| /** | |
| * Based on https://github.com/alew140/stupid-NoVNC-copy-paste/blob/main/Index.js | |
| * VNCPaste | |
| * | |
| * Pastes clipboard text into a noVNC session by synthesising keyboard events | |
| * on the canvas. | |
| * | |
| * Key points: | |
| * - noVNC resolves the keysym from event.key, never from event.shiftKey, | |
| * so the literal character must go in `key` ('@', not '2' + shiftKey). |
| [CmdletBinding()] | |
| param( | |
| [Parameter(Mandatory)] | |
| [ValidatePattern('^[0-9a-fA-F]{32}$')] | |
| [string]$ZoneTag, | |
| [Parameter(Mandatory)] | |
| [Security.SecureString]$XAtok, | |
| [Parameter(Mandatory)] |
| /* | |
| YARA rules — bincrypter-packed gsocket / gs-netcat implants | |
| ------------------------------------------------------------------ | |
| Derived from analysis of a live intrusion sample ("netd.sh"). | |
| Chain: bincrypter shell dropper | |
| -> AES+gzip -> UPX-packed ELF (UPX! magics zeroed) | |
| -> gs-netcat 1.4.42beta5 (--enable-stealth) | |
| + 664-byte operator config appended to the packed file |
| #pragma description UPX-packed ELF64 (tolerant of stripped UPX! magics) | |
| #pragma author Peter Gabaldon | |
| #pragma endian little | |
| /* | |
| * upx_elf.hexpat | |
| * ----------------------------------------------------------------------- | |
| * Parses the UPX metadata that lives *after* the ELF program header table: | |
| * | |
| * Elf64_Ehdr @ 0x00 |
| // Version 8.6 - 4:06PM EST 7/21/24 | |
| // Get ConfigStateUpdate and SensorHeartbeat events | |
| #event_simpleName=/^(ConfigStateUpdate|SensorHeartbeat)$/ event_platform=Win | |
| | cid=?cid | |
| // Splitting aid list for large customers | |
| | regex(field=aid, regex=?aidsubset) | |
| // Parse ConfigStateUpdate and extract Channel File 291 version number; accept all SensorHeartbeat events and rename timestamp field |
| // Get ConfigStateUpdate and SensorHeartbeat events | |
| #event_simpleName=/^(ConfigStateUpdate|SensorHeartbeat)$/ event_platform=Win | |
| // Narrow search to Channel File 291 and extract version number; accept all SensorHeartbeat events within impact window | |
| | case{ | |
| #event_simpleName=ConfigStateUpdate | regex("\|1,123,(?<CFVersion>.*?)\|", field=ConfigStateData, strict=false) | parseInt(CFVersion, radix=16); | |
| #event_simpleName=SensorHeartbeat | rename([[@timestamp, LastSeen]]); | |
| } | |
| | case{ |
| Aaron.Aguilar | |
| Aaron.Alonso | |
| Aaron.alvarez | |
| Aaron.Arias | |
| Aaron.Benitez | |
| Aaron.Blanco | |
| Aaron.Blesa | |
| Aaron.Bravo | |
| Aaron.Caballero | |
| Aaron.Cabrera |
Short HOWTO about one use case of the work from Cube0x0 (KrbRelay) and others.
No-Fix Local Privilege Escalation from low-priviliged domain user to local system on domain-joined computers.
Prerequisites:
| #! /bin/bash | |
| # Pedro Gabaldon Julia 2021 | |
| # https://petergabaldon.github.io/ | |
| ### COLORS | |
| NOCOLOR='\033[0m' | |
| RED='\033[0;31m' | |
| GREEN='\033[0;32m' | |
| ORANGE='\033[0;33m' |