her here a second year here on out I grow up I so here year after all he's
ever seen it may sound speakers service usually years here so there they have
their threat to use her research shape and release several schools at my life
with penetration tester much easier
great work and higher power higher
I switched over at the park which one to hit chart yeah you want your slides up
yeah helpful we go off that spawned you talk to this up so like like yet he
mentioned before the the talk with me on repurposing adversarial tradecraft and
and as you said before I've been here before last year actually not giving a
talk and i'm really happy i want to thank Mark first but just by let me come
back and give me this opportunity to come back and see all the guys and and
friends especially in augusta community so it's really nice
we'll take it off I do not have a clicker so hopefully by clicking there
will be good so little bit of introduction overview over the talk
ah Who am I where I come from that's my background you know what are we going to
talk about one of these ttp things and that eventually get into the adversaries
are actually going to cover and go over so in this case I will just take it off
by just a little introduction of myself as he said my name is ridiculously long
Alexander room deco Harvey my parents absolutely hated me so they gave me that
name
I was just recently at last day of their script is actually friday i was a pen
tester red team with them on a TD team and there's actually some guys here but
i'll be making a huge move over onto the sony side to help them help them push
for their red team capability on there soon as global threat emulation team so
I'm really excited as you mentioned before previous soldier
so for all those that are serving still really thank you and let's get started
so some some background the development of this is obviously extremely tool
centric talk just as title states it's it's based on taking adversarial TTP's
and somehow immolating them in our red team tradecraft so in this case
where I came from a heavy background in Python a lot of these tools are actually
a very low level so they're gonna be written in c++ and that's low enough
level for me it's I learn C++ about six months ago so hopefully the tools are
solid they all run they all work but there's definitely room for improvement
someone wants to contribute push some some changes and stuff like that help me
clean up code to be highly appreciated and second I was obviously with a team a
TD and a couple buddies of mine and they're all listed on there but they
they went through through hell trying to help me and get this this setup because
there's a lot of complicated stuff in here and a lot of techniques that I had
no idea how to start or even get an entry point into building some these
techniques so what is rat uh it's kind of a tricky name for or sliding for
repurposing adversarial tradecraft and it stems from the traditional view of
what red teaming also and it all stems back to wargaming eventually it's
basically taking your force looking at the enemy's repurposing what they're
doing and eventually advancing your trade craft or art form like a DoD
standpoint you know elevating your capability as a fighting force so as red
teamers we have to do this consistently the enemy or nation state X or whatever
mavattam whatever group is out there of malware authors have a lot more time
dedication and resources then you will have in two weeks to sit on a pen test
or red team and achieve the same amount of coverage as they will
so why is really important when it pushes the community forward and and
most importantly you can educate yourself so that you can educate your
client and also bring the newest attack angle to your tradecraft so little quote
red teamers often differentiate himself from pen testers in that they emulate
adversaries yet how often do we hear them talk about ad actual adversarial
TTP's based off the road threat Intel that quote was for me by the way so
is that illegal to call yourself I don't know but anyway so this is actually
something that's like talked about quite often in the red team spaces that you
know how often do you like as a red team or pentester you have enough time to sit
down dig into like a threat Intel report and actually going to build those
capabilities that probably won't even potentially help you on your test and
that's something that will cover you know and and you have to make that
decision as a tester decided that is worthwhile in pursuing so like i said
before i'd kinda jumped over it
taking time to analyze reports some of us kind of like eight on the threat
Intel side and some say it's like boring or whatnot but it does play it's like
role in developing these TTP's so like the Duke reports and the subject
especially puts out like the technical reports are actually pretty extremely
detailed for what they are and you won't be able to replicate some of this
without it to be honest so the first the first step we're going to cover Dooku
it's probably one of my favorite like now our families they have like tons of
tricks up their sleeve and we're going to cover over some of the stuff that
that they kinda like focus on one of the interesting things is for being such a
like early threat actor in our space like they always say like that the red
teaming pentesting is about five years behind and it's like totally possibly
true like women data collection
these guys were doing like remote registry collection with women before we
were even thinking about using with me pot like offensively so these guys were
on the cutting edge they labeled as an apt for a reason they have the ability
to to you know have those resources to devote to this type of collection
operations something really interesting about them is our network leveraging
something as a red team ER that I found out very early on in the beginning was
that while you have all these capabilities as a pen tester to sit in a
network plug in and just rock their network with responder that's not the
same or is the design engineer true when it comes to trying to do that on a red
team engagement things like inve and stuff like that made it a lot easier
over the years with powershell but trying to do that natively before
powershell you would literally have to roll in a custom complete custom
application so that was complicated and they they do that they use w pad so apt
x
may have owed a 22 da immediately but why use that when the shortest path of
resistance is just the user w pad and not burn their potential day so it's
kind of interesting to see like this type of attacks being played out even
though we're still using the pen testing roll interesting enough tons of driver
management they have the ability start stop and we'll cover that actually
that's one of the things we're recovering and persistence so i'll show
you a quote next on the next slide about persistence but one of things that make
them really unique is that they had the i guess you could say confidence that
they didn't have to worry about in planning on a machine or server because
they knew exactly where they were going to be inside the network and how to stay
there long-term they could just stay in memory and not worry about the reboots
or whether it be a you know the doctor not gonna be sitting on your average
user desktop they're going to be sitting in like a server rack somewhere where
redundancies and play for power and electric all those type of things just
kind of shows you some of their TTP's and that's something that we can
definitely replicate easily in our in our everyday life situation awareness
and we'll cover this little bit later as well that the text running sniffer stuff
like that so they had an idea that they knew that they would potentially could
get caught and they're gonna keep an eye out for some basic situational awareness
checks and of course 80 query eighties they were parsing a dsi and the JC
enumeration to like a human-readable xml format and that's kind of what we're
doing with power view on on like our team as heavy powershell based while the
team was just on was at 80 was very heavy powershell based so it's really
kind of cool to see like adversaries using those same exact techniques and to
think that you're doing the same kind of like simulations them so the first thing
as you can see this is like from the hacking team dumped the guy who
basically said like hey i always use due to sell persistence and it's kind of
true that about like I don't know two years ago staying in memory was the
stuff a lot of exploits like you know you gently drop the disc you would
almost always if you were gonna lay in some type of persistence you do some
type of like window
the million ways to like persist on a Windows environment rather be right
registry keys or whatever so I wanted like take this this type of ttp that
they developed and how can I go ahead and pour it over onto my side that's
like feasible one they did in memory to talk about the location so this dictated
like the survivability of the agent and basically where they want to implant and
third if you're in memory it's a lot easier to avoid hips and things of the
sort that would but like if you're dropping let's say a binary disk or
something of the sort you have a higher rate like risk of getting caught
so all those things kind of combined into a a package of that I knew that I
could possibly go after this the driver for this was I had a few long-term ops
they're like 30 days plus which is really unique in the red teaming side is
usually only have like 30 like three weeks and that's pretty much the longest
journey yet that's maybe with some out brief time too and I knew that like if i
were to do this I would have the capability of maintaining long-term c2
out of a network and so this was actually built and i'm going to show you
guys but this one actually came in like just came in handy so it's kind of cool
to actually see something you built have been used
excuse me so some questions you have to ask yourself
I kind of broke into four different locations of how or four different
segments of how I'd like to analyze the situation one the target location to the
system environment hardware platform and operating system is a target location
i'm talking is it a data center is it only your backups power supply those
type of things is it hardware is it is virtualized or is it a system enclosure
is it in Iraq server all those things we can query with women which turned out to
be extremely useful and then system environment things that you would like
grasshopper head like low the latest boot time like I want obviously persist
on the box it has the lowest or the oldest boot time and then operating
system Windows Windows OS enterprise server stuff like that so I tactics room
a few different angles
I knew how to be a powershell so it's kind of the layout of it and i wanted i
know i need to be able to target specific Oh using a network so in this
case
i use power views get that computer and was able to basically use that as my
starting point to target specific net-like server oh you stuff of that
sort then I could basically tech check to see if the boxes up obtain all the
women objects that I needed for properties and then calculate values do
a standard deviation wait a calculation off and then build statistics to see and
like visually represent like a network segment for me to pick my location so
it's kinda like every other standard powershell script out there has
threading built-in so script blocking all that kind of stuff which makes it
quite usable because obviously creating like I don't know if your network 20,000
computers i wouldn't suggest running this but you could I guess
and as I talked about before that this is just some tips for like finding a
customer you for servers or something of the sort and that came out to be really
helpful this bottom one with the ldap query so that was helping me find like
Windows 2008 servers
so as I mentioned before I had a few different sections that I want to like
go after an attack and i had to build like basically a persistent
survivability rating which is pretty cheesy sounding but I'm i basically had
no I knew I had to have a couple different properties and have waited
because just because you have a low boot time doesn't mean that i want to sit
there live there things that like ten percent would be the women system
enclosure I feel like that's quite important verses you know the window s
class so I took those calculated the huge weight value of them and was able
to build basically a statistic off of each individual computer object and then
I could pass that to a vm check and and they are and they a desktop check and I
could like split apart the network that way so i could say okay maybe I want to
persist on the desktop side versus server side or front of persistent vmas
vs servers so in certain cases this is like completely my version of what I
feels important there's no like rhyme or reason specifically for those numbers
except for I felt like those were the values that they should be designed so
as I talked about before
just some basic calculations cackling the standard deviation calculate the
variance the reason why use the standard deviation is it gives me a good idea if
you know like the house standard deviation goes you basically have an
average like baseline in your network so all these computers that are like let's
say a 500 restart like everyday and that would be like a certain rating and I can
basically pipe that in to calculate the variance and then find myself locations
in the network which have higher like outside of the standard deviation zones
and those can find me spots were like okay maybe this computer not part of the
GPO policy that restarts every night and I just actually put together a quick
demo just for time sake here so we can go ahead and play that fast
I'm just run through some like the the basic commands
I'm sorry everything excuse me so I basically set it up to like mac Sosa to
have a small domain as you can see it builds all the objects passing through
the pipeline like so you could do like raw data processing with it like off the
pipeline powershell which is really nice and then I basically build those values
and then i calculate the survivability mean so those are like 3.23 there's not
much deviation in these boxes but you could see that they were detectives
windows on you know uh those were detected as the ends and and that sort
of that kind of was really helpful for me in large datasets this becomes
extremely important because querying 500 boxes by hand on a server like in a
server like oh you would be really complicated so this makes really easy to
use easy use of it
ok or not that's not good
whoops
the second thing we talked about network leveraging so like I talked about before
they did use network leveraging for their attacks so why can't we as pen
testers or red teamers I knew that one thing that made Dooku and a lot of these
like advanced pieces of our extremely unique is their modular build they have
the ability to load up modules and then run the specific models in certain
locations
that's why you ever read like somebody's high like some high-level technical
reports they generally ask people are the reach out to communiqué if anybody
has seen other modules in these IOC's please hit me up so I can analyze them
and they definitely have modules for different attack platforms 80 query all
that kind of stuff so it was really unique to it a lot of these war modules
inside a nucleus platform and also the the sniffer portion something that that
I thought was really cool is that they had the ability to do like p capture and
network alteration on the target host which usually requires like a kernel
driver things of this or this will kind of lead us into this this next section
of of network leverage but I'm and and those types of drivers allow you to do
some of the road injections packing manipulations stuff that you generally
can't do I on a Windows operating system without the kernel space execution so
there's two options you have user mode in our case we're actually gonna go over
both i'm going to cover user-mode capture so using winsock to and then
that's completely native 22 completely and c++ no external libraries all
written so that you don't have to worry about like importing the packet dll from
from one gap when pcap and then also kernel mode which obviously gives you
full full full rights over the entire you know network stack and gives you the
ability to do fullback capture the injection part
interface within desk and and some of the network monitoring that you would
like one at sea in a full-feature rat so just like quick cover of how i went
about doing this something new to this once this side is that as I said it's in
c++ so we have to have a deployment method my choice was reflective DLL just
because of the portability of it it makes for easy integration with other
tool sets like cobalt strike just a question does anybody actually use
called strike here
ok so we seem to use that we were using a heavy on our team
it has the ability to do reflective DLL injection so there's your modularity
right there you have the ability to expand a rat without recoding the entire
thing
so in this case we're going to go through certain capture building an IPC
thread talking to that remote process uh and we're talking to that reflective DLL
injected into met in them into the process base so you can't just capture
the output of that you can't just talk to it once it's like you create that
remote friend it's gone it's like shelter injection you basically have no
way of talking to it after that you have to have some type of like IPC
communication with it and then building the pcap receiving the actual data
filtering it and then obviously writing it to disk so the windsock the windsock
process is is a little bit complicated but it's also pretty simple like in the
retrospective thanks finding the documentation for this stuff is quite
complicated though so the cool thing is i put together now all the there's a lot
of bullets here and stuff of that sort
I wouldn't really worry about those too much they're just more or less refined
we want to come back and reference some of these like actions and why did things
you can come back and take a look at you know each step that I went through so
the WCA startup which is the windsock application handle you have to obtain
basically I'm obtaining 2.2 which is supported from windows 95 all the way up
into windows 10 which makes it across platform which is amazing if as a
developer for when you're developing attack like attack platforms and stuff
of that sort
so once you do that it's kinda like you would see in any other application you
create a socket you bind to it
and in this case you only going to grab IP version 4 and above
so you're only going to grab layer 3 of the OSI model and above imagine so
you're not gonna be able to get the ethernet packets and that's a limitation
of a raw socket in windows so it's really important to know you're not
going to get full pcap and you're going to miss some things but for the most
part you're gonna get like all your HTTP and ICMP like kind of stuff anything IP
protocol and then the most important part is the dose I axle which is
actually telling like a call in the colonel telling the WCA application to
turn into promiscuous mode and setting that up and that enables you to actually
receive the IP version 4 packets that's really cool i didn't know about this
before I didn't think it was possible but there's some interesting resources
out there that are all spread out you know text documents are like 1995 and
you could kind of find these things and then eventually receive just like you
would call which is just a blocking function on on obtaining the packet data
so then we talked about creating the the IPC thread i chose to go with named
pipes because I would be using it later on in in the development cycle so in
this case I use like a language agnostic way of going about it so i created pipe
and I can also communicate with those same name pipes in powershell so however
i get to communicate to that thread i can make it happen
it gives you as an operator life choices if if it's something that's built into
your rat if it's something that is also you know compatible with powershell like
there's many ways those tons of ways of going about it so if you're in a
restricted environment it makes for easy work and then finally as i said before
you're not a lot of the functions all the filtering all that stuff is native
in c++ and built by hand with custom structure and some of that sort that way
it's completely naked you don't have to include the libraries of the winpcap
like development package so it makes it really easy for you to go and like take
all this conglomerate of code and and like kind of tweak it for what your what
your i guess like requirements are so in this case is just an example of like all
the
a couple of the structure put together for for building the pcap headers and
all that kind of stuff
oops
so and finally uh how do we deploy this we talked about this before
reflective DLL injection this is like this stuff is really really cool and
Stephen fewer I mean the guys I don't know he's like project yes it's amazing
like they have that type of you know on your name to to say that you built that
type of like attack attack my phone is really cool but so why why reflective
DLL someone you might not know what reflective DLL Tsar it's the ability to
load in memory a deal out so traditional you have to load these things off a
disk-like you can't just generally load like a PE there's no call in the windows
api like API sector might just a load a dll from memory like it just doesn't
work that way and see if they basically built over a reflective loader so that
gives you a really big selfie advantage that allows you to load the library's
without registering to the the pet the process and environmental block and also
allows you to hide from like it
enumeration of the process itself that and it won't yield in the process
modules that kinda gives you in memory stealthy and it allows you to deploy it
with ease because you can you don't have to worry about writing this deal out of
disk so you you just protecting yourself from potentially hips and all these
other different antivirus solutions and also allows for that module design that
we talked about before dll patching all those kind of things are in tons of
projects
medical uses it and there's tons of projects i use this but that there's the
kind of the basics of how it works you basically attain a byte array shoving
the memory you read write execute the memory first obviously shoving the code
for the dll obtain the offset for the dll export create remote thread in the
process this kind of probably reminds you if you've done shelter injection
kinda reminds you of something of that sort and then from that point on you
basically reflectively load functions that are needed for the front the the
threat itself so finding kernel32.dll so that they can call those functions for
the low library and then finally you can execute dl may
and here is actually a quick demo of the of it actually taking place and I think
this time I'm going to
just going to do that so I don't have to deal with that again so it with the
reflective DLL package that you build and all that comes with injector exe
which is awesome
so you can basically inject right into itself it's for a quick testing in this
case I basically just ran the project started up the pcap started and built
debug . p pcap at the top powershell is actually talking with that reflective
DLL and starting the packet capture at this point I'm basically just capturing
some network traffic you can kind of see it grow or it's like 17 kilobytes this
point i send a command to reset so now we're back down to zero and you
basically can do all these types of different like post I guess I like you
want just want to throw this dll up and then not being able to stop it like you
could just have a boxes crash itself by running pcap for the entire life of the
box being up so that would be a problem like i said that's that's why you have
to have some type of of thing like this so then right when you're done whatever
tools that you want to use maybe you like you write a custom encoder to drive
drop this to like am across the encrypted store in that store could be
later on decrypted which is what these which Dooku did with virtual file
systems and boom you have full pcap just like you would you would see with with
with like a with wireshark the one thing you're missing if you notice is the
check sums for the ethernet headers do not match up and that is the only
function that I did not get right with crc32 bees requires a secondary function
i just haven't gotten to it but someone to help with that be amazing and that is
how you do the win
pcap
and this is this is really cool
this all led to basically driver loading at the end of the day one of the main
things that I wanted to do was being able to deploy winpcap and have that
ability it in a red team environment to deploy a package that can be all
self-contained and actually execute this code so that leading into kind of like
what I want to be going about this well one critical design like we were talking
about before Dooku has a ton of platform like capabilities right so they need
that these helper capabilities of loading drivers like traditional sign
drivers of course you can't get in the kernel mode without having like a sign
driver if you didn't know that so I mean there's still like legitimate
functionality but there's different ways of going about it like we're going to
cover both there's like a service creation working we can use SC to create
a driver or you already engaged NT load driver get in the kernel space so we're
going to cover both those and soft somehow like how this capability can
kinda integrate into your red team testing methodology and and finally one
side drivers this is something like not a lot of people are talking about but
actually just popped up and products are and and and they they actually use a
vulnerable driver to get code execution in kernel space and then was able to
move there on sign npf driver with the modification driver for wimpy cap into
into the kernel space and get code execution that way that's really cool it
it shows you that just because you have the latest patches whatever maybe if
they get system and they can drop vulnerable kernel module which getting
system is not hard any privilege escalation will get you there and it
happens quite often you basically getting a kernel mode without without
too much too much of an issue because those those code-signing starts are good
for that
that driver and there's nothing you can do about that . currently with the
remote but like how already could revoke the whole driver but then you would
break tons of like back compatibility
so like I like to start with every other arm capability kind of built like why
would I want to do this and I think one it's really cool to have full pack
capture and the ability to potentially build like a double pad like attack
platform with reflective DLL and two because you know building like direct
replication is pretty cool and so that's kind of why the two methods that we
talked about for a sec driver loading that's using a service control manager
to basically start and stop the kernel driver and basically you go through a
small little set of events that to make this happen
it's not it's not complicated easy to implement its dirty though it leaves
behind a lot of artifacts
it's a service creation its registry edits it's everything that happens from
the time of loading and also requires like requires you to basically drop your
your path known to to the service controller so like a summer to look at
and see like you know evil driver assistance or whatever they're going to
know that it's basically loaded and then finally the NT load load driver which is
an undocumented windows functionality which actually is being used by SE
driver loading to in to load that driver from user space into kernel memory and
this allows for the full and deaths like application that we've been talking
about with winpcap so how do we go about building SE driver the building SE
driver version first
the first thing I had to do was obviously I had to come up with a way to
weaponizing it we talked about reflective DLL so I just kept this to
the entire talk weaponize it wrapped into collective dll it basically decodes
a large base64 char array and drops the required files the disc opens SE manager
creates the service deletes the service starts the application is required for
whatever p kapoor user-mode application you're going to run and then cleans up
after itself so just like a little background knowledge on when winpcap
what's actually happening there's quite a bit of layers of abstraction of taking
place to get you into that point where you're actually
going to be interacting with the colonel as you like i said the packets are
coming in house extracting it through sdio interface between the nic driver
then the nds interface itself which is like the networking portion of this of
the stack basically talks with nds protocol drivers which interfaces with
the upper edge of kernel space which is the NPF driver and then from there you
have to require to have two different DLLs that are in on disk in the system32
path which our packaging LOL and WP cap dll package deal elbows all your driver
communications and then WP cap abstract all those with api calls for easy
application code execution something interesting is it's quite complicated as
in every single less has a different type of dll and different type of driver
depending on architecture so if you actually going to strap the MSI package
that does the installer you could tell us five different deals for packet WP
cap has 23 different drivers so i have only tested on x86 710 and 64 so those
are the required ones just for the matrix of someone to fill in the rest
and go to the testing that be great there's probably a lot of operating
systems that need to be tested and and figuring out which ones are drop as for
the service creation as i said before not all of its relevant particular to
you but if you ever want to go right replicate this is the kind of stuff you
need you need to be able to open SE manager at all access giving full
privileges to st manager you need to basically create a service you need to
have set as a service kernel driver and then you basically need to have it on
start demand which is manual start you can basically set it up to start the
service control the service so you're basically setting a stop signal and then
finally deleting the service and this is actually the demo
so first thing i do check friend PFF PFF driver not loaded yet we're gonna
actually go ahead and I built these three applications that basically do i
get interface listing using the winpcap libraries all compiled all set up for
use if you want the visual studio packages or they're all they're easy to
use and easy to deploy so I'm basically gonna set it up as ms Colonel service
i'm going to go ahead and inject that and that deep reflective DLL and and try
to get those those three that driver setup and the to deal with drop the disk
so once I know I'm good for the debug messages which you can just remove if
you wanted to obviously probably leave them in there i'm going to go ahead and
do a driver query to make sure that it's actually been loaded and at the correct
name so even though its network packard filtering driver i basically you can set
the service query as a different name so it sets the register Keys as though so
it kind of gives you a little bit of a little bit of ease their setting those
up which is kinda nice you can just name whatever you want to that way if
someone's actually doing driver monitoring they would see that's that at
this point I'm basically going to get the interface once i have the interface
do it for that i'm going to send it to the packet dump which is just actually a
built-in example package you can get with the wimpy cap driver collection and
send it the the device and actually collect right from the box
and that's from going from no driver to obviously fullback capture which is I
think it's pretty cool
and finally the NT driver driver loading with the reflective DLL as well so this
one little bit different
you're actually calling undocumented functionality this one took quite a bit
to get right and there's just not a lot of resources out there obviously is on
documents not supposed to be used this way these are functions that are being
called on the backend that you generally as a like operating with the win32
subsystem would not be able to call so the first thing I had to do was
basically enabled privileges if anybody's ever looked like malware the
first thing it probably does is sets up like every privilege can possibly
imagine just runs those like SED but privilege is probably the first one just
so you can do process injection all that kind of stuff so i basically need SE
driving privileges i need to go ahead and write the register Keys that we
talked about uh actually find NTD ll get the handle to it run the command and
then finally unload the driver with the same exact the function so this is kind
of like a step-by-step the code is is not too complicated but the first thing
you're gonna do is enable this privilege like to talk about you
obviously you're doing it locally to the Rope a process that you're in so you
just open handle your process you are obtained the the the process token you
adjust the token privilege and then you send it the privileged that you want to
the two to load up so once you obtain that and you're good to go you have the
right like admin rights on the boxes are on high context obviously you create the
registry keys that you're required for the services the system path system type
uh service start an error control which are just D word values and a been path
basically that you would pass to a service creation but the service
creation manager and then you actually go down to the next step which is
loading the driver the first thing you have to do is you can just include
the NGF well i think some there's like one example out that does it like none
of these the other examples on the internet right now compile like you
can't find an example that compiles with actually doing this function so when I
found out is you have to actually get the module handle four NT dll then you
have to get the process the proc address which are pointers to NT on load and
unload on load and the unicode string then you pass the the subject that you
just created to the unicode function which then gives you a pointer to at ra
of your your actual you're like your string path and then you can pass at the
NT load driver which and loads the driver and returns an NT status of 0 if
if complete and if it doesn't it passes some numbers that i have no idea what
they do
probably will never figured out it so as talked about before there's some of the
code i'm going to be loading it as evil driver just so just so you can have an
idea of the registry key and creating i'm gonna go ahead and use the same
exact method that what we used before which is the service creation to sorry
the inject dll weapon organization
once the the driver is loaded as you can see basically I'm just gonna do a quick
driver query to make sure the driver actually made it into in into the kernel
mode i'm just going to quickly search for just $MONEY just to prove that
actually worked
nothing too fancy happening here and then obviously once you have this all
set up you can go about the same exact way as you would be for with with
anything else so that you could do on the pcap or whatever you need to do this
could be an individual module that does the just the loading of the driver and
then you can reflect the injection our driver that does all the pcap stuff so
that's the NT loader method and that is all going to all this going to open
source if you wanna go check it out use it for whatever you gotta do and it's
already pre Paula pre-built with the reflective DLL project so everything's
almost near weaponization ready and I think we're getting close last 10
minutes
and finally apt 29 so as the last felt the last group we're gonna be looking at
they have a unique basically a unique set of skills that's that's pretty cool
there's been a lot of research on these guys and did they have some crazy stuff
out there if you're very right red like hammer toss and some of the methods that
they use the juicy to is just crazy will use anything anything everything which
make them really hard to hunt down so what makes them kind of special one with
me if you've ever wanted anything about them they utilize will be heavy and as
somebody that's been getting deeper and deeper into the internals I want to like
replicate some of that ability with c++ which like you probably think it's
pretty daunting and it absolutely is like something in powershell it's
extremely as you get when the object in the rock and rolling and and with with
with that in mind they use a lot of PowerShell so it makes sense for them to
use a lot of women it's easy to integrate you shall the script I felt
before
yes it's big lot of propaganda objects but it's easy to use like the return
types are easy to pass properties pipeline that makes like life so easy
and then finally the most give me that the nones about them they had had people
talk about it before Mandaeans talk on on like basically hunting these guys
down is insane if you have a watch it's like from shmoocon got to see it live is
really cool and then obviously mad greater has in some of his buddies have
talked on uh why am I so sexy so that definitely good talks if you haven't
looked at him like kind of like deep-sea diving into me operations himself and
then persistence not agent persistence not like where I'm going to store but
these guys are well equipped and they're producing samples by the day like if you
really listen to talk it's inspiring like these guys are generating 10
samples like a week pretty much and one of them is completely different than the
rest of them so as you can imagine the re efforts that like figure these guys
out figure out where they are and like get rid of these guys are network is
insane and then finally agent development which is something i'm going
to move into necks in something that they do well multiply Oh Sees make it
really hard to hunt them down and it makes them big be able to persist in our
long-term if you're only read as a couple strike and that's all you have
developed once burn burn it's done but if you're using like backup agents just
like you would think c2 structure if you're going to build c2 structure for
your command control you're gonna have a initial fishing access server a
operational server and then a long-term or a long-haul server for your backup
they do the same thing with their mouth where so i wanted to build like a
long-term agent it's it's it's really POC at the moment but it has a lot of
really cool stuff in it that think that people would love to see and have
examples on some stuff out there like there's some code out there but I have
it all one good place for anybody want to take a look at it
basically the entire nation itself is built the shelves built its in Pierce
c++ in-memory logging obfuscation of all the strings standard calls for anything
you'd like one to see an agent like sleeping jitter all those basic stuff vm
detection AV detection some using women some using the standard API calls and
process listings shell commands the whole shebang everything you'd want in
the standard agent and then since it's a long-term agent the only thing I really
needed was some method of getting secondary code access or code execution
so I built in $YEAR full show called objection and process injection with the
token manipulation stuff so if you actually want to go look at this code
and have like you know like see actual running code it's all there is a lot of
stuff like you can get a peek into it like hacking team dump and stuff they
have some dumps out there someone would be complicated
a lot of the comments are all in like you know French or wherever like you
know there's tons different languages like are operating on that that code
base and eventually the coolest part will be monitoring which is something
that the defensive the defensive side is using heavy service creation process
creation and driver loading so why should I care about those type of things
if you're a Hyundai our guy like that's like bread and butter right now the
ability to go and detect these kind of things are are priceless
you know things like uproot which is but built by Jared action
I got caught on an OP like a training up with that and
with my pants down so it sucks when you get caught by these type of things but
it makes you like think as like an attacker what can i do this like to
detect them doing this back to me
um so think about how you can capture memories from compromise compromise
machine that you as I can I our guy we're gonna bring over USB stick with
memorize on the mandiant your plug this thing in your gonna get a kernel mode
dumped onto the USB stick and you're gonna take it back but when you plug
that in you have you have some risk that you're obtaining like your plug in USB
Drive in your potential you have to load lower kernel module or kernel driver
into kernel space to get that kernel memory dump so I as an operator of these
things you need to think of and all those kind of things lead into like
service creation like silence if you read the OPM reports they got if they
were to detect the service creation of silence being created or installed on
the system's maybe this maybe the hackers and OPM would not have gotten
caught just thought like you know because they got caught
according to port by kishore clogging and eventually like driver creation of
us have things that you want to see so I don't have much time so I'm going to
pound through this basically the core agent has three different threads that
do all the collection pushes them into a a monitoring thread which it has a JSON
array of vector a vector of JSON array rules better then basically have like
agent panic modes that are set so here is actually a rule creation taking place
on the side left side you have an actual json rule like detecting let's say
wireshark the exe or the executable path has wireshark in it and then it has
panic settings for sleep
exit the agent true and report the trigger obviously you can call fire
shotwire truck you'd probably want to stop all I communications so I had false
so all those people like granular as things you can set up and then you
eventually have a rule trigger handler which and handles like zeroing out the
agent cleaning your heap and doing things like that so that if you get
caught and you do have they don't know how like one thing that has memory like
analyst you want to know how far they got right so if they have my memory
logging outlet and they can detect it
well they might just know everything I got a I did but if i can get rid of that
first and they got my agent not too big of a deal
and then finally here's a here's actually process creation event taking
place on the command line a service creation event as you can see like this
is the pathname of creating a windows system32 cmd.exe service that would
spawn a response service at a given time and then finally I'll rule triggered
which actually is inside the agent so I'm just gonna do a quick demo on this I
think I have enough time
I'm really close but I think it's about a minute or two so i have a POC handler
anybody knows anything about the Empire side i'll actually be trying to
integrate this with Empire eventually or they laid universal controller be coming
out soon and this will give me the ability to actually like use this on a
usability scale-like out like right now it has all the core agents bill
everything's there as you can see actually just received a command to do
around a shell command which was a dirt and other side it's just receiving
output so anything like you would see on a normal like agent handler you have
that ability it's all there for you using the cryptic logical api's that are
built into windows all the encryption base64 it's all built there it just
needs the the core orchestrator handler now mom right there you just kind of
cologne example of the of process monitoring taking place inside the agent
itself and it's just kind of setup to print the screen right now just 44 you
know aesthetics so you can see the tasks that you see prop execute and then also
with the command line arguments the process named the event type where it
came from the path all that kind of stuff so you got really granular
activity
here's a service creation we talked about before it's on it's an event
filter set for like every second so basically i can receive all that stuff
for service creation all the all the fancy stuff and this allows me to do
that type of post-processing of the actual I are functions taking place on
the box and respond accordingly it gives the asian itself it gives it leverage
the to the operator that they could not do situational awareness and give it
like at twelve o'clock at night so things that like you would generally do
your safety checks when you get on a box you might not be able to do at twelve
o'clock at night or it you that might be sleeping for a day at a time that aging
that agent has to have
one type of capability in the back end to survive and this is kind of what I
built so in that case it monitored a wire truck being and triggered an
execution and basically exit the agent and that is the women monitoring agent
and finally the last slides key takeaways all the techniques talk about
our kind of like they're used in you know they've been talking about their
documented somewhere well document some of them are not hopefully the mass
amount of c++ and power show could have put together helps somebody all the
written visual studio 2015 on Windows 10 updated image in all compile perfectly
that's like I don't think like if you were to go looking for some of this
stuff getting something that will pile is literally the hardest thing you can
imagine like it's insane like unless you're looking at some forms from like
the nineties that's about it
some key takeaways obviously the techniques and the TTP's are awesome
really awesome to kind of integrate kind of show off you know something like the
team's palace and all that kind of stuff so i think i think overall it was a
great experience I got to learn a lot about coding got to learn a lot on a
low-level operational level that stuff that as an operator you can debug issues
even if you have like a paid tool set and finally all the codes are going to
be open source and they can be found on my github a q-switched a QE what this
basically just a list of someone wants to take a look at them later
any questions no questions
okay thank you
yeah