A Treasure Trove of Trouble: Open Directory Exposes Red Team Tools

Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.

A Halloween-themed open directory on a Hong Kong host exposed Cobalt Strike 4.2, exploit code, the BrowserGhost tool and a Goblin phishing kit aimed at Chinese-speaking education platforms.

Hunt.io exposes a multi-stage campaign: a scheduled-task executable and 'Dark Mode' Chrome extensions built from open-source spying code, plus a decoy Cobalt Strike PDF pushing duplicates.

Hunt tracked Geacon_Pro, a Golang Cobalt Strike implementation, via its default 'foren.zik' TLS certificate, surfacing servers and open directories used against Linux and Windows hosts.

While hunting IOX copies, Hunt found an open directory holding two SuperShell/GOREVERSE payloads and a Linux ELF Cobalt Strike beacon, and shows how /supershell/login panels can be tracked.

Nearly half of Microsoft IR engagements found unsecure AD configurations; Mandiant says 9 in 10 attacks exploit AD. Covers recon via PowerView and BloodHound, key techniques, and hardening priorities.