively perform payload trial and error... Tue, 13 Jun 2017 00:00:00 +0000 https://bluescreenofjeff.com/2017-06-13-serving-random-payloads-with-apache-mod_rewrite/ https://bluescreenofjeff.com/2017-06-13-serving-random-payloads-with-apache-mod_rewrite/ The Pass the Ticket (PtT) attack method uses a Kerberos ticket in place of a plaintext password or NTLM hash. Probably the most common uses of PtT are using Golden and Silver Tickets. Gaining access to a host via PtT is fairly straightforward; however, performing it through an SSH tunnel... Tue, 23 May 2017 00:00:00 +0000 https://bluescreenofjeff.com/2017-05-23-how-to-pass-the-ticket-through-ssh-tunnels/ https://bluescreenofjeff.com/2017-05-23-how-to-pass-the-ticket-through-ssh-tunnels/ A few weeks, ago I had the pleasure of participating on the Red Team for Pacific Rim CCDC. This is my third year doing the competition, and I feel like I have more fun each year. This year, I was on the Windows Meta Team and a Red Cell Team... Tue, 02 May 2017 00:00:00 +0000 https://bluescreenofjeff.com/2017-05-02-red-teaming-for-pacific-rim-ccdc-2017/ https://bluescreenofjeff.com/2017-05-02-red-teaming-for-pacific-rim-ccdc-2017/ In the (belated) spirit of April Fool’s Day, I wanted to slightly diverge from a strictly infosec topic and talk about something that can be used for good (work) or evil (trolling coworkers): Slack bots. Incoming WebHooks Incoming Webhooks allow external applications to post into Slack. The webhook processes HTTP... Tue, 11 Apr 2017 00:00:00 +0000 https://bluescreenofjeff.com/2017-04-11-slack-bots-for-trolls-and-work/ https://bluescreenofjeff.com/2017-04-11-slack-bots-for-trolls-and-work/ In a recent post, I detailed how to make a Malleable C2 profile for Cobalt Strike. Malleable C2 profiles provide an operator with the ability to shape how defenders will see, and potentially categorize, C2 traffic on the wire. Communication Profiles in Empire provide similar functionality. This increases our chances... Wed, 01 Mar 2017 00:00:00 +0000 https://bluescreenofjeff.com/2017-03-01-how-to-make-communication-profiles-for-empire/ https://bluescreenofjeff.com/2017-03-01-how-to-make-communication-profiles-for-empire/ It’s not fun to get caught on an assessment because your target has your toolset signatured. It’s even less fun if that signature is easily bypassed. Cobalt Strike’s Malleable C2 is a method of avoiding that problem when it comes to command and control (C2) traffic. Malleable C2 provides operators... Tue, 24 Jan 2017 00:00:00 +0000 https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/ https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/ Apache mod_rewrite provides conditional redirection and obfuscation to a red teamer’s infrastructure. I’ve previously written about mod_rewrite in a few posts. In this post, I will cover a few quick tricks you can use in conjunction with techniques from my earlier posts while phishing or red teaming. Be sure you... Fri, 23 Dec 2016 00:00:00 +0000 https://bluescreenofjeff.com/2016-12-23-apache_mod_rewrite_grab_bag/ https://bluescreenofjeff.com/2016-12-23-apache_mod_rewrite_grab_bag/ Tester flexibility and the ability to adapt to each environment’s unique controls and technologies is critical on assessments. Achieving an assessment’s objective often requires the use of multiple toolsets. Justin Warner (@sixdub) wrote about the importance of tool diversity in his post Empire & Tool Diversity: Integration is Key. Two... Tue, 29 Nov 2016 00:00:00 +0000 https://bluescreenofjeff.com/2016-11-29-beaconpire-cobalt-strike-and-empire-interoperability-with-aggressor-script/ https://bluescreenofjeff.com/2016-11-29-beaconpire-cobalt-strike-and-empire-interoperability-with-aggressor-script/ In a previous post, @Sw4mp_f0x and I discussed the importance of data parsing skills for penetration testers and detailed the basics of how to get started with it. In that post we covered multiple ways to match text and search for specific strings. The examples we used were pretty straightforward,... Fri, 14 Oct 2016 00:00:00 +0000 https://bluescreenofjeff.com/2016-10-14-black-magic-parsing-with-regular-expressions-parsing-for-pentesters/ https://bluescreenofjeff.com/2016-10-14-black-magic-parsing-with-regular-expressions-parsing-for-pentesters/ As pentesters and red teamers, we have lots of commands floating around in our head. As much as the 1337 profess to hate GUIs, they sure do make testing a lot easier. Cobalt Strike provides testers a lot of power with an easy-to-use interface. Aggressor Script offers a wealth of... Wed, 07 Sep 2016 00:00:00 +0000 https://bluescreenofjeff.com/2016-09-07-adding-easy-guis-to-aggressor-scripts/ https://bluescreenofjeff.com/2016-09-07-adding-easy-guis-to-aggressor-scripts/ Parsing data is a fundamental ability that anyone serious about information security should consider putting time and effort into understanding. It can mean the difference between spamming Ctrl+F in a text editor and pulling out exactly what you need with a Bash one-liner that took a couple of minutes to... Tue, 26 Jul 2016 00:00:00 +0000 https://bluescreenofjeff.com/2016-07-26-finding-diamonds-in-the-rough-parsing-for-pentesters/ https://bluescreenofjeff.com/2016-07-26-finding-diamonds-in-the-rough-parsing-for-pentesters/ Imagine you are performing a Red Team engagement. So far it’s been very hard, fighting tooth and nail to get each step closer to totally owning their network. You finally get internal network access and things are stable. Everything looks good on your end, but on the Blue side of... Tue, 28 Jun 2016 00:00:00 +0000 https://bluescreenofjeff.com/2016-06-28-cobalt-strike-http-c2-redirectors-with-apache-mod_rewrite/ https://bluescreenofjeff.com/2016-06-28-cobalt-strike-http-c2-redirectors-with-apache-mod_rewrite/ Six weeks ago I had the opportunity to Red Team for Pacific Rim CCDC. I love doing this competition because it gives me a chance to do things one would never be allowed to do on a real network and it forces me think about a different set of problems... Tue, 24 May 2016 00:00:00 +0000 https://bluescreenofjeff.com/2016-05-24-pacific-rim-ccdc_2016/ https://bluescreenofjeff.com/2016-05-24-pacific-rim-ccdc_2016/ On more than a few occasions phishing recipients have forwarded my phish to IT. The first indication is usually when I’m watching the access logs like a hawk and see multiple GET requests with a user’s token, yet haven’t received any credentials or beacon sessions. Sometimes it turns out the... Tue, 19 Apr 2016 00:00:00 +0000 https://bluescreenofjeff.com/2016-04-19-expire-phishing-links-with-apache-rewritemap/ https://bluescreenofjeff.com/2016-04-19-expire-phishing-links-with-apache-rewritemap/