Background Hi, it's been a while. A couple of months ago I was working on some payload development for an upcoming engagement. I needed to bypass a few security products. I was working on a payload that used the kitchen sink of evasion: stack spoofing, indirect syscalls, sleep
Background Process injection or code injection is a technique in which you copy and execute arbitrary code to a target process. It is often used in Offensive Security to execute tasks under the context of another legitimate process on the system. Before this blog my Mythic C2 agent, Xenon, only
Adding a COFF loader, Cobalt Strike BOFs, crashing and crashing Intro BOFs might be the most popular format for post-exploitation tooling in the cyber space. There are a bunch of reasons for that which we will discuss below. So I really wanted Xenon to be compatible with the plethora of
yes… i named this one after the minecraft achievement. The Httpx container, malleable C2 profiles, and wininet. Flexible Request Profiles To be honest, this is where I spent the bulk of my development for this project. Up to this point, the http C2 profile served it’s purpose and allowed
Mythic request types (checkin & get_tasking & post_response) Getting Tasks Now that we performed an initial check-in to the teamserver, we (the agent) need to continuously check for new tasks to execute. In Mythic this can be done with a get_tasking request. The format for this style
translation containers and checking in Agent Data Serialization I decided to build off of the Talon agent by @Cracked5pider. It uses a data serialization format “type, size, data” to pack and parse data. This allows the agent to send serialized binary data instead of worrying about creating JSON in C
Mythic landscape, motivations, and overview Intro This is a development blog series that goes along with my experience in creating a Mythic C2 agent written in C. This is not supposed to be a step-by-step tutorial, but rather a written log of what I’ve learned. I will include code
learning about early cascade injection, fixing for Win11, disassembly nonsense Intro Early Cascade injection was documented by Outflank as a novel process injection technique. The technique requires locating and modifying specific symbols in the .data and .mrdata sections of ntdll.dll in a remote process, which enables code execution via
Overview The purpose of this article is to go over the benefits of staged payloads and show a modular approach to staging payloads with Metasploit. This is definitely nothing new or ground breaking, but just a real hands-on walkthrough of how to utilize their ‘custom’ payloads with a Command &