DOCSEARCHbyAlgolia
Submit Docs

Black Hat Rust

repository·main·Indexed 26 days ago

https://github.com/skerkour/black-hat-rust

An educational resource and codebase for applying the Rust programming language to offensive security operations. It includes tools and examples for reconnaissance, exploitation, and implant development, featuring a SHA1 cracker, Tricoder asset mapper, a web crawler, various CVE exploits (CVE-2021-3156, CVE-2019-11229, CVE-2019-89242), dnsquat for typosquatting, Evil Twin and WASM phishing implementations, and Remote Access Trojan (RAT) development.

Tokens
31.5K
Snippets
104
Records
258
Agent score
88%

What's inside Black Hat Rust

  2. Overview of Black Hat Rust

    main
    Black Hat Rust is a project focused on applied offensive security using the Rust programming language. It covers the development of various offensive tools including scanners, exploits, phishing toolkits, and implants. The project demonstrates how Rust's features (like no_std, WebAssembly, and async/await) can be leveraged for security-related tasks such as shellcode development, web crawling, and building Remote Access Tools (RATs).

  4. Inspect the RAT container

    main

    You can inspect the running container by executing a bash shell inside it. Use these commands to check the /tmp directory or the agent's installation path in /root/.local/share/.

    $ docker exec -ti bhr_ch13_ssh bash
$ ls -lah /tmp
$ ls -lahR /root/.local/share/

  5. Use the num_cpu crate to count logical cores

    main

    The num_cpu crate provides a way to count the number of logical CPUs available on the current machine.

    ⚠️ Warning: This specific version of the crate in this repository has been backdoored for educational purposes regarding supply chain attacks. See https://kerkour.com/rust-crate-backdoor for details.

    [dependencies]
num_cpu = "1.0"
    // count logical cores this process could try to use
let num = num_cpu::get();

  6. Black Hat Rust Curriculum and Topics

    main

    The project is organized into three main parts covering the offensive security lifecycle:

    Part I: Reconnaissance

    • Multi-threaded attack surface discovery: Building multi-threaded scanners for target mapping.
    • Async programming: Refactoring scanners to use async/await for high-performance I/O.
    • Trait objects: Using Rust's type system to add heterogeneous modules to scanners.
    • Web crawling: Building fast web crawlers for OSINT.

    Part II: Exploitation

    • Fuzzing: Using automated fuzzing to find vulnerabilities.
    • Exploit development: Writing exploits using Rust's module system.
    • Shellcode development: Writing shellcode in plain Rust using no_std.
    • WebAssembly phishing: Creating advanced phishing pages compiled to WebAssembly.

    Part III: Implant development

    • Remote Access Tools (RAT): Building implants that communicate with remote servers and databases.
    • End-to-end encryption: Securing implant communications to avoid detection.
    • Cross-compilation: Targeting multiple platforms (Windows, macOS) using Rust's ecosystem.
    • Worm development: Incorporating scanner components into an implant to create a worm for lateral movement.

  9. Run the Chapter 11 server, agent, and client components

    main

    The Chapter 11 project consists of three main components that must be run in separate terminal sessions:

    1. Server: Run the server component first.
    2. Agent: Run the agent component in a second shell.
    3. Client: Use the client in a third shell to interact with agents.

    Client Commands

    • List Agents: Use the agents argument to see a table of connected agents, including their ID, creation time, last seen time, and public keys.
    • Execute Command: Use the exec command followed by an agent ID (-a) and the command to run on that agent.

  11. Setup the WASM phishing environment

    main

    To prepare the environment for Phishing with WASM, install the required Rust tooling using cargo install. You will need wasm-pack for compiling WebAssembly and cargo-watch for monitoring file changes during development.

    $ cargo install -f wasm-pack
$ cargo install -f cargo-watch

  12. Build and publish ebooks using Docker and Makefile

    main

    To build and self-publish ebooks using this workflow, place your source files in a src folder and ensure the Makefile is configured to point to that directory.

    Follow these steps to build the ebook using Docker:

    1. Build the Docker image using make docker.
    2. Run the container, mounting your current working directory to /ebook inside the container.

    Once the process completes, the generated ebooks will be located in the ebooks folder.

    $ make docker
$ docker run -ti --rm -v `pwd`:/ebook localhost/skerkour/ebook