WEBVTT 00:04.100 --> 00:05.340 Here's my plan, right? 00:05.700 --> 00:08.860 We're going to deliver our squirt virus in the email, right? 00:08.860 --> 00:12.360 It's going to live on their mail server until the admin's clever enough to read it. 00:13.180 --> 00:15.140 At that point, we're going to squirt his time. 00:15.240 --> 00:16.300 Mmm , pretty cool plan. 00:17.520 --> 00:20.280 Connect back shellcode out to us, listening on the public internet. 00:21.020 --> 00:24.160 We're going to escalate some privileges, drop out a nice and prepared rootkit. 00:24.880 --> 00:30.140 And then from there, we'll throw him his SSH up good and proper, sniff his keystrokes, wait for the logs in the database server. 00:30.160 --> 00:31.000 Yeah, it's all good, right? 00:31.000 --> 00:31.660 All good. 00:43.520 --> 00:45.440 Those didn't look like email addresses to me. 00:46.000 --> 00:47.320 All right, anyway, so. 00:47.460 --> 00:51.720 Got a brand new Pine 0-8, run it through our mail spoofer, send him something he's got to read, right? 00:51.720 --> 00:53.960 Now that looks like a compelling piece of email to me. 00:54.980 --> 00:57.440 And we fire up our netcap, and we hang on. 00:57.980 --> 01:02.080 If you notice, for convenience, that's on 41327 instead of 443, but never mind. 01:03.460 --> 01:04.540 And look at that. 01:04.600 --> 01:05.080 Shell. 01:05.080 --> 01:06.740 Right, find squirt, work perfectly. 01:07.380 --> 01:08.100 Yep. 01:08.340 --> 01:09.260 You were the admin? 01:09.260 --> 01:09.720 Mm-hmm. 01:09.720 --> 01:11.320 Yeah, he's a clever man, nice username. 01:12.360 --> 01:14.260 Oh, shit, where did Pine go? 01:14.300 --> 01:14.840 Nah. 01:15.860 --> 01:17.620 Ah, look, damn thing dropped core, right? 01:17.620 --> 01:18.640 He's probably going to notice that. 01:18.640 --> 01:20.520 He's sitting there, using his Pine, and bam, all gone. 01:20.520 --> 01:21.300 Ah, shit. 01:29.260 --> 01:31.900 So at this point, you know, he's probably going to spot us. 01:31.900 --> 01:35.020 Hacksaw.com, pretty poor choice of reverse, I now admit. 01:37.260 --> 01:39.200 And, ah, yeah, look at that, nice. 01:39.200 --> 01:41.740 Starter Club Shell, he's going to start running around where the core is. 01:41.940 --> 01:42.760 Ah, shit. 01:43.600 --> 01:43.820 So 01:47.780 --> 01:52.980 right about now, if you're a clever man, you know, if you're a wise man, it's time to drop carrier, right? 01:53.540 --> 01:56.740 Plus, plus, plus, ADHMort, just get the hell out of here, right? 01:56.740 --> 01:58.540 Things have gone horribly wrong. 01:59.540 --> 02:00.120 Cool. 02:00.740 --> 02:05.660 Apparently pear shape doesn't translate well into North American English, you know, I'm terribly sorry about that. 02:07.820 --> 02:09.340 But yeah, did you see that? 02:09.340 --> 02:10.880 In the PSR I put back there? 02:16.930 --> 02:17.290 No? 02:17.290 --> 02:21.130 Look, look, look, SSH session, root, and then nameserver. 02:21.850 --> 02:23.270 That sounds pretty good, huh? 02:23.270 --> 02:24.090 Pretty good. 02:24.510 --> 02:25.390 I like that. 02:32.030 --> 02:33.790 If I drop carrier now, right? 02:33.810 --> 02:35.850 I'm never going to get a chance like that, right? 02:36.690 --> 02:41.890 Man, I really, really, really wish there was a way I could get to the other end of that SSH session. 02:41.890 --> 02:43.570 It's authenticated, it's already root, right? 02:43.570 --> 02:45.570 I don't even have to goddamn root the box. 02:45.790 --> 02:48.430 All I gotta do is get down that SSH session, man. 02:48.970 --> 02:50.310 If only there was a way. 02:55.670 --> 02:57.630 Like fucking duh there is. 02:58.330 --> 03:00.050 Which is why I'm standing here. 03:02.350 --> 03:06.670 So, yeah, I smacked a few magic keystrokes, a little bit of this, a little bit of that, some bang. 03:06.670 --> 03:07.810 Bangy-bang-bang. 03:08.870 --> 03:09.910 SSH Jack. 03:20.550 --> 03:22.350 Anyway, yeah, so my name's Metal Storm. 03:22.390 --> 03:23.950 My mum calls me Adam. 03:25.310 --> 03:28.390 I'm from New Zealand, which is why I sound a little fucked up. 03:29.790 --> 03:36.010 For those of you who are not familiar, it's a very small island that kind of like connects people to any city in the entire North America. 03:36.010 --> 03:39.590 And, yeah, we have lots of sheep and apparently hobbits. 03:39.590 --> 03:40.990 I haven't seen any right now that aren't. 03:40.990 --> 03:44.470 Let me tell you right now, there are no hobbits. 03:45.190 --> 03:46.550 There's no hobbitses. 03:46.630 --> 03:48.550 They don't have preciouses. 03:48.570 --> 03:49.550 They don't exist. 03:49.750 --> 03:51.930 Sad, sad token fanboys. 03:54.090 --> 03:56.870 See, I work for a Linux integrator. 03:56.870 --> 04:01.330 I don't actually do much security for a living, so I'm kind of here in a personal capacity, which is why I can say fuck. 04:02.970 --> 04:06.210 In the past, I've been a corporate or security consultant. 04:06.210 --> 04:07.630 I've done network engineering. 04:07.630 --> 04:08.870 I've done all sorts of stuff. 04:16.780 --> 04:19.780 So, right, what the fuck, what the fuck did we just do, right? 04:22.240 --> 04:25.580 We saw ourselves a pretty classic intrusion, right? 04:26.420 --> 04:29.320 Slightly different modus operandi than you're probably used to, right? 04:30.140 --> 04:31.920 Server box was pretty well secured. 04:31.920 --> 04:38.540 Instead of attacking the server directly, I decided that the best way to do it is to attack the admin's desktop and then from there to the server. 04:39.240 --> 04:40.280 But there's desktops, right? 04:40.280 --> 04:42.580 I mean, Linux desktops just as much as Windows desktops. 04:42.580 --> 04:43.920 There's a whole bunch of complexity, right? 04:43.920 --> 04:50.780 We don't have clipping, but we do have, you know, lots of candy and enlightenment and things that make your desktop look real pretty. 04:51.900 --> 04:56.260 And all that complexity, all that kind of intellectual candy floss that's there to just rot your brain, right? 04:56.260 --> 04:57.480 That's where all the bugs are. 04:57.660 --> 05:00.000 So, I want to root up someone's big Linux server, right? 05:00.000 --> 05:01.200 I'm not going to go after the server. 05:01.200 --> 05:04.660 It's got intrusion detection all over the place and intrusion prevention like it works. 05:06.740 --> 05:09.380 I'm going to go attack the desktops, right? 05:09.380 --> 05:10.400 That's where it's at. 05:11.000 --> 05:12.900 And certainly people who have Linux desktops, right? 05:12.900 --> 05:14.060 They're real geeky. 05:14.240 --> 05:17.900 They have glasses and long hair and beauty fears and shit, right? 05:18.000 --> 05:20.540 And they look after all the good stuff. 05:20.880 --> 05:22.580 So, that's where you're going to go. 05:23.360 --> 05:24.420 But sometimes, right? 05:24.420 --> 05:25.600 Sometimes you're not perfect, right? 05:25.600 --> 05:26.820 Things go wrong. 05:27.160 --> 05:28.980 In that particular case, you know, we got there. 05:28.980 --> 05:29.520 We got busted. 05:29.520 --> 05:30.060 We dropped Cor. 05:30.060 --> 05:31.080 He's going to know this. 05:32.420 --> 05:36.240 So, you know, you can drop Cor like some sort of little pansy. 05:36.400 --> 05:38.520 Or maybe, you know, do something a little different. 05:38.520 --> 05:39.800 Just play some adaptability. 05:40.020 --> 05:40.980 Something a little new. 05:54.340 --> 05:55.400 When you hack something, what do you do? 05:55.400 --> 05:56.060 What are your goals? 05:56.060 --> 05:56.580 Well, 06:09.750 --> 06:11.310 figure out what you want to do next. 06:11.950 --> 06:14.470 Very rarely do you ever, you know, just get root on the box. 06:14.470 --> 06:14.810 You won't. 06:14.810 --> 06:15.430 You won't. 06:19.590 --> 06:22.090 So , yeah, you have to do reconnaissance, right? 06:22.090 --> 06:23.890 You're usually on your way to it. 06:24.930 --> 06:26.870 There's kind of another thing you could do, right? 06:26.870 --> 06:28.510 You could be a good guerrilla star, right? 06:28.510 --> 06:29.350 You walk in there. 06:29.350 --> 06:30.070 You get what you want. 06:30.070 --> 06:31.730 You get the hell out real fast. 06:32.130 --> 06:33.890 And that saves you a bunch of time and effort. 06:34.690 --> 06:36.030 And I'd like to explain adaptability, right? 06:36.030 --> 06:40.070 That's a big difference between all you fuckers and the people they pay to do this for. 06:41.470 --> 06:42.850 At least, the cheap ones anyway. 06:42.850 --> 06:43.450 I don't know. 06:44.590 --> 06:44.910 You 06:50.500 --> 06:55.040 have to have a really big name for root and other stuff instead of the stuff you've got. 06:55.880 --> 06:57.800 Cross-host privilege escalation, right? 06:57.800 --> 06:59.300 So, privilege escalation is pretty normal. 06:59.300 --> 07:00.120 You have a user account. 07:00.120 --> 07:00.880 You want to get some root. 07:00.880 --> 07:01.520 That's good. 07:01.520 --> 07:06.320 I think root on another box is just as good as root on this box most of the time, right? 07:07.000 --> 07:09.140 And local root, you know, it can be a distraction. 07:10.160 --> 07:11.360 You're on your way to somewhere. 07:11.360 --> 07:14.520 You don't have time to sit around and root, hit a box up, and drop it. 07:15.380 --> 07:19.160 You know, local vulnerabilities are easy to exploit often, right? 07:19.160 --> 07:20.460 We've got a lot more information. 07:20.460 --> 07:22.040 What's the version stack layout? 07:22.040 --> 07:23.860 You know what we're getting ourselves into. 07:24.320 --> 07:29.420 It can be kind of tempting to sit around and escalate your privileges because you feel good about it, right? 07:29.420 --> 07:30.360 You know, you're achieving something. 07:30.360 --> 07:32.320 You feel good, right? 07:32.320 --> 07:33.720 You feel good about yourself. 07:35.400 --> 07:36.140 Yeah, easy is good. 07:36.140 --> 07:36.660 I like easy. 07:36.660 --> 07:40.060 But what if there was something easier than local privilege escalation? 07:47.250 --> 07:48.450 Trust relationships. 07:49.070 --> 07:50.790 It's kind of old school, I know. 07:50.970 --> 07:54.850 We must be, what, five, six, seven years ago talking about trust relationships? 07:55.550 --> 07:57.030 It's kind of old school, yeah. 07:57.030 --> 07:58.510 You know, you've got cross-hosts. 07:58.510 --> 08:02.150 And back when ports below 1024 were just magically rooted. 08:03.930 --> 08:07.270 Back when people exported slash readwrite to the entire world. 08:08.050 --> 08:08.950 That was good, right? 08:08.950 --> 08:10.710 We're just a bunch of long-haired unix hippies, right? 08:10.710 --> 08:11.330 We love each other. 08:11.330 --> 08:12.090 It's all good. 08:12.090 --> 08:13.370 We just share. 08:13.430 --> 08:14.350 You don't mind this space. 08:14.350 --> 08:15.450 It's your disk space. 08:17.490 --> 08:18.570 It makes you feel good, right? 08:18.590 --> 08:19.730 It's old school. 08:19.730 --> 08:22.610 You feel like your mummy's tucking you up in bed. 08:22.610 --> 08:23.490 You know, it's good. 08:24.570 --> 08:26.170 But we called that hacking, right? 08:26.170 --> 08:27.230 That's just embarrassing, right? 08:27.230 --> 08:27.910 That wasn't hacking. 08:27.910 --> 08:29.650 That was just mounting stuff. 08:29.650 --> 08:36.110 How many of you watched Unauthorized Access where a simple nomad goes, like, mount? 08:36.330 --> 08:37.190 And he's a hacker? 08:39.550 --> 08:40.090 Sorry. 08:40.090 --> 08:42.570 You're in the room, so... 08:47.490 --> 08:51.870 And that's my favorite thing about trust relationships. 08:52.650 --> 08:53.670 Instant gratification, right? 08:53.670 --> 08:54.350 You turn up. 08:54.350 --> 08:56.670 There's a trust relationship between hosts, right? 08:56.670 --> 08:57.710 It's like Christmas. 08:57.710 --> 08:58.250 It's good. 08:58.250 --> 08:58.990 Right now. 08:58.990 --> 09:00.390 You get Root on another box. 09:00.390 --> 09:01.270 Or Shell on another box. 09:01.270 --> 09:02.050 It's great, right? 09:02.050 --> 09:03.430 It makes you feel really good. 09:13.850 --> 09:15.650 Traditional trust relationships, right? 09:15.650 --> 09:22.010 I call them long transient trusts for no reason other than that I'm obviously about to talk about transient trusts. 09:23.110 --> 09:25.930 So that's what I'm calling traditional kind of fixed trusts. 09:25.930 --> 09:27.290 Things like host trusts. 09:27.290 --> 09:29.970 Things like SSH key-based trusts. 09:30.130 --> 09:34.250 They're trust relationships that exist as stored authentication predictions. 09:34.250 --> 09:37.410 What Bruce and I would probably call one-factor authentication. 09:38.870 --> 09:42.110 Or it can be authentication based on properties of the connection. 09:42.110 --> 09:44.110 The source address, the whole thing below. 09:44.110 --> 09:45.190 All that sort of thing, right? 09:45.190 --> 09:48.530 Just your traditional run-of-the-mill garden trust relationship. 09:58.720 --> 10:01.740 And then there's trust relationships which are transient. 10:01.740 --> 10:05.420 Which are trust relationships that exist only for a period of time. 10:05.820 --> 10:10.700 And generally the most interesting class of those is post-authentication connections. 10:10.700 --> 10:17.940 Once you've initially carried out your authentication, the remainder of that session is effectively a transient trust relationship between hosts. 10:19.160 --> 10:28.840 Unless you personally authenticate every single packet you send, then you have to accept some sort of transient trust relationship between hosts. 10:30.880 --> 10:31.420 Let's 10:40.560 --> 10:46.900 look at a couple of methods, the traditional methods for exploiting trust and transient trust relationships. 10:47.200 --> 10:50.060 And to do so, I picked a couple of methods just out of the air. 10:50.600 --> 10:52.800 How easy it's going to be to do it. 10:52.800 --> 10:54.760 How sneaky it is, how stealthy. 10:54.760 --> 10:57.900 How close to right the fuck now you can do it. 10:58.200 --> 11:00.860 And an overall kind of feeling of feasibility, right? 11:00.860 --> 11:04.220 Because an attack's no use if you're only going to be able to use it one time in a hundred. 11:05.420 --> 11:06.940 So yeah, we're going to evaluate them. 11:06.940 --> 11:12.100 And for the purposes of this, we're just going to assume that we've got a non-root shell on the box. 11:22.680 --> 11:25.920 Right, so your traditional non-transient trusts, right? 11:25.920 --> 11:27.000 It's pretty straightforward. 11:27.000 --> 11:33.440 And our job is to impersonate the credentials that are used to authenticate that connection for trust. 11:33.440 --> 11:41.660 Whether it be by coming through the trusted box, using stored key material like a safe trust, or by spoofing. 11:42.140 --> 11:43.280 And that's pretty straightforward, right? 11:43.280 --> 11:44.140 That's easy. 11:44.140 --> 11:45.100 Everyone knows that. 11:45.720 --> 11:46.680 It's pretty sneaky, right? 11:46.680 --> 11:50.080 No one knows that you turned up, sorted all the trust and abused it, right? 11:50.080 --> 11:51.320 It's pretty damn good. 11:51.940 --> 11:52.500 When? 11:52.500 --> 11:53.460 Yeah, right now, right? 11:53.460 --> 11:54.700 You turn up, you find a trust, you're gone. 11:54.700 --> 11:55.480 It's all good. 11:56.160 --> 11:59.400 But, overall feasibility, it's not simple, right? 11:59.400 --> 12:03.100 How often do people still rely on ports being low 1024, right? 12:03.100 --> 12:05.080 Outside of like bank environments or whatever. 12:06.260 --> 12:07.560 Not that often, unfortunately. 12:07.560 --> 12:09.680 So you don't see this, which is a pity, because I like it. 12:18.750 --> 12:26.250 Right, the other interesting way to attack a transient trust relationship, a traditional way of doing it, if you will, is key log, right? 12:26.250 --> 12:37.410 So during authentication, you log the user's input, either by trojaning SSH having it, listening to your keystrokes, or by logging it from the keyboard or the hardware keylogger, whatever you call it, right? 12:37.410 --> 12:38.610 Even shoulder surfing, right? 12:38.610 --> 12:39.770 Something old school like that. 12:39.890 --> 12:44.390 So you steal the credentials, and then later on, you reuse them for your own good. 12:44.670 --> 12:44.950 Right? 12:44.950 --> 12:45.870 Classic technique. 12:46.350 --> 12:46.810 Easy? 12:46.810 --> 12:47.410 Hell yeah. 12:47.890 --> 12:48.690 Everyone does it, right? 12:48.690 --> 12:52.030 It is the standard way of getting from one box to another. 12:52.670 --> 12:53.350 Right, stealthy? 12:53.350 --> 12:54.010 Sure, you do it, right? 12:54.010 --> 12:55.910 You rootkit the box up, you trojan it, all good. 12:57.230 --> 13:00.590 When, this is the downside of this, is you have to wait for them to log back in, right? 13:00.590 --> 13:04.050 And say like in our example earlier on, right, you're about to get busted. 13:04.250 --> 13:07.930 So if you now go ahead and kill their SSH client, they're not going to reconnect, right? 13:07.930 --> 13:09.450 They're wondering where the fuck Pine went. 13:11.710 --> 13:13.010 So yeah, that's not so good. 13:13.010 --> 13:15.130 Overall feasibility though, it's a really good technique, right? 13:15.550 --> 13:16.830 It's kind of the gold standard. 13:16.830 --> 13:17.630 It's what everyone does. 13:17.630 --> 13:19.650 You can always fall back on a keylogger, right? 13:20.270 --> 13:21.150 It's all good. 13:29.960 --> 13:31.000 More advanced technique, right? 13:31.000 --> 13:32.100 There's a man in the middle, right? 13:33.320 --> 13:37.300 Similar sort of thing, except that we impersonate the server to the client, and the client to the server. 13:37.300 --> 13:39.960 We sit in the middle, we grab the authentication credentials. 13:40.040 --> 13:45.020 Optionally, if it's encrypted, we have a little bit of jiggery-pokey with fake certificates, fake host keys, that sort of thing. 13:46.520 --> 13:52.860 And then, later on, we can either sniff their connection, see what they're doing, and if we're feeling particularly narked, we can take it over. 13:53.120 --> 13:56.240 Now the downside of that is, of course, the user's probably going to notice. 13:58.420 --> 14:02.080 So ease, yeah, it's a relatively well understood sort of thing. 14:02.460 --> 14:04.680 You know, it's not wildly complicated. 14:04.680 --> 14:13.600 The downside is, as people deploy PKI systems, or at least look at their host keys, which I hope you do, it's not so good. 14:13.620 --> 14:15.000 Stealthy, yeah, same thing, right? 14:15.220 --> 14:21.060 SSH pops up, huge mongers warning, saying, you know, oh look, someone has messed with your host key, this might be bad. 14:22.200 --> 14:23.560 When, same problem, right? 14:23.560 --> 14:25.880 We have to wait until authentication time to do it. 14:26.420 --> 14:28.820 But overall feasibility, yeah, it's okay, right? 14:28.820 --> 14:29.860 We can do this occasionally. 14:38.220 --> 14:39.880 Ah, now this is kind of old school, right? 14:39.880 --> 14:41.460 The TCP hijack attack, right? 14:41.460 --> 14:47.540 You take a running, open, post-authentication connection, and you bust open sequence numbers, and you hijack it, right? 14:47.540 --> 14:50.440 This is old school, it's been used quite famously by Mr. 14:50.440 --> 14:51.300 Kevin Mitnick. 14:52.320 --> 14:55.360 But unfortunately when you go and do it, oh yeah, the user's noticing. 14:55.360 --> 14:57.860 Look at that, that does look like Shimomura, don't you think? 14:58.140 --> 15:01.960 He looks pretty pissed, he's got two exclamation marks next to him. 15:02.400 --> 15:03.540 That's how you tell. 15:04.040 --> 15:05.820 So yeah, ease, these days, not so good. 15:05.820 --> 15:09.180 People have decent, hopefully, random number sequence generation. 15:10.440 --> 15:12.180 And yeah, it's not so stealthy. 15:12.180 --> 15:14.860 But the plus side, right, it has all the properties we're looking for, right? 15:14.860 --> 15:16.180 We can do it right now, right now. 15:16.180 --> 15:20.360 Open connection, it's got the credentials we want at the other end, we can go and steal it, all good. 15:21.300 --> 15:24.340 But the downside is, yeah, overall feasibility, not so good, right? 15:24.440 --> 15:29.900 You're going to need raw sockets, you're going to need promiscuous interface to try and see the sequence numbers if you're not going to be doing it blind. 15:29.900 --> 15:32.440 Doing it blind these days is not as easy as it used to be. 15:33.480 --> 15:34.460 So yeah, I like it, right? 15:34.460 --> 15:37.000 I'd like to be able to do this, but it's not always feasible. 15:45.670 --> 15:47.390 But this is the fun one. 15:48.350 --> 16:01.230 So, after we've authenticated the session, we turn up on the user's box, and we sneak down their running connection from inside the box, and they don't notice. 16:01.690 --> 16:05.030 Hmm, that sounds easy, it is. 16:05.230 --> 16:07.130 It sounds stealthy, it is. 16:07.510 --> 16:10.110 It sounds like you could do it right now, hmm. 16:11.490 --> 16:12.530 And is it feasible? 16:12.530 --> 16:13.870 Well, the code's on your CD. 16:22.740 --> 16:23.080 Say what? 16:23.080 --> 16:24.880 Yeah, hijack the application. 16:25.180 --> 16:26.080 Why not, right? 16:26.600 --> 16:27.720 It is slightly different, right? 16:27.720 --> 16:31.840 It demands slightly different methodology, right, when you're going to hack someone. 16:31.840 --> 16:36.760 Normally, you hack them on a public holiday, on a weekend, you know, when they're getting married, something like that. 16:37.720 --> 16:43.560 Here, what you're interested in is maximising the number of open post-authentication sessions for you to sneak down. 16:43.660 --> 16:49.360 So really what you want to do is you want to turn up, during peak time, right, the middle of the day, when everybody's right there at their desks. 16:49.380 --> 16:53.920 And then you want to sneak in and take their route right out from under them without them noticing. 16:54.900 --> 16:57.140 Right, just daylight robbery. 16:59.760 --> 17:02.320 And the funny thing is, right, it's not even that difficult. 17:02.660 --> 17:04.320 Right, this is just a party trick. 17:06.960 --> 17:11.780 I mean, all I did, right, was I thought, you know, there's a lot to be learned from kind of old-school DOS viruses. 17:11.780 --> 17:13.820 There's a lot to be learned from things we've done in the past. 17:13.820 --> 17:23.780 And this is just creative re-application of the same tricks that, you know, binary reverse engineers and virus writers and all those sort of, you know, kind of sneaky fuckers have been doing for a while. 17:30.790 --> 17:36.490 Right, so I took those numbers that I just pulled out of my ass earlier on and I put them on a graph to make it kind of look legitimate. 17:38.690 --> 17:49.450 And as this graph clearly demonstrates, right, my technique is wildly better than everything except classic trust relationships, which you'd have to be a retard to deploy, right? 17:49.450 --> 17:50.190 I mean, seriously. 17:50.970 --> 17:52.490 So yeah, I graphed them. 17:52.490 --> 18:01.750 And really the conclusion from this graph is that transient trust relationships, exploiting them, is almost as much fun and as easy as exploiting traditional trust relationships. 18:08.630 --> 18:14.150 So, for your hijacking pleasure, I present to you my SSH jacket. 18:22.470 --> 18:24.490 It doesn't actually look like that, right? 18:24.490 --> 18:26.110 You don't need to clap, but it looks different. 18:26.110 --> 18:27.630 It looks like a script and stuff. 18:29.290 --> 18:35.750 So yeah, it's a Python script, which, when pointed at an SSH session, gives you a shell at the other end. 18:35.790 --> 18:36.630 Just like that. 18:37.150 --> 18:43.910 So we're going to talk about briefly how it works, a few kind of implementation details, a bit of nitty-gritty stuff so you can do it yourself. 18:44.070 --> 18:49.270 And then we're going to diverge briefly into considering anti-forensics whilst implementing and using it. 18:50.190 --> 18:54.510 And then there'll be like one slide of mitigation, you know, just the responsible bit of the talk. 18:54.890 --> 19:00.450 And then, yeah, we'll talk about a few other bits and pieces that you might have up your sleeves or I might have up mine. 19:08.750 --> 19:10.170 Fullscreen, that's pretty futuristic 19:15.950 --> 19:16.310 . 19:16.490 --> 19:20.190 I'm not familiar with this commercial software with the two buttons and stuff. 19:21.750 --> 19:23.430 I'm kind of a one-button sort of guy. 19:25.490 --> 19:26.550 Hey, that's pretty sweet. 19:29.690 --> 19:31.650 Hey man, I just hack your network, right? 19:31.650 --> 19:33.150 I don't do presentations. 19:34.870 --> 19:36.250 So yeah, SSH, right? 19:36.250 --> 19:43.890 For those of you who aren't familiar, which probably isn't anybody, I guess, SSH provides this virtual channel metaphor, right? 19:43.890 --> 19:48.470 Effectively, SSH provides a multiplexed transport, right? 19:48.470 --> 19:52.590 You can run multiple sessions across a single encrypted TCP pipe. 19:52.610 --> 19:55.970 And it provides a number of useful things for you to connect to those sessions. 19:55.970 --> 19:58.290 The typical ones you'll see is your TTY. 19:58.590 --> 20:00.830 Apparently that's pronounced titty, I'm not sure. 20:02.310 --> 20:05.550 A shell for you to talk to on the other end of your titty. 20:08.070 --> 20:10.570 And of course, TCP sockets is the other thing we normally shunt around. 20:10.570 --> 20:11.730 X-connections, that sort of thing. 20:11.730 --> 20:12.710 Things over TCP. 20:12.710 --> 20:14.190 People are quite familiar with that. 20:15.350 --> 20:20.950 So what we're trying to do here, of course, is we want to be able to take the user's session away from him and use his credentials. 20:20.950 --> 20:22.470 But we don't want him to notice, right? 20:22.470 --> 20:26.470 And this sort of virtual channel metaphor is exactly what we're looking for. 20:32.500 --> 20:33.800 So how's it work, huh? 20:33.800 --> 20:39.020 Well, we're going to take the features provided by SSH and we're just going to use them for evil. 20:39.640 --> 20:41.360 That's what hacking's all about, right? 20:41.900 --> 20:44.940 So what we do is we ask for a second shell. 20:44.940 --> 20:47.000 We say, hey, server, I'm Bob, I'm authentic. 20:47.000 --> 20:48.200 You saw that earlier, right? 20:48.200 --> 20:49.220 I gave him my password. 20:49.220 --> 20:50.040 I'm good, right? 20:50.420 --> 20:51.660 You want to give me another shell? 20:52.560 --> 20:53.760 I'll go another one. 20:54.420 --> 20:55.100 Maybe two. 20:55.800 --> 20:57.820 And then we're going to glue it to the hacker. 20:58.340 --> 20:59.160 Give him a socket. 20:59.840 --> 21:00.460 Connect it up. 21:00.460 --> 21:01.140 Oh, look, a shell. 21:01.140 --> 21:01.900 Just like that. 21:10.990 --> 21:16.890 So using Python and a little bit of debug trickery, we go ahead and we ptrace attach to the client process. 21:16.890 --> 21:19.750 Now, this implies, obviously, that you need to be able to ptrace attach. 21:19.950 --> 21:24.490 So, obviously, you have to be root or you have to be running as the same user, right? 21:24.490 --> 21:26.410 And that's not as stupid as it sounds. 21:27.110 --> 21:29.750 You think about all the Firefox bugs we've had lately, right? 21:29.790 --> 21:33.010 Admins who run the links on the desktop are almost always going to run Firefox. 21:33.010 --> 21:35.950 There's been a few Firefox kind of zero-day run code sort of bugs. 21:35.950 --> 21:40.070 You turn up on the desktop, you find every running SSH connection, you jump down them. 21:46.030 --> 21:48.030 And then we just rummage around. 21:48.890 --> 21:51.790 And we find ourselves the virtual channel setup code. 21:52.310 --> 21:54.590 SSH session 2 open, if you're wondering. 21:55.350 --> 21:57.030 And then we just go ahead and patch it. 21:57.510 --> 21:59.870 So instead of talking to the user, it talks to us. 22:07.720 --> 22:09.080 And then we run it. 22:17.010 --> 22:19.850 And then we just put everything back like nothing ever happened. 22:20.850 --> 22:23.690 Except that the shell just popped out my netcat. 22:26.510 --> 22:27.230 Hehehe. 22:31.510 --> 22:35.790 So yeah, this is, I like to think, this is the sort of thing that your mother warns you about, right? 22:36.770 --> 22:38.350 Hackers, we're sneaky. 22:38.370 --> 22:39.090 Sneaky. 22:39.590 --> 22:41.190 Well, one of you guys is sneaky. 22:41.190 --> 22:42.610 The guy earlier on, yeah. 22:43.010 --> 22:43.690 Yeah. 22:44.570 --> 22:49.590 Right, we don't just install LK4 anymore, you know, just trojan ourselves LS and stuff, right? 22:49.750 --> 22:50.950 That's kind of boring. 22:51.330 --> 22:54.610 And we don't install BNC, because who cares about ISE, that's right. 22:54.610 --> 22:55.190 That's crap. 22:56.630 --> 23:00.530 Except the older ones get caught there, they're always running egg drop bots and crazy shit like that. 23:01.830 --> 23:07.190 And yeah, good hackers, a little bit of creativity here and there, maybe they'll do something new and interesting like jack your SSH connections. 23:08.030 --> 23:11.390 And if you hire some pen testers, and they're good, maybe they'll do it too. 23:16.390 --> 23:19.910 So all we're really doing here, it's just automated debugging, right? 23:19.970 --> 23:22.210 It's not crazy, it's not rocket science, right? 23:22.470 --> 23:28.630 And of course, if you give me a debugger, and one of your processes that happens to be doing something important, of course I can fuck with it, right? 23:28.630 --> 23:30.450 That's normal, that's what debuggers do. 23:30.650 --> 23:32.730 And humans with debuggers can do sneaky things. 23:33.610 --> 23:36.390 But what we really want, is we want to automate it, right? 23:37.470 --> 23:43.290 We want the sneakiness of a human, and the speed and portability of a script. 23:44.630 --> 23:46.190 So that's what we do. 23:47.410 --> 23:53.630 So we're using Python, we're using GDB, gluing them together, and we've come up with, effectively, an automated debugging toolkit. 23:53.630 --> 23:54.230 Of 23:57.520 --> 24:08.880 course, one of the downsides about this, and if you've done any binary reverse engineering, is that debugging binaries, when you don't have any symbol information, is not really debugging, right? 24:08.880 --> 24:10.400 It's not fun anymore. 24:10.800 --> 24:15.860 So you have to do a bunch of tricks that normal reverse engineers, people who are doing binary analysis, have to do. 24:15.860 --> 24:17.940 And we'll talk a little bit about that in a second. 24:23.400 --> 24:25.880 So yeah, the nitty-gritty implementation details. 24:25.880 --> 24:27.760 Write a little bit about Python, about GDMMI. 24:27.760 --> 24:34.720 One of the things we have to do is we have to find a safe place that we're going to stop the program and kind of mess with its execution flow. 24:34.720 --> 24:39.520 Because obviously we can't just go wildly executing code in its memory space and hope it's going to work. 24:40.700 --> 24:44.560 And then we have to find the code we're going to run, we have to execute that code. 24:45.100 --> 24:47.180 Or we have to inject some code there first, obviously. 24:47.320 --> 24:48.640 And then we have to put it all back again. 24:48.640 --> 24:56.720 And of course, what I'm discussing is in specific reference to my SSH jackup, but it's equally applicable to anything that you're doing this sort of stuff to. 24:56.720 --> 24:59.680 And we'll talk about a few of the other interesting things you could do later. 25:04.120 --> 25:09.160 So yeah, gdb is the GNU debugger, for those of you who aren't familiar with it. 25:10.080 --> 25:11.640 I'm sure you've heard of Richard Stallman, right? 25:11.640 --> 25:13.960 He writes some good stuff, one of them happens to be a debugger. 25:13.960 --> 25:14.800 It's pretty cool. 25:15.820 --> 25:18.420 And gdbmi is its programmatic interface. 25:19.260 --> 25:20.800 Gdbmi is actually pretty suck. 25:20.800 --> 25:22.820 It's about half implemented, but it's good enough. 25:23.900 --> 25:26.700 So yeah, I went ahead and just wrote some Python bindings for it. 25:27.240 --> 25:31.620 Implements pretty basic functionality, but enough to get the job done, right? 25:37.510 --> 25:41.470 So the SSH client, as you normally use it, is single threaded. 25:41.590 --> 25:44.550 It doesn't expect to be running other code in the middle of other code. 25:45.570 --> 25:52.770 So yeah, and there's all sorts of kind of nasty global data structures and arrays of function pointers and shit like that, right? 25:52.770 --> 25:56.090 So we have to be a little careful about what we're doing. 25:56.170 --> 25:59.490 It's also completely asynchronous. 25:59.490 --> 26:03.990 So when you, for example, when we ask for that virtual channel, it doesn't get set up right there. 26:04.030 --> 26:12.210 It goes in a queue with a list of packets that have to be sent to set it up and there's a whole kind of state machine that models how the SSH client interacts with the server. 26:12.330 --> 26:13.590 So we have to be kind of careful. 26:14.210 --> 26:16.710 So we have to find the safe place where we can run our code. 26:16.710 --> 26:23.270 And what you're aiming for in the choice of a safe place is really minimal deviation from the normal operation of the code. 26:23.270 --> 26:30.670 And funnily enough, right, that happens to be in the middle of the main line, of course, around the select call because that's where everything branches from. 26:30.670 --> 26:36.110 So we read the findSource, I find the select call, I decide that's probably a good place. 26:37.450 --> 26:43.590 So we ptrace attach, we stop the process, we drop a breakpoint in that safe place, and we let it run until it comes back. 26:44.570 --> 26:45.570 Just like that. 26:53.280 --> 26:54.820 But where is select? 26:54.820 --> 26:57.620 Normally, right, normally if you're debugging something you just go, hey, gdb where select? 26:57.740 --> 26:59.260 And it goes, oh, yeah, over there. 26:59.340 --> 27:00.020 It's all good. 27:00.020 --> 27:04.780 But we don't have any symbol information so we have to do a little, you know, work backwards. 27:04.860 --> 27:06.740 And this technique is very well understood. 27:06.740 --> 27:07.980 Everyone does this sort of thing. 27:09.340 --> 27:10.600 So where does select come from? 27:10.600 --> 27:11.380 It comes from libc. 27:11.380 --> 27:12.260 So how does it get in there? 27:12.260 --> 27:13.960 Well, the loader puts it there. 27:14.860 --> 27:15.420 Where does it put it? 27:15.420 --> 27:16.980 It dynamically links it into address space. 27:16.980 --> 27:18.720 So we ask, where do you dynamically link it? 27:18.720 --> 27:20.180 It says over here, and that's all good. 27:24.560 --> 27:28.660 And then, you know, we have to rummage around in the global offset table. 27:29.080 --> 27:30.320 Find it in there. 27:35.440 --> 27:39.540 The ELF procedure linkage table, another exciting piece of the ELF format. 27:44.740 --> 27:50.580 And then we rather boringly rummage through the code segment until we find a piece of code that calls that PLT entry. 27:50.580 --> 27:54.220 In this case, actually, it's quite easy because there is only one call to select in the whole damn binary. 27:54.220 --> 27:57.540 So we can put a breakpoint right in the middle of the ELF PLT. 27:57.540 --> 27:58.160 Save me a step. 27:58.160 --> 27:58.720 Nice. 27:59.760 --> 28:01.380 So yeah, now we've found select. 28:08.820 --> 28:10.560 So where are we going to put our evil code? 28:11.740 --> 28:22.560 Well, we're going to go and patch SSH session 2 open, which is the piece of code responsible for setting up a new virtual channel and asking the server to connect something to the NBR TCP socket, or in our case, a shell. 28:24.180 --> 28:25.860 Still no debug symbols, of course. 28:26.000 --> 28:27.960 Fortunately for us, there's a unique error string in there. 28:27.960 --> 28:30.200 It happens to bitch about the dupe failing. 28:30.200 --> 28:32.160 And that's the only occurrence of that string in the binary. 28:32.160 --> 28:34.860 So we rummage around, we find it in the read-only data section. 28:36.880 --> 28:39.120 And walk the code segment looking for calls to that, right? 28:39.120 --> 28:40.960 Now we know roughly where we are in this function. 28:40.960 --> 28:41.680 Nice and easy. 28:48.110 --> 28:50.130 So yeah, the evil code itself, right? 28:50.230 --> 28:54.030 It's going to overwrite the first half of the virtual channel setup code. 28:54.890 --> 28:58.190 We're going to save the registers, we're going to save the flags so we don't fuck things up too much. 28:58.770 --> 29:01.690 And then basically we're going to inject its shellcode, right? 29:01.690 --> 29:02.490 It looks like shellcode. 29:02.490 --> 29:03.350 Same sort of thing, right? 29:03.350 --> 29:07.870 We're going to call socket, we're going to call connect, we're going to connect it back to wherever we happen to be listening. 29:08.050 --> 29:12.770 And then we're going to substitute it for the file handles that it's expecting to be a normal Unix TTY. 29:14.750 --> 29:16.330 I like Unix, it's cool. 29:16.910 --> 29:19.790 I see you do that in Windows where your Winsock sockets are different from your file. 29:19.790 --> 29:20.830 Ah, Jesus. 29:21.730 --> 29:27.270 And then we're going to leave the registers set up just right so that the second half of the function runs perfectly. 29:28.650 --> 29:34.450 And for really no good reason at all, I'm using libc calls instead of kernel syscalls, which I could. 29:34.450 --> 29:35.970 It's just, you know, a bit of variety. 29:36.430 --> 29:37.950 Sick of kernel syscalls, very boring. 29:45.100 --> 29:46.880 So, why all the effort, right? 29:46.880 --> 29:48.900 Why do we go to so much effort to overwrite half a function? 29:48.900 --> 29:56.420 Wouldn't it be simpler to just have a piece of code which we've already compiled, which happens to set up virtual channels, and we'll just kind of copy it into its address space and run it, right? 29:56.420 --> 29:57.600 That would be a lot more straightforward. 29:58.740 --> 29:59.840 Yeah, it might be. 30:00.600 --> 30:05.640 But one of the really suck things about that is you have to link it by hand with no symbol information, right? 30:05.640 --> 30:07.500 Which, if you've tried, it's not fun, right? 30:07.500 --> 30:08.920 That's not a fun game at all. 30:09.240 --> 30:19.440 And so I thought maybe it would be easier to just let the bottom half of the function, which contains all the symbol references, just let it be, and inject stuff up the top to take advantage of that. 30:21.020 --> 30:33.460 It's particularly nasty for SSH, because it has this whole kind of, you may remember from, you know, programming classes, this data-driven metaphor which was popular kind of late 90s or something, where you have like wild arrays of function pointers and you just let the data index into them and... 30:35.420 --> 30:38.880 Right, that's pretty yuck to have to reverse engineer on the fly. 30:41.760 --> 30:44.560 It's especially tedious if you have to do it for every binary. 30:45.480 --> 30:53.460 In this case, we actually patch it up at runtime, to make sure that the shellcode we have will run in this particular environment. 30:53.520 --> 30:56.180 And you'll see, actually, it's surprisingly successful. 31:05.920 --> 31:06.700 So what do we do? 31:06.700 --> 31:09.220 Well, we work backwards from that unique Duke error message we found. 31:09.220 --> 31:10.940 We find the appropriate place at the top of the function. 31:10.940 --> 31:13.780 We just kind of walk up until we see a function preamble. 31:14.860 --> 31:20.040 And then we learn a few bits and pieces, like how big the local stack is, and we patch in the command line parameters so it's user-friendly. 31:20.660 --> 31:24.440 And a few other bits and pieces that we discovered as we were, you know, doing our thing. 31:25.960 --> 31:27.800 And now we have a nice little piece of evil. 31:32.540 --> 31:34.300 So, yeah, let's wedge it in. 31:34.600 --> 31:36.880 Back up the instruction pointer, so we know where we were. 31:37.600 --> 31:39.500 Back up the old code that we're about to override. 31:39.500 --> 31:40.680 Stash it somewhere in memory. 31:41.920 --> 31:44.060 And then we go ahead and just inject our code. 31:44.060 --> 31:45.780 Now it's going to take care of a few bits and pieces. 31:45.780 --> 31:49.800 We've got a breakpoint at the end to catch it when it's finished. 31:50.980 --> 31:52.560 Hmm, what do you think we're going to do next? 31:59.700 --> 32:00.900 That guy over there, right? 32:00.900 --> 32:01.580 He's busy. 32:01.580 --> 32:02.760 He's playing hunt the wumpus, right? 32:02.760 --> 32:04.320 He's just doing his job. 32:05.260 --> 32:07.060 That wumpus, it's still going to kill him. 32:07.900 --> 32:09.500 And we got ourselves a shell. 32:09.500 --> 32:10.300 Just like that. 32:10.400 --> 32:10.960 Transparent. 32:10.960 --> 32:12.400 The user doesn't even notice, right? 32:12.400 --> 32:14.100 He sits there running something interactive. 32:15.400 --> 32:18.100 Shell pops out from underneath him and he doesn't even notice. 32:18.980 --> 32:20.140 Sucks for him, huh? 32:29.160 --> 32:31.780 So maybe you're going to go home and jack yourself, right? 32:36.540 --> 32:37.260 So what are you going to do? 32:37.280 --> 32:38.080 How are you going to do it? 32:38.140 --> 32:42.240 How are you guys going to go home and hijack yourself some action? 32:43.180 --> 32:43.940 Well, it's pretty straightforward. 32:43.940 --> 32:49.980 Well, what I did, and you don't have to kind of do what I did, of course, is I wrote the hijack code in C first. 32:49.980 --> 32:50.720 Makes it nice and easy. 32:50.740 --> 32:51.520 Compiled it up. 32:51.740 --> 32:57.200 I compiled it actually directly into SSH because I wanted to prove that you could have two shell sessions down in SSH. 32:57.200 --> 32:58.220 And you can. 32:58.540 --> 33:07.140 So I hooked it up like a magic keystroke and you smack the escape tilde, or whatever the hell it is, and bring up the command prompt and open me a shell, please, and it gave me one. 33:07.200 --> 33:08.360 Just to prove the point. 33:10.280 --> 33:13.620 And then, of course, the compiler had conveniently generated most of my shell code for me. 33:13.620 --> 33:15.060 Gee, that's so hard. 33:15.140 --> 33:16.160 Glad I bought the book. 33:17.620 --> 33:21.060 And then I went ahead and implemented hijacking for a binary that had debug symbols. 33:21.060 --> 33:21.760 Make it nice and easy. 33:21.760 --> 33:26.140 Just to prove that I get the code in and out of memory, in and out of the half of the function, nice and easily. 33:31.080 --> 33:39.200 And then the really suck bit, which is you build a list of symbols you're going to need to find and you come up with a strategy to find them and then you actually have to go ahead and write code to do it. 33:40.300 --> 33:41.540 And then, ooh, look, jack your friends. 33:41.540 --> 33:42.200 Fun and profit. 33:43.440 --> 33:49.460 And then, if you're really nice, package it up for the security consultants, put some 3D, some spinny round, you know. 33:53.160 --> 33:55.000 Maybe do it in Flash, I don't know. 33:59.930 --> 34:01.110 A few bits and pieces, right? 34:01.110 --> 34:02.510 The things that didn't fit in elsewhere. 34:02.950 --> 34:05.650 Think about how much you use SSH, right? 34:06.070 --> 34:07.610 You use it for SCP. 34:07.650 --> 34:08.650 You use it for CVS. 34:08.650 --> 34:10.650 You pipe stuff over SSH all the time. 34:10.650 --> 34:17.310 You have backup push, you have some CPIO, or whatever other home roll backup solution you're using on Unix because you can't find a decent one. 34:19.110 --> 34:20.350 Yeah, it gets around, right? 34:20.350 --> 34:21.290 There's a lot of it. 34:21.730 --> 34:23.610 And, yeah, this does work over SCP. 34:23.850 --> 34:26.130 And, yeah, it does work over stuff over SSH. 34:26.130 --> 34:28.470 You know, there's a few little wrinkles, but it works just fine. 34:29.730 --> 34:32.110 Actually, the code on your CD doesn't work just fine. 34:32.110 --> 34:33.950 The stuff I have right now does. 34:34.370 --> 34:39.310 And it'll be on, I guess, on blackhat.com or Defcon or wherever they put this stuff after I've finished. 34:39.310 --> 34:40.370 But, yeah, so, yeah, it does. 34:40.370 --> 34:41.990 It jacks SCP just fine. 34:43.670 --> 34:50.870 You'll notice in the client, you can hit tilde and I think it's hash or something and it brings up a list of the open virtual channels you have. 34:50.870 --> 34:51.790 Does it show up in that list? 34:51.790 --> 34:52.970 Yeah, it does, actually. 34:53.310 --> 34:57.110 How many of you knew you could list the virtual channels open with tilde and hash? 34:58.030 --> 34:59.070 One, one. 34:59.070 --> 35:00.190 Horns, thank you. 35:02.370 --> 35:04.710 But, of course, that's the client that's listing it, so you want to go patch that? 35:04.710 --> 35:05.710 Sure, no problem. 35:06.510 --> 35:07.950 And what happens when they log out? 35:07.950 --> 35:18.850 Well , anyone who's used port forwarding, right, you know what happens when you've got an open shell, you've got a port forward as well, you're using the port forward to, you know, look at GoPorn or whatever, right, and you log out, right, you haven't finished looking at the GoPorn, 35:18.850 --> 35:19.670 the connection stays open. 35:19.670 --> 35:21.110 Great, well, the same thing happens here. 35:21.510 --> 35:31.610 So, you're SCPing, your SCP takes 30 seconds, I happen to catch it in time, run a shell over it, your SCP will stay running once it's finished copying so that I can do some hacking, play Hunt the Wampus. 35:33.650 --> 35:35.330 And how does it, well, how well does it work? 35:35.330 --> 35:39.990 Well, uh, at the moment, uh, any open SSH3-ish it should work on. 35:40.330 --> 35:47.750 Um, it's known to work on, on the out of the box Stephen Sarge RHEL3, RH9, it works on Slack, uh, Slackware as well, 9.1. 35:48.030 --> 35:50.870 Uh, it doesn't work on SUSE because their compiler is just retarded. 35:51.050 --> 36:04.950 Um, I, I work with a guy who used to work at SUSE on their, on their AMD64 stuff and they, they got paid by AMD to write loads of extra optimizations for AMD64 and then they went and back ported them over to Intel and now the compiler just generates code that's so wildly broken. 36:05.110 --> 36:08.250 Right , I, I can't, I look at it, right, I can't believe it even executes. 36:08.270 --> 36:11.050 Right, I, I've seen it miscompile, like, really basic stuff. 36:11.050 --> 36:14.830 Anyway, so, it doesn't work on SUSE, right, uh, ah... 36:15.790 --> 36:25.770 I, I'll get round to it, right, I'll probably just write some, some one-off custom code that's gonna work on SUSE because the, the magic heuristic stuff that works on everything else doesn't work on their compiler. 36:26.990 --> 36:28.050 Silly SUSE. 36:35.560 --> 36:41.040 Also, it's also worth mentioning, I guess, uh, Python 2.2, 2.3, 2.4, it's known to work with. 36:41.040 --> 36:44.000 2.1, it ought to work, but I haven't tested on 2.1. 36:44.000 --> 36:47.460 Anything older than that you're probably, uh, you know, there's a few bits and pieces that are broken. 36:47.720 --> 36:50.900 Um, GDB, I haven't noticed any version it doesn't work with yet. 36:50.980 --> 36:53.200 Uh, it's a pretty straightforward text interface. 36:54.860 --> 36:58.380 Now, if you'll indulge me, a brief, uh, brief tangent into anti-forensics. 36:58.380 --> 37:06.000 Now, uh, those of you at, who are at Black Hat, uh, or, uh, RuxCon last year may have seen, uh, the Grugs talk on anti-forensic stuff. 37:06.000 --> 37:07.880 I don't know if he was doing it at DefCon, was he? 37:07.880 --> 37:08.320 No? 37:08.600 --> 37:09.120 No. 37:10.460 --> 37:11.280 It's very interesting. 37:11.280 --> 37:14.840 Well, I saw it at RuxCon, uh, two years ago, or a year and a half ago. 37:14.860 --> 37:17.660 And yes, I remember very interesting things to say about anti-forensics. 37:17.660 --> 37:25.960 And of course, when you're, when you're attacking systems like this, right, in the middle of the day, or when everyone's using them, it assumes that you're taking pretty basic anti-forensic precautions. 37:25.960 --> 37:28.160 You don't want to leave too many, too many trails. 37:29.100 --> 37:40.360 So yeah, I'm going to talk, uh, just a brief, you know, very brief overview of anti-forensic technique, and then how I've implemented it, uh, successfully and unsuccessfully in some places, uh, when I was using and writing the SSH jacket. 37:44.470 --> 37:48.730 So yeah, the most important thing, the most important thing is don't put anything on disk. 37:48.730 --> 37:49.710 Do it all in memory, right? 37:49.710 --> 37:51.810 Memory goes away when they reboot the box. 37:52.770 --> 37:53.190 Right? 37:53.190 --> 37:59.670 There's nothing on disk, there's no tripwire, there's no, nothing for them to look at with Ncase or whatever other expensive, uh, forensic products they're using. 37:59.670 --> 38:02.290 You know, it's like if you get swapped out the disk, you don't know well. 38:03.130 --> 38:05.830 But really, you want to try and keep everything in memory only. 38:06.630 --> 38:08.190 Uh, use local tools, right? 38:08.190 --> 38:12.170 These are, these are Turing-complete machines, you can write your split code in whatever's available, right? 38:12.170 --> 38:15.830 If you have to write a port scanner in ORC, do it, right? 38:15.890 --> 38:18.030 Right, if it has a Perl interpreter, great, use that. 38:18.030 --> 38:19.690 Right, if it has a Python interpreter , use that. 38:19.690 --> 38:23.990 If you're good, right, you turn up, you find what's there, and you write your tools on the spot. 38:24.630 --> 38:31.130 That way you don't have to go and, you know, wget magic hacksaw tarball.tar.gz from hacksaw.com, right, which is a real fucking giveaway. 38:32.050 --> 38:33.730 You don't want them to know what you did. 38:35.490 --> 38:37.890 And yeah, try to make new network connections, right? 38:37.890 --> 38:42.970 You don't want anything for their intrusion detection or cough prevention systems to spot. 38:45.090 --> 38:48.730 And you don't want them sniffing your traffic and kind of replaying it later and figuring out what the hell you did. 38:49.790 --> 38:53.310 So yeah, reuse your existing connection, hide in plain sight, use encryption. 39:00.610 --> 39:02.270 So, how well do I do? 39:02.270 --> 39:04.950 Well, we do use general purpose tools, right? 39:04.950 --> 39:06.830 GDB is pretty general purpose. 39:06.910 --> 39:11.150 I mean, if you turn up on a box that doesn't have GDB, maybe it's not such a giveaway to go ahead and install it, right? 39:11.150 --> 39:12.210 I mean, maybe you're just helping, right? 39:12.210 --> 39:14.010 You're just doing a bit of administration for them. 39:14.670 --> 39:17.830 Some of the best run Windows boxes I've seen are admin by Russian hackers. 39:19.950 --> 39:20.470 Remotely, right? 39:20.470 --> 39:21.750 They don't even have to go on site to reboot it. 39:21.750 --> 39:22.450 How nice. 39:23.810 --> 39:24.450 So yeah, we do. 39:24.450 --> 39:25.510 We use general purpose tools. 39:25.510 --> 39:27.170 We use the Python interpreter, we use GDB. 39:27.170 --> 39:28.130 That's nice. 39:29.130 --> 39:32.170 SSH is encrypted, so the packet is not much use. 39:33.350 --> 39:38.690 And yeah, our new shell that's going across the existing SSH connection, right, there's nothing new there. 39:38.690 --> 39:42.810 There's no new connection for any intrusion detection or things to spot. 39:42.930 --> 39:45.030 Not very interesting. 39:45.090 --> 39:45.810 That's good. 39:45.810 --> 39:47.350 We're looking okay so far. 39:51.720 --> 39:52.680 Where do I start? 39:52.680 --> 39:56.460 Well, Python code lying around disk. 39:56.460 --> 39:57.200 Not very elegant, right? 39:57.200 --> 40:00.780 I've got to copy the script across and then I've got to go Python, SSH, yada, yada, yada. 40:00.900 --> 40:01.740 That's not very nice. 40:01.740 --> 40:03.480 There's no script lying around for them to look at. 40:03.480 --> 40:06.740 Even Python bytecode lying around, you can turn that back into code pretty easily. 40:07.980 --> 40:16.100 And of course the other problem is we have that connection coming from the SSH client out to our network, which has a TCP connection with the shell on the other end, right? 40:16.100 --> 40:16.960 That's a new connection. 40:16.960 --> 40:17.940 That's not so nice. 40:19.160 --> 40:20.780 And yeah, it's in the clear as well. 40:20.860 --> 40:25.780 So obviously if I were a cunning man, if I were a patient man, I would have implemented SSH connect back, right? 40:25.780 --> 40:27.720 Because all the code in the client is there, right? 40:27.860 --> 40:30.400 I haven't done that yet, sorry. 40:31.480 --> 40:33.800 But if you happen to turn up over SSH, right? 40:33.800 --> 40:39.700 So say it's the second box you've routed in a row, and you just came in across an SSH connection, why don't you set up a port for it? 40:40.340 --> 40:41.380 Bring it back down like that. 40:41.380 --> 40:42.480 That would be a pretty good idea. 40:47.020 --> 40:48.820 So let's not leave our scripts lying around on disk. 40:48.820 --> 40:52.400 How about we just go ahead and load that Python directly into memory? 40:52.400 --> 40:53.180 All good, right? 40:54.000 --> 40:58.740 So let's just run up a Python interpreter, ask it to read from Samjin, and execute it. 40:59.280 --> 41:09.660 And then locally, we'll take the Python script we want to run locally, we'll compile it up, we'll turn it into Python, we'll compress it and paste it into work, we'll send it across the wire, maybe with a little loader at the other end to unpack it and run it. 41:10.940 --> 41:12.580 And then send it across your shell. 41:13.700 --> 41:14.400 That's all good, right? 41:14.400 --> 41:15.340 Nothing on disk. 41:16.000 --> 41:17.740 That sound straightforward to anybody? 41:18.320 --> 41:19.580 Pretty straightforward to me, right? 41:19.580 --> 41:23.300 It's just three lines right there, and then a little bit of jiggery-pokery. 41:28.220 --> 41:29.580 I know you want a script. 41:29.600 --> 41:31.120 You want scripts, don't you, right? 41:31.120 --> 41:33.120 OK, I wrote a script for you, make it nice and easy. 41:33.880 --> 41:35.120 It does all of the above, right? 41:35.120 --> 41:44.880 So now if we load, we pass in a Python script, list the Python libraries we might require, mine our arguments, packs it up, sends it across, runs it, you give it a shell and a modem, it knows how to do the rest. 41:45.920 --> 41:48.200 And then if you're really cool, right, hack in Screen. 41:48.200 --> 41:49.060 Screen's really neat. 41:49.360 --> 41:50.900 Screen is a terminal multiplexer, right? 41:50.900 --> 41:51.980 So you must know Screen. 41:57.300 --> 42:00.680 Screen has this really cool feature called Bang. 42:01.560 --> 42:09.480 It'll run a local command and then it comes with other options, but it will inject the output of that local command into your remote session. 42:10.000 --> 42:12.700 So I sit there on Screen, I go CTRL-A and my screen escapes here. 42:12.700 --> 42:14.440 I go bang, bang, bang, bang, bang. 42:15.200 --> 42:21.740 Powerful load, SSJAC, process ID, destination host port, and it runs it on the remote machine, just like I was there. 42:24.040 --> 42:24.940 That's pretty cool, right? 42:24.940 --> 42:27.180 You can almost forget you're running it remotely. 42:27.660 --> 42:30.040 And obviously for your convenience, that's obviously neat. 42:36.800 --> 42:37.720 So what else can I do? 42:37.720 --> 42:38.580 What else can I do with this? 42:38.580 --> 42:42.380 Well, it would be nice to actually generate the shellcode on it. 42:43.220 --> 42:47.780 I didn't get around to writing it in Assembler yet, and other people have already written it, even in Python, right? 42:47.780 --> 42:52.740 It doesn't have a lot of documentation, so I read through it, but I haven't implemented anything. 42:54.200 --> 42:56.540 Yeah, pure Python debugger, so that would be cool. 42:57.420 --> 42:58.460 Aha! 42:58.920 --> 43:05.160 What other protocols have virtual channel infrastructures and are used on clients? 43:05.160 --> 43:05.740 Lots. 43:05.740 --> 43:08.380 Especially poorly-packed senior clients. 43:09.020 --> 43:09.800 Hmm. 43:10.780 --> 43:12.860 MS-IDP, Citrix. 43:13.520 --> 43:18.040 I've already had a chat with some people who like hacking on Citrix, and they're pretty keen on this idea. 43:18.360 --> 43:26.420 Citrix has got a virtual channel infrastructure for running, you know, drive mapping, and all sorts of things. 43:26.420 --> 43:26.740 Yeah . 43:28.480 --> 43:29.700 And all manner of things, right? 43:29.700 --> 43:35.420 I mean, once you have an ordinated programmatic debugging toolkit, you start seeing all the things you can just beat with that hammer, right? 43:35.420 --> 43:37.300 It's a really cool thing to have in your toolkit. 43:38.140 --> 43:42.600 You can start, you know, you can have it disassemble stuff on the fly, figure stuff out, and patch it, right? 43:42.600 --> 43:43.280 All programmatically. 43:43.280 --> 43:43.860 It's cool. 43:50.770 --> 43:55.370 Right, now, now, being as it is that, you know, I'm obviously some sort of long hair, right? 43:55.370 --> 43:59.350 And I'm from the Antipodes, I'm not very fashionable, right? 43:59.350 --> 44:01.310 I'm kind of stuck in the 80s and shit, right? 44:01.310 --> 44:04.690 So, I'm not sure if this is still fashionable, right? 44:04.690 --> 44:06.530 Because, blaming Theo for everything. 44:07.170 --> 44:08.550 Is that still fashionable? 44:09.110 --> 44:09.590 Yeah? 44:09.590 --> 44:10.370 Yeah, okay. 44:10.810 --> 44:13.390 Unfortunately for me, it's not Theo's fault. 44:13.390 --> 44:14.170 Sorry. 44:14.930 --> 44:17.110 It's actually a feature of all things. 44:17.130 --> 44:23.270 The SSH protocol specification says it's just fine to have multiple channels on the other end. 44:23.270 --> 44:25.190 That's a requirement, right? 44:25.190 --> 44:26.210 That's pretty cool, huh? 44:26.210 --> 44:28.350 I hadn't really thought about it before, right? 44:28.350 --> 44:29.350 My SSH client, right? 44:29.350 --> 44:31.830 If I was to say, get a shell, that's all there is to it, right? 44:32.030 --> 44:34.790 But now imagine like a graphical client, like a CAD. 44:39.200 --> 44:40.980 So yeah, it's a feature, right? 44:41.040 --> 44:44.420 If you could get a shell from a server back to the client, right? 44:44.440 --> 44:45.360 That would be a bug. 44:45.520 --> 44:46.760 Unfortunately, Theo took care of that. 44:46.760 --> 44:47.680 He's a good dude. 44:48.120 --> 44:49.580 Same with unsolicited port forwarding. 44:49.580 --> 44:55.720 If you could port forward from a server back to the client without it asking you to do so, that would be a bug also. 44:55.820 --> 44:57.280 But no, I've taken care of that. 44:57.280 --> 45:00.000 I haven't looked at any other SSH implementations. 45:00.280 --> 45:07.360 Because SSH is, you know, the client and the server are very, very similar in functionality, they both have to deal with this multiplexing and multiplexing. 45:07.780 --> 45:13.940 Generally, most people write that code once, right, and use it in both a client and a server implementation, so you have to be pretty careful. 45:13.940 --> 45:24.000 So if I were you, and you're using a funny SSH server, one of those crazy Cisco ones, I don't know, yeah, I might have a look at that. 45:24.280 --> 45:25.600 It might work, wouldn't it? 45:26.680 --> 45:28.680 But anyway, it's not OpenSSH's fault. 45:28.680 --> 45:29.960 Please don't send me a bug report. 45:29.960 --> 45:30.640 It's not a bug report. 45:30.640 --> 45:31.500 Blame me instead. 45:31.500 --> 45:36.100 I don't want Theo to, you know, come and bring me up and harass me, kick my ass or whatever. 45:37.140 --> 45:38.380 But yeah, OpenSSH is cool. 45:38.380 --> 45:39.580 For the record, OpenSSH is cool. 45:39.580 --> 45:40.220 I like it. 45:40.220 --> 45:42.080 It's a big fat loaded piece of crap, but I like it. 45:42.080 --> 45:43.060 I use it every day. 45:50.120 --> 45:50.800 Mitigation technique. 45:50.800 --> 45:52.040 Responsible slide, right here. 45:52.260 --> 45:53.380 Don't get rooted. 45:53.820 --> 45:54.580 Nice and easy. 45:55.260 --> 45:59.740 You could, if you were cunning, patch ptrace, maybe, so you couldn't do it as a user. 45:59.740 --> 46:02.460 I suppose there's patches around to do that already. 46:03.120 --> 46:08.960 One of the things that's not on there is you could, the SSH agent, they try to prevent this attack by making it set GID. 46:09.040 --> 46:11.880 I don't know that making your SSH client set GID is a good idea. 46:11.880 --> 46:14.660 I mean, there's probably all sorts of other things that would go horribly wrong if you did that. 46:15.880 --> 46:26.740 One of the most important things that you can actually do to help yourself is if you're running restricted, if you're running trust relationships using keys between hosts, there's a bunch of tools you can use to restrict what those keys can be used for. 46:26.740 --> 46:32.400 You can restrict what commands are executed, you can restrict where port forwarding is allowed, you can restrict x-forwarding, all that sort of thing. 46:32.400 --> 46:32.780 Use it. 46:32.780 --> 46:33.280 Use it. 46:33.280 --> 46:33.920 Really do. 46:34.720 --> 46:38.060 Oh yeah, and then Steve Gibson, he had some really good ideas about those wall sockets right there. 46:38.060 --> 46:38.440 They're bad. 46:38.440 --> 46:39.220 Sorry, the buggers. 46:39.460 --> 46:42.360 I think we should get him in charge of the anti-bugger movement. 46:47.460 --> 46:48.240 Yeah, why do you care? 46:48.240 --> 46:49.440 It's just a party trick, right? 46:49.440 --> 46:51.080 This is just like eroding the farms. 46:51.080 --> 46:51.760 That's all, right? 46:51.760 --> 46:53.880 It's not wildly zero-day. 46:53.880 --> 46:54.760 If you get rooted, you're screwed. 46:54.760 --> 46:55.420 You knew that. 46:57.100 --> 46:57.840 Rich desktops? 46:57.840 --> 46:59.020 Yeah, it's a good way, right? 46:59.120 --> 47:03.300 Tacking desktop machines that are full of complexity is a very good way to get to well-protected servers. 47:03.300 --> 47:04.440 And especially willing to admins. 47:04.440 --> 47:07.680 Anyone running Linux on a desktop is probably looking after interesting stuff. 47:08.940 --> 47:11.420 And yeah, try it against RDPM or ICA. 47:11.420 --> 47:12.580 That could be interesting. 47:17.160 --> 47:18.260 Very pretty mad greets. 47:18.260 --> 47:19.560 There's not much of a scene in New Zealand. 47:19.560 --> 47:20.340 There's only a few of us. 47:20.340 --> 47:20.960 We all drink beer. 47:20.960 --> 47:25.020 There's like, let's run through tables the whole scene, but yeah, I thought I'd better say hi to them. 47:25.020 --> 47:27.920 And GadooSpice, he gave me my first security hack two years ago. 47:28.740 --> 47:29.740 He's a good dude. 47:30.660 --> 47:33.280 Oh yeah, and there were a few talks about this one that were interesting. 47:33.340 --> 47:34.200 The Elf. 47:34.300 --> 47:36.080 Sean Flowers Elf Encrypter, right? 47:36.080 --> 47:37.140 That's some crazy shit. 47:37.140 --> 47:37.680 I gotta read that. 47:37.680 --> 47:43.500 It's like, symbiotic p-tracing processes that take memory in and out of each other and unencrypt it. 47:43.500 --> 47:44.040 It's crazy. 47:44.040 --> 47:44.780 Go look at it. 47:49.940 --> 47:51.860 Apparently, I'm out of time so you don't get to shred me. 47:52.060 --> 47:52.700 Sorry. 47:52.940 --> 47:56.720 There was also a demo that I'm getting the head signal. 47:58.140 --> 47:59.700 If you want to see it, come see me afterwards. 47:59.700 --> 48:01.820 We'll do it on a box that doesn't look like a screensaver. 48:02.880 --> 48:03.960 Alright, thank you guys!