Shells

Obtaining shells via Logitech Unifying Dongles

02 December 2019 ~9 min By Rogan Dawes
Internal Radio Real-World Redteam Rf Shells Usb
In this post, I will recap some of the security research conducted on wireless keyboards and mice, and eventually show how current wireless keyboards and mice can be used to obtain a covert shell on a target computer. Around 2009, Max Moser realised that most wireless keyboards were simply transmitting the keystrokes in clear text. His initial research targeted systems using 27MHz radios. In 2010, he presented followup research targeting…

Outlook Forms and Shells

28 April 2017 ~12 min By etienne
External Shells Tools
Using MS Exchange and Outlook to get a foothold in an organisation, or to maintain persistence, has been a go to attack method for RedTeams lately. This attack has typically relied on using Outlook Rules to trigger the shell execution. Although Ruler makes accomplishing this really easy, it has, up until now, required a WebDAV server to host our shell/application. In most cases this is not an issue, but once…

USaBUSe Linux updates

10 March 2017 ~5 min By Rogan Dawes
Abuse Backdoor Build-It Conferences Empire Exploit Hardware Internals Linux Metasploit Programming Real-World Research Shells Tunnelling
(If you’re new to this project, read the intro first) For the past few months, I’ve been working on porting the USaBUSe stack from the custom hardware (AVR+ESP8266) to the Linux USB gadget stack. I wanted to make the techniques more accessible to people unfamiliar with embedded development, and I also wanted to take advantage of the variety of possibilities inherent in having a fully featured Linux environment to work…

Something about sudo, Kingcope and re-inventing the wheel

27 May 2013 ~4 min By george
Backdoor Fun Howto Infrastructure Internals Linux Local Post-Exploitation Shells Silly-Yammerings Tricks
Willems and I are currently on an internal assessment and have popped a couple hundred (thousand?) RHEL machines, which was trivial since they are all imaged. Anyhoo – long story short, we have a user which is allowed to make use of sudo for a few commands, such as reboot and service. I immediately thought it would be nice to turn this into a local root somehow. Service seemed promising…

T-Shirt Shell Competition

23 November 2012 ~3 min By Dominic White
Fun Post-Exploitation Programming Shells
For our internal hackathon, we wanted to produce some shirts. We ran a competition to see who could produce a reverse shell invocation most worthy of inclusion on a shirt. Here are the submissions, which may be instructive or useful. But first; the winning t-shirt design goes to Vlad (-islav, baby don’t hurt me, don’t hurt me, no more): Funny story; the printer left out the decimal points between the…