Cas van Cooten

About Me

Thu, 27 Feb 2025 00:00:00 +0000

Hi! I’m Cas, an offensive security enthusiast and Red Teamer based in the Netherlands. I like to play around with anything that is related to hacking, security, programming languages, or tech in general. I love to learn, but I love sharing the things that I have learned even more - that’s what this blog is for. If you would like to get in touch you can do so via Twitter or email. I’m always up for a chat about (offensive) security and the latest new programming languages!

Abusing VS Code's Bootstrapping Functionality To Quietly Load Malicious Extensions

Thu, 27 Feb 2025 00:00:00 +0000

Wow, been a while since my last blog 😅. During some research I came across a technique variation which I felt was interesting enough to share in a brief blog post. It relates to how the bootstrapping functionality in VS Code can be abused to quietly load plugins - it may come in handy during your initial access adventures!

The Threat of VS Code Extensions

It’s no secret that the popularity of VS Code brings a lot of risk exposure in the form of its plugin system. Threat actors and researchers alike have been happily abusing it to target developers - even your favorite dark theme is not safe.

So You Wanna Hack a Bank? 'Global Central Bank' (PACES) Certification Review

Tue, 05 Oct 2021 00:00:00 +0000

Updated February 13th, 2023: The PACES certification has been renamed to ‘Certified Red Team Master’ (CRTM) and is now licensed by AlteredSecurity instead of PentesterAcademy, this blog post has been updated to reflect.

Introduction

The “Global Central Bank” (GCB) labs and accompanying “Certified Red Team Master” (CRTM) certification are definitely something else. It is more or less the “level-up” from the respective “Attacking and Defending Active Directory” (CRTP) and “Windows Red Team Lab” (CRTE) courses, also provided by AlteredSecurity. GCB is the hardest of the three, so if you’re looking for more beginner-friendly material, you’re probably better off reading my blog post on CRTP instead.

Building a C2 Implant in Nim - Considerations and Lessons Learned

Wed, 25 Aug 2021 00:00:00 +0000

Nim for offensive security

For a while now I have been playing with the programming language Nim in the context of Offensive Security. Nim is a relatively young and fairly unknown programming language that has a syntax quite similar to Python’s, so is very easy to pick up. It however offers the flexibility and low-level capabilities of languages like C/C++, and has a great foreign function interface. On top of that, it compiles to native C (as well as some other languages), which results in native binaries that are quite slim. This makes it very suitable for malware development, especially for scrubs that are too scared of C/C++ to write any proper program in those languages (like me!).

Operate Like You Mean It: 'Red Team Ops' (CRTO) Course Review

Sat, 10 Jul 2021 00:00:00 +0000

Introduction

If you hang around the infosec “twittersphere” or in other security communities, odds are you have already seen someone share their experiences on the ‘Red Team Ops’ course by ZeroPointSecurity. I had heard a lot about this course prior to enrolling in it myself - almost exclusively consisting of positive reviews. The author of the course, RastaMouse, is quite a well-known figure in the infosec community. You may know him for his open-source tool contributions, such as Watson or ThreatCheck, or if you are a HackTheBox-enthusiast you may know him for the RastaLabs pro lab.

Getting the OSEP Certification: 'Evasion Techniques and Breaching Defenses' (PEN-300) Course Review

Sat, 27 Mar 2021 00:00:00 +0000

Updated February 13th, 2023: Some referenced courses are now licensed by AlteredSecurity instead of PentesterAcademy, this post has been updated to reflect.

Introduction

When Offensive Security announced the new PEN-300 course, also called “Evasion Techniques and Breaching Defenses”, the syllabus immediately intrigued me. The course promises to provide an advanced course, aimed at “OSCP-level penetration testers who want to develop their skills against hardened systems”, and discusses more advanced penetration testing topics such as antivirus evasion, process injection and migration, bypassing application whitelisting and network filters, Windows/Linux post-exploitation and lateral movement (hello Active Directory!).

Windows & Active Directory Exploitation Cheat Sheet and Command Reference

Wed, 04 Nov 2020 00:00:00 +0000

Last update: November 3rd, 2021

Updated November 3rd, 2021: Included several fixes and actualized some techniques. Changes made to the Defender evasion, RBCD, Domain Enumeration, Rubeus, and Mimikatz sections. Fixed some whoopsies as well 🙃.

Updated June 5th, 2021: I have made some more changes to this post based on (among others) techniques discussed in ZeroPointSecurity’s ‘Red Team Ops’ course (for the CRTO certification). I’ve re-written and improved many sections. New sections have been added on DPAPI and GPO abuse. Notable changes have been made to the the sections on LAPS, AppLocker & CLM, PowerView, and Overpass-the-Hash with Rubeus. Enjoy! :)

Getting the CRTP Certification: 'Attacking and Defending Active Directory' Course Review

Tue, 13 Oct 2020 00:00:00 +0000

Updated February 13th, 2023: The CRTP certification is now licensed by AlteredSecurity instead of PentesterAcademy, this blog post has been updated to reflect.

Introduction

As a red teamer -or as a hacker in general- you’re guaranteed to run into Microsoft’s Active Directory sooner or later. Almost every major organization uses Active Directory (which we will mostly refer to as ‘AD’) to manage authentication and authorization of servers and workstations in their environment. It is a complex product, and managing it securely becomes increasingly difficult at scale.

Try Harder: Yet Another Journey To OSCP

Sun, 17 May 2020 00:00:00 +0000

The first part of this blog post dives into my personal OSCP story. If you’re only interested in stuff you can apply to your own PWK journey, jump to the key takeaways or the OSCP FAQ.

Preamble

I don’t have a very technical background. I did a Master’s in Information Science before starting as a Cyber Security Consultant. In my current role, I deal with various cyber topics on an organizational level - usually not from a very technical perspective.

Generating pretty PWK reports with Pandoc and Markdown (templates inside!)

Thu, 07 May 2020 00:00:00 +0000

For some people, the reporting bit of the PWK course may be their pride and joy leading up to their OSCP certification. For others, it’s just a necessity that they want to get out of the way. Either way, handing in a report describing your findings is a requirement posed by Offensive Security - so you’re gonna have to do it if you want to obtain that elusive OSCP certification!

OSCP Cheat Sheet and Command Reference

Sun, 03 May 2020 00:00:00 +0000

Updated May 18th, 2020

Since my OSCP certification exam is coming up, I decided to do a writeup of the commands and techniques I have most frequently used in the PWK labs and in similar machines. I aimed for it to be a basic command reference, but in writing it it has grown out to be a bit more than that!

That being said - it is far from an exhaustive list. If you feel any important tips, tricks, commands or techniques are missing from this list just get in touch on Twitter!