[00:04.100 --> 00:05.340]  Here's my plan, right?
[00:05.700 --> 00:08.860]  We're going to deliver our squirt virus in the email, right?
[00:08.860 --> 00:12.360]  It's going to live on their mail server until the admin's clever enough to read it.
[00:13.180 --> 00:15.140]  At that point, we're going to squirt his time.
[00:15.240 --> 00:16.300]  Mmm, pretty cool plan.
[00:17.520 --> 00:20.280]  Connect back shellcode out to us, listening on the public internet.
[00:21.020 --> 00:24.160]  We're going to escalate some privileges, drop out a nice and prepared rootkit.
[00:24.880 --> 00:27.340]  And then from there, we'll throw him his SSH up good and proper,
[00:27.340 --> 00:30.140]  sniff his keystrokes, wait for the logs in the database server.
[00:30.160 --> 00:31.660]  Yeah, it's all good, right? All good.
[00:43.520 --> 00:45.440]  Those didn't look like email addresses to me.
[00:46.000 --> 00:47.320]  All right, anyway, so.
[00:47.460 --> 00:50.240]  Got a brand new Pine 0-8, run it through our mail spoofer,
[00:50.240 --> 00:51.720]  send him something he's got to read, right?
[00:51.720 --> 00:53.960]  Now that looks like a compelling piece of email to me.
[00:54.980 --> 00:57.440]  And we fire up our netcap, and we hang on.
[00:57.980 --> 01:02.080]  If you notice, for convenience, that's on 41327 instead of 443, but never mind.
[01:03.460 --> 01:06.740]  And look at that. Shell. Right, find squirt, work perfectly.
[01:07.380 --> 01:09.720]  Yep. You were the admin? Mm-hmm.
[01:09.720 --> 01:11.320]  Yeah, he's a clever man, nice username.
[01:12.360 --> 01:14.260]  Oh, shit, where did Pine go?
[01:14.300 --> 01:14.840]  Nah.
[01:15.860 --> 01:17.620]  Ah, look, damn thing dropped core, right?
[01:17.620 --> 01:20.520]  He's probably going to notice that. He's sitting there, using his Pine, and bam, all gone.
[01:20.520 --> 01:21.300]  Ah, shit.
[01:29.260 --> 01:31.900]  So at this point, you know, he's probably going to spot us.
[01:31.900 --> 01:35.020]  Hacksaw.com, pretty poor choice of reverse, I now admit.
[01:37.260 --> 01:39.200]  And, ah, yeah, look at that, nice.
[01:39.200 --> 01:41.740]  Starter Club Shell, he's going to start running around where the core is.
[01:41.940 --> 01:42.760]  Ah, shit.
[01:43.600 --> 01:50.840]  So right about now, if you're a clever man, you know, if you're a wise man,
[01:50.840 --> 01:52.980]  it's time to drop carrier, right?
[01:53.540 --> 01:56.740]  Plus, plus, plus, ADHMort, just get the hell out of here, right?
[01:56.740 --> 01:58.540]  Things have gone horribly wrong.
[01:59.540 --> 02:00.120]  Cool.
[02:00.740 --> 02:05.660]  Apparently pear shape doesn't translate well into North American English, you know, I'm terribly sorry about that.
[02:07.820 --> 02:10.880]  But yeah, did you see that? In the PSR I put back there?
[02:16.930 --> 02:17.290]  No?
[02:17.290 --> 02:21.130]  Look, look, look, SSH session, root, and then nameserver.
[02:21.850 --> 02:23.270]  That sounds pretty good, huh?
[02:23.270 --> 02:24.090]  Pretty good.
[02:24.510 --> 02:25.390]  I like that.
[02:32.030 --> 02:33.790]  If I drop carrier now, right?
[02:33.810 --> 02:35.850]  I'm never going to get a chance like that, right?
[02:36.690 --> 02:41.890]  Man, I really, really, really wish there was a way I could get to the other end of that SSH session.
[02:41.890 --> 02:43.570]  It's authenticated, it's already root, right?
[02:43.570 --> 02:45.570]  I don't even have to goddamn root the box.
[02:45.790 --> 02:48.430]  All I gotta do is get down that SSH session, man.
[02:48.970 --> 02:50.310]  If only there was a way.
[02:55.670 --> 02:57.630]  Like fucking duh there is.
[02:58.330 --> 03:00.050]  Which is why I'm standing here.
[03:02.350 --> 03:06.670]  So, yeah, I smacked a few magic keystrokes, a little bit of this, a little bit of that, some bang.
[03:06.670 --> 03:07.810]  Bangy-bang-bang.
[03:08.870 --> 03:09.910]  SSH Jack.
[03:20.550 --> 03:22.350]  Anyway, yeah, so my name's Metal Storm.
[03:22.390 --> 03:23.950]  My mum calls me Adam.
[03:25.310 --> 03:28.390]  I'm from New Zealand, which is why I sound a little fucked up.
[03:29.790 --> 03:36.010]  For those of you who are not familiar, it's a very small island that kind of like connects people to any city in the entire North America.
[03:36.010 --> 03:40.990]  And, yeah, we have lots of sheep and apparently hobbits. I haven't seen any right now that aren't.
[03:40.990 --> 03:44.470]  Let me tell you right now, there are no hobbits.
[03:45.190 --> 03:46.550]  There's no hobbitses.
[03:46.630 --> 03:48.550]  They don't have preciouses.
[03:48.570 --> 03:49.550]  They don't exist.
[03:49.750 --> 03:51.930]  Sad, sad token fanboys.
[03:54.090 --> 03:56.870]  See, I work for a Linux integrator.
[03:56.870 --> 04:01.330]  I don't actually do much security for a living, so I'm kind of here in a personal capacity, which is why I can say fuck.
[04:02.970 --> 04:06.210]  In the past, I've been a corporate or security consultant.
[04:06.210 --> 04:07.630]  I've done network engineering.
[04:07.630 --> 04:08.870]  I've done all sorts of stuff.
[04:16.780 --> 04:19.780]  So, right, what the fuck, what the fuck did we just do, right?
[04:22.240 --> 04:25.580]  We saw ourselves a pretty classic intrusion, right?
[04:26.420 --> 04:29.320]  Slightly different modus operandi than you're probably used to, right?
[04:30.140 --> 04:31.920]  Server box was pretty well secured.
[04:31.920 --> 04:37.000]  Instead of attacking the server directly, I decided that the best way to do it is to attack the admin's desktop
[04:37.000 --> 04:38.540]  and then from there to the server.
[04:39.240 --> 04:40.280]  But there's desktops, right?
[04:40.280 --> 04:42.580]  I mean, Linux desktops just as much as Windows desktops.
[04:42.580 --> 04:43.920]  There's a whole bunch of complexity, right?
[04:43.920 --> 04:50.780]  We don't have clipping, but we do have, you know, lots of candy and enlightenment and things that make your desktop look real pretty.
[04:51.900 --> 04:56.260]  And all that complexity, all that kind of intellectual candy floss that's there to just rot your brain, right?
[04:56.260 --> 04:57.480]  That's where all the bugs are.
[04:57.660 --> 05:00.000]  So, I want to root up someone's big Linux server, right?
[05:00.000 --> 05:01.200]  I'm not going to go after the server.
[05:01.200 --> 05:04.660]  It's got intrusion detection all over the place and intrusion prevention like it works.
[05:06.740 --> 05:09.380]  I'm going to go attack the desktops, right?
[05:09.380 --> 05:10.400]  That's where it's at.
[05:11.000 --> 05:12.900]  And certainly people who have Linux desktops, right?
[05:12.900 --> 05:14.060]  They're real geeky.
[05:14.240 --> 05:17.900]  They have glasses and long hair and beauty fears and shit, right?
[05:18.000 --> 05:20.540]  And they look after all the good stuff.
[05:20.880 --> 05:22.580]  So, that's where you're going to go.
[05:23.360 --> 05:24.420]  But sometimes, right?
[05:24.420 --> 05:25.600]  Sometimes you're not perfect, right?
[05:25.600 --> 05:26.820]  Things go wrong.
[05:27.160 --> 05:28.980]  In that particular case, you know, we got there.
[05:28.980 --> 05:29.520]  We got busted.
[05:29.520 --> 05:30.060]  We dropped Cor.
[05:30.060 --> 05:31.080]  He's going to know this.
[05:32.420 --> 05:36.240]  So, you know, you can drop Cor like some sort of little pansy.
[05:36.400 --> 05:38.520]  Or maybe, you know, do something a little different.
[05:38.520 --> 05:39.800]  Just play some adaptability.
[05:40.020 --> 05:40.980]  Something a little new.
[05:54.340 --> 05:55.400]  When you hack something, what do you do?
[05:55.400 --> 05:56.060]  What are your goals?
[05:56.060 --> 06:11.310]  Well, figure out what you want to do next.
[06:11.950 --> 06:14.470]  Very rarely do you ever, you know, just get root on the box.
[06:14.470 --> 06:14.810]  You won't.
[06:14.810 --> 06:15.430]  You won't.
[06:19.590 --> 06:22.090]  So, yeah, you have to do reconnaissance, right?
[06:22.090 --> 06:23.890]  You're usually on your way to it.
[06:24.930 --> 06:26.870]  There's kind of another thing you could do, right?
[06:26.870 --> 06:28.510]  You could be a good guerrilla star, right?
[06:28.510 --> 06:29.350]  You walk in there.
[06:29.350 --> 06:30.070]  You get what you want.
[06:30.070 --> 06:31.730]  You get the hell out real fast.
[06:32.130 --> 06:33.890]  And that saves you a bunch of time and effort.
[06:34.690 --> 06:36.030]  And I'd like to explain adaptability, right?
[06:36.030 --> 06:40.070]  That's a big difference between all you fuckers and the people they pay to do this for.
[06:41.470 --> 06:42.850]  At least, the cheap ones anyway.
[06:42.850 --> 06:43.450]  I don't know.
[06:44.590 --> 06:55.040]  You have to have a really big name for root and other stuff instead of the stuff you've got.
[06:55.880 --> 06:57.800]  Cross-host privilege escalation, right?
[06:57.800 --> 06:59.300]  So, privilege escalation is pretty normal.
[06:59.300 --> 07:00.120]  You have a user account.
[07:00.120 --> 07:00.880]  You want to get some root.
[07:00.880 --> 07:01.520]  That's good.
[07:01.520 --> 07:06.320]  I think root on another box is just as good as root on this box most of the time, right?
[07:07.000 --> 07:09.140]  And local root, you know, it can be a distraction.
[07:10.160 --> 07:11.360]  You're on your way to somewhere.
[07:11.360 --> 07:14.520]  You don't have time to sit around and root, hit a box up, and drop it.
[07:15.380 --> 07:19.160]  You know, local vulnerabilities are easy to exploit often, right?
[07:19.160 --> 07:20.460]  We've got a lot more information.
[07:20.460 --> 07:22.040]  What's the version stack layout?
[07:22.040 --> 07:23.860]  You know what we're getting ourselves into.
[07:24.320 --> 07:29.420]  It can be kind of tempting to sit around and escalate your privileges because you feel good about it, right?
[07:29.420 --> 07:30.360]  You know, you're achieving something.
[07:30.360 --> 07:32.320]  You feel good, right?
[07:32.320 --> 07:33.720]  You feel good about yourself.
[07:35.400 --> 07:36.660]  Yeah, easy is good. I like easy.
[07:36.660 --> 07:40.060]  But what if there was something easier than local privilege escalation?
[07:47.250 --> 07:48.450]  Trust relationships.
[07:49.070 --> 07:50.790]  It's kind of old school, I know.
[07:50.970 --> 07:54.850]  We must be, what, five, six, seven years ago talking about trust relationships?
[07:55.550 --> 07:57.030]  It's kind of old school, yeah.
[07:57.030 --> 07:58.510]  You know, you've got cross-hosts.
[07:58.510 --> 08:02.150]  And back when ports below 1024 were just magically rooted.
[08:03.930 --> 08:07.270]  Back when people exported slash readwrite to the entire world.
[08:08.050 --> 08:08.950]  That was good, right?
[08:08.950 --> 08:10.710]  We're just a bunch of long-haired unix hippies, right?
[08:10.710 --> 08:11.330]  We love each other.
[08:11.330 --> 08:12.090]  It's all good.
[08:12.090 --> 08:13.370]  We just share.
[08:13.430 --> 08:14.350]  You don't mind this space.
[08:14.350 --> 08:15.450]  It's your disk space.
[08:17.490 --> 08:18.570]  It makes you feel good, right?
[08:18.590 --> 08:19.730]  It's old school.
[08:19.730 --> 08:22.610]  You feel like your mummy's tucking you up in bed.
[08:22.610 --> 08:23.490]  You know, it's good.
[08:24.570 --> 08:26.170]  But we called that hacking, right?
[08:26.170 --> 08:27.230]  That's just embarrassing, right?
[08:27.230 --> 08:27.910]  That wasn't hacking.
[08:27.910 --> 08:29.650]  That was just mounting stuff.
[08:29.650 --> 08:36.110]  How many of you watched Unauthorized Access where a simple nomad goes, like, mount?
[08:36.330 --> 08:37.190]  And he's a hacker?
[08:39.550 --> 08:40.090]  Sorry.
[08:40.090 --> 08:42.570]  You're in the room, so...
[08:47.490 --> 08:51.870]  And that's my favorite thing about trust relationships.
[08:52.650 --> 08:53.670]  Instant gratification, right?
[08:53.670 --> 08:54.350]  You turn up.
[08:54.350 --> 08:56.670]  There's a trust relationship between hosts, right?
[08:56.670 --> 08:57.710]  It's like Christmas.
[08:57.710 --> 08:58.250]  It's good.
[08:58.250 --> 08:58.990]  Right now.
[08:58.990 --> 09:00.390]  You get Root on another box.
[09:00.390 --> 09:01.270]  Or Shell on another box.
[09:01.270 --> 09:02.050]  It's great, right?
[09:02.050 --> 09:03.430]  It makes you feel really good.
[09:13.850 --> 09:15.650]  Traditional trust relationships, right?
[09:15.650 --> 09:22.010]  I call them long transient trusts for no reason other than that I'm obviously about to talk about transient trusts.
[09:23.110 --> 09:25.930]  So that's what I'm calling traditional kind of fixed trusts.
[09:25.930 --> 09:27.290]  Things like host trusts.
[09:27.290 --> 09:29.970]  Things like SSH key-based trusts.
[09:30.130 --> 09:34.250]  They're trust relationships that exist as stored authentication predictions.
[09:34.250 --> 09:37.410]  What Bruce and I would probably call one-factor authentication.
[09:38.870 --> 09:42.110]  Or it can be authentication based on properties of the connection.
[09:42.110 --> 09:44.110]  The source address, the whole thing below.
[09:44.110 --> 09:45.190]  All that sort of thing, right?
[09:45.190 --> 09:48.530]  Just your traditional run-of-the-mill garden trust relationship.
[09:58.720 --> 10:01.740]  And then there's trust relationships which are transient.
[10:01.740 --> 10:05.420]  Which are trust relationships that exist only for a period of time.
[10:05.820 --> 10:10.700]  And generally the most interesting class of those is post-authentication connections.
[10:10.700 --> 10:17.940]  Once you've initially carried out your authentication, the remainder of that session is effectively a transient trust relationship between hosts.
[10:19.160 --> 10:28.840]  Unless you personally authenticate every single packet you send, then you have to accept some sort of transient trust relationship between hosts.
[10:30.880 --> 10:46.900]  Let's look at a couple of methods, the traditional methods for exploiting trust and transient trust relationships.
[10:47.200 --> 10:50.060]  And to do so, I picked a couple of methods just out of the air.
[10:50.600 --> 10:52.800]  How easy it's going to be to do it.
[10:52.800 --> 10:54.760]  How sneaky it is, how stealthy.
[10:54.760 --> 10:57.900]  How close to right the fuck now you can do it.
[10:58.200 --> 11:00.860]  And an overall kind of feeling of feasibility, right?
[11:00.860 --> 11:04.220]  Because an attack's no use if you're only going to be able to use it one time in a hundred.
[11:05.420 --> 11:06.940]  So yeah, we're going to evaluate them.
[11:06.940 --> 11:12.100]  And for the purposes of this, we're just going to assume that we've got a non-root shell on the box.
[11:22.680 --> 11:25.920]  Right, so your traditional non-transient trusts, right?
[11:25.920 --> 11:27.000]  It's pretty straightforward.
[11:27.000 --> 11:33.440]  And our job is to impersonate the credentials that are used to authenticate that connection for trust.
[11:33.440 --> 11:41.660]  Whether it be by coming through the trusted box, using stored key material like a safe trust, or by spoofing.
[11:42.140 --> 11:44.140]  And that's pretty straightforward, right? That's easy.
[11:44.140 --> 11:45.100]  Everyone knows that.
[11:45.720 --> 11:46.680]  It's pretty sneaky, right?
[11:46.680 --> 11:50.080]  No one knows that you turned up, sorted all the trust and abused it, right?
[11:50.080 --> 11:51.320]  It's pretty damn good.
[11:51.940 --> 11:53.460]  When? Yeah, right now, right?
[11:53.460 --> 11:55.480]  You turn up, you find a trust, you're gone. It's all good.
[11:56.160 --> 11:59.400]  But, overall feasibility, it's not simple, right?
[11:59.400 --> 12:03.100]  How often do people still rely on ports being low 1024, right?
[12:03.100 --> 12:05.080]  Outside of like bank environments or whatever.
[12:06.260 --> 12:07.560]  Not that often, unfortunately.
[12:07.560 --> 12:09.680]  So you don't see this, which is a pity, because I like it.
[12:18.750 --> 12:26.250]  Right, the other interesting way to attack a transient trust relationship, a traditional way of doing it, if you will, is key log, right?
[12:26.250 --> 12:34.630]  So during authentication, you log the user's input, either by trojaning SSH having it, listening to your keystrokes,
[12:34.630 --> 12:37.410]  or by logging it from the keyboard or the hardware keylogger, whatever you call it, right?
[12:37.410 --> 12:39.770]  Even shoulder surfing, right? Something old school like that.
[12:39.890 --> 12:44.390]  So you steal the credentials, and then later on, you reuse them for your own good.
[12:44.670 --> 12:45.870]  Right? Classic technique.
[12:46.350 --> 12:47.410]  Easy? Hell yeah.
[12:47.890 --> 12:48.690]  Everyone does it, right?
[12:48.690 --> 12:52.030]  It is the standard way of getting from one box to another.
[12:52.670 --> 12:54.010]  Right, stealthy? Sure, you do it, right?
[12:54.010 --> 12:55.910]  You rootkit the box up, you trojan it, all good.
[12:57.230 --> 13:00.590]  When, this is the downside of this, is you have to wait for them to log back in, right?
[13:00.590 --> 13:04.050]  And say like in our example earlier on, right, you're about to get busted.
[13:04.250 --> 13:07.930]  So if you now go ahead and kill their SSH client, they're not going to reconnect, right?
[13:07.930 --> 13:09.450]  They're wondering where the fuck Pine went.
[13:11.710 --> 13:13.010]  So yeah, that's not so good.
[13:13.010 --> 13:15.130]  Overall feasibility though, it's a really good technique, right?
[13:15.550 --> 13:16.830]  It's kind of the gold standard.
[13:16.830 --> 13:17.630]  It's what everyone does.
[13:17.630 --> 13:19.650]  You can always fall back on a keylogger, right?
[13:20.270 --> 13:21.150]  It's all good.
[13:29.960 --> 13:31.000]  More advanced technique, right?
[13:31.000 --> 13:32.100]  There's a man in the middle, right?
[13:33.320 --> 13:36.220]  Similar sort of thing, except that we impersonate the server to the client,
[13:36.220 --> 13:37.300]  and the client to the server.
[13:37.300 --> 13:39.960]  We sit in the middle, we grab the authentication credentials.
[13:40.040 --> 13:43.440]  Optionally, if it's encrypted, we have a little bit of jiggery-pokey with fake certificates,
[13:43.440 --> 13:45.020]  fake host keys, that sort of thing.
[13:46.520 --> 13:50.460]  And then, later on, we can either sniff their connection, see what they're doing,
[13:50.460 --> 13:52.860]  and if we're feeling particularly narked, we can take it over.
[13:53.120 --> 13:56.240]  Now the downside of that is, of course, the user's probably going to notice.
[13:58.420 --> 14:02.080]  So ease, yeah, it's a relatively well understood sort of thing.
[14:02.460 --> 14:04.680]  You know, it's not wildly complicated.
[14:04.680 --> 14:11.540]  The downside is, as people deploy PKI systems, or at least look at their host keys, which I hope you do,
[14:12.580 --> 14:13.600]  it's not so good.
[14:13.620 --> 14:15.000]  Stealthy, yeah, same thing, right?
[14:15.220 --> 14:17.800]  SSH pops up, huge mongers warning, saying, you know,
[14:17.800 --> 14:21.060]  oh look, someone has messed with your host key, this might be bad.
[14:22.200 --> 14:23.560]  When, same problem, right?
[14:23.560 --> 14:25.880]  We have to wait until authentication time to do it.
[14:26.420 --> 14:28.820]  But overall feasibility, yeah, it's okay, right?
[14:28.820 --> 14:29.860]  We can do this occasionally.
[14:38.220 --> 14:39.880]  Ah, now this is kind of old school, right?
[14:39.880 --> 14:41.460]  The TCP hijack attack, right?
[14:41.460 --> 14:44.420]  You take a running, open, post-authentication connection,
[14:44.420 --> 14:47.540]  and you bust open sequence numbers, and you hijack it, right?
[14:47.540 --> 14:51.300]  This is old school, it's been used quite famously by Mr. Kevin Mitnick.
[14:52.320 --> 14:55.360]  But unfortunately when you go and do it, oh yeah, the user's noticing.
[14:55.360 --> 14:57.860]  Look at that, that does look like Shimomura, don't you think?
[14:58.140 --> 15:01.960]  He looks pretty pissed, he's got two exclamation marks next to him.
[15:02.400 --> 15:03.540]  That's how you tell.
[15:04.040 --> 15:05.820]  So yeah, ease, these days, not so good.
[15:05.820 --> 15:09.180]  People have decent, hopefully, random number sequence generation.
[15:10.440 --> 15:12.180]  And yeah, it's not so stealthy.
[15:12.180 --> 15:14.860]  But the plus side, right, it has all the properties we're looking for, right?
[15:14.860 --> 15:16.180]  We can do it right now, right now.
[15:16.180 --> 15:18.900]  Open connection, it's got the credentials we want at the other end,
[15:18.900 --> 15:20.360]  we can go and steal it, all good.
[15:21.300 --> 15:24.340]  But the downside is, yeah, overall feasibility, not so good, right?
[15:24.440 --> 15:26.820]  You're going to need raw sockets, you're going to need promiscuous interface
[15:27.460 --> 15:29.900]  to try and see the sequence numbers if you're not going to be doing it blind.
[15:29.900 --> 15:32.440]  Doing it blind these days is not as easy as it used to be.
[15:33.480 --> 15:34.460]  So yeah, I like it, right?
[15:34.460 --> 15:37.000]  I'd like to be able to do this, but it's not always feasible.
[15:45.670 --> 15:47.390]  But this is the fun one.
[15:48.350 --> 15:51.690]  So, after we've authenticated the session,
[15:52.630 --> 15:54.430]  we turn up on the user's box,
[15:54.430 --> 15:58.670]  and we sneak down their running connection from inside the box,
[15:59.630 --> 16:01.230]  and they don't notice.
[16:01.690 --> 16:05.030]  Hmm, that sounds easy, it is.
[16:05.230 --> 16:07.130]  It sounds stealthy, it is.
[16:07.510 --> 16:10.110]  It sounds like you could do it right now, hmm.
[16:11.490 --> 16:13.870]  And is it feasible? Well, the code's on your CD.
[16:22.740 --> 16:24.880]  Say what? Yeah, hijack the application.
[16:25.180 --> 16:26.080]  Why not, right?
[16:26.600 --> 16:27.720]  It is slightly different, right?
[16:27.720 --> 16:30.780]  It demands slightly different methodology, right,
[16:30.780 --> 16:31.840]  when you're going to hack someone.
[16:31.840 --> 16:34.780]  Normally, you hack them on a public holiday, on a weekend,
[16:34.780 --> 16:36.760]  you know, when they're getting married, something like that.
[16:37.720 --> 16:41.060]  Here, what you're interested in is maximising the number of open
[16:41.060 --> 16:43.560]  post-authentication sessions for you to sneak down.
[16:43.660 --> 16:45.480]  So really what you want to do is you want to turn up,
[16:45.480 --> 16:47.360]  during peak time, right, the middle of the day,
[16:47.360 --> 16:49.360]  when everybody's right there at their desks.
[16:49.380 --> 16:51.080]  And then you want to sneak in and take their route
[16:51.080 --> 16:53.920]  right out from under them without them noticing.
[16:54.900 --> 16:57.140]  Right, just daylight robbery.
[16:59.760 --> 17:02.320]  And the funny thing is, right, it's not even that difficult.
[17:02.660 --> 17:04.320]  Right, this is just a party trick.
[17:06.960 --> 17:09.120]  I mean, all I did, right, was I thought,
[17:09.120 --> 17:10.400]  you know, there's a lot to be learned from kind of
[17:10.400 --> 17:11.780]  old-school DOS viruses.
[17:11.780 --> 17:13.820]  There's a lot to be learned from things we've done in the past.
[17:13.820 --> 17:16.380]  And this is just creative re-application of the same tricks
[17:16.380 --> 17:19.020]  that, you know, binary reverse engineers and virus writers
[17:19.020 --> 17:22.280]  and all those sort of, you know, kind of sneaky fuckers
[17:22.280 --> 17:23.780]  have been doing for a while.
[17:30.790 --> 17:33.350]  Right, so I took those numbers that I just pulled out of my ass earlier on
[17:33.910 --> 17:36.490]  and I put them on a graph to make it kind of look legitimate.
[17:38.690 --> 17:40.830]  And as this graph clearly demonstrates, right,
[17:40.830 --> 17:42.270]  my technique is wildly better
[17:44.730 --> 17:46.990]  than everything except classic trust relationships,
[17:46.990 --> 17:49.450]  which you'd have to be a retard to deploy, right?
[17:49.450 --> 17:50.190]  I mean, seriously.
[17:50.970 --> 17:52.490]  So yeah, I graphed them.
[17:52.490 --> 17:54.570]  And really the conclusion from this graph is that
[17:54.570 --> 17:56.990]  transient trust relationships, exploiting them,
[17:56.990 --> 17:59.470]  is almost as much fun and as easy as
[17:59.470 --> 18:01.750]  exploiting traditional trust relationships.
[18:08.630 --> 18:10.930]  So, for your hijacking pleasure,
[18:10.930 --> 18:14.150]  I present to you my SSH jacket.
[18:22.470 --> 18:24.490]  It doesn't actually look like that, right?
[18:24.490 --> 18:26.110]  You don't need to clap, but it looks different.
[18:26.110 --> 18:27.630]  It looks like a script and stuff.
[18:29.290 --> 18:31.150]  So yeah, it's a Python script,
[18:31.150 --> 18:34.430]  which, when pointed at an SSH session,
[18:34.430 --> 18:35.750]  gives you a shell at the other end.
[18:35.790 --> 18:36.630]  Just like that.
[18:37.150 --> 18:40.470]  So we're going to talk about briefly how it works,
[18:40.730 --> 18:42.150]  a few kind of implementation details,
[18:42.190 --> 18:43.910]  a bit of nitty-gritty stuff so you can do it yourself.
[18:44.070 --> 18:46.110]  And then we're going to diverge briefly into
[18:46.110 --> 18:49.270]  considering anti-forensics whilst implementing and using it.
[18:50.190 --> 18:52.810]  And then there'll be like one slide of mitigation,
[18:52.810 --> 18:54.510]  you know, just the responsible bit of the talk.
[18:54.890 --> 18:57.170]  And then, yeah, we'll talk about a few other bits and pieces
[18:57.170 --> 19:00.450]  that you might have up your sleeves or I might have up mine.
[19:08.750 --> 19:16.310]  Fullscreen, that's pretty futuristic.
[19:16.490 --> 19:17.870]  I'm not familiar with this commercial software
[19:17.870 --> 19:20.190]  with the two buttons and stuff.
[19:21.750 --> 19:23.430]  I'm kind of a one-button sort of guy.
[19:25.490 --> 19:26.550]  Hey, that's pretty sweet.
[19:29.690 --> 19:31.650]  Hey man, I just hack your network, right?
[19:31.650 --> 19:33.150]  I don't do presentations.
[19:34.870 --> 19:36.250]  So yeah, SSH, right?
[19:36.250 --> 19:38.070]  For those of you who aren't familiar,
[19:38.070 --> 19:40.130]  which probably isn't anybody, I guess,
[19:40.130 --> 19:43.890]  SSH provides this virtual channel metaphor, right?
[19:43.890 --> 19:48.470]  Effectively, SSH provides a multiplexed transport, right?
[19:48.470 --> 19:52.590]  You can run multiple sessions across a single encrypted TCP pipe.
[19:52.610 --> 19:54.450]  And it provides a number of useful things
[19:54.450 --> 19:55.970]  for you to connect to those sessions.
[19:55.970 --> 19:58.290]  The typical ones you'll see is your TTY.
[19:58.590 --> 20:00.830]  Apparently that's pronounced titty, I'm not sure.
[20:02.310 --> 20:05.550]  A shell for you to talk to on the other end of your titty.
[20:08.070 --> 20:09.690]  And of course, TCP sockets is the other thing
[20:09.690 --> 20:10.570]  we normally shunt around.
[20:10.570 --> 20:11.730]  X-connections, that sort of thing.
[20:11.730 --> 20:12.710]  Things over TCP.
[20:12.710 --> 20:14.190]  People are quite familiar with that.
[20:15.350 --> 20:17.110]  So what we're trying to do here, of course,
[20:17.110 --> 20:19.670]  is we want to be able to take the user's session away from him
[20:19.670 --> 20:20.950]  and use his credentials.
[20:20.950 --> 20:22.470]  But we don't want him to notice, right?
[20:22.470 --> 20:24.730]  And this sort of virtual channel metaphor
[20:24.730 --> 20:26.470]  is exactly what we're looking for.
[20:32.500 --> 20:33.800]  So how's it work, huh?
[20:33.800 --> 20:36.880]  Well, we're going to take the features provided by SSH
[20:37.260 --> 20:39.020]  and we're just going to use them for evil.
[20:39.640 --> 20:41.360]  That's what hacking's all about, right?
[20:41.900 --> 20:44.940]  So what we do is we ask for a second shell.
[20:44.940 --> 20:47.000]  We say, hey, server, I'm Bob, I'm authentic.
[20:47.000 --> 20:48.200]  You saw that earlier, right?
[20:48.200 --> 20:49.220]  I gave him my password.
[20:49.220 --> 20:50.040]  I'm good, right?
[20:50.420 --> 20:51.660]  You want to give me another shell?
[20:52.560 --> 20:53.760]  I'll go another one.
[20:54.420 --> 20:55.100]  Maybe two.
[20:55.800 --> 20:57.820]  And then we're going to glue it to the hacker.
[20:58.340 --> 20:59.160]  Give him a socket.
[20:59.840 --> 21:00.460]  Connect it up.
[21:00.460 --> 21:01.140]  Oh, look, a shell.
[21:01.140 --> 21:01.900]  Just like that.
[21:10.990 --> 21:14.370]  So using Python and a little bit of debug trickery,
[21:14.370 --> 21:16.890]  we go ahead and we ptrace attach to the client process.
[21:16.890 --> 21:17.850]  Now, this implies, obviously,
[21:17.850 --> 21:19.750]  that you need to be able to ptrace attach.
[21:19.950 --> 21:21.290]  So, obviously, you have to be root
[21:21.910 --> 21:24.490]  or you have to be running as the same user, right?
[21:24.490 --> 21:26.410]  And that's not as stupid as it sounds.
[21:27.110 --> 21:29.750]  You think about all the Firefox bugs we've had lately, right?
[21:29.790 --> 21:31.210]  Admins who run the links on the desktop
[21:31.210 --> 21:33.010]  are almost always going to run Firefox.
[21:33.010 --> 21:35.950]  There's been a few Firefox kind of zero-day run code sort of bugs.
[21:35.950 --> 21:37.110]  You turn up on the desktop,
[21:37.110 --> 21:38.970]  you find every running SSH connection,
[21:38.970 --> 21:40.070]  you jump down them.
[21:46.030 --> 21:48.030]  And then we just rummage around.
[21:48.890 --> 21:51.790]  And we find ourselves the virtual channel setup code.
[21:52.310 --> 21:54.590]  SSH session 2 open, if you're wondering.
[21:55.350 --> 21:57.030]  And then we just go ahead and patch it.
[21:57.510 --> 21:59.870]  So instead of talking to the user, it talks to us.
[22:07.720 --> 22:09.080]  And then we run it.
[22:17.010 --> 22:19.850]  And then we just put everything back like nothing ever happened.
[22:20.850 --> 22:23.690]  Except that the shell just popped out my netcat.
[22:26.510 --> 22:27.230]  Hehehe.
[22:31.510 --> 22:33.330]  So yeah, this is, I like to think,
[22:33.330 --> 22:35.790]  this is the sort of thing that your mother warns you about, right?
[22:36.770 --> 22:39.090]  Hackers, we're sneaky. Sneaky.
[22:39.590 --> 22:41.190]  Well, one of you guys is sneaky.
[22:41.190 --> 22:42.610]  The guy earlier on, yeah.
[22:43.010 --> 22:43.690]  Yeah.
[22:44.570 --> 22:47.150]  Right, we don't just install LK4 anymore,
[22:47.150 --> 22:49.590]  you know, just trojan ourselves LS and stuff, right?
[22:49.750 --> 22:50.950]  That's kind of boring.
[22:51.330 --> 22:54.610]  And we don't install BNC, because who cares about ISE, that's right.
[22:54.610 --> 22:55.190]  That's crap.
[22:56.630 --> 22:58.090]  Except the older ones get caught there,
[22:58.090 --> 23:00.530]  they're always running egg drop bots and crazy shit like that.
[23:01.830 --> 23:04.170]  And yeah, good hackers, a little bit of creativity here and there,
[23:04.170 --> 23:05.730]  maybe they'll do something new and interesting like
[23:05.730 --> 23:07.190]  jack your SSH connections.
[23:08.030 --> 23:10.350]  And if you hire some pen testers, and they're good,
[23:10.350 --> 23:11.390]  maybe they'll do it too.
[23:16.390 --> 23:19.910]  So all we're really doing here, it's just automated debugging, right?
[23:19.970 --> 23:22.210]  It's not crazy, it's not rocket science, right?
[23:22.470 --> 23:24.210]  And of course, if you give me a debugger,
[23:24.210 --> 23:26.970]  and one of your processes that happens to be doing something important,
[23:26.970 --> 23:28.630]  of course I can fuck with it, right?
[23:28.630 --> 23:30.450]  That's normal, that's what debuggers do.
[23:30.650 --> 23:32.730]  And humans with debuggers can do sneaky things.
[23:33.610 --> 23:36.390]  But what we really want, is we want to automate it, right?
[23:37.470 --> 23:40.590]  We want the sneakiness of a human,
[23:40.590 --> 23:43.290]  and the speed and portability of a script.
[23:44.630 --> 23:46.190]  So that's what we do.
[23:47.410 --> 23:49.150]  So we're using Python, we're using GDB,
[23:49.150 --> 23:51.170]  gluing them together, and we've come up with,
[23:51.170 --> 23:53.630]  effectively, an automated debugging toolkit.
[23:53.630 --> 24:00.900]  Of course, one of the downsides about this,
[24:00.900 --> 24:03.260]  and if you've done any binary reverse engineering,
[24:03.260 --> 24:06.440]  is that debugging binaries,
[24:06.440 --> 24:07.840]  when you don't have any symbol information,
[24:07.840 --> 24:10.400]  is not really debugging, right? It's not fun anymore.
[24:10.800 --> 24:12.600]  So you have to do a bunch of tricks
[24:12.600 --> 24:14.240]  that normal reverse engineers,
[24:14.240 --> 24:15.860]  people who are doing binary analysis, have to do.
[24:15.860 --> 24:17.940]  And we'll talk a little bit about that in a second.
[24:23.400 --> 24:25.880]  So yeah, the nitty-gritty implementation details.
[24:25.880 --> 24:27.760]  Write a little bit about Python, about GDMMI.
[24:27.760 --> 24:31.380]  One of the things we have to do is we have to find a safe place
[24:31.380 --> 24:32.900]  that we're going to stop the program
[24:32.900 --> 24:34.720]  and kind of mess with its execution flow.
[24:34.720 --> 24:37.320]  Because obviously we can't just go wildly executing code
[24:37.320 --> 24:39.520]  in its memory space and hope it's going to work.
[24:40.700 --> 24:42.380]  And then we have to find the code we're going to run,
[24:42.380 --> 24:44.560]  we have to execute that code.
[24:45.100 --> 24:47.180]  Or we have to inject some code there first, obviously.
[24:47.320 --> 24:48.640]  And then we have to put it all back again.
[24:48.640 --> 24:51.060]  And of course, what I'm discussing is in specific reference
[24:51.060 --> 24:52.580]  to my SSH jackup,
[24:52.580 --> 24:53.900]  but it's equally applicable
[24:55.000 --> 24:56.720]  to anything that you're doing this sort of stuff to.
[24:56.720 --> 24:58.640]  And we'll talk about a few of the other interesting things
[24:58.640 --> 24:59.680]  you could do later.
[25:04.120 --> 25:06.760]  So yeah, gdb is the GNU debugger,
[25:06.760 --> 25:09.160]  for those of you who aren't familiar with it.
[25:10.080 --> 25:11.640]  I'm sure you've heard of Richard Stallman, right?
[25:11.640 --> 25:13.960]  He writes some good stuff, one of them happens to be a debugger.
[25:13.960 --> 25:14.800]  It's pretty cool.
[25:15.820 --> 25:18.420]  And gdbmi is its programmatic interface.
[25:19.260 --> 25:20.800]  Gdbmi is actually pretty suck.
[25:20.800 --> 25:22.820]  It's about half implemented, but it's good enough.
[25:23.900 --> 25:26.700]  So yeah, I went ahead and just wrote some Python bindings for it.
[25:27.240 --> 25:29.040]  Implements pretty basic functionality,
[25:29.040 --> 25:31.620]  but enough to get the job done, right?
[25:37.510 --> 25:39.410]  So the SSH client,
[25:39.410 --> 25:41.470]  as you normally use it, is single threaded.
[25:41.590 --> 25:43.290]  It doesn't expect to be running other code
[25:43.290 --> 25:44.550]  in the middle of other code.
[25:45.570 --> 25:47.750]  So yeah, and there's all sorts of
[25:47.750 --> 25:49.930]  kind of nasty global data structures
[25:49.930 --> 25:51.430]  and arrays of function pointers
[25:51.430 --> 25:52.770]  and shit like that, right?
[25:52.770 --> 25:53.890]  So we have to be a little careful
[25:54.710 --> 25:56.090]  about what we're doing.
[25:56.170 --> 25:59.490]  It's also completely asynchronous.
[25:59.490 --> 26:01.190]  So when you, for example,
[26:01.190 --> 26:02.510]  when we ask for that virtual channel,
[26:02.510 --> 26:03.990]  it doesn't get set up right there.
[26:04.030 --> 26:05.450]  It goes in a queue with a list of packets
[26:05.450 --> 26:06.590]  that have to be sent to set it up
[26:06.590 --> 26:09.550]  and there's a whole kind of state machine
[26:09.550 --> 26:12.210]  that models how the SSH client interacts with the server.
[26:12.330 --> 26:13.590]  So we have to be kind of careful.
[26:14.210 --> 26:15.690]  So we have to find the safe place
[26:15.690 --> 26:16.710]  where we can run our code.
[26:16.710 --> 26:17.910]  And what you're aiming for
[26:17.910 --> 26:19.390]  in the choice of a safe place
[26:19.390 --> 26:21.170]  is really minimal deviation
[26:21.170 --> 26:23.270]  from the normal operation of the code.
[26:23.270 --> 26:24.910]  And funnily enough, right,
[26:24.910 --> 26:26.830]  that happens to be in the middle of the main line,
[26:26.830 --> 26:29.110]  of course, around the select call
[26:29.110 --> 26:30.670]  because that's where everything branches from.
[26:30.670 --> 26:33.490]  So we read the findSource,
[26:33.490 --> 26:34.370]  I find the select call,
[26:34.370 --> 26:36.110]  I decide that's probably a good place.
[26:37.450 --> 26:39.070]  So we ptrace attach,
[26:39.070 --> 26:40.750]  we stop the process, we drop a breakpoint
[26:40.750 --> 26:42.170]  in that safe place, and we let it run
[26:42.170 --> 26:43.590]  until it comes back.
[26:44.570 --> 26:45.570]  Just like that.
[26:53.280 --> 26:54.820]  But where is select?
[26:54.820 --> 26:56.180]  Normally, right, normally if you're debugging something
[26:56.180 --> 26:57.620]  you just go, hey, gdb where select?
[26:57.740 --> 27:00.020]  And it goes, oh, yeah, over there. It's all good.
[27:00.020 --> 27:02.400]  But we don't have any symbol information
[27:02.400 --> 27:04.780]  so we have to do a little, you know, work backwards.
[27:04.860 --> 27:06.740]  And this technique is very well understood.
[27:06.740 --> 27:07.980]  Everyone does this sort of thing.
[27:09.340 --> 27:10.600]  So where does select come from?
[27:10.600 --> 27:12.260]  It comes from libc. So how does it get in there?
[27:12.260 --> 27:13.960]  Well, the loader puts it there.
[27:14.860 --> 27:15.420]  Where does it put it?
[27:15.420 --> 27:16.980]  It dynamically links it into address space.
[27:16.980 --> 27:18.720]  So we ask, where do you dynamically link it?
[27:18.720 --> 27:20.180]  It says over here, and that's all good.
[27:24.560 --> 27:26.380]  And then, you know, we have to rummage around
[27:26.380 --> 27:28.660]  in the global offset table.
[27:29.080 --> 27:30.320]  Find it in there.
[27:35.440 --> 27:37.240]  The ELF procedure linkage table,
[27:37.240 --> 27:39.540]  another exciting piece of the ELF format.
[27:44.740 --> 27:46.580]  And then we rather boringly rummage
[27:46.580 --> 27:47.380]  through the code segment
[27:47.380 --> 27:49.020]  until we find a piece of code
[27:49.020 --> 27:50.580]  that calls that PLT entry.
[27:50.580 --> 27:51.760]  In this case, actually, it's quite easy
[27:51.760 --> 27:53.120]  because there is only one call to select
[27:53.120 --> 27:54.220]  in the whole damn binary.
[27:54.220 --> 27:55.960]  So we can put a breakpoint
[27:55.960 --> 27:57.540]  right in the middle of the ELF PLT.
[27:57.540 --> 27:58.720]  Save me a step. Nice.
[27:59.760 --> 28:01.380]  So yeah, now we've found select.
[28:08.820 --> 28:10.560]  So where are we going to put our evil code?
[28:11.740 --> 28:12.940]  Well, we're going to go and patch
[28:12.940 --> 28:14.040]  SSH session 2 open,
[28:14.040 --> 28:15.200]  which is the piece of code responsible
[28:15.200 --> 28:16.560]  for setting up a new virtual channel
[28:17.400 --> 28:19.840]  and asking the server to connect
[28:19.840 --> 28:21.460]  something to the NBR TCP socket,
[28:21.460 --> 28:22.560]  or in our case, a shell.
[28:24.180 --> 28:25.860]  Still no debug symbols, of course.
[28:26.000 --> 28:27.960]  Fortunately for us, there's a unique error string in there.
[28:27.960 --> 28:30.200]  It happens to bitch about the dupe failing.
[28:30.200 --> 28:32.160]  And that's the only occurrence of that string in the binary.
[28:32.160 --> 28:34.860]  So we rummage around, we find it in the read-only data section.
[28:36.880 --> 28:37.900]  And walk the code segment
[28:37.900 --> 28:39.120]  looking for calls to that, right?
[28:39.120 --> 28:41.680]  Now we know roughly where we are in this function. Nice and easy.
[28:48.110 --> 28:50.130]  So yeah, the evil code itself, right?
[28:50.230 --> 28:52.430]  It's going to overwrite the first half
[28:52.430 --> 28:54.030]  of the virtual channel setup code.
[28:54.890 --> 28:56.030]  We're going to save the registers,
[28:56.030 --> 28:58.190]  we're going to save the flags so we don't fuck things up too much.
[28:58.770 --> 29:00.310]  And then basically we're going to inject
[29:00.870 --> 29:02.490]  its shellcode, right? It looks like shellcode.
[29:02.490 --> 29:04.590]  Same sort of thing, right? We're going to call socket,
[29:04.590 --> 29:06.370]  we're going to call connect, we're going to connect it back to
[29:06.370 --> 29:07.870]  wherever we happen to be listening.
[29:08.050 --> 29:09.990]  And then we're going to substitute it for the file handles
[29:09.990 --> 29:12.770]  that it's expecting to be a normal Unix TTY.
[29:14.750 --> 29:16.330]  I like Unix, it's cool.
[29:16.910 --> 29:18.050]  I see you do that in Windows where your
[29:18.050 --> 29:19.790]  Winsock sockets are different from your file.
[29:19.790 --> 29:20.830]  Ah, Jesus.
[29:21.730 --> 29:24.250]  And then we're going to leave the registers set up just right
[29:24.250 --> 29:27.270]  so that the second half of the function runs perfectly.
[29:28.650 --> 29:30.490]  And for really no good reason at all,
[29:30.490 --> 29:32.170]  I'm using libc calls instead of
[29:32.170 --> 29:34.450]  kernel syscalls, which I could.
[29:34.450 --> 29:35.970]  It's just, you know, a bit of variety.
[29:36.430 --> 29:37.950]  Sick of kernel syscalls, very boring.
[29:45.100 --> 29:46.880]  So, why all the effort, right?
[29:46.880 --> 29:48.900]  Why do we go to so much effort to overwrite half a function?
[29:48.900 --> 29:51.420]  Wouldn't it be simpler to just have a piece of code
[29:51.420 --> 29:53.180]  which we've already compiled, which happens to set up
[29:53.180 --> 29:55.200]  virtual channels, and we'll just kind of copy it into
[29:55.200 --> 29:57.600]  its address space and run it, right? That would be a lot more straightforward.
[29:58.740 --> 29:59.840]  Yeah, it might be.
[30:00.600 --> 30:01.860]  But one of the really suck things
[30:01.860 --> 30:03.360]  about that is you have to link it by hand
[30:03.360 --> 30:05.640]  with no symbol information, right?
[30:05.640 --> 30:07.500]  Which, if you've tried, it's not fun, right?
[30:07.500 --> 30:08.920]  That's not a fun game at all.
[30:09.240 --> 30:11.120]  And so I thought maybe it would be easier to just
[30:11.120 --> 30:13.340]  let the bottom half of the function,
[30:13.340 --> 30:14.940]  which contains all the symbol references,
[30:14.940 --> 30:17.720]  just let it be, and inject stuff
[30:17.720 --> 30:19.440]  up the top to take advantage of that.
[30:21.020 --> 30:23.320]  It's particularly nasty for SSH, because it has
[30:23.320 --> 30:24.960]  this whole kind of, you may remember from, you know,
[30:24.960 --> 30:27.320]  programming classes, this data-driven metaphor
[30:27.320 --> 30:29.640]  which was popular kind of late 90s or something,
[30:29.640 --> 30:31.460]  where you have like wild arrays of function pointers
[30:31.460 --> 30:33.460]  and you just let the data index into them and...
[30:35.420 --> 30:37.720]  Right, that's pretty yuck to have to reverse engineer
[30:37.720 --> 30:38.880]  on the fly.
[30:41.760 --> 30:43.420]  It's especially tedious if you have to do it
[30:43.420 --> 30:44.560]  for every binary.
[30:45.480 --> 30:47.980]  In this case, we actually patch it up
[30:47.980 --> 30:49.040]  at runtime,
[30:49.040 --> 30:51.380]  to make sure that the shellcode we have
[30:51.380 --> 30:53.460]  will run in this particular environment.
[30:53.520 --> 30:56.180]  And you'll see, actually, it's surprisingly successful.
[31:05.920 --> 31:07.420]  So what do we do? Well, we work backwards
[31:07.420 --> 31:09.220]  from that unique Duke error message we found.
[31:09.220 --> 31:10.940]  We find the appropriate place at the top of the function.
[31:10.940 --> 31:13.780]  We just kind of walk up until we see a function preamble.
[31:14.860 --> 31:16.420]  And then we learn a few bits and pieces,
[31:16.420 --> 31:17.560]  like how big the local stack is,
[31:17.560 --> 31:18.960]  and we patch in the command line parameters
[31:18.960 --> 31:20.040]  so it's user-friendly.
[31:20.660 --> 31:22.620]  And a few other bits and pieces that we discovered
[31:22.620 --> 31:24.440]  as we were, you know, doing our thing.
[31:25.960 --> 31:27.800]  And now we have a nice little piece of evil.
[31:32.540 --> 31:34.300]  So, yeah, let's wedge it in.
[31:34.600 --> 31:35.740]  Back up the instruction pointer,
[31:35.740 --> 31:36.880]  so we know where we were.
[31:37.600 --> 31:39.500]  Back up the old code that we're about to override.
[31:39.500 --> 31:40.680]  Stash it somewhere in memory.
[31:41.920 --> 31:42.980]  And then we go ahead
[31:42.980 --> 31:44.060]  and just inject our code.
[31:44.060 --> 31:45.780]  Now it's going to take care of a few bits and pieces.
[31:45.780 --> 31:49.000]  We've got a breakpoint at the end to catch it
[31:49.000 --> 31:49.800]  when it's finished.
[31:50.980 --> 31:52.560]  Hmm, what do you think we're going to do next?
[31:59.700 --> 32:00.900]  That guy over there, right?
[32:00.900 --> 32:02.760]  He's busy. He's playing hunt the wumpus, right?
[32:02.760 --> 32:04.320]  He's just doing his job.
[32:05.260 --> 32:07.060]  That wumpus, it's still going to kill him.
[32:07.900 --> 32:09.500]  And we got ourselves a shell.
[32:09.500 --> 32:10.960]  Just like that. Transparent.
[32:10.960 --> 32:12.400]  The user doesn't even notice, right?
[32:12.400 --> 32:14.100]  He sits there running something interactive.
[32:15.400 --> 32:16.700]  Shell pops out from underneath him
[32:16.700 --> 32:18.100]  and he doesn't even notice.
[32:18.980 --> 32:20.140]  Sucks for him, huh?
[32:29.160 --> 32:30.560]  So maybe you're going to go home
[32:30.560 --> 32:31.780]  and jack yourself, right?
[32:36.540 --> 32:37.260]  So what are you going to do?
[32:37.280 --> 32:38.080]  How are you going to do it?
[32:38.140 --> 32:39.700]  How are you guys going to go home
[32:39.700 --> 32:42.240]  and hijack yourself some action?
[32:43.180 --> 32:43.940]  Well, it's pretty straightforward.
[32:43.940 --> 32:45.840]  Well, what I did, and you don't have to
[32:45.840 --> 32:48.240]  kind of do what I did, of course,
[32:48.240 --> 32:49.980]  is I wrote the hijack code in C first.
[32:49.980 --> 32:51.520]  Makes it nice and easy. Compiled it up.
[32:51.740 --> 32:53.520]  I compiled it actually directly into SSH
[32:53.520 --> 32:55.320]  because I wanted to prove that you could have
[32:55.320 --> 32:57.200]  two shell sessions down in SSH.
[32:57.200 --> 32:59.320]  And you can. So I hooked it up
[32:59.320 --> 33:02.040]  like a magic keystroke and you smack the escape
[33:02.680 --> 33:03.860]  tilde, or whatever the hell it is,
[33:03.860 --> 33:04.900]  and bring up the command prompt
[33:04.900 --> 33:07.140]  and open me a shell, please, and it gave me one.
[33:07.200 --> 33:08.360]  Just to prove the point.
[33:10.280 --> 33:11.380]  And then, of course, the compiler
[33:11.380 --> 33:13.620]  had conveniently generated most of my shell code for me.
[33:13.620 --> 33:16.160]  Gee, that's so hard. Glad I bought the book.
[33:17.620 --> 33:19.660]  And then I went ahead and implemented hijacking
[33:19.660 --> 33:21.760]  for a binary that had debug symbols. Make it nice and easy.
[33:21.760 --> 33:23.820]  Just to prove that I get the code in and out of memory,
[33:23.820 --> 33:26.140]  in and out of the half of the function, nice and easily.
[33:31.080 --> 33:32.200]  And then the really suck bit,
[33:32.200 --> 33:34.060]  which is you build a list of symbols you're going to need to find
[33:34.500 --> 33:36.160]  and you come up with a strategy to find them
[33:36.800 --> 33:38.060]  and then you actually have to go ahead
[33:38.060 --> 33:39.200]  and write code to do it.
[33:40.300 --> 33:42.200]  And then, ooh, look, jack your friends. Fun and profit.
[33:43.440 --> 33:45.520]  And then, if you're really nice,
[33:45.520 --> 33:47.480]  package it up for the security consultants,
[33:47.480 --> 33:49.460]  put some 3D, some spinny round, you know.
[33:53.160 --> 33:55.000]  Maybe do it in Flash, I don't know.
[33:59.930 --> 34:01.110]  A few bits and pieces, right?
[34:01.110 --> 34:02.510]  The things that didn't fit in elsewhere.
[34:02.950 --> 34:05.650]  Think about how much you use SSH, right?
[34:06.070 --> 34:07.610]  You use it for SCP.
[34:07.650 --> 34:08.650]  You use it for CVS.
[34:08.650 --> 34:10.650]  You pipe stuff over SSH all the time.
[34:10.650 --> 34:12.430]  You have backup push, you have some CPIO,
[34:12.430 --> 34:15.130]  or whatever other home roll backup solution
[34:15.130 --> 34:15.890]  you're using on Unix
[34:15.890 --> 34:17.310]  because you can't find a decent one.
[34:19.110 --> 34:20.350]  Yeah, it gets around, right?
[34:20.350 --> 34:21.290]  There's a lot of it.
[34:21.730 --> 34:23.610]  And, yeah, this does work over SCP.
[34:23.850 --> 34:26.130]  And, yeah, it does work over stuff over SSH.
[34:26.130 --> 34:27.130]  You know, there's a few little wrinkles,
[34:27.130 --> 34:28.470]  but it works just fine.
[34:29.730 --> 34:32.110]  Actually, the code on your CD doesn't work just fine.
[34:32.110 --> 34:33.950]  The stuff I have right now does.
[34:34.370 --> 34:36.270]  And it'll be on, I guess, on blackhat.com
[34:36.270 --> 34:37.830]  or Defcon or wherever they put this stuff
[34:38.190 --> 34:39.310]  after I've finished.
[34:39.310 --> 34:40.370]  But, yeah, so, yeah, it does.
[34:40.370 --> 34:41.990]  It jacks SCP just fine.
[34:43.670 --> 34:44.990]  You'll notice in the client,
[34:44.990 --> 34:47.790]  you can hit tilde and I think it's hash
[34:47.790 --> 34:48.870]  or something and it brings up a list
[34:48.870 --> 34:50.870]  of the open virtual channels you have.
[34:50.870 --> 34:52.970]  Does it show up in that list? Yeah, it does, actually.
[34:53.310 --> 34:54.810]  How many of you knew you could list
[34:54.810 --> 34:57.110]  the virtual channels open with tilde and hash?
[34:58.030 --> 34:59.070]  One, one.
[34:59.070 --> 35:00.190]  Horns, thank you.
[35:02.370 --> 35:03.410]  But, of course, that's the client
[35:03.410 --> 35:04.710]  that's listing it, so you want to go patch that?
[35:04.710 --> 35:05.710]  Sure, no problem.
[35:06.510 --> 35:07.950]  And what happens when they log out?
[35:07.950 --> 35:09.630]  Well, anyone who's used port forwarding, right,
[35:09.630 --> 35:11.410]  you know what happens when you've got an open shell,
[35:11.410 --> 35:13.510]  you've got a port forward as well, you're using the port forward
[35:13.510 --> 35:15.890]  to, you know, look at GoPorn or whatever,
[35:15.890 --> 35:17.970]  right, and you log out, right, you haven't
[35:17.970 --> 35:19.670]  finished looking at the GoPorn, the connection stays open.
[35:19.670 --> 35:21.110]  Great, well, the same thing happens here.
[35:21.510 --> 35:24.250]  So, you're SCPing, your SCP takes 30 seconds,
[35:24.250 --> 35:25.650]  I happen to catch it in time, run a shell
[35:25.650 --> 35:27.330]  over it, your SCP will stay running
[35:27.850 --> 35:29.710]  once it's finished copying so that I can do some
[35:29.710 --> 35:31.610]  hacking, play Hunt the Wampus.
[35:33.650 --> 35:35.330]  And how does it, well, how well does it work?
[35:35.330 --> 35:37.410]  Well, uh, at the moment, uh, any
[35:37.410 --> 35:39.990]  open SSH3-ish it should work on.
[35:40.330 --> 35:42.010]  Um, it's known to work on, on
[35:42.010 --> 35:43.370]  the out of the box Stephen Sarge
[35:44.290 --> 35:45.770]  RHEL3, RH9, it works on
[35:45.770 --> 35:47.750]  Slack, uh, Slackware as well, 9.1.
[35:48.030 --> 35:49.050]  Uh, it doesn't work on SUSE
[35:49.050 --> 35:50.870]  because their compiler is just retarded.
[35:51.050 --> 35:53.550]  Um, I, I work with a guy who used
[35:53.550 --> 35:55.470]  to work at SUSE on their, on their AMD64
[35:55.470 --> 35:57.370]  stuff and they, they got paid by AMD
[35:57.370 --> 35:59.070]  to write loads of extra optimizations
[35:59.070 --> 36:00.950]  for AMD64 and then they went and back ported
[36:00.950 --> 36:02.970]  them over to Intel and now the compiler just generates
[36:02.970 --> 36:04.950]  code that's so wildly broken.
[36:05.110 --> 36:06.770]  Right, I, I can't, I look at it, right, I can't
[36:06.770 --> 36:09.010]  believe it even executes. Right, I, I've
[36:09.010 --> 36:11.050]  seen it miscompile, like, really basic stuff.
[36:11.050 --> 36:12.970]  Anyway, so, it doesn't work on SUSE,
[36:12.970 --> 36:14.830]  right, uh, ah...
[36:15.790 --> 36:16.990]  I, I'll get round
[36:16.990 --> 36:19.030]  to it, right, I'll probably just write some, some
[36:19.030 --> 36:20.850]  one-off custom code that's gonna
[36:20.850 --> 36:22.990]  work on SUSE because the, the magic heuristic stuff
[36:22.990 --> 36:24.930]  that works on everything else doesn't work on
[36:24.930 --> 36:25.770]  their compiler.
[36:26.990 --> 36:28.050]  Silly SUSE.
[36:35.560 --> 36:36.740]  Also, it's also worth
[36:36.740 --> 36:38.880]  mentioning, I guess, uh, Python 2.2,
[36:38.880 --> 36:41.040]  2.3, 2.4, it's known to work with.
[36:41.040 --> 36:42.740]  2.1, it ought to work, but
[36:42.740 --> 36:44.860]  I haven't tested on 2.1. Anything older than that
[36:44.860 --> 36:46.640]  you're probably, uh, you know, there's a few bits and pieces
[36:46.640 --> 36:48.680]  that are broken. Um, GDB,
[36:48.680 --> 36:50.900]  I haven't noticed any version it doesn't work with yet.
[36:50.980 --> 36:53.200]  Uh, it's a pretty straightforward text interface.
[36:54.860 --> 36:56.620]  Now, if you'll indulge me, a brief, uh,
[36:56.620 --> 36:58.780]  brief tangent into anti-forensics. Now, uh,
[36:58.780 --> 37:00.680]  those of you at, who are at Black Hat,
[37:00.680 --> 37:02.700]  uh, or, uh, RuxCon last
[37:02.700 --> 37:04.540]  year may have seen, uh, the Grugs talk
[37:04.540 --> 37:06.720]  on anti-forensic stuff. I don't know if he was doing
[37:06.720 --> 37:08.320]  it at DefCon, was he? No?
[37:08.600 --> 37:09.120]  No.
[37:10.460 --> 37:12.880]  It's very interesting. Well, I saw it at RuxCon, uh,
[37:12.880 --> 37:14.840]  two years ago, or a year and a half ago.
[37:14.860 --> 37:16.720]  And yes, I remember very interesting things to say about
[37:16.720 --> 37:18.660]  anti-forensics. And of course, when you're,
[37:18.660 --> 37:20.580]  when you're attacking systems like this, right, in
[37:20.580 --> 37:22.780]  the middle of the day, or when everyone's using them,
[37:22.780 --> 37:24.520]  it assumes that you're taking pretty basic
[37:24.520 --> 37:26.700]  anti-forensic precautions. You don't want to leave too
[37:26.700 --> 37:28.160]  many, too many trails.
[37:29.100 --> 37:30.900]  So yeah, I'm going to talk, uh, just a brief,
[37:30.900 --> 37:33.160]  you know, very brief overview of anti-forensic
[37:33.160 --> 37:34.860]  technique, and then how I've implemented
[37:34.860 --> 37:37.120]  it, uh, successfully and unsuccessfully
[37:37.120 --> 37:38.920]  in some places, uh, when I was using and
[37:38.920 --> 37:40.360]  writing the SSH jacket.
[37:44.470 --> 37:46.670]  So yeah, the most important thing, the most
[37:46.670 --> 37:48.730]  important thing is don't put anything on disk.
[37:48.730 --> 37:50.530]  Do it all in memory, right? Memory goes away
[37:50.530 --> 37:51.810]  when they reboot the box.
[37:52.770 --> 37:54.690]  Right? There's nothing on disk, there's no tripwire,
[37:54.690 --> 37:56.630]  there's no, nothing for them to look at with Ncase
[37:56.630 --> 37:58.590]  or whatever other expensive, uh, forensic
[37:58.590 --> 38:00.430]  products they're using. You know, it's like if you get
[38:00.430 --> 38:02.290]  swapped out the disk, you don't know well.
[38:03.130 --> 38:04.450]  But really, you want to try and keep
[38:04.450 --> 38:05.830]  everything in memory only.
[38:06.630 --> 38:08.510]  Uh, use local tools, right? These are,
[38:08.510 --> 38:10.330]  these are Turing-complete machines, you can write your
[38:10.330 --> 38:12.170]  split code in whatever's available, right?
[38:12.170 --> 38:14.570]  If you have to write a port scanner in ORC,
[38:14.570 --> 38:16.990]  do it, right? Right, if it has a
[38:16.990 --> 38:18.950]  Perl interpreter, great, use that. Right, if it has a
[38:18.950 --> 38:20.790]  Python interpreter, use that. If you're good, right,
[38:20.790 --> 38:22.690]  you turn up, you find what's there, and you
[38:22.690 --> 38:25.130]  write your tools on the spot.
[38:25.130 --> 38:26.490]  That way you don't have to go and, you know,
[38:26.490 --> 38:28.590]  wget magic hacksaw tarball.tar.gz
[38:28.590 --> 38:30.110]  from hacksaw.com, right, which is a real
[38:30.110 --> 38:32.650]  fucking giveaway. You don't want
[38:32.650 --> 38:33.730]  them to know what you did.
[38:35.490 --> 38:36.550]  And yeah, try to make
[38:36.550 --> 38:38.510]  new network connections, right? You don't want anything
[38:38.510 --> 38:39.990]  for their intrusion detection or
[38:40.590 --> 38:42.970]  cough prevention systems to spot.
[38:45.090 --> 38:46.470]  And you don't want them sniffing your traffic
[38:46.470 --> 38:48.730]  and kind of replaying it later and figuring out what the hell you did.
[38:49.790 --> 38:50.590]  So yeah, reuse
[38:50.590 --> 38:52.470]  your existing connection, hide in plain sight,
[38:52.470 --> 38:53.310]  use encryption.
[39:00.610 --> 39:01.070]  So,
[39:01.070 --> 39:02.270]  how well do I do?
[39:02.270 --> 39:04.010]  Well, we do use
[39:04.010 --> 39:05.890]  general purpose tools, right? GDB is pretty
[39:05.890 --> 39:07.990]  general purpose. I mean, if you turn up on a box that doesn't
[39:07.990 --> 39:09.950]  have GDB, maybe it's not such a giveaway
[39:09.950 --> 39:11.710]  to go ahead and install it, right? I mean, maybe you're just
[39:11.710 --> 39:14.010]  helping, right? You're just doing a bit of administration for them.
[39:14.670 --> 39:15.770]  Some of the best run Windows
[39:15.770 --> 39:17.830]  boxes I've seen are admin by Russian hackers.
[39:19.950 --> 39:20.290]  Remotely,
[39:20.290 --> 39:21.750]  right? They don't even have to go on site to reboot it.
[39:21.750 --> 39:22.450]  How nice.
[39:23.810 --> 39:25.810]  So yeah, we do. We use general purpose tools. We use the
[39:25.810 --> 39:28.130]  Python interpreter, we use GDB. That's nice.
[39:29.130 --> 39:29.710]  SSH is
[39:29.710 --> 39:32.170]  encrypted, so the packet is not much use.
[39:33.350 --> 39:33.950]  And yeah,
[39:33.950 --> 39:35.510]  our new shell that's
[39:35.510 --> 39:37.790]  going across the existing SSH connection,
[39:37.790 --> 39:39.590]  right, there's nothing new there. There's no new connection
[39:39.590 --> 39:41.270]  for any intrusion detection
[39:41.270 --> 39:42.810]  or things to spot.
[39:42.930 --> 39:45.810]  Not very interesting. That's good.
[39:45.810 --> 39:47.350]  We're looking okay so far.
[39:51.720 --> 39:52.680]  Where do I start?
[39:52.680 --> 39:54.800]  Well,
[39:54.800 --> 39:56.460]  Python code lying around disk.
[39:56.460 --> 39:58.420]  Not very elegant, right? I've got to copy the script across
[39:58.420 --> 40:00.020]  and then I've got to go Python, SSH,
[40:00.020 --> 40:02.420]  yada, yada, yada. That's not very nice. There's no script lying
[40:02.420 --> 40:04.440]  around for them to look at. Even Python bytecode
[40:04.440 --> 40:06.740]  lying around, you can turn that back into code pretty easily.
[40:07.980 --> 40:08.500]  And of course
[40:08.500 --> 40:10.280]  the other problem is we have that connection coming
[40:10.280 --> 40:12.340]  from the SSH client out to
[40:12.340 --> 40:14.460]  our network, which has a TCP
[40:14.460 --> 40:16.100]  connection with the shell on the other end, right?
[40:16.100 --> 40:17.940]  That's a new connection. That's not so nice.
[40:19.160 --> 40:20.780]  And yeah, it's in the clear as well.
[40:20.860 --> 40:22.460]  So obviously if I were a cunning man,
[40:22.460 --> 40:24.160]  if I were a patient man, I would have implemented
[40:24.680 --> 40:26.100]  SSH connect back, right? Because all the
[40:26.100 --> 40:27.720]  code in the client is there, right?
[40:27.860 --> 40:30.400]  I haven't done that yet, sorry.
[40:31.480 --> 40:32.200]  But if you happen
[40:32.200 --> 40:34.140]  to turn up over SSH, right? So say it's
[40:34.140 --> 40:35.940]  the second box you've routed in a row,
[40:35.940 --> 40:38.420]  and you just came in across an SSH connection,
[40:38.420 --> 40:39.700]  why don't you set up a port for it?
[40:40.340 --> 40:42.480]  Bring it back down like that. That would be a pretty good idea.
[40:47.020 --> 40:48.820]  So let's not leave our scripts lying around on disk.
[40:48.820 --> 40:49.840]  How about we just go ahead
[40:50.320 --> 40:52.400]  and load that Python directly into memory?
[40:52.400 --> 40:53.180]  All good, right?
[40:54.000 --> 40:55.200]  So let's just
[40:55.200 --> 40:57.160]  run up a Python interpreter, ask it to read
[40:57.160 --> 40:58.740]  from Samjin, and execute it.
[40:59.280 --> 41:01.100]  And then locally, we'll take the Python script
[41:01.100 --> 41:03.060]  we want to run locally, we'll compile it up, we'll turn it into
[41:03.060 --> 41:04.980]  Python, we'll compress it and paste it into work,
[41:04.980 --> 41:07.380]  we'll send it across the wire, maybe with a
[41:07.380 --> 41:11.300]  little loader at the other end to unpack it and run it.
[41:11.300 --> 41:13.920]  And then send it across your shell.
[41:13.920 --> 41:16.580]  That's all good, right? Nothing on disk.
[41:16.580 --> 41:18.940]  That sound straightforward to anybody?
[41:18.940 --> 41:19.640]  Pretty straightforward to me, right?
[41:19.640 --> 41:21.420]  It's just three lines
[41:21.420 --> 41:23.300]  right there, and then a little bit of jiggery-pokery.
[41:28.220 --> 41:29.580]  I know you want a script.
[41:29.600 --> 41:31.120]  You want scripts, don't you, right?
[41:31.120 --> 41:33.120]  OK, I wrote a script for you, make it nice and easy.
[41:33.880 --> 41:35.120]  It does all of the above, right?
[41:35.120 --> 41:37.420]  So now if we load, we pass in a Python script,
[41:37.420 --> 41:39.460]  list the Python libraries we might require,
[41:39.460 --> 41:41.640]  mine our arguments, packs it up, sends it across,
[41:41.640 --> 41:43.660]  runs it, you give it a shell and a modem,
[41:43.660 --> 41:44.880]  it knows how to do the rest.
[41:45.920 --> 41:47.440]  And then if you're really cool, right,
[41:47.440 --> 41:49.060]  hack in Screen. Screen's really neat.
[41:49.360 --> 41:50.900]  Screen is a terminal multiplexer, right?
[41:50.900 --> 41:51.980]  So you must know Screen.
[41:57.300 --> 41:58.720]  Screen has this really cool feature
[41:59.540 --> 42:00.680]  called Bang.
[42:01.560 --> 42:03.100]  It'll run a local command
[42:03.100 --> 42:05.480]  and then it comes with other options,
[42:05.480 --> 42:07.260]  but it will inject the output
[42:07.260 --> 42:09.480]  of that local command into your remote session.
[42:10.000 --> 42:11.000]  So I sit there on Screen, I go
[42:11.000 --> 42:12.700]  CTRL-A and my screen escapes here.
[42:12.700 --> 42:14.440]  I go bang, bang, bang, bang, bang.
[42:15.200 --> 42:18.240]  Powerful load, SSJAC, process ID,
[42:18.240 --> 42:19.540]  destination host port,
[42:19.540 --> 42:20.600]  and it runs it on the remote machine,
[42:20.600 --> 42:21.740]  just like I was there.
[42:24.040 --> 42:24.940]  That's pretty cool, right?
[42:24.940 --> 42:27.180]  You can almost forget you're running it remotely.
[42:27.660 --> 42:29.060]  And obviously for your convenience,
[42:29.060 --> 42:30.040]  that's obviously neat.
[42:36.800 --> 42:37.720]  So what else can I do?
[42:37.720 --> 42:38.580]  What else can I do with this?
[42:38.580 --> 42:41.440]  Well, it would be nice to actually generate
[42:41.440 --> 42:42.380]  the shellcode on it.
[42:43.220 --> 42:45.320]  I didn't get around to writing it in Assembler yet,
[42:45.320 --> 42:46.420]  and other people have already written it,
[42:46.420 --> 42:47.780]  even in Python, right?
[42:47.780 --> 42:50.420]  It doesn't have a lot of documentation,
[42:50.420 --> 42:52.740]  so I read through it, but I haven't implemented anything.
[42:54.200 --> 42:55.400]  Yeah, pure Python debugger,
[42:55.400 --> 42:56.540]  so that would be cool.
[42:57.420 --> 42:58.460]  Aha!
[42:58.920 --> 43:01.120]  What other protocols have
[43:01.120 --> 43:02.460]  virtual channel infrastructures
[43:03.420 --> 43:05.160]  and are used on clients?
[43:05.160 --> 43:07.000]  Lots. Especially poorly-packed
[43:07.000 --> 43:08.380]  senior clients.
[43:09.020 --> 43:09.800]  Hmm.
[43:10.780 --> 43:12.860]  MS-IDP, Citrix.
[43:13.520 --> 43:14.840]  I've already had a chat with some people
[43:14.840 --> 43:16.220]  who like hacking on Citrix,
[43:16.220 --> 43:18.040]  and they're pretty keen on this idea.
[43:18.360 --> 43:20.040]  Citrix has got a virtual channel infrastructure
[43:20.040 --> 43:23.400]  for running, you know, drive mapping,
[43:25.320 --> 43:26.420]  and all sorts of things.
[43:26.420 --> 43:26.740]  Yeah.
[43:28.480 --> 43:29.700]  And all manner of things, right?
[43:29.700 --> 43:31.360]  I mean, once you have an ordinated
[43:31.760 --> 43:32.980]  programmatic debugging toolkit,
[43:32.980 --> 43:35.420]  you start seeing all the things you can just beat with that hammer, right?
[43:35.420 --> 43:37.300]  It's a really cool thing to have in your toolkit.
[43:38.140 --> 43:38.860]  You can start, you know,
[43:38.860 --> 43:41.040]  you can have it disassemble stuff on the fly,
[43:41.040 --> 43:42.600]  figure stuff out, and patch it, right?
[43:42.600 --> 43:43.860]  All programmatically. It's cool.
[43:50.770 --> 43:51.910]  Right, now,
[43:51.910 --> 43:53.210]  now, being as it is that, you know,
[43:53.210 --> 43:55.370]  I'm obviously some sort of long hair, right?
[43:55.370 --> 43:58.150]  And I'm from the Antipodes,
[43:58.150 --> 43:59.350]  I'm not very fashionable, right?
[43:59.350 --> 44:01.310]  I'm kind of stuck in the 80s and shit, right?
[44:01.310 --> 44:03.410]  So, I'm not sure if this is
[44:03.410 --> 44:04.690]  still fashionable, right?
[44:04.690 --> 44:06.530]  Because, blaming Theo for everything.
[44:07.170 --> 44:08.550]  Is that still fashionable?
[44:09.110 --> 44:10.370]  Yeah? Yeah, okay.
[44:10.810 --> 44:13.390]  Unfortunately for me, it's not Theo's fault.
[44:13.390 --> 44:14.170]  Sorry.
[44:14.930 --> 44:17.110]  It's actually a feature of all things.
[44:17.130 --> 44:19.210]  The SSH protocol specification
[44:19.210 --> 44:21.130]  says it's just fine
[44:21.590 --> 44:23.270]  to have multiple channels on the other end.
[44:23.270 --> 44:25.190]  That's a requirement, right?
[44:25.190 --> 44:26.210]  That's pretty cool, huh?
[44:26.210 --> 44:28.350]  I hadn't really thought about it before, right?
[44:28.350 --> 44:30.070]  My SSH client, right? If I was to say,
[44:30.070 --> 44:31.830]  get a shell, that's all there is to it, right?
[44:32.030 --> 44:34.790]  But now imagine like a graphical client, like a CAD.
[44:39.200 --> 44:40.980]  So yeah, it's a feature, right?
[44:41.040 --> 44:42.800]  If you could get a shell from a server
[44:42.800 --> 44:44.420]  back to the client, right?
[44:44.440 --> 44:46.020]  That would be a bug. Unfortunately,
[44:46.020 --> 44:47.680]  Theo took care of that. He's a good dude.
[44:48.120 --> 44:49.580]  Same with unsolicited port forwarding.
[44:49.580 --> 44:51.680]  If you could port forward from a server back to the client
[44:51.680 --> 44:53.520]  without it asking you to do so,
[44:53.520 --> 44:55.720]  that would be a bug also.
[44:55.820 --> 44:57.280]  But no, I've taken care of that.
[44:57.280 --> 45:00.000]  I haven't looked at any other SSH implementations.
[45:00.280 --> 45:01.600]  Because SSH is, you know,
[45:01.600 --> 45:03.760]  the client and the server are very, very similar
[45:03.760 --> 45:05.480]  in functionality, they both have to deal with
[45:05.480 --> 45:07.360]  this multiplexing and multiplexing.
[45:07.780 --> 45:09.820]  Generally, most people write that code once,
[45:09.820 --> 45:11.440]  right, and use it in both a client and a server
[45:11.440 --> 45:13.940]  implementation, so you have to be pretty careful.
[45:13.940 --> 45:15.400]  So if I were you, and you're using
[45:15.940 --> 45:17.360]  a funny SSH server,
[45:17.360 --> 45:19.980]  one of those crazy Cisco ones,
[45:19.980 --> 45:21.660]  I don't know,
[45:21.660 --> 45:24.000]  yeah, I might have a look at that.
[45:24.280 --> 45:25.600]  It might work, wouldn't it?
[45:26.680 --> 45:27.320]  But anyway,
[45:27.320 --> 45:29.960]  it's not OpenSSH's fault. Please don't send me a bug report.
[45:29.960 --> 45:31.500]  It's not a bug report. Blame me instead.
[45:31.500 --> 45:33.380]  I don't want Theo to, you know, come and bring me up
[45:33.380 --> 45:36.100]  and harass me, kick my ass or whatever.
[45:37.140 --> 45:38.380]  But yeah, OpenSSH is cool.
[45:38.380 --> 45:39.580]  For the record, OpenSSH is cool.
[45:39.580 --> 45:41.500]  I like it. It's a big fat loaded piece of crap,
[45:41.500 --> 45:43.060]  but I like it. I use it every day.
[45:50.120 --> 45:50.800]  Mitigation technique.
[45:50.800 --> 45:52.040]  Responsible slide, right here.
[45:52.260 --> 45:54.580]  Don't get rooted. Nice and easy.
[45:55.260 --> 45:57.080]  You could, if you were cunning,
[45:57.080 --> 45:58.760]  patch ptrace, maybe, so you
[45:58.760 --> 45:59.740]  couldn't do it as a user.
[45:59.740 --> 46:02.460]  I suppose there's patches around to do that already.
[46:03.120 --> 46:04.560]  One of the things that's not on there is
[46:04.560 --> 46:06.200]  you could, the SSH agent,
[46:06.200 --> 46:08.960]  they try to prevent this attack by making it set GID.
[46:09.040 --> 46:10.540]  I don't know that making your SSH client
[46:10.540 --> 46:12.240]  set GID is a good idea. I mean, there's probably
[46:12.240 --> 46:14.660]  all sorts of other things that would go horribly wrong if you did that.
[46:15.880 --> 46:16.720]  One of the most important
[46:16.720 --> 46:18.540]  things that you can actually do to help
[46:18.540 --> 46:20.300]  yourself is if you're running restricted, if you're running
[46:20.300 --> 46:23.040]  trust relationships using keys between hosts,
[46:23.600 --> 46:25.000]  there's a bunch of tools you can use
[46:25.000 --> 46:26.740]  to restrict what those keys can be used for.
[46:26.740 --> 46:28.480]  You can restrict what commands are executed,
[46:28.480 --> 46:30.700]  you can restrict where port forwarding is allowed,
[46:30.700 --> 46:32.780]  you can restrict x-forwarding, all that sort of thing. Use it.
[46:32.780 --> 46:33.920]  Use it. Really do.
[46:34.720 --> 46:36.780]  Oh yeah, and then Steve Gibson, he had some really good ideas
[46:36.780 --> 46:39.220]  about those wall sockets right there. They're bad. Sorry, the buggers.
[46:39.460 --> 46:40.800]  I think we should get him in charge
[46:40.800 --> 46:42.360]  of the anti-bugger movement.
[46:47.460 --> 46:48.240]  Yeah, why do you care?
[46:48.240 --> 46:49.440]  It's just a party trick, right?
[46:49.440 --> 46:51.760]  This is just like eroding the farms. That's all, right?
[46:51.760 --> 46:53.880]  It's not wildly zero-day.
[46:53.880 --> 46:55.420]  If you get rooted, you're screwed. You knew that.
[46:57.100 --> 46:57.840]  Rich desktops?
[46:57.840 --> 46:59.020]  Yeah, it's a good way, right?
[46:59.120 --> 47:01.740]  Tacking desktop machines that are full of complexity is a very good way
[47:01.740 --> 47:03.300]  to get to well-protected servers.
[47:03.300 --> 47:05.600]  And especially willing to admins. Anyone running Linux on a desktop
[47:05.600 --> 47:07.680]  is probably looking after interesting stuff.
[47:08.940 --> 47:09.820]  And yeah, try it against
[47:10.380 --> 47:11.420]  RDPM or ICA.
[47:11.420 --> 47:12.580]  That could be interesting.
[47:17.160 --> 47:18.260]  Very pretty mad greets.
[47:18.260 --> 47:20.340]  There's not much of a scene in New Zealand. There's only a few of us.
[47:20.340 --> 47:22.340]  We all drink beer. There's like, let's run through tables
[47:22.340 --> 47:25.020]  the whole scene, but yeah, I thought I'd better say hi to them.
[47:25.020 --> 47:27.040]  And GadooSpice, he gave me my first security hack
[47:27.040 --> 47:27.920]  two years ago.
[47:28.740 --> 47:29.740]  He's a good dude.
[47:30.660 --> 47:33.280]  Oh yeah, and there were a few talks about this one that were interesting.
[47:33.340 --> 47:34.940]  The Elf. Sean Flowers
[47:34.940 --> 47:37.140]  Elf Encrypter, right? That's some crazy shit.
[47:37.140 --> 47:38.860]  I gotta read that. It's like, symbiotic
[47:39.600 --> 47:40.980]  p-tracing processes that
[47:40.980 --> 47:42.740]  take memory in and out of each other
[47:42.740 --> 47:44.780]  and unencrypt it. It's crazy. Go look at it.
[47:49.940 --> 47:50.720]  Apparently, I'm out of time
[47:50.720 --> 47:51.860]  so you don't get to shred me.
[47:52.060 --> 47:53.960]  Sorry. There was also a demo
[47:53.960 --> 47:56.720]  that I'm getting the head signal.
[47:58.140 --> 47:58.780]  If you want to see it,
[47:58.780 --> 48:00.720]  come see me afterwards. We'll do it on a box that doesn't
[48:00.720 --> 48:01.820]  look like a screensaver.
[48:02.880 --> 48:03.960]  Alright, thank you guys!