start	end	text
4100	5340	Here's my plan, right?
5700	8860	We're going to deliver our squirt virus in the email, right?
8860	12360	It's going to live on their mail server until the admin's clever enough to read it.
13180	15140	At that point, we're going to squirt his time.
15240	16300	Mmm, pretty cool plan.
17520	20280	Connect back shellcode out to us, listening on the public internet.
21020	24160	We're going to escalate some privileges, drop out a nice and prepared rootkit.
24880	27340	And then from there, we'll throw him his SSH up good and proper,
27340	30140	sniff his keystrokes, wait for the logs in the database server.
30160	31660	Yeah, it's all good, right? All good.
43520	45440	Those didn't look like email addresses to me.
46000	47320	All right, anyway, so.
47460	50240	Got a brand new Pine 0-8, run it through our mail spoofer,
50240	51720	send him something he's got to read, right?
51720	53960	Now that looks like a compelling piece of email to me.
54980	57440	And we fire up our netcap, and we hang on.
57980	62080	If you notice, for convenience, that's on 41327 instead of 443, but never mind.
63460	66740	And look at that. Shell. Right, find squirt, work perfectly.
67380	69720	Yep. You were the admin? Mm-hmm.
69720	71320	Yeah, he's a clever man, nice username.
72360	74260	Oh, shit, where did Pine go?
74300	74840	Nah.
75860	77620	Ah, look, damn thing dropped core, right?
77620	80520	He's probably going to notice that. He's sitting there, using his Pine, and bam, all gone.
80520	81300	Ah, shit.
89260	91900	So at this point, you know, he's probably going to spot us.
91900	95020	Hacksaw.com, pretty poor choice of reverse, I now admit.
97260	99200	And, ah, yeah, look at that, nice.
99200	101740	Starter Club Shell, he's going to start running around where the core is.
101940	102760	Ah, shit.
103600	110840	So right about now, if you're a clever man, you know, if you're a wise man,
110840	112980	it's time to drop carrier, right?
113540	116740	Plus, plus, plus, ADHMort, just get the hell out of here, right?
116740	118540	Things have gone horribly wrong.
119540	120120	Cool.
120740	125660	Apparently pear shape doesn't translate well into North American English, you know, I'm terribly sorry about that.
127820	130880	But yeah, did you see that? In the PSR I put back there?
136930	137290	No?
137290	141130	Look, look, look, SSH session, root, and then nameserver.
141850	143270	That sounds pretty good, huh?
143270	144090	Pretty good.
144510	145390	I like that.
152030	153790	If I drop carrier now, right?
153810	155850	I'm never going to get a chance like that, right?
156690	161890	Man, I really, really, really wish there was a way I could get to the other end of that SSH session.
161890	163570	It's authenticated, it's already root, right?
163570	165570	I don't even have to goddamn root the box.
165790	168430	All I gotta do is get down that SSH session, man.
168970	170310	If only there was a way.
175670	177630	Like fucking duh there is.
178330	180050	Which is why I'm standing here.
182350	186670	So, yeah, I smacked a few magic keystrokes, a little bit of this, a little bit of that, some bang.
186670	187810	Bangy-bang-bang.
188870	189910	SSH Jack.
200550	202350	Anyway, yeah, so my name's Metal Storm.
202390	203950	My mum calls me Adam.
205310	208390	I'm from New Zealand, which is why I sound a little fucked up.
209790	216010	For those of you who are not familiar, it's a very small island that kind of like connects people to any city in the entire North America.
216010	220990	And, yeah, we have lots of sheep and apparently hobbits. I haven't seen any right now that aren't.
220990	224470	Let me tell you right now, there are no hobbits.
225190	226550	There's no hobbitses.
226630	228550	They don't have preciouses.
228570	229550	They don't exist.
229750	231930	Sad, sad token fanboys.
234090	236870	See, I work for a Linux integrator.
236870	241330	I don't actually do much security for a living, so I'm kind of here in a personal capacity, which is why I can say fuck.
242970	246210	In the past, I've been a corporate or security consultant.
246210	247630	I've done network engineering.
247630	248870	I've done all sorts of stuff.
256780	259780	So, right, what the fuck, what the fuck did we just do, right?
262240	265580	We saw ourselves a pretty classic intrusion, right?
266420	269320	Slightly different modus operandi than you're probably used to, right?
270140	271920	Server box was pretty well secured.
271920	277000	Instead of attacking the server directly, I decided that the best way to do it is to attack the admin's desktop
277000	278540	and then from there to the server.
279240	280280	But there's desktops, right?
280280	282580	I mean, Linux desktops just as much as Windows desktops.
282580	283920	There's a whole bunch of complexity, right?
283920	290780	We don't have clipping, but we do have, you know, lots of candy and enlightenment and things that make your desktop look real pretty.
291900	296260	And all that complexity, all that kind of intellectual candy floss that's there to just rot your brain, right?
296260	297480	That's where all the bugs are.
297660	300000	So, I want to root up someone's big Linux server, right?
300000	301200	I'm not going to go after the server.
301200	304660	It's got intrusion detection all over the place and intrusion prevention like it works.
306740	309380	I'm going to go attack the desktops, right?
309380	310400	That's where it's at.
311000	312900	And certainly people who have Linux desktops, right?
312900	314060	They're real geeky.
314240	317900	They have glasses and long hair and beauty fears and shit, right?
318000	320540	And they look after all the good stuff.
320880	322580	So, that's where you're going to go.
323360	324420	But sometimes, right?
324420	325600	Sometimes you're not perfect, right?
325600	326820	Things go wrong.
327160	328980	In that particular case, you know, we got there.
328980	329520	We got busted.
329520	330060	We dropped Cor.
330060	331080	He's going to know this.
332420	336240	So, you know, you can drop Cor like some sort of little pansy.
336400	338520	Or maybe, you know, do something a little different.
338520	339800	Just play some adaptability.
340020	340980	Something a little new.
354340	355400	When you hack something, what do you do?
355400	356060	What are your goals?
356060	371310	Well, figure out what you want to do next.
371950	374470	Very rarely do you ever, you know, just get root on the box.
374470	374810	You won't.
374810	375430	You won't.
379590	382090	So, yeah, you have to do reconnaissance, right?
382090	383890	You're usually on your way to it.
384930	386870	There's kind of another thing you could do, right?
386870	388510	You could be a good guerrilla star, right?
388510	389350	You walk in there.
389350	390070	You get what you want.
390070	391730	You get the hell out real fast.
392130	393890	And that saves you a bunch of time and effort.
394690	396030	And I'd like to explain adaptability, right?
396030	400070	That's a big difference between all you fuckers and the people they pay to do this for.
401470	402850	At least, the cheap ones anyway.
402850	403450	I don't know.
404590	415040	You have to have a really big name for root and other stuff instead of the stuff you've got.
415880	417800	Cross-host privilege escalation, right?
417800	419300	So, privilege escalation is pretty normal.
419300	420120	You have a user account.
420120	420880	You want to get some root.
420880	421520	That's good.
421520	426320	I think root on another box is just as good as root on this box most of the time, right?
427000	429140	And local root, you know, it can be a distraction.
430160	431360	You're on your way to somewhere.
431360	434520	You don't have time to sit around and root, hit a box up, and drop it.
435380	439160	You know, local vulnerabilities are easy to exploit often, right?
439160	440460	We've got a lot more information.
440460	442040	What's the version stack layout?
442040	443860	You know what we're getting ourselves into.
444320	449420	It can be kind of tempting to sit around and escalate your privileges because you feel good about it, right?
449420	450360	You know, you're achieving something.
450360	452320	You feel good, right?
452320	453720	You feel good about yourself.
455400	456660	Yeah, easy is good. I like easy.
456660	460060	But what if there was something easier than local privilege escalation?
467250	468450	Trust relationships.
469070	470790	It's kind of old school, I know.
470970	474850	We must be, what, five, six, seven years ago talking about trust relationships?
475550	477030	It's kind of old school, yeah.
477030	478510	You know, you've got cross-hosts.
478510	482150	And back when ports below 1024 were just magically rooted.
483930	487270	Back when people exported slash readwrite to the entire world.
488050	488950	That was good, right?
488950	490710	We're just a bunch of long-haired unix hippies, right?
490710	491330	We love each other.
491330	492090	It's all good.
492090	493370	We just share.
493430	494350	You don't mind this space.
494350	495450	It's your disk space.
497490	498570	It makes you feel good, right?
498590	499730	It's old school.
499730	502610	You feel like your mummy's tucking you up in bed.
502610	503490	You know, it's good.
504570	506170	But we called that hacking, right?
506170	507230	That's just embarrassing, right?
507230	507910	That wasn't hacking.
507910	509650	That was just mounting stuff.
509650	516110	How many of you watched Unauthorized Access where a simple nomad goes, like, mount?
516330	517190	And he's a hacker?
519550	520090	Sorry.
520090	522570	You're in the room, so...
527490	531870	And that's my favorite thing about trust relationships.
532650	533670	Instant gratification, right?
533670	534350	You turn up.
534350	536670	There's a trust relationship between hosts, right?
536670	537710	It's like Christmas.
537710	538250	It's good.
538250	538990	Right now.
538990	540390	You get Root on another box.
540390	541270	Or Shell on another box.
541270	542050	It's great, right?
542050	543430	It makes you feel really good.
553850	555650	Traditional trust relationships, right?
555650	562010	I call them long transient trusts for no reason other than that I'm obviously about to talk about transient trusts.
563110	565930	So that's what I'm calling traditional kind of fixed trusts.
565930	567290	Things like host trusts.
567290	569970	Things like SSH key-based trusts.
570130	574250	They're trust relationships that exist as stored authentication predictions.
574250	577410	What Bruce and I would probably call one-factor authentication.
578870	582110	Or it can be authentication based on properties of the connection.
582110	584110	The source address, the whole thing below.
584110	585190	All that sort of thing, right?
585190	588530	Just your traditional run-of-the-mill garden trust relationship.
598720	601740	And then there's trust relationships which are transient.
601740	605420	Which are trust relationships that exist only for a period of time.
605820	610700	And generally the most interesting class of those is post-authentication connections.
610700	617940	Once you've initially carried out your authentication, the remainder of that session is effectively a transient trust relationship between hosts.
619160	628840	Unless you personally authenticate every single packet you send, then you have to accept some sort of transient trust relationship between hosts.
630880	646900	Let's look at a couple of methods, the traditional methods for exploiting trust and transient trust relationships.
647200	650060	And to do so, I picked a couple of methods just out of the air.
650600	652800	How easy it's going to be to do it.
652800	654760	How sneaky it is, how stealthy.
654760	657900	How close to right the fuck now you can do it.
658200	660860	And an overall kind of feeling of feasibility, right?
660860	664220	Because an attack's no use if you're only going to be able to use it one time in a hundred.
665420	666940	So yeah, we're going to evaluate them.
666940	672100	And for the purposes of this, we're just going to assume that we've got a non-root shell on the box.
682680	685920	Right, so your traditional non-transient trusts, right?
685920	687000	It's pretty straightforward.
687000	693440	And our job is to impersonate the credentials that are used to authenticate that connection for trust.
693440	701660	Whether it be by coming through the trusted box, using stored key material like a safe trust, or by spoofing.
702140	704140	And that's pretty straightforward, right? That's easy.
704140	705100	Everyone knows that.
705720	706680	It's pretty sneaky, right?
706680	710080	No one knows that you turned up, sorted all the trust and abused it, right?
710080	711320	It's pretty damn good.
711940	713460	When? Yeah, right now, right?
713460	715480	You turn up, you find a trust, you're gone. It's all good.
716160	719400	But, overall feasibility, it's not simple, right?
719400	723100	How often do people still rely on ports being low 1024, right?
723100	725080	Outside of like bank environments or whatever.
726260	727560	Not that often, unfortunately.
727560	729680	So you don't see this, which is a pity, because I like it.
738750	746250	Right, the other interesting way to attack a transient trust relationship, a traditional way of doing it, if you will, is key log, right?
746250	754630	So during authentication, you log the user's input, either by trojaning SSH having it, listening to your keystrokes,
754630	757410	or by logging it from the keyboard or the hardware keylogger, whatever you call it, right?
757410	759770	Even shoulder surfing, right? Something old school like that.
759890	764390	So you steal the credentials, and then later on, you reuse them for your own good.
764670	765870	Right? Classic technique.
766350	767410	Easy? Hell yeah.
767890	768690	Everyone does it, right?
768690	772030	It is the standard way of getting from one box to another.
772670	774010	Right, stealthy? Sure, you do it, right?
774010	775910	You rootkit the box up, you trojan it, all good.
777230	780590	When, this is the downside of this, is you have to wait for them to log back in, right?
780590	784050	And say like in our example earlier on, right, you're about to get busted.
784250	787930	So if you now go ahead and kill their SSH client, they're not going to reconnect, right?
787930	789450	They're wondering where the fuck Pine went.
791710	793010	So yeah, that's not so good.
793010	795130	Overall feasibility though, it's a really good technique, right?
795550	796830	It's kind of the gold standard.
796830	797630	It's what everyone does.
797630	799650	You can always fall back on a keylogger, right?
800270	801150	It's all good.
809960	811000	More advanced technique, right?
811000	812100	There's a man in the middle, right?
813320	816220	Similar sort of thing, except that we impersonate the server to the client,
816220	817300	and the client to the server.
817300	819960	We sit in the middle, we grab the authentication credentials.
820040	823440	Optionally, if it's encrypted, we have a little bit of jiggery-pokey with fake certificates,
823440	825020	fake host keys, that sort of thing.
826520	830460	And then, later on, we can either sniff their connection, see what they're doing,
830460	832860	and if we're feeling particularly narked, we can take it over.
833120	836240	Now the downside of that is, of course, the user's probably going to notice.
838420	842080	So ease, yeah, it's a relatively well understood sort of thing.
842460	844680	You know, it's not wildly complicated.
844680	851540	The downside is, as people deploy PKI systems, or at least look at their host keys, which I hope you do,
852580	853600	it's not so good.
853620	855000	Stealthy, yeah, same thing, right?
855220	857800	SSH pops up, huge mongers warning, saying, you know,
857800	861060	oh look, someone has messed with your host key, this might be bad.
862200	863560	When, same problem, right?
863560	865880	We have to wait until authentication time to do it.
866420	868820	But overall feasibility, yeah, it's okay, right?
868820	869860	We can do this occasionally.
878220	879880	Ah, now this is kind of old school, right?
879880	881460	The TCP hijack attack, right?
881460	884420	You take a running, open, post-authentication connection,
884420	887540	and you bust open sequence numbers, and you hijack it, right?
887540	891300	This is old school, it's been used quite famously by Mr. Kevin Mitnick.
892320	895360	But unfortunately when you go and do it, oh yeah, the user's noticing.
895360	897860	Look at that, that does look like Shimomura, don't you think?
898140	901960	He looks pretty pissed, he's got two exclamation marks next to him.
902400	903540	That's how you tell.
904040	905820	So yeah, ease, these days, not so good.
905820	909180	People have decent, hopefully, random number sequence generation.
910440	912180	And yeah, it's not so stealthy.
912180	914860	But the plus side, right, it has all the properties we're looking for, right?
914860	916180	We can do it right now, right now.
916180	918900	Open connection, it's got the credentials we want at the other end,
918900	920360	we can go and steal it, all good.
921300	924340	But the downside is, yeah, overall feasibility, not so good, right?
924440	926820	You're going to need raw sockets, you're going to need promiscuous interface
927460	929900	to try and see the sequence numbers if you're not going to be doing it blind.
929900	932440	Doing it blind these days is not as easy as it used to be.
933480	934460	So yeah, I like it, right?
934460	937000	I'd like to be able to do this, but it's not always feasible.
945670	947390	But this is the fun one.
948350	951690	So, after we've authenticated the session,
952630	954430	we turn up on the user's box,
954430	958670	and we sneak down their running connection from inside the box,
959630	961230	and they don't notice.
961690	965030	Hmm, that sounds easy, it is.
965230	967130	It sounds stealthy, it is.
967510	970110	It sounds like you could do it right now, hmm.
971490	973870	And is it feasible? Well, the code's on your CD.
982740	984880	Say what? Yeah, hijack the application.
985180	986080	Why not, right?
986600	987720	It is slightly different, right?
987720	990780	It demands slightly different methodology, right,
990780	991840	when you're going to hack someone.
991840	994780	Normally, you hack them on a public holiday, on a weekend,
994780	996760	you know, when they're getting married, something like that.
997720	1001060	Here, what you're interested in is maximising the number of open
1001060	1003560	post-authentication sessions for you to sneak down.
1003660	1005480	So really what you want to do is you want to turn up,
1005480	1007360	during peak time, right, the middle of the day,
1007360	1009360	when everybody's right there at their desks.
1009380	1011080	And then you want to sneak in and take their route
1011080	1013920	right out from under them without them noticing.
1014900	1017140	Right, just daylight robbery.
1019760	1022320	And the funny thing is, right, it's not even that difficult.
1022660	1024320	Right, this is just a party trick.
1026960	1029120	I mean, all I did, right, was I thought,
1029120	1030400	you know, there's a lot to be learned from kind of
1030400	1031780	old-school DOS viruses.
1031780	1033820	There's a lot to be learned from things we've done in the past.
1033820	1036380	And this is just creative re-application of the same tricks
1036380	1039020	that, you know, binary reverse engineers and virus writers
1039020	1042280	and all those sort of, you know, kind of sneaky fuckers
1042280	1043780	have been doing for a while.
1050790	1053350	Right, so I took those numbers that I just pulled out of my ass earlier on
1053910	1056490	and I put them on a graph to make it kind of look legitimate.
1058690	1060830	And as this graph clearly demonstrates, right,
1060830	1062270	my technique is wildly better
1064730	1066990	than everything except classic trust relationships,
1066990	1069450	which you'd have to be a retard to deploy, right?
1069450	1070190	I mean, seriously.
1070970	1072490	So yeah, I graphed them.
1072490	1074570	And really the conclusion from this graph is that
1074570	1076990	transient trust relationships, exploiting them,
1076990	1079470	is almost as much fun and as easy as
1079470	1081750	exploiting traditional trust relationships.
1088630	1090930	So, for your hijacking pleasure,
1090930	1094150	I present to you my SSH jacket.
1102470	1104490	It doesn't actually look like that, right?
1104490	1106110	You don't need to clap, but it looks different.
1106110	1107630	It looks like a script and stuff.
1109290	1111150	So yeah, it's a Python script,
1111150	1114430	which, when pointed at an SSH session,
1114430	1115750	gives you a shell at the other end.
1115790	1116630	Just like that.
1117150	1120470	So we're going to talk about briefly how it works,
1120730	1122150	a few kind of implementation details,
1122190	1123910	a bit of nitty-gritty stuff so you can do it yourself.
1124070	1126110	And then we're going to diverge briefly into
1126110	1129270	considering anti-forensics whilst implementing and using it.
1130190	1132810	And then there'll be like one slide of mitigation,
1132810	1134510	you know, just the responsible bit of the talk.
1134890	1137170	And then, yeah, we'll talk about a few other bits and pieces
1137170	1140450	that you might have up your sleeves or I might have up mine.
1148750	1156310	Fullscreen, that's pretty futuristic.
1156490	1157870	I'm not familiar with this commercial software
1157870	1160190	with the two buttons and stuff.
1161750	1163430	I'm kind of a one-button sort of guy.
1165490	1166550	Hey, that's pretty sweet.
1169690	1171650	Hey man, I just hack your network, right?
1171650	1173150	I don't do presentations.
1174870	1176250	So yeah, SSH, right?
1176250	1178070	For those of you who aren't familiar,
1178070	1180130	which probably isn't anybody, I guess,
1180130	1183890	SSH provides this virtual channel metaphor, right?
1183890	1188470	Effectively, SSH provides a multiplexed transport, right?
1188470	1192590	You can run multiple sessions across a single encrypted TCP pipe.
1192610	1194450	And it provides a number of useful things
1194450	1195970	for you to connect to those sessions.
1195970	1198290	The typical ones you'll see is your TTY.
1198590	1200830	Apparently that's pronounced titty, I'm not sure.
1202310	1205550	A shell for you to talk to on the other end of your titty.
1208070	1209690	And of course, TCP sockets is the other thing
1209690	1210570	we normally shunt around.
1210570	1211730	X-connections, that sort of thing.
1211730	1212710	Things over TCP.
1212710	1214190	People are quite familiar with that.
1215350	1217110	So what we're trying to do here, of course,
1217110	1219670	is we want to be able to take the user's session away from him
1219670	1220950	and use his credentials.
1220950	1222470	But we don't want him to notice, right?
1222470	1224730	And this sort of virtual channel metaphor
1224730	1226470	is exactly what we're looking for.
1232500	1233800	So how's it work, huh?
1233800	1236880	Well, we're going to take the features provided by SSH
1237260	1239020	and we're just going to use them for evil.
1239640	1241360	That's what hacking's all about, right?
1241900	1244940	So what we do is we ask for a second shell.
1244940	1247000	We say, hey, server, I'm Bob, I'm authentic.
1247000	1248200	You saw that earlier, right?
1248200	1249220	I gave him my password.
1249220	1250040	I'm good, right?
1250420	1251660	You want to give me another shell?
1252560	1253760	I'll go another one.
1254420	1255100	Maybe two.
1255800	1257820	And then we're going to glue it to the hacker.
1258340	1259160	Give him a socket.
1259840	1260460	Connect it up.
1260460	1261140	Oh, look, a shell.
1261140	1261900	Just like that.
1270990	1274370	So using Python and a little bit of debug trickery,
1274370	1276890	we go ahead and we ptrace attach to the client process.
1276890	1277850	Now, this implies, obviously,
1277850	1279750	that you need to be able to ptrace attach.
1279950	1281290	So, obviously, you have to be root
1281910	1284490	or you have to be running as the same user, right?
1284490	1286410	And that's not as stupid as it sounds.
1287110	1289750	You think about all the Firefox bugs we've had lately, right?
1289790	1291210	Admins who run the links on the desktop
1291210	1293010	are almost always going to run Firefox.
1293010	1295950	There's been a few Firefox kind of zero-day run code sort of bugs.
1295950	1297110	You turn up on the desktop,
1297110	1298970	you find every running SSH connection,
1298970	1300070	you jump down them.
1306030	1308030	And then we just rummage around.
1308890	1311790	And we find ourselves the virtual channel setup code.
1312310	1314590	SSH session 2 open, if you're wondering.
1315350	1317030	And then we just go ahead and patch it.
1317510	1319870	So instead of talking to the user, it talks to us.
1327720	1329080	And then we run it.
1337010	1339850	And then we just put everything back like nothing ever happened.
1340850	1343690	Except that the shell just popped out my netcat.
1346510	1347230	Hehehe.
1351510	1353330	So yeah, this is, I like to think,
1353330	1355790	this is the sort of thing that your mother warns you about, right?
1356770	1359090	Hackers, we're sneaky. Sneaky.
1359590	1361190	Well, one of you guys is sneaky.
1361190	1362610	The guy earlier on, yeah.
1363010	1363690	Yeah.
1364570	1367150	Right, we don't just install LK4 anymore,
1367150	1369590	you know, just trojan ourselves LS and stuff, right?
1369750	1370950	That's kind of boring.
1371330	1374610	And we don't install BNC, because who cares about ISE, that's right.
1374610	1375190	That's crap.
1376630	1378090	Except the older ones get caught there,
1378090	1380530	they're always running egg drop bots and crazy shit like that.
1381830	1384170	And yeah, good hackers, a little bit of creativity here and there,
1384170	1385730	maybe they'll do something new and interesting like
1385730	1387190	jack your SSH connections.
1388030	1390350	And if you hire some pen testers, and they're good,
1390350	1391390	maybe they'll do it too.
1396390	1399910	So all we're really doing here, it's just automated debugging, right?
1399970	1402210	It's not crazy, it's not rocket science, right?
1402470	1404210	And of course, if you give me a debugger,
1404210	1406970	and one of your processes that happens to be doing something important,
1406970	1408630	of course I can fuck with it, right?
1408630	1410450	That's normal, that's what debuggers do.
1410650	1412730	And humans with debuggers can do sneaky things.
1413610	1416390	But what we really want, is we want to automate it, right?
1417470	1420590	We want the sneakiness of a human,
1420590	1423290	and the speed and portability of a script.
1424630	1426190	So that's what we do.
1427410	1429150	So we're using Python, we're using GDB,
1429150	1431170	gluing them together, and we've come up with,
1431170	1433630	effectively, an automated debugging toolkit.
1433630	1440900	Of course, one of the downsides about this,
1440900	1443260	and if you've done any binary reverse engineering,
1443260	1446440	is that debugging binaries,
1446440	1447840	when you don't have any symbol information,
1447840	1450400	is not really debugging, right? It's not fun anymore.
1450800	1452600	So you have to do a bunch of tricks
1452600	1454240	that normal reverse engineers,
1454240	1455860	people who are doing binary analysis, have to do.
1455860	1457940	And we'll talk a little bit about that in a second.
1463400	1465880	So yeah, the nitty-gritty implementation details.
1465880	1467760	Write a little bit about Python, about GDMMI.
1467760	1471380	One of the things we have to do is we have to find a safe place
1471380	1472900	that we're going to stop the program
1472900	1474720	and kind of mess with its execution flow.
1474720	1477320	Because obviously we can't just go wildly executing code
1477320	1479520	in its memory space and hope it's going to work.
1480700	1482380	And then we have to find the code we're going to run,
1482380	1484560	we have to execute that code.
1485100	1487180	Or we have to inject some code there first, obviously.
1487320	1488640	And then we have to put it all back again.
1488640	1491060	And of course, what I'm discussing is in specific reference
1491060	1492580	to my SSH jackup,
1492580	1493900	but it's equally applicable
1495000	1496720	to anything that you're doing this sort of stuff to.
1496720	1498640	And we'll talk about a few of the other interesting things
1498640	1499680	you could do later.
1504120	1506760	So yeah, gdb is the GNU debugger,
1506760	1509160	for those of you who aren't familiar with it.
1510080	1511640	I'm sure you've heard of Richard Stallman, right?
1511640	1513960	He writes some good stuff, one of them happens to be a debugger.
1513960	1514800	It's pretty cool.
1515820	1518420	And gdbmi is its programmatic interface.
1519260	1520800	Gdbmi is actually pretty suck.
1520800	1522820	It's about half implemented, but it's good enough.
1523900	1526700	So yeah, I went ahead and just wrote some Python bindings for it.
1527240	1529040	Implements pretty basic functionality,
1529040	1531620	but enough to get the job done, right?
1537510	1539410	So the SSH client,
1539410	1541470	as you normally use it, is single threaded.
1541590	1543290	It doesn't expect to be running other code
1543290	1544550	in the middle of other code.
1545570	1547750	So yeah, and there's all sorts of
1547750	1549930	kind of nasty global data structures
1549930	1551430	and arrays of function pointers
1551430	1552770	and shit like that, right?
1552770	1553890	So we have to be a little careful
1554710	1556090	about what we're doing.
1556170	1559490	It's also completely asynchronous.
1559490	1561190	So when you, for example,
1561190	1562510	when we ask for that virtual channel,
1562510	1563990	it doesn't get set up right there.
1564030	1565450	It goes in a queue with a list of packets
1565450	1566590	that have to be sent to set it up
1566590	1569550	and there's a whole kind of state machine
1569550	1572210	that models how the SSH client interacts with the server.
1572330	1573590	So we have to be kind of careful.
1574210	1575690	So we have to find the safe place
1575690	1576710	where we can run our code.
1576710	1577910	And what you're aiming for
1577910	1579390	in the choice of a safe place
1579390	1581170	is really minimal deviation
1581170	1583270	from the normal operation of the code.
1583270	1584910	And funnily enough, right,
1584910	1586830	that happens to be in the middle of the main line,
1586830	1589110	of course, around the select call
1589110	1590670	because that's where everything branches from.
1590670	1593490	So we read the findSource,
1593490	1594370	I find the select call,
1594370	1596110	I decide that's probably a good place.
1597450	1599070	So we ptrace attach,
1599070	1600750	we stop the process, we drop a breakpoint
1600750	1602170	in that safe place, and we let it run
1602170	1603590	until it comes back.
1604570	1605570	Just like that.
1613280	1614820	But where is select?
1614820	1616180	Normally, right, normally if you're debugging something
1616180	1617620	you just go, hey, gdb where select?
1617740	1620020	And it goes, oh, yeah, over there. It's all good.
1620020	1622400	But we don't have any symbol information
1622400	1624780	so we have to do a little, you know, work backwards.
1624860	1626740	And this technique is very well understood.
1626740	1627980	Everyone does this sort of thing.
1629340	1630600	So where does select come from?
1630600	1632260	It comes from libc. So how does it get in there?
1632260	1633960	Well, the loader puts it there.
1634860	1635420	Where does it put it?
1635420	1636980	It dynamically links it into address space.
1636980	1638720	So we ask, where do you dynamically link it?
1638720	1640180	It says over here, and that's all good.
1644560	1646380	And then, you know, we have to rummage around
1646380	1648660	in the global offset table.
1649080	1650320	Find it in there.
1655440	1657240	The ELF procedure linkage table,
1657240	1659540	another exciting piece of the ELF format.
1664740	1666580	And then we rather boringly rummage
1666580	1667380	through the code segment
1667380	1669020	until we find a piece of code
1669020	1670580	that calls that PLT entry.
1670580	1671760	In this case, actually, it's quite easy
1671760	1673120	because there is only one call to select
1673120	1674220	in the whole damn binary.
1674220	1675960	So we can put a breakpoint
1675960	1677540	right in the middle of the ELF PLT.
1677540	1678720	Save me a step. Nice.
1679760	1681380	So yeah, now we've found select.
1688820	1690560	So where are we going to put our evil code?
1691740	1692940	Well, we're going to go and patch
1692940	1694040	SSH session 2 open,
1694040	1695200	which is the piece of code responsible
1695200	1696560	for setting up a new virtual channel
1697400	1699840	and asking the server to connect
1699840	1701460	something to the NBR TCP socket,
1701460	1702560	or in our case, a shell.
1704180	1705860	Still no debug symbols, of course.
1706000	1707960	Fortunately for us, there's a unique error string in there.
1707960	1710200	It happens to bitch about the dupe failing.
1710200	1712160	And that's the only occurrence of that string in the binary.
1712160	1714860	So we rummage around, we find it in the read-only data section.
1716880	1717900	And walk the code segment
1717900	1719120	looking for calls to that, right?
1719120	1721680	Now we know roughly where we are in this function. Nice and easy.
1728110	1730130	So yeah, the evil code itself, right?
1730230	1732430	It's going to overwrite the first half
1732430	1734030	of the virtual channel setup code.
1734890	1736030	We're going to save the registers,
1736030	1738190	we're going to save the flags so we don't fuck things up too much.
1738770	1740310	And then basically we're going to inject
1740870	1742490	its shellcode, right? It looks like shellcode.
1742490	1744590	Same sort of thing, right? We're going to call socket,
1744590	1746370	we're going to call connect, we're going to connect it back to
1746370	1747870	wherever we happen to be listening.
1748050	1749990	And then we're going to substitute it for the file handles
1749990	1752770	that it's expecting to be a normal Unix TTY.
1754750	1756330	I like Unix, it's cool.
1756910	1758050	I see you do that in Windows where your
1758050	1759790	Winsock sockets are different from your file.
1759790	1760830	Ah, Jesus.
1761730	1764250	And then we're going to leave the registers set up just right
1764250	1767270	so that the second half of the function runs perfectly.
1768650	1770490	And for really no good reason at all,
1770490	1772170	I'm using libc calls instead of
1772170	1774450	kernel syscalls, which I could.
1774450	1775970	It's just, you know, a bit of variety.
1776430	1777950	Sick of kernel syscalls, very boring.
1785100	1786880	So, why all the effort, right?
1786880	1788900	Why do we go to so much effort to overwrite half a function?
1788900	1791420	Wouldn't it be simpler to just have a piece of code
1791420	1793180	which we've already compiled, which happens to set up
1793180	1795200	virtual channels, and we'll just kind of copy it into
1795200	1797600	its address space and run it, right? That would be a lot more straightforward.
1798740	1799840	Yeah, it might be.
1800600	1801860	But one of the really suck things
1801860	1803360	about that is you have to link it by hand
1803360	1805640	with no symbol information, right?
1805640	1807500	Which, if you've tried, it's not fun, right?
1807500	1808920	That's not a fun game at all.
1809240	1811120	And so I thought maybe it would be easier to just
1811120	1813340	let the bottom half of the function,
1813340	1814940	which contains all the symbol references,
1814940	1817720	just let it be, and inject stuff
1817720	1819440	up the top to take advantage of that.
1821020	1823320	It's particularly nasty for SSH, because it has
1823320	1824960	this whole kind of, you may remember from, you know,
1824960	1827320	programming classes, this data-driven metaphor
1827320	1829640	which was popular kind of late 90s or something,
1829640	1831460	where you have like wild arrays of function pointers
1831460	1833460	and you just let the data index into them and...
1835420	1837720	Right, that's pretty yuck to have to reverse engineer
1837720	1838880	on the fly.
1841760	1843420	It's especially tedious if you have to do it
1843420	1844560	for every binary.
1845480	1847980	In this case, we actually patch it up
1847980	1849040	at runtime,
1849040	1851380	to make sure that the shellcode we have
1851380	1853460	will run in this particular environment.
1853520	1856180	And you'll see, actually, it's surprisingly successful.
1865920	1867420	So what do we do? Well, we work backwards
1867420	1869220	from that unique Duke error message we found.
1869220	1870940	We find the appropriate place at the top of the function.
1870940	1873780	We just kind of walk up until we see a function preamble.
1874860	1876420	And then we learn a few bits and pieces,
1876420	1877560	like how big the local stack is,
1877560	1878960	and we patch in the command line parameters
1878960	1880040	so it's user-friendly.
1880660	1882620	And a few other bits and pieces that we discovered
1882620	1884440	as we were, you know, doing our thing.
1885960	1887800	And now we have a nice little piece of evil.
1892540	1894300	So, yeah, let's wedge it in.
1894600	1895740	Back up the instruction pointer,
1895740	1896880	so we know where we were.
1897600	1899500	Back up the old code that we're about to override.
1899500	1900680	Stash it somewhere in memory.
1901920	1902980	And then we go ahead
1902980	1904060	and just inject our code.
1904060	1905780	Now it's going to take care of a few bits and pieces.
1905780	1909000	We've got a breakpoint at the end to catch it
1909000	1909800	when it's finished.
1910980	1912560	Hmm, what do you think we're going to do next?
1919700	1920900	That guy over there, right?
1920900	1922760	He's busy. He's playing hunt the wumpus, right?
1922760	1924320	He's just doing his job.
1925260	1927060	That wumpus, it's still going to kill him.
1927900	1929500	And we got ourselves a shell.
1929500	1930960	Just like that. Transparent.
1930960	1932400	The user doesn't even notice, right?
1932400	1934100	He sits there running something interactive.
1935400	1936700	Shell pops out from underneath him
1936700	1938100	and he doesn't even notice.
1938980	1940140	Sucks for him, huh?
1949160	1950560	So maybe you're going to go home
1950560	1951780	and jack yourself, right?
1956540	1957260	So what are you going to do?
1957280	1958080	How are you going to do it?
1958140	1959700	How are you guys going to go home
1959700	1962240	and hijack yourself some action?
1963180	1963940	Well, it's pretty straightforward.
1963940	1965840	Well, what I did, and you don't have to
1965840	1968240	kind of do what I did, of course,
1968240	1969980	is I wrote the hijack code in C first.
1969980	1971520	Makes it nice and easy. Compiled it up.
1971740	1973520	I compiled it actually directly into SSH
1973520	1975320	because I wanted to prove that you could have
1975320	1977200	two shell sessions down in SSH.
1977200	1979320	And you can. So I hooked it up
1979320	1982040	like a magic keystroke and you smack the escape
1982680	1983860	tilde, or whatever the hell it is,
1983860	1984900	and bring up the command prompt
1984900	1987140	and open me a shell, please, and it gave me one.
1987200	1988360	Just to prove the point.
1990280	1991380	And then, of course, the compiler
1991380	1993620	had conveniently generated most of my shell code for me.
1993620	1996160	Gee, that's so hard. Glad I bought the book.
1997620	1999660	And then I went ahead and implemented hijacking
1999660	2001760	for a binary that had debug symbols. Make it nice and easy.
2001760	2003820	Just to prove that I get the code in and out of memory,
2003820	2006140	in and out of the half of the function, nice and easily.
2011080	2012200	And then the really suck bit,
2012200	2014060	which is you build a list of symbols you're going to need to find
2014500	2016160	and you come up with a strategy to find them
2016800	2018060	and then you actually have to go ahead
2018060	2019200	and write code to do it.
2020300	2022200	And then, ooh, look, jack your friends. Fun and profit.
2023440	2025520	And then, if you're really nice,
2025520	2027480	package it up for the security consultants,
2027480	2029460	put some 3D, some spinny round, you know.
2033160	2035000	Maybe do it in Flash, I don't know.
2039930	2041110	A few bits and pieces, right?
2041110	2042510	The things that didn't fit in elsewhere.
2042950	2045650	Think about how much you use SSH, right?
2046070	2047610	You use it for SCP.
2047650	2048650	You use it for CVS.
2048650	2050650	You pipe stuff over SSH all the time.
2050650	2052430	You have backup push, you have some CPIO,
2052430	2055130	or whatever other home roll backup solution
2055130	2055890	you're using on Unix
2055890	2057310	because you can't find a decent one.
2059110	2060350	Yeah, it gets around, right?
2060350	2061290	There's a lot of it.
2061730	2063610	And, yeah, this does work over SCP.
2063850	2066130	And, yeah, it does work over stuff over SSH.
2066130	2067130	You know, there's a few little wrinkles,
2067130	2068470	but it works just fine.
2069730	2072110	Actually, the code on your CD doesn't work just fine.
2072110	2073950	The stuff I have right now does.
2074370	2076270	And it'll be on, I guess, on blackhat.com
2076270	2077830	or Defcon or wherever they put this stuff
2078190	2079310	after I've finished.
2079310	2080370	But, yeah, so, yeah, it does.
2080370	2081990	It jacks SCP just fine.
2083670	2084990	You'll notice in the client,
2084990	2087790	you can hit tilde and I think it's hash
2087790	2088870	or something and it brings up a list
2088870	2090870	of the open virtual channels you have.
2090870	2092970	Does it show up in that list? Yeah, it does, actually.
2093310	2094810	How many of you knew you could list
2094810	2097110	the virtual channels open with tilde and hash?
2098030	2099070	One, one.
2099070	2100190	Horns, thank you.
2102370	2103410	But, of course, that's the client
2103410	2104710	that's listing it, so you want to go patch that?
2104710	2105710	Sure, no problem.
2106510	2107950	And what happens when they log out?
2107950	2109630	Well, anyone who's used port forwarding, right,
2109630	2111410	you know what happens when you've got an open shell,
2111410	2113510	you've got a port forward as well, you're using the port forward
2113510	2115890	to, you know, look at GoPorn or whatever,
2115890	2117970	right, and you log out, right, you haven't
2117970	2119670	finished looking at the GoPorn, the connection stays open.
2119670	2121110	Great, well, the same thing happens here.
2121510	2124250	So, you're SCPing, your SCP takes 30 seconds,
2124250	2125650	I happen to catch it in time, run a shell
2125650	2127330	over it, your SCP will stay running
2127850	2129710	once it's finished copying so that I can do some
2129710	2131610	hacking, play Hunt the Wampus.
2133650	2135330	And how does it, well, how well does it work?
2135330	2137410	Well, uh, at the moment, uh, any
2137410	2139990	open SSH3-ish it should work on.
2140330	2142010	Um, it's known to work on, on
2142010	2143370	the out of the box Stephen Sarge
2144290	2145770	RHEL3, RH9, it works on
2145770	2147750	Slack, uh, Slackware as well, 9.1.
2148030	2149050	Uh, it doesn't work on SUSE
2149050	2150870	because their compiler is just retarded.
2151050	2153550	Um, I, I work with a guy who used
2153550	2155470	to work at SUSE on their, on their AMD64
2155470	2157370	stuff and they, they got paid by AMD
2157370	2159070	to write loads of extra optimizations
2159070	2160950	for AMD64 and then they went and back ported
2160950	2162970	them over to Intel and now the compiler just generates
2162970	2164950	code that's so wildly broken.
2165110	2166770	Right, I, I can't, I look at it, right, I can't
2166770	2169010	believe it even executes. Right, I, I've
2169010	2171050	seen it miscompile, like, really basic stuff.
2171050	2172970	Anyway, so, it doesn't work on SUSE,
2172970	2174830	right, uh, ah...
2175790	2176990	I, I'll get round
2176990	2179030	to it, right, I'll probably just write some, some
2179030	2180850	one-off custom code that's gonna
2180850	2182990	work on SUSE because the, the magic heuristic stuff
2182990	2184930	that works on everything else doesn't work on
2184930	2185770	their compiler.
2186990	2188050	Silly SUSE.
2195560	2196740	Also, it's also worth
2196740	2198880	mentioning, I guess, uh, Python 2.2,
2198880	2201040	2.3, 2.4, it's known to work with.
2201040	2202740	2.1, it ought to work, but
2202740	2204860	I haven't tested on 2.1. Anything older than that
2204860	2206640	you're probably, uh, you know, there's a few bits and pieces
2206640	2208680	that are broken. Um, GDB,
2208680	2210900	I haven't noticed any version it doesn't work with yet.
2210980	2213200	Uh, it's a pretty straightforward text interface.
2214860	2216620	Now, if you'll indulge me, a brief, uh,
2216620	2218780	brief tangent into anti-forensics. Now, uh,
2218780	2220680	those of you at, who are at Black Hat,
2220680	2222700	uh, or, uh, RuxCon last
2222700	2224540	year may have seen, uh, the Grugs talk
2224540	2226720	on anti-forensic stuff. I don't know if he was doing
2226720	2228320	it at DefCon, was he? No?
2228600	2229120	No.
2230460	2232880	It's very interesting. Well, I saw it at RuxCon, uh,
2232880	2234840	two years ago, or a year and a half ago.
2234860	2236720	And yes, I remember very interesting things to say about
2236720	2238660	anti-forensics. And of course, when you're,
2238660	2240580	when you're attacking systems like this, right, in
2240580	2242780	the middle of the day, or when everyone's using them,
2242780	2244520	it assumes that you're taking pretty basic
2244520	2246700	anti-forensic precautions. You don't want to leave too
2246700	2248160	many, too many trails.
2249100	2250900	So yeah, I'm going to talk, uh, just a brief,
2250900	2253160	you know, very brief overview of anti-forensic
2253160	2254860	technique, and then how I've implemented
2254860	2257120	it, uh, successfully and unsuccessfully
2257120	2258920	in some places, uh, when I was using and
2258920	2260360	writing the SSH jacket.
2264470	2266670	So yeah, the most important thing, the most
2266670	2268730	important thing is don't put anything on disk.
2268730	2270530	Do it all in memory, right? Memory goes away
2270530	2271810	when they reboot the box.
2272770	2274690	Right? There's nothing on disk, there's no tripwire,
2274690	2276630	there's no, nothing for them to look at with Ncase
2276630	2278590	or whatever other expensive, uh, forensic
2278590	2280430	products they're using. You know, it's like if you get
2280430	2282290	swapped out the disk, you don't know well.
2283130	2284450	But really, you want to try and keep
2284450	2285830	everything in memory only.
2286630	2288510	Uh, use local tools, right? These are,
2288510	2290330	these are Turing-complete machines, you can write your
2290330	2292170	split code in whatever's available, right?
2292170	2294570	If you have to write a port scanner in ORC,
2294570	2296990	do it, right? Right, if it has a
2296990	2298950	Perl interpreter, great, use that. Right, if it has a
2298950	2300790	Python interpreter, use that. If you're good, right,
2300790	2302690	you turn up, you find what's there, and you
2302690	2305130	write your tools on the spot.
2305130	2306490	That way you don't have to go and, you know,
2306490	2308590	wget magic hacksaw tarball.tar.gz
2308590	2310110	from hacksaw.com, right, which is a real
2310110	2312650	fucking giveaway. You don't want
2312650	2313730	them to know what you did.
2315490	2316550	And yeah, try to make
2316550	2318510	new network connections, right? You don't want anything
2318510	2319990	for their intrusion detection or
2320590	2322970	cough prevention systems to spot.
2325090	2326470	And you don't want them sniffing your traffic
2326470	2328730	and kind of replaying it later and figuring out what the hell you did.
2329790	2330590	So yeah, reuse
2330590	2332470	your existing connection, hide in plain sight,
2332470	2333310	use encryption.
2340610	2341070	So,
2341070	2342270	how well do I do?
2342270	2344010	Well, we do use
2344010	2345890	general purpose tools, right? GDB is pretty
2345890	2347990	general purpose. I mean, if you turn up on a box that doesn't
2347990	2349950	have GDB, maybe it's not such a giveaway
2349950	2351710	to go ahead and install it, right? I mean, maybe you're just
2351710	2354010	helping, right? You're just doing a bit of administration for them.
2354670	2355770	Some of the best run Windows
2355770	2357830	boxes I've seen are admin by Russian hackers.
2359950	2360290	Remotely,
2360290	2361750	right? They don't even have to go on site to reboot it.
2361750	2362450	How nice.
2363810	2365810	So yeah, we do. We use general purpose tools. We use the
2365810	2368130	Python interpreter, we use GDB. That's nice.
2369130	2369710	SSH is
2369710	2372170	encrypted, so the packet is not much use.
2373350	2373950	And yeah,
2373950	2375510	our new shell that's
2375510	2377790	going across the existing SSH connection,
2377790	2379590	right, there's nothing new there. There's no new connection
2379590	2381270	for any intrusion detection
2381270	2382810	or things to spot.
2382930	2385810	Not very interesting. That's good.
2385810	2387350	We're looking okay so far.
2391720	2392680	Where do I start?
2392680	2394800	Well,
2394800	2396460	Python code lying around disk.
2396460	2398420	Not very elegant, right? I've got to copy the script across
2398420	2400020	and then I've got to go Python, SSH,
2400020	2402420	yada, yada, yada. That's not very nice. There's no script lying
2402420	2404440	around for them to look at. Even Python bytecode
2404440	2406740	lying around, you can turn that back into code pretty easily.
2407980	2408500	And of course
2408500	2410280	the other problem is we have that connection coming
2410280	2412340	from the SSH client out to
2412340	2414460	our network, which has a TCP
2414460	2416100	connection with the shell on the other end, right?
2416100	2417940	That's a new connection. That's not so nice.
2419160	2420780	And yeah, it's in the clear as well.
2420860	2422460	So obviously if I were a cunning man,
2422460	2424160	if I were a patient man, I would have implemented
2424680	2426100	SSH connect back, right? Because all the
2426100	2427720	code in the client is there, right?
2427860	2430400	I haven't done that yet, sorry.
2431480	2432200	But if you happen
2432200	2434140	to turn up over SSH, right? So say it's
2434140	2435940	the second box you've routed in a row,
2435940	2438420	and you just came in across an SSH connection,
2438420	2439700	why don't you set up a port for it?
2440340	2442480	Bring it back down like that. That would be a pretty good idea.
2447020	2448820	So let's not leave our scripts lying around on disk.
2448820	2449840	How about we just go ahead
2450320	2452400	and load that Python directly into memory?
2452400	2453180	All good, right?
2454000	2455200	So let's just
2455200	2457160	run up a Python interpreter, ask it to read
2457160	2458740	from Samjin, and execute it.
2459280	2461100	And then locally, we'll take the Python script
2461100	2463060	we want to run locally, we'll compile it up, we'll turn it into
2463060	2464980	Python, we'll compress it and paste it into work,
2464980	2467380	we'll send it across the wire, maybe with a
2467380	2471300	little loader at the other end to unpack it and run it.
2471300	2473920	And then send it across your shell.
2473920	2476580	That's all good, right? Nothing on disk.
2476580	2478940	That sound straightforward to anybody?
2478940	2479640	Pretty straightforward to me, right?
2479640	2481420	It's just three lines
2481420	2483300	right there, and then a little bit of jiggery-pokery.
2488220	2489580	I know you want a script.
2489600	2491120	You want scripts, don't you, right?
2491120	2493120	OK, I wrote a script for you, make it nice and easy.
2493880	2495120	It does all of the above, right?
2495120	2497420	So now if we load, we pass in a Python script,
2497420	2499460	list the Python libraries we might require,
2499460	2501640	mine our arguments, packs it up, sends it across,
2501640	2503660	runs it, you give it a shell and a modem,
2503660	2504880	it knows how to do the rest.
2505920	2507440	And then if you're really cool, right,
2507440	2509060	hack in Screen. Screen's really neat.
2509360	2510900	Screen is a terminal multiplexer, right?
2510900	2511980	So you must know Screen.
2517300	2518720	Screen has this really cool feature
2519540	2520680	called Bang.
2521560	2523100	It'll run a local command
2523100	2525480	and then it comes with other options,
2525480	2527260	but it will inject the output
2527260	2529480	of that local command into your remote session.
2530000	2531000	So I sit there on Screen, I go
2531000	2532700	CTRL-A and my screen escapes here.
2532700	2534440	I go bang, bang, bang, bang, bang.
2535200	2538240	Powerful load, SSJAC, process ID,
2538240	2539540	destination host port,
2539540	2540600	and it runs it on the remote machine,
2540600	2541740	just like I was there.
2544040	2544940	That's pretty cool, right?
2544940	2547180	You can almost forget you're running it remotely.
2547660	2549060	And obviously for your convenience,
2549060	2550040	that's obviously neat.
2556800	2557720	So what else can I do?
2557720	2558580	What else can I do with this?
2558580	2561440	Well, it would be nice to actually generate
2561440	2562380	the shellcode on it.
2563220	2565320	I didn't get around to writing it in Assembler yet,
2565320	2566420	and other people have already written it,
2566420	2567780	even in Python, right?
2567780	2570420	It doesn't have a lot of documentation,
2570420	2572740	so I read through it, but I haven't implemented anything.
2574200	2575400	Yeah, pure Python debugger,
2575400	2576540	so that would be cool.
2577420	2578460	Aha!
2578920	2581120	What other protocols have
2581120	2582460	virtual channel infrastructures
2583420	2585160	and are used on clients?
2585160	2587000	Lots. Especially poorly-packed
2587000	2588380	senior clients.
2589020	2589800	Hmm.
2590780	2592860	MS-IDP, Citrix.
2593520	2594840	I've already had a chat with some people
2594840	2596220	who like hacking on Citrix,
2596220	2598040	and they're pretty keen on this idea.
2598360	2600040	Citrix has got a virtual channel infrastructure
2600040	2603400	for running, you know, drive mapping,
2605320	2606420	and all sorts of things.
2606420	2606740	Yeah.
2608480	2609700	And all manner of things, right?
2609700	2611360	I mean, once you have an ordinated
2611760	2612980	programmatic debugging toolkit,
2612980	2615420	you start seeing all the things you can just beat with that hammer, right?
2615420	2617300	It's a really cool thing to have in your toolkit.
2618140	2618860	You can start, you know,
2618860	2621040	you can have it disassemble stuff on the fly,
2621040	2622600	figure stuff out, and patch it, right?
2622600	2623860	All programmatically. It's cool.
2630770	2631910	Right, now,
2631910	2633210	now, being as it is that, you know,
2633210	2635370	I'm obviously some sort of long hair, right?
2635370	2638150	And I'm from the Antipodes,
2638150	2639350	I'm not very fashionable, right?
2639350	2641310	I'm kind of stuck in the 80s and shit, right?
2641310	2643410	So, I'm not sure if this is
2643410	2644690	still fashionable, right?
2644690	2646530	Because, blaming Theo for everything.
2647170	2648550	Is that still fashionable?
2649110	2650370	Yeah? Yeah, okay.
2650810	2653390	Unfortunately for me, it's not Theo's fault.
2653390	2654170	Sorry.
2654930	2657110	It's actually a feature of all things.
2657130	2659210	The SSH protocol specification
2659210	2661130	says it's just fine
2661590	2663270	to have multiple channels on the other end.
2663270	2665190	That's a requirement, right?
2665190	2666210	That's pretty cool, huh?
2666210	2668350	I hadn't really thought about it before, right?
2668350	2670070	My SSH client, right? If I was to say,
2670070	2671830	get a shell, that's all there is to it, right?
2672030	2674790	But now imagine like a graphical client, like a CAD.
2679200	2680980	So yeah, it's a feature, right?
2681040	2682800	If you could get a shell from a server
2682800	2684420	back to the client, right?
2684440	2686020	That would be a bug. Unfortunately,
2686020	2687680	Theo took care of that. He's a good dude.
2688120	2689580	Same with unsolicited port forwarding.
2689580	2691680	If you could port forward from a server back to the client
2691680	2693520	without it asking you to do so,
2693520	2695720	that would be a bug also.
2695820	2697280	But no, I've taken care of that.
2697280	2700000	I haven't looked at any other SSH implementations.
2700280	2701600	Because SSH is, you know,
2701600	2703760	the client and the server are very, very similar
2703760	2705480	in functionality, they both have to deal with
2705480	2707360	this multiplexing and multiplexing.
2707780	2709820	Generally, most people write that code once,
2709820	2711440	right, and use it in both a client and a server
2711440	2713940	implementation, so you have to be pretty careful.
2713940	2715400	So if I were you, and you're using
2715940	2717360	a funny SSH server,
2717360	2719980	one of those crazy Cisco ones,
2719980	2721660	I don't know,
2721660	2724000	yeah, I might have a look at that.
2724280	2725600	It might work, wouldn't it?
2726680	2727320	But anyway,
2727320	2729960	it's not OpenSSH's fault. Please don't send me a bug report.
2729960	2731500	It's not a bug report. Blame me instead.
2731500	2733380	I don't want Theo to, you know, come and bring me up
2733380	2736100	and harass me, kick my ass or whatever.
2737140	2738380	But yeah, OpenSSH is cool.
2738380	2739580	For the record, OpenSSH is cool.
2739580	2741500	I like it. It's a big fat loaded piece of crap,
2741500	2743060	but I like it. I use it every day.
2750120	2750800	Mitigation technique.
2750800	2752040	Responsible slide, right here.
2752260	2754580	Don't get rooted. Nice and easy.
2755260	2757080	You could, if you were cunning,
2757080	2758760	patch ptrace, maybe, so you
2758760	2759740	couldn't do it as a user.
2759740	2762460	I suppose there's patches around to do that already.
2763120	2764560	One of the things that's not on there is
2764560	2766200	you could, the SSH agent,
2766200	2768960	they try to prevent this attack by making it set GID.
2769040	2770540	I don't know that making your SSH client
2770540	2772240	set GID is a good idea. I mean, there's probably
2772240	2774660	all sorts of other things that would go horribly wrong if you did that.
2775880	2776720	One of the most important
2776720	2778540	things that you can actually do to help
2778540	2780300	yourself is if you're running restricted, if you're running
2780300	2783040	trust relationships using keys between hosts,
2783600	2785000	there's a bunch of tools you can use
2785000	2786740	to restrict what those keys can be used for.
2786740	2788480	You can restrict what commands are executed,
2788480	2790700	you can restrict where port forwarding is allowed,
2790700	2792780	you can restrict x-forwarding, all that sort of thing. Use it.
2792780	2793920	Use it. Really do.
2794720	2796780	Oh yeah, and then Steve Gibson, he had some really good ideas
2796780	2799220	about those wall sockets right there. They're bad. Sorry, the buggers.
2799460	2800800	I think we should get him in charge
2800800	2802360	of the anti-bugger movement.
2807460	2808240	Yeah, why do you care?
2808240	2809440	It's just a party trick, right?
2809440	2811760	This is just like eroding the farms. That's all, right?
2811760	2813880	It's not wildly zero-day.
2813880	2815420	If you get rooted, you're screwed. You knew that.
2817100	2817840	Rich desktops?
2817840	2819020	Yeah, it's a good way, right?
2819120	2821740	Tacking desktop machines that are full of complexity is a very good way
2821740	2823300	to get to well-protected servers.
2823300	2825600	And especially willing to admins. Anyone running Linux on a desktop
2825600	2827680	is probably looking after interesting stuff.
2828940	2829820	And yeah, try it against
2830380	2831420	RDPM or ICA.
2831420	2832580	That could be interesting.
2837160	2838260	Very pretty mad greets.
2838260	2840340	There's not much of a scene in New Zealand. There's only a few of us.
2840340	2842340	We all drink beer. There's like, let's run through tables
2842340	2845020	the whole scene, but yeah, I thought I'd better say hi to them.
2845020	2847040	And GadooSpice, he gave me my first security hack
2847040	2847920	two years ago.
2848740	2849740	He's a good dude.
2850660	2853280	Oh yeah, and there were a few talks about this one that were interesting.
2853340	2854940	The Elf. Sean Flowers
2854940	2857140	Elf Encrypter, right? That's some crazy shit.
2857140	2858860	I gotta read that. It's like, symbiotic
2859600	2860980	p-tracing processes that
2860980	2862740	take memory in and out of each other
2862740	2864780	and unencrypt it. It's crazy. Go look at it.
2869940	2870720	Apparently, I'm out of time
2870720	2871860	so you don't get to shred me.
2872060	2873960	Sorry. There was also a demo
2873960	2876720	that I'm getting the head signal.
2878140	2878780	If you want to see it,
2878780	2880720	come see me afterwards. We'll do it on a box that doesn't
2880720	2881820	look like a screensaver.
2882880	2883960	Alright, thank you guys!