penetration Testing Lab




Command and Control – Windows COM


Red team engagements are becoming more and more popular and system administrators are more aware about tools and techniques so avoiding detection is a much harder task. Red teamers from the other hand are always looking for command and controls tools that are using either legitimate traffic or standard functionality of Windows to hide their activities. The native Windows Script Host engine can be used as another method of command and control as it was presented at Bsides Las Vegas 2017 and a tool was released to assist towards this activity.
Koadic Framework was developed by Sean Dillon  and Zach Harding and is based in JavaScript and VBScript since it is using Windows Script Host (WSH). Therefore it can be used in multiple Windows environments from Windows 2000 to Windows 10. Legacy systems they don’t have PowerShell or they might be running an old version of ASP.NET so compare to other tools that are based in PowerShell it can be used as a more reliable solution.
Koadic is fast, less noisy and has the ability to deliver payloads in memory as well.
Koadic
Koadic
Koadic by default is configured to use Microsoft HTML Application as a stager and the only requirement is to set the local IP address. Other stagers involve the usage of rundll32 and regsvr32. Additionally as many other command and control tools it supports encrypted communication for a more stealthy approach.
Koadic - MSHTA Stager
Koadic – MSHTA Stager
The following command needs to executed on the target from a command prompt:
MSHTA - Execution on the target
MSHTA – Execution on the target
By specifying the Zombie ID Koadic can interact with the host:
Koadic - Interact with Zombies
Koadic – Interaction with Zombies
Koadic is using some of the well-known user account control (UAC) bypasses of Matt Nelson to perform elevation.
Koadic - Bypass UAC SDCLT
Koadic – Bypass UAC SDCLT
A new session will created but this time it will be elevated:
Koadic - Elevated Session
Koadic – Elevated Session
It is also possible to execute commands on the target by using the cmdshell and the zombie ID.
Koadic - Command Execution
Koadic – Command Execution
This framework has a number of implants that can be used to execute various activities like:
  • Gather password hashes
  • Bypass UAC
  • Perform a port scan
  • Kill antivirus
  • File transfer
  • Execute shellcode
  • Perform Phishing
Koadic - Implants
Koadic – Implants
Performing a port scan on a number of targets is easy with the following implant:
Koadic - TCP Scanner
Koadic – TCP Scanner
Open ports will appear in green:
Koadic - TCP Scanner Results
Koadic – TCP Scanner Results
It is also possible to attempt to steal password from normal users through a password box. However this will defeat the purpose of being stealthy during the red team engagement.
Koadic - Password Box
Koadic – Password Box
The script prompt that will appear to the user:
Koadic - Script Prompt
Koadic – Script Prompt

Comments

Post a Comment

Popular posts from this blog

Image
How to Change Your IP Address Every time you connect to the Internet, your ISP (Internet Service Provider) assigns an IP address to your computer that makes it possible for websites and applications to keep track of your online activities and also pin point your physical location. Therefore, in order to protect your Internet privacy, it is often necessary to change your IP address. Ways to Change IP Address The following are some of the possible ways to change IP address of your computer: 1. Using a VPN: Best Way to Change IP Address Even though there are several methods to change your IP address, using a VPN proxy is by far the best and most secure way. The following are some of the most popular VPN proxies that most Internet users prefer: 1. Private Internet Access  – Private Internet Access is one of the best VPN service that allows you to instantly change your IP address with an encrypted connection. This provides you a complete anonymity wh...
Read more
Image
The Password Facts that Hackers Don’t Want you to Know if there’s one thing that makes us so vulnerable in this highly connected, digital age, it’s ignorance. Sadly, many of us are ignorant about the thing we rely on most for securing our confidential secrets – our password. Our lack of understanding about passwords is allowing crooks to spy on us, steal from us, and deceive us into thinking nothing ever happened. Despite the volumes of texts that have already been written about them, how many of us have ever read a single chapter paragraph about the nitty-gritty of passwords? hat’s why we have compiled the following three short lists which outline the most common misconceptions about passwords; the ways in which our passwords can be stolen; and the tools you need to make sure it doesn’t happen to you. Each of these sections can be read in less than two minutes. But once you’re done, you will have acquired enough information to deal safely and confidently with you...
Read more
Image
How to Create Fake Last Seen Time on WhatsApp in Android create fake last seen time on WhatsApp I only believe that WhatsApp is one of the best creations of the modern world. It is Application which has changed our lives forever and for very good reason, but we need to swallow one thing that it hasn’t done anything yet to maintain our privacy. WhatsApp last seen  is the unique and very useful feature, but at the same time, it disturbs your privacy which you need to hide sometimes from your friends or family. Surely we as human beings don’t like being noticed every time. You may know about the loopholes of original WhatsApp but at the same time, there are some  modded Applications which works better than WhatsApp and are really faster than the original one. we are talking about modded version, we surely need to mention  GBWhatsApp which is so called the best  modded version of WhatsApp . By using this Application you can create your own fake last see...
Read more