Exposed Directory Reveals Red-Team Tools, Kerberoasted Hashes and Cobalt Strike Profile
Summary
Researchers found an exposed directory containing red-team tools, Kerberoasted hashes, and Cobalt Strike files. Certificate details were linked to a Cobalt Strike instance, but no beacon was associated with the port at the time of writing.
Key points
- The directory exposed Cobalt Strike, Havoc, and Villian tools, along with an SSH directory, bash history, a BloodHound archive, and network-analysis scripts.
- A text file contained Kerberoasted hashes, which can be taken offline for password cracking.
- Cobalt Strike files included a Malleable C2 profile named darkgate.profile and TLS certificate information.
- The profile's certificate was used to find a matching Cobalt Strike instance on port 50050.
- The server appeared relatively recent and potentially still in use, but no beacon was associated with the port at the time of analysis.
- The article says the exposed materials may indicate a red-team engagement, while noting the operator's identity and purpose were not confirmed.
Article Details
- Attack Vectors
- An exposed, directory-indexed server made red-team tools, scripts, certificates, and other files accessible online.
- A text file contained Kerberoasted hashes; the article describes obtaining service-account password hashes through Kerberoasting for offline cracking.
- The directory included a likely Malleable C2 profile associated with Cobalt Strike, which could reveal communication configuration and infrastructure.
- Defensive Notes
- Secure servers against unintended directory indexing and public exposure of sensitive files.
- Red teams should protect collected data, tools, certificates, and hashes and prioritize operational security during engagements.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ddosi[.]org | Identified as the website that hosted a cracked version of Cobalt Strike. |
MITRE ATT&CK
People
Tools
BloodHoundCobaltStrike, Havoc, and Villian. Additionally, we can see an exposed SSH directory, bash history, a BloodHound zip file, and probable 7Zip binaries (likely used for exfiltration). We can also see typical red teamCobalt Strikeand folders within Justin's post, we can see three well-known command and control (C2) frameworks, CobaltStrike, Havoc, and Villian. Additionally, we can see an exposed SSH directory, bash history, a BloodHound zipHavocwithin Justin's post, we can see three well-known command and control (C2) frameworks, CobaltStrike, Havoc, and Villian. Additionally, we can see an exposed SSH directory, bash history, a BloodHound zip file, andVillianJustin's post, we can see three well-known command and control (C2) frameworks, CobaltStrike, Havoc, and Villian. Additionally, we can see an exposed SSH directory, bash history, a BloodHound zip file, and probable