DTM - @dtmsecurity

@dtmsecurity

Sign in Subscribe

DTM

GIF Steganography from First Principles

GIF Steganography from First Principles

Inspiration Adam's blog on PNG steganography inspired me to start a project in a similar vein but focused on GIF files instead. Although I have previously written several .NET-based steganography tools previously, I have typically relied on existing libraries for the steganography part without delving into the fundamentals. It was

Cobalt Strike DNS Direct Egress Not That Far Away

Cobalt Strike DNS Direct Egress Not That Far Away

Cobalt Strike 4.3 added a bunch of useful new DNS beacon features which allow the behaviour to be tweaked more than before. Prior to this release the configuration was fairly limited for most mature client use cases. I look forward to trying out some of the new features. One

Code execution via the Windows Update client (wuauclt)

Code execution via the Windows Update client (wuauclt)

Its been a few months since my last post about uploading and downloading data with certreq.exe as a potential alternative to certutil.exe in LOLBIN land. I've been having a blast starting my new role in the MDSec ActiveBreach team. Today I wanted to share something a little more

Upload and download small files with CertReq.exe

Upload and download small files with CertReq.exe

I stumbled on another lesser known LOLBAS (https://lolbas-project.github.io/) for upload and downloading (small) files. CertReq.exe is present on Windows and its intended use to to assist with the creation and installation of certificates. You can use it as follows: Upload a file via HTTP POST Upload

Exploring search connectors and library files in Windows

Exploring search connectors and library files in Windows

Introduction This short post explores the file formats .searchConnector-ms and .library-ms. Both of these file formats have default file associations on most Windows versions. They integrate with Windows to show content from a arbitrary location which can also be a remote location by specifying a WebDAV share. As seen in

Sorry you have missed a package

Sorry you have missed a package

In Windows 10 there’s a handy way for administrators to provision systems by way of something known as a “Provisioning Package”. This blog explores these files which carry a .ppkg extension. We look at some of the features and what happens if you interact with one. Particularly focusing on

The origin of command and control traffic

When chatting through the DNS over HTTPS based command and control technique with defenders, something which came up in a blue teams arsenal caught my attention. This was JA3 which is an open source project from Salesforce which has been integrated into a lots of security software and appliances which

Playing with DNS over HTTPS (DoH)

It has been nearly a month since I spoke at Mitre ATT&CKcon and shared some research into DNS over HTTPS (DoH) from a red team perspective. After releasing the tool DoHC2 there has been quite a few people using it and talking about DoH which is awesome! There's also

DNS over HTTPS (DoH) Servers

I recently conducted some research into DNS over HTTPS (DoH) that is documented here [https://www.trustwave.com/Resources/SpiderLabs-Blog/DOH!-DNS-Over-HTTPS-Poses-Possible-Risks-to-Enterprises/] . When it came to identifying any publically available DoH servers available on the Internet I found the best resource to be the curl wiki page [https://github.com/

For informational and educational purposes only.

"Sometimes, hacking is just someone spending more time on something than anyone else might reasonably expect." @JGamblin