{"id":2996,"date":"2021-05-01T14:35:14","date_gmt":"2021-05-01T12:35:14","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=2996"},"modified":"2023-12-24T12:43:01","modified_gmt":"2023-12-24T11:43:01","slug":"covenant","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=2996","title":{"rendered":"Covenant"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">-NET attack frame\u00adwork: <a href=\"https:\/\/github.com\/cobbr\/Covenant\">https:\/\/github.com\/cobbr\/Covenant<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Usage<\/h2>\n\n\n\n<ol class=\"wp-block-list\"><li>Cre\u00adate a lis\u00adten\u00ader on the attack system.<\/li><li>Add a launch\u00ader to the listener.<\/li><li>The attack sys\u00adtem now pro\u00advides a pay\u00adload file the vic\u00adtim has to&nbsp;start.<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">You can use Urban\u00adBish\u00adop to inject the pay\u00adload into a run\u00adning process. As soon as the pay\u00adload is exe\u00adcut\u00aded, Covenant will show on the dash\u00adboard a new con\u00adnec\u00adtion with which you can inter\u00adact now. Exam\u00adple for the injec\u00adtion&nbsp;part:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"679\" src=\"https:\/\/andreas-klingler.de\/infosec\/wp-content\/uploads\/2021\/05\/Bildschirmfoto-2021-05-01-um-14.56.28-1024x679.png\" alt class=\"wp-image-2999\" srcset=\"https:\/\/infosec.andreas-klingler.de\/wp-content\/uploads\/2021\/05\/Bildschirmfoto-2021-05-01-um-14.56.28-1024x679.png 1024w, https:\/\/infosec.andreas-klingler.de\/wp-content\/uploads\/2021\/05\/Bildschirmfoto-2021-05-01-um-14.56.28-300x199.png 300w, https:\/\/infosec.andreas-klingler.de\/wp-content\/uploads\/2021\/05\/Bildschirmfoto-2021-05-01-um-14.56.28-768x509.png 768w, https:\/\/infosec.andreas-klingler.de\/wp-content\/uploads\/2021\/05\/Bildschirmfoto-2021-05-01-um-14.56.28-1536x1018.png 1536w, https:\/\/infosec.andreas-klingler.de\/wp-content\/uploads\/2021\/05\/Bildschirmfoto-2021-05-01-um-14.56.28.png 2046w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\"><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>-NET attack frame\u00adwork: https:\/\/github.com\/cobbr\/Covenant Usage Cre\u00adate a lis\u00adten\u00ader on the attack sys\u00adtem. Add a launch\u00ader to the lis\u00adten\u00ader. The attack sys\u00adtem now pro\u00advides a pay\u00adload file the vic\u00adtim has to&nbsp;start. You can use Urban\u00adBish\u00adop to inject the pay\u00adload into a run\u00adning process. As soon as the pay\u00adload is exe\u00adcut\u00aded, Covenant will show on the dashboard&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[470],"tags":[348,382,24],"class_list":["post-2996","post","type-post","status-publish","format-standard","hentry","category-active-enum","tag-net","tag-covenant","tag-windows"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2996","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2996"}],"version-history":[{"count":2,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2996\/revisions"}],"predecessor-version":[{"id":3000,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2996\/revisions\/3000"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2996"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2996"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}