Outflank Security Tooling (OST) Releases

Outflank C2

Asynchronous task support

• Though BOFs were previously designed for synchronous operations, operators can now to roll out a network of sensors and stream these events to the C2 server for further processing – all while the implant is sleepmasked

Outflank C2 Async BOF Pack

• This can monitor for various events, with an initial release consisting of four monitoring BOFs:
• Usermon: Monitor and record user login events. Every login is recorded and printed
• Procmon: Monitor for a specific application start
• Clipmon: Monitor the clipboard, recording every new text copy
• Keylogger: Record all entered keystrokes, including key modifiers and special keys
• Usermon: Monitor and record user login events. Every login is recorded and printed

Bugfixes

• Numerous bugfixes and minor improvements for payload generator, Ceaconbooster, languagePanda

Schedule a demo to learn more >

ShovelNG

• With Bring your own Execution Context (BYOEC), it is now possible to configure ShovelNG to upload your own .exe to be used as execution context instead of one of the currently available LOLBINS

• Added 5 pre-configured Execution Contexts

• Additional execution configurations soon to come
  

Schedule a demo to learn more >

Portal

• This Portal update will bring many small changes to make usage and build flows more convenient, including the introduction of Evil-O-4000, who will now help and guide you, providing:

  • Input validation errors in PE Payload Generator

  • Inconsistencies/warnings between Outflank C2 and PE Payload Generator settings

  • Confirmation of input validation

Miscellaneous Bugfixes

• Fixes for Outflank C2, PE Payload Generator, and EarlyCascade

Schedule a demo to learn more >

Outflank C2

• New Enclave Sleep Mask added

• New AMSI bypass: Novel data-only bypass

• New BOF loader: Overhauled for increased flexibility and performance

• Guardrails: Anti-sandbox guardrails now aligned with Payload Generator to provide same options and protection

PE Payload Generator

• Cross product configuration checks added

EDR Presets

• New community contributed EDR preset added

Schedule a demo to learn more >

Tech Deep Dive

• Recording of the Secure Enclaves knowledge sharing session added to portal:

              – Deep dive into architecture of VBS enclaves

              – Full walkthrough demo with practical techniques for existing vulnerable enclave DLLs

EDR Presets

• New community contributed EDR preset added

Schedule a demo to learn more >

• BOF loader is now able to deal with BOFs BeaconPrintf-ing binary buffers from BOFs that aren’t programmed nicely

• System proxy support for Linux and macOS

• Several small bug fixes on additional HTTP headers

• Added 2 new EDR presets

• Improved OPSEC documentation

Schedule a demo to learn more >

Updates

• Evasion improvement for PasswordSpy

• Bugfix for ROADtune Android support

• Bugfix for lateral movement via Shovel
  

Schedule a demo to learn more >

Updates

• Improvement on the guardrail requirements to avoid sandbox analysis

Schedule a demo to learn more >

Tradecraft

• Knowledge session on MS defender static detections now available on portal

Updates

• Overall quality of life improvements & smaller bug fixes

Schedule a demo to learn more >

EarlyCascade Injection in Payload Generator

• Added a novel injection technique called ‘EarlyCascade’

• Added ‘freeze’ as a new process creation method

• New ‘Embed in section’ option

• Relative local paths are now supported

Updates

• Bugfixes in Payload Generator, Outflank C2 (formerly Stage1), and in the OST portal

Schedule a demo to learn more >

Outflank C2: New Name & New Features

• Native Implants: Tailored for each OS, both implants are written in C/C++/ASM

• Full Implant Capabilities: Dynamic Execution (BOF/JXA), network tunneling, http & tcp beacons

• Guardrails & High OPSEC: Our research into macOS & Linux EDR was incorporated in developing the implant

• In-Phase Builder: Capabilities to generate/transform raw shellcode in various macOS or Linux formats

• Stage1 has been renamed Outflank C2

Schedule a demo to learn more >

PE Payload Generator:

• 4 New EDR presets (community contributions)

In-Phase Builder

• Updated .Net shellcode loader as follow-up after the Elsatic Blog

Stage1 C2

• Update for KernelCallbackTables injection and Module Stomping

• Bugfixes

BeaconBooster

• Implemented evasion for Windows Defender Emulator

Schedule a demo to learn more >

New tool in beta: In-Phase Builder

• This is an incredibly powerful framework for generating and working with file formats and is easily extendible.

• Each file format transformation has been implemented in the infection chain and optimized for OPSEC.

• Chains include new tradecraft to decrease the number of warnings/popups a victim will see or change some popups to less scary ones.

• The tool incorporates our research and full weaponisation of an initial infection file format that has less stringent browser controls and Mark-of-the-Web blocks than most known formats.

  Schedule a demo to learn more >

EDR Evasion

• Evasive features ported towards ShovelNG for lateral movement

• Additions of new EDR presets

Stage1

• Major performance enhancement of SOCKS

Misc Features and Updates

• New Keylogger and capability for remote command execution over WSMan

• Inclusion of new relaying research

• Updates to several tools to support new Windows versions, features, bugfixes, etc

Schedule a demo to learn more >

• EDR info has been extended and presets are now available for a total of six major EDRs.

• A cheat sheet is now available for the “OPSEC tricks for attacking Azure AD with ROADtools” recording.

• Numerous small bugfixes have been implemented.

Schedule a demo to learn more >

Tech DeepDive Recording

• Microsoft Office Offensive Tradecraft: A recording of a public office tradecraft training.

EDR Evasion / Payload generator & documentation

• Two new PE Payload Generator EDR presets.

Schedule a demo to learn more >

Updates:

Tool category: Out-phase/Exfiltration

• Hidden Desktop: Complete rewrite, BOF format and various new functionality

• New feature in Stage 1: Reverse Port Forwarding (Enabling hiddenDesktop via Stage1)

Schedule a demo to learn more >

Updates:

Tool Category: Lateral Movement

• Enhanced ShovelNG (lateral movement) for increased evasion/OPSEC

Knowledge Sharing:

Category: Cloud OPSEC

• Tech DeepDive Recording: OPSEC tricks for attacking Azure AD with ROADtools from Dirk-Jan Mollema

Schedule a demo to learn more >

Tool category: Command & Control

Schedule a demo to learn more >

Release type: Knowledge Sharing

•   Added Tech Deep Dive video on Stage 1 automation
•   Added Tech Deep Dive video on Windows Kernel Drivers

Schedule a demo to learn more >

Release type: Updates

•   PE Payload Generator now supports .node files
•   KernelTool and Kernelkatz driver change after update of Microsoft Driver Block List
•   KernelTool support for DSE disabling
•   KernelKatz enhancements to dump plaintext WDigest Credentials and toggle WDigest support

Release type: Knowledge Sharing

•  Added ClockOnce video to Tech DeepDive section

Schedule a demo to learn more >

Tool category: Command & Control

•   New tool release: Cobalt Strike Integrations on User Defined Reflective Loader

Schedule a demo to learn more >

Tool category: Initial Access

Schedule a demo to learn more >

Tool category: Credential dumping

•  New tool release DumpMstsc: a BOF to retrieve passwords from a running mstsc process

Updates:

•  New UAC bypass functionality in KerberosAsk, code overhaul in KernelTool and added opsec features in ShovelNG (lateral movement pack)

Schedule a demo to learn more >

Release type: Knowledge Sharing

•  Sharing: session on EDR Evasion & Opsec, recording is available in portal

Schedule a demo to learn more >