#crto — Public Fediverse posts

I’ve just published the second guide (out of three I’m going to publish on Crystal Palace, and in this case on Mythic C2. The first one is the one I published a few days ago, which breaks down Crystal Palace in great detail), with this one focusing more on Mythic C2, Xenon Agent and how I apply ‘Crystal Palace’ within this infrastructure.

In this guide, I don’t explain how I bypass EDRs, but rather how Mythic actually works, as it’s a really interesting project for long-term personal and business C2 set-ups, and how the link with Crystal Palace works at a logical level.

Finally, in the last piece of documentation, due out in a couple of days, I’ll tackle the subject of that infamous loader that I think we all hate. I’ll speak from my own experience and because I use Rust covering what I’ve learnt from Altered Security CETP and Zero-Point Security Ltd CRTL, as well as my personal preferences.

In the meantime, here’s the link and a diagram that more or less represents (IN A VERY SIMPLIFIED, EXTREMELY SUMMARISED AND CONCISE WAY) a current workflow using Mythic to evade, in my case, Elastic 9.4.2, MDE and CrowdStrike (I do miss having a CrowdStrike licence; mine ran out a month and a half ago 😭 )

(The documentation is in Spanish.:) )

https://fallenangel666-blog.pages.dev/posts/mythic-c2-xenon-y-crystal-palace

#Malware #CRTO #CRTL #ciberseguridad #hacking #windows #cybersecurity #RedTeam #kernel #C2 #mythicc2 #cobaltstrike #ring0

https://www.europesays.com/lu/6460/ Criteo targets Luxembourg redomicile; U.S. move possible in 2027 | CRTO SEC Filing #Criteo #CRTO #DirectListing #FormS4 #Luxembourg #redomiciliation #TaxRate

Criteo targets Luxembourg redomicile; U.S. move possible in 2027 | CRTO SEC Filing

Filed by Criteo S.A. pursuant to Rule 425 under the Securities Act of 1933 and deemed filed pursuant…
#Luxembourg #Luxemburg #LU #Europe #Europa #EU #criteo #CRTO #directlisting #FormS-4 #Lëtzebuerg #luxembourg #redomiciliation #taxrate
https://www.europesays.com/2971023/

Criteo targets Luxembourg redomicile; U.S. move possible in 2027 | CRTO SEC Filing https://www.byteseu.com/1997065/ #Criteo #CRTO #DirectListing #FormS4 #Luxembourg #redomiciliation #TaxRate

That's how it ends, with the #CRTO certificate. One of he best courses I attended so far!

That's how it ends, with the #CRTO certificate. One of he best courses I attended so far!

That's how it ends, with the #CRTO certificate. One of he best courses I attended so far!

So it began, the journey to #CRTO

So it began, the journey to #CRTO

So it began, the journey to #CRTO

Got in some practice "pillaging" DPAPI. Next, more lateral movement practice. #CRTO #GetSmart

Got in some practice "pillaging" DPAPI. Next, more lateral movement practice. #CRTO #GetSmart

Got in some practice "pillaging" DPAPI. Next, more lateral movement practice. #CRTO #GetSmart

Got in some practice "pillaging" DPAPI. Next, more lateral movement practice. #CRTO #GetSmart

Got in some practice "pillaging" DPAPI. Next, more lateral movement practice. #CRTO #GetSmart

Phishing bit worked. Need to rework the persistence. First crack didn't work as expected. #CRTO #GetSmart #PracticeMakesPerfect

Phishing bit worked. Need to rework the persistence. First crack didn't work as expected. #CRTO #GetSmart #PracticeMakesPerfect

Phishing bit worked. Need to rework the persistence. First crack didn't work as expected. #CRTO #GetSmart #PracticeMakesPerfect

Phishing bit worked. Need to rework the persistence. First crack didn't work as expected. #CRTO #GetSmart #PracticeMakesPerfect

Phishing bit worked. Need to rework the persistence. First crack didn't work as expected. #CRTO #GetSmart #PracticeMakesPerfect

Gone Phishing #beautifulDay #CRTO #GetSmart

Gone Phishing #beautifulDay #CRTO #GetSmart

Gone Phishing #beautifulDay #CRTO #GetSmart

Gone Phishing #beautifulDay #CRTO #GetSmart

Gone Phishing #beautifulDay #CRTO #GetSmart

We are thrilled to announce that #AdversaryWars #AdversaryVillageCTF at @defcon 31 has secured a Gold sponsorship from Zero-Point Security and RastaMouse, the creator of the awesome #CRTO #RedTeamOps #AdversarySimulation course.
We extend our heartfelt gratitude to #ZeroPointSecurity and Rasta for their unwavering support to the #AdversaryVillage community.

For more information, please visit our webpage: https://adversaryvillage.org/adversary-events/DEFCON-31/
Learn more about Zero-Point Security training: https://training.zeropointsecurity.co.uk

#PurpleTeam #BreachSimulation #BAS #AdversaryTactics #DEFCON31 #AdversaryEmulation #AdversaryMindset #AdversaryTradecraft #CTF #AdversaryWarsCTF #DEFCON

We are thrilled to announce that #AdversaryWars #AdversaryVillageCTF at @defcon 31 has secured a Gold sponsorship from Zero-Point Security and RastaMouse, the creator of the awesome #CRTO #RedTeamOps #AdversarySimulation course.
We extend our heartfelt gratitude to #ZeroPointSecurity and Rasta for their unwavering support to the #AdversaryVillage community.

For more information, please visit our webpage: https://adversaryvillage.org/adversary-events/DEFCON-31/
Learn more about Zero-Point Security training: https://training.zeropointsecurity.co.uk

#PurpleTeam #BreachSimulation #BAS #AdversaryTactics #DEFCON31 #AdversaryEmulation #AdversaryMindset #AdversaryTradecraft #CTF #AdversaryWarsCTF #DEFCON

We are thrilled to announce that #AdversaryWars #AdversaryVillageCTF at @defcon 31 has secured a Gold sponsorship from Zero-Point Security and RastaMouse, the creator of the awesome #CRTO #RedTeamOps #AdversarySimulation course.
We extend our heartfelt gratitude to #ZeroPointSecurity and Rasta for their unwavering support to the #AdversaryVillage community.

For more information, please visit our webpage: https://adversaryvillage.org/adversary-events/DEFCON-31/
Learn more about Zero-Point Security training: https://training.zeropointsecurity.co.uk

#PurpleTeam #BreachSimulation #BAS #AdversaryTactics #DEFCON31 #AdversaryEmulation #AdversaryMindset #AdversaryTradecraft #CTF #AdversaryWarsCTF #DEFCON

We are thrilled to announce that #AdversaryWars #AdversaryVillageCTF at @defcon 31 has secured a Gold sponsorship from Zero-Point Security and RastaMouse, the creator of the awesome #CRTO #RedTeamOps #AdversarySimulation course.
We extend our heartfelt gratitude to #ZeroPointSecurity and Rasta for their unwavering support to the #AdversaryVillage community.

For more information, please visit our webpage: https://adversaryvillage.org/adversary-events/DEFCON-31/
Learn more about Zero-Point Security training: https://training.zeropointsecurity.co.uk

#PurpleTeam #BreachSimulation #BAS #AdversaryTactics #DEFCON31 #AdversaryEmulation #AdversaryMindset #AdversaryTradecraft #CTF #AdversaryWarsCTF #DEFCON

We are thrilled to announce that #AdversaryWars #AdversaryVillageCTF at @defcon 31 has secured a Gold sponsorship from Zero-Point Security and RastaMouse, the creator of the awesome #CRTO #RedTeamOps #AdversarySimulation course.
We extend our heartfelt gratitude to #ZeroPointSecurity and Rasta for their unwavering support to the #AdversaryVillage community.

For more information, please visit our webpage: https://adversaryvillage.org/adversary-events/DEFCON-31/
Learn more about Zero-Point Security training: https://training.zeropointsecurity.co.uk

#PurpleTeam #BreachSimulation #BAS #AdversaryTactics #DEFCON31 #AdversaryEmulation #AdversaryMindset #AdversaryTradecraft #CTF #AdversaryWarsCTF #DEFCON

#hack100days Day 10. Back to #CRTO and the lab. More initial compromise and some host enumeration. #RedTeam #CobaltStrike

#hack100days Day 10. Back to #CRTO and the lab. More initial compromise and some host enumeration. #RedTeam #CobaltStrike

#hack100days Day 10. Back to #CRTO and the lab. More initial compromise and some host enumeration. #RedTeam #CobaltStrike

#hack100days Day 10. Back to #CRTO and the lab. More initial compromise and some host enumeration. #RedTeam #CobaltStrike

#hack100days Day 10. Back to #CRTO and the lab. More initial compromise and some host enumeration. #RedTeam #CobaltStrike

#hack100days Day 8. More time on #CRTO, finally got into the lab and worked on the Initial Compromise section. Got acquainted with [[https://github.com/dafthack/MailSniper|Mailsniper]]. (Reckon its utility is shrinking as OWA and Exchange install bases shrink.)

#hack100days Day 8. More time on #CRTO, finally got into the lab and worked on the Initial Compromise section. Got acquainted with [[https://github.com/dafthack/MailSniper|Mailsniper]]. (Reckon its utility is shrinking as OWA and Exchange install bases shrink.)

#hack100days Day 8. More time on #CRTO, finally got into the lab and worked on the Initial Compromise section. Got acquainted with [[https://github.com/dafthack/MailSniper|Mailsniper]]. (Reckon its utility is shrinking as OWA and Exchange install bases shrink.)

#hack100days Day 8. More time on #CRTO, finally got into the lab and worked on the Initial Compromise section. Got acquainted with [[https://github.com/dafthack/MailSniper|Mailsniper]]. (Reckon its utility is shrinking as OWA and Exchange install bases shrink.)

#hack100days Day 8. More time on #CRTO, finally got into the lab and worked on the Initial Compromise section. Got acquainted with [[https://github.com/dafthack/MailSniper|Mailsniper]]. (Reckon its utility is shrinking as OWA and Exchange install bases shrink.)

Cleared my #CRTO Red Team Operator exam this week from Zero Point Security. Great course and exam experience!

#hack100days Day 7. Spent more time on extending #CobaltStrike section of #CRTO. Grokking Aggressor Scripts are CS client extensions. Looked harder at Beacon Object Files, not sure if that's going to be important for the test, though. Found https://github.com/CCob/BOF.NET as a way to pull in some .Net, but it's not yet obvious to me how that works. Regardless. Must. Hit. The. Lab.

#hack100days Day 7. Spent more time on extending #CobaltStrike section of #CRTO. Grokking Aggressor Scripts are CS client extensions. Looked harder at Beacon Object Files, not sure if that's going to be important for the test, though. Found https://github.com/CCob/BOF.NET as a way to pull in some .Net, but it's not yet obvious to me how that works. Regardless. Must. Hit. The. Lab.

#hack100days Day 7. Spent more time on extending #CobaltStrike section of #CRTO. Grokking Aggressor Scripts are CS client extensions. Looked harder at Beacon Object Files, not sure if that's going to be important for the test, though. Found https://github.com/CCob/BOF.NET as a way to pull in some .Net, but it's not yet obvious to me how that works. Regardless. Must. Hit. The. Lab.

#hack100days Day 7. Spent more time on extending #CobaltStrike section of #CRTO. Grokking Aggressor Scripts are CS client extensions. Looked harder at Beacon Object Files, not sure if that's going to be important for the test, though. Found https://github.com/CCob/BOF.NET as a way to pull in some .Net, but it's not yet obvious to me how that works. Regardless. Must. Hit. The. Lab.

#hack100days Day 7. Spent more time on extending #CobaltStrike section of #CRTO. Grokking Aggressor Scripts are CS client extensions. Looked harder at Beacon Object Files, not sure if that's going to be important for the test, though. Found https://github.com/CCob/BOF.NET as a way to pull in some .Net, but it's not yet obvious to me how that works. Regardless. Must. Hit. The. Lab.

#hack100days : day 79 : More CRTO. Read a bit about C2 profiles for v4 of CS: https://infosecwriteups.com/red-team-cobalt-strike-4-0-malleable-c2-profile-guideline-eb3eeb219a7c No time in the lab, which is lame. #GetSmart #CRTO #PimumNonNocere

#hack100days : day 79 : More CRTO. Read a bit about C2 profiles for v4 of CS: https://infosecwriteups.com/red-team-cobalt-strike-4-0-malleable-c2-profile-guideline-eb3eeb219a7c No time in the lab, which is lame. #GetSmart #CRTO #PimumNonNocere

#hack100days : day 79 : More CRTO. Read a bit about C2 profiles for v4 of CS: https://infosecwriteups.com/red-team-cobalt-strike-4-0-malleable-c2-profile-guideline-eb3eeb219a7c No time in the lab, which is lame. #GetSmart #CRTO #PimumNonNocere

#hack100days : day 78 : Worked on CRTO. Spent some time in the lab. Got some results I expected. Got some I didn't. Fleshed out notes. #GetSmart #CRTO #PrimumNonNocere

#hack100days : day 78 : Worked on CRTO. Spent some time in the lab. Got some results I expected. Got some I didn't. Fleshed out notes. #GetSmart #CRTO #PrimumNonNocere

#hack100days : day 78 : Worked on CRTO. Spent some time in the lab. Got some results I expected. Got some I didn't. Fleshed out notes. #GetSmart #CRTO #PrimumNonNocere

#hack100days: day 74 : (D'oh. Yesterday was actually day 73.) Restarted the CRTO modules. Signed up for the lab. Working through the material and building out notes for the exam. #RedTeam #CRTO #GetSmart

#hack100days: day 74 : (D'oh. Yesterday was actually day 73.) Restarted the CRTO modules. Signed up for the lab. Working through the material and building out notes for the exam. #RedTeam #CRTO #GetSmart

#hack100days: day 74 : (D'oh. Yesterday was actually day 73.) Restarted the CRTO modules. Signed up for the lab. Working through the material and building out notes for the exam. #RedTeam #CRTO #GetSmart

#hack100days: day 72 : (yesterday I watched soccer.) Finished up the CRTO modules. Time to sign up for the lab and go through it again. #RedTeam #CRTO #PrimumNonNocere

#hack100days: day 72 : (yesterday I watched soccer.) Finished up the CRTO modules. Time to sign up for the lab and go through it again. #RedTeam #CRTO #PrimumNonNocere

#hack100days: day 72 : (yesterday I watched soccer.) Finished up the CRTO modules. Time to sign up for the lab and go through it again. #RedTeam #CRTO #PrimumNonNocere

#hack100days : day 72 : CRTO today. Eighty percent through first pass. Goal is to get through it over the weekend and start hitting the lab next week. #RedTeam #CRTO #PrimumNonNocere

#hack100days : day 72 : CRTO today. Eighty percent through first pass. Goal is to get through it over the weekend and start hitting the lab next week. #RedTeam #CRTO #PrimumNonNocere