Hacker News new | ask | show | jobs
by mtlynch 6 days ago
> Naturally, the next move was pivoting from defense to offense. I wanted to see if the attackers left any vulnerable services exposed on their IP.

Why not attack them through the C2 interface? That's where I'd expect them to slip up.
1 comments
CITIZENDOT 6 days ago
> C2 interface

do you mean the machine which is connected through the victim's machine? if so, i should put this in a VM, run and see where it's sending/receiving requests from. i'll do that.

link
mtlynch 6 days ago
Yeah, exactly. If there's a C2 server, there's some protocol for communication between the C2 server and each victim node.

You can intentionally infect a machine with the malware but then watch the traffic between the victim node and the C2 server. If you get lucky, the C2 server assumes that the victim node is trusted and doesn't sanity check victim->server communication.

Note that this cranks up the danger quite a few notches, though it sounds like you know what you're doing.

link