1 00:00:04,100 --> 00:00:05,340 Here's my plan, right? 2 00:00:05,700 --> 00:00:08,860 We're going to deliver our squirt virus in the email, right? 3 00:00:08,860 --> 00:00:12,360 It's going to live on their mail server until the admin's clever enough to read it. 4 00:00:13,180 --> 00:00:15,140 At that point, we're going to squirt his time. 5 00:00:15,240 --> 00:00:16,300 Mmm , pretty cool plan. 6 00:00:17,520 --> 00:00:20,280 Connect back shellcode out to us, listening on the public internet. 7 00:00:21,020 --> 00:00:24,160 We're going to escalate some privileges, drop out a nice and prepared rootkit. 8 00:00:24,880 --> 00:00:30,140 And then from there, we'll throw him his SSH up good and proper, sniff his keystrokes, wait for the logs in the database server. 9 00:00:30,160 --> 00:00:31,000 Yeah, it's all good, right? 10 00:00:31,000 --> 00:00:31,660 All good. 11 00:00:43,520 --> 00:00:45,440 Those didn't look like email addresses to me. 12 00:00:46,000 --> 00:00:47,320 All right, anyway, so. 13 00:00:47,460 --> 00:00:51,720 Got a brand new Pine 0-8, run it through our mail spoofer, send him something he's got to read, right? 14 00:00:51,720 --> 00:00:53,960 Now that looks like a compelling piece of email to me. 15 00:00:54,980 --> 00:00:57,440 And we fire up our netcap, and we hang on. 16 00:00:57,980 --> 00:01:02,080 If you notice, for convenience, that's on 41327 instead of 443, but never mind. 17 00:01:03,460 --> 00:01:04,540 And look at that. 18 00:01:04,600 --> 00:01:05,080 Shell. 19 00:01:05,080 --> 00:01:06,740 Right, find squirt, work perfectly. 20 00:01:07,380 --> 00:01:08,100 Yep. 21 00:01:08,340 --> 00:01:09,260 You were the admin? 22 00:01:09,260 --> 00:01:09,720 Mm-hmm. 23 00:01:09,720 --> 00:01:11,320 Yeah, he's a clever man, nice username. 24 00:01:12,360 --> 00:01:14,260 Oh, shit, where did Pine go? 25 00:01:14,300 --> 00:01:14,840 Nah. 26 00:01:15,860 --> 00:01:17,620 Ah, look, damn thing dropped core, right? 27 00:01:17,620 --> 00:01:18,640 He's probably going to notice that. 28 00:01:18,640 --> 00:01:20,520 He's sitting there, using his Pine, and bam, all gone. 29 00:01:20,520 --> 00:01:21,300 Ah, shit. 30 00:01:29,260 --> 00:01:31,900 So at this point, you know, he's probably going to spot us. 31 00:01:31,900 --> 00:01:35,020 Hacksaw.com, pretty poor choice of reverse, I now admit. 32 00:01:37,260 --> 00:01:39,200 And, ah, yeah, look at that, nice. 33 00:01:39,200 --> 00:01:41,740 Starter Club Shell, he's going to start running around where the core is. 34 00:01:41,940 --> 00:01:42,760 Ah, shit. 35 00:01:43,600 --> 00:01:43,820 So 36 00:01:47,780 --> 00:01:52,980 right about now, if you're a clever man, you know, if you're a wise man, it's time to drop carrier, right? 37 00:01:53,540 --> 00:01:56,740 Plus, plus, plus, ADHMort, just get the hell out of here, right? 38 00:01:56,740 --> 00:01:58,540 Things have gone horribly wrong. 39 00:01:59,540 --> 00:02:00,120 Cool. 40 00:02:00,740 --> 00:02:05,660 Apparently pear shape doesn't translate well into North American English, you know, I'm terribly sorry about that. 41 00:02:07,820 --> 00:02:09,340 But yeah, did you see that? 42 00:02:09,340 --> 00:02:10,880 In the PSR I put back there? 43 00:02:16,930 --> 00:02:17,290 No? 44 00:02:17,290 --> 00:02:21,130 Look, look, look, SSH session, root, and then nameserver. 45 00:02:21,850 --> 00:02:23,270 That sounds pretty good, huh? 46 00:02:23,270 --> 00:02:24,090 Pretty good. 47 00:02:24,510 --> 00:02:25,390 I like that. 48 00:02:32,030 --> 00:02:33,790 If I drop carrier now, right? 49 00:02:33,810 --> 00:02:35,850 I'm never going to get a chance like that, right? 50 00:02:36,690 --> 00:02:41,890 Man, I really, really, really wish there was a way I could get to the other end of that SSH session. 51 00:02:41,890 --> 00:02:43,570 It's authenticated, it's already root, right? 52 00:02:43,570 --> 00:02:45,570 I don't even have to goddamn root the box. 53 00:02:45,790 --> 00:02:48,430 All I gotta do is get down that SSH session, man. 54 00:02:48,970 --> 00:02:50,310 If only there was a way. 55 00:02:55,670 --> 00:02:57,630 Like fucking duh there is. 56 00:02:58,330 --> 00:03:00,050 Which is why I'm standing here. 57 00:03:02,350 --> 00:03:06,670 So, yeah, I smacked a few magic keystrokes, a little bit of this, a little bit of that, some bang. 58 00:03:06,670 --> 00:03:07,810 Bangy-bang-bang. 59 00:03:08,870 --> 00:03:09,910 SSH Jack. 60 00:03:20,550 --> 00:03:22,350 Anyway, yeah, so my name's Metal Storm. 61 00:03:22,390 --> 00:03:23,950 My mum calls me Adam. 62 00:03:25,310 --> 00:03:28,390 I'm from New Zealand, which is why I sound a little fucked up. 63 00:03:29,790 --> 00:03:36,010 For those of you who are not familiar, it's a very small island that kind of like connects people to any city in the entire North America. 64 00:03:36,010 --> 00:03:39,590 And, yeah, we have lots of sheep and apparently hobbits. 65 00:03:39,590 --> 00:03:40,990 I haven't seen any right now that aren't. 66 00:03:40,990 --> 00:03:44,470 Let me tell you right now, there are no hobbits. 67 00:03:45,190 --> 00:03:46,550 There's no hobbitses. 68 00:03:46,630 --> 00:03:48,550 They don't have preciouses. 69 00:03:48,570 --> 00:03:49,550 They don't exist. 70 00:03:49,750 --> 00:03:51,930 Sad, sad token fanboys. 71 00:03:54,090 --> 00:03:56,870 See, I work for a Linux integrator. 72 00:03:56,870 --> 00:04:01,330 I don't actually do much security for a living, so I'm kind of here in a personal capacity, which is why I can say fuck. 73 00:04:02,970 --> 00:04:06,210 In the past, I've been a corporate or security consultant. 74 00:04:06,210 --> 00:04:07,630 I've done network engineering. 75 00:04:07,630 --> 00:04:08,870 I've done all sorts of stuff. 76 00:04:16,780 --> 00:04:19,780 So, right, what the fuck, what the fuck did we just do, right? 77 00:04:22,240 --> 00:04:25,580 We saw ourselves a pretty classic intrusion, right? 78 00:04:26,420 --> 00:04:29,320 Slightly different modus operandi than you're probably used to, right? 79 00:04:30,140 --> 00:04:31,920 Server box was pretty well secured. 80 00:04:31,920 --> 00:04:38,540 Instead of attacking the server directly, I decided that the best way to do it is to attack the admin's desktop and then from there to the server. 81 00:04:39,240 --> 00:04:40,280 But there's desktops, right? 82 00:04:40,280 --> 00:04:42,580 I mean, Linux desktops just as much as Windows desktops. 83 00:04:42,580 --> 00:04:43,920 There's a whole bunch of complexity, right? 84 00:04:43,920 --> 00:04:50,780 We don't have clipping, but we do have, you know, lots of candy and enlightenment and things that make your desktop look real pretty. 85 00:04:51,900 --> 00:04:56,260 And all that complexity, all that kind of intellectual candy floss that's there to just rot your brain, right? 86 00:04:56,260 --> 00:04:57,480 That's where all the bugs are. 87 00:04:57,660 --> 00:05:00,000 So, I want to root up someone's big Linux server, right? 88 00:05:00,000 --> 00:05:01,200 I'm not going to go after the server. 89 00:05:01,200 --> 00:05:04,660 It's got intrusion detection all over the place and intrusion prevention like it works. 90 00:05:06,740 --> 00:05:09,380 I'm going to go attack the desktops, right? 91 00:05:09,380 --> 00:05:10,400 That's where it's at. 92 00:05:11,000 --> 00:05:12,900 And certainly people who have Linux desktops, right? 93 00:05:12,900 --> 00:05:14,060 They're real geeky. 94 00:05:14,240 --> 00:05:17,900 They have glasses and long hair and beauty fears and shit, right? 95 00:05:18,000 --> 00:05:20,540 And they look after all the good stuff. 96 00:05:20,880 --> 00:05:22,580 So, that's where you're going to go. 97 00:05:23,360 --> 00:05:24,420 But sometimes, right? 98 00:05:24,420 --> 00:05:25,600 Sometimes you're not perfect, right? 99 00:05:25,600 --> 00:05:26,820 Things go wrong. 100 00:05:27,160 --> 00:05:28,980 In that particular case, you know, we got there. 101 00:05:28,980 --> 00:05:29,520 We got busted. 102 00:05:29,520 --> 00:05:30,060 We dropped Cor. 103 00:05:30,060 --> 00:05:31,080 He's going to know this. 104 00:05:32,420 --> 00:05:36,240 So, you know, you can drop Cor like some sort of little pansy. 105 00:05:36,400 --> 00:05:38,520 Or maybe, you know, do something a little different. 106 00:05:38,520 --> 00:05:39,800 Just play some adaptability. 107 00:05:40,020 --> 00:05:40,980 Something a little new. 108 00:05:54,340 --> 00:05:55,400 When you hack something, what do you do? 109 00:05:55,400 --> 00:05:56,060 What are your goals? 110 00:05:56,060 --> 00:05:56,580 Well, 111 00:06:09,750 --> 00:06:11,310 figure out what you want to do next. 112 00:06:11,950 --> 00:06:14,470 Very rarely do you ever, you know, just get root on the box. 113 00:06:14,470 --> 00:06:14,810 You won't. 114 00:06:14,810 --> 00:06:15,430 You won't. 115 00:06:19,590 --> 00:06:22,090 So , yeah, you have to do reconnaissance, right? 116 00:06:22,090 --> 00:06:23,890 You're usually on your way to it. 117 00:06:24,930 --> 00:06:26,870 There's kind of another thing you could do, right? 118 00:06:26,870 --> 00:06:28,510 You could be a good guerrilla star, right? 119 00:06:28,510 --> 00:06:29,350 You walk in there. 120 00:06:29,350 --> 00:06:30,070 You get what you want. 121 00:06:30,070 --> 00:06:31,730 You get the hell out real fast. 122 00:06:32,130 --> 00:06:33,890 And that saves you a bunch of time and effort. 123 00:06:34,690 --> 00:06:36,030 And I'd like to explain adaptability, right? 124 00:06:36,030 --> 00:06:40,070 That's a big difference between all you fuckers and the people they pay to do this for. 125 00:06:41,470 --> 00:06:42,850 At least, the cheap ones anyway. 126 00:06:42,850 --> 00:06:43,450 I don't know. 127 00:06:44,590 --> 00:06:44,910 You 128 00:06:50,500 --> 00:06:55,040 have to have a really big name for root and other stuff instead of the stuff you've got. 129 00:06:55,880 --> 00:06:57,800 Cross-host privilege escalation, right? 130 00:06:57,800 --> 00:06:59,300 So, privilege escalation is pretty normal. 131 00:06:59,300 --> 00:07:00,120 You have a user account. 132 00:07:00,120 --> 00:07:00,880 You want to get some root. 133 00:07:00,880 --> 00:07:01,520 That's good. 134 00:07:01,520 --> 00:07:06,320 I think root on another box is just as good as root on this box most of the time, right? 135 00:07:07,000 --> 00:07:09,140 And local root, you know, it can be a distraction. 136 00:07:10,160 --> 00:07:11,360 You're on your way to somewhere. 137 00:07:11,360 --> 00:07:14,520 You don't have time to sit around and root, hit a box up, and drop it. 138 00:07:15,380 --> 00:07:19,160 You know, local vulnerabilities are easy to exploit often, right? 139 00:07:19,160 --> 00:07:20,460 We've got a lot more information. 140 00:07:20,460 --> 00:07:22,040 What's the version stack layout? 141 00:07:22,040 --> 00:07:23,860 You know what we're getting ourselves into. 142 00:07:24,320 --> 00:07:29,420 It can be kind of tempting to sit around and escalate your privileges because you feel good about it, right? 143 00:07:29,420 --> 00:07:30,360 You know, you're achieving something. 144 00:07:30,360 --> 00:07:32,320 You feel good, right? 145 00:07:32,320 --> 00:07:33,720 You feel good about yourself. 146 00:07:35,400 --> 00:07:36,140 Yeah, easy is good. 147 00:07:36,140 --> 00:07:36,660 I like easy. 148 00:07:36,660 --> 00:07:40,060 But what if there was something easier than local privilege escalation? 149 00:07:47,250 --> 00:07:48,450 Trust relationships. 150 00:07:49,070 --> 00:07:50,790 It's kind of old school, I know. 151 00:07:50,970 --> 00:07:54,850 We must be, what, five, six, seven years ago talking about trust relationships? 152 00:07:55,550 --> 00:07:57,030 It's kind of old school, yeah. 153 00:07:57,030 --> 00:07:58,510 You know, you've got cross-hosts. 154 00:07:58,510 --> 00:08:02,150 And back when ports below 1024 were just magically rooted. 155 00:08:03,930 --> 00:08:07,270 Back when people exported slash readwrite to the entire world. 156 00:08:08,050 --> 00:08:08,950 That was good, right? 157 00:08:08,950 --> 00:08:10,710 We're just a bunch of long-haired unix hippies, right? 158 00:08:10,710 --> 00:08:11,330 We love each other. 159 00:08:11,330 --> 00:08:12,090 It's all good. 160 00:08:12,090 --> 00:08:13,370 We just share. 161 00:08:13,430 --> 00:08:14,350 You don't mind this space. 162 00:08:14,350 --> 00:08:15,450 It's your disk space. 163 00:08:17,490 --> 00:08:18,570 It makes you feel good, right? 164 00:08:18,590 --> 00:08:19,730 It's old school. 165 00:08:19,730 --> 00:08:22,610 You feel like your mummy's tucking you up in bed. 166 00:08:22,610 --> 00:08:23,490 You know, it's good. 167 00:08:24,570 --> 00:08:26,170 But we called that hacking, right? 168 00:08:26,170 --> 00:08:27,230 That's just embarrassing, right? 169 00:08:27,230 --> 00:08:27,910 That wasn't hacking. 170 00:08:27,910 --> 00:08:29,650 That was just mounting stuff. 171 00:08:29,650 --> 00:08:36,110 How many of you watched Unauthorized Access where a simple nomad goes, like, mount? 172 00:08:36,330 --> 00:08:37,190 And he's a hacker? 173 00:08:39,550 --> 00:08:40,090 Sorry. 174 00:08:40,090 --> 00:08:42,570 You're in the room, so... 175 00:08:47,490 --> 00:08:51,870 And that's my favorite thing about trust relationships. 176 00:08:52,650 --> 00:08:53,670 Instant gratification, right? 177 00:08:53,670 --> 00:08:54,350 You turn up. 178 00:08:54,350 --> 00:08:56,670 There's a trust relationship between hosts, right? 179 00:08:56,670 --> 00:08:57,710 It's like Christmas. 180 00:08:57,710 --> 00:08:58,250 It's good. 181 00:08:58,250 --> 00:08:58,990 Right now. 182 00:08:58,990 --> 00:09:00,390 You get Root on another box. 183 00:09:00,390 --> 00:09:01,270 Or Shell on another box. 184 00:09:01,270 --> 00:09:02,050 It's great, right? 185 00:09:02,050 --> 00:09:03,430 It makes you feel really good. 186 00:09:13,850 --> 00:09:15,650 Traditional trust relationships, right? 187 00:09:15,650 --> 00:09:22,010 I call them long transient trusts for no reason other than that I'm obviously about to talk about transient trusts. 188 00:09:23,110 --> 00:09:25,930 So that's what I'm calling traditional kind of fixed trusts. 189 00:09:25,930 --> 00:09:27,290 Things like host trusts. 190 00:09:27,290 --> 00:09:29,970 Things like SSH key-based trusts. 191 00:09:30,130 --> 00:09:34,250 They're trust relationships that exist as stored authentication predictions. 192 00:09:34,250 --> 00:09:37,410 What Bruce and I would probably call one-factor authentication. 193 00:09:38,870 --> 00:09:42,110 Or it can be authentication based on properties of the connection. 194 00:09:42,110 --> 00:09:44,110 The source address, the whole thing below. 195 00:09:44,110 --> 00:09:45,190 All that sort of thing, right? 196 00:09:45,190 --> 00:09:48,530 Just your traditional run-of-the-mill garden trust relationship. 197 00:09:58,720 --> 00:10:01,740 And then there's trust relationships which are transient. 198 00:10:01,740 --> 00:10:05,420 Which are trust relationships that exist only for a period of time. 199 00:10:05,820 --> 00:10:10,700 And generally the most interesting class of those is post-authentication connections. 200 00:10:10,700 --> 00:10:17,940 Once you've initially carried out your authentication, the remainder of that session is effectively a transient trust relationship between hosts. 201 00:10:19,160 --> 00:10:28,840 Unless you personally authenticate every single packet you send, then you have to accept some sort of transient trust relationship between hosts. 202 00:10:30,880 --> 00:10:31,420 Let's 203 00:10:40,560 --> 00:10:46,900 look at a couple of methods, the traditional methods for exploiting trust and transient trust relationships. 204 00:10:47,200 --> 00:10:50,060 And to do so, I picked a couple of methods just out of the air. 205 00:10:50,600 --> 00:10:52,800 How easy it's going to be to do it. 206 00:10:52,800 --> 00:10:54,760 How sneaky it is, how stealthy. 207 00:10:54,760 --> 00:10:57,900 How close to right the fuck now you can do it. 208 00:10:58,200 --> 00:11:00,860 And an overall kind of feeling of feasibility, right? 209 00:11:00,860 --> 00:11:04,220 Because an attack's no use if you're only going to be able to use it one time in a hundred. 210 00:11:05,420 --> 00:11:06,940 So yeah, we're going to evaluate them. 211 00:11:06,940 --> 00:11:12,100 And for the purposes of this, we're just going to assume that we've got a non-root shell on the box. 212 00:11:22,680 --> 00:11:25,920 Right, so your traditional non-transient trusts, right? 213 00:11:25,920 --> 00:11:27,000 It's pretty straightforward. 214 00:11:27,000 --> 00:11:33,440 And our job is to impersonate the credentials that are used to authenticate that connection for trust. 215 00:11:33,440 --> 00:11:41,660 Whether it be by coming through the trusted box, using stored key material like a safe trust, or by spoofing. 216 00:11:42,140 --> 00:11:43,280 And that's pretty straightforward, right? 217 00:11:43,280 --> 00:11:44,140 That's easy. 218 00:11:44,140 --> 00:11:45,100 Everyone knows that. 219 00:11:45,720 --> 00:11:46,680 It's pretty sneaky, right? 220 00:11:46,680 --> 00:11:50,080 No one knows that you turned up, sorted all the trust and abused it, right? 221 00:11:50,080 --> 00:11:51,320 It's pretty damn good. 222 00:11:51,940 --> 00:11:52,500 When? 223 00:11:52,500 --> 00:11:53,460 Yeah, right now, right? 224 00:11:53,460 --> 00:11:54,700 You turn up, you find a trust, you're gone. 225 00:11:54,700 --> 00:11:55,480 It's all good. 226 00:11:56,160 --> 00:11:59,400 But, overall feasibility, it's not simple, right? 227 00:11:59,400 --> 00:12:03,100 How often do people still rely on ports being low 1024, right? 228 00:12:03,100 --> 00:12:05,080 Outside of like bank environments or whatever. 229 00:12:06,260 --> 00:12:07,560 Not that often, unfortunately. 230 00:12:07,560 --> 00:12:09,680 So you don't see this, which is a pity, because I like it. 231 00:12:18,750 --> 00:12:26,250 Right, the other interesting way to attack a transient trust relationship, a traditional way of doing it, if you will, is key log, right? 232 00:12:26,250 --> 00:12:37,410 So during authentication, you log the user's input, either by trojaning SSH having it, listening to your keystrokes, or by logging it from the keyboard or the hardware keylogger, whatever you call it, right? 233 00:12:37,410 --> 00:12:38,610 Even shoulder surfing, right? 234 00:12:38,610 --> 00:12:39,770 Something old school like that. 235 00:12:39,890 --> 00:12:44,390 So you steal the credentials, and then later on, you reuse them for your own good. 236 00:12:44,670 --> 00:12:44,950 Right? 237 00:12:44,950 --> 00:12:45,870 Classic technique. 238 00:12:46,350 --> 00:12:46,810 Easy? 239 00:12:46,810 --> 00:12:47,410 Hell yeah. 240 00:12:47,890 --> 00:12:48,690 Everyone does it, right? 241 00:12:48,690 --> 00:12:52,030 It is the standard way of getting from one box to another. 242 00:12:52,670 --> 00:12:53,350 Right, stealthy? 243 00:12:53,350 --> 00:12:54,010 Sure, you do it, right? 244 00:12:54,010 --> 00:12:55,910 You rootkit the box up, you trojan it, all good. 245 00:12:57,230 --> 00:13:00,590 When, this is the downside of this, is you have to wait for them to log back in, right? 246 00:13:00,590 --> 00:13:04,050 And say like in our example earlier on, right, you're about to get busted. 247 00:13:04,250 --> 00:13:07,930 So if you now go ahead and kill their SSH client, they're not going to reconnect, right? 248 00:13:07,930 --> 00:13:09,450 They're wondering where the fuck Pine went. 249 00:13:11,710 --> 00:13:13,010 So yeah, that's not so good. 250 00:13:13,010 --> 00:13:15,130 Overall feasibility though, it's a really good technique, right? 251 00:13:15,550 --> 00:13:16,830 It's kind of the gold standard. 252 00:13:16,830 --> 00:13:17,630 It's what everyone does. 253 00:13:17,630 --> 00:13:19,650 You can always fall back on a keylogger, right? 254 00:13:20,270 --> 00:13:21,150 It's all good. 255 00:13:29,960 --> 00:13:31,000 More advanced technique, right? 256 00:13:31,000 --> 00:13:32,100 There's a man in the middle, right? 257 00:13:33,320 --> 00:13:37,300 Similar sort of thing, except that we impersonate the server to the client, and the client to the server. 258 00:13:37,300 --> 00:13:39,960 We sit in the middle, we grab the authentication credentials. 259 00:13:40,040 --> 00:13:45,020 Optionally, if it's encrypted, we have a little bit of jiggery-pokey with fake certificates, fake host keys, that sort of thing. 260 00:13:46,520 --> 00:13:52,860 And then, later on, we can either sniff their connection, see what they're doing, and if we're feeling particularly narked, we can take it over. 261 00:13:53,120 --> 00:13:56,240 Now the downside of that is, of course, the user's probably going to notice. 262 00:13:58,420 --> 00:14:02,080 So ease, yeah, it's a relatively well understood sort of thing. 263 00:14:02,460 --> 00:14:04,680 You know, it's not wildly complicated. 264 00:14:04,680 --> 00:14:13,600 The downside is, as people deploy PKI systems, or at least look at their host keys, which I hope you do, it's not so good. 265 00:14:13,620 --> 00:14:15,000 Stealthy, yeah, same thing, right? 266 00:14:15,220 --> 00:14:21,060 SSH pops up, huge mongers warning, saying, you know, oh look, someone has messed with your host key, this might be bad. 267 00:14:22,200 --> 00:14:23,560 When, same problem, right? 268 00:14:23,560 --> 00:14:25,880 We have to wait until authentication time to do it. 269 00:14:26,420 --> 00:14:28,820 But overall feasibility, yeah, it's okay, right? 270 00:14:28,820 --> 00:14:29,860 We can do this occasionally. 271 00:14:38,220 --> 00:14:39,880 Ah, now this is kind of old school, right? 272 00:14:39,880 --> 00:14:41,460 The TCP hijack attack, right? 273 00:14:41,460 --> 00:14:47,540 You take a running, open, post-authentication connection, and you bust open sequence numbers, and you hijack it, right? 274 00:14:47,540 --> 00:14:50,440 This is old school, it's been used quite famously by Mr. 275 00:14:50,440 --> 00:14:51,300 Kevin Mitnick. 276 00:14:52,320 --> 00:14:55,360 But unfortunately when you go and do it, oh yeah, the user's noticing. 277 00:14:55,360 --> 00:14:57,860 Look at that, that does look like Shimomura, don't you think? 278 00:14:58,140 --> 00:15:01,960 He looks pretty pissed, he's got two exclamation marks next to him. 279 00:15:02,400 --> 00:15:03,540 That's how you tell. 280 00:15:04,040 --> 00:15:05,820 So yeah, ease, these days, not so good. 281 00:15:05,820 --> 00:15:09,180 People have decent, hopefully, random number sequence generation. 282 00:15:10,440 --> 00:15:12,180 And yeah, it's not so stealthy. 283 00:15:12,180 --> 00:15:14,860 But the plus side, right, it has all the properties we're looking for, right? 284 00:15:14,860 --> 00:15:16,180 We can do it right now, right now. 285 00:15:16,180 --> 00:15:20,360 Open connection, it's got the credentials we want at the other end, we can go and steal it, all good. 286 00:15:21,300 --> 00:15:24,340 But the downside is, yeah, overall feasibility, not so good, right? 287 00:15:24,440 --> 00:15:29,900 You're going to need raw sockets, you're going to need promiscuous interface to try and see the sequence numbers if you're not going to be doing it blind. 288 00:15:29,900 --> 00:15:32,440 Doing it blind these days is not as easy as it used to be. 289 00:15:33,480 --> 00:15:34,460 So yeah, I like it, right? 290 00:15:34,460 --> 00:15:37,000 I'd like to be able to do this, but it's not always feasible. 291 00:15:45,670 --> 00:15:47,390 But this is the fun one. 292 00:15:48,350 --> 00:16:01,230 So, after we've authenticated the session, we turn up on the user's box, and we sneak down their running connection from inside the box, and they don't notice. 293 00:16:01,690 --> 00:16:05,030 Hmm, that sounds easy, it is. 294 00:16:05,230 --> 00:16:07,130 It sounds stealthy, it is. 295 00:16:07,510 --> 00:16:10,110 It sounds like you could do it right now, hmm. 296 00:16:11,490 --> 00:16:12,530 And is it feasible? 297 00:16:12,530 --> 00:16:13,870 Well, the code's on your CD. 298 00:16:22,740 --> 00:16:23,080 Say what? 299 00:16:23,080 --> 00:16:24,880 Yeah, hijack the application. 300 00:16:25,180 --> 00:16:26,080 Why not, right? 301 00:16:26,600 --> 00:16:27,720 It is slightly different, right? 302 00:16:27,720 --> 00:16:31,840 It demands slightly different methodology, right, when you're going to hack someone. 303 00:16:31,840 --> 00:16:36,760 Normally, you hack them on a public holiday, on a weekend, you know, when they're getting married, something like that. 304 00:16:37,720 --> 00:16:43,560 Here, what you're interested in is maximising the number of open post-authentication sessions for you to sneak down. 305 00:16:43,660 --> 00:16:49,360 So really what you want to do is you want to turn up, during peak time, right, the middle of the day, when everybody's right there at their desks. 306 00:16:49,380 --> 00:16:53,920 And then you want to sneak in and take their route right out from under them without them noticing. 307 00:16:54,900 --> 00:16:57,140 Right, just daylight robbery. 308 00:16:59,760 --> 00:17:02,320 And the funny thing is, right, it's not even that difficult. 309 00:17:02,660 --> 00:17:04,320 Right, this is just a party trick. 310 00:17:06,960 --> 00:17:11,780 I mean, all I did, right, was I thought, you know, there's a lot to be learned from kind of old-school DOS viruses. 311 00:17:11,780 --> 00:17:13,820 There's a lot to be learned from things we've done in the past. 312 00:17:13,820 --> 00:17:23,780 And this is just creative re-application of the same tricks that, you know, binary reverse engineers and virus writers and all those sort of, you know, kind of sneaky fuckers have been doing for a while. 313 00:17:30,790 --> 00:17:36,490 Right, so I took those numbers that I just pulled out of my ass earlier on and I put them on a graph to make it kind of look legitimate. 314 00:17:38,690 --> 00:17:49,450 And as this graph clearly demonstrates, right, my technique is wildly better than everything except classic trust relationships, which you'd have to be a retard to deploy, right? 315 00:17:49,450 --> 00:17:50,190 I mean, seriously. 316 00:17:50,970 --> 00:17:52,490 So yeah, I graphed them. 317 00:17:52,490 --> 00:18:01,750 And really the conclusion from this graph is that transient trust relationships, exploiting them, is almost as much fun and as easy as exploiting traditional trust relationships. 318 00:18:08,630 --> 00:18:14,150 So, for your hijacking pleasure, I present to you my SSH jacket. 319 00:18:22,470 --> 00:18:24,490 It doesn't actually look like that, right? 320 00:18:24,490 --> 00:18:26,110 You don't need to clap, but it looks different. 321 00:18:26,110 --> 00:18:27,630 It looks like a script and stuff. 322 00:18:29,290 --> 00:18:35,750 So yeah, it's a Python script, which, when pointed at an SSH session, gives you a shell at the other end. 323 00:18:35,790 --> 00:18:36,630 Just like that. 324 00:18:37,150 --> 00:18:43,910 So we're going to talk about briefly how it works, a few kind of implementation details, a bit of nitty-gritty stuff so you can do it yourself. 325 00:18:44,070 --> 00:18:49,270 And then we're going to diverge briefly into considering anti-forensics whilst implementing and using it. 326 00:18:50,190 --> 00:18:54,510 And then there'll be like one slide of mitigation, you know, just the responsible bit of the talk. 327 00:18:54,890 --> 00:19:00,450 And then, yeah, we'll talk about a few other bits and pieces that you might have up your sleeves or I might have up mine. 328 00:19:08,750 --> 00:19:10,170 Fullscreen, that's pretty futuristic 329 00:19:15,950 --> 00:19:16,310 . 330 00:19:16,490 --> 00:19:20,190 I'm not familiar with this commercial software with the two buttons and stuff. 331 00:19:21,750 --> 00:19:23,430 I'm kind of a one-button sort of guy. 332 00:19:25,490 --> 00:19:26,550 Hey, that's pretty sweet. 333 00:19:29,690 --> 00:19:31,650 Hey man, I just hack your network, right? 334 00:19:31,650 --> 00:19:33,150 I don't do presentations. 335 00:19:34,870 --> 00:19:36,250 So yeah, SSH, right? 336 00:19:36,250 --> 00:19:43,890 For those of you who aren't familiar, which probably isn't anybody, I guess, SSH provides this virtual channel metaphor, right? 337 00:19:43,890 --> 00:19:48,470 Effectively, SSH provides a multiplexed transport, right? 338 00:19:48,470 --> 00:19:52,590 You can run multiple sessions across a single encrypted TCP pipe. 339 00:19:52,610 --> 00:19:55,970 And it provides a number of useful things for you to connect to those sessions. 340 00:19:55,970 --> 00:19:58,290 The typical ones you'll see is your TTY. 341 00:19:58,590 --> 00:20:00,830 Apparently that's pronounced titty, I'm not sure. 342 00:20:02,310 --> 00:20:05,550 A shell for you to talk to on the other end of your titty. 343 00:20:08,070 --> 00:20:10,570 And of course, TCP sockets is the other thing we normally shunt around. 344 00:20:10,570 --> 00:20:11,730 X-connections, that sort of thing. 345 00:20:11,730 --> 00:20:12,710 Things over TCP. 346 00:20:12,710 --> 00:20:14,190 People are quite familiar with that. 347 00:20:15,350 --> 00:20:20,950 So what we're trying to do here, of course, is we want to be able to take the user's session away from him and use his credentials. 348 00:20:20,950 --> 00:20:22,470 But we don't want him to notice, right? 349 00:20:22,470 --> 00:20:26,470 And this sort of virtual channel metaphor is exactly what we're looking for. 350 00:20:32,500 --> 00:20:33,800 So how's it work, huh? 351 00:20:33,800 --> 00:20:39,020 Well, we're going to take the features provided by SSH and we're just going to use them for evil. 352 00:20:39,640 --> 00:20:41,360 That's what hacking's all about, right? 353 00:20:41,900 --> 00:20:44,940 So what we do is we ask for a second shell. 354 00:20:44,940 --> 00:20:47,000 We say, hey, server, I'm Bob, I'm authentic. 355 00:20:47,000 --> 00:20:48,200 You saw that earlier, right? 356 00:20:48,200 --> 00:20:49,220 I gave him my password. 357 00:20:49,220 --> 00:20:50,040 I'm good, right? 358 00:20:50,420 --> 00:20:51,660 You want to give me another shell? 359 00:20:52,560 --> 00:20:53,760 I'll go another one. 360 00:20:54,420 --> 00:20:55,100 Maybe two. 361 00:20:55,800 --> 00:20:57,820 And then we're going to glue it to the hacker. 362 00:20:58,340 --> 00:20:59,160 Give him a socket. 363 00:20:59,840 --> 00:21:00,460 Connect it up. 364 00:21:00,460 --> 00:21:01,140 Oh, look, a shell. 365 00:21:01,140 --> 00:21:01,900 Just like that. 366 00:21:10,990 --> 00:21:16,890 So using Python and a little bit of debug trickery, we go ahead and we ptrace attach to the client process. 367 00:21:16,890 --> 00:21:19,750 Now, this implies, obviously, that you need to be able to ptrace attach. 368 00:21:19,950 --> 00:21:24,490 So, obviously, you have to be root or you have to be running as the same user, right? 369 00:21:24,490 --> 00:21:26,410 And that's not as stupid as it sounds. 370 00:21:27,110 --> 00:21:29,750 You think about all the Firefox bugs we've had lately, right? 371 00:21:29,790 --> 00:21:33,010 Admins who run the links on the desktop are almost always going to run Firefox. 372 00:21:33,010 --> 00:21:35,950 There's been a few Firefox kind of zero-day run code sort of bugs. 373 00:21:35,950 --> 00:21:40,070 You turn up on the desktop, you find every running SSH connection, you jump down them. 374 00:21:46,030 --> 00:21:48,030 And then we just rummage around. 375 00:21:48,890 --> 00:21:51,790 And we find ourselves the virtual channel setup code. 376 00:21:52,310 --> 00:21:54,590 SSH session 2 open, if you're wondering. 377 00:21:55,350 --> 00:21:57,030 And then we just go ahead and patch it. 378 00:21:57,510 --> 00:21:59,870 So instead of talking to the user, it talks to us. 379 00:22:07,720 --> 00:22:09,080 And then we run it. 380 00:22:17,010 --> 00:22:19,850 And then we just put everything back like nothing ever happened. 381 00:22:20,850 --> 00:22:23,690 Except that the shell just popped out my netcat. 382 00:22:26,510 --> 00:22:27,230 Hehehe. 383 00:22:31,510 --> 00:22:35,790 So yeah, this is, I like to think, this is the sort of thing that your mother warns you about, right? 384 00:22:36,770 --> 00:22:38,350 Hackers, we're sneaky. 385 00:22:38,370 --> 00:22:39,090 Sneaky. 386 00:22:39,590 --> 00:22:41,190 Well, one of you guys is sneaky. 387 00:22:41,190 --> 00:22:42,610 The guy earlier on, yeah. 388 00:22:43,010 --> 00:22:43,690 Yeah. 389 00:22:44,570 --> 00:22:49,590 Right, we don't just install LK4 anymore, you know, just trojan ourselves LS and stuff, right? 390 00:22:49,750 --> 00:22:50,950 That's kind of boring. 391 00:22:51,330 --> 00:22:54,610 And we don't install BNC, because who cares about ISE, that's right. 392 00:22:54,610 --> 00:22:55,190 That's crap. 393 00:22:56,630 --> 00:23:00,530 Except the older ones get caught there, they're always running egg drop bots and crazy shit like that. 394 00:23:01,830 --> 00:23:07,190 And yeah, good hackers, a little bit of creativity here and there, maybe they'll do something new and interesting like jack your SSH connections. 395 00:23:08,030 --> 00:23:11,390 And if you hire some pen testers, and they're good, maybe they'll do it too. 396 00:23:16,390 --> 00:23:19,910 So all we're really doing here, it's just automated debugging, right? 397 00:23:19,970 --> 00:23:22,210 It's not crazy, it's not rocket science, right? 398 00:23:22,470 --> 00:23:28,630 And of course, if you give me a debugger, and one of your processes that happens to be doing something important, of course I can fuck with it, right? 399 00:23:28,630 --> 00:23:30,450 That's normal, that's what debuggers do. 400 00:23:30,650 --> 00:23:32,730 And humans with debuggers can do sneaky things. 401 00:23:33,610 --> 00:23:36,390 But what we really want, is we want to automate it, right? 402 00:23:37,470 --> 00:23:43,290 We want the sneakiness of a human, and the speed and portability of a script. 403 00:23:44,630 --> 00:23:46,190 So that's what we do. 404 00:23:47,410 --> 00:23:53,630 So we're using Python, we're using GDB, gluing them together, and we've come up with, effectively, an automated debugging toolkit. 405 00:23:53,630 --> 00:23:54,230 Of 406 00:23:57,520 --> 00:24:08,880 course, one of the downsides about this, and if you've done any binary reverse engineering, is that debugging binaries, when you don't have any symbol information, is not really debugging, right? 407 00:24:08,880 --> 00:24:10,400 It's not fun anymore. 408 00:24:10,800 --> 00:24:15,860 So you have to do a bunch of tricks that normal reverse engineers, people who are doing binary analysis, have to do. 409 00:24:15,860 --> 00:24:17,940 And we'll talk a little bit about that in a second. 410 00:24:23,400 --> 00:24:25,880 So yeah, the nitty-gritty implementation details. 411 00:24:25,880 --> 00:24:27,760 Write a little bit about Python, about GDMMI. 412 00:24:27,760 --> 00:24:34,720 One of the things we have to do is we have to find a safe place that we're going to stop the program and kind of mess with its execution flow. 413 00:24:34,720 --> 00:24:39,520 Because obviously we can't just go wildly executing code in its memory space and hope it's going to work. 414 00:24:40,700 --> 00:24:44,560 And then we have to find the code we're going to run, we have to execute that code. 415 00:24:45,100 --> 00:24:47,180 Or we have to inject some code there first, obviously. 416 00:24:47,320 --> 00:24:48,640 And then we have to put it all back again. 417 00:24:48,640 --> 00:24:56,720 And of course, what I'm discussing is in specific reference to my SSH jackup, but it's equally applicable to anything that you're doing this sort of stuff to. 418 00:24:56,720 --> 00:24:59,680 And we'll talk about a few of the other interesting things you could do later. 419 00:25:04,120 --> 00:25:09,160 So yeah, gdb is the GNU debugger, for those of you who aren't familiar with it. 420 00:25:10,080 --> 00:25:11,640 I'm sure you've heard of Richard Stallman, right? 421 00:25:11,640 --> 00:25:13,960 He writes some good stuff, one of them happens to be a debugger. 422 00:25:13,960 --> 00:25:14,800 It's pretty cool. 423 00:25:15,820 --> 00:25:18,420 And gdbmi is its programmatic interface. 424 00:25:19,260 --> 00:25:20,800 Gdbmi is actually pretty suck. 425 00:25:20,800 --> 00:25:22,820 It's about half implemented, but it's good enough. 426 00:25:23,900 --> 00:25:26,700 So yeah, I went ahead and just wrote some Python bindings for it. 427 00:25:27,240 --> 00:25:31,620 Implements pretty basic functionality, but enough to get the job done, right? 428 00:25:37,510 --> 00:25:41,470 So the SSH client, as you normally use it, is single threaded. 429 00:25:41,590 --> 00:25:44,550 It doesn't expect to be running other code in the middle of other code. 430 00:25:45,570 --> 00:25:52,770 So yeah, and there's all sorts of kind of nasty global data structures and arrays of function pointers and shit like that, right? 431 00:25:52,770 --> 00:25:56,090 So we have to be a little careful about what we're doing. 432 00:25:56,170 --> 00:25:59,490 It's also completely asynchronous. 433 00:25:59,490 --> 00:26:03,990 So when you, for example, when we ask for that virtual channel, it doesn't get set up right there. 434 00:26:04,030 --> 00:26:12,210 It goes in a queue with a list of packets that have to be sent to set it up and there's a whole kind of state machine that models how the SSH client interacts with the server. 435 00:26:12,330 --> 00:26:13,590 So we have to be kind of careful. 436 00:26:14,210 --> 00:26:16,710 So we have to find the safe place where we can run our code. 437 00:26:16,710 --> 00:26:23,270 And what you're aiming for in the choice of a safe place is really minimal deviation from the normal operation of the code. 438 00:26:23,270 --> 00:26:30,670 And funnily enough, right, that happens to be in the middle of the main line, of course, around the select call because that's where everything branches from. 439 00:26:30,670 --> 00:26:36,110 So we read the findSource, I find the select call, I decide that's probably a good place. 440 00:26:37,450 --> 00:26:43,590 So we ptrace attach, we stop the process, we drop a breakpoint in that safe place, and we let it run until it comes back. 441 00:26:44,570 --> 00:26:45,570 Just like that. 442 00:26:53,280 --> 00:26:54,820 But where is select? 443 00:26:54,820 --> 00:26:57,620 Normally, right, normally if you're debugging something you just go, hey, gdb where select? 444 00:26:57,740 --> 00:26:59,260 And it goes, oh, yeah, over there. 445 00:26:59,340 --> 00:27:00,020 It's all good. 446 00:27:00,020 --> 00:27:04,780 But we don't have any symbol information so we have to do a little, you know, work backwards. 447 00:27:04,860 --> 00:27:06,740 And this technique is very well understood. 448 00:27:06,740 --> 00:27:07,980 Everyone does this sort of thing. 449 00:27:09,340 --> 00:27:10,600 So where does select come from? 450 00:27:10,600 --> 00:27:11,380 It comes from libc. 451 00:27:11,380 --> 00:27:12,260 So how does it get in there? 452 00:27:12,260 --> 00:27:13,960 Well, the loader puts it there. 453 00:27:14,860 --> 00:27:15,420 Where does it put it? 454 00:27:15,420 --> 00:27:16,980 It dynamically links it into address space. 455 00:27:16,980 --> 00:27:18,720 So we ask, where do you dynamically link it? 456 00:27:18,720 --> 00:27:20,180 It says over here, and that's all good. 457 00:27:24,560 --> 00:27:28,660 And then, you know, we have to rummage around in the global offset table. 458 00:27:29,080 --> 00:27:30,320 Find it in there. 459 00:27:35,440 --> 00:27:39,540 The ELF procedure linkage table, another exciting piece of the ELF format. 460 00:27:44,740 --> 00:27:50,580 And then we rather boringly rummage through the code segment until we find a piece of code that calls that PLT entry. 461 00:27:50,580 --> 00:27:54,220 In this case, actually, it's quite easy because there is only one call to select in the whole damn binary. 462 00:27:54,220 --> 00:27:57,540 So we can put a breakpoint right in the middle of the ELF PLT. 463 00:27:57,540 --> 00:27:58,160 Save me a step. 464 00:27:58,160 --> 00:27:58,720 Nice. 465 00:27:59,760 --> 00:28:01,380 So yeah, now we've found select. 466 00:28:08,820 --> 00:28:10,560 So where are we going to put our evil code? 467 00:28:11,740 --> 00:28:22,560 Well, we're going to go and patch SSH session 2 open, which is the piece of code responsible for setting up a new virtual channel and asking the server to connect something to the NBR TCP socket, or in our case, a shell. 468 00:28:24,180 --> 00:28:25,860 Still no debug symbols, of course. 469 00:28:26,000 --> 00:28:27,960 Fortunately for us, there's a unique error string in there. 470 00:28:27,960 --> 00:28:30,200 It happens to bitch about the dupe failing. 471 00:28:30,200 --> 00:28:32,160 And that's the only occurrence of that string in the binary. 472 00:28:32,160 --> 00:28:34,860 So we rummage around, we find it in the read-only data section. 473 00:28:36,880 --> 00:28:39,120 And walk the code segment looking for calls to that, right? 474 00:28:39,120 --> 00:28:40,960 Now we know roughly where we are in this function. 475 00:28:40,960 --> 00:28:41,680 Nice and easy. 476 00:28:48,110 --> 00:28:50,130 So yeah, the evil code itself, right? 477 00:28:50,230 --> 00:28:54,030 It's going to overwrite the first half of the virtual channel setup code. 478 00:28:54,890 --> 00:28:58,190 We're going to save the registers, we're going to save the flags so we don't fuck things up too much. 479 00:28:58,770 --> 00:29:01,690 And then basically we're going to inject its shellcode, right? 480 00:29:01,690 --> 00:29:02,490 It looks like shellcode. 481 00:29:02,490 --> 00:29:03,350 Same sort of thing, right? 482 00:29:03,350 --> 00:29:07,870 We're going to call socket, we're going to call connect, we're going to connect it back to wherever we happen to be listening. 483 00:29:08,050 --> 00:29:12,770 And then we're going to substitute it for the file handles that it's expecting to be a normal Unix TTY. 484 00:29:14,750 --> 00:29:16,330 I like Unix, it's cool. 485 00:29:16,910 --> 00:29:19,790 I see you do that in Windows where your Winsock sockets are different from your file. 486 00:29:19,790 --> 00:29:20,830 Ah, Jesus. 487 00:29:21,730 --> 00:29:27,270 And then we're going to leave the registers set up just right so that the second half of the function runs perfectly. 488 00:29:28,650 --> 00:29:34,450 And for really no good reason at all, I'm using libc calls instead of kernel syscalls, which I could. 489 00:29:34,450 --> 00:29:35,970 It's just, you know, a bit of variety. 490 00:29:36,430 --> 00:29:37,950 Sick of kernel syscalls, very boring. 491 00:29:45,100 --> 00:29:46,880 So, why all the effort, right? 492 00:29:46,880 --> 00:29:48,900 Why do we go to so much effort to overwrite half a function? 493 00:29:48,900 --> 00:29:56,420 Wouldn't it be simpler to just have a piece of code which we've already compiled, which happens to set up virtual channels, and we'll just kind of copy it into its address space and run it, right? 494 00:29:56,420 --> 00:29:57,600 That would be a lot more straightforward. 495 00:29:58,740 --> 00:29:59,840 Yeah, it might be. 496 00:30:00,600 --> 00:30:05,640 But one of the really suck things about that is you have to link it by hand with no symbol information, right? 497 00:30:05,640 --> 00:30:07,500 Which, if you've tried, it's not fun, right? 498 00:30:07,500 --> 00:30:08,920 That's not a fun game at all. 499 00:30:09,240 --> 00:30:19,440 And so I thought maybe it would be easier to just let the bottom half of the function, which contains all the symbol references, just let it be, and inject stuff up the top to take advantage of that. 500 00:30:21,020 --> 00:30:33,460 It's particularly nasty for SSH, because it has this whole kind of, you may remember from, you know, programming classes, this data-driven metaphor which was popular kind of late 90s or something, where you have like wild arrays of function pointers and you just let the data index into them and... 501 00:30:35,420 --> 00:30:38,880 Right, that's pretty yuck to have to reverse engineer on the fly. 502 00:30:41,760 --> 00:30:44,560 It's especially tedious if you have to do it for every binary. 503 00:30:45,480 --> 00:30:53,460 In this case, we actually patch it up at runtime, to make sure that the shellcode we have will run in this particular environment. 504 00:30:53,520 --> 00:30:56,180 And you'll see, actually, it's surprisingly successful. 505 00:31:05,920 --> 00:31:06,700 So what do we do? 506 00:31:06,700 --> 00:31:09,220 Well, we work backwards from that unique Duke error message we found. 507 00:31:09,220 --> 00:31:10,940 We find the appropriate place at the top of the function. 508 00:31:10,940 --> 00:31:13,780 We just kind of walk up until we see a function preamble. 509 00:31:14,860 --> 00:31:20,040 And then we learn a few bits and pieces, like how big the local stack is, and we patch in the command line parameters so it's user-friendly. 510 00:31:20,660 --> 00:31:24,440 And a few other bits and pieces that we discovered as we were, you know, doing our thing. 511 00:31:25,960 --> 00:31:27,800 And now we have a nice little piece of evil. 512 00:31:32,540 --> 00:31:34,300 So, yeah, let's wedge it in. 513 00:31:34,600 --> 00:31:36,880 Back up the instruction pointer, so we know where we were. 514 00:31:37,600 --> 00:31:39,500 Back up the old code that we're about to override. 515 00:31:39,500 --> 00:31:40,680 Stash it somewhere in memory. 516 00:31:41,920 --> 00:31:44,060 And then we go ahead and just inject our code. 517 00:31:44,060 --> 00:31:45,780 Now it's going to take care of a few bits and pieces. 518 00:31:45,780 --> 00:31:49,800 We've got a breakpoint at the end to catch it when it's finished. 519 00:31:50,980 --> 00:31:52,560 Hmm, what do you think we're going to do next? 520 00:31:59,700 --> 00:32:00,900 That guy over there, right? 521 00:32:00,900 --> 00:32:01,580 He's busy. 522 00:32:01,580 --> 00:32:02,760 He's playing hunt the wumpus, right? 523 00:32:02,760 --> 00:32:04,320 He's just doing his job. 524 00:32:05,260 --> 00:32:07,060 That wumpus, it's still going to kill him. 525 00:32:07,900 --> 00:32:09,500 And we got ourselves a shell. 526 00:32:09,500 --> 00:32:10,300 Just like that. 527 00:32:10,400 --> 00:32:10,960 Transparent. 528 00:32:10,960 --> 00:32:12,400 The user doesn't even notice, right? 529 00:32:12,400 --> 00:32:14,100 He sits there running something interactive. 530 00:32:15,400 --> 00:32:18,100 Shell pops out from underneath him and he doesn't even notice. 531 00:32:18,980 --> 00:32:20,140 Sucks for him, huh? 532 00:32:29,160 --> 00:32:31,780 So maybe you're going to go home and jack yourself, right? 533 00:32:36,540 --> 00:32:37,260 So what are you going to do? 534 00:32:37,280 --> 00:32:38,080 How are you going to do it? 535 00:32:38,140 --> 00:32:42,240 How are you guys going to go home and hijack yourself some action? 536 00:32:43,180 --> 00:32:43,940 Well, it's pretty straightforward. 537 00:32:43,940 --> 00:32:49,980 Well, what I did, and you don't have to kind of do what I did, of course, is I wrote the hijack code in C first. 538 00:32:49,980 --> 00:32:50,720 Makes it nice and easy. 539 00:32:50,740 --> 00:32:51,520 Compiled it up. 540 00:32:51,740 --> 00:32:57,200 I compiled it actually directly into SSH because I wanted to prove that you could have two shell sessions down in SSH. 541 00:32:57,200 --> 00:32:58,220 And you can. 542 00:32:58,540 --> 00:33:07,140 So I hooked it up like a magic keystroke and you smack the escape tilde, or whatever the hell it is, and bring up the command prompt and open me a shell, please, and it gave me one. 543 00:33:07,200 --> 00:33:08,360 Just to prove the point. 544 00:33:10,280 --> 00:33:13,620 And then, of course, the compiler had conveniently generated most of my shell code for me. 545 00:33:13,620 --> 00:33:15,060 Gee, that's so hard. 546 00:33:15,140 --> 00:33:16,160 Glad I bought the book. 547 00:33:17,620 --> 00:33:21,060 And then I went ahead and implemented hijacking for a binary that had debug symbols. 548 00:33:21,060 --> 00:33:21,760 Make it nice and easy. 549 00:33:21,760 --> 00:33:26,140 Just to prove that I get the code in and out of memory, in and out of the half of the function, nice and easily. 550 00:33:31,080 --> 00:33:39,200 And then the really suck bit, which is you build a list of symbols you're going to need to find and you come up with a strategy to find them and then you actually have to go ahead and write code to do it. 551 00:33:40,300 --> 00:33:41,540 And then, ooh, look, jack your friends. 552 00:33:41,540 --> 00:33:42,200 Fun and profit. 553 00:33:43,440 --> 00:33:49,460 And then, if you're really nice, package it up for the security consultants, put some 3D, some spinny round, you know. 554 00:33:53,160 --> 00:33:55,000 Maybe do it in Flash, I don't know. 555 00:33:59,930 --> 00:34:01,110 A few bits and pieces, right? 556 00:34:01,110 --> 00:34:02,510 The things that didn't fit in elsewhere. 557 00:34:02,950 --> 00:34:05,650 Think about how much you use SSH, right? 558 00:34:06,070 --> 00:34:07,610 You use it for SCP. 559 00:34:07,650 --> 00:34:08,650 You use it for CVS. 560 00:34:08,650 --> 00:34:10,650 You pipe stuff over SSH all the time. 561 00:34:10,650 --> 00:34:17,310 You have backup push, you have some CPIO, or whatever other home roll backup solution you're using on Unix because you can't find a decent one. 562 00:34:19,110 --> 00:34:20,350 Yeah, it gets around, right? 563 00:34:20,350 --> 00:34:21,290 There's a lot of it. 564 00:34:21,730 --> 00:34:23,610 And, yeah, this does work over SCP. 565 00:34:23,850 --> 00:34:26,130 And, yeah, it does work over stuff over SSH. 566 00:34:26,130 --> 00:34:28,470 You know, there's a few little wrinkles, but it works just fine. 567 00:34:29,730 --> 00:34:32,110 Actually, the code on your CD doesn't work just fine. 568 00:34:32,110 --> 00:34:33,950 The stuff I have right now does. 569 00:34:34,370 --> 00:34:39,310 And it'll be on, I guess, on blackhat.com or Defcon or wherever they put this stuff after I've finished. 570 00:34:39,310 --> 00:34:40,370 But, yeah, so, yeah, it does. 571 00:34:40,370 --> 00:34:41,990 It jacks SCP just fine. 572 00:34:43,670 --> 00:34:50,870 You'll notice in the client, you can hit tilde and I think it's hash or something and it brings up a list of the open virtual channels you have. 573 00:34:50,870 --> 00:34:51,790 Does it show up in that list? 574 00:34:51,790 --> 00:34:52,970 Yeah, it does, actually. 575 00:34:53,310 --> 00:34:57,110 How many of you knew you could list the virtual channels open with tilde and hash? 576 00:34:58,030 --> 00:34:59,070 One, one. 577 00:34:59,070 --> 00:35:00,190 Horns, thank you. 578 00:35:02,370 --> 00:35:04,710 But, of course, that's the client that's listing it, so you want to go patch that? 579 00:35:04,710 --> 00:35:05,710 Sure, no problem. 580 00:35:06,510 --> 00:35:07,950 And what happens when they log out? 581 00:35:07,950 --> 00:35:18,850 Well , anyone who's used port forwarding, right, you know what happens when you've got an open shell, you've got a port forward as well, you're using the port forward to, you know, look at GoPorn or whatever, right, and you log out, right, you haven't finished looking at the GoPorn, 582 00:35:18,850 --> 00:35:19,670 the connection stays open. 583 00:35:19,670 --> 00:35:21,110 Great, well, the same thing happens here. 584 00:35:21,510 --> 00:35:31,610 So, you're SCPing, your SCP takes 30 seconds, I happen to catch it in time, run a shell over it, your SCP will stay running once it's finished copying so that I can do some hacking, play Hunt the Wampus. 585 00:35:33,650 --> 00:35:35,330 And how does it, well, how well does it work? 586 00:35:35,330 --> 00:35:39,990 Well, uh, at the moment, uh, any open SSH3-ish it should work on. 587 00:35:40,330 --> 00:35:47,750 Um, it's known to work on, on the out of the box Stephen Sarge RHEL3, RH9, it works on Slack, uh, Slackware as well, 9.1. 588 00:35:48,030 --> 00:35:50,870 Uh, it doesn't work on SUSE because their compiler is just retarded. 589 00:35:51,050 --> 00:36:04,950 Um, I, I work with a guy who used to work at SUSE on their, on their AMD64 stuff and they, they got paid by AMD to write loads of extra optimizations for AMD64 and then they went and back ported them over to Intel and now the compiler just generates code that's so wildly broken. 590 00:36:05,110 --> 00:36:08,250 Right , I, I can't, I look at it, right, I can't believe it even executes. 591 00:36:08,270 --> 00:36:11,050 Right, I, I've seen it miscompile, like, really basic stuff. 592 00:36:11,050 --> 00:36:14,830 Anyway, so, it doesn't work on SUSE, right, uh, ah... 593 00:36:15,790 --> 00:36:25,770 I, I'll get round to it, right, I'll probably just write some, some one-off custom code that's gonna work on SUSE because the, the magic heuristic stuff that works on everything else doesn't work on their compiler. 594 00:36:26,990 --> 00:36:28,050 Silly SUSE. 595 00:36:35,560 --> 00:36:41,040 Also, it's also worth mentioning, I guess, uh, Python 2.2, 2.3, 2.4, it's known to work with. 596 00:36:41,040 --> 00:36:44,000 2.1, it ought to work, but I haven't tested on 2.1. 597 00:36:44,000 --> 00:36:47,460 Anything older than that you're probably, uh, you know, there's a few bits and pieces that are broken. 598 00:36:47,720 --> 00:36:50,900 Um, GDB, I haven't noticed any version it doesn't work with yet. 599 00:36:50,980 --> 00:36:53,200 Uh, it's a pretty straightforward text interface. 600 00:36:54,860 --> 00:36:58,380 Now, if you'll indulge me, a brief, uh, brief tangent into anti-forensics. 601 00:36:58,380 --> 00:37:06,000 Now, uh, those of you at, who are at Black Hat, uh, or, uh, RuxCon last year may have seen, uh, the Grugs talk on anti-forensic stuff. 602 00:37:06,000 --> 00:37:07,880 I don't know if he was doing it at DefCon, was he? 603 00:37:07,880 --> 00:37:08,320 No? 604 00:37:08,600 --> 00:37:09,120 No. 605 00:37:10,460 --> 00:37:11,280 It's very interesting. 606 00:37:11,280 --> 00:37:14,840 Well, I saw it at RuxCon, uh, two years ago, or a year and a half ago. 607 00:37:14,860 --> 00:37:17,660 And yes, I remember very interesting things to say about anti-forensics. 608 00:37:17,660 --> 00:37:25,960 And of course, when you're, when you're attacking systems like this, right, in the middle of the day, or when everyone's using them, it assumes that you're taking pretty basic anti-forensic precautions. 609 00:37:25,960 --> 00:37:28,160 You don't want to leave too many, too many trails. 610 00:37:29,100 --> 00:37:40,360 So yeah, I'm going to talk, uh, just a brief, you know, very brief overview of anti-forensic technique, and then how I've implemented it, uh, successfully and unsuccessfully in some places, uh, when I was using and writing the SSH jacket. 611 00:37:44,470 --> 00:37:48,730 So yeah, the most important thing, the most important thing is don't put anything on disk. 612 00:37:48,730 --> 00:37:49,710 Do it all in memory, right? 613 00:37:49,710 --> 00:37:51,810 Memory goes away when they reboot the box. 614 00:37:52,770 --> 00:37:53,190 Right? 615 00:37:53,190 --> 00:37:59,670 There's nothing on disk, there's no tripwire, there's no, nothing for them to look at with Ncase or whatever other expensive, uh, forensic products they're using. 616 00:37:59,670 --> 00:38:02,290 You know, it's like if you get swapped out the disk, you don't know well. 617 00:38:03,130 --> 00:38:05,830 But really, you want to try and keep everything in memory only. 618 00:38:06,630 --> 00:38:08,190 Uh, use local tools, right? 619 00:38:08,190 --> 00:38:12,170 These are, these are Turing-complete machines, you can write your split code in whatever's available, right? 620 00:38:12,170 --> 00:38:15,830 If you have to write a port scanner in ORC, do it, right? 621 00:38:15,890 --> 00:38:18,030 Right, if it has a Perl interpreter, great, use that. 622 00:38:18,030 --> 00:38:19,690 Right, if it has a Python interpreter , use that. 623 00:38:19,690 --> 00:38:23,990 If you're good, right, you turn up, you find what's there, and you write your tools on the spot. 624 00:38:24,630 --> 00:38:31,130 That way you don't have to go and, you know, wget magic hacksaw tarball.tar.gz from hacksaw.com, right, which is a real fucking giveaway. 625 00:38:32,050 --> 00:38:33,730 You don't want them to know what you did. 626 00:38:35,490 --> 00:38:37,890 And yeah, try to make new network connections, right? 627 00:38:37,890 --> 00:38:42,970 You don't want anything for their intrusion detection or cough prevention systems to spot. 628 00:38:45,090 --> 00:38:48,730 And you don't want them sniffing your traffic and kind of replaying it later and figuring out what the hell you did. 629 00:38:49,790 --> 00:38:53,310 So yeah, reuse your existing connection, hide in plain sight, use encryption. 630 00:39:00,610 --> 00:39:02,270 So, how well do I do? 631 00:39:02,270 --> 00:39:04,950 Well, we do use general purpose tools, right? 632 00:39:04,950 --> 00:39:06,830 GDB is pretty general purpose. 633 00:39:06,910 --> 00:39:11,150 I mean, if you turn up on a box that doesn't have GDB, maybe it's not such a giveaway to go ahead and install it, right? 634 00:39:11,150 --> 00:39:12,210 I mean, maybe you're just helping, right? 635 00:39:12,210 --> 00:39:14,010 You're just doing a bit of administration for them. 636 00:39:14,670 --> 00:39:17,830 Some of the best run Windows boxes I've seen are admin by Russian hackers. 637 00:39:19,950 --> 00:39:20,470 Remotely, right? 638 00:39:20,470 --> 00:39:21,750 They don't even have to go on site to reboot it. 639 00:39:21,750 --> 00:39:22,450 How nice. 640 00:39:23,810 --> 00:39:24,450 So yeah, we do. 641 00:39:24,450 --> 00:39:25,510 We use general purpose tools. 642 00:39:25,510 --> 00:39:27,170 We use the Python interpreter, we use GDB. 643 00:39:27,170 --> 00:39:28,130 That's nice. 644 00:39:29,130 --> 00:39:32,170 SSH is encrypted, so the packet is not much use. 645 00:39:33,350 --> 00:39:38,690 And yeah, our new shell that's going across the existing SSH connection, right, there's nothing new there. 646 00:39:38,690 --> 00:39:42,810 There's no new connection for any intrusion detection or things to spot. 647 00:39:42,930 --> 00:39:45,030 Not very interesting. 648 00:39:45,090 --> 00:39:45,810 That's good. 649 00:39:45,810 --> 00:39:47,350 We're looking okay so far. 650 00:39:51,720 --> 00:39:52,680 Where do I start? 651 00:39:52,680 --> 00:39:56,460 Well, Python code lying around disk. 652 00:39:56,460 --> 00:39:57,200 Not very elegant, right? 653 00:39:57,200 --> 00:40:00,780 I've got to copy the script across and then I've got to go Python, SSH, yada, yada, yada. 654 00:40:00,900 --> 00:40:01,740 That's not very nice. 655 00:40:01,740 --> 00:40:03,480 There's no script lying around for them to look at. 656 00:40:03,480 --> 00:40:06,740 Even Python bytecode lying around, you can turn that back into code pretty easily. 657 00:40:07,980 --> 00:40:16,100 And of course the other problem is we have that connection coming from the SSH client out to our network, which has a TCP connection with the shell on the other end, right? 658 00:40:16,100 --> 00:40:16,960 That's a new connection. 659 00:40:16,960 --> 00:40:17,940 That's not so nice. 660 00:40:19,160 --> 00:40:20,780 And yeah, it's in the clear as well. 661 00:40:20,860 --> 00:40:25,780 So obviously if I were a cunning man, if I were a patient man, I would have implemented SSH connect back, right? 662 00:40:25,780 --> 00:40:27,720 Because all the code in the client is there, right? 663 00:40:27,860 --> 00:40:30,400 I haven't done that yet, sorry. 664 00:40:31,480 --> 00:40:33,800 But if you happen to turn up over SSH, right? 665 00:40:33,800 --> 00:40:39,700 So say it's the second box you've routed in a row, and you just came in across an SSH connection, why don't you set up a port for it? 666 00:40:40,340 --> 00:40:41,380 Bring it back down like that. 667 00:40:41,380 --> 00:40:42,480 That would be a pretty good idea. 668 00:40:47,020 --> 00:40:48,820 So let's not leave our scripts lying around on disk. 669 00:40:48,820 --> 00:40:52,400 How about we just go ahead and load that Python directly into memory? 670 00:40:52,400 --> 00:40:53,180 All good, right? 671 00:40:54,000 --> 00:40:58,740 So let's just run up a Python interpreter, ask it to read from Samjin, and execute it. 672 00:40:59,280 --> 00:41:09,660 And then locally, we'll take the Python script we want to run locally, we'll compile it up, we'll turn it into Python, we'll compress it and paste it into work, we'll send it across the wire, maybe with a little loader at the other end to unpack it and run it. 673 00:41:10,940 --> 00:41:12,580 And then send it across your shell. 674 00:41:13,700 --> 00:41:14,400 That's all good, right? 675 00:41:14,400 --> 00:41:15,340 Nothing on disk. 676 00:41:16,000 --> 00:41:17,740 That sound straightforward to anybody? 677 00:41:18,320 --> 00:41:19,580 Pretty straightforward to me, right? 678 00:41:19,580 --> 00:41:23,300 It's just three lines right there, and then a little bit of jiggery-pokery. 679 00:41:28,220 --> 00:41:29,580 I know you want a script. 680 00:41:29,600 --> 00:41:31,120 You want scripts, don't you, right? 681 00:41:31,120 --> 00:41:33,120 OK, I wrote a script for you, make it nice and easy. 682 00:41:33,880 --> 00:41:35,120 It does all of the above, right? 683 00:41:35,120 --> 00:41:44,880 So now if we load, we pass in a Python script, list the Python libraries we might require, mine our arguments, packs it up, sends it across, runs it, you give it a shell and a modem, it knows how to do the rest. 684 00:41:45,920 --> 00:41:48,200 And then if you're really cool, right, hack in Screen. 685 00:41:48,200 --> 00:41:49,060 Screen's really neat. 686 00:41:49,360 --> 00:41:50,900 Screen is a terminal multiplexer, right? 687 00:41:50,900 --> 00:41:51,980 So you must know Screen. 688 00:41:57,300 --> 00:42:00,680 Screen has this really cool feature called Bang. 689 00:42:01,560 --> 00:42:09,480 It'll run a local command and then it comes with other options, but it will inject the output of that local command into your remote session. 690 00:42:10,000 --> 00:42:12,700 So I sit there on Screen, I go CTRL-A and my screen escapes here. 691 00:42:12,700 --> 00:42:14,440 I go bang, bang, bang, bang, bang. 692 00:42:15,200 --> 00:42:21,740 Powerful load, SSJAC, process ID, destination host port, and it runs it on the remote machine, just like I was there. 693 00:42:24,040 --> 00:42:24,940 That's pretty cool, right? 694 00:42:24,940 --> 00:42:27,180 You can almost forget you're running it remotely. 695 00:42:27,660 --> 00:42:30,040 And obviously for your convenience, that's obviously neat. 696 00:42:36,800 --> 00:42:37,720 So what else can I do? 697 00:42:37,720 --> 00:42:38,580 What else can I do with this? 698 00:42:38,580 --> 00:42:42,380 Well, it would be nice to actually generate the shellcode on it. 699 00:42:43,220 --> 00:42:47,780 I didn't get around to writing it in Assembler yet, and other people have already written it, even in Python, right? 700 00:42:47,780 --> 00:42:52,740 It doesn't have a lot of documentation, so I read through it, but I haven't implemented anything. 701 00:42:54,200 --> 00:42:56,540 Yeah, pure Python debugger, so that would be cool. 702 00:42:57,420 --> 00:42:58,460 Aha! 703 00:42:58,920 --> 00:43:05,160 What other protocols have virtual channel infrastructures and are used on clients? 704 00:43:05,160 --> 00:43:05,740 Lots. 705 00:43:05,740 --> 00:43:08,380 Especially poorly-packed senior clients. 706 00:43:09,020 --> 00:43:09,800 Hmm. 707 00:43:10,780 --> 00:43:12,860 MS-IDP, Citrix. 708 00:43:13,520 --> 00:43:18,040 I've already had a chat with some people who like hacking on Citrix, and they're pretty keen on this idea. 709 00:43:18,360 --> 00:43:26,420 Citrix has got a virtual channel infrastructure for running, you know, drive mapping, and all sorts of things. 710 00:43:26,420 --> 00:43:26,740 Yeah . 711 00:43:28,480 --> 00:43:29,700 And all manner of things, right? 712 00:43:29,700 --> 00:43:35,420 I mean, once you have an ordinated programmatic debugging toolkit, you start seeing all the things you can just beat with that hammer, right? 713 00:43:35,420 --> 00:43:37,300 It's a really cool thing to have in your toolkit. 714 00:43:38,140 --> 00:43:42,600 You can start, you know, you can have it disassemble stuff on the fly, figure stuff out, and patch it, right? 715 00:43:42,600 --> 00:43:43,280 All programmatically. 716 00:43:43,280 --> 00:43:43,860 It's cool. 717 00:43:50,770 --> 00:43:55,370 Right, now, now, being as it is that, you know, I'm obviously some sort of long hair, right? 718 00:43:55,370 --> 00:43:59,350 And I'm from the Antipodes, I'm not very fashionable, right? 719 00:43:59,350 --> 00:44:01,310 I'm kind of stuck in the 80s and shit, right? 720 00:44:01,310 --> 00:44:04,690 So, I'm not sure if this is still fashionable, right? 721 00:44:04,690 --> 00:44:06,530 Because, blaming Theo for everything. 722 00:44:07,170 --> 00:44:08,550 Is that still fashionable? 723 00:44:09,110 --> 00:44:09,590 Yeah? 724 00:44:09,590 --> 00:44:10,370 Yeah, okay. 725 00:44:10,810 --> 00:44:13,390 Unfortunately for me, it's not Theo's fault. 726 00:44:13,390 --> 00:44:14,170 Sorry. 727 00:44:14,930 --> 00:44:17,110 It's actually a feature of all things. 728 00:44:17,130 --> 00:44:23,270 The SSH protocol specification says it's just fine to have multiple channels on the other end. 729 00:44:23,270 --> 00:44:25,190 That's a requirement, right? 730 00:44:25,190 --> 00:44:26,210 That's pretty cool, huh? 731 00:44:26,210 --> 00:44:28,350 I hadn't really thought about it before, right? 732 00:44:28,350 --> 00:44:29,350 My SSH client, right? 733 00:44:29,350 --> 00:44:31,830 If I was to say, get a shell, that's all there is to it, right? 734 00:44:32,030 --> 00:44:34,790 But now imagine like a graphical client, like a CAD. 735 00:44:39,200 --> 00:44:40,980 So yeah, it's a feature, right? 736 00:44:41,040 --> 00:44:44,420 If you could get a shell from a server back to the client, right? 737 00:44:44,440 --> 00:44:45,360 That would be a bug. 738 00:44:45,520 --> 00:44:46,760 Unfortunately, Theo took care of that. 739 00:44:46,760 --> 00:44:47,680 He's a good dude. 740 00:44:48,120 --> 00:44:49,580 Same with unsolicited port forwarding. 741 00:44:49,580 --> 00:44:55,720 If you could port forward from a server back to the client without it asking you to do so, that would be a bug also. 742 00:44:55,820 --> 00:44:57,280 But no, I've taken care of that. 743 00:44:57,280 --> 00:45:00,000 I haven't looked at any other SSH implementations. 744 00:45:00,280 --> 00:45:07,360 Because SSH is, you know, the client and the server are very, very similar in functionality, they both have to deal with this multiplexing and multiplexing. 745 00:45:07,780 --> 00:45:13,940 Generally, most people write that code once, right, and use it in both a client and a server implementation, so you have to be pretty careful. 746 00:45:13,940 --> 00:45:24,000 So if I were you, and you're using a funny SSH server, one of those crazy Cisco ones, I don't know, yeah, I might have a look at that. 747 00:45:24,280 --> 00:45:25,600 It might work, wouldn't it? 748 00:45:26,680 --> 00:45:28,680 But anyway, it's not OpenSSH's fault. 749 00:45:28,680 --> 00:45:29,960 Please don't send me a bug report. 750 00:45:29,960 --> 00:45:30,640 It's not a bug report. 751 00:45:30,640 --> 00:45:31,500 Blame me instead. 752 00:45:31,500 --> 00:45:36,100 I don't want Theo to, you know, come and bring me up and harass me, kick my ass or whatever. 753 00:45:37,140 --> 00:45:38,380 But yeah, OpenSSH is cool. 754 00:45:38,380 --> 00:45:39,580 For the record, OpenSSH is cool. 755 00:45:39,580 --> 00:45:40,220 I like it. 756 00:45:40,220 --> 00:45:42,080 It's a big fat loaded piece of crap, but I like it. 757 00:45:42,080 --> 00:45:43,060 I use it every day. 758 00:45:50,120 --> 00:45:50,800 Mitigation technique. 759 00:45:50,800 --> 00:45:52,040 Responsible slide, right here. 760 00:45:52,260 --> 00:45:53,380 Don't get rooted. 761 00:45:53,820 --> 00:45:54,580 Nice and easy. 762 00:45:55,260 --> 00:45:59,740 You could, if you were cunning, patch ptrace, maybe, so you couldn't do it as a user. 763 00:45:59,740 --> 00:46:02,460 I suppose there's patches around to do that already. 764 00:46:03,120 --> 00:46:08,960 One of the things that's not on there is you could, the SSH agent, they try to prevent this attack by making it set GID. 765 00:46:09,040 --> 00:46:11,880 I don't know that making your SSH client set GID is a good idea. 766 00:46:11,880 --> 00:46:14,660 I mean, there's probably all sorts of other things that would go horribly wrong if you did that. 767 00:46:15,880 --> 00:46:26,740 One of the most important things that you can actually do to help yourself is if you're running restricted, if you're running trust relationships using keys between hosts, there's a bunch of tools you can use to restrict what those keys can be used for. 768 00:46:26,740 --> 00:46:32,400 You can restrict what commands are executed, you can restrict where port forwarding is allowed, you can restrict x-forwarding, all that sort of thing. 769 00:46:32,400 --> 00:46:32,780 Use it. 770 00:46:32,780 --> 00:46:33,280 Use it. 771 00:46:33,280 --> 00:46:33,920 Really do. 772 00:46:34,720 --> 00:46:38,060 Oh yeah, and then Steve Gibson, he had some really good ideas about those wall sockets right there. 773 00:46:38,060 --> 00:46:38,440 They're bad. 774 00:46:38,440 --> 00:46:39,220 Sorry, the buggers. 775 00:46:39,460 --> 00:46:42,360 I think we should get him in charge of the anti-bugger movement. 776 00:46:47,460 --> 00:46:48,240 Yeah, why do you care? 777 00:46:48,240 --> 00:46:49,440 It's just a party trick, right? 778 00:46:49,440 --> 00:46:51,080 This is just like eroding the farms. 779 00:46:51,080 --> 00:46:51,760 That's all, right? 780 00:46:51,760 --> 00:46:53,880 It's not wildly zero-day. 781 00:46:53,880 --> 00:46:54,760 If you get rooted, you're screwed. 782 00:46:54,760 --> 00:46:55,420 You knew that. 783 00:46:57,100 --> 00:46:57,840 Rich desktops? 784 00:46:57,840 --> 00:46:59,020 Yeah, it's a good way, right? 785 00:46:59,120 --> 00:47:03,300 Tacking desktop machines that are full of complexity is a very good way to get to well-protected servers. 786 00:47:03,300 --> 00:47:04,440 And especially willing to admins. 787 00:47:04,440 --> 00:47:07,680 Anyone running Linux on a desktop is probably looking after interesting stuff. 788 00:47:08,940 --> 00:47:11,420 And yeah, try it against RDPM or ICA. 789 00:47:11,420 --> 00:47:12,580 That could be interesting. 790 00:47:17,160 --> 00:47:18,260 Very pretty mad greets. 791 00:47:18,260 --> 00:47:19,560 There's not much of a scene in New Zealand. 792 00:47:19,560 --> 00:47:20,340 There's only a few of us. 793 00:47:20,340 --> 00:47:20,960 We all drink beer. 794 00:47:20,960 --> 00:47:25,020 There's like, let's run through tables the whole scene, but yeah, I thought I'd better say hi to them. 795 00:47:25,020 --> 00:47:27,920 And GadooSpice, he gave me my first security hack two years ago. 796 00:47:28,740 --> 00:47:29,740 He's a good dude. 797 00:47:30,660 --> 00:47:33,280 Oh yeah, and there were a few talks about this one that were interesting. 798 00:47:33,340 --> 00:47:34,200 The Elf. 799 00:47:34,300 --> 00:47:36,080 Sean Flowers Elf Encrypter, right? 800 00:47:36,080 --> 00:47:37,140 That's some crazy shit. 801 00:47:37,140 --> 00:47:37,680 I gotta read that. 802 00:47:37,680 --> 00:47:43,500 It's like, symbiotic p-tracing processes that take memory in and out of each other and unencrypt it. 803 00:47:43,500 --> 00:47:44,040 It's crazy. 804 00:47:44,040 --> 00:47:44,780 Go look at it. 805 00:47:49,940 --> 00:47:51,860 Apparently, I'm out of time so you don't get to shred me. 806 00:47:52,060 --> 00:47:52,700 Sorry. 807 00:47:52,940 --> 00:47:56,720 There was also a demo that I'm getting the head signal. 808 00:47:58,140 --> 00:47:59,700 If you want to see it, come see me afterwards. 809 00:47:59,700 --> 00:48:01,820 We'll do it on a box that doesn't look like a screensaver. 810 00:48:02,880 --> 00:48:03,960 Alright, thank you guys!