keyboardcrunch

{
	// Declare static groups of users beyond those in the identity service.
	"groups": {
		"group:admins": ["myadmin@site"],
	},
	// Declare convenient hostname aliases to use in place of IP addresses.
	"hosts": {
		"rproxy_ext":         "100.100.99.68",
		"apps_int":           "100.100.99.69",
		"supabase":           "100.100.99.70",

keyboardcrunch

Caldera Server

Caldera Python Service

The main python caldera service, /etc/systemd/system/caldera.service.

[Unit]
Description=MITRE Caldera Server

[Service]
WorkingDirectory=/opt/caldera
ExecStart=/usr/bin/python3 server.py --insecure

keyboardcrunch

Headless Applications with xvfb and x11vnc

In the code block below we're going to launch two graphical applications on a headless server (no desktop environment) within their own virtual display, then launch an instance of x11vnc server connected to each virtual display. Generally if you have more than one application you might as well run a full desktop environment and vnc server, but this is more fun.

Requirements

• x11vnc
• the desktop apps you want (handbrake and firefox used in example)
• (optional) fluxbox or other minimal DE

keyboardcrunch

Sliver C2 Detection Research

Blog Posts

• https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
• https://community.netwitness.com/t5/netwitness-community-blog/sliver-c2-network-and-endpoint-detection-with-netwitness/ba-p/689643

Discussions

• https://twitter.com/svch0st/status/1562752142066470918?lang=en

Defaults

keyboardcrunch

Steps

1. Download and install 7-Zip
2. Download and extract the 7-zip extras.
3. Create a payload build directory and copy the 7zS.sfx file from extras into it.
4. Right-click and 7z archive your decoy payload, move it to a stand-alone payload build directory.
5. Craft your payload and save it as config.txt (See payloads below, must be in UTF-8 format) within this payload build directory.
6. With cmd.exe binary combine the files, copy /b 7zS.sfx + config.txt + decoy.7z sfx_payload.exe
7. Distribute and test your sfx mayhem carefully.

keyboardcrunch

Nginx mTLS Setup

This configuration will setup an Nginx server that requires a valid client certificate for mutual tls. We'll cover some basic certificate setup, the nginx config, and some openssl conversions for browser certificate import.

Certificate Setup

Creating the Certificates Manually

Create the CA

openssl genrsa -out ca.key 4096
openssl req -new -x509 -key ca.key -out ca.crt

keyboardcrunch

$ServiceList = @'
diagtrack
dusmsvc
dps
wdiservicehost
wdisystemhost
mapsbroker
fhsvc
GoogleChromeElevationService
gupdate

keyboardcrunch

# Allows install of any locally hosted extensions, restricts webstore extensions without explicit allow.
{
  "HomepageLocation": "https://www.google.com",
  "HomepageIsNewTabPage": false,
  "ExtensionSettings": {
    "*": {
      "installation_mode": "blocked",
      "blocked_install_message": "Extension installation is restricted to reviewed and approved only.",
      "blocked_permissions": [],
      "install_sources": [

keyboardcrunch

<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0">
    <channel>
        <title>keyboardcrunch - recently read</title>
        <link>https://blog.keyboardcrunch.com/</link>
        <description>A list of stuff I found interesting or look forward to reading.</description>
        <lastBuildDate>Thu, 15 Jun 2023 01:59:18 GMT</lastBuildDate>
        <docs>https://validator.w3.org/feed/docs/rss2.html</docs>
        <generator>https://github.com/jpmonette/feed</generator>
        <item>

keyboardcrunch

1. Modify /etc/nginx/nginx.conf file
2. Modify /etc/nginx/sites-available/site.conf file
3. Create /etc/nginx/useragent.rule file

Where to find user agent strings?
https://explore.whatismybrowser.com/useragents/explore/software_name/facebook-bot/

Test:

[rubin@reaper ~]$ curl -A "instagram" -I https://plrm.podcastalot.com