Author: Rasta Mouse

.NET Startup Hooks

tl;dr Since .NET Core 3, the dotnet runtime has provided a low-level hook that allows injecting managed code that will run before an application’s entry point. This hook makes it possible to effectively backdoor any .NET application on a host (Windows, Linux, and macOS). You may ask why such a feature exists. It’s used in

Read more

Token Impersonation in C#

This post was inspired by a question posted by kevin in my Discord server, about how token impersonation can be applied to threads in C#. Before delving into that particular facet, let’s do a quick recap of token impersonation as a whole. What is Token Impersonation? This is a practice by which a calling thread

Read more

GetDomain vs GetComputerDomain vs GetCurrentDomain

Many Active Directory enumeration and post-exploitation tools need to figure out which domain they’re in or which domain they need to target. For convenience, PowerShell and C# tools can use the .NET Domain class from the System.DirectoryService.ActiveDirectory namespace. This class has several methods that can return a relevant Domain object, including GetComputerDomain() and GetCurrentDomain(). This

Read more

Evilginx, meet BITB

Obligatory disclaimer that I did not come up with any of these techniques – I’m just combining two awesome ideas by other people. If you’re not familiar with Evilginx or BITB, here’s a quick recap. Evilginx, created by Kuba Gretzky, is a man-in-the-middle framework designed to facilitate the capture of credentials and session cookies. It

Read more

OUs and GPOs and WMI Filters, Oh My!

Abusing GPOs is a tactic that’s been actively in-play for many years. ACL-based path-finding for GPOs was introduced to BloodHound 1.5 in 2018, and other tools have been released such as SharpGPOAbuse which implement various abuse primitives. You may be familiar with this representation, where a machine is a member of an OU and a

Read more

Why Tool-Restricted Exams (Sometimes) Matter

As the author of the Red Team Ops course and certification, I often get asked why the tools available in the exam are restricted to those provided in the pre-configured environment. The answer is a little involved to explain fully on Twitter or Discord, so this post is my attempt at providing a more complete

Read more

SOCKS4a Proxy in C#

Some time ago, I tweeted a teaser about implementing a SOCKS4 proxy in .NET. This post will finally provide a basic run-down of how I implemented it. There are some short-comings, which I’ll try and callout as they come up. We start off by creating a class that will bring a bind address and port

Read more

Adjacency List to Manage P2P Implants

In Command & Control (C2) parlance, there are two main types of implant: egress and (peer-to-peer) P2P. An egress implant will talk directly to attacker-controlled infrastructure over a protocol such as HTTP. A P2P implant does not talk directly to an attacker, but has their communications (SMB, TCP, or whatever) relayed through one or more

Read more

Dumping LSASS with Duplicated Handles

In the previous blog post, we looked at how to enumerate and duplicate open process handles in C#. The use case that was outlined involved stealing a handle to LSASS, as this is potentially more OPSEC safe (from AV and EDRs) than obtaining a handle directly. This post will demonstrate how to use such a

Read more

Duplicating Handles in C#

Introduction Applications can open and maintain handles to Windows objects such as access tokens, processes, threads, files, named pipes and more. As a local admin (or with SeDebug privs), it’s possible to enumerate open handles across the entire OS and duplicate them for our own use. This is particularly useful when you want to obtain

Read more