Resources

Why It’s Not Core Impact vs. Core Impact
Blog

Why It’s Not Core Impact vs. Cobalt Strike

Tue, 03/15/2022
Making a decision on a new cybersecurity tool is never easy—particularly when it’s unclear how rival products compare. It’s tempting to simply type “product vs. product” into Google and see if one stands out as the clear favorite. However, sometimes you can find that two products have been mistakenly grouped together and aren’t actually in competition, but rather, they are in separate categories....
Penetration Testing
Red Team
Article

Analysis of CVE-2022-21882 "Win32k Window Object Type Confusion Exploit"

I wanted to write this blog to show the analysis I did in the context of developing the Core Impact exploit “Win32k Window Object Type Confusion” that abuses the CVE-2022-21882 vulnerability. It’s based on the existing Proof of Concept (POC), which is both interesting and quite complex. It may be difficult to understand everything that is happening by just reading the blogpost. I encourage readers...
Incorporating New Tools into Core Impact
Blog

Incorporating New Tools into Core Impact

Mon, 02/21/2022
Core Impact has further enhanced the pen testing process with the introduction of two new modules. The first module enables the use of .NET assemblies, while the second module provides the ability to use BloodHound, a data analysis tool that uncovers hidden relationships within an Active Directory (AD) environment. In this blog, we’ll dive into how Core Impact users can put these new modules into...
Penetration Testing
SIEM for SMB
Blog

4 Ways to Use SIEM for SMB

Tue, 02/08/2022
Security Information and Event Management (SIEM) solutions are often seen as a necessity only for large enterprises with massive environments to monitor for security threats. While this may have been true over a decade ago, in the early days of SIEM. Since then organizational IT infrastructures have become increasingly multifaceted, and the threat landscape continues to evolve. These days, small...
SIEM
Article

Reversing and Exploiting with Free Tools: Part 12

In part 11, we completed the ROP bypass of the DEP. In this part, we’ll begin our first exercise compiled in 64 bits. Before beginning, we’ll go over a few concepts in detail, because this exercise requires a new frame of reference. While the base is the same, it’s important to know the differences between 32 and 64 bits in order to be successful in reversing. Starting with 64 bits We’ve already...
cybersecurity-trends-predictions
Blog

The New Normal in Cybersecurity: Exploring the Top Three 2022 Predictions

Tue, 01/04/2022
In The New Normal in Cybersecurity Part 1, we examined three leading trends in the cybersecurity community over the past year. In this installment, we will take a look into the future and make predictions about where the cybersecurity landscape is potentially headed in 2022 and beyond. #1: New Laws and Regulations In the future, it’s likely that new laws and regulations will be enacted as the U.S....
Penetration Testing
Red Team
Threat Detection
IGA
Compliance
cybersecurity-trends-predictions
Blog

The New Normal in Cybersecurity: Examining the Top Three 2021 Trends

Tue, 01/04/2022
The past year has shown organizations that uncertainty and a transformed reality are the new normal in business. While remote work was intended as a temporary response to the global pandemic, it is now considered a regular part of the business environment—fundamentally altering the way companies operate. This means organizations have had to respond in real-time to shift their cybersecurity...
Penetration Testing
Red Team
Threat Detection
IGA
IAM
Compliance
Article

Writing Beacon Object Files: Flexible, Stealthy, and Compatible

This post focuses on creating Cobalt Strike Beacon Object Files using the MinGW compiler on Linux. We will discuss several ideas and best practices that will increase the quality of your BOFs. Flexibility Compiling to Both Object Files and Executables While writing a BOF is great, it’s always worth making the code compile to both BOF and EXE. This provides a lot more options: we could run our...
Article

Core Impact Issues Latest Exploit for Log4Shell Vulnerability

The Log4Shell vulnerability, a serious remote code execution vulnerability in the Apache Log4j2 library, is one of the best candidates for winning several Pwnie awards in 2022. What is the Log4Shell Vulnerability? CVE-2021-44228 is an improper input validation vulnerability (CWE-20). Any attacker who controls log messages or log message parameters is able to execute arbitrary code loaded from LDAP...
Flying padlock
Video

Cybersecurity in a Changed World: 2021 Trends and 2022 Predictions

Wed, 12/08/2021
If 2020 seemed like an anomaly, 2021 proved to us that it’s time to get comfortable with the transformed reality. Remote work, intended as a temporary response to COVID-19, is now an increasingly standardized way to operate. With face-to-face operations no longer the norm, numerous organizations have shifted to a technology-driven strategy. We’ve seen a rise in initiatives like self-service or...
Penetration Testing
What is the MITRE Attack Framework
Blog

What is the MITRE ATT&CK® Framework?

Mon, 12/06/2021
The MITRE ATT&CK Framework was created in 2013 to create a comprehensive document of tactics, techniques, and procedures that cyber attackers were regularly using to breach the defenses of individuals and organizations. Since then, it has grown to be a global knowledge base that has helped to standardize defensive security and remains accessible to all security professionals. This framework...
Penetration Testing
Reflections on Ekoparty 2021
Blog

Reflections on Ekoparty 2021

By Ricardo Narvaja on Tue, 11/30/2021
Ekoparty began as an underground hacking event, but has grown into one of the foremost cybersecurity conferences in Latin America. This year was the 20th anniversary of the incredible infosec event, which takes place every year in Buenos Aires. In order to discover insights from this year’s conference, we talked with two experts from Core Security who attended, and also served as trainers at the...
Penetration Testing
Video

Core Impact 21.2 Overview

Mon, 11/29/2021
We’re pleased to announce a new release of Core Impact! Version 21.2 introduces the MITRE ATT&CK™ framework, a matrix of attack tactics and techniques that serves as a reference for cybersecurity professionals which has become a standard in defensive security. Core Impact users can now create MITRE ATT&CK™ reports to classify engagement results according to the matrix, and gain further insight...
Penetration Testing
Core Impact 21.2
Blog

Core Impact 21.2: Incorporating the MITRE ATT&CK™ Framework and Attack Map Enhancements

Mon, 11/29/2021
The latest release of Core Impact has arrived! Version 21.2 underscores our alignment with the cybersecurity community, incorporating the MITRE ATT&CK™ framework to provide further insights into security weaknesses. We’ve also added additional features to Core Impact’s attack map, making the penetration testing process even more intuitive. The MITRE...
Penetration Testing
critical-access-risks-security
Blog

Five Critical Access Risks You Should Find Before an Audit Does

Thu, 11/18/2021
Like a lot of organizations today, your company is facing increasing demands to support and protect countless systems, applications, and platforms that contain sensitive business data by controlling access to this critical information. On top of this, you are pressured to meet ongoing regulatory compliance and industry mandates. Nearly every industry today has specific regulatory requirements and...
PAM
IGA
IAM
Article

Nanodump: A Red Team Approach to Minidumps

Motivation It is known that dumping Windows credentials is a technique often utilized for everyday attacks by adversaries and, consequently, Red Teamers. This process has been out there for several years and is well documented by MITRE under the T1003.001 technique. Sometimes, when conducting a Red Team engagement, there may be some limitations when trying to go beyond the early detection of this...
man-at-computer-with-locks
Video

A Secure Alliance: How Vulnerability Management and Penetration Testing Work Together

Wed, 11/10/2021
IT environments have grown increasingly sophisticated, giving individuals and businesses capabilities they never could have dreamed of 20 years ago. However, the only thing growing faster than technology are the threats to it. While there is no foolproof way to stop every cyber-attack, a strategic combination of security resources can make your cyber defenses formidable. When used together,...
We’re In: Tired Hacking Tropes in TV Shows and Movies
Blog

We’re In: Tired Hacking Tropes in TV Shows and Movies

Wed, 11/03/2021
It’s a well-known fact that TV shows and movies pride themselves on their complete and total accuracy when it comes to portraying historical events, illnesses, or jobs. That’s how we know that everyone in olden times spoke in British accents no matter what country they were in, people with tuberculosis casually cough up blood while otherwise carrying on as normal, and all doctors wander about in...
Penetration Testing
Phishing