⭕️ ابزاری توسعه داده شده که Microsoft Graph API را اصطلاحا c2 کرده و با استفاده از ارتباط سامانه sharepoint با Microsoft Graph API ارتباطات HTTPS beaconing که با استفاده از C2 معروف Coblat Strike ایجاد شده برقرار میکند.
از ویژگی های این ابزار میتوان موارد زیر را مثال زد:
#RedTeam #C2
@Engineer_Computer
از ویژگی های این ابزار میتوان موارد زیر را مثال زد:
GraphStrike supports almost all normal Cobalt Strike activities to include:
Use of Proxychains through a Cobalt Strike SOCKS proxy (though it is very slow...)
Upload/Download of large files
BOFs, execute-assembly, etc.
This also includes GraphStrike integration of the sleep, exit, and remove commands to match GraphStrike Server sleep times with Beacon as well as delete files in SharePoint when a Beacon is exited or removed.
GraphStrike additionally incorporates all of the features and functionality of the original AceLdr, with some additional API's made to utilize call stack spoofing as well.
#RedTeam #C2
@Engineer_Computer
GitHub
GitHub - RedSiege/GraphStrike: Cobalt Strike HTTPS beaconing over Microsoft Graph API
Cobalt Strike HTTPS beaconing over Microsoft Graph API - GitHub - RedSiege/GraphStrike: Cobalt Strike HTTPS beaconing over Microsoft Graph API
⭕️ اگر با C2 معروف Cobalt Strike کار کرده باشید با Beacon Object File (BOF) ها آشنا هستید.BOF ای توسعه داده شده که جایگزینی برای دستورات Spawnas و Inject است که با دستور spawn_with [pid] [listener] از آن میتوان استفاده کرد.
حال به فرایند آن میپردازیم:
#RedTeam #Beacon #C2
@Engineer_Computer
حال به فرایند آن میپردازیم:
Obtain a handle to the target process.
Obtain a handle to the process' primary token.
Duplicate the primary token to an impersonation token.
Get the Beacon spawnto value.
Attempt to spawn a new process with the duplicated token using CreateProcessWithTokenW.
If this attempt fails, try CreateProcessAsUserW.
Inject the Beacon shellcode into the spawned process.
Link to the Beacon in the case of P2P.
#RedTeam #Beacon #C2
@Engineer_Computer
GitHub
GitHub - rasta-mouse/SpawnWith
Contribute to rasta-mouse/SpawnWith development by creating an account on GitHub.