Discover cedowens/keygrabber Open Source project

A list of JARM hashes for different ssl implementations used by some C2/red team tools.

301

C2-JARM

129

MacC2

python-based Mac Command and Control that uses internal API calls instead of command line utilities. Author: Cedric Owens

Proof of concept MacOS post exploitation tool written in Swift. Designed as a POC for blue teams to build macOS detections. Author: Cedric Owens

128

MacShellSwift

Unit tests for blue teams to aid with building detections for some common macOS post exploitation methods.

113

Swift-Attack

Scripts (python3 and Swift) for macOS to recursively check /Applications and also check /usr/local/bin, /usr/bin, and /usr/sbin for binaries with problematic/interesting entitlements. Also checks for hardened runtime enablement

101

EntitlementCheck

Swift code to programmatically perform dylib injection

Inject_Dylib

Scripts to automate standing up apache2 with mod_rewrite in front of C2 servers.

Mod_Rewrite_Automation

Python3 script to generate a macro to launch a Mythic payload. Author: Cedric Owens

Mythic-Macro-Generator

JXA implementation of some SwiftBelt functions. Author: Cedric Owens

SwiftBelt-JXA

JXA and swift code that can perform some macOS situational awareness without generating TCC prompts.

Spotlight-Enum-Kit

A Swift port of some of the original PersistentJXA projects by D00MFist. Original PersistentJXA repo: https://github.com/D00MFist/PersistentJXA

Persistent-Swift

Python3 script to generate Office macros for the EvilOSX framework. Author: Cedric Owens

EvilOSX_MacroGenerator

Swift code to programmatically execute local or hosted JXA payloads from Terminal without using the on-disk osascript binary.

JXA-Runner

Collection of Slides From My Conference Talks

Presentations

aws_key_triage_tool

Script to automate initial triage/enumeration on a set of aws keys in an input file.

A combined list of helpful awscli commands from Scott Piper's flaws.cloud exercise as well as from Beau Bullock's Breaching the Cloud Training

aws-cli-notes

Dump-Chrome-Cookies

Repo with a modified version of CookieBro and scripts to leverage it to dump Chrome cookies

Scripts to automate standing up C2 infra with firewall settings inside of DigitalOcean.

Terraform_DigitalOcean_Scripts

python3 scripts to help with aws triage needs

Helpful_aws-scripts

JXA script based on research by Jeff Johnson on leveraging TextEdit to remove quarantine attributes on files. Jeff's original research is here: https://lapcatsoftware.com/articles/sandbox-escape.html

JXA-RemoveQuarantine

Swift code to run a dylib on disk

Dylib_Runner

Tool to download, install, and run macOS capable command & control servers (i.e., C2s with macOS payloads/clients) as docker containers from a list of options. This is helpful for automating C2 server setup.

C2_Cradle

Spins up a docker container with several useful tools for offensive security in macOS/cloud environments. Also installs the needed dependencies for each tool/utility during docker setup.

docker-arsenal

Dockerfile

Linode_Terraform_Scripts

Scripts to automate standing up hosts in Linode

Swift code to parse the quarantine history database, Chrome history database, Safari history database, and Firefox history database on macOS.

macOS-browserhist-parser

POC for a basic C2 server using the python aiohttp framework

SimpleC2_Server

Scripts to automate HELK server standup in Digital Ocean and filebeat on macOS to help automation of sending endpoint security logs from macOS hosts into HELK for building detections content

HELK-automation

python3 script that pulls gitlab data of interest using a gitlab personal access token

Gitlab-Searcher

A JXA script that leverages sqlite3 API calls to add items to the user's TCC database at: ~/Library/Application Support/com.apple.TCC/TCC.db

Add-To-TCC-DB

Skeleton spreadsheet to track rolling red team operation metrics.

Rolling_Op_Metrics

ioreg-and-sysctl-examples

Examples of programmatically interacting with ioreg and sysctl to query system info

C# implementation of my original Jenkins Hunter script (orig in python). It uses threading to search for unauthenticated Jenkins instances on ports 8080, 80, and 443. Author: Cedric Owens

Jenkins_Hunter_CSharp

JXA-Firefox

JXA Scripts for extracting data from Firefox

JXA script to add a macho binary to ~/.zshrc for persistence

zshrc-persist-JXA

A Swift (and slightly modified) version of Thomas Reed's PICT (Post Infection Collection Toolkit)

PICT-Swift

Golang programmatically invoking my SwiftBelt-JXA macOS system enumerator project (Golang running SwiftBelt-JXA via cgo)

GoBelt

AV_Enum_JXA

JXA code to enumerate security software on a macOS host

Threaded C# code that uses wmic to quickly check a host's /24 subnet for other hosts the current user has local admin access to. Author: Cedric Owens

LocalAdminChecker

SSH-Password-Sprayer

python3 script to spray a username and password against a network range. Author: Cedric Owens

Python3 Script to perform a password spray against an okta instance

okta-sprayer

List of some cloud metadata URLs that return interesting info

Metadata_URLs

dns-TXT-exfil-test

Simple client/server in golang to help with testing data exfil detections over DNS TXT records

find_chrome_tab

For those of us with too many Chrome tabs open on macOS 😳...this is a simple applescript to search all tab titles and urls across all Chrome browser windows for a match string and if found it sets that as the active tab. 😎

kube-unauth-exec-hunter

Python3 script to check a subnet range for kubernetes nodes allowing system:anonymous API command access. Author: Cedric Owens

python3 script that rates the difficulty of a given phishing exercise. Author: Cedric Owens

PhishDifficultyScorer

Simple wrapper around gitleaks to enumerate publicly facing repos belonging to an org and then run gitleaks against each in search of exposed secrets/keys.

gitleaks-wrapper

A wrapper around the on disk jamf binary (for JAMF managed macOS hosts). Useful for unit testing detections of offensive jamf host-based commands.

JAMF_Runner

python3 script that searches a network range for instances of unauthenticated Jenkins hosts. Author: Cedric Owens

JenkinsHunter

An example of how to use chromedp to run Chrome headless with the remote debugger port programmatically (is still a wrapper around the Chrome binary)

dns-exfil-test

chromedp-remotedebugger-example

SituationalAwarenessTool

C# tool that uses .net to provide situational awareness on a Windows host.

modified-tcc-clickjack

modified version of Ron Masas's TCC-Clickjack Swift project

python3 script that searches a network range for hosts hosting interesting pages that an attacker can leverage. Author: Cedric Owens

Page-Finder

Bash + terraform scripts to automate standing up pritunl VPN servers.

pritunl-vpn-setup-automation

C# Code to dump all AD computers and then quickly sweep for a given port.

AD-Threaded-Port-Sweeper

DGA-test

simple code to help with DGA nxdomain response testing

http-uri-test

SlackXtract

Swift code to extract available slack information from macOS hosts. Automates steps identified in Cody Thomas' post: https://posts.specterops.io/abusing-slack-for-offensive-operations-2343237b9282