00:00:00.000-->00:00:05.000
>>Hello >>Hi >>Welcome to this
presentation there was a few of
you still filing in um but just

00:00:08.458-->00:00:13.458
sit down find a seat sit down be
humble [chuckles] do what
Kendrick Lamar says. So instead

00:00:16.500-->00:00:21.500
of having a normal boring like
here’s our history basically our
CV on a slide uh what we have

00:00:25.208-->00:00:30.208
instead is a more or less
summary of of our lives but I’d
like to read you the bio that we

00:00:33.000-->00:00:39.042
submitted for this talk because
I think it’s one of the greater
literary works of the 21st

00:00:39.042-->00:00:44.042
century. We were raised by
computerized wolves with a
pension for fine art and rum

00:00:46.042-->00:00:50.667
based cocktails while tik-
technically from different
mothers and also sides of the

00:00:50.667-->00:00:56.708
world we formed the first cyber
wolf brothership shell bent to
[inaudible] the state of

00:00:56.708-->00:01:01.333
targeted malware implants to
support the ongoing war against
the institutionalized mediocrity

00:01:01.333-->00:01:05.125
of the corporate shadow
government working in tandem
with dolphin researchers funded

00:01:05.125-->00:01:09.250
by the oligarch llamas we found
a way to synthesize powdered
ethanol into mechanical pony

00:01:09.250-->00:01:14.250
fuel. That’s it [applause]
[coughs] So clearly we’re here
to talk about some gun it’s made

00:01:23.708-->00:01:28.708
of meat it shoots bullets of
malware but before we do that
I’d like to just give you some

00:01:32.292-->00:01:38.958
background of the the reason
this is here and the reason is
that this is a tool for red team

00:01:38.958-->00:01:43.958
by red teamers to solve some of
the headaches and problems that
we have in our day to day

00:01:46.542-->00:01:52.417
operations because we wanted to
be able to focus on the
challenges that really matter

00:01:52.417-->00:01:59.000
and not all the really like
annoying stuff like like
reporting not being very good or

00:01:59.000-->00:02:04.000
having to go spin up a bunch of
things so also if you’re asking
do I mean pentesting? No, no I

00:02:06.542-->00:02:11.542
do not I don’t mean to start a
holy war here but it’s not a
pentesting tool I don’t even

00:02:13.708-->00:02:19.792
think we do pentesting anymore
it- it’s- it’s red teaming but
this tool isn’t going to help

00:02:19.792-->00:02:25.708
you penetrate anything this
isn’t a hacking tool that has a
bunch of exploits in it this

00:02:25.708-->00:02:31.542
isn’t something that is going to
like I don’t know penetrate a
network in any way for you it’s

00:02:31.542-->00:02:36.542
um it’s a tool for red team. So
fundamentally it’s a framework
for creating, managing and

00:02:38.583-->00:02:43.167
interacting with stealth
implants that support persistent
adversarial operations you still

00:02:43.167-->00:02:49.500
need to have those implants you
still need to be able to get
them in the environment somehow

00:02:49.500-->00:02:55.125
it’s basically just a shell you
know? Management portal. So um
red team operating paradigm we

00:02:55.125-->00:03:00.125
th th- more background on what
we do and how we do it so when
we- when we do scopes we try and

00:03:02.250-->00:03:08.333
scope it so that it’s any
systems, humans, processes,that
are employed by the target we

00:03:08.333-->00:03:13.333
call this yoloscoping. We choose
the targets for ourselves as a
red team and we try most of the

00:03:15.417-->00:03:20.875
time pretty successfully to set
the rules of the engagement for
ourselves and we never time box

00:03:20.875-->00:03:24.750
it right? We- we set the amount
of time we need as well and it’s
it’s however long it takes

00:03:24.750-->00:03:28.083
because that’s how the
adversaries work too and if
we’re going to simulate

00:03:28.083-->00:03:32.375
something accurately, it’s
however long it takes, not you
have two weeks to hack us or

00:03:32.375-->00:03:39.083
else. Pfft. Also um sometimes we
do steal stuff for real and
because of that instant

00:03:39.083-->00:03:45.167
responders, they respond for
real, they treat us like we’re
real, and because of that we

00:03:45.167-->00:03:51.917
have to try really hard not to
get caught, and we have to pull
out any stops necessary. We try

00:03:51.917-->00:03:57.542
and read out our results to
large audiences as well too not
quite as large as this one but

00:03:57.542-->00:04:04.000
um it’s it’s it’s about trying
to craft propaganda and craft a
change for security to uplift

00:04:04.000-->00:04:08.792
things, right? It’s not- It’s
not just about HA HA it’s hacked
here’s your list of results so.

00:04:08.792-->00:04:13.792
A bit of an origin story
starting out basically, new job
they say hey hack stuff also

00:04:17.083-->00:04:21.500
cause an impact also don’t get
caught also do you have shell
yet, wait, do you have shell

00:04:21.500-->00:04:25.417
yet, do you have shell yet? So
after a few weeks of do you have
shell yet? I’m just like fine,

00:04:25.417-->00:04:30.792
I’ll just go get some malware
and that sounds easy enough and
and I’ll craft a social

00:04:30.792-->00:04:35.833
engineering campaign and I’ll
just get someone to run my
malware except most of the

00:04:35.833-->00:04:41.417
decent malwares was for windows
and anything that was for osx
either didn’t have encrypted co-

00:04:41.417-->00:04:47.417
communications which is a no go
and you have full network pcap
it also maybe didn’t have like

00:04:47.417-->00:04:52.417
persistence mechanisms or the
shell wasn’t even interactive.
So write your own. My first

00:04:55.000-->00:04:59.667
malware dot jpg basically it’s
just a python script that makes
reverse SSH tunnels happen,

00:04:59.667-->00:05:05.375
pretty rudy- rudimentary tried
to put some cool tricks in there
like using Twitter to resolve

00:05:05.375-->00:05:10.375
C2s, random scheduling, things
to try to thwart our blue team
and it was obfuscated and there

00:05:12.375-->00:05:15.667
was a nice script to try and
like generate it different so I
was able to try and be

00:05:15.667-->00:05:21.958
adaptable. And it worked good
for like about a year maybe this
this was a pretty effective

00:05:21.958-->00:05:25.583
piece of thing because when you
custom write something it works
good >>This is my favorite gif

00:05:25.583-->00:05:29.917
by the way I think in the whole
presentation >>Second favorite
[laughs] but this comes with

00:05:29.917-->00:05:34.917
some problems, first of all blue
side, they don’t like getting
wrecked by a python script um so

00:05:37.625-->00:05:43.333
naturally because it’s an
adversarial game they start
writing specific detections for

00:05:43.333-->00:05:50.167
red team and specific-
specifically to detect the exact
techniques that our malware

00:05:50.167-->00:05:55.417
deploys and because of this the
attribution of the red team gets
really good so our ability to do

00:05:55.417-->00:06:01.875
things like not tell them it’s
us and have them believe that
it’s not us goes down big team

00:06:01.875-->00:06:07.458
and suddenly we are getting
attributed all over the place
and we can’t be good boogeymen

00:06:07.458-->00:06:11.208
and plus we still have this
thing that’s like mostly
spaghetti code ‘cause I wrote it

00:06:11.208-->00:06:16.208
and I’m crap at that so we
iterate new team members you say
hey like one of the first things

00:06:18.708-->00:06:24.958
you’re gonna do, write some
malware, and she writes a java
SSH full implementation, goes

00:06:24.958-->00:06:28.750
both ways, does pretty much the
same thing but looks totally
different and that works for a

00:06:28.750-->00:06:33.125
bit then we have to iterate
again we a- get one that’s
written completed in bash and we

00:06:33.125-->00:06:37.833
add some new tricks to it we’re
just like yes this is great new
malware, new tricks, we’re like

00:06:37.833-->00:06:44.000
DJ Khaled, we da besss
bar-war-warr [sings] right? It’s
great except the status quo was

00:06:44.000-->00:06:48.167
that we ended up rewriting ou-
our malware each time that we
wanted something new and we had

00:06:48.167-->00:06:52.625
to stand up all our own c2 each
time as well and we had to
manage and configure it all as

00:06:52.625-->00:06:57.458
well this kind of sucks and we
have to manage the keys and the
certs and it took a lot of time

00:06:57.458-->00:07:02.375
and effort and this is prone to
errors because of the time and
effort we start messing up we

00:07:02.375-->00:07:07.208
accidentally reuse a C2 that
gets us attributed that’s not
what we want maybe things get us

00:07:07.208-->00:07:11.375
caught sometimes we- one time we
accidentally connected to it
from like the the internal

00:07:11.375-->00:07:18.042
corporate network now you see C-
C2 and also red team laptop
connecting to the same thing,

00:07:18.042-->00:07:22.792
yeah, owned, right? This was
painful because their stuff is
unreliable it’s impossible to

00:07:22.792-->00:07:27.458
maintain, it’s impossible to
truly iterate on it, and it’s
really hard to add features

00:07:27.458-->00:07:32.458
because again, spaghetti code,
>>Spaghet >>So wouldn’t it be
nice if you didn’t have to write

00:07:36.333-->00:07:41.333
things from scratch every time.
Sorry [laughs] cutting new
malware implants only took

00:07:43.667-->00:07:47.917
seconds, and you could pick the
features you wanted for that
implant and the C2 server

00:07:47.917-->00:07:53.083
infrastructure setup happened
automagically for you and each
sample was unique so when you

00:07:53.083-->00:07:59.208
take an MB5 of something you
upload it into Virustotal that
means nothing and each C2

00:07:59.208-->00:08:04.250
endpoint was unique, these are
operational things that we want
so bake them in right? And you

00:08:04.250-->00:08:09.542
didn’t have to manage the keys
for those servers because you
know that’s hard and wouldn’t it

00:08:09.542-->00:08:15.500
be nice if the malware was just
super fugging awesome and each
time you added new things to it

00:08:15.500-->00:08:20.667
it just got better because you
actually had a system to iterate
on it? So let’s imagine I- I

00:08:20.667-->00:08:25.000
want you all to reach under your
seats, underneath there we’ve
placed like on the Oprah Show,

00:08:25.000-->00:08:29.250
an imaginary thinking cap for
you [laughter] >>You’re not
reaching under your seat >>That

00:08:29.250-->00:08:34.958
guy! Thank you I knew I could- I
knew someone would do it, so
we’ll put on our imagination

00:08:34.958-->00:08:40.833
hats and let’s imagine a world
with better malware for red team
operators like us where it-

00:08:40.833-->00:08:44.792
there’s a framer let’s imagine
that we build it in a way so
that we can build the features

00:08:44.792-->00:08:50.500
we need. So we have a core and
the core we probably want to
bolt on some modules to it maybe

00:08:50.500-->00:08:54.167
things like how to connect to
network and this could be
something like as simple as a

00:08:54.167-->00:08:59.208
network connection or as complex
as Reddit posts or Youtube
comments or Twitter things

00:08:59.208-->00:09:03.375
right? >>It doesn’t necessarily
only have to be one either you
might have multiple different C2

00:09:03.375-->00:09:07.125
methods >>Right >>And you can
have all of those in the same
malware implant and then swap

00:09:07.125-->00:09:11.958
between them or- or send
fragmented packets across all of
them. >>Which would be really

00:09:11.958-->00:09:16.333
hard to do with spaghetti code.
And then we can also have things
like persistence modules because

00:09:16.333-->00:09:20.542
we want to run long term
persistence ops. Bad guys
already have this stuff just no

00:09:20.542-->00:09:25.875
one really shares it right? But
we can do better simulations if
we had this right? Maybe we

00:09:25.875-->00:09:31.375
wanna have like a dropper right?
And we [laughter] the- the
spoiler alert is I don’t think

00:09:31.375-->00:09:35.792
we have this yet but we’re-
we’re building this for the best
case scenario for the future to

00:09:35.792-->00:09:42.417
scale for like our own
capability so maybe we want so
that when a system is infected

00:09:42.417-->00:09:47.417
it takes little information like
hardware ID’s of that system,
submits that to the server, and

00:09:49.667-->00:09:54.000
then the server says, here you
go just in time copulation of
your malware, it’s encrypted for

00:09:54.000-->00:09:58.250
your system so when you pull it
off that system and you throw it
in your automated sandbox

00:09:58.250-->00:10:01.792
[smacks lips] it doesn’t work
>>And even if blue team kind of
know that you’re doing this you

00:10:01.792-->00:10:05.667
can randomize the metrics or the
the IDs that you’re using on
that system so they still have

00:10:05.667-->00:10:10.125
to put in some reversing if it-
to work out you know what you’ve
actually used that time >>Yeah

00:10:10.125-->00:10:15.708
so we’re we’re we basically
wanna be able to change our IOCs
programmatically, right? >>And

00:10:15.708-->00:10:19.667
then uh because you’ve got all
of this in the one framework you
can then start to do more

00:10:19.667-->00:10:24.500
advanced things like have threat
profiles for a specific
operation so maybe you know this

00:10:24.500-->00:10:30.458
time you want to spin off your
C2 this way and you want to have
it in on on this cloud provider

00:10:30.458-->00:10:33.042
and you wanna have um like this
particular configuration for it
well you can do that in the

00:10:33.042-->00:10:38.500
framework and you can start to
simulate that with multiple
operators all at the same time

00:10:38.500-->00:10:42.500
they don’t need to um manually
do that it just happens
automatically whenever you spin

00:10:42.500-->00:10:51.667
off that C2 and every yeah >>So
you can also probably do things
like if you’re you’re a red team

00:10:51.667-->00:10:57.250
right? Part of what you’re
saying that you’re doing is
adversary simulation so this

00:10:57.250-->00:11:03.125
could give you the ability to
say, okay I’m going to add a
network module in and that

00:11:03.125-->00:11:08.583
network module is going to
dictate how the traffic looks on
the wire so even though you get

00:11:08.583-->00:11:13.625
to use your shell like whatever
you could say let’s mimic this
threat actor based on a pcap get

00:11:13.625-->00:11:17.833
it in and get that type of
traffic >>Yeah you can look at
the the frequency of uh uh

00:11:17.833-->00:11:22.083
packets you can look at the
average size of packets and you
can look at the average length

00:11:22.083-->00:11:26.625
of connection and then you can
use those types of connections
in the network, split your data

00:11:26.625-->00:11:30.750
across multiple ones of those so
when the blue team is looking
for data being exfilled it’s not

00:11:30.750-->00:11:33.625
being exfilled over one
connection but multiple
connections that all look like

00:11:33.625-->00:11:37.833
common traffic on that- that
system. >>So let’s keep
imagining alright? It’s nice

00:11:37.833-->00:11:42.542
that if we’re gonna have more
things we’re gonna have more
things that we want to

00:11:42.542-->00:11:46.958
cronenberg altogether and we
don’t wanna have to rewrite all
these different components so

00:11:46.958-->00:11:50.917
let’s just let that be anything
else and also we should probably
write it in Golang right?

00:11:50.917-->00:11:55.625
>>That’s sexy these days >>Go-
golang is sexy right? Yeah >>Who
likes golang? >>And this all has

00:11:55.625-->00:11:59.958
to work together and it needs to
come together as like a singular
atomic unit like the things that

00:11:59.958-->00:12:03.917
make up our bodies and our ever
expanding universe and it should
probably adapt to any situation

00:12:03.917-->00:12:08.417
like Macgyver like work on
different Os’ do things like
that it doesn’t need to be tied

00:12:08.417-->00:12:13.958
to a certain thing and it should
be designed eloquently >>Yeah,
like Taylor >>Like Tay tay

00:12:13.958-->00:12:21.625
[chuckles] This guy loves Taylor
Swift like for real [applause]
like >>Cool so yeah that’s what

00:12:21.625-->00:12:26.542
we built >>Well, the beginnings
>>So let’s have a look
>>[laughs] No it’s done >>So, So

00:12:26.542-->00:12:31.583
we start with the core that you
kind of saw before we need
everything to- to kind of be

00:12:31.583-->00:12:35.708
oriented around this so you- we
can bolt the functionality into
a common- common uh yeah a a

00:12:35.708-->00:12:42.958
centerpoint. It’s essentially a
microkernel so you’re managing
execution flow between all the

00:12:42.958-->00:12:47.250
different modules and and
whatever their functionality
might be as well as passing data

00:12:47.250-->00:12:52.333
between them and then saving
that and returning it to the C2
network. So the core is gonna be

00:12:52.333-->00:12:57.417
in a specific language uh right
now our first core is written in
golang and you can attach golang

00:12:57.417-->00:13:01.417
modules on to this uh and the-
the core determines what
platforms it can run on so in

00:13:01.417-->00:13:07.583
this case golang is trivially
cross platform so you can run on
uh Mac, Linux, and in- on

00:13:07.583-->00:13:13.750
Windows. So when you want to
execute some part of that module
functionality how does the core

00:13:13.750-->00:13:18.958
manage to do that? Well it uses
two specific things uh to manage
execution flow one is an event

00:13:18.958-->00:13:24.458
loop where modules can register
themselves to handle specific
events uh and it’s it’s if

00:13:24.458-->00:13:28.500
you’ve done any OS programming
it’s very similar to like a
standard OS event um when that

00:13:28.500-->00:13:33.125
gets signaled by any module it
will then trigger the the module
which is going to handle that

00:13:33.125-->00:13:38.167
functionality. And we have a
scheduler loop maybe you wanna
have some code that’s going to

00:13:38.167-->00:13:43.208
execute every hour, every day,
or every week, uh well in this
case the core will handle that

00:13:43.208-->00:13:47.250
for you as well. So if we look
at an example of a module the C2
module is going to start with

00:13:47.250-->00:13:53.042
because every core needs to have
a C2 module in order to connect
back to meatpistol. So this is

00:13:53.042-->00:13:59.333
our C2 module it’s job is to
without the core needing to
understand how it does it

00:13:59.333-->00:14:04.583
connect and disconnect from the
meatpistol network and provide a
method for the modules to

00:14:04.583-->00:14:08.750
communicate data or transfer
data back to the C2 network for
the operators to use. So how

00:14:08.750-->00:14:13.375
does the core know how to use
that? Well once again it comes
back to the core knows that if

00:14:13.375-->00:14:20.500
it triggers a C2 connect event
that the C2 module will do
whatever it needs to do and then

00:14:20.500-->00:14:27.375
report back on whether it
succeeded or not. So in this
particular example C2 connect

00:14:27.375-->00:14:33.333
and disconnect. Alright. But a
malware implant that only has a
C2 connection is not very

00:14:33.333-->00:14:40.125
exciting so why don’t we add
some persistence to it or why
don’t we add some file

00:14:40.125-->00:14:44.625
capabilities to be able to put
files on that system, grab files
off that system, download files

00:14:44.625-->00:14:49.958
from the internet, then we
perhaps we are doing a whole
bunch of common activities every

00:14:49.958-->00:14:55.208
single time we compromise the
system to exfil chrome cookies
or you know to see a password or

00:14:55.208-->00:14:58.875
whatever it is you do when you
get on that system why not wrap
that up into a single command

00:14:58.875-->00:15:03.125
that can be executed on demand?
And then of course we need
shells, so we need an exec

00:15:03.125-->00:15:08.208
module and then you can start to
think of a whole range of other
modules that you might be able

00:15:08.208-->00:15:13.417
to use with the framework for
example you might have a module
that regularly detects um if- if

00:15:13.417-->00:15:17.208
anything is being scanned on
that system if- if there’s
responders looking for that

00:15:17.208-->00:15:22.667
malware so you can clean up and
get off. And you can see- I mean
with all of these different

00:15:22.667-->00:15:26.458
kinds of functionality
meatpistol gives you an
opportunity to pick and choose

00:15:26.458-->00:15:31.333
the things that you want for
each implant. Not just across
the entire operation but for

00:15:31.333-->00:15:36.458
every target system that you
drop it on you can customize
this it’s like a malware buffet

00:15:36.458-->00:15:42.625
>>Sounds delicious mmm [smacks
lips] [audience laughter] >>So
how does everything communicate?

00:15:42.625-->00:15:50.458
[laughter] >>Do that again
>>We’ve spoken about how it
internally communicates but how

00:15:50.458-->00:15:57.958
does it externally communicate
with the C2 network? Well we’ve
implemented uh like client to

00:15:57.958-->00:16:04.500
client Uni-directional data
transfer which kinda sounds like
half a TCP connection [laughter]

00:16:04.500-->00:16:12.292
so I mean that’s some impressive
control flow there but uh
[laughter] you know. Alright but

00:16:12.292-->00:16:17.208
we need this to be persistent as
well because our operators are
connecting to the the master C2

00:16:17.208-->00:16:21.500
and the implants are connecting
to the master C2 but they’re not
necessarily online at the same

00:16:21.500-->00:16:25.500
time or the implant might come
and go as it- as it pleases so
we have to persist the data

00:16:25.500-->00:16:30.708
there so that whenever they’re
both online they can get what
they need. And plus at the end

00:16:30.708-->00:16:34.958
of the operation you wanna have
a record of all the things that
you have done on that target

00:16:34.958-->00:16:39.042
system for analysis for next
time, for >>For reporting!
[laughter[ >>For reporting, or

00:16:39.042-->00:16:46.042
cleaning up. Alright so here’s
our- here’s our persistent
storage and we also wanted to

00:16:46.042-->00:16:53.000
achieve the greatest level of
hacking excellence ever
displayed [laughter] >>Finally

00:16:53.000-->00:16:57.875
the dream is reality [chuckles]
>>I know a lot of us haven’t
quite got there yet but uh we-

00:16:57.875-->00:17:02.458
we strive for it every day to
have hackers that can have two
hackers on one keyboard

00:17:02.458-->00:17:08.917
[laughter] >>It’s real guys
>>Yeah. So with having many
readers and many writers on

00:17:08.917-->00:17:15.042
these channels, you could have
two operators on different
laptops in different parts of

00:17:15.042-->00:17:20.917
the world operating on the same
shell in the same system at the
same time. >>So this is actually

00:17:20.917-->00:17:26.083
really useful because you used
to be like in your shell, in
your session, or whatever, using

00:17:26.083-->00:17:30.250
whatever tool you’re using but
you want someone else to be like
hey jump in my shell and like

00:17:30.250-->00:17:35.000
ride along with me, maybe
they’re a new person, maybe
they’re more senior and you need

00:17:35.000-->00:17:38.208
their help so now you can have
someone just like in the
framework jump into your session

00:17:38.208-->00:17:44.208
with you and they can type or
takeover but you can both see it
so we used to accomplish this by

00:17:44.208-->00:17:47.875
like setting up shared screen
sessions that we’d all jump into
at the same time but >>And

00:17:47.875-->00:17:52.292
importantly uh even if you sp-
uh spawn multiple shells on the
meatpistol framework it’s not

00:17:52.292-->00:17:57.083
spinning up not connections it’s
all multiplexing all of that
data across the one connection

00:17:57.083-->00:18:01.125
so you can control how that
occurs, so if you have C2 and
you want to fragment that data

00:18:01.125-->00:18:06.667
up it’s fine you don’t have to
like open up new connections
that uh blue team can see. And

00:18:06.667-->00:18:11.875
to achieve that we needed to
introduce some additional
blocking semantics which uh yeah

00:18:11.875-->00:18:17.417
uh allow you to to block at the
end until the the whole channel
is closed which gives you an

00:18:17.417-->00:18:22.333
interface that looks a little
bit like this. The important
thing in meatpistol is to push

00:18:22.333-->00:18:26.750
all the complexity not at the
not at the module level where
you wanna write as many modules

00:18:26.750-->00:18:30.333
as you want and you you want
them to be simple and easy to
implement, you wanna push all

00:18:30.333-->00:18:35.667
that to the service side. So the
module just sees something that
it can read from it can write to

00:18:35.667-->00:18:42.917
it can attach and detach which
is similar to a normal file open
and close and then a close which

00:18:42.917-->00:18:47.875
essentially says there are no
more writes ever going to occur
on this channel, so if you read

00:18:47.875-->00:18:54.167
to the end it will return the
EOF finally instead of blocking.
So that’s how one client to

00:18:54.167-->00:18:58.875
client communication works, how
does the whole meatpistol
network look? Um well this

00:18:58.875-->00:19:02.792
pretty much sums it up it’s not
too complication, there’s two
important things that I would

00:19:02.792-->00:19:09.292
like to point out here, one,
it’s a red team, it’s not a red
person, so we have multiple

00:19:09.292-->00:19:13.958
operators all connecting to the
master C2. And they’re operating
in the same state, with the same

00:19:13.958-->00:19:20.167
implants, at the same time. And
then the second part is the
infected hosts you see down on

00:19:20.167-->00:19:24.458
the right hand side are all your
implants but they’re not
connecting directly back to the

00:19:24.458-->00:19:30.833
master C2 because this is
obviously trivial to attribute
instead we have a proxy C2 layer

00:19:30.833-->00:19:36.708
in the middle which you know it
it could be a a simple dumb
transparent proxy which just

00:19:36.708-->00:19:41.083
forwards packets straight
through to the master C2 or
maybe it’s a more intelligent C2

00:19:41.083-->00:19:45.958
that will take fragmented
packets and then decode them or
whatever and then pass that data

00:19:45.958-->00:19:52.625
back. >>This this design, this
model is for Opsec for teams
that have to operate internally,

00:19:52.625-->00:19:58.667
right? Because you have all
these strange things where like
the real adversaries they don’t

00:19:58.667-->00:20:03.667
have this problem, this is- this
is a design paradigm for red
teams because you might be

00:20:03.667-->00:20:09.542
internal to your company right?
You might work somewhere or be
on site. You want it so that no

00:20:09.542-->00:20:16.583
one ever sees you talking to the
same thing as the infected hosts
talk to. >>Makes sense >>Yeah

00:20:16.583-->00:20:20.625
makes sense, right? I see a lot
of nods so >>Cool, okay, well,
what does it actually look like?

00:20:20.625-->00:20:26.583
>>Oh S**t, okay we’re um we’re
gonna switch to mirror mode and
not have any speaker notes or

00:20:26.583-->00:20:31.333
anything for the rest of the
talk, you guys are okay with
that [chuckles] we’re we’ll be

00:20:31.333-->00:20:41.500
fine >>This is fun [pops
mouth][sings under breath] >>Um
alright, I’m in, I’m in

00:20:41.500-->00:20:48.250
[inaudible] >>Is it good?
Alright [inaudible] >>Is that
visible? >>Can you guys see

00:20:48.250-->00:20:56.042
that? Want it a bit bigger
[inaudible off-mic comment] Oh
rea- I’ll spoil the end

00:20:56.042-->00:21:04.625
[laughter] Alright oh! Re-
>>Wahhh >>Sorry I’m gonna have
to quit and restart I need a

00:21:04.625-->00:21:14.500
Taylor quote, there we go >>Okay
[laughter] >>So we’ve just
gotten into meatpistol we’ve

00:21:14.500-->00:21:17.417
connected to the server if- if
you had connected to this Fuzzy,
what’s- what’s the first thing

00:21:17.417-->00:21:20.042
that you kind of would wanna do?
>>Well you know we set out to do
years ago was like let’s make a

00:21:20.042-->00:21:23.458
thing that let’s us build
malware >>Cool >>Without being a
headache so maybe we build some

00:21:23.458-->00:21:29.792
malware? Let’s make some mother
f**king malware >>Alright >>Oh I
got that right. >>So we’re gonna

00:21:29.792-->00:21:34.000
create a new blueprint we’re
gonna call it Taytay because I
think that’s been very well

00:21:34.000-->00:21:39.917
established by now [laughter] A
blueprint is uh a set of
configurations for a specific

00:21:39.917-->00:21:45.625
implant. You can create multiple
blueprints at the start of an
operation and it’s- you can save

00:21:45.625-->00:21:49.750
that for later, you don’t have
to keep building the same types
of implants over and over again

00:21:49.750-->00:21:54.667
by reconfiguring them every
time. So first of all to build
some malware we need to create

00:21:54.667-->00:21:58.583
some modules, so we need to add
modules to the blueprint. We
only have four at the moment but

00:21:58.583-->00:22:04.875
they- they implement what we
need so let’s add all of those
to our blueprint. [mouse

00:22:04.875-->00:22:11.125
clicking] >>Na, na, na, na, na,
na no- you know we co- how we
could do this faster if we could

00:22:11.125-->00:22:14.750
both type on the same keyboard
[laughter] >>I know right, we
need meatpistol for our

00:22:14.750-->00:22:19.917
meatpistol. Alright so now we
have a look at the options that
we can configure based on the

00:22:19.917-->00:22:25.500
modules that we’ve added. Fairly
standard fare here uh you can
set your C2 host in port because

00:22:25.500-->00:22:30.500
the C2 module that we’ve added
is a GRPC, standard TLS
authentication, etcetera,

00:22:30.500-->00:22:34.333
etcetera, etcetera. Some of the
other options there you might
not be familiar with. Darken is

00:22:34.333-->00:22:40.875
a custom golang or post
copulation obfuscator um which
we’ll go through and strip out-

00:22:40.875-->00:22:45.917
>>It’s a, it’s a regex >>It’s
pretty much >>Sorry, it just
regex’s stuff out of the binary

00:22:45.917-->00:22:50.542
but with ra- random bots. >>And
then the uh the packer yeah
there’s nothing fancy happening

00:22:50.542-->00:22:54.375
there either, it’s just all
different options that you can
set. Importantly here because

00:22:54.375-->00:22:59.375
it’s on Golang at the moment,
you can set the OS in the
architecture and it will compile

00:22:59.375-->00:23:05.458
for whatever you want just by
changing a string like yeah, I
love Golang >>That’s cool >>Yeah

00:23:05.458-->00:23:12.125
so we’re gonna set debug to true
so that you can see the output
in the demo. Uh and now we need

00:23:12.125-->00:23:19.083
to spin up a C2 for this. Now
what we could do is we could say
spin up. Meatproxy is an alias

00:23:19.083-->00:23:24.250
for an image identifier so and-
think of any instance online,
think of, an image that you’ve

00:23:24.250-->00:23:28.000
created, you can alias that
instead of having like the i
dash blah blah blah blah blah

00:23:28.000-->00:23:37.958
Couple of seconds later we have
our C2 ready to rock n’ roll
that’s what you need to do no

00:23:37.958-->00:23:42.042
logging in and having to two
factor through Amazon and then
find out you’re in the wrong

00:23:42.042-->00:23:46.667
region or you know whatever um
cloud provider you’re using.
>>Que this IP address getting

00:23:46.667-->00:23:51.208
like DOS’d off the Internet so
[chuckles] >>But I mean eve-
even that would get a bit

00:23:51.208-->00:23:56.125
tiresome having to spin up your
own C2 every single time like if
you’re gonna automate things why

00:23:56.125-->00:24:06.458
not go the whole way? So let’s
set our C2 host and C2 port to
be auto. And now let’s build it.

00:24:06.458-->00:24:11.833
So in the background >>I was
gonna- I was just going to
comment on the names like you

00:24:11.833-->00:24:17.333
wrote this thing so it instead
of having like terrible like
UIDs for everything it just

00:24:17.333-->00:24:21.875
creates these crazy things and
one time it created a a really
useful malware implant for us

00:24:21.875-->00:24:26.792
and it was called Cottage Wife
it was really [chuckles]
[audience laughs] It was with us

00:24:26.792-->00:24:31.458
for a long time, cooked us bread
[laughter continues] >>So yeah
as you can see now it’s finished

00:24:31.458-->00:24:35.125
it’s- it’s got the C2 it’s
automatically spun that up and
configured the malware to use it

00:24:35.125-->00:24:39.500
um I know some people in the
audience are probably
downloading this right now but

00:24:39.500-->00:24:48.083
don’t bother uh it’s not that
exciting um alright woop [mouse
clicks] but I mean you still

00:24:48.083-->00:24:51.667
have to build every single time
you have one piece of malware.
Wouldn’t it be cool if you could

00:24:51.667-->00:24:57.167
just like build more of them.
And in the meantime we’ll
download the first one that we

00:24:57.167-->00:25:01.292
just created. Now you can get
this on the system anywhere that
you want. Uh if you’re red

00:25:01.292-->00:25:05.667
teaming the whole point of
meatpistol is not to compromise
the system it’s to manage post

00:25:05.667-->00:25:12.458
compromise of the system so >>I
told you it wasn’t a penetration
tool >>Yeah. And you- so you can

00:25:12.458-->00:25:16.208
see the first build of the
malware has come back here as
well. Justs gives you the link

00:25:16.208-->00:25:21.500
and the C2 that it spun out for
you. So the- this is good if you
wanna do something like a USB

00:25:21.500-->00:25:25.917
drop you wanna se- uh set 10
USBs or whatever, copy all that
across and then you’re good to

00:25:25.917-->00:25:34.542
go you don’t have to like sit
there building all of them.
[mouse clicking] Alright, so

00:25:34.542-->00:25:38.083
then we run the implant, we get
the connect back. And you can
notice it’s coming from the C2

00:25:38.083-->00:25:44.667
that was automatically spun up.
So now let’s have a look at the
implants we’ve got. We can see

00:25:44.667-->00:25:52.708
we’ve got one connection from 9
seconds ago, AptlyBasil. So we
can select that implant and now

00:25:52.708-->00:25:58.875
we can start to do things with
it uh this is similar to like a
um what- I mean yeah- you can

00:25:58.875-->00:26:03.250
pretty much do things with it.
So the first thing you might
wanna do is maybe pop a shell

00:26:03.250-->00:26:10.000
and so now we have a shell now
this is not just- it’s not a
dumb shell you can you can do

00:26:10.000-->00:26:16.542
pretty much anything you want so
if you want to go into vim you
can go into vim I’m in vim.

00:26:16.542-->00:26:23.333
>>The test for this guys
interview was write me a shell
that’s actually fully

00:26:23.333-->00:26:36.875
interactive. In a day. No. It’s
probably important to note that
the things that you can do right

00:26:36.875-->00:26:38.750
now is dictated by what modules
you chose earlier. Also we have
tab complete I know like any

00:26:38.750-->00:26:42.000
tool if you don’t have tab
complete it’s like garbage right
like it’s the- the metric that

00:26:42.000-->00:26:48.375
everything is judged by >>And
we’ve got history. And then you
exit out and you’re back in the

00:26:48.375-->00:26:53.375
framework again. So at this
point you might even be like oh
yeah that’s great well that’s a

00:26:53.375-->00:26:58.667
shell like I can literally do
that in every single tool that
I’ve ever had before. Well we

00:26:58.667-->00:27:04.708
also have this. So remember how
I said that all channels are
persistent? All channels are

00:27:04.708-->00:27:08.208
persistent and that shell
session, every read and ever
write is recorded, with a

00:27:08.208-->00:27:13.458
timestamp so that you could
literally ask ecinema your
entire session on that box. If

00:27:13.458-->00:27:20.000
we wanted to view what happened
in that session sorry there’s a
little bit of a- there we go.

00:27:20.000-->00:27:25.042
And we have the full session
that we just showed you, but
saved. >>That’s not useful at

00:27:25.042-->00:27:30.000
all right? ‘Cause no one here
ever forgets to like start their
terminal logging or you know

00:27:30.000-->00:27:35.042
take a screenshot or anything
like that, right? No >>And you
could also do analysis on that

00:27:35.042-->00:27:41.292
at the end of the operation if
you wanna do like smart
detection of like certs or or

00:27:41.292-->00:27:44.417
keys or anything in your ce- uh
shell sessions you can do that
at the server level without the

00:27:44.417-->00:27:50.500
operator having to- to manually
do that. Uh you might also want
to you know tell the implant to

00:27:50.500-->00:27:54.833
sleep for a little while maybe
you- yeah if you- if you’re
gonna do this manually it’s not

00:27:54.833-->00:27:59.750
quite as useful but what you can
do is automate this process so
if you can say I wanna have a

00:27:59.750-->00:28:04.583
shell herder which will- within
3 hours I can have one implant
in this particular environment

00:28:04.583-->00:28:09.750
and then the framework could
sleep all the other implants for
you so you’re having minimal

00:28:09.750-->00:28:13.875
connection back to the C2 until
you need something and then
you’ll trigger it and it’ll wake

00:28:13.875-->00:28:19.208
up for you. >>I know sleep might
sound boring, but imagine you
wanna go home for the weekend or

00:28:19.208-->00:28:23.583
the night, right? You’re not
working anymore, it’s off
business hours, you don’t want

00:28:23.583-->00:28:29.208
any network traffic going to and
from the systems because that’s
really anomalous right? So sleep

00:28:29.208-->00:28:33.125
sleep’s actually useful. Go on
>>So I mean there’s a whole
bunch of all the commands that

00:28:33.125-->00:28:37.083
you can do here um but we’ll
we’ll leave that up to to people
to kind of explore. >>That’s

00:28:37.083-->00:28:52.750
meatpistol basically >>That’s
meatpistol >>yeah, so, uhh
[applause] Oh [applause] Hmmm

00:28:52.750-->00:28:59.667
Surely our presentation’s
somewhere [chuckles] there it
is. Cool. Okay so one thing you

00:28:59.667-->00:29:10.458
should know like I mean this was
and still is very much alpha as
fug >>You know >>And I mean

00:29:10.458-->00:29:20.417
that’s just how it is so but the
thing is we’ve used this on a
number of operations now and

00:29:20.417-->00:29:25.583
it’s solved a real problem for
us malware implant creation with
like jenky scripts that we were

00:29:25.583-->00:29:28.250
writing it used to take days
because you had to test it you
had to figure it out and you had

00:29:28.250-->00:29:32.042
to try and develope something
to- to manage this and it didn’t
scale from one thing to another

00:29:32.042-->00:29:36.333
you had to constantly redo all
of this stuff. Now it takes
seconds for us. >>And the

00:29:36.333-->00:29:41.667
important thing as well is in a-
in a red team operation you want
the experience for the red team

00:29:41.667-->00:29:45.542
operator to be the same every
single time so they can get used
to the workflow but you want

00:29:45.542-->00:29:50.750
your actual method of operation
to be totally different from the
forensics side. So with a

00:29:50.750-->00:29:54.375
framework like this you can have
a a- very familiar face for the
red team operators while

00:29:54.375-->00:29:59.792
changing modules or changing how
they’re configured for example
like different C2 or whatever it

00:29:59.792-->00:30:03.125
might be to have a very
different experience on the blue
team side when they’re looking

00:30:03.125-->00:30:10.708
at the malware you’re dropping
and how it’s communicating.
[sighs] Yeah so once you get

00:30:10.708-->00:30:14.292
locked into a serious malware
collection the tendency is to
try and push it as far as you

00:30:14.292-->00:30:20.375
can. >>Yeah so about a week ago
maybe less than a week ago um
>>It was like four days >>My

00:30:20.375-->00:30:24.958
like house got turned in like a
weird scene from Silicon Valley
there was like 3 people sitting

00:30:24.958-->00:30:30.792
on my couch and like
contributing because John had a
bright idea he’s like maybe we

00:30:30.792-->00:30:37.208
can get someone to see if they
could like write a new core in a
different language so, why do we

00:30:37.208-->00:30:41.542
have a Python core? >>Yeah, well
yeah, it’s- it’s- it’s- one
thing to kind of write something

00:30:41.542-->00:30:44.583
for your own internal use,
getting people to be able to use
that and understand how it works

00:30:44.583-->00:30:48.833
is an entirely different thing.
So we thought it would be cool
to to throw it out there as a

00:30:48.833-->00:30:54.125
challenge to some students to
say hey you know write a Python
core for this before our talk in

00:30:54.125-->00:30:59.917
4 days uh so a big shout out to
Glen and Shawn, are you guys
here right now? Yeah >>It’s

00:30:59.917-->00:31:04.917
their first Def Con yay! >>It’s
their first Def Con [applause]
>>Gettin’ shout outs on their

00:31:04.917-->00:31:13.875
first Def Con >>And in four days
time uh after being bribed with
uh an a lunch in West Oakland

00:31:13.875-->00:31:19.708
>>Fancy! >>And uh yeah they they
managed to get a Python core up
and running and working with a-

00:31:19.708-->00:31:26.583
with a shell module and
everything so kudos. >>Cool. So.
What’s the best way to increase

00:31:26.583-->00:31:34.708
this? Right? Um Obviously like
the more you get the more
capability we get to do

00:31:34.708-->00:31:38.208
different things, to simulate
different stuff uh the idea
would be to share it or not

00:31:38.208-->00:31:45.792
which uh sharing it was our
intent um I messed up a little
bit we >>WE >>messed up a little

00:31:45.792-->00:31:50.333
bit >>we messed up a little bit
>>Uh I didn’t realize there was
a um an approval process in

00:31:50.333-->00:31:56.375
order to open source things and
I just didn’t do that like I was
told about it like today and um

00:31:56.375-->00:32:03.917
so [sighs] uh we- we can’t. But
um we’ll- we’ll go- get back
>>We’ll come back to that

00:32:03.917-->00:32:09.292
>>We’ll probably. Don’t worry.
Um I’m gonna do whatever I have
to do to to make this thing

00:32:09.292-->00:32:15.000
reality >>We, we >>We will >>We
will [laughter] >>So you’re
probably wondering about the

00:32:15.000-->00:32:22.792
name. So of course any good tool
has like a you know a
backronymed name um and it needs

00:32:22.792-->00:32:28.750
to it needs to be self
referential I think that’s what
recursion is right? Is that

00:32:28.750-->00:32:32.292
recursion? >>Yeah, yeah >>What
is tranal? >>So we were thinking
meatpistol maybe like we’re

00:32:32.292-->00:32:35.250
throwing this around some idea
meatpistol enthralls angry
tyrants proposing intimate

00:32:35.250-->00:32:39.625
sexy-times teasing oligarch
llamas but then we also thought
maybe marginally erect alpacas

00:32:39.625-->00:32:42.958
tactically pursuing
international slave trading
oligarch llamas would be a good

00:32:42.958-->00:32:46.958
one too [laughter] but but then
we though you know maybe it’s
just a modular embedded

00:32:46.958-->00:32:51.958
adversary tooling platform
>>Yeah no- nobody cares >>Yeah
[laughter] the point is we

00:32:51.958-->00:32:58.500
called it meatpistol because we
can and also I mean like maybe
you got you picked up on that

00:32:58.500-->00:33:03.375
[laughter][applause] It’s- it’s
an homage to an awesome tool,
right? And we had to call our

00:33:03.375-->00:33:10.292
thing something. So it’s natural
for people to wanna compare this
tool with other tools because

00:33:10.292-->00:33:17.042
like we understand like there is
a lot of really cool stuff in
the ecosystem of offensive

00:33:17.042-->00:33:22.458
tooling that you can use and
we’ve- we get that question a
lot I mean we’ve been

00:33:22.458-->00:33:25.917
socializing this with other red
teams in the industry to see
like what is it- what should we

00:33:25.917-->00:33:32.125
work on this, should we develop
it and most of the first few
questions are like comparison

00:33:32.125-->00:33:38.292
type questions and so we’ll just
address a few of those before we
have to answer it a million

00:33:38.292-->00:33:42.708
times offline. People as us
how’s it different from
metasploit, right? I um I don’t

00:33:42.708-->00:33:48.750
want to start holy war again um
so if you disagree with me right
now just sit down be humble for

00:33:48.750-->00:33:53.375
a moment don’t throw anything
and uh we can talk about it
later but I think metasploit is

00:33:53.375-->00:33:58.250
a tool that is inherently
fundamentally designed to ta- to
be an exploit database where you

00:33:58.250-->00:34:04.792
can pair an exploit with a
payload and then having whatever
auxiliary models you want right?

00:34:04.792-->00:34:08.833
To weaponize things, to
penetrate, to-to-to actually be
a pentesting tool. It’s

00:34:08.833-->00:34:12.958
definitely grown into much more
than that but we have no
intention of being an exploit

00:34:12.958-->00:34:18.542
database. People also ask is
this the same as Cobalt Strike?
And I mean no it’s obviously a

00:34:18.542-->00:34:22.250
different tool, but Cobalt
Strike I see as something that
really helps you simulate

00:34:22.250-->00:34:26.125
adversarial scenarios, right?
You can do spear phishing, you
can do pivots, you can visualize

00:34:26.125-->00:34:32.625
the network, it’s really really
cool but it’s visualization, its
automation, ours is just give me

00:34:32.625-->00:34:39.625
malware. ‘ Also they’re like did
you hear about Empire and I was
like yeah and then I was like

00:34:39.625-->00:34:46.625
checking it out and I like as
I’m looking through the models
in Empire and I see that like

00:34:46.625-->00:34:50.042
one of the post exploitation
modules is like giving me credit
I’m like what the s**t so I was

00:34:50.042-->00:34:52.958
like super flattered and
flabbergasted by that but it’s a
really it’s a really cool tool

00:34:52.958-->00:34:57.125
um it’s a post exploitation
agent believe that’s what it
says on the Github page. Ours is

00:34:57.125-->00:35:03.917
make me malware, manage C2,
manage infrastructure. And then
um actually the Def Con CFP

00:35:03.917-->00:35:07.875
panel asked us this they’re like
they just demped fuzzbunch does
that make your tool irrelevant?

00:35:07.875-->00:35:12.958
And I was like s**t does it make
our tool irrelevant? And so I
went and and like looked up the

00:35:12.958-->00:35:16.500
fuzzbunch stuff and I was like
pfft this is all Windows stuff
and they’re like it’s a really

00:35:16.500-->00:35:20.667
cool bag of tricks but it is in
no way something that’s gonna
help our team run operations.

00:35:20.667-->00:35:28.250
Perfect. So meatpistol not an
exploit database, not click to
win automation, it’s not post

00:35:28.250-->00:35:34.458
exploitation agent, it’s not a
bag of cool tricks, it’s it’s
obviously a meat cannon that

00:35:34.458-->00:35:39.792
shoots out malware implants. No.
Meatpistol is a framework for
red teams to create better

00:35:39.792-->00:35:44.708
implants over time to manage
them in a more professional and
less ad hoc crazy way it’s an

00:35:44.708-->00:35:50.583
efficiency tool cause we want to
be the best red team we can be
and we think efficiency is the

00:35:50.583-->00:35:55.208
way to do it. It’s also
multi-user implant management,
an interaction portal, a single

00:35:55.208-->00:36:00.958
place to do everything make your
stuff and interact with it. It’s
also an offensive infrastructure

00:36:00.958-->00:36:05.083
automation tool I think that’s
one of the ways it started.
>>It’s trying to strike that

00:36:05.083-->00:36:09.625
nice balance between having that
commodity malware and that
custom malware cause nobody has

00:36:09.625-->00:36:14.208
time for custom malware every
time >>So the point is
meatpistol is something that has

00:36:14.208-->00:36:20.458
saved us a lot of times and and
pain. And now it could be yours
in the near future but while

00:36:20.458-->00:36:27.208
while we ca n’t open source it
today uh we do have some
t-shirts that are pretty cool

00:36:27.208-->00:36:31.375
>>Yeah >>So there’s a bit of a
challenge here. If you can
figure it out, you can have

00:36:31.375-->00:00:00.000
meatpistol t-shirt. So thank you
that’s, that’s our talk. >>Woo!
[applause]