kilianc

65 karma · joined April 26, 2019

kilianc··on Let’s Go (VS) Code – Red Team Style

The Microsoft signed and hosted Reverse Shell

TL;DR; MS is offering a signed binary (code.exe), which will establish a Command&Control channel via an official Microsoft domain https://vscode.dev. The C2 communication itself is going to https://global.rel.tunnels.api.visualstudio.com over WebSockets. An attacker only needs an Github account.

kilianc··on When setting an environment variable gives you a 40x speedup

True, that could have used a TL;DR, agreed.

kilianc··on When setting an environment variable gives you a 40x speedup

True, but then you would loose all the coloring. By targeting only the attributes that generate additional syscalls, you can keep the vast majority of the colors and get a nice speed bump. Win win.

kilianc··on When setting an environment variable gives you a 40x speedup

Yes, it leaves all of the default coloring, except for the bits that require additional syscalls, that is: executable permission, setuid/setgid bits, and file capabilities.

kilianc··on When setting an environment variable gives you a 40x speedup

Precisely. We want colors. We're refined people.

kilianc··on When setting an environment variable gives you a 40x speedup

Good point! But sometimes a large-scale parallel filesystem can't beat a local SSD on certain patterns.

Also, we didn't see any timings for that 1,000x claim, so let's say it's an estimate. :)