Cube0x0

-founder
🇸🇪

[Andrea P @decoder_it]

I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic. ➡️https://t.co/OztMeuoU5L

[Cube0x0 @cube0x0]

@ShitSecure Nice! Totally missed that one
Thanks for sharing

[Cube0x0 @cube0x0]

If you wanna do it in c#, merge this with the og krbrelay https://github[.]com/CICADA8-Research/RemoteKrbRelay

[Andrew Oliveau @AndrewOliveau]

RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM authentications via DCOM. Remotely compromise users without moving laterally or touching LSASS.

Hope you enjoy the blog & tool drop 🤟

https://t.co/ch9WuSP6bm

[Cube0x0 @cube0x0]

@passthehashbrwn Make it 8 and you'll qualify for hosting your training at defcon!

[Cube0x0 @cube0x0]

I asked myself, how difficult would it be to run a 0xC2 agent in a non-rooted Samsung phone, via an APK installation, and use it for lateral movement

Turns out, not very difficult at all

[Andrea P @decoder_it]

M'm glad to release the tool I have been working hard on the last month: #KrbRelayEx
A Kerberos relay & forwarder for MiTM attacks!
>Relays Kerberos AP-REQ tickets
>Manages multiple SMB consoles
>Works on Win& Linux with .NET 8.0
>...
GitHub: https://t.co/zoN2fX6Hsc

[Cube0x0 @cube0x0]

@MarcOverIP @OutflankNL 🤝

[Cube0x0 @cube0x0]

@_RastaMouse it already existed when i wrote the convert script back in January
@mcbroom_evan did a great job with https://t.co/PonkbD2Rd4

[Cube0x0 @cube0x0]

I have received a few questions about reusing existing open-source and in-house BOFs in 0xC2 so I am leaving it here for visibility.

Yes the 0xC2 Windows agent has a backward-compatible layer so you can reuse your existing object file tools after converting the Sleep script to Lua. To help with that we have provided a script that translates your Sleep code to AST and then AST to Lua. It's not 1:1 but helps with 90+% of the work.

[Cube0x0 @cube0x0]

@redteamcore You can have concurrency(serve multiple connections) in your server without multi threading.
Creating threads is only needed for coerce

[Cube0x0 @cube0x0]

Don't we all get to the point where all you want to do is capture and relay NTLM and Kerberos authentications in a BOF?

It's just faster to write a capture & relaying framework in C for ntlm, kerberos, dcom, smb, http, mssql with native Windows support than fixing impacket.
Available for 0xC2 clients in the coming update

[Cube0x0 @cube0x0]

@Cyb3rMonk Lol no, that would have been weird.
Everything happens inside the beacon process

[Cube0x0 @cube0x0]

@ShitSecure @zeroSteiner That and the packets sent over the network from the impacket server and client scripts do not blend in very well

[Cube0x0 @cube0x0]

@filip_dragovic That's many cve's
Gj man and gz!

[Cube0x0 @cube0x0]

@decoder_it @_RastaMouse @curi0usJack @tiraniddo nice!

[Andrea P @decoder_it]

@_RastaMouse @curi0usJack @tiraniddo @cube0x0 https://t.co/Pi0sfpTbc7

[Andrea P @decoder_it]

Is Kerberos relaying so limited? I'd say no, thanks to @tiraniddo CredMarshalTargetInfo trick. In this case, I'm relaying SMB to HTTP (ADCS) with a modified version of @cube0x0 krbrelay using DFSCoerce and PetitPotam - classic ESC8 attack with Kerberos, no DCOM involved ;)

[Cube0x0 @cube0x0]

@MarcOverIP @harmj0y Thank you! 🙏

[Cube0x0 @cube0x0]

0xC2 is now available and the site has been updated with a brief introduction
https://t.co/ozqeJ776RM

[Artem I. Baranov @artem_i_baranov]

Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation
https://t.co/1oA09svlNQ