#Red_Team

Sandman is a backdoor that meant to work on hardened networks during red team engagements.

Sandman works as a stager and leverages NTP (protocol to sync time & date) to download an arbitrary shellcode from a pre defined server.

Since NTP is a protocol that is overlooked by many defenders resulting wide network accessability.

https://github.com/Idov31/Sandman

@BlueRedTeam

#Red_Team

A huge chunk of my personal notes since I started playing CTFs and working as a Red Teamer.

https://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks

@BlueRedTeam

#Cobalt_Strike
A Cobalt Strike Beacon Notifier Via Telegram Bot.

https://github.com/lynxbinz/CS-Beacon-Notifier
@BlueRedTeam

Download Kali Pruple

@BlueRedTeam

#Cobalt_Strike
Cobalt Strike profile generator using Jenkins to automate the heavy lifting

https://github.com/RomanRII/jenkins-strike

@BlueRedTeam

#Cobalt_Strike
Code and yara rules for detection and analysis of Cobalt Strike

https://github.com/we1h0/cobaltstrike-yara

@BlueRedTeam

#Cobalt_Strike

Use Alibaba Cloud oss ​​object storage to forward http traffic to implement (cs) Cobalt Strike, msf online, etc. These use Alibaba Cloud's related domain names for communication.

https://github.com/pantom2077/alioss-stinger

@BlueRedTeam

#Red_Team
Red Team Script for Cloud pentest with private Cloud built with OpenShift. Fast Extrated the config information in bootstrap.ign file

https://github.com/Esonhugh/OpenShift_IGN_ConfigFileExtractor

@BlueRedTeam

#Red_Team
Responsible Red Team
https://github.com/jam620/rrt-logging

@BlueRedTeam

#Red_Team

RedTeam With OneNote Sections

1. Not affected by Protected View/ MOTW
2. Allows embedding Malicious Excel/Word/PPT files that will be played without protected view
3. Allows embedding HTA, LNK, EXE files and spoof extensions
4. Possible to format document in a way user are tricked into opening a malicious file or a link

@BlueRedTeam

#webshell
A python based webshell discovery and decoder for static packet captures. Designed to be extended for easy identification and decoding of many webshell families.

https://github.com/fredflinch/mothra

Demonstrating the value of entropy as a detection mechanism for obfuscated webshells.
https://github.com/mttaggart/webshell-entropy

@BlueRedTeam

#Cobalt_Strike

Cobalt Strike 4.7

https://github.com/injectexpert/Cobalt-Strike-4.7

@BlueRedTeam

#Red_Team
OffensivePipeline allows to download, compile (without Visual Studio) and obfuscate C# tools for Red Team exercises.

https://github.com/Aetsu/OffensivePipeline

@BlueRedTeam

Friends, has anyone worked with sigtran? Message me:
@NetPwn

دوستان کسی با sigtran کار کرده به من پیام بده :
@NetPwn

#CVE-2023
Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2023-21543, CVE-2023-21546, CVE-2023-21556, CVE-2023-21679. CVE
https://github.com/Live-Hack-CVE/CVE-2023-21555

@BlueRedTeam

#Cobalt_Strike

Convert Cobalt Strike profiles to modrewrite noscripts

https://github.com/threatexpress/cs2modrewrite

@BlueRedTeam

#Red_Team
Puppet Deployment for Red Teaming

https://github.com/jabbate19/Nightmarionne

@BlueRedTeam

#Red_Team

Red Team Tutorial: Design and setup of C2 traffic redirectors

https://ditrizna.medium.com/design-and-setup-of-c2-traffic-redirectors-ec3c11bd227d

@BlueRedTeam

#Red_Team

I've had so much fun learning rust. This is an excellent example of the power of rust, no EDR unhooking, patching of ETW, syscalls, or LITCRYPT and it calls home against EDRs.  More to come soon .

https://twitter.com/Tyl0us/status/1627759675352424460‌

@BlueRedTeam

#Red_Team

AMSI Patch to Defeat Windows Defender
In this week's red team tip. I take a look at the new AMSI patch from TheD1rkMtr. I use the patch to slip Invoke-Mimikatz by Windows Defender. Take a look!Amsi Patch to Bypass Windows Defender

AMSI Patch
https://github.com/TheD1rkMtr/AMSI_patch

@BlueRedTeam