Collaborate Disseminate
Although Covenant’s Administrator portal by default runs on localhost port 7443 (https://127.0.0.1:7443) but it’s also accessible through the public IP of the VPS.
So to limit the access to Administrative page, I created an iptables rule t… Continue reading The C2 Listener isn’t listening when used with iptables [closed]
This time for my red teaming engagement I decided to use Covenant as my C2.
I literally changed everything from it, to evade every type of detection and finally get a FUD detection on antiscan.me. Obviously it was for Static Detection
For … Continue reading Evading behavioral detection
After doing a successful phishing campaign, I got a reverse shell from two Windows machines which are part of Active Directory.
Now I want to run tools such as responder, mitm6, impacket-wmiexec, but how can I forward these tools’ network … Continue reading Forwarding impacket’s/mitm6 network traffic to compromised host [closed]
I am using powershell version of mimikatz (Invoke-Mimikatz.ps1).
I want to download it and save it in memory only without touching the disk.
I did this using powershell.exe -windowstyle hidden -ExecutionPolicy Unrestricted -nop -Command &q… Continue reading Downloading PowerShell file and executing in memory [closed]
Whenever I create a scheduled task with administrator privs, it executes normally without any problem like:- schtasks /create /tn sample /tr C:\Windows\System32\cmd.exe /sd 08/10/2023 /st 10:23 /sc once
But whenever I tried to create a tas… Continue reading Unable to create scheduled task which executes as System
During a pentest I used to move laterally between Active Directory workstations using psexec or remote service creation techniques.
But this is the first time that I have had to conduct a pentest of a small organisation with 20-25 computer… Continue reading Is there a technique for lateral movement in a non Active Directory network? [closed]