Acknowledgments & References

Acknowledgments

I would like to personally thanks to the following people for helping/supporting the development of Kraken in different ways:

• Kurosh Dabag Escalante (aka kudaes)
• Pablo Martinez (aka xassiz)
• Elephant Se4l
• Daniel López Jiménez (aka attl4s)
• Jarilaos Arias Vidaurre (aka jari)
• Balhissay
• Alex Barreiros
• Luis Vacas (aka Cybervaca)
• Anton Ortigueira (aka antuache)
• Marc Hortelano
• Vicenç Asensio (aka etnum)

On the other hand, I would like to highlight some of the projects I have been inspired by and which I consider very important:

• https://github.com/blackarrowsec/redteam-research/tree/master/Hanshell
• https://github.com/epinna/weevely3
• https://github.com/antonioCoco/SharPyShell
• https://github.com/L-codes/Neo-reGeorg

References

The development of the modules, agents and other functionalities has been possible thanks to the consultation of reference sources such as the following (I may be missing some references):

• https://www.liquid-technologies.com/online-json-to-schema-converter
• https://github.com/tennc/webshell/blob/master/aspx/asp.net-backdoors/fileupload.aspx
• https://staaldraad.github.io/2017/12/20/netstat-without-netstat/
• https://stackoverflow.com/questions/5281341/get-local-network-interface-addresses-using-only-proc
• https://www.php.net/manual/es/function.fread.php
• https://unix.stackexchange.com/questions/345539/how-can-i-list-net-work-devices-and-ipv4-address-on-linux-without-ifconfig-ip-co
• https://stackoverflow.com/questions/5281341/get-local-network-interface-addresses-using-only-proc
• https://csharp.hotexamples.com/es/examples/System.Security.Principal/NTAccount/Translate/php-ntaccount-translate-method-examples.html
• https://stackoverflow.com/questions/394816/how-to-get-parent-process-in-net-in-managed-way
• https://stackoverflow.com/questions/9198184/setting-file-creation-timestamp-in-java
• https://stackoverflow.com/questions/3875801/convert-jiffies-to-seconds
• https://www.php.net/manual/en/function.time.php#108581
• https://www.adamsmith.haus/python/answers/how-to-generate-an-md5-hash-for-large-files-in-python
• https://social.msdn.microsoft.com/Forums/vstudio/en-US/f81bea37-26f5-44d8-bac4-bc534bbb03b4/c-how-to-check-file-folder-if-writable?forum=netfxbcl
• https://stackoverflow.com/questions/321370/how-can-i-convert-a-hex-string-to-a-byte-array
• https://stackoverflow.com/questions/311165/how-do-you-convert-a-byte-array-to-a-hexadecimal-string-and-vice-versa
• https://www.oracle.com/java/technologies/javase/jdk8-naming.html
• https://www.c-sharpcorner.com/article/csharp-convert-bytes-to-kb-mb-gb/
• https://stackoverflow.com/questions/7445182/find-out-file-owner-creator-in-c-sharp
• https://stackoverflow.com/questions/834303/startswith-and-endswith-functions-in-php
• https://stackoverflow.com/questions/11837541/check-if-a-port-is-open
• https://www.pinvoke.net/default.aspx/Constants/SECURITY_MANDATORY.html
• http://cstruter.com/blog/270
• https://stackoverflow.com/questions/59370897/redirect-standard-output-of-createprocesswithtokenw-in-c-sharp
• https://stackoverflow.com/questions/15480062/python-argparse-remainder-is-not-clear
• https://github.com/blackarrowsec/redteam-research/tree/master/Hanshell
• https://www.pinvoke.net/default.aspx/shell32.commandlinetoargvw
• https://posts.specterops.io/understanding-and-defending-against-access-token-theft-finding-alternatives-to-winlogon-exe-80696c8a73b
• https://github.com/slyd0g/PrimaryTokenTheft
• https://learn.microsoft.com/en-us/windows/win32/secauthz/privilege-constants
• https://stackoverflow.com/questions/5194057/better-way-to-convert-file-sizes-in-python
• https://www.codejava.net/java-se/java-se-versions-history
• https://learn.microsoft.com/es-es/dotnet/framework/migration-guide/versions-and-dependencies
• https://stackoverflow.com/questions/1570422/convert-string-to-securestring
• https://stackoverflow.com/questions/664432/how-do-i-programmatically-change-file-permissions
• https://0x00-0x00.github.io/research/2018/10/21/Windows-API-And-Impersonation-Part-2.html
• https://www.dotnetperls.com/decompress
• https://stackoverflow.com/questions/4700897/wmi-security-center-productstate-clarification
• https://payatu.com/blog/amsi-bypass/