# CodeX's Terminal Window

## CodeX's Terminal Window

- [root@codex](https://codex-7.gitbook.io/codexs-terminal-window/root-codex.md): Red team research, CTF solutions, and random stuff I find interesting
- [Red Team OPSEC](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-opsec.md): This page is just a collection of things I think should be done on a red team operation to hinder detection and response. Work in progress. Will be updated whenever I learn new tricks
- [Infrastructure](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-opsec/infrastructure.md)
- [Example Red Team Infra](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-opsec/infrastructure/example-red-team-infra.md)
- [Cobalt Strike Redirectors](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-opsec/infrastructure/cobalt-strike-redirectors.md): A redirector a day keeps IR away
- [Using SSH Tunneling to secure C2 infra](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-opsec/infrastructure/using-ssh-tunneling-to-secure-c2-infra.md): Pesky AV vendors keep scanning my stuff >:C
- [Red Team Dev](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev.md): red team related dev work that doesnt directly fall under malware dev
- [Extending Havoc C2](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/extending-havoc-c2.md): Blog series where I try to explain the third party interfaces in @C5pider's Havoc C2
- [Third Party Agents](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/extending-havoc-c2/third-party-agents.md)
- [1: Understanding the interface](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/extending-havoc-c2/third-party-agents/1-understanding-the-interface.md)
- [2: Writing the agent](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/extending-havoc-c2/third-party-agents/2-writing-the-agent.md)
- [3: Writing the agent handler](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/extending-havoc-c2/third-party-agents/3-writing-the-agent-handler.md)
- [4: Testing the agent](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/extending-havoc-c2/third-party-agents/4-testing-the-agent.md)
- [Loader Dev](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/loader-dev.md): CreateRemoteThread()
- [In Memory OPSEC](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/loader-dev/in-memory-opsec.md)
- [PE Structures](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/loader-dev/in-memory-opsec/pe-structures.md)
- [Memory Permissions and Allocation Types](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/loader-dev/in-memory-opsec/memory-permissions-and-allocation-types.md)
- [In Memory Signatures](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/loader-dev/in-memory-opsec/in-memory-signatures.md)
- [Evasion Adventures](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/loader-dev/evasion-adventures.md): Talk I gave on in memory evasion and memory OPSEC.
- [Sleep masking](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/loader-dev/sleep-masking.md): Because sometimes set sleep\_mask "true"; isnt enough
- [Mimikatz vs Windows Defender](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/loader-dev/mimikatz-vs-windows-defender.md): Ever wanted to drop Mimikatz to disk during an engagement? Probably not. Lets do it anyways!
- [Indirect syscalls](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/loader-dev/indirect-syscalls.md): Referenced from: https://www.cobaltstrike.com/blog/writing-beacon-object-files-flexible-stealthy-and-compatible/
- [Cobalt Strike](https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike.md): Fire teh lazer!
- [Building custom C2 channels by hooking wininet](https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/building-custom-c2-channels-by-hooking-wininet.md): Because official specs sometimes (often) suck
- [Modifying the Sleep Mask Kit](https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/modifying-the-sleep-mask-kit.md)
- [Discord Beacon Notifications](https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/discord-beacon-notifications.md): :ping:
- [Evading Hunt-Sleeping-Beacons](https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/evading-hunt-sleeping-beacons.md): Reference: https://github.com/thefLink/Hunt-Sleeping-Beacons
- [Beacon Object Files](https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/beacon-object-files.md): No mor fork and run
- [Misc. Interesting Stuff](https://codex-7.gitbook.io/codexs-terminal-window/red-team/misc.-interesting-stuff.md): This is where I put stuff that I'm lazy to categorize
- [Detecting Cobalt Strike](https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike.md): Stuff that causes Cobalt Strike to be flagged, so we don't accidentally burn ourselves.
- [Sleep Mask Kit IOCs](https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs.md): YARA rule included!
- [Hunting Beacon in the heap](https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/hunting-beacon-in-the-heap.md): WORK IN PROGRESS
- [Decrypting C2 traffic with known key](https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/decrypting-c2-traffic-with-known-key.md): Reference: https://blog.nviso.eu/2021/10/21/cobalt-strike-using-known-private-keys-to-decrypt-traffic-part-1/
- [Cyber Defenders Discovery Camp 2021](https://codex-7.gitbook.io/codexs-terminal-window/ctf-solutions/cyber-defenders-discovery-camp-2021.md): This CTF was problematic...to say the least :/
- [Lets Go Hunting](https://codex-7.gitbook.io/codexs-terminal-window/ctf-solutions/cyber-defenders-discovery-camp-2021/lets-go-hunting.md)
- [Linux Rules The World!](https://codex-7.gitbook.io/codexs-terminal-window/ctf-solutions/cyber-defenders-discovery-camp-2021/linux-rules-the-world.md)
- [Going active](https://codex-7.gitbook.io/codexs-terminal-window/ctf-solutions/cyber-defenders-discovery-camp-2021/going-active.md)
- [File it away](https://codex-7.gitbook.io/codexs-terminal-window/ctf-solutions/cyber-defenders-discovery-camp-2021/file-it-away.md)
- [Behind the mask](https://codex-7.gitbook.io/codexs-terminal-window/ctf-solutions/cyber-defenders-discovery-camp-2021/behind-the-mask.md): Red team time!
- [Box Writeups](https://codex-7.gitbook.io/codexs-terminal-window/box-challenges/box-writeups.md): I like to do boxes with a bit of red team tradecraft added in for fun.
- [Home | Ethan Seow](https://codex-7.gitbook.io/codexs-terminal-window/home-or-ethan-seow.md)