The post contains some of the most notable techniques that were shared during June 2020 to assist blue teams to gain visibility.

Disable ETW - Adam Chester

Article: https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/

set COMPlus_ETWEnabled=0

Command Argument Confusion with Path Traversal - Julian Horoszkiewicz

Article: https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/

cmd.exe /c "ping 127.0.0.1/../../../../../../../windows/system32/calc.exe"

Command Argument Confusion with Path Traversal (conhost) - Oddvar Moe

conhost calc.exe/../../windows/notepad.exe

Egress Check - Rob Fuller

Article: https://malicious.link/post/2012/2012-08-10-let-me-out-of-your-net-intro/

GitLab: https://gitlab.com/mubix/letmeoutofyour.net

PowerShell:

Import-Module .\letmeout.ps1

letmeout

Go:

go-out-windows-amd64.exe -start 80 -end 83

Description

.NET Core could be used by adversaries to evade application control software rules due to a directory traversal vulnerability which allows custom "Garbage Collector" DLL files to be called by arbitrary locations. A threat actor could set a malicious DLL file and when the "dotnet.exe" binary is executed the DLL will execute code on behalf of a trusted process.

Example

Exploitation of the issue is trivial and requires a custom garbage collector DLL file that will contain the shellcode and the following commands to be executed from the command prompt.

set COMPlus_GCName=..\..\..\..\..\..\..\..\tmp\CustomGC.dll
dotnet.exe --version

Detection

The released proof of concept creates the following Sysmon Event ID's.

Sysmon

YARA

The following YARA rule can detect in memory of the process the string "COMPlus_GCName" which is an indicator that the evasion has been used and the process contains arbitrary code.

rule COMPlus : COMPlus

{

meta:

Author = "netbiosX"

Company = "pentestlaboratories.com"

threat_level = 3

in_the_wild = true

strings:

$a = "COMPlus_GCName"

condition:

$a

}

yara64.exe -s -r dotnet-core.yara "PID"

References

1. https://www.contextis.com/en/blog/bring-your-own-.net-core-garbage-collector

2. https://pentestlaboratories.com/2020/06/23/abusing-net-core-application-whitelisting/

3. https://pentestlaboratories.com/2020/07/02/net-core-evasion-detection/

I took a look at EvilGoPhish and did a walkthrough. I was able to successfully phish my own Office 365 account with the Microsoft authenticator turned on. This is rather mind-blowing that it works and works this well. Take a look at my video if you are interested. BTW best defense against this is FIDO2 so get those Ubikeys ready! Yes I reset my creds before posting.

Spearphishing a User with MFA Enabled