Weaponizing Starlark: Non-Executable Malware and Scriptable C2 Agents

Starlark in Go

Why?

Every C2 module system ends up in the same place. You either ship native code (a BOF, a DLL, raw shellcode) and accept that it looks like malware the moment it becomes executable, or you ship a script that needs powershell.exe or python.exe on the target, which …

View comments.

more ...

Learning AD by Building a C2: Exploiting Constrained Delegation with emp3r0r

notes on constrained delegation

Constrained Delegation

I come from the Linux world, and AD still confuses me on a regular basis, delegation especially; these notes are my attempt to finally make sense of it. My last post was about RBCD. Constrained delegation is the classic version of the same idea: the frontend account decides …

View comments.

more ...