UNC1739 blog

June 08, 2021

PortBender: TCP Port Redirection for Red Team Operations

How to redirect traffic from an incoming TCP port using the PortBender utility to perform SMB relay attacks and simulate Duqu 2.0-style persistence through a C2 framework like Cobalt Strike.

#red-team #offensive-tooling #smb-relay #cobalt-strike #persistence

Extending LLVM for Code Obfuscation (2 of 2)

Part two of the LLVM code obfuscation series. This installment covers developing a more complex pass that automatically encrypts string literals during the compilation process by manipulating the LLVM IR.

#reverse-engineering #llvm #obfuscation #compiler #red-team #malware

Extending LLVM for Code Obfuscation (1 of 2)

An introduction to binary obfuscation techniques through LLVM compiler customization. Part one covers LLVM fundamentals, development environment setup, and developing an LLVM pass for junk code insertion.

#reverse-engineering #llvm #obfuscation #compiler #red-team #malware