#RedTeamTip - Twitter Hashtag

about 3 years ago

#redteamtip: This is one of the quickest wins you can have in a Red team. During my last engagement, I found an active notepad process, but was not able to access its network path as the location of the text file was unmounted. However, since the process was active, I checked the status of the process using 'psgrep' and 'windowlist' command of Brute Ratel. The 'windowlist' command does show the path of the share at times. Next, I dumped the notepad memory and extracted the dump in a fileless manner. Finally, used strings and grep on the dump file offline to search for the user's name and its adjacent strings. Make note that notepad.exe/office etc. stores the buffer of the process in UNICODE. Thus you have to use 'strings --encoding=l' to search UNICODE strings and then use grep without casing (-ie). In my case I searched for the user's name with -A (after text) and -B (before text) to search for adjacent lines of text which might contain password. Remember that LSASS is not the only thing that stores passwords 😉, and you might not get all sensitives files just by searching for files, as some might only exist in memory 🤓.

NinjaParanoid's tweet photo. #redteamtip: This is one of the quickest wins you can have in a Red team. During my last engagement, I found an active notepad process, but was not able to access its network path as the location of the text file was unmounted. However, since the process was active, I checked the status of the process using 'psgrep' and 'windowlist' command of Brute Ratel.
The 'windowlist' command does show the path of the share at times.
Next, I dumped the notepad memory and extracted the dump in a fileless manner.
Finally, used strings and grep on the dump file offline to search for the user's name and its adjacent strings.
Make note that notepad.exe/office etc. stores the buffer of the process in UNICODE. Thus you have to use 'strings --encoding=l' to search UNICODE strings and then use grep without casing (-ie). In my case I searched for the user's name with -A (after text) and -B (before text) to search for adjacent lines of text which might contain password. Remember that LSASS is not the only thing that stores passwords 😉, and you might not get all sensitives files just by searching for files, as some might only exist in memory 🤓.

2

286

67

147

32K

Chetan Nayak (Brute Ratel C4 Author)

@NinjaParanoid

about 3 years ago

#redteamtip: During my last 4 redteams in the past 1 year, I haven't spawned a full HTTP payload. I would rather spawn a http connector which checks in at specified interval and connects to a badger in another process via local named pipe. This way, my core badger and my http connector run seperately. My named pipe is only connected when the sleep interval is over. Thus even if the blue team hunts down and starts analyzing my http payload, they wont find my payload core. The payload core is also configured in such a way that if it doesnt find the http connector's PID running, it will simply exit to avoid further IOCs. Creativity is the limit here. Havent found a single EDR or blue team detect this till date 🤓.

7

206

32

103

41K

Chetan Nayak (Brute Ratel C4 Author)

@NinjaParanoid

about 3 years ago

#redteamtip: In linux you can simply exfiltrate the '.mozilla' or the 'snap/chromium' dir from the home and restore the full sessions/profiles/passwords on your own computer. Compromised an entire dev env in a red team by just exploiting one ssh key and chromium of a dev. 🤓

4

181

32

87

27K

thesle3p @thesl3ep

over 3 years ago

#redteamtip Need to duplicate or forge a form or corporate document but don't have have access to a original? A lot of people use the website https://t.co/ObyIX8QDbh to fill out documents online and the documents they upload to the site are searchable and downloadable

0

2

0

1

87

Low tier securitymander @checkymander

over 3 years ago

#redteamtip don't get caught

8

70

6

3

10K

Ghaleb Al-otaibi @Patri1ck

over 3 years ago

RedteamTip: If you compromise an account member of the group Backup Operators you can become the Domain Admin without RDP or WinRM on the Domain Controller. Just by using BackupOperatorToDA.exe tool CC: @mpgn_x64 #redteamtip https://t.co/r9FChPcT7p

2

264

95

76

28K

Dodo on Security 🇵🇸 🇺🇦 @dodo_sec

over 3 years ago

@vxunderground That's s common misconception about the RPG-7. #RedTeamTip you don't need to enter a facility with it, just use enough ammo to bring down the walls until you reach the room where the EDR is running

4

7

0

2K

vx-underground

@vxunderground

over 3 years ago

Recently we have received criticism for our #1 #RedTeamTip of using an RPG-7 to bypass EDRs. Some individuals pointed out an RPG-7 would not be allowed on most corporate premises. While this may be true, vx-underground also has a 0day exploit to get access to ANY facility.

vxunderground's tweet photo. Recently we have received criticism for our #1 #RedTeamTip of using an RPG-7 to bypass EDRs. Some individuals pointed out an RPG-7 would not be allowed on most corporate premises.

While this may be true, vx-underground also has a 0day exploit to get access to ANY facility. https://t.co/R68cMqI7jE

25

485

40

17

79K

vx-underground

@vxunderground

over 3 years ago

We have seen many tweets recently about silly malware concepts like "syscalls", "unhooking", or "obfuscation". Here is our #1 #RedTeamTip to avoid EDRs. Use an RPG-7 to obliterate the computer. The EDR cannot detect your malware if the computer is not operational

vxunderground's tweet photo. We have seen many tweets recently about silly malware concepts like "syscalls", "unhooking", or "obfuscation".

Here is our #1 #RedTeamTip to avoid EDRs. Use an RPG-7 to obliterate the computer. The EDR cannot detect your malware if the computer is not operational https://t.co/flB9oODU5b

30

690

139

15

77K

RistBS @RistBs

almost 4 years ago

@C5pider @ SaveToNotion #EDR #Bypass #redteamtip 🤡

0

3

0

486

Samir @SBousseaden

almost 4 years ago

#redteamtip :D

0

26

1

8

5K

Josh @passthehashbrwn

almost 4 years ago

Here's an actual #redteamtip, close your laptop and go outside

4

147

20

1

0

Omar Ωr Santos @santosomar

about 5 years ago

Hey #Hackers! We will be hosting a stream with @NahamSec @_johnhammond @thecybermentor @stokfredrik talking about our CTF and events during #defcon. We will be giving out a ton of prizes, but I need your help. Do you have a #RedTeamTip that you want to share? #CyberSecurity

2

69

24

3

0

Shantanu Khandelwal @shantanukhande

over 5 years ago

Using Google's OpenRedirect to Bypass Mail Filters for Phishing h[xx]ps://googleweblight.com/i?u=https://www.redteam.cafe #RedTeamTip #RedTeam

0

10

3

0

Shantanu Khandelwal @shantanukhande

about 6 years ago

Since @vysecurity told me to post some tips, here is one of my golden tip. RedTip # 407 Not a lot of people know about Find-DomainPropertyObjectOutlier in Powerview. Use it to find hidden secrets inside AD Attributes. #RedTeam #RedTeamTip

3

9

2

0

that_faceless_coder @faceless_coder

about 6 years ago

👑Great feature of WMI is dat it allows us 2 subscribe 2 specific system events like process starts by subscribing 2 event notifications from WMI providers such as WIN32_process. Subscribing to an occurring system event is a gud way 2 maintain fileless persistence #redteamtip👑

0

2

1

0

Ashutosh Barot

@ashu_barot

about 6 years ago

Outlook wil block email with malwares attached BUT You can use 'Microsoft Teams' to send Malwares also you can use teams to send almost every file type, .zip, .exe, .vbs, .ps1, .hta, .lnk @MicrosoftTeams @msftsecresponse #RedTeamTip #MicrosoftTeams #Microsoft #CyberSecurity

3

4

0

sailay(valen) @404death

almost 7 years ago

you can get network & other informations by executing windows default file: C:\Windows\System32\gatherNetworkInfo.vbs #redteamtip

1

20

9

1

0

⠝⠁⠃⠑⠑⠇ ⠁⠓⠍⠑⠙ @rogue_kdc

almost 7 years ago

#redteamtip If you bought a phishing domain which resembles the real domain closely, setup a catch-all mailbox to get all the mails people sent to the phishing domain by mistake. Absolutely goldmine!

1

8

3

0

Bobby Sanchez @redteambs

about 7 years ago

Tattoo all your scored krbtgt hashes as a chest piece to attract new clients. Shows #dedication which customers love. #prestige #redteamtip

0

3

2

0

Top Tweets for #RedTeamTip

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users