# Welcome to Securescape! ## About Us Securescape is a cyber security blog that aims to share techniques, tools, guides, and resources to aid beginners in this field, and for anyone else to benefit from it. ## Cooler Blogs {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} # Operating Systems (WIP) This will be a high level introduction to Operating Systems concepts. If you would like more detailed information then look into: * [Modern Operating Systems](https://csc-knu.github.io/sys-prog/books/Andrew%20S.%20Tanenbaum%20-%20Modern%20Operating%20Systems.pdf) * [Neso Academy](https://youtube.com/playlist?list=PLBlnK6fEyqRiVhbXDGLXDk_OQAeuVcp2O) * [Operating Systems - Bedtime Story](https://drive.google.com/file/d/1eEame5iVTox5g5O6HQVePhJBTiMpP5gY/view?usp=share_link) **A basic understanding of Computer Architecture is needed to undestand some concepts.**\ You can find some resources to learn these here: * [Computer Architecture - A Quantitative Approach](https://ict.iitk.ac.in/wp-content/uploads/CS422-Computer-Architecture-patterson-5th-edition.pdf) * [Fundamentals of Computer Organisation & Architecture](https://engineering.futureuniversity.com/BOOKS%20FOR%20IT/%5BMostafa_Abd-El-Barr__Hesham_El-Rewini%5D_Fundamenta$BookZZ.org$.pdf) * [Neso Academy - Computer Organisation & Architecture](https://www.youtube.com/playlist?list=PLBlnK6fEyqRgLLlzdgiTUKULKJPYc0A4q) # Introduction to Operating Systems A brief introduction and history into Operating Systems ## History | Type | Product | Date | | --------------------------- | ------------------ | -------- | | Vacuum Tubes | Z3 Computer, ENLAC | 1945-55 | | Transistors & Batch Systems | GMOS | 1955-65 | | ICs & Multiprogramming | System/360 | 1965-80 | | Personal Computers | CP/M, MS-DOS | 1980-Now | | Mobile Computers | PDA, Android, iOS | 1990-Now | ## Definitions * **Computer:** A general purpose device that can execute sequences of instructions presented in a formal format to perform numerical calculations and other tasks. * **Computer Hardware:** A collection of physical components and elements which make up a computer system. * **Computer Software:** A collection of all programs stored in and executed by a computer system. * **Application Software:** Performs specific tasks for the user. * **System Software:** Operates and controls the computer system, and provides a platform to run application software. ## Introduction An **Operating System** is a piece of software that manages all the resources of a computer system, both hardware and software, and provides an environment in which the user can execute their programs in a convenient and efficient manner.\ \ They exist because they offer a reasonable way to solve the problem of creating a useable computer system. An operating system: * Manages the computer hardware * Facilitates execution of application programs * Acts as an intermediary between the user and the computer hardware * Designed to be convenient and efficient Design Goals: * Convenience & Ease of Use - Personal Computers * Efficiency (Proper Resource Allocation) - High Performance Computers * Energy Conservation - Handheld Devices * Minimal User Interference - Embedded Devices Operating System Layout

## Computer Hardware Hardware Components in a typical Computer System

### CPU Internals CPU Internals Diagram

### Storage {% embed url="" %} Registers

#### Cache When a program reads a word, the hardware checks to see if it's in the cache. 1. If so, then you will have a cache hit (2 cycles) 2. If not, then it will make a request to the main memory over the bus which is expensive Cache is expensive, therefore its size is limited. #### Disk Drive Structure Data on a disk is stored on **Tracks** and is read through a **Head**. Since the head has to search through the disk for the information, data acquisition is slow.\ Each sector on a disk stores between 256 bytes to 1 kilobyte of information. {% embed url="" %} Disk Drive Internals {% endembed %} ### Multithreaded and Multicore Chips Chips can have a shared or separate cache connected to it depending on the manufacturer - Intel or AMD for example.

A core could be a CPU, and a CPU could be:\ 1\. Efficiency Core - Slower but consumes less power\ 2\. Performance Core - Efficient but expensive #### Memory Memory is split between two types: * Single Base / Limit Pair * Set for each process * Two Base / Limit Registers * One for the program, one for the data What this means is that in a single base, the process and the user data is compiled together and given a limit for the whole program, while a two base will have the program running on one or more addresses, and the data running on a separate address. #### Deadlock When processes don't have a cycle or order to follow they will try to run at the same time, causing a deadlock - where they will each wait for the next program to run before running themselves.

## Multiprogramming Multiprogramming increases CPU utilisation by keeping multiple jobs (Code and Data) in the memory so that the CPU always has one to execute.

## Multitasking Multitasking is a logical extension of multiprogramming. * CPU Executes multiple tasks by switching among them * The switching is very fast * Requires an interactive (Hands-On) computer where the user can directly interact with the computer * Response Time should be minimal **Kernel:** A kernal is that part of the operating system which interacts directly with the hardware and performs the most crucial tasks\ \ **Microkernel:** The microkernel is much smaller in size than a conventional kernel and supports only the core operating system functionalities\ \ **Shell:** The shell - or command interpreter - is part of the operating system that receives commands from the users and gets them executed ### System Call A system call is a mechanism where a user program can request a service from the kernel for which it does not have the permission to perform. User programs typically do not have permission to perform operations like accessing I/O devices and communicating with other programs. * A user program invokes system calls when it requires such services * System calls provide an interface between a program and the operating system * System calls have different types * fork * exec * getpid * getppid * wait * exit ## Dual-Mode Operation * **User Mode** * **Kernel Mode / Supervisor Mode / System Mode / Privileged Mode** * **Mode Bit:** Kernel - 0, User - 1 * Request using a system call System Calls from user to kernal and back

System Calls from user to kernal and back

## Duties of the Operating System ### Process Management * Creating and deleting user and system processes * Suspending and resuming processes * Interprocess Communication * Process Synchronisation * Deadlock Handling ### Memory Management * Keeping track of which part of memory is used by which job * Allocating and deallocating memory space ### Storage Management * File System Management * Creating, deleting, and manipulating files and directories * Mass Storage Management * Free Space Management * Storage Allocation * Disk Scheduling ### Caching ### Input-Output Management ## Operating System Structures * Monolithic \[MS DOS, Unix, Linux] * Layered \[THE] * Microkernel \[Mach, MINIX] A **Real-Time Operating System (RTOS)** has well-defined time constraints which have to be met or the system will fail. An RTOS is used when rigid time constraints have been placed on the operation of processes or flow of data.\ \ An RTOS is often used in the control device in a dedicated application. RTOS has two types - Soft and Hard.\ \ **Applications:** Embedded Systems, Robotics, Scientific Utilities, etc. \ \ **Booting:** Booting is the process of starting the computer and loading the kernel. When a computer is turned on, the power-on self-tests (POST) are performed. Then the bootstrap loader, which resides in the ROM, is executed. The bootstrap loader loads the kernel or a more sophisticated loader. # Processes and Process Management # Processes ## Pseudo-Parallelism In a **Uni-Processor System**, at any instant, the CPU is only running **One** process.\ But, in a **Multiprogramming System**, the CPU switches from processes quickly, running each for tens or hundreds of milliseconds. The true hardware parallelism is in **Multiprocessor** systems

## What is a process? A process is an **executing program**, including the current values of the program counter, registers, and variables.\ \ **Program:** Group of Instructions, passive entity\ **Process:** Program Activity, active entity * Code, Data, and Stack * Usually (but not always) has its own address space * Program State * CPU Registers * Program Counter (Current Location in the Code) * Stack Pointer *Only one process can be running in the CPU at any given time* Stack Example

## When is a process created? **System Initialisation (When the system starts):** One or more processes created when the OS starts up\ **Execution of a process creation system call:** Something explicitly asks for a new process ### System calls * System Calls can come from: * User requests to create a new process (system call executed from user shell) * Already running processes * User Programs * System Daemons ### Process End * Conditions that terminate processes can be * Voluntary * Normal Exit * Error Exit * Involuntary * Fatal Error * Killed by another process ## Process Hierarchies * Parent creates a child process * Child processes can create their own children * Forms a hierarchy * UNIX calls this a "Process Group" * If a process exits, its children are "inherited" by the exiting process's parent *However* * Windows has no concept of process hierarchy * All processes are created equal ## Process States A **Process State** is defined by the current activity of the process. As a process executes, its state changes.

Only one process can be in the running state at any instant. Many processes can be ready or waiting.\ \ Each process is internally represented by the operating system by a **Process Control Block (PCB)** also called Task Control Block.\ \ The PCB contains all information associated with the process, such as: * Process State * Values of Program Counter and other registers * CPU Scheduling Information * Priority, Pointer to Scheduling Queue, etc * Accounting Information * Process ID, CPU and Real-Time Used, Time Limits, etc * I/O Status Information * List of I/O devices allocated, List of Open Files, etc ## Process in the OS The process has Two "Layers". \ The lowest layer of process-structured OS handles interrupts, scheduling.\ Above that layer are sequential processes\ \- Processes are tracked in the *Process Table*\ *-* Each process has a *Process Table Entry* Layers of Processes

## Implementation of Processes To implement the process model, the operating system maintains a table called a process table, with one entry per process. This entry contains important information about the process' state, including its program counter, stack pointer, memory allocation, the status of its open files, its accounting and scheduling information, and everything else about the process that must be saved when the process is switched from *running* or *ready* or *blocked* state so that it can be restarted later as if it had never been stopped. ### Process Table Fields | Process Management | Memory Management | File Management | | ------------------------- | ----------------------------- | ----------------- | | Registers | Pointer to Text Segment Info | Root Directory | | Program Counter | Pointer to Data Segment Info | Working Directory | | Program Status Word | Pointer to Stack Segment Info | File Descriptors | | Stack Pointer | | User ID | | Process State | | Group ID | | Priority | | | | Scheduling Parameters | | | | Process ID | | | | Parent Process | | | | Process Group | | | | Signals | | | | Time when Process Started | | | | CPU Time Used | | | | Children's CPU Time | | | | Time of Next Alarm | | | Associated with I/O class is a location (typically at a fixed location near the bottom of the memory) called the **interrupt vector**. It contains the address of the interrupt service procedure. Suppose that user process 3 is running when a disk interrupt happens. User 3's program counter, program status word, and sometimes one or more registers are pushed onto the current stack by the interrupt hardware. The computer then jumps to the address specified in the interrupt vector. That is all the hardware does. From here on, it is up to the software, in particular, the interrupt service procedure. All interrupts start by saving the registers, often in the process table entry for the current process. Then the information pushed onto the stack by the interrupt is removed and the stack pointer is set to point to a temporary stack used by the process handler. Actions such as saving the registers and setting the stack pointer can- not even be expressed in high-level languages such as C, so they are performed by a small assembly-language routine, usually the same one for all interrupts since the work of saving the registers is identical, no matter what the cause of the interrupt is. When this routine is finished, it calls a C procedure to do the rest of the work for this specific interrupt type. (We assume the operating system is written in C, the usual choice for all real operating systems.) When it has done its job, possibly making some process now ready, the scheduler is called to see who to run next. After that, control is passed back to the assembly-language code to load up the registers and memory map for the now-current process and start it running. It is worth noting that the de- tails vary somewhat from system to system. A process may be interrupted thousands of times during its execution, but the key idea is that after each interrupt the interrupted process returns to precisely the same state it was in before the interrupt occurred. *The diagram below summarises this* ## Modelling Multi-programming When multi-programming is used, CPU utilisation can be improved. Example; If the average process computes only 20% of the time it is sitting in memory, then with five processes in memory at once the CPU should be busy all the time. This is unrealistic but it assumes that all five processes will never be waiting for I/O at the same time. Template of what the lowest level of the OS does when an interrupt occurs

Template of what the lowest level of the OS does when an interrupt occurs

A better way is to look at CPU usage using probabilities. Suppose that a process spends a fraction *p* of its time waiting for I/O to complete. With *n* processes in memory at once, the probability that all *n* processes are waiting for the I/O (in which the CPU will be IDLE) is *p^n.* The CPU utilisation is then given by the formula $$ \text{CPU Utilisation = }1-p^n $$ The diagram below shows the CPU Utilisation as a function of *n*, which is called the **degree of multi-programming.**

CPU Utilisation as a function of the number of processes in memory

From the diagram it is clear that if processes spend 80% of their time waiting for I/O, at least 10 processes must be in memory at once to get the CPU waste below 10%. When you realize that an interactive process waiting for a user to type some- thing at a terminal (or click on an icon) is in I/O wait state, it should be clear that I/O wait times of 80% and more are not unusual. But even on servers, processes doing a lot of disk I/O will often have this percentage or more. Suppose, for example, that a computer has 8 GB of memory, with the operating system and its tables taking up 2 GB and each user program also taking up 2 GB. These sizes allow three user programs to be in memory at once. With an 80% aver- age I/O wait, we have a CPU utilization (ignoring operating system overhead) of *1 − 0. 8^3* or about 49%. Adding another 8 GB of memory allows the system to go from three-way multi-programming to seven-way multi-programming, thus raising the CPU utilization to 79%. In other words, the additional 8 GB will raise the throughput by 30%. Adding yet another 8 GB would increase CPU utilization only from 79% to 91%, thus raising the throughput by only another 12%. Using this model, the computer’s owner might decide that the first addition was a good investment but that the second was not. # Threads # Scheduling # Memory Management # Virtual Memory Management # Storage Management # I/O Management # Linux (WIP) # Introduction to Linux "Linux is an open source Unix-Like operating system based on the linux kernal..." yeah this blog isn't about a lecture on linux but how to use the system and utilise it for cyber security. What you need to know is that: * Linux is an operating system * It has things called "Distributions" which are: Ubuntu, Debian, Arch, Fedora, etc. * You have a lot of control over everything and linux won't warn you - wanna delete your root directory? Go for it! This amount of customisation and control over your system makes linux an ideal system to master. ## Using Linux We will go into: * Linux File Systems * Linux Commands * Exercises ### File Systems Files in linux operate on a hierarchy type model for its files and directories: ![Linux FHS](https://tecadmin.net/wp-content/uploads/2022/06/linux-filesystem-hierarchy.png) The top part of the 'tree' is called the root - it houses all of your directories, while everything else is called a 'node'. Each 'parent' node can have a 'child' node, which is to say, a folder inside of another folder. #### Content Types There are 4 major types of content stored in a file system: 1. **Persistent:** Contents that will be persistent after a system reboot. (Systems and Application configuration settings) 2. **Runtime:** Content generated by a running process (Usually deleted by a reboot) 3. **Variable/Dynamic:** The content of these can be appended or modified by processes running on the system 4. **Static Content:** Content that remains unchanged unless edited or configured | System Directories | Purpose | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | /etc | Contains configuration files used by system services | | /root | This is a home directory for the Linux superuser account, `root` | | /boot | Contains all the files needed to start the boot process. | | /home | This is where standard users store their personal configurations and data such as Documents, Videos, Music etc | | /var | Has variable data that is required to persist between boots – databases, log files, mails, cache directories, Web data etc | | /tmp | Stores temporary files. All Linux users can write to this directory. Files older than 10 days are deleted automatically. | | /usr | This directory contains shared libraries, installed software, and read-only program data. Some of the important subdirectories include: /usr/bin: Mostly user commands are located here. /usr/sbin: Hosts System administrative commands that required privilege escalation to run. /usr/local: For locally customized software. | | /dev | This contains special device files used by the system to access hardware. | | /run | The processes started since the last boot stores their runtime data here, e.g. process ID files and lock files. These contents are recreated on reboot. | [Source](https://computingforgeeks.com/understanding-the-linux-file-system-hierarchy/) #### Shortcuts Some helpful shortcuts: ```bash root - '/' home - '~' OR 'cd [ENTER]' previous - '-' ``` ### Navigating your terminal The terminal is the most essential part of your linux system (other than the root, boot, uhh everything else) learning how to use it will make you much faster in navigating, programming, and hacking. Skipping this step will only bring you pain trust me. #### Basic Commands ```bash # Help man - Manual - man [command] - man ls # Utility echo - Echoes user input (Functions as print) - echo "Hello" cat - Concatinate, append or replace text / display file contents - cat "Hello" > file.txt, cat file.txt # Navigation cd - Change Directory - cd [directory] - cd / ls - List Directory Contents - ls [OPTIONS] - ls OR ls /[folder] # Creating Files & Folders mkdir - Make Directory - mkdir [NAME] - mkdir testfolder touch - Create File - touch [NAME][.EXT] - touch script.sh cp - Copy File - cp [ORIG] [COPY] - cp original.txt new.txt mv - Move / Rename - mv [file/folder] [location] OR mv [filename1] [filename2] # Deleting Files & Folders rm - Remove - rm [FILE] - rm script.sh rmdir - Remove Directory - rmdir [FOLDER] - rmdir testfolder (Empty folders) # Network Commands ifconfig - Interface Configuration - shows your IP addresses, and other network info - ifconfig [INTERFACE] - ifconfig eth0 ip - Same as ifconfig - ip a netstat - Network Statistics - netstat [FLAGS] ping - Sends packets to check destination response - ping [URL] OR ping [IP] ``` There are many more commands that we will come across but we will get to them later. For now, let's look at flags and wildcards. **Flags** ```bash # Flags [Find list of a commands' flag using man] ## Navigation ls -l > Long list ls -a > Display All (Hidden included) ls -R > List recursively (Current directory + any directory that is inside it) # You can chain flags together too (Usually) ls -la > List everything + long listed ls -laR > Everything + Recursive + Long ## Nested folders mkdir -p > create folders + parent folders if they are not present - mkdir -p folder1/folder2/folder3 ## Remove rm -r > remove recursively rm -f > force remove rm -rf > recursive force (! Careful with this, you can delete your entire file system as well) ``` **Wildcards** Wildcards are special characters that do specific things or target specific items based on the users' input ```bash * - Matches any number of chars or a set of chars. Example: file1.txt file2.txt To select file2.txt using *: *2.txt it will target a pattern that matches with whatever ends in 2.txt ? - Matches a set number of chars depends on how many ? you use. Example: Seer Seen Soon To select everything that starts with S, has 2 chars in the middle, and ends with n - S??n [] # - Matches a range of characters between the brackets. Example: S[on]n # will match Son and Snn (Range from on) # If we do S[a-d]n, we will match San, Sbn, Scn, Sdn (Range from a to d) ``` ### Exercises Solve these exercises to get you comfortable with using Linux. You can always refer to the `man` page or back here for references. \[+] [OverTheWire Bandit](https://overthewire.org/wargames/bandit/) \[+] [Linux Full Course Video](https://www.youtube.com/watch?v=Wgi-OfbP2Gw) # Linux System Management ## Processes ## Networking ### IP Configuration ### Firewall Uncomplicated Firewall (UFW) is a simple to use tool which allows you to set up firewall rules in less than 5 minutes. ```bash sudo -s apt-get install ufw # -------------------- # This says that it will allow any outgoing connections on port 22 using the TCP protocol ufw allow out 22/tcp # This allows all traffic on port 22 TCP/UDP ufw allow 22 # This will deny ALL outgoing connections ufw default deny outgoing ``` By default, UFW will create a set of IPv4 and IPv6 - it is recommended that you delete whichever one you don't use. ## Automation There are tasks that we might do every time we start our system or every so often - like backing up folders, starting an application or multiple applications, or running scripts. Instead of doing it manually, Linux provides a process called **Cron** which we can utilise to automate these boring tasks and do them for us. ### Crontabs A crontab is a file that's utilised by the cron process to execute each line of instructions.\ Crontabs need 6 values in-order to work: | Value | Description | | ----- | ----------------------------------------------- | | MIN | What minute to execute at | | HOUR | What hour to execute at | | DOM | What **D**ay **O**f the **M**onth to execute at | | MON | What **M**onth **O**f the **Y**ear to execute a | | DOW | What **D**ay **O**f the **W**eek to execute at | | CMD | The actual command that'll get executed | | \* | NULL | [*TryHackMe - Linux 3*](https://tryhackme.com/room/linuxfundamentalspart3) For example, if we wanted to start a script called `update_repos.sh` every Friday, we would do: ```bash * * * * 5 bash /home/username/update_repos.sh >/dev/null 2>&1 ``` We can use a tool like [Crontab Generator](https://crontab-generator.org/) to make these for us since memorising the positions is a hassle and we like things easy *right?*\ The asterisks represent NULL inputs if we don't want to include additional values. #### Creating & Editing a crontab Enough with the boring stuff, let's look at how to create our own crontabs. Start by opening your terminal and executing `crontab -e` ```bash no crontab for USER - using an empty one Select an editor. To change later, run 'select-editor'. 1. /bin/nano <---- easiest 2. /usr/bin/vim.basic 3. /usr/bin/vim.tiny 4. /bin/ed Choose 1-4 [1]: ``` You might get this on first launch, select 1 if you want to go with `nano`, I prefer Vim so I'll use the second option. Scroll down to the bottom of the list and create a new line by hitting the `return` key (Enter).\ \ Now, go to [Crontab Generator](https://crontab-generator.org/) and create a process to automate!

Once you're done, click generate and paste the output into your crontab editor

Press `Ctrl + X` to save on Nano, or `:wq` on Vim. That's it!\ If you want to remove your saved crontabs, you can run `crontab -r`. # Programming (WIP) # Assembly {% embed url="" %} {% embed url="" %} {% embed url="" %} # C(++/#) # Python # Nim Resources to get started with Nim Programming {% embed url="" %} {% embed url="" %} # Bash Bash Scripting * [x] Introduction to Bash * [x] Variables, Loops, and Port Scanner * [ ] Interacting with existing tools # Introduction to Bash Scripting Bash scripting is a powerful tool that allows you to automate tasks, create programs, and perform various operations on your computer or server. In this blog post, we will introduce the basics of bash #### What is Bash? Bash (short for Bourne Again Shell) is a Unix shell and command language that is widely used on Linux and other Unix-like operating systems. It allows you to interact with the operating system through the command line and provides many features for scripting, such as variables, loops, and conditional statements. #### Getting Started with Bash Scripting To write a bash script, you will need a text editor and a terminal program. Any text editor will do, but it is recommended to use one that has syntax highlighting for bash scripts, such as `vi`, `emacs`, or `nano`. To create a new bash script, open a text editor and type the following at the top of the file: ```bash #!/bin/bash ``` This is known as the "shebang" and tells the operating system which interpreter to use when running the script. Next, you can add your bash commands below the shebang. For example, to display a message on the screen, you can use the echo command: ```bash #!/bin/bash echo "Hello, world!" ``` To execute the script, open a terminal and navigate to the directory where the script is saved. Then, use the chmod command to make the script executable: ```bash chmod +x script.sh # chmod (or change mode) is used to change file and folder permissions. # r - Read # w - Write # x - Execute ``` Finally, run the script using the `./` command: ```bash ./script.sh ``` #### Examples of Bash Scripts Here are some examples of tasks that can be automated using bash scripts: ``` Managing files and directories Working with text and strings Interacting with other programs (We will be looking into this more later on) Performing system tasks, such as starting and stopping services Repetitive work (Recon/Enumeration, exploit scripts, etc.) ``` #### Debugging and Troubleshooting Bash Scripts Bash scripts can sometimes produce error messages or behave unexpectedly. Here are some tips for debugging and troubleshooting bash scripts: ``` Use the bash -x option to enable debugging output Use the set -e option to make the script exit immediately if any command fails Use the set -u option to exit if an uninitialized variable is used Use the set -o pipefail option to make the script exit if any command in a pipeline fails ``` #### Tips and Best Practices Here are some tips for writing efficient and maintainable bash scripts: * Use # to add comments to your code - This makes it easier for others to understand your code, as well as yourself if you are coming back to it in the future. * Use variables to store data and make your code more readable * Use functions to organize your code and make it easier to reuse * Test your scripts thoroughly before deploying them #### Conclusion We have introduced some of the basics towards bash scripting. In the next post, we will do a deep dive into variables, loops, and we will make a port scanner as our project. #### Resources \[+] [GeeksForGeeks](https://www.geeksforgeeks.org/bash-scripting-introduction-to-bash-and-bash-scripting/) # Variables, Loops, and Port Scanner In the previous post, we went over how to create a Bash script and run it on our terminal. In this one, we will be taking a look into creating variables, loops, passing system arguments, and finally - building a portscanner. #### Variables Variables are names that hold a value. If we have a fruit, the fruit will have seeds in it, in programming we might say fruit="Seeds", it's a great way to store things which we want to reference it later in the program. ```bash #!/bin/bash hello="Hello World" echo $hello ``` We first assigned a string `"Hello World"` to our variable called hello, then we used the `$` operator to reference the variable `hello`, and used the `echo` command to print the string out to the user. We can use a number of data types to store into our variables, namely: ```bash string: Alphanumerical Character "Apple" float: Decimal Value 3.14 integer: Numerical Value 5 ``` #### Loops Loops are methods in which we can iterate over a given code a specific number of times or, an infinite number of times (infinite loop). Generally, we want to avoid infinite loops as it can crash your program or computer. There are a couple of loops that we can choose from; While loops, Until loops, and For Loops. **For Loop** The for loop is usually used to iterate through a range of items or a sequence of integers. Let's take a look at a simple example using the same code as before: ```bash #!/bin/bash hello="Hello World" for i in range {1..5} do echo $hello done ``` We first gave an instruction to our loop to iterate on a range from 1-5: `for i in range {1..5}`, then we said `do` to tell the program what to run, which in this case was our echo statement, then we closed the loop using `done` The output looks like this: ```bash Hello World Hello World Hello World Hello World Hello World ``` **While Loops** While loops are used when the limit is unknown, like `loop $function until $function > 10`, we don't know when it will be more than 10, but when it reaches that the program stops. (When it reaches the specified limit, it changes True to False) ```bash #!/bin/bash count=0 while [ $count -le 5 ] do echo "Count = " $count ((count++)) done ``` We first assigned an integer variable called `count` with the value `0` so we can iterate up to a number limit. Then, in our `while` loop, we specified that count should be Less Than (`-le`) 5. The command in the loop will print out the current number that count is assigned to then increment count by 1. The output looks like this: ```bash Count = 0 Count = 1 Count = 2 Count = 3 Count = 4 Count = 5 ``` **Until Loops** Until loops are similar to While loops, but instead of the statement being True, it's first False then changed to True once the condition is met. ```bash count=0 until [ $count -gt 5 ] do echo "Count = " $count ((count++)) done ``` Our condition is that `until` our `count` variable is Greater Than (`-gt`) 5, repeat the command. The output for this is the same as While. A more in-depth look into loops can be found in [this link](https://linuxhint.com/full-guide-to-bash-loops/) #### Port Scanner A port scanner is a program which identifies what network ports a given address has. For example, if we have a network `127.0.0.1` with an `http` server, we might identify port 80. This is useful if we want to attack networks as it gives us a path of what we want to enumerate or use as our attack vector. ```bash #!/bin/bash # Variables ip=$1 # Scanner for port in range {1..65535} do 2>/dev/null echo > /dev/tcp/$ip/$port if [ $? == 0 ]; then { echo "[+] Port: $port is open" } fi done ``` The variable `ip` takes in the first command line argument from the user `./portscanner.sh `, which is then run through `/dev/tcp` with the port from range 1..65535 (the max number of ports on a network). If the port is open, then the port will be printed to the user. If not, then it will be sent to `/dev/null` to hide the output. ```bash $> ./portscanner.sh 127.0.0.1 [+] Port: 8080 is open ``` #### Conclusion We now have a basic understanding of how Bash scripts are written and how we can interact with linux applications using it. Your task is to experiment with different things that you might need in a CTF, daily automation, etc. Good luck! # Networking (WIP) # Networking 101 # Networking Basics ## Networking Definition Networking is what connects people, devices, and the world together. This of a computer network like a conference where people meet up and exchange information, or a global trade network where companies trade goods and services to each other or to individuals. In a networking sense, each individual would be what is called an End Devices. Computers, mobile phones, and VOIP telephones, are some examples of end devices. For data to reach an end device, you will need ## Network Architecture ### Topology #### LAN - Local Area Network Local Area Network refers to devices which are wired together using physical cables, in a local area (Like a computer lab). There are different topologies in which the devices are connected Different Network Topologies

**Point to Point:** Point to point is when an end device is connected to an end device #### WLAN - Wireless Local Area Network #### WAN - Wireless Area Network #### VPN - Virtual Private Network ### Hardware # Protocols # IPv4 # IPv6 # Packet Tracer ## Requirements * Sign up for Skillsforall * Visit [this link](https://skillsforall.com/resources/lab-downloads) to download the Packet Tracer application (Supports Windows, Ubuntu, and MacOS - though I have gotten it to work on other linux distros) * [Networking Basics](/fundamentals/networking-wip/networking-101/networking-basics) # Interface

## Network Devices ### Routers

### Switches

### Hubs

### Wireless Networks

# Connections # Creating Networks # Virtual LANS & Trunks # Subnetting # Network Security # Report Writing (WIP) # Research Skills # Structuring a Report ## Introduction Reports are a way of telling a story in a structured way, such that the information is digestible to persons of any level of understanding. Within 5 minutes, anyone should be able to tell what the report is about, what the conclusion is, and what it is trying to fix. ## Types of Reports When writing and structuring a report, we must know what the goal of it is - is it a penetration testing report that's meant to be seen by the client, their C-Suite, and engineers? Or is it a research paper that's meant to collate data and how one can gain knowledge, or fix an issue through it? * Informational Report * Research Report * Operational Report * Penetration Testing Report * Red Team Report * Incident Report * Open Source Intelligence Report # Creating Templates # Methodologies Penetration Testing and Red Team Methodologies ## What are Methodologies? These are globally recognised standards for Red and Blue teams. The purpose of having methodologies is to set a standard across every country or company. ### [OSSTMM](/general-security/methodologies/osstmm) > The Open Source Security Testing Methodology Manual (OSSTMM) is a methodology to test the operational security of physical locations, workflow, human security testing, physical security testing, wireless security testing, telecommunication security testing, data networks security testing and compliance. OSSTMM can be supporting reference of ISO 27001 instead of a hands-on or technical application penetration testing guide. *\~* [*OWASP*](https://owasp.org/www-project-web-security-testing-guide/latest/3-The_OWASP_Testing_Framework/1-Penetration_Testing_Methodologies#open-source-security-testing-methodology-manual) ### [OWASP](/general-security/methodologies/owasp) The Open Web Application Security Project Methodology covers 3 parts - Web Security (WSTG), Mobile Security (MSTG), and Firmware Security. They are most popularly known by the OWASP Top 10 ratings for popular Web Vulnerabilities for each given year. OWASP also creates labs such as DVWA and Juice Shop where you can practice and learn about their Top 10 vulnerabilities and how to exploit them. ### [NIST](/general-security/methodologies/nist) The NIST Cyber Security Framework covers the Blue Team Methodology of Identify, Protect, Detect, Respond and Recover. They set standards on best practices, Guidelines and Standards for managing cyber security risks. Additionally, NIST provides [free online learning](https://www.nist.gov/cyberframework/online-learning) to teach end users how to use their framework, and how to implement them into their businesses and lives. ### [PTES](/general-security/methodologies/ptes) > The Penetration Testing Execution Standard (PTES) is the most recent (and arguably the most complete overall) penetration testing methodology to date. It was developed by a team of information security practitioners with the aim of addressing the need for a complete and up-to-date standard in penetration testing. \~ [FutureLearn](https://www.futurelearn.com/info/courses/ethical-hacking-an-introduction/0/steps/71523) ### [Cyber Killchain](/general-security/methodologies/cyber-killchain) > Developed by Lockheed Martin, the Cyber Kill Chain® framework is part of the Intelligence Driven Defense® model for identification and prevention of cyber intrusions activity. The model identifies what the adversaries must complete in order to achieve their objective. > > The seven steps of the Cyber Kill Chain® enhance visibility into an attack and enrich an analyst’s understanding of an adversary’s tactics, techniques and procedures. \~ [*Lockheed Martin*](https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html) # OSSTMM Open Source Testing Methodology Manual {% embed url="" %} # OWASP Open Web Application Security Project {% embed url="" %} # Web Security Testing Guide # Mobile Security Testing Guide # NIST National Institute of Standards and Technology {% embed url="" %} Taken from this website {% endembed %} ## NIST DEFEND Methodology ### Identify The Identify Function assists in developing an organizational understanding to managing cybersecurity risk to systems, people, assets, data, and capabilities. Understanding the business context, the resources that support critical functions, and the related cybersecurity risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs. **Examples of outcome Categories within this Function include:** * Identifying physical and software assets within the organization to establish the basis of an Asset Management program * Identifying the Business Environment the organization supports including the organization's role in the supply chain, and the organizations place in the critical infrastructure sector * Identifying cybersecurity policies established within the organization to define the Governance program as well as identifying legal and regulatory requirements regarding the cybersecurity capabilities of the organization * Identifying asset vulnerabilities, threats to internal and external organizational resources, and risk response activities as a basis for the organizations Risk Assessment * Identifying a Risk Management Strategy for the organization including establishing risk tolerances * Identifying a Supply Chain Risk Management strategy including priorities, constraints, risk tolerances, and assumptions used to support risk decisions associated with managing supply chain risks ### Protect The Protect Function outlines appropriate safeguards to ensure delivery of critical infrastructure services. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event. **Examples of outcome Categories within this Function include:** * Protections for Identity Management and Access Control within the organization including physical and remote access * Empowering staff within the organization through Awareness and Training including role based and privileged user training * Establishing Data Security protection consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information * Implementing Information Protection Processes and Procedures to maintain and manage the protections of information systems and assets * Protecting organizational resources through Maintenance, including remote maintenance, activities * Managing Protective Technology to ensure the security and resilience of systems and assets are consistent with organizational policies, procedures, and agreements ### Detect The Detect Function defines the appropriate activities to identify the occurrence of a cybersecurity event. The Detect Function enables timely discovery of cybersecurity events. **Examples of outcome Categories within this Function include:** * Ensuring Anomalies and Events are detected, and their potential impact is understood * Implementing Security Continuous Monitoring capabilities to monitor cybersecurity events and verify the effectiveness of protective measures including network and physical activities * Maintaining Detection Processes to provide awareness of anomalous events ### Respond The Respond Function includes appropriate activities to take action regarding a detected cybersecurity incident. The Respond Function supports the ability to contain the impact of a potential cybersecurity incident. **Examples of outcome Categories within this Function include:** * Ensuring Response Planning process are executed during and after an incident * Managing Communications during and after an event with stakeholders, law enforcement, external stakeholders as appropriate * Analysis is conducted to ensure effective response and support recovery activities including forensic analysis, and determining the impact of incidents * Mitigation activities are performed to prevent expansion of an event and to resolve the incident * The organization implements Improvements by incorporating lessons learned from current and previous detection / response activities ### Recover The Recover Function identifies appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. The Recover Function supports timely recovery to normal operations to reduce the impact from a cybersecurity incident. **Examples of outcome Categories within this Function include:** * Ensuring the organization implements Recovery Planning processes and procedures to restore systems and/or assets affected by cybersecurity incidents * Implementing Improvements based on lessons learned and reviews of existing strategies * Internal and external Communications are coordinated during and following the recovery from a cybersecurity incident # PTES > *The penetration testing execution standard consists of seven (7) main sections. These cover everything related to a penetration test - from the initial communication and reasoning behind a pentest, through the intelligence gathering and threat modeling phases where testers are working behind the scenes in order to get a better understanding of the tested organization, through vulnerability research, exploitation and post exploitation, where the technical security expertise of the testers come to play and combine with the business understanding of the engagement, and finally to the reporting, which captures the entire process, in a manner that makes sense to the customer and provides the most value to it. \~* [*OWASP*](https://owasp.org/www-project-web-security-testing-guide/latest/3-The_OWASP_Testing_Framework/1-Penetration_Testing_Methodologies#penetration-testing-execution-standard) ### Diagram

### Details #### Pre-Engagement # Cyber Killchain # Binary Exploitation {% embed url="" %} {% embed url="" %} # Cheat Sheets # Enumeration # Network Scan ## Nmap ## Amass # Vulnerability Scan ## Nikto ## WPScan ## Nmap ## Metasploit ## OpenVAS ## Nessus # Web Scan # Exploitation # Page 1 # Payloads & Shells ## Reverse Shells ## Bind Shells # Post Exploitation # Lay of The Land ## Linux ## Windows ## Active Directory # Persistence ## Linux ## Windows ## Active Directory ## Web Server # Data Exfiltration ## Netcat ## Socat ## SCP ## SMB ## Python ## Updog # Pivoting # Command & Control C2 or C\&C ## Metasploit ## Armitage ## Sliver ## Havoc # Disassembly # Radare2 # GDB # Hardware Exploitation # Intro to Hardware # Red Team ## About Red Teaming is the act of performing Adverserial Tactics, Techniques, and Procedures ([TTPs](https://csrc.nist.gov/glossary/term/tactics_techniques_and_procedures)) to represent an attacker, such as a state sponsored threat actor, or an insider threat. It is a term created by the US Military to test battalion readiness (See [Geronimo ](https://en.wikipedia.org/wiki/509th_Infantry_Regiment_$United_States$)Battalion) or as an OPFOR for allied countries. ## The Need The point of Red Teams is to measure cyber readiness and the physical security of a company, whether internal, or external. The difference betwen a Red Team and a Penetration Test is that red teams aren't disclosed to the blue team or organisation except for an insider contact (the CISO or similar). Watch the video for a small introduction to Red Teaming. {% embed url="" %} ## Resources ### Blogs {% embed url="" %} ### Books {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} ### Organisations {% embed url="" %} {% embed url="" %} ### Courses {% embed url="" %} Red Team Path {% endembed %} {% embed url="" %} Responsible Red Teaming - Husky Hacks {% endembed %} {% embed url="" %} Red Team Fundamentals Course {% endembed %} {% embed url="" %} # Malware Development # C# Malware # Offensive Development Building resilient infrastructure, and automating offensive development ## [DevOps](/offensive-security/red-team/offensive-development/offensive-devops) ### GitLab Infrastructure

/pages/ZpnK2uoO104k2jylrS39

[GitLab Setup](/offensive-security/red-team/offensive-development/offensive-devops/gitlab/gitlab-setup) [Simple Calculator Project](/offensive-security/red-team/offensive-development/offensive-devops/gitlab/simple-calculator-project) [Making our CI/CD Pipeline](/offensive-security/red-team/offensive-development/offensive-devops/gitlab/making-our-ci-cd-pipeline) [Build Artifacts](/offensive-security/red-team/offensive-development/offensive-devops/gitlab/build-artifacts)

### TeamCity Infrastructure

/pages/7t7tZfBTNpdwbTYVYNLJ

[TeamCity Setup](/offensive-security/red-team/offensive-development/offensive-devops/teamcity/teamcity-setup) [Creating TeamCity Projects](/offensive-security/red-team/offensive-development/offensive-devops/teamcity/creating-teamcity-projects) [Obfuscating Payloads](/offensive-security/red-team/offensive-development/offensive-devops/teamcity/obfuscating-payloads)

### Jenkins Infrastructure

/pages/CT2N7M1NW6zQ8S1oTtk4

## [Infrastructure](/offensive-security/red-team/offensive-development/infrastructure-development-wip) ### Command & Control Infrastructure

/pages/0lbHUhHDgn1KlKyjPlTU

[Command & Control Anatomy](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/command-and-control-anatomy) [Traffic Redirection](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/traffic-redirection) [Covert Infrastructure](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/covert-infrastructure)

### Phishing Infrastructure

/pages/a1bxgwQdSUcdeEp7tgM3

[Email Anatomy](/offensive-security/red-team/offensive-development/infrastructure-development-wip/phishing-infrastructure/email-anatomy) [Payload Delivery](/offensive-security/red-team/offensive-development/infrastructure-development-wip/phishing-infrastructure/payload-delivery) [Removing Red Flags](/offensive-security/red-team/offensive-development/infrastructure-development-wip/phishing-infrastructure/removing-red-flags)

### Infrastructure as Code

/pages/HYCKesGRMhrKPm0nGIAi

[Terraform](/offensive-security/red-team/offensive-development/infrastructure-development-wip/infrastructure-as-code/terraform) [Ansible](/offensive-security/red-team/offensive-development/infrastructure-development-wip/infrastructure-as-code/ansible)

### Infrastructure Automation

/pages/vOtC0kJoOjDFuaSL0CbG

[Structuring our Project](/offensive-security/red-team/offensive-development/infrastructure-development-wip/infrastructure-automation/structuring-our-project) [Automating Server Setups](/offensive-security/red-team/offensive-development/infrastructure-development-wip/infrastructure-automation/automating-server-setups) [Orchestrating our Infrastructure](/offensive-security/red-team/offensive-development/infrastructure-development-wip/infrastructure-automation/orchestrating-our-infrastructure) [CI/CD Integration](/offensive-security/red-team/offensive-development/infrastructure-development-wip/infrastructure-automation/ci-cd-integration)

# Offensive DevOps About Offensive DevOps ### Development Operations #### What is DevOps *I don't know, I'm not a developer\~* DevOps - or Development Operations, is a methodology whereby people, technology, and processes are controlled in a lifecycle - from the integration of software, to its deployment and back.

#### What is CI/CD This is the practice of automating procedures to accelerate software deployment and delivery - instead of having to build on Visual Studio, releasing that as a binary manually, and repeating that process with each version of your software, you automate the unit testing and building of your code to then release it out into the wild. ### Offensive DevOps In our case, DevOps is used to automate the building, obfuscation, and submission of tools to our operators around the clock. Infrastructure and code should be maintainable and recyclable to achieve maximum efficiency when performing an assessment. #### Red Team [Capability Maturity Model](https://www.redteammaturity.com/) The goal of this blog is to achieve a level 4 -> 5 in **Configuration Management** and a level 3 in **Operational Capability** #### **Configuration Management** ***Level 4*** *The Red Team uses merge and pull requests, or similar, prior to changing known-good versions* ***Level 5*** *The Red Team leverages automated CI/CD actions to expedite delivery and maintain quality of products* #### Operation Capability ***Level 3*** *The Red Team modifies common TTPs to address operation needs; the Red Team collectively has deep knowledge of common software / services / technologies, such as Active Directory or a CSP in use; the Red Team has identified specialisations aligned to operation phases or needs* ### Blog Scope * Setting up a GitLab server * Setting up a TeamCity and Jenkins server * Setting up CI/CD Pipelines * Building Private and Public Projects * Obfuscating and Storing Tools ### Offensive DevOps Architecture

### Table of Contents

/pages/ZpnK2uoO104k2jylrS39

/pages/7t7tZfBTNpdwbTYVYNLJ

/pages/CT2N7M1NW6zQ8S1oTtk4

[Jenkins Setup](/offensive-security/red-team/offensive-development/offensive-devops/jenkins-wip/jenkins-setup) [Creating Pipelines](/offensive-security/red-team/offensive-development/offensive-devops/jenkins-wip/creating-pipelines) [Managing Projects](/offensive-security/red-team/offensive-development/offensive-devops/jenkins-wip/managing-projects) [API Interaction](/offensive-security/red-team/offensive-development/offensive-devops/jenkins-wip/api-interaction)

### Credits & References * Mika 💜 - Proof Reading * * # GitLab GitLab is a tool used by organisations to ease development, host private and public repositories, and manage department-based security controls. It is an alternative solution to GitHub which can be hosted on-premises, removing some security risks which may occur from data breaches or online misconfigurations (though they can still exist if misconfigured locally). {% hint style="warning" %} You are expected to know Git commands for this module, as we will be using it throughout the project. {% endhint %} # GitLab Setup ### Module Objective * Setting up a GitLab server * Creating users * Pushing and Pulling repositories from our private instance * Creating build pipelines to test for failures ### Prerequisites {% code overflow="wrap" %} ```yaml Minimum: - 4GB RAM - 50GB Disk Space - Virtualisation Software (VMWare or VirtualBox) - Linux Server (We will be using Ubuntu 22.04 for our lab) - https://ubuntu.com/download/server ``` {% endcode %} #### Network Setup (OPTIONAL) {% hint style="info" %} **Section Objective** * Create a segregated network for private connections {% endhint %} This section goes over how to set up a Host-Only network if you want to access the server from a virtual machine that is not connected to NAT. On the **Virtual Network Editor**, click on ***Add Network -> OK*** then select the **Host-Only** option. You can rename it if you would like.

After you're done with the network configuration, click on your Ubuntu Server VM and click on ***VM -> Settings***

and add your network

### GitLab Installation {% hint style="info" %} **Section Objective** * Setting up a GitLab instance * Setting up runners to compile projects {% endhint %} {% hint style="warning" %} If you don't see an IP Address, then try running `sudo dhclient ` {% endhint %} Before starting this section, have a Linux server up and ready. The script below will install GitLab, Docker, and some quality-of-life tools such as Vim and ohmyzsh (you can remove these from the script if you do not want them). Download the script then run the following commands: ```bash chmod +x install_gitlab.sh sudo ./install_gitlab.sh # Don't set it as localhost/127.0.0.1 ``` {% @github-files/github-code-block url="" %} Once the installation is complete, you should be able to open the GitLab web page from your host/Window VM at the selected IP Address GitLab creates a random root password which you can get by running the command below {% code overflow="wrap" %} ```bash sudo cat /etc/gitlab/initial_root_password ``` {% endcode %} Use this to log in to the web console

{% hint style="danger" %} Make sure to save or change the root password, as it will be deleted from the server files after logging in. {% endhint %} #### OPTIONAL - Adding an SSL Certificate If you are implementing this in an organisation environment, setting up a TLS certificate is advisable to encrypt the traffic going to and from the server. We will not go through this in this blog, but you can easily find it on the GitLab documentation below. {% embed url="" %} GitLab SSL Installation for Linux {% endembed %} ### Adding a Runner {% hint style="info" %} **Section Objectives** * Create a Runner instance * Register the runner to the GitLab server {% endhint %} A runner is a program that runs on your server. It compiles and builds projects depending on the language it's using. We will need to create a runner for each language we use in our project, though multiple projects can use the same runner making it handy for multiple build pipelines. Below are a couple of languages that you can have a runner use, there are a lot more though. {% hint style="info" %} **Runner Languages** * Golang: * Python: * C#: * C: * Rust: ... {% endhint %} #### Installing a runner To install a runner, we first need to get the dependencies, we've made this simpler by providing the script below: {% @github-files/github-code-block url="" %} Download it then execute it. After installation is complete, you will be met with a prompt - keep this open as we move on to the next step. #### Getting a Token Each runner we create requires a unique token which we can generate from the Runners tab, under CI/CD.

Click on **New Instance Runner -> Linux -> Create runner** to open the runner config settings

{% code title="Example Prompt" overflow="wrap" %} ```bash Enter the GitLab instance URL (for example, https://gitlab.com/): http://192.168.8.142 Enter the registration token: glrt-5yE22sixYMxP5jW4FLpq Verifying runner... is valid runner=5yE22sixY Enter a name for the runner. This is stored only in the local config.toml file: [devops]: golang2 Enter an executor: custom, parallels, kubernetes, docker-autoscaler, instance, shell, ssh, virtualbox, docker, docker-windows, docker+machine: docker Enter the default Docker image (for example, ruby:2.7): golang:1.22 Runner registered successfully. Feel free to start it, but if it's running already the config should be automatically reloaded! ``` {% endcode %} Copy the token, then go back to your terminal. Enter your GitLab server IP, then your runner's token, name your runner (you can give it the same name as the UI one), type `docker` for the executor, and then the language of your choice. Since I'll be using Go for this demo, use `golang:1.22` Once you are done, type in `sudo gitlab-runner` run to generate a callback to the server. This will register it for later use. {% hint style="danger" %} **Make sure to run the command as sudo** `sudo gitlab-runner ...` {% endhint %}

TL;DR Steps

1. Open the Runner screen from **Dashboard -> Build -> Runner -> New Instance Runner** 2. Create a Linux runner, add tags *(optional)* 3. Copy Runner Token 4. In your terminal, type `sudo gitlab-runner register` 5. Enter your GitLab IP address 6. Enter your runner's token 7. Enter a name for your runner 8. Enter `docker` for the executor 9. Enter a language you want the runner to compile 10. Execute `sudo gitlab-runner run`

### Adding Users {% hint style="info" %} **Section Objectives** * Create normal users * Add an SSH key for the user {% endhint %} Now that we have the core settings set up, we can start creating users by going to **Admin Area -> Users -> New User** Fill in the required details, set the access level as **Regular**, then click **Create User** Before logging out of root, click the Edit button next to the user and give them a username and password. You can optionally set up SMTP to send a password reset link instead.

{% embed url="" %} GitLab SMTP Setup {% endembed %} Once the password has been set, log in to your user, go to **Edit Profile -> SSH Keys** and add a new SSH key. This will let you push and pull private repositories from this user. We will also do this for our Windows VM to connect our private GitLab repositories to TeamCity. You can create one by running `ssh-keygen` if you do not have a copy or want a separate key for the server. SSH keys can be found in `/home/$USER/.ssh/SSH_KEY_NAME.pub`

# Simple Calculator Project ### Module Objectives * Creating a simple project * Adding code * Uploading our code to GitLab * Writing test cases to check for failed and successful builds ### Creating a Project Repository Now that we have everything set up, we can start making projects. Start by logging into your normal user (if you haven't already), then go to **Projects -> New Project.** *You can remove the README.*

Set your project to public or private - we can use private for this one since we have our SSH key uploaded

Once it's been created, git clone your project into a directory

### Making a simple calculator To test if our runner works, we will create a simple program which we can upload then run tests and configure pipelines for. Let's make a simple calculator. I'll be using Go for this example {% code title="calculator.go" %} ```go package main import "fmt" func Add(x, y int) (res int) { return x + y } func Subtract(x, y int) (res int) { return x - y } func main() { fmt.Println("Addition: ", Add(1, 2)) fmt.Println("Subtraction: ", Subtract(4, 2)) } ``` {% endcode %} Test this by running `go run calculator.go` ``` Addition: 3 Subtraction: 2 ``` Now that it works, we can push our demo app to our repository ```bash > git switch -c main > git add . > git commit -m "Calculator Demo" > git push origin main ```

### Writing Test Cases Now that we have a functioning program, we can write a test case to check whether the values are acceptable, if not it will fail the build. We will reuse the code above for this [*Reference*](https://www.digitalocean.com/community/tutorials/how-to-write-unit-tests-in-go-using-go-test-and-the-testing-package) {% code title="calculator.go" %} ```go package main import "fmt" func Add(x, y int) (res int) { return x + y } func Subtract(x, y int) (res int) { return x - y } func main() { fmt.Println("Addition: ", Add(1, 2)) fmt.Println("Subtraction: ", Subtract(4, 2)) } ``` {% endcode %} {% code title="calculator\_test.go" %} ```go package main import "testing" func TestAdd(t *testing.T){ got := Add(4, 4) want:= 8 if got != want { t.Errorf("got %q. wanted %q", got, want) } } func TestSubtract(t *testing.T){ got := Subtract(6, 4) want:= 2 if got != want { t.Errorf("got %q. wanted %q", got, want) } } ``` {% endcode %} To run the test: ```bash > go mod init calculator > go test # Result > go test PASS ok calculator 0.127s ``` We can test for failure as well by changing the `want` variable to a random integer/string ```bash > go test --- FAIL: TestAdd (0.00s) calculator_test.go:9: got '\b'. wanted '\x05' --- FAIL: TestSubtract (0.00s) calculator_test.go:19: got '\x02'. wanted '\x03' FAIL exit status 1 FAIL calculator 0.215s ``` Change back the values and push the code to your repository # Making our CI/CD Pipeline ### Config File To create our pipeline, we must first create a `.gitlab-ci.yml` file and specify it to our project requirements (Place this in your project root) [Templates](https://docs.gitlab.com/ee/ci/examples/) [Syntax Reference](https://docs.gitlab.com/ee/ci/yaml/) {% code title=".gitlab-ci.yml" %} ```yaml image: golang:1.22 stages: - test - build build: stage: build script: - "go build -o calculator" - "./calculator" test: stage: test script: - "go test" ``` {% endcode %} Paste the code then push it to your repository ```bash > git add .\.gitlab-ci.yml > git commit -m "Created GO Pipeline" > git push ``` We can now view our pipeline from the repository, under **Build -> Pipeline -> Pipeline Number** ### **Viewing our deployed pipeline**

{% hint style="warning" %} **Issues Faced** Spent the better part of an hour debugging and figured out that you need to create a runner as root cause of docker permissions. Alternatively, you can add yourself to the docker group - although it's easier just to use sudo {% endhint %} ### Testing for Failures Just like in [Simple Calculator Project](/offensive-security/red-team/offensive-development/offensive-devops/gitlab/simple-calculator-project), we can test for failures by changing the values slightly First, we'll create a separate branch to mimic a real project, then change the test values from there

Push your changes then wait for the pipeline to finish running

We can now fix it back and create a merge request to main. Merge requests will trigger a pipeline job to check for errors before letting you merge (depending on your project settings)

# Build Artifacts ### Basic Artifact Output Artifacts are files that are exported from our build step, such as binary executable files. We can easily add them with 2 more lines on our pipeline configuration file. [*More Details*](https://docs.gitlab.com/ee/ci/jobs/job_artifacts.html) ```yaml image: golang:1.22 stages: - test - build build: stage: build script: - "go build -o calculator" - "./calculator" artifacts: # Our change paths: - calculator # Filename test: stage: test script: - "go test" ``` Save your changes to trigger a new deployment pipeline, then check if you can download the file

### Better ways of storing artifacts Look into deploying your artifacts into a file server such as through SSH, SMB or NFS. Below is an example of using SSH for this. * # TeamCity TeamCity is a free\* CI/CD platform developed and maintained by JetBrains. The on-premises professional version gives us powerful features which can be used in an enterprise environment (though it might not fit your enterprise's scale). TeamCity will allow us to pull public, and private repositories from GitHub and GitLab respectively, which makes it fairly flexible when using other people's tools, and customising it to our needs. # TeamCity Setup ### Module Objectives * Setup TeamCity * Install Languages * C# * Go * Create Users * Configure GitLab to work with TeamCity ### Prerequisites {% code overflow="wrap" %} ```yaml Minimum: - 4GB RAM - 64GB Disk Space - Virtualisation Software (VMWare or VirtualBox) - Windows 10 Pro - Git - Java JDK 17 / 22 ``` {% endcode %} ### Installing TeamCity {% hint style="info" %} **Section Objectives** * Install the TeamCity Server * Install the TeamCity Agent * Exclude the TeamCity folder from Defender {% endhint %} Compiling .NET Framework projects is easier on a Windows machine, hence we will be installing TeamCity on a Windows virtual machine. You can download TeamCity Professional from [here](https://www.jetbrains.com/teamcity/download/). Configure your install directory (or leave it as the default), and copy the path down. Since we will be compiling malicious projects, we must add a Defender exclusion to this path. You can leave everything as default.

TeamCity supports multiple build agents, which can be used in conjunction with GitLab's build agents as part of a CI/CD cycle (***GitLab Repo -> TeamCity Compilation -> File Sharing Server***) Once installation is complete, you should see the build agent properties pop up. Note down the server address.

Save the properties, then you can select whether you'd like it to run as a domain/local user, or as SYSTEM. We will run the server and the build agent as the SYSTEM account for simplicity's sake.

Once done, open the UI at `http://:8111.` Select the internal database (or set up an external one for long-term storage - [see migration steps here](https://www.jetbrains.com/help/teamcity/2024.03/migrating-to-external-database.html?Migrating+to+an+External+Database#Switch+with+No+Data+Migration) if you are following along), proceed, then accept the license agreement, and deselect the anonymous stats submission.

Once this is done, create an admin account then move on to the next section.

#### Defender Settings As mentioned before, we need to add an exclusion to Defender to prevent it from deleting our artifacts. Open Defender, then click on Manage settings

Turn off automatic sample submission to stop our artifacts from getting burned, then scroll down, click on add or remove exclusions, and add the TeamCity directory. The default location is `C:\Teamcity`

### Install Programming Languages #### Git Since we will clone GitHub repositories, [Git](https://git-scm.com/download/win) is required on the TeamCity server. #### C\# To compile most of the C#-based tools that we will be using in this blog, we need the .NET 4.0 and 4.5 targeting packs, as well as the 3.5 development tools. Since these are considered deprecated, they were removed from [dotnet.microsoft.com](https://dotnet.microsoft.com). A workaround is installing [Visual Studio 2019](https://learn.microsoft.com/en-us/visualstudio/releases/2019/release-notes-preview), then downloading the .NET Desktop Workload and targeting packs.

Double check the components and add 3.5 development tools

#### Golang Installing Golang is pretty simple, you can get it from [their website](https://go.dev/doc/install), download the installer, and then hit next for everything ### Configuring GitLab (Optional) #### Integration If you would like to use TeamCity as part of your CI/CD pipeline, you can add it from the integrations section on GitLab at ***Admin -> Integrations -> JetBrains TeamCity***

You will need to change the `http://localhost:8111` default server URL to one that is accessible to GitLab (NAT/Host-Only for example)

#### SSH Key(s) Since we might have a mixture of private and public repositories on GitLab, we need to create an SSH key on our Windows server, then copy the public key to our ***GitLab server -> Deployment Keys -> New deploy keys*** 1. **Windows Server**

```powershell > ssh-keygen > cat ~/.ssh/ssh_key_name.pub ``` 2. **GitLab Server** {% hint style="info" %} Alternatively, you can add deploy keys per project instead of instance-wide to reduce your attack surface. {% endhint %}

Create a new key and add one on the user you want to access repositories from

#### Personal Access Token(s) Another way of doing this is by using Personal Access Tokens. These are unique random characters that allows for authentication through the GUI, as well as through REST APIs - which will come in handy if you make a builder tool later on for individual operators. To add them, go to ***Edit Profile -> Access Tokens -> Add new token***

Give the token a name, and check the permissions that you want it to have, then create the token.

Save the token in a secure location (Such as Bitwarden's Secrets Manager) so you can re-use it later on.

# Creating TeamCity Projects Short module on how to pull repositories from different sources ### Module Objectives * Pulling Public Repositories from GitHub * Pulling Private Repositories from GitLab ### Introduction TeamCity's projects consist of repositories pulled from public and private sources such as an internal GitLab server, or GitHub. By default, TeamCity will check for updates from the repository every 60 seconds, then pull the latest changes - though this can be changed per project if this is not something that you want/need. You can also select which branches to pull from - either the default main branch, all branches (by inserting a wildcard `*`), or a specific branch such as `dev` or `nightly` if you're looking for bleeding edge changes. ### Public Repositories {% tabs %} {% tab title="C# Tools" %} * [Rubeus](https://github.com/GhostPack/Rubeus) * [Seatbelt](https://github.com/GhostPack/Seatbelt) * [SafetyKatz](https://github.com/GhostPack/SafetyKatz) * [SharpUp](https://github.com/GhostPack/SharpUp) * [SharpDpapi](https://github.com/GhostPack/SharpDPAPI) {% endtab %} {% tab title="Golang Tools" %} * [Ligolo-ng](https://github.com/Nicocha30/ligolo-ng) * [Trufflehog](https://github.com/trufflesecurity/trufflehog.git) {% endtab %} {% endtabs %} #### Creating your public project To create our project, first get a GitHub link (We will use Seatbelt and Ligolo-ng for our demo). On TeamCity, select ***Create Project -> From a repository URL -> \ -> Proceed***

{% hint style="info" %} * Make sure you have an internet connection to your server * Add a username and token if you are pulling from a private repository {% endhint %} Next, change the builder configuration name to something memorable or related to the project, and add the branch that you would like to monitor. You can go to the original project's repository to see what the other branches are. Once you're ready, click proceed.

After clicking proceed, you will be met with the configuration page for our builder. TeamCity will automatically detect a build step to use based on our project, but we can change this later

Use the selected build step, then click on edit next to the .NET builder

The compile instructions on Seatbelt tells us to use .NET 3.5 or 4.0 to build our project, and to target release. We will reflect these requirements in our build step.

1. Set the MSBuild Version to 2019 2. Set the Required SDK to `3.5` or `4.0` 3. Set the Configuration to `Release` 4. Save your changes

Now, we need to specify where our binary will be built. We will choose `Seatbelt\bin\Release\Seatbelt.exe`

#### Troubleshooting {% hint style="warning" %} * Double check that JDK 17 or 22 are installed on your system * If you do not have any agents, then you can click on Agents from the dashboard, click on Install Agent, then follow the instructions {% endhint %}

#### Cont. If everything went well, you should be able to run your build step, and get your first artifact!

{% hint style="warning" %} If you run into an error on .NET SDK 3.5 not being installed, go to the visual studio installer and add .NET Framework 3.5 Developer Tools from the Individual Components tab and install [Microsoft .NET Framework 3.5 Service Pack 1](https://www.microsoft.com/en-us/download/details.aspx?id=22\&desc=dotnet35) then restart your VM {% endhint %} If the build is successful, you should see the Seatbelt executable in your artifacts tab, if you cannot find it here then add the `C:\BuildAgent` directory to your Defender exclusions (if you've installed an agent post server setup)

You can download the artifact by clicking on its name. You might need to add another exclusion at `C:\ProgramData\JetBrains\TeamCity`. We will take a look at how to make the binary less detectable in the next chapter.

### Private Repositories Pulling from private repositories is just as easy as from public ones, the only difference is that private repositories must be accessible and you must have the necessary credentials to access them. If you recall from the [previous module](/offensive-security/red-team/offensive-development/offensive-devops/teamcity/teamcity-setup#ssh-key-s), we added our SSH key and created an access token. We will use these to pull the repository - the same can be done for GitHub using Personal Access Tokens or SSH keys. Let's try pulling our calculator project, then testing and building it using TeamCity

# Double check your connection to your GitLab server from TeamCity's server
PS> ping 192.168.8.142

Pinging 192.168.8.142 with 32 bytes of data:
Reply from 192.168.8.142: bytes=32 time<1ms TTL=64
Reply from 192.168.8.142: bytes=32 time<1ms TTL=64

If successful, you should see this screen:

Go to the next section, then click on Build Features - we have to enable the Golang feature to be able to run Go commands

Go back to Build Steps, then in the Command Line option paste this in: ```batch go test -json ./... exit 0 ``` This will run a test on all the folders within the project.

Save and run this step. If the build succeeds, you should see a tab called Tests and the two test cases that we have set in [Simple Calculator Project](/offensive-security/red-team/offensive-development/offensive-devops/gitlab/simple-calculator-project)

You can add a second build step after the test with `go build ./... -o calculator` to get your executable # Obfuscating Payloads the fun part 😊 Now that we have a successful workflow, we can start messing around with removing Indicators of Compromise (IOCs) and obfuscating our payloads with a variety of methods. We will re-use our Seatbelt example from the previous section ### Module Objectives * Create a build step to check for Indicators of Compromise (IOC) * Use Powershell to remove the IOC from our project * Obfuscate our payload using ConfuserEx * Check the payload against ThreatCheck * Obfuscate Go Binaries * Periodic Scanning with VirusTotal\* ### Required Tools #### Payloads We will be using Ligolo-ng and Seatbelt {% tabs %} {% tab title="C#" %} * [Rubeus](https://github.com/GhostPack/Rubeus) * [Seatbelt](https://github.com/GhostPack/Seatbelt) * [SafetyKatz](https://github.com/GhostPack/SafetyKatz) * [SharpLigolo](https://github.com/S3cur3Th1sSh1t/SharpLigolo) {% endtab %} {% tab title="Golang" %} * [Ligolo-ng](https://github.com/Nicocha30/ligolo-ng) * [Shellcode Runner](https://github.com/ChrisPritchard/golang-shellcode-runner) {% endtab %} {% endtabs %} #### Detection Tools {% tabs %} {% tab title="Threat Detection" %} * [ThreatCheck](https://github.com/rasta-mouse/ThreatCheck) * [BestEdrOfTheMarket](https://github.com/Xacone/BestEdrOfTheMarket) * [CrimsonEDR](https://github.com/Helixo32/CrimsonEDR) {% endtab %} {% tab title="File Analysis" %} * [YARA](https://github.com/virustotal/yara/releases/tag/v4.5.0) * [Rules](https://github.com/Securescape/Offensive-Development/tree/main/YARA%20Rules) {% endtab %} {% endtabs %} #### Obfuscation {% tabs %} {% tab title="C#" %} * [ConfuserEx](https://github.com/mkaring/ConfuserEx) * [neo-ConfuserEx](https://github.com/XenocodeRCE/neo-ConfuserEx) - *Use this instead since it's newer* {% endtab %} {% tab title="Golang" %} * [Garble](https://github.com/burrowers/garble) {% endtab %} {% endtabs %} ### Installing Detection Tools {% hint style="info" %} **Section Objectives** * Install YARA * Download YARA Rules * Test our artifact against YARA * Install and Build ThreatCheck * Analyse our artifact with ThreatCheck * Detect Bad Bytes {% endhint %} Before we begin, we will need to install some tools that will detect our payload - which we can later use within our build steps to pass or fail the project before publishing an artifact. #### YARA YARA is a file analysis tool which dissects and searches for bad characters based on a set of rules. Rules can be downloaded from many sources - for our demo, we have included the rules that we will be using. Download the binary from the link above, then place it in a reachable directory. I will store all of the tools we're using in `C:\Tools` to keep things organised. After extracting YARA, download the rules from [this repository](https://github.com/Securescape/Offensive-Development/tree/main/YARA%20Rules) and place them inside YARA's root folder. It should look like this ``` Directory: C:\Tools\yara Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 4/24/2024 6:24 PM 735 rubeus.yar -a---- 4/24/2024 6:24 PM 756 safetykatz.yar -a---- 4/24/2024 6:24 PM 750 seatbelt.yar -a---- 4/24/2024 6:24 PM 484 sharpligolo.yar -a---- 2/13/2024 11:02 AM 2417152 yara64.exe -a---- 2/13/2024 11:02 AM 2362880 yarac64.exe ``` Test the rule against a Seatbelt artifact:

PS> .\yara64.exe -s .\seatbelt.yar C:\..\Seatbelt\bin\Release\Seatbelt.exe

HackTool_MSIL_SEATBELT_2 C:\BuildAgent\work\8306664e377be4bb\Seatbelt\bin\Release\Seatbelt.exe

We can see that YARA found the [hardcoded GUID](https://github.com/GhostPack/Seatbelt/blob/master/Seatbelt/Properties/AssemblyInfo.cs) which is included in Seatbelt's original project - we will need to remove this IOC if we want to be slightly stealthier. #### ThreatCheck [ThreatCheck ](https://github.com/rasta-mouse/ThreatCheck)is a tool developed by Daniel Duggan (RastaMouse) which cuts up binaries and detect the exact bytes which AV solutions hate. We can use this tool to detect if anything needs to be patched post obfuscation To install it, clone the repository to your directory of choice, compile it using Visual Studio 2019 or through `dotnet.exe` - I will be using VS 2019 for this ```bash git clone https://github.com/rasta-mouse/ThreatCheck.git mv .\ThreatCheck\ThreatCheck\ ThreatC echo A | rm -Force .\ThreatCheck\ mv .\ThreatC\ ThreatCheck ``` Open the solution in Visual Studio, then select `Release` and build

Once built, you will find the binary in the bin folder `C:\Tools\ThreatCheck\ThreatCheck\bin\Release` {% hint style="danger" %} In order for ThreatCheck to work properly, we need to disable Windows Defender on our system so that the data isn't being deleted during analysis {% endhint %} ```powershell PS> C:\Tools\ThreatCheck\...\ThreatCheck.exe -f C:\...\Seatbelt.exe ```

### Removing IOCs using Powershell Now that we know how basic detections can screw up our payload, let us see how we can bypass them. The first step is removing the hard-coded GUID string in `Seatbelt\Properties\AssemblyInfo.cs` (The same applies for Rubeus and the rest) In our Seatbelt build configuration, add a new build step and select Powershell, we will use a small script to generate a random GUID, then replace the old one with it *(Slightly modified from* [*Devops for PT*](https://training.zeropointsecurity.co.uk/courses/devops-for-pentesters)*)* ```powershell # Get relative path of AssemblyInfo.cs $teamCityProjectName = "%teamcity.projectName%" $path = ".\$teamCityProjectName\Properties\AssemblyInfo.cs" Write-Output "Project Path: $path" # Read file $content = Get-Content -Path $path -Raw Write-Output "Original Content:" Write-Output "$content" # Generate a new random GUID $newGuid = [System.Guid]::NewGuid().ToString() Write-Output "Random GUID: $newGuid" # Replace the GUID with our random one (Will work with any GUID) $content = $content | ForEach-Object { $_ -replace '\[assembly: Guid$"[^"]*"$\]', "[assembly: Guid(`"$newGuid`")]"} Write-Output $content # Overwrite the file $content | Set-Content -Path $path ```

Then move the build step above the compilation step using the `Reorder Build Steps` option

Now, we need to add a parameter to our builder which includes the TeamCity project name using `%system.teamcity.projectName%`

Save this, then build the project. Check the file using YARA afterwards - you should see from the build logs that our GUID changed from `aec32155-d589-4150-8fe7-2900df4554c8` to `a9d35d54-019f-45dd-839d-6243648dcac6`

We can confirm this change using YARA

...and dnSpy

The Powershell template being used can be re-used for the other [GhostPack](https://github.com/GhostPack) projects. This method is not sufficient to not get detected by ThreatCheck - though our next method will ### Removing IOCs using ConfuserEx {% hint style="info" %} **Section Objectives** * Use ConfuserEx GUI to pack Seatbelt * Use the different rules given by ConfuserEx * Check Seatbelt against ThreatCheck before and after obfuscation * Integrate ConfuserEx CLI into our Build Pipeline {% endhint %} [ConfuserEx](https://github.com/mkaring/ConfuserEx) is a .NET obfuscation tool which hides symbols and makes it difficult to understand what a C# executable does statically. To get started, download the latest binary (ConfuserEx.zip) from the Release page, and save it in your Tools folder (Mine is in `C:\Tools`) ConfuserEx templates are written in XML , and can be referenced at: * * * A basic template which uses an aggressive preset can be written as follows {% code overflow="wrap" %} ```xml ``` {% endcode %} The `project` element describes where the file will reside after ConfuserEx runs. The `rule` element refers to which rules it should use, `packer` specifies what type of packer ConfuserEx should utilise, and `module` is for the target path. ConfuserEx lets you specify multiple rules and modules, and can cover both DLLs and binary files alike - which can be useful for DLL type payloads. You can also add more protections listed in the [third link](https://github.com/mkaring/ConfuserEx/wiki/Protections) ```xml ``` Some protections take additional parameters as well, such as the `anti debug` protection which takes 3 arguments (taken from [here](https://github.com/mkaring/ConfuserEx/wiki/Anti-Debug-Protection)) * `safe`: ConfuserEx would detect debugger/profiler using managed API *(default)* * `win32`: ConfuserEx would detect debugger/profiler using unmanaged WinAPI (**Incompatible with OS other than Windows**) * `antinet`: ConfuserEx would detect debugger/profiler using [antinet](https://github.com/0xd4d/antinet) by @0xd4d In XML form, it will look like this ```xml ``` This allows us to beef up some of our default rules when it comes to templates and automating the obfuscation process #### GUI Version Before creating our pipeline, let's first use the GUI tool to examine the before and after of our Seatbelt executable. This will help us understand what to expect once a build has been completed. We will also testing our executable against ThreatCheck to confirm that it worked Start the ConfuserEx application located in `C:\Tools\ConfuserEx\ConfuserEx.exe` (the directory you've extracted to), and create a new folder within the Tools directory where you will store the output - I've included our payload from the previous build inside of our output folder for comparison

Drag and drop your binary into the modules tab, then click on `Settings`. You should be able to see your binary's name displayed in the list. Click on this, then press the plus button to add a rule. Click on the packer check box as well.

Press the Edit button on the left to bring up the rules you want to use - for this, we will be using the basic Aggressive preset - experiment on your own to see what works well for you

Click `Done` once you're happy with the settings, then go to the `Protect` tab on the main interface and hit `Protect` to start packing your binary. Once it's complete, run ThreatCheck on your test binary, and the one you've packed to see the difference

You can decrease the detected bytes through other means as well - such as running the executable through a loader, or by using more protections/rules through ConfuserEx. #### Integrating ConfuserEx into our build pipeline Instead of doing this manually, we can integrate ConfuserEx's template into our build pipeline with the use of a PowerShell script. Create the following scripts inside the C:\Tools\ConfuserEx directory, and save it as `aggressive_template.ps1` ```powershell param ( [Parameter(Mandatory=$true)] [String]$path, [Parameter(Mandatory=$true)] [String]$projectName ) $template = @" "@ Write-Output "[+] Using ConfuserEx with $PSCommandPath" $template | Out-File -FilePath "$path\$projectName.crproj" C:\Tools\ConfuserEx\Confuser.CLI.exe -n "$path\$projectName.crproj" ``` Where: * `$path` is where the release directory is * `$projectName` is the project name These variables will be used in TeamCity as such: 1. Create a new build step for ConfuserEx using the PowerShell runner

2. Specify the script file and the arguments TeamCity should execute ```powershell "%teamcity.build.checkoutDir%\%teamcity.projectName%\bin\Release" "%teamcity.projectName%" ```

Run the build step, then verify that it worked by using dnSpy

```powershell PS C:\Tools\SEATBELT - TESTING> C:\ThreatCheck.exe -f "C:\Seatbelt.exe" [+] No threat found! ``` ### Build Tests using ThreatCheck {% hint style="info" %} **Section Objectives** * Integrate ThreatCheck into our build pipeline * Fail builds that get detected by ThreatCheck {% endhint %} The last step (for now) is to check the artifact against ThreatCheck to make sure that it's properly obfuscated. To do this, we will create a new PowerShell script with the following: {% code overflow="wrap" %} ```powershell param ( [Parameter(Mandatory=$true)] [String]$path, [Parameter(Mandatory=$true)] [String]$projectName ) Write-Output "[+] Executing Threat Check" C:\Tools\ThreatCheck\ThreatCheck\bin\Release\ThreatCheck.exe -f "$path\$projectName.exe" ``` {% endcode %} Then, repeat the previous execution arguments for TeamCity ```powershell "%teamcity.build.checkoutDir%\%teamcity.projectName%\bin\Release" "%teamcity.projectName%" ```

To test our build step we will run our program twice - once with our ConfuserEx step, and once without.

We can see that there is a fixed message when a bad segment is detected by Threat Check, we can use this to create a filter which fails our build in case the program is not obfuscated In your build's `Failure Conditions`, add a new failure condition to match the message received - you can also add other messages if ThreatCheck has other failure messages Text to look for: `[!] Identified end of bad bytes at offset`

Test this on our last build step to see if it works

We can also test this by re-running our build

Re-enable your obfuscation step and you're done! The next steps would be to 1. Publish artifacts to central file share 2. Copy your build step into a global configuration 3. Check artifact hashes against VirusTotal (Using their API) daily to make sure the binaries aren't burned 4. Create a tool to download your artifact onto your operations machine or into your Command and Control team server 5. Your own creativity :) ### VirusTotal Vetting (WIP) # Jenkins (WIP) Jenkins is an open source automation server which is used to deploy and automate projects - from infrastructure (IaC) to code builds. Due to its open source nature, it has a lot of supporting plugins which will aid you in your development stack. # Jenkins Setup Jenkins can be installed on all operating systems/distributions, and is made easier with their docker container. I will be installing it on an Ubuntu server as we have done in the GitLab section previous though. [Docs for reference](https://www.jenkins.io/doc/book/installing/linux/). Jenkins also has a list of [best practices](https://www.jenkins.io/doc/book/using/best-practices/) which I advise you explore and set up according to your organisation or environment. ### Module Objectives * Install Jenkins Server * Install plugins * Create your First Admin Account ### Prerequisites {% code overflow="wrap" %} ```yaml Minimum: - 4GB RAM - 64GB Disk Space - Virtualisation Software (VMWare or VirtualBox) - Any Platform/OS - Git - Java JDK 17 / 22 ``` {% endcode %} *For a more in-depth list -* [*check the documentation*](https://www.jenkins.io/doc/book/installing/) ### Installing Jenkins Installing Jenkins is straightforward - the commands below were taken from the Jenkins documentation found [here](https://www.jenkins.io/doc/book/installing/linux/). I converted it to a script for convenience (and future automation). {% @github-files/github-code-block url="" %} Save the file as whatever you'd like, then execute it to begin the installation process. This can take several minutes to complete. Once done, you should see this output ```bash [+] Installation Complete [!] Jenkins running on: http://YOUR-IP:8080 [!] Jenkins Password : 9d2ad[..]c2c43e ``` Access the webpage from the IP address selected, then use the password that was generated for you (You must change this later). You should see the page below when the password has been entered

I'll click on the suggested plugins, though you can go with the other option as well. After the setup is complete, create your first admin user to access the main dashboard. #### First Admin User

If you are using a DNS server and custom SSL certs or a FQDN, you can also specify that URL here instead of the IP address (For simplicity, I'll go with the default value)

You should be taken to this screen once you've made your choice (skip or set the URL settings)

You will also notice an error on the top right, this is due to us not having a build agent which we'll set up later. # Creating Pipelines ### Module Objectives * Creating our first pipeline * Setting up BlueOcean # Managing Projects ### Module Objectives * Pulling a project from GitLab * Pulling a project from GitHub # API Interaction * Creating a Python Tool * Integrating with a C2 # Infrastructure Development (WIP) ### Infrastructure Infrastructure refers to a collection of tools, technologies, and services which are interconnected or relay information between each other. A basic example is a building - which is made of multiple rooms and floors, each with a unique or collection of purposes that achieve a unified goal. ### Offensive Infrastructure Offensive infrastructure takes this concept and adds layers of obscurity and obfuscation to ensure the operational capabilities of your team are not hindered. #### Red Team [Capability Maturity Model](https://www.redteammaturity.com/) The goal of this blog is to achieve a level 3 -> 4 in Infrastructure ***Level 3*** *The Red Team's infrastructure deployment is well documented to expedite manual configuration; infrastructure configuration accounts for best practice OPSEC concerns* ***Level 4*** *The Red Team leverages automated deployments for infrastructure; Red Team infrastructure security is self-assessed* ### High Level Diagram Several diagrams have been created per section of this course such as the one in [Command & Control Infrastructure](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure)and [Phishing Infrastructure](/offensive-security/red-team/offensive-development/infrastructure-development-wip/phishing-infrastructure). This is more of a "Complete" diagram of how a typical setup would look like *Insert graph of Phishing, Payload Delivery, and C2 Infra* # Command & Control Infrastructure ### Command & Control *Description Covered in* [Command & Control Anatomy](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/command-and-control-anatomy) ### Command & Control Infrastructure The Command & Control (C2/C\&C) infrastructure encompasses multiple technologies: * Team Server (the C2 Itself) * Redirector (Determines traffic flow) * Network Protocols (How the agent communicates) * Cover Server (A decoy server to send defenders or scanners to) The purpose of the infrastructure is to protect the internal network and the operation from being uncovered. By utilising traffic redirectors, decoy servers, and redirection rules, we can ensure that the security and knowledge about the on-going operations remain hidden from unauthorised view. #### High Level Graph

High Level Overview of a classic C2 Infrastructure Design

### Table of Contents

/pages/kVdJGKvwkaDUTDzTpp7g

[Command & Control Frameworks](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/command-and-control-anatomy/command-and-control-frameworks) [Mythic Framework](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/command-and-control-anatomy/mythic-framework)

/pages/pBgbbcRO5zGzuCl3lLew

[Nginx](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/traffic-redirection/nginx) [Amazon Web Services](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/traffic-redirection/amazon-web-services) [Microsoft Azure](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/traffic-redirection/microsoft-azure) [Google Cloud Platform](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/traffic-redirection/google-cloud-platform) [Cloudflare Workers](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/traffic-redirection/cloudflare-workers)

/pages/AqPpDrIv2O30PfbuE8Nv

[Ensuring Resiliency](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/covert-infrastructure/ensuring-resiliency) [Traffic Masking](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/covert-infrastructure/traffic-masking) [Network Rules](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/covert-infrastructure/network-rules)

# Command & Control Anatomy ### Introduction A Command and Control (C2) Framework is a server which handles connections to and from an *agent.* The basic functionality of an agent is that it pulls commands from the server, and executes it on the victim's machine. Agents utilise a number of protocols and encryption algorithms in order to communicate with the server. ### Terminology

Term	Definition
C2 Server / Team Server	Handler to manage connections, tasks, and functionality between itself and the agent. Can also allow multiplayer operations with other operators
Agent/Grunt/Beacon/etc.	A (usually) small program that listens for tasks from the server, then executes them on a host/victim machine
Loader	A wrapper program that hides the agent's true motives via encryption or the deployment of evasive techniques, before executing the agent's shellcode
Callback	A connection request to the server - either to receive a task, or to check-in (new agents check-in to get registered for further tasking)
OPSEC	Operational Security (OPSEC) is how much sensitive information you are able to mask or hide from your rivals (Blue Teams, employees, server/hosting providers, and other threat actors). This can include WHOIS records, C2 server location, passwords, framework used, the back-end technology, locations, etc. Your operations within the target network is also considered sensitive, and great care must be taken to not get discovered by the employees or third parties
Sleep	How long an agent waits before calling back to the server
Jitter	Adds randomness to the sleep value, the higher the jitter rate, the more random the connection is (advisable to have them in odd numbers like 67%)
Short Haul	Short haul beacons/servers are used for quick interactions with the agent. Usually, the sleep time for these beacons will be low (0-30 seconds) Due to the short callback times, these agents can be detected in longer operations as they are more prone to execute OPSEC unsafe commands, or get picked up by threat hunting solutions via traffic analysis
Long Haul	Long haul beacons/servers are reserved as a backup to our short haul channels, and are usually used in longer operations since their call back times can be a lot longer (30 mins+)
Redirector	Redirectors move traffic from the target environment, and sends it to our team server Rules can be added to the redirector to check if it is coming from our agent, or if it's a web scanner/person trying to access the site More information in /pages/pBgbbcRO5zGzuCl3lLew
Malleable C2	Customisable command and control profiles which allows the operator to blend in with existing/"normal" network signatures, change agent behaviour, or server/listener functionality

### Protocols *This is not an exhaustive list - check out the* [*MITRE ATT\&CK Framework*](https://attack.mitre.org/tactics/TA0011/) *for more*

Protocol	Description	OPSEC Concerns
HTTP/S	The most common type of communication due to its reliability and malleability when connecting to a target externally	HTTP uses clear-text communication which can easily be seen by others HTTPS works well unless if you're using self-signed certificates which will get flagged as suspicious
DNS	DNS communication utilises TXT records to transfer data. Whilst it can take a long time to transport large data such as images or files, DNS is reliable and useful for long haul communication	DNS traffic can be inspected and blocked by IPS systems if the endpoint/domain is deemed to be new, or suspicious within the environment Large amounts of text via DNS can also be seen as suspicious
SMB	A common favourite to use within Windows environments, SMB communicates through the use of named pipes, which allows lateral movement without the fear of being stopped by external firewalls (443/80 being blocked)	Not all processes create named pipe which might be picked out as suspicious by Intrusion Prevention Systems (IPS) and other security products
TCP	TCP communicates in a Peer-to-Peer (P2P) fashion. Due to the way it initiates and verifies connectivity, TCP is a reliable method to communicate between beacon to beacon or beacon to server	Since the connection is consistent and persistent, TCP can be identified easily in a network traffic capture which makes it a very use-case specific protocol to implement

[^1]: A small piece of [code](https://duckduckgo.com/?q=code+definition\&ia=definition), used as the [payload](https://duckduckgo.com/?q=payload+definition\&ia=definition) of a [virus](https://duckduckgo.com/?q=virus+definition\&ia=definition) or other [malware](https://duckduckgo.com/?q=malware+definition\&ia=definition), that [launches](https://duckduckgo.com/?q=launches+definition\&ia=definition) a [shell](https://duckduckgo.com/?q=shell+definition\&ia=definition) so that the [attacker](https://duckduckgo.com/?q=attacker+definition\&ia=definition) can control the [compromised](https://duckduckgo.com/?q=compromised+definition\&ia=definition) computer. *\~*[*Wordnik*](https://www.wordnik.com/words/shellcode) # Command & Control Frameworks Common Command & Control Frameworks used by Professionals and Threat Actors ### Command & Control Frameworks #### C2 Matrix The [C2 Matrix ](https://howto.thec2matrix.com/)is a tool built by [SANS](https://www.sans.org/tools/the-c2-matrix/) for security professionals looking to integrate a Command & Control framework within their workflow. It has a list of near up-to-date C2's (Commercial and otherwise), as well as their capabilities, the language it was built in, and more. The matrix also features a virtual machine - [Slingshot ](https://howto.thec2matrix.com/slingshot-c2-matrix-edition)- which can be used to test out C2s within a virtualised lab environment.

#### Commercial C2 Frameworks C2 Frameworks varies in price based on their capabilities, Operational Security, and Support - ranging from affordable to an SME, to 5 kidneys and some change. **Cobalt Strike (CS)** Probably one of the most recognisable C2s on the market. The C2 was created by Raphael Mudge as a paid version of [Armitage ](https://www.kali.org/tools/armitage/)- a GUI version of Metasploit. Due to its stability, malleability and long history of success, CS is used in many red team & penetration testing engagements - and by threat actors - to achieve domain dominance over client environments. The easy to navigate GUI and customisable features makes it a great choice for those that can afford it. **Courses that utilise CS in their labs:** There are some courses that offer training with CS which makes it more accessible to learn and use a commercial C2 * [Certified Red Team Operator/Lead](https://training.zeropointsecurity.co.uk/bundles/red-team-courses) * [Advanced Red Team Operations](https://training.whiteknightlabs.com/advanced-red-team-operations/) * [Offensive Development](https://training.whiteknightlabs.com/offensive-development-training/) #### Open Source C2 Frameworks **Metasploit Framework** **Mythic Framework** **Havoc Framework** # Metasploit Framework # Installing Metasploit * Ubuntu * Debian * Kali (Pre-installed) # Metasploit Basics * Navigation * Platforms * Windows * Linux * Listeners * TCP * SMB * HTTP/S * Payloads * Misc (Calculator.exe) * Meterpreter * Shell * Traffic Inspection with Wireshark # Advanced Features * Resource Files * Encoding * Encryption * Bypassing AV # Mythic Framework Mythic Command & Control Framework ### Sections * [Installing Mythic](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/command-and-control-anatomy/mythic-framework/installing-mythic) * Manual * Scripted * Installing Payloads & Listeners * [Malleable Command & Control](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/command-and-control-anatomy/mythic-framework/malleable-command-and-control) * Configuring Listener Profiles * Redirection Rules (Soft Introduction) * [All About Agents](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/command-and-control-anatomy/mythic-framework/all-about-agents) * Setting up a victim environment * Creating agents * Agent Configuration * Payload Delivery * [Services](/offensive-security/red-team/offensive-development/infrastructure-development-wip/command-and-control-infrastructure/command-and-control-anatomy/mythic-framework/services) * Creating an Agent * Using Service Wrappers # Installing Mythic ### # Malleable Command & Control * Generating Normal Traffic with Burpsuite * Customising our C2 Profile * HTTP * SMB * Customising Server Responses # All About Agents * Agent Anatomy * Communication Protocol * Encryption and Encoding * Generating Payloads * Full Binary * Shellcode * Basic Evasion Techniques # Services # Traffic Redirection --- [Next Page](/llms-full.txt/1)