DOCSEARCHbyAlgolia
Submit Docs

Red Teaming Tactics and Techniques

repository·master·Indexed 26 days ago

https://github.com/mantvydasb/redteaming-tactics-and-techniques

A collection of research notes and documentation on red teaming, offensive security techniques, and malware analysis. Includes cheatsheets for Active Directory and Kerberos abuse, DNS reconnaissance, Nmap scanning, SNMP enumeration, reverse shell one-liners, and techniques for bypassing AppLocker and file upload restrictions.

Tokens
210.3K
Snippets
559
Records
950
Agent score
39%

What's inside redteaming-tactics-and-techniques

  2. Overview of the Shellcode Compilation Process

    master

    The process of converting C code into executable shellcode follows these six high-level steps:

    1. Write shellcode in C: Develop the logic using C.
    2. Compile to assembly: Convert the C code into a list of assembly instructions.
    3. Clean assembly: Massage the assembly instructions to remove external dependencies and clean up the code.
    4. Link to a binary: Link the cleaned assembly into an executable (e.g., an EXE).
    5. Extract shellcode: Pull the raw shellcode bytes out of the resulting binary.
    6. Execute: Inject and execute the shellcode using code injection techniques.

  3. Overview of Red Teaming Tactics and Techniques

    master

    This repository contains personal research notes focused on red teaming and offensive security. It documents experiments involving various tools and techniques used by penetration testers, red teams, and adversaries. The content covers offensive security techniques such as:

    • Gaining code execution
    • Code injection
    • Defense evasion
    • Lateral movement
    • Persistence

    Important Usage Warnings:

    • The notes are not exhaustive and may contain mistakes; always consult additional resources.
    • The content is based on research and experiments in controlled environments.
    • The documentation is created by @spotheplanet. Cloning and presenting this work as your own is strictly forbidden.

  4. Identify Privileged AD Account Memberships

    master

    Beyond Domain Admins, several other Active Directory group memberships can be leveraged for privilege escalation:

    • Account Operators: Allows creating non-administrator accounts and groups on the domain and logging in to Domain Controllers (DCs) locally.
    • Server Operators: Allows configuring Domain Controllers with privileges including: local logon, backing up/restoring files and directories, changing system time/timezone, and forcing remote shutdowns.
    • Backup Operators: Allows accessing the file system on Domain Controllers (e.g., DC01).

  5. Understand PE File Header Terminology

    master

    To parse Portable Executable (PE) files, you must understand the following core concepts:

    • Section: A PE header defining parts of the binary (e.g., .text for assembly code, .data for variables).
    • File item: A specific part of a PE file, such as a code section.
    • Relative Virtual Address (RVA): The address of a file item in memory minus the image base address.
    • Virtual Address (VA): The actual virtual memory address of a file item in memory (without subtracting the image base).
    • Data Directories: Located in the Optional Header, these contain RVAs and sizes for various tables, such as the DLL imports table.

  6. Understand AWS Identity and Access Management (IAM) components

    master

    AWS IAM is structured around a hierarchy of accounts and identities. Understanding these relationships is essential for auditing or red teaming cloud environments:

    • Organization / Root / Management Account: The top-level entity that can manage multiple sub-accounts.
    • Accounts: Individual AWS environments that contain Users, Groups, Roles, and Policies.
    • Users: Individual identities within an account.
    • Groups: Collections of Users. Users can be members of Groups.
    • Roles: Secure mechanisms to grant temporary permissions to trusted entities. Trusted entities include:
      • Another AWS account (internal or 3rd party)
      • AWS services
      • Web Identity
      • SAML Federation
    • Policies: JSON objects that define permissions (what can or cannot be done with resources like EC2 instances, images, network interfaces, or security groups). Policies are attached to identities (Users, Groups, or Roles) to define their level of access.

  7. Understand Early Bird APC Queue Code Injection

    master

    Early Bird APC Queue Code Injection is a technique used to execute shellcode early in a process's initialization phase. By targeting a process while it is still in a suspended state, the malicious behavior occurs before many AV/EDR hooks are fully active, increasing the chance of evasion.

    High-level workflow:

    1. Create a legitimate process (e.g., calc.exe) in a suspended state.
    2. Allocate memory for shellcode within the new process's address space.
    3. Declare an APC (Asynchronous Procedure Call) routine pointing to the shellcode.
    4. Write the shellcode to the allocated memory.
    5. Queue the APC to the process's main thread.
    6. Resume the thread to trigger shellcode execution.

  8. Understand Format String Vulnerabilities

    master
    A Format String bug occurs in C-based programs when user-supplied data is passed directly as the format string argument to functions like printf, fprintf, sprintf, or snprintf. Instead of the data being treated as a literal string, the program interprets format specifiers (starting with %) within the user input, allowing an attacker to manipulate program execution.

  9. Automate Red Team Infrastructure with Terraform

    master
    This guide outlines the use of Terraform to build a resilient, disposable, and easily replaceable red team infrastructure using the 'Infrastructure as Code' (IaC) principle. By defining the environment state in Terraform configuration files, operators can quickly rebuild 'burned' (detected) servers to minimize engagement interruptions.

  10. Understand the ret-to-libc technique

    master
    The ret-to-libc (return-to-libc) technique is used to exploit buffer overflow vulnerabilities on *nix systems where stack memory is protected by the No-Execute (NX) bit. Instead of executing shellcode placed on the stack, the attacker overwrites the return address to point to existing executable code within the standard C library (libc), such as the system() function. This allows the attacker to bypass NX protections by reusing legitimate code already mapped into the program's memory space.

  11. Understand the ShadowMove lateral movement technique

    master

    ShadowMove is a lateral movement technique that allows an adversary to steal (duplicate) an existing network socket from a running process on a compromised host.

    Key Characteristics:

    • No New Connections: The ShadowMove process does not establish any new TCP connections to the target host. Instead, it reuses an existing connection established by another process (e.g., nc.exe).
    • Mechanism: It enumerates handles in the target process looking for \Device\Afd handles (used for network socket communication). It then uses WSADuplicateSocketW and WSASocket to create a duplicate socket.
    • Communication: Once the shared socket is created, the ShadowMove process can use standard send and recv API calls to communicate through the hijacked connection.

  12. Understand ADCS + PetitPotam NTLM Relay Attack Conditions

    master

    An Active Directory environment is vulnerable to this privilege escalation technique (from low-privileged user to Domain Admin) if the following conditions are met:

    • ADCS Configuration: ADCS is configured to allow NTLM authentication.
    • Lack of Protections: NTLM authentication is not protected by Extended Protection for Authentication (EPA) or SMB signing.
    • Active Services: ADCS is running either the Certificate Authority Web Enrollment service or the Certificate Enrollment Web Service.