yeah yeah all right cool well thank you
so much and thank you especially cyber
cotton too it's a my privilege to be
back here and definitely more of a
technical talk last time last year I
just yelled at everyone for 20 minutes
so but you know this is me definitely
more technical so monitor vision
techniques what this talk is all about
is basically just work arounds work
around that we find our industry and
what works against different different
technological components and what
doesn't so first of all as a as a pen
tester we we stand on the shoulders of
giants when it comes to tools right we
don't write all of our own tools I use
tools like you know Callie and and
metasploit an empire and those are
written by some very very very smart
people and right there jerrison 12 and
celeb trades 60 and the rest of dads
owner there those are people that I go
to my friends my co-workers and when
oftentimes what you're going to hear me
present is not necessarily just my ideas
but their ideas as well so I would be
stupid and mean not to actually you know
throw shot us to them so thank you guys
so top Ock's first things that were
going to cover in fact these are this
exactly we're going to see in fact if
you're in the very back you might want
to come up front because I'm going to be
presenting a couple demos that involve
visual studio and ID in cali so if you
can't see you might want to just take a
second come on up here so we're going to
talk about inline control workarounds
and why in line controls i'm talking
like Palo Alto quarter net next-gen
email controls proof point stuff like
that antivirus evasion and then some
pelo customization at the very end so
I'm gonna have to fly through this so I
I probably will not have time for
questions at the end of this talk but
I'm definitely gonna be around tonight
so if you have questions just by only to
come by me so just look at about me I've
been doing infosec for 10 years both in
all offensive and defensive roles I'm
currently a senior penetration tester
with center com which is based out of
Brookfield Wisconsin and such Caesar
Active Directory development Python
PowerShell things like that so all right
before we go any further just a couple
things so first of all this talk is not
going to hit the internet publicly and
the reason being is because I talk about
vendors good vendors span vendors yeah
I'm actually gonna drop some names
how it goes so the talk is not going to
eat internet I'm not going to lose the
slides either if you have the show say
intestinal fortitude I have the slides
available on this USB key you may come
get them after the talk if you so desire
by the way I don't know anything about
infecting USB keys but seriously though
just click enable content once you open
those slides you can keep using so and
it's far as a mini rant there's a train
in infosec right now especially amongst
red teamers in fact actually before even
going for the red team in the audience
real ready Murr like like 10 of you
cheese Louise blue team defenders okay
all right Georgie blue team okay vendors
all right exits in the back vendors go
that way bring us all back a bunch of
beer all right vendor just get out but
the rant that I have is that there's a
train in infosec right now that goes
something like this if you're a red team
and you release like an awesome tool or
a technique or something like that a
bunch of other people just like jump you
on Twitter and say where's the
mitigations who's the mitigations you
can't wait to without a mitigation and
I'm here to tell you that I have a talk
and I've workarounds and I have evasions
and I have no mitigation for i'm not
going to release anything like that
that's not my job so in fact my job is
to read to me i'm going to divide the
room and a half right now my job is red
camera is to break stuff your job is
blue tumors fixed up okay i will tell
you about the attack and then you can
take that knowledge about the attack and
then take it to your place wherever you
work and put in the fix however you see
said okay but don't expect me to drop a
bunch of your rules the end of the talks
you can just drag and drop under your
you know awesome solution back or work
and block on my hard work because i'm
not going to do that so you're the blue
team's with lou harder alright inline
control inline control first of all what
is in my control you know inline control
is a network layer control that performs
a real time to Rep reventon okay so in
this case i'm basically going to hone in
on two solutions that i think actually
do a pretty good job they are palo alto
unfortunate alright whatever you think
in terms of vendors this is my
experience as a pen tester you might
have completely different experience and
you might not use either these and you
think that you're you know firewall is
the shizz and it does a fantastic job
that's awesome okay
this is my experience working with these
two they actually do a pretty good job
when it comes to threat prevention ok so
my the testing that I did and and what
will get into actual test cases and
stuff like that but the testing that I
did was performed with the fully
licensed up-to-date Palo Alto so
everything every check box that I could
check I checked and what I ended up
doing was taking standard payloads from
meterpreter and Empire and puffy and
custom interpreter and I ran them
through my Palo Alto so the focus of
this kind of test is not to determine
its antivirus effective or not that's
not this about this is to determine how
effective was the inline control and do
i need to work around anything on the
inline control ok so meterpreter I
apologize we can't seem back if you
can't see so let me know meterpreter is
standard windows 64-bit interpret
reverse https sometime use all the time
its pen testers default certificate port
443 and xor encoding Empire if you're
not familiar with Empire that is
basically a it's a python-based server
with a full power shell it all of the
modules and and all the agents run on
PowerShell exclusively and it's meant in
a windows environment ok as far as puppy
goes if you've never heard of puppy hmm
oh it's evil puppy is outstanding
probably uses the OB fs3 transport was
the transport use for the Tor network so
it's basically obfuscate et CP which
means that most inline controls don't
know what to do with it they're like no
I don't know what this means so there
you go I'll need to center right through
ok so a public fantastic and it's open
source so this being open source rat ok
and I use the defaults airport over 3 as
well custom interpreter is C short code
that i pilfered from stack exchange and
then hacked to do what i wanted to do
and then my victim machines windows 10
and 17 both 64 bit windows defender was
running on although i didn't know at the
time and then just an idea about the
palo alto configuration if anybody how
many guys are familiar parallel toes
anyone alright gradually quite a few of
you that's great ok so URL filtering i
had almost all the categories now if the
pen says around the city care about your
revolting because i can just go out the
powers website and request that the
category for my malicious domain gets
changed to sports
health is like oh yeah yeah it sports
that's fine bone protection I turn on
all the things and in fact this stuff
over here these are all the additional
vulnerability protection filters
mechanisms rules not sure there are
terminologies that you can enable but as
you can see I needle a ton of them
Empire metasploit meterpreter I enabled
a bunch of stuff in fact I think I turn
on an additional 50 filters to try and
monitor for my malicious traffic and
then final blocking I blocked all the
files turn on antivirus anti-spyware and
wildfires well and the last but not
least and this is really the big hitter
SSL decryption if you're not using SSL
decryption your environment see me after
class let's talk about the results
meterpreter this is like I said standard
stock meterpreter this was actually this
got caught with SSL decryption so you
can see over on this top that is the
actual Palo Alto a message that came
back and it identified correctly as as
interpreter and so with that episode the
crip shun my reverse https alfond
connection was halted and then a new and
then the traffic was inspected and then
a new connection was established by the
Palo Alto so so deep packet inspection
was taking place on that attack and
that's how it identified it as
meterpreter and really interesting
behavior so if your pen tester this this
is interesting and I had never expected
where I'd experienced this on a test but
I finally was able to duplicate it
reliably in my lab environment this
behavior happened right here I would get
a shell and then 10 seconds clear the
show would die and then the show would
come back and 10 things later shell with
that and and this is what was happening
when that pack so the the traffic was
going through the Palo Alto paula was
inspecting and then actually determining
oh your malicious and then killing the
connection but after the connection was
established there was like five to 10
second window where I had a shell and I
don't you might actually like auto run
scripts um something malicious during
that time I did not try that but can
tell across well now without SSL
decryption and this is blooming weight
without a cell decryption it just it's
still right there
stock meterpreter just flew right past
the Palo Alto and in fact this was
actually before I remembered that I had
windows defender on and and i was i was
doing doing this testing and I'm
thinking to myself okay windows defender
should pop up in a second now and it did
and that's when it's the tenor message
that I got sweet so Microsoft and nailed
it on that one Empire Empire is the tool
that generally speaking I prefer to land
with in my fishing campaigns Empire is
is fantastic Empire sales through
everything Palo Alto is like oh now
you're that's a little traffic yeah
you're fine agent agent agent and you do
down here empire powershell payload I
hope specifically selected this in palo
alto to be like hey block this stuff now
now we're not gonna block it and it's
like I had not that I not customized the
frameworks in any way this is just like
straight down one from good up okay and
I just did right there alright that's
cool puppy again blue right there no
problems whatsoever and interesting if
you look at this over here I want to
draw attention this this right here kiss
you where's decrypt unsupported ur this
is what the Palo Alto does when it
doesn't know it doesn't understand what
you're doing it's like oh there's ssl
here but then no but then oh yeah
there's a cell and then no and then you
know it's it's basically just wtfing
it's like yeah yeah alright so my
traffic through no problem he'll open Oh
interestingly enough Windows Defender
caught the puppy payload as when 32 pad
of poopie I don't so anyways I don't I
don't understand I mean those are just
decisions anyways agents for this okay
how do you why do you work around the
Sun well as you can see there wasn't a
serta lot to work around but I'm gonna
give you a couple of tricks that I use
in my testing that makes it a little
more difficult for defenders to actually
catch on on what you're doing first of
all if you're going to land with
meterpreter and you're in your fishing
campaign okay use auxiliary gather and
person SSL and what that does geez you
probably cannot see that in the back
what what that's
is that you put in a website in this
case w google com and it goes out to go
we'll grab the certificate and then
basically it Stan's a new certificate
with Google's information and so you run
your payload using that certificate and
then the the the firewall just like oh
yeah your google in fact I was testing
this on on a Ford Annette actually one
more thing before i get there when you
do this when you run ms that venom set
your stage verify its else are too true
and your handlers to sell certain so set
those two options and that's how you
actually use that certificate when when
you when your pelo connects back but I
was actually doing some testing up in
northern Wisconsin with another firm who
uses fortinet and and I crapped up this
payload and they were they I send it
through and I got a shell back and
they're like okay let us know when you
click and I'm like I clicked like what
did you what happened is like I gotta
show click it again got another shelf
and they're like well all we see is
travis from google like yeah that's me
I'm Google today alright so in line of
asians i have to admit this is probably
the area where where I ended up short on
in terms of what i really really really
wanted to be able to get through
meterpreter stock meterpreter through
SSL decryption I was not able to do it
in the time I had a lot of for preparing
this talk but pay attention to
decryption detection patterns favorite
Empire and puppy over msf if you're
getting infected okay and hope that you
not work on the cisco fire well hope
that you are working the cisco firewall
and the reason why I say that is cheese
I'm sorry but if your cisco cisco shop
they do not do threat prevention or
maybe they do threat prevention and no
one buys that solution but when when I
test chops that I have a cisco firewall
everything just flows right through it
flies right through so if there is to
prevention on a cisco i would love to
hear about it so that way i can tell my
customers actually used to be buying
this firewall instead of you know the
a-si 5500 because that just it's just
not doing it
so anyways yeah whenever I whenever my
custard so yeah yeah we get the latest
gray cisco firewall some like me sweet
but anyways it's just this goes great
just at the kitty where is this going
the room you guys are awesome okay
controls define anything that stops my
fish from getting the inbox and that's
really what I care about most now for
this particular talks I'm not going to
go into like all the various spam
filters I'm i pretty much only care
about next-gen spam filters okay like
proof point mimecast Google's Panthro
there's Google sample there's that
actually pretty decent in certain cases
there in certain circumstances they just
Bay they feel hurt so a little bit of a
story in terms of how this portion of
talk you in carob I was sending I was an
apprentice is sending a fish to a
customer and in fact here's the phishing
email so shooting there's no names in
there sir quite good I'll give you
second to read codes often in fact i
have my friend and co-worker casey
camilleri in the front row here he's a
guy who put this email together and this
is my go to this email works ten times
out of ten it is fantastic you send this
thing to reach before christmas oh my
gosh people's heads explode it's
fantastic because and the reason being
everyone everyone hates HR right
everyone hates teacher all this email
does is confirm all the reasons why
everyone hates HR and so i had to tag it
with we apologize for any inconvenience
this may have caused to babysit time I
just rub it in right and and people just
click click this it's like gangbusters a
fantastic so I i sent this with the
attachment and you might recognize the
formatting amusing office 365 another
technique another tool there I so I sent
its with the attachment and it got back
I got a message back just said oh this
is a virus ok so I take the cash run out
i'll put a link in and i say and i hope
the files exactly follow on my tax sir
when i put a lincoln and I'm like please
download the attachment here ok so I
send that off I do not get back a bounce
saying that there's a virus but I get
back with in about 60 seconds I got 10
to 15 clicks they all kind of look like
this I just click click
click click I'm like what is going on
like they're not they're not that dumb I
mean they're not they're not all gonna
click like that fast I mean you know a
verizon data breach investigation report
the average time from the time that i
send a fish at the time i get to the
time someone opens an attachment is
about three minutes and 40 seconds that
was rising DVR 2016 I believe so but in
this case I was getting click after
click after click repeatedly but I was
not getting any shells what the heck is
going on so in this case I I did after
about 60 seconds I gotta bounce back
from office 365 and it said your email
has a virus and it was detected by mine
cast oh my oh never heard of it okay be
sure everyone else who I looked at my
customers MX record and here's what you
got bunch of mine cast entries like I
need to know mine can't sit so Delta
mine cast calm and I do some research
and they're very very similar to prove
point which is that you send an email
and there's a link in the email but what
they're gonna do is like dynamic URL
analysis they'll actually go out grab
attachments sandbox it see if it's
malicious and you know they do all that
work on behalf of the user okay so in
this case in fact the only reason why I
knew that is because they put a fancy
little video on their website and so I
just SAT there and watch live video in
fact there's a screenshot of my end user
not getting my email because his inbox
was protected so I was not happy about
that I'm sending a fish I'm putting all
this work into it everyone thinks the
fishing is easy and it's not like hours
and hours to craft a good fishing
campaign anyway home of the story so i
was i was just kind of sitting there in
a WTF loop and I'm like what that go do
now and my co-worker Scott says to me oh
you didn't use apache mod rewrite my
reah it's got to fix all your problems I
was like all right that's great I've
used a pass you've never use mod rewrite
so I went out and did some research on
my rewrite and it is fantastic so in
order to get mod rewrite going what mod
rewrite will do if you've never used it
is it will take an incoming requests and
then based on certain parameters like I
don't know regex or the IP that it's
coming from you can have apache do
certain things with that request like
forwarding so to get that started you
set this in your default icon for your
site's enable okay and this basically a
lot
this is the first step to getting Apache
mod rewrite to work the mod rewrite is
already included by a patch if you just
apt-get install Apache you get my
rewrite quite a fall okay and then next
step is you create an htaccess file dot
HD eight eight dot H TXS file okay in
your Apache directory and oh by the way
I forgot to tell you guys if you see the
picture icon that's probably if you're
going to take a picture that might be
worthwhile taking picture up so in this
particular case I simply created a bunch
of conditions based on the addresses
that have been coming in that I knew was
not my my customers landlink ok it was
not there when I Pete so I create a
bunch of rewrite conditions and then I'm
like oh well if you belong to any one of
these at peace just send that request
over to google com okay so and oh by the
way I shadow to blue screen of Jeff's
previous worker on adaptive subdivision
of various group he was put together a
ton of awesome information on red team
infrastructure so I would HIGHLY highly
recommend you go out to his website and
read every single article because it
will tell you how to use apache for all
sorts of nefarious purposes so I put
this in place and then I send my email
again and this starts happening I get a
bunch of clicks but notice they're all
being 302 all being redirecting
everyone's going out to google and then
I sit back I take a sip of my coffee and
then she'll start coming in and it's
just beautiful all right there's good
work on and everything it's absolutely
works for proof point as well okay and
because you you're controlling the rules
of the game at this point all right you
know other technology works it's going
to go out scan it and analyze that link
but if you can control that request
which you can you can send that request
to wherever you want this case cool
we're great so it speaking of Google
what happens if your target is using
gmail and so in this case I if I want to
send a malicious payload from a gmail
account normally I use office 365 you
know I'm a few weeks and rugged niche in
a little bit but normally that's what I
what I need but in some cases i use
gmail however if i want to upload an
attachment to google that contains i
don't know because it looks like this
I got some power shell naughtiness in
here this is basically just standard
Empire launcher so it looks like just
basically for Empire stuff okay what
happens that gets blocked who says buyer
suteki alright so when I look at Excel
spreadsheet and I upload them to notice
your be calm and they have power shell
in them they all come back who's saying
yes we caught you and you're like win32
PowerShell dash children and that
happens all the time so if you look at
this code and you see the arguments you
see the cookie the command line
parameters how do you get this to happen
how do you get it such that you bypass
Google's virus checking and I can get my
malicious PowerShell based payload in my
excel spreadsheet how do I get that into
a gmail message how many guesses well
just like that there is no joke I tested
this last night to make sure that it
worked before keeping it in here simple
string concatenation this is like the
dumbest most basic most easiest of
bypasses if you can even call it that
and and it works flawlessly with Google
I i have sent fish too many customers
just doing simple string concatenation
like that all right so what happens if
you are sending than someone who's using
google okay so I I had a customer that I
was testing and they were using g sweet
so I believe this if i recall correctly
this is a educational institute and they
had they were using g sweet for their
for all of their their email and google
docs and all that kind of stuff so when
you send an email to them their domain
simply resolve to google and all the the
email was going to gmail well when i
sent my fish and i got no shelves i sent
to the everyone hates h our fish and i
got no shells and and i was frustrated
cuz i'm like i always get shells of this
fish and so I I contacted my customer
and I'm like hey uh just out of
curiosity and you can tell me it's okay
did this get caught by Google Santos and
he's like yes okay alright that's fine
all they need to know and so I did some
investigation I just I
actually talk to kiesha again I'm like
Casey you help me figure this out and
and Kate said oh you forgot this we're
just a standard SPF record and so I
added my standard SPF record to my
naughty domain this is the correct
that's we have record to use for office
365 so on my evil domain evil domain com
I went out and add an SPF record to this
and set my fish again and girl was like
oh you have an SPF record you're good
right a right to michelle's coming ok
simple simple workarounds so as far as
email number one off you skip your
payload it doesn't have to be fancy like
it like it's just a simple string
concatenation generally speaking will
work frequently all right number two
sent your SPF record this is important
so when you go out to godaddy and
register your evil domain now you pay
$13 alright you can control the full dns
so create a txt record that it that uses
the @ symbol for the host so it covers
all entries all-in-one interest to that
and then set your SPF data to what you
just saw ok so yes fifth record number
three use the links instead of
attachments attachments are far more
likely to get caught at least it seems
to be getting that we didn't used to be
that way even like six months ago but
more recently especially when sending
from office 365 the attachments getting
busted links are still sailing through
number four HT Access HTA access is your
friend I will now use it for everything
because it's just glorious when you see
what you see security just get kicked
out that door and you see your client
get kicked in this store and and then
she'll come back it's just it's like a
happy dance moment fantastic all right
check the fish with is not spam calm
it's not spam is really really cool
because I you you send your email to an
email address they'll give you like a
randomized email address to send your
fishing email to and so he sent it to
them and then they will put a report up
in about five minutes online and that
report basically gives you all the spam
indicators that say well this was fine
this was not fine this is fine this was
not fine and your overall ranking I use
this quite frequently it's actually very
handy and last but not least you happen
to get a free month of office 365 with
the godaddy domain purchase
so you know just use that free month and
do what you got to do and then throw it
away for good purposes only right right
authorised they sign the rules of
engagement why all right antivirus so I
did kind of some of the same testing
with antivirus payloads that i did with
inline control so i generated material
right Jerry Empire and I sent them
through know distribute calm I prefer no
distribute because unlike virustotal no
distribute will not distribute your
results to AV vendors ok so if you're
actually testing a payload like
something that you put work into I use
nodus true because they also contain all
the major players so by major players
here's Reming semantics also norton
mcafee trend microsoft security
essentials and also defender those are
the ones that i care about those are the
ones that I've seen enterprise if you
use clamavi if you use to 360 how many
better look at that I you put your hand
down no no you've never heard of it
right no one uses that stuff everyone in
your enterprise uses one of them
generally speaking okay you might you
might be like some you know crazy unix
period admin that's using like some AV
that you download like what most people
use this stuff okay sorry want to like
mini rant most people use this stuff
alright so here's the results of what I
encountered red means it was picked up
by one of those major players green
means even if it was picked up it was
picked up by someone that I had to
google that I never okay so if you look
at mature / the the ex's interpreter I
believe no distribute processes through
35 different engines so just the
standard meterpreter executable that
actually is just that gets picked up by
a half of av vendors that that's how you
read this even when we signed it with a
legitimate code signing cert it was
still picked up by 15 back to a factory
pic 2 by 5 and then Ebola which I'll do
a demo of later
absolutely sail through everything which
is fantastic the yellow field is
interesting because for the Empire deal
who generated it was only picked by one
we did nothing but when we signed it it
got picked up by five I'm a little
nervous about our code signing sir but
okay anyways and then a custom seat up
over here i will also dumb in this as
well that got picked up by very little
to nothing alright so maybe evasion
number one back to our factory back to a
factory is pretty cool because what will
allow you to do is take an existing
executable a legitimate executable say
for example putty or assist internals or
you know a standard standalone
executable and you can backdoor it with
your malicious payload okay it supports
user-supplied show code which is
outstanding just a standard
run-of-the-mill back to our factory
payload creation was only picked up by
five or thirty five which is actually
pretty good okay and then really really
easy to stall on cali just app install
back door factory okay number two
powershell oh powershell AV evasions
they're just beautiful okay when it
comes to powershell scripts how many of
you heard me me me cats most of you okay
so I leave you heard of invoke dash Mimi
cats dot ps1 most of you okay so in this
case Mimi cats a very very popular
attack tool for polling plaintext
credentials out of memory was reported
over to powershell but what you need to
understand about how AV vendors detect
powershell is that if i take invoke name
you can't stand voc Desmond can stop ps1
and I drop it onto a system that is
using semantic up-to-date semantics
semantics will catch it okay it's going
to say this is mini cats and poom you
know alert get sent off and you're
caught okay but what is important to
understand is that a tea vendors are
really just searching for strings so how
do you get around that remove all the
comments this is this is so embarrassing
leeez it's great to remove all the
comments and then change the function
names and parameter rings you don't have
to change any of the workable code in
fact here's do you want to see this is a
script that I run on my powershell files
okay so the first line right here all
right dot k call my dog i'll find all my
god PS 1 files and then i get rid of the
block comments block comments and
powershell begin with less than pound
and they end with boundless not and that
is where the PowerShell authors put all
their comments they put their Twitter
handles and things like that and that is
one huge thing that a be vendors key off
of they also key off of standard
comments in the script okay and then I
for many cats i did just there just a
couple of special things i tweaked mimi
cat so now it is mini cars and I changed
a couple of parameters dumb creds to
give me credits and dumb search to give
me search and so you would simply run it
like this you run it basically just
exactly how you would run in bovania
cats however in this particular case
running it like this just in and I
tested this three weeks ago on a
customer that was using up-to-date
semantics ok all of their clients versus
ate all their a be different interrupts
date this ran flawlessly okay so and
what's nice about this is that these top
two just those top two will find all of
your power shell files and remove all
the comments something really really
handy to run and say Empire core puppy
you know on those power Shelby's
payloads works very very well okay and
then I custom c-sharp number one so in
this case custom t-shirt number one is
going to this is actually code that like
I said I kind of copy pasta from stack
overflow and add it to my own Dalton
muscles to it what that does that takes
standard NSS then I'm out put that in AC
shop format and then victory as far as
the payload this gets picked up only by
12 35 and it was none of the major
players okay they actually extremely
easy to use and I put all the code up on
github which I'll drop at the end of the
store in custom seat right over to this
actually runs power so code without
power shell dot exe which is really
handy because a lot of our customers
back we've been telling them and there's
something of a debate you know in the
infosec community right now above do you
block PowerShell aditi do not block
PowerShell dating scene I've my own
thoughts on that before the customers
that are blocked in PowerShell that HC
we still need a way of firing power
shell code without using PowerShell that
exe and you can
do that using the diner framework and
the system management automation neither
backwards system automation management
dll ok so let's actually do quick demo
all right interesting sorry oh this this
is gonna suck you guys can't see nothin
hang on let me come near my displays
their displays all right okay cool just
an you're calling instance of what I'm
going to do no interpreter fine misspell
something just tell me dang it mature
mature got it so in this case I'm gonna
set the format to c sharp c or c c sharp
C sharp that's right what was it shark
she sure did alright alright oh god this
incredible okay so if you actually look
at this code this basically just outputs
the mature procedure to c sharp format
so
too by the way this is actually what
real pen testing looks like just a ton
of typos all the time alright this is
gonna be difficult let's let's try this
okay it's a little better alright so in
this particular code segment standard
main class is actually really small just
going to talk you through just a little
bit of it so we're allocating some
memory and then we are going to copy our
flights from our DS bytes class into
memory and then I just have a couple of
junk loops literally they do absolutely
nothing the whole point here is just to
throw off the hash just in case someone
else hasn't wrkn it so you know it just
changes to whatever you want okay and
then we kick off the thread another junk
loop and then we're waiting so where you
put this this is right there just paste
in good to go and then build your
solution you can do this using the
communication of visual studio as well
solution Explorer and then there's your
payload okay I do not have a listener up
and running this point but just give you
an idea of how easy and simple it is to
go ahead and built your payload ok the
other solution just a quick demo on that
close that and start page because that's
easier psy are so in this case what this
does is there is a reference to system
management automation ok this is
available in a windows sdk and this is
the dll that you actually need in order
to fire power shell code without
powershell dot exe so in this case I
have this coded up simply just to take
Bay 64 encoded PowerShell commands and
Fire decode them and then fire them in
this case all this command does is run
PS version table ok that's all it does
so if we fire that and you get the
output there's something interesting to
pay attention to it was one o'clock in
the morning when I notice this last
night
if you look at this the powershell
version that comes back here is five dot
0 build version turned out there but if
you look up here same operating system
power subversion 20 build version 6 dot
one that's because I'm using an
out-of-date version of system management
automation a dll what does this mean to
you well defenders what this means is
that if you are an intrepid defender and
you have logging enabled PowerShell
module log enabled which you might not
know is that module logging didn't was
not available in PowerShell 2 point 0
and so if I conduct a PowerShell
downgrade attack and run all my
PowerShell commands using PowerShell
version 2 point 0 nothing shows up in
your logs absolutely nothing so if i can
get this dll this version of this dll
along with my evil power shell code onto
your system even though you're running
Windows 10 with PowerShell 5.1 latest
and greatest you got all your logs
turned to 11 you're not going to see
anything and that's just brings joy to
my heart that's just a warm fuzzy right
there so Q hi how do i turn off how do i
turn off mirroring okay back to this
real quick okay so how do i get the
payload actually onto the system like I
was going to phish someone how would i
get system management automation dll as
well as that binary on to the system
well here's exactly what i would do and
this was this is a macro function that i
put together I just couple months ago so
in this case i'm setting up a reference
to a windows function called URL
download that file and my macro code
looks just like this i'm calling this
function i'm grabbing i'm grabbing a PS
fired i th see that's the binary that
you just saw and I'm saving it to see
program data PS fire dot exe and then
i'm downloading the management
automation dll and saving that to see
program data so if you're an intrepid
defender and you're like well we have
antivirus configured a block everything
in percent tenth and percent app data
it's something interesting is that c
program data
allows if you look at the permissions in
C program data it is all users have read
and execute but then if you scroll down
a little bit it says special permissions
and you click special permissions and
then you see all users have ability to
write files even low privileged users
which means that I can take my binary
and store it in C program data as a low
privileged user along with that DLL and
then fire it and I have to say anything
attempt that's actually that's kind of
come on alright last thing is Ebola in
here this will be kind of last one of
the last things and demos that I talked
about so Ebola is fantastic and this is
the thing that got like zero of sixteen
we uploaded this to virus oil as well
like I said I have a tool slide at the
very end that has all the github link
something like that so on Ebola what
Ebola does is you give it a variable or
a set of variables that are going to be
found on your targets computer so let's
say you know that your targets name is
Jason all right and so what happens is
that you said the invite the encryption
key to Jason and what happens is that
Ebola takes your payload encrypts it
with that key and then the the code that
actually runs on the target machine is a
brute force mechanism which brute forces
its own key using environment variables
on the target system so some of the
things that you can actually do with
this are you can you can set the
decryption key to a user ID to a domain
name to a lan IP to like an IP address
you can code it to all kinds of stuff
and you can do combinations which means
and this is a beautiful thing because
it's it's completely defensive its self
defending against San boxing against
sandbox techniques so it evades sandbox
is because the sandboxes cannot when
they try and do payload analysis they
cannot decrypt the payload because they
don't have the right environment
variable set and they don't know what
those environment variables are but you
do because you're the attacker and
you've done research against your target
okay so how would we chain this together
alright this will be the last demo video
how would you change something like this
together so let's say I want to generate
a payload
okay let's let's use a meterpreter
payload and I want to obfuscate I want
to obfuscate it using Ebola and then I
want to send it to my target okay and I
want to do this in such a way that's
going to evade as much antivirus as
possible okay as well as inline controls
well like I said if you have ssl
inspection going on you will block this
but if you don't you won't okay let's
see how this works I'm going to run
three tools unicorn Ebola and Lucky
Strike to actually do this demonstration
your displays on okay oh what's wrong
that's me right ok so first let's launch
this F console are cypher con so what
I'm doing is just the same default
listener the listener options are
basically what you saw before which is
windows interpreter reverse htps using
port 443 so in this case I'm kind of you
know fudging the scenario of it because
I'm sending us all based on just the
ends that have my environment but the
gold asst will be I was sending it
across the internet to a Windows host
that has power shell ok so the first
thing to do is to go to the unicorn
director and then what I'm going to do
is unicorn where is my IP address
here's the IP address why should watch
it closely I get it right all right ok
so we generated a lonely I've know he
was going to work by the way fifty
percent of the time it works every time
so when you and you're gonna have to
bear with me because it's going to look
hideous but what actually comes out of
that is a ton of base 64 encoded stuff
and then a PowerShell with some variable
substitution dash to be one so we're
hiding the window we're doing a bunch of
variable substitution here and then
we're actually going to call PowerShell
with that variable substitution passing
in our naughty base64 encoded stuff no I
learned my lesson last night from the
bottom up okay so I'm going to take all
this code all right
when base64 decode it base64 d filename
too long that's not one it's not what
should be happening oh shoot oh god
what's that yeah okay it's totally
embarrassing anyways yes echo instead of
cad good god so let's say that out to
payload ps1 and so now i have my payload
of ps1 which should be ok so now that's
my my basis for decoded unicorn call so
all this is is the shellcode for reverse
HCPs stager and just being set through
through PowerShell ok so now in order to
processes through Ebola it's important
to understand Ebola requires a file
called genetic config so genetic config
is basically the max there the
configuration file for Ebola okay so in
this case i'm using output type of power
shell and a payload type of code i'm
passing in powershell code ok and then
here are the environment variables you
can use a combination of environment
variables in order to make this work ok
don't just have to go with one you can
always amazed you want so in this case
I'm going with Jason because the target
machine there we go so obviously that's
that's the energy so this is also my
target user ok
so I'm going to call Ebola I thought
what the heck is that well P want the
past to my payload type ps1 and then I'm
also going to pass in the genetic config
and so now what comes out is actually be
easier for me to show you another screen
cat put our show send that to the
clipboard okay now it actually comes out
is a bunch of power shell code that is
basically designed to iterate across the
environment variables on the system and
perform the decryption and then actually
launch the power so the malicious powers
of code that i have here which is in my
lookup table right here okay and here's
a function here called get er done that
does that work so so I'm going to save
payload a ps1 and I'm going to run a
tool called Lucky Strike i'm going to
add that payload we're going to call
this cipher con users jason desktop
tailored go ad case when a little one
that's why okay and i'm going to create
i'm going to select that file or select
that payload cipher con and then it's
going to prompt me for what infection
method do i wanna use i'm going to
choose number two selling bed non base64
which means i'm going to take that power
shell code the Ebola output generate
power shell code and i'm going to cram
it into a bunch of excel cells and then
my macro code is going to perform an
obfuscated a call to powershell retrieve
all that power shell code and then
firing okay
and I'm going to create a file this is
running a fully up-to-date version of
Windows Defender by the way okay so
there's my malicious files to use JSON
documents like a strike and then OT NP
something okay these are just lucky
strike payloads and here's my flower
open up the file and here it is to be to
most dangerous words and information
security alright enable content no eat
is going to work what those can you will
content and there's our show so what
happened we do real quick is have a
couple minutes left what happened here
cuz I'll actually shoot i found a bug in
my own code so i'm going to get rid of
the window style hidden so you can
actually see what would happen at this
code or to fire this is what the bola
script actually looks like alright well
yeah i'm not going to show you that all
right how to keep tenders are busy let's
just keep clicking play all right not
today but what happens that power some
window pops up and basically you you see
the brute force attempts passing for
each environment variable so if you
wanted to do this for say a domain user
which is generally speaking the case
that i am most interested in what you
would use instead of using a user ID you
would use the user domain flag which in
this case my machine is joined to the
lab domain okay so there's going to be
the netbios domain name not the fully
qualified domain name okay so if you use
Ebola and you want to contain the
explosion so to speak to only a group of
target users that belong to a specific
organization that you happen to
no the netbios 80 domain name of I don't
know they left Oh ntlm authentication
opens the internet and you were able to
get that information that way then you
could you can contain it such that if
that payload ever landed in a sandbox
then it would not be able to fire it and
I think that's what all the head in fact
I even think I'm just about on time so
this is probably the slide that you want
San Diego here come the cameras okay
this is all tools using this demo both
of the pieces of code that you saw the
the demo extras are down there at the
bottom on my repo so grab those and
customizing anything you want I'll wait
until the cameras go down look at that
five minutes five minutes left I'm
probably at this point just be
respectful the next speaker I'm not
going to take any questions like i said
i will be i'll back you can definitely
buy me beer and I'll tell anything you
want to know that's it thank you very
much