Kali Linux

LDAPFragger : Command And Control Tool That Enables Attackers To Route Cobalt Strike Beacon Data

LDAPFragger is a Command and Control tool that enables attackers to route Cobalt Strike beacon data over LDAP using user attributes.

For background information, read the release blog: http://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes

Dependencies and installation

  • Compiled with .NET 4.0, but may work with older and newer .NET frameworks as well

Usage

_ _ _ | | | | / |
| | | | _ _ _ | | _ _ _ _ _ _ _ _
| |/ |/ _ | ‘ | | ‘/ |/ _ |/ ` |/ \ ‘|
| | (| | (| | |) | | | | | (| | (| | (| | / | ||_,|_,| ./|| || _,|_, |__, |___|| | | / | / | || |/ |/
Fox-IT – Rindert Kramer
Usage:
–cshost: IP address or hostname of the Cobalt Strike instance
–csport: Port of the external C2 interface on the Cobalt Strike server
-u: Username to connect to Active Directory
-p: Password to connect to Active Directory
-d: FQDN of the Active Directory domain
–ldaps: Use LDAPS instead of LDAP
-v: Verbose output
-h: Display this message
If no AD credentials are provided, integrated AD authentication will be used.

Example usage

From network segment A, run

LDAPFragger –cshost –csport
LDAPFragger –cshost –csport -u -p -d

From network segment B, run

LDAPFragger
LDAPFragger -u -p -d

LDAPS can be used with the --LDAPS flag, however, regular LDAP traffic is encrypted as well. Please do note that the default Cobalt Strike payload will get caught by most AVs.

R K

Recent Posts

Playwright-MCP : A Powerful Tool For Browser Automation

Playwright-MCP (Model Context Protocol) is a cutting-edge tool designed to bridge the gap between AI…

13 hours ago

JBDev : A Tool For Jailbreak And TrollStore Development

JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…

1 day ago

Kereva LLM Code Scanner : A Revolutionary Tool For Python Applications Using LLMs

The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…

1 day ago

Nuclei-Templates-Labs : A Hands-On Security Testing Playground

Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…

2 days ago

SSH-Stealer : The Stealthy Threat Of Advanced Credential Theft

SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…

2 days ago

ollvm-unflattener : A Tool For Reversing Control Flow Flattening In OLLVM

Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…

2 days ago