Carrie Roberts // *Guest Blog You have a password hash you would like to crack for a password that contains an Umlaut. You know, the two dots over a letter as is commonly seen in the German language. For our example here, we have the Windows password hash of the password “Möm Rülez!” I know, […]
Carrie Roberts//* I have needed to remind myself how to set up RDP access through an SSH connection so many times that I’ve decided to document it here for future reference. I hope it proves useful to you as well. I do “adversary simulation” for work and so I present this information using terms like […]
Carrie Roberts//* (Updated 2/26/2019) Note: Windows Defender added a detection on 2/25/2019 which now detects this method as “AmsiTamper.A” Windows Defender does a good job of blocking many attacks, including attempts to establish Command & Control (C2) sessions with published tools like PowerShell Empire. I was recently looking for a way to establish such a […]
Carrie Roberts* // Using a trusted certificate and non-default Empire options will help increase your chances of getting a successful session out of a network. Follow these instructions to get setup. First, get a signed digital certificate for your server using Let’s Encrypt. Visit https://certbot.eff.org/ for instructions. The process is also shown here for Apache running […]
Carrie Roberts // Tired of typing those Empire commands to startup your goto listeners? Wish there was an equivalent to Metasploit resource files for Empire? This is not currently implemented as far as I know, so until then here is a hack to make it happen. When I’m working with tools on a remote […]
