search

bats3c / shad0w

A post exploitation framework designed to operate covertly on heavily monitored environments
https://blog.dylan.codes/shad0w/
MIT License
2.03k stars 323 forks source link

ImpersonateUser/rev2self and SMB Pivoting #44

Closed trickster0 closed 4 years ago

trickster0 commented 4 years ago

ImpersonateUser/rev2self and SMB Pivoting

If you add those couple of things, your C2 will be gold in addition to the teamserver you are already building. Also visualization of pivots would be also a nice addition. :) Not sure if you can do the impersonation, i assume you can if you have privileges to inject on different process but it wont be possible to rev2self i assume right? Awesome work till now man. I will start testing it around.

P.S Mark as enhancement.

bats3c commented 4 years ago

Along side the team server I'm also working on token abuse, then you will be able to steal tokens from processes and ret2self. SMB and RPC pivots are in the pipeline.

Also yes your right, its not really possible to ret2self when migrating a process, because if you migrate to a process with lower privilages than yours its not possible to migrate back.

Visualization of pivots is also a good idea, I will keep it in mind when building the GUI.

I'm gonna close this issue cause there is a lot of different things here, but I do plan on implementing all of them thanks.