Session Hijacking with Mythic C2 & RoadTools 🔐

Catch me live on Twitch every Sunday at 17:00 UTC:
https://www.twitch.tv/flangvik/​​

Join in for an in-depth exploration of post-compromise session hijacking techniques using Mythic C2 and RoadTools! In this session, we dive into the intricacies of extracting Microsoft session cookies from a compromised Windows machine

Get 5% off MacroPack Pro and ShellcodePack using code FLANG24. Visit https://www.balliskit.com/ for your evasion needs! Demo videos can be found at https://vimeo.com/balliskit

Get 50% OFF your first month with code Flangvik50OFF at AzireVPN, a no-BS, privacy and transparency-first VPN. Sign up at https://manager.azirevpn.com/auth/register

If you are planning on purchasing one of the great courses by Zero Point Security, please consider using my affiliate code 1e3cfb, or use this link
https://training.zeropointsecurity.co.uk/?ref=1e3cfb

Join the Flangvik Discord! :)
https://discord.gg/r927C6GBBV

Follow me on Twitter:
https://twitter.com/Flangvik​

0:00 - Start of stream
0:34 - Introduction to session hijacking scenarios
1:52 - Sponsor segment
3:39 - Getting started and primary refresh tokens (PRTs)
7:51 - Discussing device authentication methods
10:12 - Generating PRT cookie with Road tools
14:22 - Importance of changing client ID and resource
19:54 - Importance of correct argument usage
22:07 - Using Road TX for interactive access
24:42 - Troubleshooting login issues
28:11 - Authenticating as the user again
30:50 - Using white chocolate for cookie extraction
35:06 - Discussing issues with Go programming
39:01 - Using proxy chains for connections
44:42 - Connecting over proxy chains
46:20 - Issues with Go applications and proxy
54:06 - Debugging connection issues live
1:00:00 - Checking connection reset issues
1:02:06 - Debugging connection issues continues
1:04:34 - Extracting cookies for authentication
1:06:34 - Automating browser interactions with Python
1:09:44 - New file browser features explained
1:11:32 - Upcoming stream topics and ideas
1:15:52 - Thanking viewers and closing remarks