I have spotted this interesting tweet from Malwar3Ninja and decided to take a look and analyse the Cobalt Strike PowerShell payload. PowerShell Payload Analysis. We can spot the for function:

DLL Hijacking via Cobalt Strike & Attack Analysis. Agenda Hijack Execution Flow: DLL Search Order Hijacking. Payload extraction from the PCAP (VT, Triage, and CyberChef Analysis). Attack Analysis. DLL Hijacking via Cobalt Strike/Sysrep. Hijack Execution Flow Adversaries may execute their own malicious payloads by hijacking the way operating systems run…

Agenda: Malleable C2 — jQuery profiles. Cobalt Strike — SpawnTo and Rundll32. PCAP & VT Analysis — Rundll32 connecting over TCP to Cobalt Strike C2. Cobalt Strike Malleable C2 User-Agents. Malleable C2 — jQuery profiles. Malleable C2 profiles have been widely adopted and used by Cobalt Strike, a popular framework used by Red Teamers, APT’s…

Lab: SSRF with filter bypass via open redirection vulnerability — Lab: SSRF with filter bypass via open redirection vulnerability Objectives: This lab has a stock check feature that fetches data from an internal system. To solve the lab, change the stock check URL to access the admin interface at http://192.168.0.12:8080/admin and delete the user carlos. The stock checker has been restricted to only access the local application, so you…

Lab: SSRF with blacklist-based input filter — Lab: SSRF with blacklist-based input filter Objectives: This lab has a stock check feature that fetches data from an internal system. To solve the lab, change the stock check URL to access the admin interface at http://localhost/admin and delete the user carlos. The developer has deployed two weak anti-SSRF defenses that you will need to bypass.

Lab: Basic SSRF against another back-end system — Lab: Basic SSRF against another back-end system Objectives: This lab has a stock check feature that fetches data from an internal system. To solve the lab, use the stock check functionality to scan the internal 192.168.0.X range for an admin interface on port 8080, then use it to delete the user carlos.

Lab: Basic SSRF against the local server — Server-side request forgery (also known as SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make requests to an unintended location. In a typical SSRF attack, the attacker might cause the server to make a connection to internal-only services within the organization’s infrastructure…