Primary Categories: [[BlackBasta]] Links: [[BlackBasta Articles]] / [[BlackBasta CVE's]] / [[BlackBasta Ransom Note]] / [[BlackBasta TTP's]] # [[BlackBasta Tools]] ## Discovery - AdFind - Advanced IP Scanner is used to discover all connected devices on a local network, providing details like IP addresses, MAC addresses, and device names, enabling network administrators to manage and monitor their network. - https://www.advanced-ip-scanner.com/ - Bloodhound - BloodHound is an open-source tool for cybersecurity that maps complex relationships within an Active Directory (AD) environment to identify potential attack paths. - [https://github.com/SpecterOps/BloodHound](https://github.com/SpecterOps/BloodHound) - PowerView - PowerView is a PowerShell tool to gain network situational awareness on Windows domains. It contains a set of pure-PowerShell replacements for various windows "net *" commands, which utilize PowerShell AD hooks and underlying Win32 API functions to perform useful Windows domain functionality. - https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon - PSNmap - Svendsen Tech's PowerShell asynchronous nmap-like port scanner, accepting IPv4 CIDR notation. DNS lookups. - https://github.com/EliteLoser/PSnmap - SoftPerfect NetScan - This fast, highly configurable IPv4/IPv6 scanner can streamline many of your network support procedures. Its well-designed interface, light weight and portability coupled with an extensive range of options and advanced features make SoftPerfect Network Scanner an invaluable tool, whether you are a professional system administrator, someone providing occasional network maintenance, or a general user interested in computer security. - https://www.softperfect.com/products/networkscanner/ ## RMM Tools - AnyDesk - AnyDesk is used for remote desktop access, allowing users to control one computer from another device as if they were physically there. - https://anydesk.com/en - Atera - Atera provides an all-in-one IT management platform that includes remote monitoring and management (RMM), patch management, ticketing, and automation. - https://www.atera.com/ - NetSupport - NetSupport Manager is a Windows-centric cross-platform remote control software, allowing remote screen control and systems management from a Windows or Windows Mobile device of Windows, Mac, Linux, Solaris and Mobile devices. - https://www.netsupportsoftware.com/ - ScreenConnect - ScreenConnect is a software used for remote support, remote access, and remote meetings. It allows users, typically IT professionals, to remotely control computers, servers, and mobile devices to troubleshoot issues, provide technical assistance, or perform unattended maintenance. - https://www.screenconnect.com/ - Splashtop - Splashtop is used for remote access to a computer or device, allowing users to view and control it from another device, anywhere with an internet connection. - [https://www.splashtop.com/](https://www.splashtop.com/) - Supremo - Supremo Mobile Assist empowers you to remotely access and manage Android devices from your PC or Mac with ease. - https://www.supremocontrol.com/ ## Defense Evasion - Backstab - Backstab is a tool capable of killing antimalware protected processes by leveraging sysinternals’ Process Explorer (ProcExp) driver, which is signed by Microsoft. - https://github.com/Yaxser/Backstab ## Credential Theft - Mimikatz - Mimikatz is a tool that is commonly used by hackers and security professionals to extract sensitive information, such as passwords and credentials, from a system’s memory. It is typically used to gain unauthorized access to networks, systems, or applications or to perform other malicious activities, such as privilege escalation or lateral movement within a network. - [https://github.com/ParrotSec/mimikatz](https://github.com/ParrotSec/mimikatz) ## OffSec - Brute Ratel (BRc4) - Brute Ratel is a post-exploitation and command-and-control (C2) framework, used to simulate advanced attacker behaviors. - https://bruteratel.com/ - Cobalt Strike - Cobalt Strike is a legitimate commercial adversary simulation and penetration testing tool used by cybersecurity professionals to assess network security. However, due to its powerful capabilities, it is also widely used by malicious threat actors, including ransomware gangs and state-sponsored groups, for real-world cyberattacks. - https://www.cobaltstrike.com/ - Metasploit - Metasploit is a cybersecurity platform used for penetration testing, which involves identifying and exploiting vulnerabilities to assess security. - https://www.metasploit.com/ - PowerSploit - PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. PowerSploit is comprised of the following modules and scripts: - https://github.com/PowerShellMafia/PowerSploit ## LOLBAS - BITSAdmin - bitsadmin is a command-line tool in Windows that manages the Background Intelligent Transfer Service (BITS) for transferring files in the background. - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin - PsExec - PsExec is a lightweight telnet replacement that lets users execute processes on other systems (complete with full interactivity for console applications) without having to manually install client software. PsExec's uses include launching interactive command-prompts on remote systems and remote-enabling tools such as IpConfig that otherwise do not have the ability to show information about remote systems. - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec ## Exfiltration - Rclone - Rclone is a command-line tool used for managing files on cloud storage, allowing users to copy, sync, and transfer files between various cloud providers and local systems. - https://rclone.org/ - Qaz[.]im - qaz.im is a disposable temp email domain that provides users with temporary email addresses for anonymous online activities - https://qaz.im/