Adding a COFF loader, Cobalt Strike BOFs, crashing and crashing Intro BOFs might be the most popular format for post-exploitation tooling in the cyber space. There are a bunch of reasons for that which we will discuss below. So I really wanted Xenon to be compatible with the plethora of
yes… i named this one after the minecraft achievement. The Httpx container, malleable C2 profiles, and wininet. Flexible Request Profiles To be honest, this is where I spent the bulk of my development for this project. Up to this point, the http C2 profile served it’s purpose and allowed
Mythic request types (checkin & get_tasking & post_response) Getting Tasks Now that we performed an initial check-in to the teamserver, we (the agent) need to continuously check for new tasks to execute. In Mythic this can be done with a get_tasking request. The format for this style
translation containers and checking in Agent Data Serialization I decided to build off of the Talon agent by @Cracked5pider. It uses a data serialization format “type, size, data” to pack and parse data. This allows the agent to send serialized binary data instead of worrying about creating JSON in C
Mythic landscape, motivations, and overview Intro This is a development blog series that goes along with my experience in creating a Mythic C2 agent written in C. This is not supposed to be a step-by-step tutorial, but rather a written log of what I’ve learned. I will include code
learning about early cascade injection, fixing for Win11, disassembly nonsense Intro Early Cascade injection was documented by Outflank as a novel process injection technique. The technique requires locating and modifying specific symbols in the .data and .mrdata sections of ntdll.dll in a remote process, which enables code execution via
Overview The purpose of this article is to go over the benefits of staged payloads and show a modular approach to staging payloads with Metasploit. This is definitely nothing new or ground breaking, but just a real hands-on walkthrough of how to utilize their ‘custom’ payloads with a Command &