[Music]
um so this talk on a thing I called
secret handshake um so it's a ma commit
control channel that uses x59
shts x59 shts as kind of like the data
uh pipeline um there's a little bit of
Graphics in there and these are
generated with stable diffusion where I
just like secret handshake cyber hackers
and this is what it came up with um all
right so um my name's John Conwell uh
I'm a data scientist by trade been doing
that for about 12 years um about six
years ago I subsp specialized in infosec
um specifically looking for um thread
actor infrastructure um fishing maare
fra that kind of stuff and at two my
last two companies I had like a
six-month project and 9month project
where they wanted me to just focus on X5
and9 CS so like the first place they do
they scrape all the metadata of pretty
much every known domain out there was
like 350 million domains
registered um and one day they just
added a a search scraper and then said
hey data scientists here's 300 million
X5 inserts go find bad stuff um so I
start parsing them and looking for
anomalies and doing weird stuff and like
trying to find anything malicious I
found weird things and lots of shirts
that don't work um but I never found
anything malicious like
nothing um exciting right so my last
company was an ndr and they did the same
thing they're like we want you to create
a model to predict maare like it's maare
C2 based on the Cs um so I pulled on a
big data set and also did a fishing one
you know like when it comes down to it I
didn't find anything like someone who
comes down to it thread actors use Sears
the same reason we do we to encrypt
stuff right there was nothing really
really exciting about how they use X5
and
inserts but I kept looking like I wanted
to find something really interesting um
and I'd heard rumors on Twitter like red
teamers kind of maybe put um a script in
there or you know we're putting you know
modifying the CT or basically just
creating a pen file which is base 64
encod a file calling it assert but with
you know a binary in there just doing
some interesting things um but for me
the Holy Grail both good and bad right
would be uh a ma C2 channel that used
Sears searched search searched never
found one so I was like well um let's
just write one I like I'm a blue teamer
but I like to um create stuff to
understand
stuff um so just level set if you know
what Mal community control is um I just
want to kind of
uh get everyone up speed want to stay
with me all right so Mal command and
control is basically the communication
between the uh the command server and
infected clients right so the server
sends commands to the client the client
runs it gets the output and sends the
output back to the command to to the
server um there's beaconing which is
infected client just saying hey I'm here
I'm here I'm here um when the server is
not up running or um doesn't want to
interact yet
um servers can download uh malicious
binaries to the client and vice versa
the client infected client can
exfiltrate um customer data to command
control server that's bad um one of the
goals main one of the main goals in um
C2 communication is to blend into
network uh the background traffic right
there's tons of TLS you don't want to do
something weird odd proprietary protocol
that's going to stand out you want to
just blend into all the other stuff um
and a channel C2 channel is literally
just the protocol we use so HTTP believe
it or not is still used for a bit um
htps DNS uh tunneling
UDP um lots of others and then
x509 all
right all right so we live in encryption
age TLS is everywhere um Google does
this thing where like analyze what
percentage of internet traffic is
encrypted so um back in 2019 it was at
95% right so a lot and it's been steady
since you know the past four years it's
pretty much right at 95% of all traffic
is encrypted which means um well and X5
and9 inserts enable encryption right it
tells you kind of the algorithms and
stuff um does the handshake and the
encrypt stuff so there's a lot of x59
search just flying around the internet
and they're just files right right
they're just a file basically uncoded
you can put stuff in files you can do
all sorts of malicious things to them um
but we kind of trust them because it's
the thing that enables encryption like
the good stuff um so our north south
Network logs are littered with TS
sessions littered with X5 and
nerts and my last company was an
ndr network uh uh detection
response and I haven't really seen a lot
of ndrs focus on the search that much
like they might pull out the subject and
the issuer and the subject alt name just
to kind of give you context of um like
who issued the Ser from this domain or
whatever but not really um look at it
from a detection perspective um and if
I'm wrong let me know
um so that kind of worried me so the
potential to use Sears is pretty high
not a lot of uh ndrs really look at it
so and one last bit about
CS CS are issued by a uh certificate
Authority so like there's trusted sech
trusted authorities ver sign let's
encrypt um the standard ones you would
think about but you can basically issue
your own root CT be your own certificate
Authority and issue your own CTS and
that's what this does like I don't know
if you could actually do this uh C2
Channel with let en Crypt it would be
super slow um all right
so this is you probably all seen this is
TLS um kind of the flow the handshake um
for command and control malare command
control you need um what's called a
request response pattern right server
sends a request the client does a thing
it sends a response um when I was
looking at how could I do C2 over x59
doesn't really work with TLS because the
server sends aert to the client client
authenticates it and that's it like
there's no way for the client to kind of
send stuff back um so that's not going
to work for us um there's a thing called
Mutual TLS where the client has aert
also and the the server sends CT down to
the client client authenticates it yay
um the client sends its SE to the server
and it makes sure it's trusted and then
they can do um encrypted communication
which is perfect for um enabling that
request response uh
pattern all right so mutual TLS works
great for us um we got that request
response channel uh the challenges then
are going to be how do we embed payloads
data into x59
CTS um and design this request response
communication pattern kind of looks like
you could because they go both ways but
it's a little harder than that I'll talk
to about it why um you also have to
dynamically issue new CTS like every
handshake so if the server says Hey run
who am I um the client's going to run
who am I it doesn't already have that
who am iert like the answer so it's
going to have to run it generate the
cert embed the command then uh embed the
output and send it back which means
network sockets have to be created on
both sides every handshake like they
have to tear down the socket creating a
new socket and um go all right so for
embedding data inserts um this is the
cipher
concert uh just for example um I played
around like issuer really can't use as a
field um because it's set by the signing
CT right so for this one let's encrypt
um the algorithm Fields you probably you
might be might be able to change
programmatically um but the goal is to
have a valid TLS session and so if you
start messing with those it's not going
to work this serial number is 20 bytes
you can put anything you want in there
up to 20 bytes but that's a pretty
limited payload it's hex so like you it
you can't do much with it um there's the
subject and subject Al name which
corporations actually you like
Enterprise services use the subject a
lot they put all sorts of weird stuff
into the subject of assert um but it's
pretty obvious like if you're as a
Defender looking at Cs and like looking
for any kind of outlier it's going to be
very very obvious because most ndrs pull
out subject subject alt name
um but that leaves all the other
extensions and there's dozens and dozens
of other
extensions um that are out there right
you can and you can use those
so X5 andite CTS are created using
what's called asn1 coding uh which is
abstract syntax notation one um just a a
way to for you know to create Fields
basically for encoding um every
extension has a very very specific
formatting for it right so
um
if you if you want to basically extend
an extension you have to know like which
field in which place you want to inject
a string or something um every format
has an Associated oid which is object
identifier and that's how like your
browser knows to
um like it gets a gets an extension
subject Al name looks at the oid says oh
I know this oid this is how I parse it
um and let's see and a weird one this is
fun sn1 has a null field um so all as1
Fields have basically the type of the
field string inch float
null um the value and the length so if
it's string you put like dog in there
and the value and length would be three
um null actually has value which should
be null and the length which should be
zero but you can put anything you want
in there just as long as you set the
right length and the parser is going to
go and say hey this is null field that's
500 characters long just goes ahead and
then starts parsing along and so you can
actually embed a null field in there and
it'll ignore it but if your parser pulls
it out then you have a way to uh send
data so there's a couple extensions I
played around with um the NS comment is
the one I uh one of the ones I picked
for embedding data um NS is uh net uh
Netscape Netscape comment it's a
deprecated extension but you still see
it some time so like it's not too much
of an outlier um and you can create
what's called an arbitrary extension
which is just an extension that's not um
has no oid or the oid is not known right
um so the the parser is going to look at
it look at the oid see if it can form or
parse it can't skip it um but as long as
you know how to parse it you
can so I use NS comment for the command
uh um and the server so the client has
two commands a beacon like I'm here um
and then response which is like the
response to a bash command um and the
server can send sleep bash data xfill or
kill um and then I used an arbitrary
extension as the payload so if the
server sends a bash um the payload would
actually be like who am I you know just
the command to run um and then the
client's payload would be John right um
just whatever the output of who am I is
um let's see the payload is also used if
you're going to do data exfiltration
that would be like the chunk of the file
you're trying to exfiltrate or for a
binary dropper you put it in there um
and the oid I picked I just picked some
random oid um and then just added 666 at
the end and now it's mine my
oid um all right so we know how to put
this is all done in Python by the way so
by python is kind of um the cryptography
library is is what I use to um create
CTS and add payloads into it so we can
do create CTS with payloads um but we
still have to do this command and
control kind of a uh communication
pattern um it looks like I said it looks
like you can go like server send the
thing down the client send the thing
back so it's response reply but when you
create a socket you have to basically
configure it with the CT you're going to
use so before you get the server CT the
client already has to have a CT
ready and they create a connection
exchange Sears so it actually takes two
mutual TLS handshakes to do the you know
request and then um tear down the
sockets create new sockets
response um so it's kind of like this
weird half duplex transition mode half
duplex is data goes one away per
connection you have to kill a connection
create a new connection to send back um
so what this looks like um real quick
both client server generates the
CTS um they're going to create their
sockets with the CTS that they're going
to
pass um and this on this one like the
the client is the be consert like hey
I'm here and the server is going to be
the command like run
LS um so let's see yeah establish
connection Exchange close the connect
close the
sockets um the client is going to parse
the CT it's going to pull out the
command um it's going to be hey Ls I'm
going to run that get the command the
list list directory
listing now it's going to generate its
own CT embedding that output into it the
server is going to create a sleep
basically like hey call back in so many
seconds um create sockets handshake
exchange um client gets the server HT
pulls out the Sleep falls asleep uh the
server is going to pull out the
commandert or the output CT um Parts the
output right to log show it in a session
if it was live whatever um and the
client goes to sleep so that's kind of
you see the the two two handshakes that
have to happen in order for that full
kind of uh request reply pattern um all
right so here is
a uh
demo see if I can just run it
ha all right so on the first one one I
am showing there's a server out
directory on the right um and that's
basically just pause um that's basically
showing you that the server out
directory is empty I'm going to do data
exfiltration so proving now nothing
there um all right so I'm going to kick
up the python
client and one thing it's going to show
it's I don't know if you can even read
this because it's so tiny probably um
but it's beaconing right now it's
basically saying hey um beacon beacon
connection's not there so it just try
again a few seconds seconds I'm going to
spin up the
server um and say pick bash bash is
going to be the command and PWD what
directory am I in they generate the
Sears
exchange um the client generated itts
did another exchange and that's the
output so you know whatever that
directory is so now I want to see LS
what are what's in this
directory um exchange
Sears and we have a folder
listing oh super valuable files that
looks really fun so we're going to do
let's look inside super valuable
[Music]
files and we
see hacker hacker extra large let's look
at that so I'm going to do de data ex
filtration on hacker extra large and so
xfill command
and and wait for
it
okay so now I'm basically exporting six
Meg I'm exfiltrating six Meg file um but
you can't really make well you you can
make a six megert um you can make it uh
open uh open SSL won't parse it it'll
throw exception anything over like 64 or
64k I think is the biggest CT you can do
so partitioning the into these little
bits um and you can see it creates a lot
of certificates so it's just hammering
SS handshakes going like crazy so this
would obviously be very from a detection
perspective a good signal right big SS
lots of them um and then I send a kill
command the client killed itself and
then I'm going to prove server out hey
there's a file um we're going to open
it
and
data
breach see what I did
there um all right oh no not again there
we
go okay so that's pretty much um the C2
Channel x59 Sears we can talk back and
forth get output data
exfiltrate I'm a Defender blue team
myself uh so I never want to release
something that could be malicious
without providing how would you detect
this how would you look for this so this
is now the blue team side of things um
these CTS are not issued by a
certificate Authority so like you saw
how I would I had to create this
arbitrary exception sorry arbitrary
extension with like the my own custom
bite package I don't know if you could
like go to let en Crypt and say hey
create an ex create aert for me but add
these bites as you know with this oid
into this cert um so none of them are
trusted uh issued by trusted authorities
um there there's going to be a lot of
mutual TLS sessions between the same uh
Source destination IP and Port Port
could change like you could put that
into the communication where changes
Port but same IPS which would be weird
um and they're going to be in close
proximity time proximity right it's
going to be every couple 5 Seconds 10
seconds whatever you want your if it's a
live interaction um session you don't
want to wait an hour per um Command
right so it's going to be every 5
Seconds 10 seconds um
and it's going to have that kind of same
sleep Jitter periodicity that you would
see with like Cobalt strike if you were
doing a TLS um communication with Cobalt
strike say you give it like 100 second
sleep with a 10sec Jitter you know it's
between 90 and 110 seconds is going to
be you know the communication so you
look for that periodicity same thing
here um the big one here the C
fingerprints will be different on most
of these should be different right
you're because you're creating Cs on the
Fly they have different time stamps
different payloads so two different you
know same same IPS talking a lot
different CTS that would be really
really weird that would stand out um and
your bite sizes of the CTS are going to
be different right so small ones for
commands medium ones for like command
replies and bigger ones for U data data
exfiltration um so like this seems like
um pretty easy set of detection so when
I when I first did this I worked at an
ndr so I turned this into the query and
ran it and like I expected one of two
things one is um nothing like I saw I
would expect I expected like I would see
no traffic that looks like this the
other one which I kind of wanted but
really didn't want was to find like I
found the next solar winds like
something somebody's using this in the
wild and I searched for it and I never
found it I wrote it and now like
somebody's doing this um I didn't find
that either what I found was the third
op option was there's actually
Enterprise services that have this
Mutual TLS traffic pattern which
freaking blew me away like when I first
ran in I saw like oh I've got a lot of
traffic and I looked like wait tin
tianium and Microsoft and P to networks
and cohesity like these are Big names
EMC
um and so if anyone knows why so if you
work at any of these companies
or admin these services that do mutro
TLS with different CTS
uh really fast I will buy you a beer if
you come talk to me later um because I
want to know from looking at the CTS uh
the issuer was those companies um the
subject the main thing you usually see
is like um I think there's like asset
management system so like the subject
had a key value pairer and they're like
asset ID equals guid or machine ID or
user ID like some kind of ID and then
some kind of alpha numeric um
value
so these things um easy way
to um look for this though is that they
repeat like every hour or every so many
you know minutes U the same set of
searchs kind of repeats through right um
You might get a new asset so that you're
going to get a new CT shows up um or um
an asset goes away so one lessert but
basically you're going to get the same
thing so it which it should stand out
from what like the C2 traffic uh would
look like um and I didn't check when I
was there I didn't look uh I didn't
think to look but the server search
should also be the same every time like
if the
client's basically passing all these new
CTS over there's no reason for the
server to be creating its own new CT
each time it's probably the same thing
so that would be that would be how you
differentiate like these Enterprise
products from um some goofy C2
channel uh mitigation wise when I first
wrote this I was like oh this is
terrible like I I thought I created
something horrible
um and then I think about it more and
it's actually super easy to mitigate
like SSL inspection should
hypothetically just completely block
this right
because you're going to basically the
the the client's going to talk to the
inspection server it's going to create
its own TLS session completely isolated
from inspection server talking to the C2
server right so it's not going to pull
out like the ex the the the server
inspection server is not going to pull
out like my arbitrary extension and
Generator sech talk to the C2 server and
put it back in it's not going to do that
right um so this theoretically should
just oh my gosh I blew through that um
this should just completely um block
this type of C2 Channel
um so one last thing when I first did
this um when I got kind of got got it
done I was like well it creates it's
kind of brittle right it creates a lot
of um artifacts on the hard drive
because it has to create all these shts
um it's you know new session every time
killing uh network sockets and tear
bring them up tear them down so it's
pretty brittle um is there what's the
next step like is there a way to do it
with
TLs but not
x509 um and I started kick kicking
around ideas um and at the same time
some dude reached out to me on Twitter
and he had the same ideas and he's like
so we started talking and the thought is
with just the TLs handshake
itself no CTS like normal regular sht
let's encrypt but so Random bites every
TLS handshake the client the Server
create 32 bytes of random bytes that way
like they create it they send it to each
other that way they encrypt it send it
back decrypt it and they can say hey we
can talk to each other in crypted land
so we have 32 bytes there um the message
ID the client's supposed to create one
send it to the server the server is
supposed to send the same ID back but
it's deprecated so like I don't know I'm
sure the server could probably send a
different message ID back and it'd be
okay so now you have 64 bytes of data
that you could actually exchange over
TLS um if you look at ESN is almost 66
kilobytes of data which is more
than the x59 insert could actually pass
in one shot so now we have you know 66
kilobytes of data you could
theoretically pass from the client to
the server and 64 bytes from the server
back which could be be used for an
actual C2
Channel
um the only downsides is I mean this
would literally be a custom Library you
couldn't do it with OP SSL because you
have to like pull out these bits pin
them together to get your full package
right so you got to um come up with a
custom TLS
library and it's on the client so the
client already has to be infected um to
do this so um it's going to be super
chatty because lots of TLS sessions
again same with the mutual TLS right
it's going to sit there and Hammer these
because the um the data is over the
handshake not the application data um
and the other thing is and when I first
thought about this this is kind of this
one was scary to me as well because like
ndrs don't even look inside like this P
this piece of the TLs handshake most IND
look at that if you had Sak cotta you
could probably pull those out right
um but ssel inspection again would
totally block this because like say we
used the the random bytes the inspection
server is not going to take the random
bytes of the client pull it out create
aert or um sorry pull it out and with
its session to the C2 server like use
the same random bytes it's just going to
create an independent handshake so
pretty sure SL inspection also would
totally block this one um hands
down um and that is all I have one
little bit there's prior prior art
notice on this
um about two months after I wrote this
uh this uh C2 server or this C2 Channel
um I randomly ran across a white paper
by D Nam Jason Reeves who invented it
like three years prior to me um 2019 he
wrote a white paper on this so that's
the link um and he also did a TLS binary
dropper in go um that does s similar
kind of thing um but yeah there you go
any questions
yes
right so the question is if if it's
basically some kind of medical domain or
or pii kind of protected thing where
you're not able to do inspection
um well that's so inspection is for
mitigation um you could still detect
this I think pretty easily if you had an
ndr something that allows you to kind of
query against um the aggregate set of
fields in all the sechs you're seeing um
and oh uh this GitHub has all the
detection logic or you know is all
written up on the readme of the Hub uh
link
so
yep what's
that
oh I don't think it matters right so
like if you're using TLS handshake to
pass like the C2 channel do you really
care if it's all that secure cuz you're
doing the the the the you know the
malicious thing um and you're hiding in
a pretty unique way um could be secure I
don't really think it matters that much
like so another weird one
was this so when I first did the data
exfiltration I was using um RSA private
key SI like 4096 I want to be super
secure um but it was slow as like
it was literally like uh one megabyte
every like 20 SEC it was terrible um and
so I real realiz like as I get a smaller
private key size the the it runs faster
a small smaller key and so like well
it's less secure I'm like I don't really
care really um that's the smallest I
could get so I got like 1.5 megabyte per
second throughput um on the same metal
so that's like just um compute
time
but um
yeah
yep
this would be if like you wouldn't use
this to
um one of the things I what I wanted to
do is prove like a a C2 channel is
possible I didn't want to create like
the most robust uh Mau Library there is
so you could have um multiple sessions
like multiple effective clients talk to
the same server using like subdomains um
so then you would have like different
subdomains spinning up its own uh uh
connections
um but I you wouldn't be like
controlling a big botnet with this this
is more I would say very very targeted
you have you know you've done um
infiltration and you want to get uh
command control you know within some
Corporation right um very very targeted
small any other
questions no oh
yep
no I didn't um you talking about like
like reging the oid well so the oid I
picked is the fsb's oid and then I added
I didn't want to mess with that um but I
just added 666 at the end of it um so no
I didn't like and and the other thing is
like the format could
change um so it's registered um I if I
wanted to change format i' have to
do
that um anything
else cool so one last last bit like um I
did I used stable diffusion to create
some of the art so when I was playing
around with like what does secret
handshake look like in cyber Punk um
hacker kind of way these are things it
came up with um though there was a
couple like super uncomfortable ones
like I love the one on the left where
the computer is caressing the dude the
programmer's hands um or just this um
so secret
handshakes all right thanks
guys