LDAPFragger is a Command and Control tool that enables attackers to route Cobalt Strike beacon data over LDAP using user attributes.
For background information, read the release blog: http://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes
.NET 4.0
, but may work with older and newer .NET frameworks as well_ _ _ | | | | / |
| | | | _ _ _ | | _ _ _ _ _ _ _ _
| |/ |/ _
| ‘ | | ‘/ |/ _
|/ ` |/ \ ‘|
| | (| | (| | |) | | | | | (| | (| | (| | / | ||_,|_,| ./|| || _,|_, |__, |___|| | | / | / | || |/ |/
Fox-IT – Rindert Kramer
Usage:
–cshost: IP address or hostname of the Cobalt Strike instance
–csport: Port of the external C2 interface on the Cobalt Strike server
-u: Username to connect to Active Directory
-p: Password to connect to Active Directory
-d: FQDN of the Active Directory domain
–ldaps: Use LDAPS instead of LDAP
-v: Verbose output
-h: Display this message
If no AD credentials are provided, integrated AD authentication will be used.
From network segment A, run
LDAPFragger –cshost –csport
LDAPFragger –cshost –csport -u -p -d
From network segment B, run
LDAPFragger
LDAPFragger -u -p -d
LDAPS can be used with the --LDAPS
flag, however, regular LDAP traffic is encrypted as well. Please do note that the default Cobalt Strike payload will get caught by most AVs.
Welcome to the Cybersecurity Toolkit, a collection of essential Python tools designed for penetration testing…
The main objective of the creation of this laboratory is to transport the applications, tools…
"Dark FB" is a powerful toolkit designed for those who wish to delve deeper into…
Unlock the potential of ethical hacking with Wifi-Hacking.py, a powerful cybersecurity tool designed to navigate…
This repository was created with the aim of assisting companies and independent researchers about Tactics,…
A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path…