Shogun Lab conducts R&D to help organizations secure their systems and software. おもしろい です ね。(shogunlab on https://nitter.gq/t.co/7jpKkhb6OO)
Joined March 2017
- Tweets214
- Following589
- Followers1.5K
- Likes6.4K
Pinned Tweet
I’m excited to finally release a short book that’s about building C2 implants in C++. I hope it can serve as an educational resource for those in Red Teams who want to get started writing their own implants and related C2 components.
You can read it here: shogunlab.gitbook.io/buildin…
Shogun Lab retweeted
[BLOG] Playing in the (Tradecraft) Garden of Beacon: Finding Eden - cobaltstrike.com/blog/playin…
Shogun Lab retweeted
In this post, I discuss one key difference in the thinking between sophisticated adversaries and many of the red teams that try to simulate them, as well as what that means for tradecraft and tooling.
jackson_t.gitlab.io/it-depen…
Open sourcing a side-project I’ve been working on called “Mochi”. It’s a PoC C++ loader that leverages ChaiScript to modularize and execute code. It was built to allow remote loading of ChaiScript files that execute offensive actions with the Windows API:
github.com/shogunlab/Mochi
I may have reinvented the wheel in some areas, but hopefully it still serves as an interesting PoC. I’m not aware of any offensive tooling using ChaiScript, so if people have projects I could reference, please let me know!
Special thanks to @Jackson_T and Craig for reviewing an early demo. Their comments and feedback were very much appreciated.
I've added a C++ version of the Sukoshi AWS IoT Core implant for those who are interested in experimenting with a binary. You can find an updated page with build instructions and C++ source code here: github.com/shogunlab/Sukoshi
Lately, I’ve been experimenting with different protocols and methods for C2. As part of this, I developed a PoC Python implant called “Sukoshi”. It uses the MQTT protocol for C2 and leverages AWS IoT Core as its infrastructure: github.com/shogunlab/Sukoshi
I’d like to shout out Daniel Abeles (@Daniel_Abeles) and Moshe Zioni for their work while at @Akamai Threat Research. Their MQTT-PWN project served as an excellent reference during development: mqtt-pwn.readthedocs.io/en/l…
Special thanks to @Jackson_T for kindly providing feedback and reviewing a demo of the project.
Shogun Lab retweeted
🧠 Mental models are useful for developing solutions and stimulating thinking. In this post, I discuss some personal mental models I've found useful for offensive capability R&D, which can also generalize to understanding opponent processes in InfoSec.
jackson-t.ca/operational-men…
I wrote this OSINT tool a while ago to help with finding leaked data on GitHub, but I never widely publicized it because I thought it was too simple. I've made some minor updates recently and I think the simplicity could actually be a strong point now: github.com/shogunlab/gitform…
The TL;DR is it does a code search on GitHub for internal keywords gathered from a client during an OSINT assessment and it does secondary checks with additional keywords related to the client organization to (hopefully) eliminate false positives.
Since I published this tool, many other projects have come along that are more fully featured and you should check them out if you want something like that. One of my favorites is GitGot by @BishopFox:
github.com/BishopFox/GitGot
I was happy to be a part of this discussion with Josh Arsenio at Security Compass. It was about the benefits of building custom C2 implants for Red Teams. If you're interested in that topic as well, check it out! resources.securitycompass.co…
Shogun Lab retweeted
Introducing SysWhispers2! It no longer relies on pre-computed syscall tables, and uses @modexpblog's address sorting implementation instead. Check out @ElephantSe4l's write-up for how the technique works.
- github.com/jthuraisamy/SysWh…
- crummie5.club/freshycalls