DeepSec 2023 Talk: Introducing CS2BR – Teaching Badgers New Tricks – Moritz Thomas & Patrick Eisenschmidt
Staying under the radar and remaining undetected is one of our priorities during Red Teaming assessments. After all, we’re simulating real threat actors and want to reach our object
https://blog.deepsec.net/deepsec-2023-talk-introducing-cs2br-teaching-badgers-new-tricks-moritz-thomas-patrick-eisenschmidt/
#Conference #BOFs #C2Frameworks #COFF #CS2BR #DeepSec2023 #RedTeaming #Talk

@hoernchen72 #coff ? Habe ich seit Jahrzehnten nicht mehr in freier Wildbahn gesehen. Hm, auf #Ultrix/#MIPS muss das damals gewesen sein. Auch #Parix für #Transputer hat es benutzt.

Http://de.wikipedia.org/wiki/COFF

Coffe... #coffee #coffe #coff #coffy #cofy #cofe #cof

A VSCode devcontainer for development of COFF files with batteries included: https://github.com/EspressoCake/BOF_Development_Docker

#visualstudiocode #bof #coff

A coffee with Massimiliano Trolese
Il caffè che non ti aspetti, #CoffeeOfTheDay @ April 24, 2023 at 12:00AM
https://www.cafexperiment.com/2023/04/24/il-caffe-che-non-ti-aspetti/ #cafexperiment

Be #pictoftheday: tag us and join the experiment!
#coffeelover #teamcoffee #coffee #dailycoffee #acoffeeaday #CaféDuJour #coff…

A coffee with Stefano Paganini
Cafè Gourmand @ Artigiano in Fiera 2022, #CoffeeOfTheDay @ December 06, 2022
https://www.cafexperiment.com/2022/12/06/cafe-gourmand-artigiano-in-fiera-2022/ #cafexperiment

Be #pictoftheday: tag us and join the experiment!
#coffeelover #teamcoffee #coffee #dailycoffee #acoffeeaday #CaféDuJour #coff…

A coffee with Caterina Policaro
Il concetto di #EveryWhere in un caffè, #CoffeeOfTheDay @ November 08, 2022
https://www.cafexperiment.com/2022/11/08/il-concetto-di-everywhere-in-un-caffe/ #cafexperiment

Be #pictoftheday: tag us and join the experiment!
#coffeelover #teamcoffee #coffee #dailycoffee #acoffeeaday #CaféDuJour #coff…

I can now generate Windows #COFF object files containing .rsrc sections “by hand” again, but this time I know a little more about what I’m doing so it’s not just a sequence of bytes to write. Time to prepare the package for release after sleep.

#programming

It looks like the only fixed parts of a COFF object file are the file header and section table right at the start, so it's fairly easy to stream it to disk or an in-memory buffer as long as you know how many sections there will be, and as long as it's possible to rewind the file to update the headers.

The examples that I have put relocations right after the section, and symbols at the end of the file, but that seems convenient, not necessary.

#windows #coff #programming

Currently I’m using the object crate from https://github.com/gimli-rs/object. It’s good and pretty easy to use once you know what output you want to get, but it comes with a whole lot of dependencies for something that's supposed to be a one-liner in build.rs.

So, I’m changing the code that writes .o files for Rust GNU compiler targets back to my own code, but this time I (think I) know what’s going on with #COFF symbols, relocations, alignment and so on.

I’m using https://docs.microsoft.com/en-us/windows/win32/debug/pe-format for reference.

well, either our heater at work is on fire, or it hasn't been working properly at all this year, but that is one funky aroma. #coff #coff