#hack100days — Public Fediverse posts

#hack100days Day 16. Watched Alh4zr3d's stream of taking a crack at TryHackMe's Red Team Capstone. #RedTeam #GetSmart

#hack100days Day 16. Watched Alh4zr3d's stream of taking a crack at TryHackMe's Red Team Capstone. #RedTeam #GetSmart

#hack100days Day 15, delayed. At a cybersecurity happy hour last night, spent some time brainstorming some techniques for "multiplexing" C2 or exfil. Runs the risk of re-implementing techniques from an app using UDP to cover dropped payloads, which runs risk of beacon bloat. Fun thought experiment. #RedTeam

#hack100days Day 15, delayed. At a cybersecurity happy hour last night, spent some time brainstorming some techniques for "multiplexing" C2 or exfil. Runs the risk of re-implementing techniques from an app using UDP to cover dropped payloads, which runs risk of beacon bloat. Fun thought experiment. #RedTeam

#hack100days Day 14. Slacked a bit over the weekend. Read up on Powershell, its relationship w/C#/.Net. Found some references to using C# to run powershell. Looked at msbuild.exe. I had a tab open talking about 'psattack', but the links to the GitHub page resulted in a 404. It looks like one could write a wrapper in C# that can call PowerShell w/out going through powershell.exe. Seems interesting. (Doing this because I didn't have enough time to bang around in CRTO lab.) #RedTeam #LOLBAS #PowerShell

#hack100days Day 14. Slacked a bit over the weekend. Read up on Powershell, its relationship w/C#/.Net. Found some references to using C# to run powershell. Looked at msbuild.exe. I had a tab open talking about 'psattack', but the links to the GitHub page resulted in a 404. It looks like one could write a wrapper in C# that can call PowerShell w/out going through powershell.exe. Seems interesting. (Doing this because I didn't have enough time to bang around in CRTO lab.) #RedTeam #LOLBAS #PowerShell

#hack100days Day 13. Busy day. Saw @securestep9 toot about #BugBountyTips that had this link: https://medium.com/@imshewale/complete-bug-bounty-recon-fundamentals-f283dee5c370 Checked it out and it has an extensive list of tools! So, reviewed that. Ran across a lot of familiar things and saw some new things, so that's useful.

#hack100days Day 13. Busy day. Saw @securestep9 toot about #BugBountyTips that had this link: https://medium.com/@imshewale/complete-bug-bounty-recon-fundamentals-f283dee5c370 Checked it out and it has an extensive list of tools! So, reviewed that. Ran across a lot of familiar things and saw some new things, so that's useful.

#hack100days Day 12. Spent some time on personal lab. Trying out Windows and UTM on MacBook Pro M2. Working on powershell version of ICMP exfil. #RedTeam

#hack100days Day 12. Spent some time on personal lab. Trying out Windows and UTM on MacBook Pro M2. Working on powershell version of ICMP exfil. #RedTeam

#hack100days Day 11. Compared and contrasted some "AI"s and their ability to generate code. Tested and confirmed some python3/scapy can send ICMP with a payload. Going to explore that some more tomorrow, along with a PowerShell version. Test will be using it as an exfiltration channel. #RedTeam

#hack100days Day 11. Compared and contrasted some "AI"s and their ability to generate code. Tested and confirmed some python3/scapy can send ICMP with a payload. Going to explore that some more tomorrow, along with a PowerShell version. Test will be using it as an exfiltration channel. #RedTeam

#hack100days Day 10. Back to #CRTO and the lab. More initial compromise and some host enumeration. #RedTeam #CobaltStrike

#hack100days Day 10. Back to #CRTO and the lab. More initial compromise and some host enumeration. #RedTeam #CobaltStrike

#hack100days Day 9. Got caught up on security newsletters. Pre-Ordered a copy of Evading EDR from No Starch Press by Matt Hand (https://nostarch.com/evading-edr).

#hack100days Day 9. Got caught up on security newsletters. Pre-Ordered a copy of Evading EDR from No Starch Press by Matt Hand (https://nostarch.com/evading-edr).

#hack100days Day 8. More time on #CRTO, finally got into the lab and worked on the Initial Compromise section. Got acquainted with [[https://github.com/dafthack/MailSniper|Mailsniper]]. (Reckon its utility is shrinking as OWA and Exchange install bases shrink.)

#hack100days Day 8. More time on #CRTO, finally got into the lab and worked on the Initial Compromise section. Got acquainted with [[https://github.com/dafthack/MailSniper|Mailsniper]]. (Reckon its utility is shrinking as OWA and Exchange install bases shrink.)

#hack100days Day 7. Spent more time on extending #CobaltStrike section of #CRTO. Grokking Aggressor Scripts are CS client extensions. Looked harder at Beacon Object Files, not sure if that's going to be important for the test, though. Found https://github.com/CCob/BOF.NET as a way to pull in some .Net, but it's not yet obvious to me how that works. Regardless. Must. Hit. The. Lab.

#hack100days Day 7. Spent more time on extending #CobaltStrike section of #CRTO. Grokking Aggressor Scripts are CS client extensions. Looked harder at Beacon Object Files, not sure if that's going to be important for the test, though. Found https://github.com/CCob/BOF.NET as a way to pull in some .Net, but it's not yet obvious to me how that works. Regardless. Must. Hit. The. Lab.

#hack100days Day 6. Revisited extending CS section. Definitely need to spend time with this stuff in the lab. Use of winapi could lead to trouble, so need to grok how to finesse that. Gotta hide from EDR.

#hack100days Day 6. Revisited extending CS section. Definitely need to spend time with this stuff in the lab. Use of winapi could lead to trouble, so need to grok how to finesse that. Gotta hide from EDR.

#hack100days Day 5. #StlCitySC was on tonight, so no CRTO lab. Revisited the ADCS section, though. Also did some AI prompting and looked at #Rust crates for ICMP. I am looking for a way to generate ICMP ECHO REPLY packets in #PowerShell or Rust. (Python isn't installed *everywhere*. Where I'm going has PowerShell or I can drop an executable.) This site is where I'm starting, but my rust skills are not yet strong.

#hack100days Day 5. #StlCitySC was on tonight, so no CRTO lab. Revisited the ADCS section, though. Also did some AI prompting and looked at #Rust crates for ICMP. I am looking for a way to generate ICMP ECHO REPLY packets in #PowerShell or Rust. (Python isn't installed *everywhere*. Where I'm going has PowerShell or I can drop an executable.) This site is where I'm starting, but my rust skills are not yet strong.

#hack100days Day 4. More CRTO. Revisited the material on application whitelisting and LOLBAS. The placement in the material is off-putting. Seems like covering this material hand-in-glove with initial access would make more sense. Shooting for banging around in the lab tomorrow.

#hack100days Day 4. More CRTO. Revisited the material on application whitelisting and LOLBAS. The placement in the material is off-putting. Seems like covering this material hand-in-glove with initial access would make more sense. Shooting for banging around in the lab tomorrow.

#hack100days Day 3. More CRTO. Re-reviewed material on defeating Defender. Thinking through if there's opportunities to incorporate some techniques learned from a couple of @[email protected] streams into the methodology. Maybe in the malleable C2 or in the Aggressor Scripts? More learnin' needed. #getSmart

#hack100days Day 3. More CRTO. Re-reviewed material on defeating Defender. Thinking through if there's opportunities to incorporate some techniques learned from a couple of @[email protected] streams into the methodology. Maybe in the malleable C2 or in the Aggressor Scripts? More learnin' needed. #getSmart

#hack100days Day 2. More CRTO w/harder look at pivot listeners and their payloads.

#hack100days Day 2. More CRTO w/harder look at pivot listeners and their payloads.

#hack100days Day 1. CRTO lab. Managing DNS is not my forte. Anyway, made some progress w/DNS and HTTP listeners.

#hack100days Day 1. CRTO lab. Managing DNS is not my forte. Anyway, made some progress w/DNS and HTTP listeners.

Have anti-pollen nose spray, will sit on porch and listen to birds singing and maple seeds hitting patio. Broke the #hack100days chain, so back to it w/CRTO.

Have anti-pollen nose spray, will sit on porch and listen to birds singing and maple seeds hitting patio. Broke the #hack100days chain, so back to it w/CRTO.

#hack100days : day 80 : Fell off the wagon for a couple of days. Then a post (https://cyberplace.social/@GossiTheDog/110100144318003862) from @GossiTheDog crossed my feeds. #ThreatHuntThursday is on. Did some digging in Defender ATH and it looks like some linux commands get logged in Defender--I searched for sudo. The install will show up as a wsl.exe command with the image passed as a parameter. So, it looks like there are some detective controls available if you weren't expecting the user population to be utilizing WSL. Gonna poke at it some more tomorrow.

#hack100days : day 79 : More CRTO. Read a bit about C2 profiles for v4 of CS: https://infosecwriteups.com/red-team-cobalt-strike-4-0-malleable-c2-profile-guideline-eb3eeb219a7c No time in the lab, which is lame. #GetSmart #CRTO #PimumNonNocere

#hack100days : day 78 : Worked on CRTO. Spent some time in the lab. Got some results I expected. Got some I didn't. Fleshed out notes. #GetSmart #CRTO #PrimumNonNocere

#hack100days : day 77 : Pollen season, rainy day, and coding hang-over triple-whammy. Got caught up on @thegrugq newsletters, had a bourbon, and I'm off to read another chapter on #rust.

#hack100days: day 76 : In baseball, bat .333 and you're in the hall of fame. Got some #PowerShell done. My comfort with it is increasing. ChatGPT is working well as a "debug buddy". Hunting will wait until tomorrow, along w/CRTO. #AmCoding

#hack100days: day 75 : Yesterday and today were vacation days. Got a new MacBook yesterday, so part of yesterday and today was setting it up. Giving UTM a shot. Spun up a MacOS vm and a Kali vm. The MacOS locks up now and again, so that's no bueno. I'd like that to be be my ctf attacking host. Off to read another chapter on Rust before sleep and back to work tomorrow. Tomorrow shall be some hunting, PowerShell, and time on CRTO lab.

#hack100days: day 74 : (D'oh. Yesterday was actually day 73.) Restarted the CRTO modules. Signed up for the lab. Working through the material and building out notes for the exam. #RedTeam #CRTO #GetSmart

#hack100days: day 72 : (yesterday I watched soccer.) Finished up the CRTO modules. Time to sign up for the lab and go through it again. #RedTeam #CRTO #PrimumNonNocere

#hack100days : day 72 : CRTO today. Eighty percent through first pass. Goal is to get through it over the weekend and start hitting the lab next week. #RedTeam #CRTO #PrimumNonNocere

#hack100days: day 71 : Moar #powershell! Sorted a couple of functions. Figured out how to create an object to store the data in and to spit it out as a json "blob". Need to focus on getting the first MVP done and worry about edge-cases later.

#hack100days: day 71 : Moar #powershell! Sorted a couple of functions. Figured out how to create an object to store the data in and to spit it out as a json "blob". Need to focus on getting the first MVP done and worry about edge-cases later.

#hack100days : day 70 : Today was a day of json and powershell. Took a different approach than I usually do. Started with laying out a json schema for all the data elements I want. Then backed into into functions and code. I've coded in ksh and bash for so long, I'm more used to doing the functions first. This is more interesting, because now I hunt for LOLBAS to get the data. #redteam #LolBas

#hack100days : day 70 : Today was a day of json and powershell. Took a different approach than I usually do. Started with laying out a json schema for all the data elements I want. Then backed into into functions and code. I've coded in ksh and bash for so long, I'm more used to doing the functions first. This is more interesting, because now I hunt for LOLBAS to get the data. #redteam #LolBas

#hack100days : day 69 : Forgot to post last night. Watched @alh4zr3d @[email protected] "Newbie Tuesday" stream. Biggest take-away was older Logitech wireless devices speak wifi. So, "BadUSB"/RubberDucky is in-play during physical tests: https://github.com/insecurityofthings/jackit/tree/master/jackit #redteam

#hack100days : day 69 : Forgot to post last night. Watched @alh4zr3d @[email protected] "Newbie Tuesday" stream. Biggest take-away was older Logitech wireless devices speak wifi. So, "BadUSB"/RubberDucky is in-play during physical tests: https://github.com/insecurityofthings/jackit/tree/master/jackit #redteam

#hack100days : day 68 : Watched some #rust videos by @valhalla_dev Watched him go over some chapters out of the Rust Book and a couple of videos on malware dev. #redteam #GetSmart

#hack100days : day 68 : Watched some #rust videos by @valhalla_dev Watched him go over some chapters out of the Rust Book and a couple of videos on malware dev. #redteam #GetSmart

#hack100days : day 67 : Read another chapter #rust. This one hurt my brain and will need to be revisited. #getsmart

#hack100days : day 66 : Took a crack at #HackTheBox new release, Inject. I've gotten rusty.

#hack100days : day 65 : Kept chipping away at _Rust_Programming. Took at look at Defender and Advanced Threat. Created a query for finding admin users modifying registry run keys. I'm a fan of the 'project' command to grab only the columns I care about. #GetSmart

#hack100days : day 64 : read another chapter of _Rust_Programming_… Site visit today, learning and relearning about processes and tech used to make the firm money. Thinking hard about attack paths and drafting possibles exercises. #redteam #getsmart

#hack100days : day 63 : Lots of context switching today, articles, newsletters, and such. Going to unplug and finish another chapter of _Rust_Programming_Language_. #GetSmart

#hack100days : day 62 : Wasn't up for it yesterday, took a sick day. Did some poking around at a recent CVE. Not going to share which one at this time. Led to another thread, though. Something that could lead to finding weird... Look for instances of the Windows process WerFault.exe starting. What was the parent process? What was the user id for the process? You may find something that is well broken and needs fixing--that cleans up log files--or something that needs further research. #ThreatHunting #BlueTeam

#hack100days : day 61 : Another light day. Read articles and another chapter in _Rust Programming Language_--was reminded to keep up on that via link from a @thegrugq newsletter to @buttplug.io (@twitter) thread, leading to @m_ou_se@twitter presence talking about her book _Rust Atomics and Locks_ (which is available at https://marabos.nl/atomics/, so I have some more reading and coding to do... #GetSmart #Rust

#hack100days : day 60 : Another section of CRTO done. Learned more about MSFT's Data Protection API, which was new to me. Otherwise, it was light today. #GetSmart

#hack100days : day 59 : Two more sections of CRTO down. Tuned the registry run key search in Defender ATH. Noisy bugger, going to take some work to sort out "normal". Seems like a good place to hide for long-haul persistence. #RedTeam #BlueTeam