p3nt4

[p3nt4 @xP3nt4]

Decided to share my PowerShell implant for Nuages C2. I have used an obfuscated version of this on many successful red teams without detection.
https://t.co/ovFlRBZiYT

[p3nt4 @xP3nt4]

Added DNS handling to Nuages' Sharp Implant. Not the fastest but TCP tunneling through DNS is pretty fun. https://t.co/apDzni7R9S.

[p3nt4 @xP3nt4]

Manage resource-based constrained delegation using impacket. Enables abusing PetitPotam/ntlmrelayx to compromise non-dc host when SMB signing is enabled:
petitpotam->ntlmrelayx->adcs->cert->rubeus->tgt->delegateAccess.py->getSt.py->PWN
https://t.co/IszvdzYZg9

[p3nt4 @xP3nt4]

Run .Net assemblies using rundll32.exe: https://t.co/grFaepqqxQ

[p3nt4 @xP3nt4]

Added a new API endpoint to Nuages to enable direct binary communication for file transmission and tcp pivoting. The performance gain is really noticeable. https://t.co/apDzni7R9S

[LuemmelSec @theluemmel]

New blog-post is out:
https://t.co/ZdOoGw58Bn

Bypassing AV, AMSI, ConstrainedLanguage and AppLocker

Thx @ShitSecure and @0x23353435 for QA and all your input.
@_RastaMouse @phraaaaaaa @egeblc for sharing knowledge and tools
#redteam #pentest #RTO

[p3nt4 @xP3nt4]

@TestingPens Thanks. That's a great idea for a prod implant. This one is just a POC, it's not really weaponized as it is.

[p3nt4 @xP3nt4]

Just finished a tutorial on how to leverage the Nuages framework to develop custom full-featured C2 implants in a few hours.
https://t.co/TCEwYYvEtl

[p3nt4 @xP3nt4]

@__SPX__ @phraaaaaaa @0x1337rob Nice! This is also part of the Nuages philosophy, I'm sharing an example handler but the idea would be that people would write their own as well

[p3nt4 @xP3nt4]

Finally implemented native socks proxying, port forwarding and interactive channeling into Nuages. NodeJS streams made it a lot easier than expected!

[p3nt4 @xP3nt4]

@__SPX__ @phraaaaaaa @0x1337rob Thanks! Feel free to contribute :)

[p3nt4 @xP3nt4]

@phraaaaaaa @0x1337rob Yes, however the idea is that people have to write their own implants. With all the back end work done it's not that much work

[Yuri @yamminnnnn]

https://t.co/dplSWRxhhn

[p3nt4 @xP3nt4]

Added an experimental "Reverse" Socks proxy function to https://t.co/ABqN0QV0MQ, with an option to go through system proxies 😛. Credit to @Arno0x0x for the later

[Mr.Un1k0d3r @MrUn1k0d3r]

Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\

Then

%userprofile%\AppData\Local\Microsoft\Teams\Update.exe --processStart payload.exe --process-start-args "whatever args"

Trusted signed binary will run the payload for you 😊

#RedTeam #Pentesting

[p3nt4 @xP3nt4]

Multithreaded Powershell script to extract large files securely:
https://t.co/ZpiNKr5TuS

[p3nt4 @xP3nt4]

Just released https://t.co/apDzni7R9S, a C2 framework I have been working on for fun.

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

Thanks to Rory McNamara 🥰 ( https://t.co/bCEnjcBhcv ) _and a big SQLITE3 lib update_, #mimikatz can now open Chrome saved passwords & cookies databases already opened by Chrome (without making a copy of them somewhere..)

Be efficient and use it as is!

> https://t.co/Wzb5GAfWfd

[p3nt4 @xP3nt4]

Completely redesigned https://t.co/ABqN0QV0MQ. The new script has drastically improved performances and no more memory leak issues.