4 ms·
Pro-tip: if you pop a shell, only use it to run your own dropper. Use locally available tools as little as possible. Automate your entire post-exploitation payl
by zx2c4 9y ago
Pro-tip: if you pop a shell, only use it to run your own dropper. Use locally available tools as little as possible. Automate your entire post-exploitation payload and cleanup and get out as soon as possible.
Reading this article is like reading about elite navy seals who storm an enemy outpost, get inside, and then get distracted trying to refashion a stapler they find laying around into a lock-picking device to open the safe.
- tudelo 9y ago"only use it to run your own dropper" Can you clarify this? I'm not really sure what it means.
- zx2c4 9y agohttps://en.wikipedia.org/wiki/Dropper_(malware) https://en.wikipedia.org/wiki/Dropper_(malware)
- deleted 9y ago[deleted]
- blincoln 9y agoIt depends upon what one is trying to do, and what resources one has available, IMO. If someone is actually working for an intelligence agency/criminal organization, or is part of an internal red team, then they have the time and resources to target specific classes of system, plan everything out, and build a package that will do exactly what they want against those specific systems, without any operator interaction. Most pen testers don't have the time to do that, let alone do it well, and there's a good chance that anything automated that they hack together will miss something interesting either because the person who built the payload didn't expect it, or because blindly doing all of the things that would locate interesting information would involve sending gigs of data back to C2. Knowing how to quickly improvise things like what's described in the article is super-helpful for the more generalized "see how you can misuse this system" type of pen testing.