1 00:00:00,000 --> 00:00:09,200 So, like the title suggests, we're going to be exploiting some CNC servers today, or at least exploiting some CNC toolkits. 2 00:00:09,520 --> 00:00:16,240 Before I get right into that though, these are, at least best to my knowledge, new exploits. 3 00:00:16,520 --> 00:00:20,980 And at the end of this, I will be releasing the Metasploit modules for these exploits. 4 00:00:21,180 --> 00:00:26,460 Before I get there though, I just, I don't want the focus to be so much about these exploits. 5 00:00:26,460 --> 00:00:28,820 I mean, I think they're cool, they're remote code execution. 6 00:00:29,280 --> 00:00:37,900 But the take away should be, if you're a vulnerability researcher, like this field of looking at CNC servers for exploits, is a right field. 7 00:00:37,900 --> 00:00:47,120 There's low laying fruit everywhere and I really don't feel like people are, or a lot of researchers are looking at it, or if they're looking at it, they're very, they're using them just for themselves and not really sharing. 8 00:00:47,280 --> 00:00:54,680 So, um, key take away is this is, this is a really interesting field and I highly recommend anybody who's into vulnerability research to jump into it. 9 00:00:55,040 --> 00:00:58,700 So, before I get started on the exploits, I'm going to do a little bit of background. 10 00:00:58,700 --> 00:01:02,020 I'm going to talk a little bit about some legal stuff, but then we'll, then we'll get into the exploits. 11 00:01:02,820 --> 00:01:05,080 Um, so background on me a little bit. 12 00:01:05,340 --> 00:01:09,660 I've been in this computer, computer security community for over 10 years. 13 00:01:09,660 --> 00:01:12,920 I currently work at, uh, Symantec as a threat researcher. 14 00:01:13,080 --> 00:01:18,900 Before that, I worked for the, uh, DOD doing COE, C&E, C&O, C&A. 15 00:01:19,880 --> 00:01:23,840 Um, and I've had done some time in the trenches as well. 16 00:01:23,940 --> 00:01:28,800 I was an IT administrator before that, so I know what it's like down in the field. 17 00:01:28,800 --> 00:01:32,760 I feel like I kind of have a good round understanding of, uh, this particular area. 18 00:01:32,980 --> 00:01:37,000 With all that being said, the disclaimer should come as no surprise to anybody. 19 00:01:37,000 --> 00:01:46,560 Um, everything I'm about to say up here does not represent any of the opinions, uh, or my opinions do not represent the views of my current or former employers. 20 00:01:46,560 --> 00:01:48,000 Make that clear. 21 00:01:48,000 --> 00:01:54,560 Um, what I'm going to discuss is probably illegal, so what you do with it is up to you. 22 00:01:54,560 --> 00:01:59,080 If you do cool stuff with it, I'd love to hear about it, but what you do, it's your own risk. 23 00:01:59,080 --> 00:01:59,560 Cool? 24 00:01:59,560 --> 00:02:00,860 We got that covered. 25 00:02:01,280 --> 00:02:05,960 Alright, so, let me talk about what really led me into this field. 26 00:02:05,960 --> 00:02:13,740 And that's one thing that bothers me about the security community, the security defense industry, is that there's this defeatist attitude out there, right? 27 00:02:13,740 --> 00:02:16,760 Like, no matter how hard we try, we're gonna lose. 28 00:02:16,800 --> 00:02:21,260 And if you went into, like, a basketball game with that kind of attitude, like, it's not gonna work. 29 00:02:21,260 --> 00:02:25,580 But somehow we expect that it's okay for the security community, right? 30 00:02:25,580 --> 00:02:33,880 Like, I hear this sophisticated actor term passed around all the time as if it's some kind of excuse why a company got hacked. 31 00:02:34,180 --> 00:02:39,140 And I don't, I don't really understand what they're trying to convey by using that term. 32 00:02:39,360 --> 00:02:48,380 If, if I, I try to picture, like, that conversation with the sea levels when you're trying to explain what just happened, uh, sir, we've been hacked. 33 00:02:48,840 --> 00:02:50,740 What, what, how did, how did they get in? 34 00:02:50,740 --> 00:02:52,360 Oh, well, they were sophisticated. 35 00:02:53,320 --> 00:02:55,960 Like, how do you know they were sophisticated? 36 00:02:56,700 --> 00:03:01,040 Well, they were wearing a monocle , so they're clearly a sophisticated actor. 37 00:03:01,420 --> 00:03:04,760 You know, like, what, what does sophisticated mean in this context? 38 00:03:04,760 --> 00:03:09,420 Whatever it means, I don't think it means what they're even trying to persuade it means, right? 39 00:03:09,420 --> 00:03:21,160 I think they're trying to persuade, or, or, to convey, excuse me, that it means that this attacker was so far beyond what we can just, defenders can do that we just can't win. 40 00:03:21,280 --> 00:03:23,160 And so that's what I set out with this to say. 41 00:03:23,160 --> 00:03:32,020 I was like, well, I'm going to take a look at the tools that these sophisticated actors are using and let's just see if we're, if they're vulnerable to attacks, if somebody was to attack them back. 42 00:03:32,140 --> 00:03:33,920 And so that's where I went with this. 43 00:03:34,800 --> 00:03:38,900 Now, Hacking Pack has been a very hot topic over the years, right? 44 00:03:38,900 --> 00:03:46,220 Five years ago, at Black Hat, they did an anonymous survey asking people if they've participated in hacking back in some form. 45 00:03:46,300 --> 00:03:51,500 And anonymously, over a third of the people surveyed admitted to it. 46 00:03:51,740 --> 00:03:58,640 Uh, a lot of times, when a company's hacked, they want justice, they want revenge, they want that person to pay for what they've done. 47 00:03:58,640 --> 00:04:04,420 So they'll go to law enforcement and law enforcement has their hands tied, or can't do anything, or has no recourse. 48 00:04:04,420 --> 00:04:06,680 They, sorry, we can't do anything about this. 49 00:04:06,680 --> 00:04:09,820 And so, companies kind of feel obligated to take this on themselves. 50 00:04:09,820 --> 00:04:11,820 Uh, I, I'm just going to do it myself. 51 00:04:12,400 --> 00:04:20,020 Add to that, this, uh, new draft bill that, uh, Senator Tom Graves, uh, out of Georgia is preparing to present. 52 00:04:20,020 --> 00:04:25,240 It's called the Active Cyber Defense Certainty Act, the ACDC Act. 53 00:04:25,240 --> 00:04:26,420 I love the acronym. 54 00:04:27,320 --> 00:04:38,080 But, um, it's basically a bill that will allow those who have been hacked to be exempt from hacking laws when their aim is to attack their assailant. 55 00:04:38,120 --> 00:04:39,700 So this is kind of an interesting idea. 56 00:04:39,700 --> 00:04:43,020 If this was proposed, if this draft makes it through Congress. 57 00:04:43,620 --> 00:04:48,140 However, generally, like, first thought, this is a very, very bad idea, right? 58 00:04:48,140 --> 00:04:51,480 Like, this is a game you're not going to win in the end result. 59 00:04:51,920 --> 00:04:55,680 Uh, as a corporation , you're, it's first off, it's probably illegal. 60 00:04:55,680 --> 00:04:58,640 Even if that's made legal, it's still very iffy. 61 00:04:59,040 --> 00:05:07,580 Um, you, you gotta take into fact all the lost productivity while you send your best guys, rather than defending your network, you're now sending them to go attack. 62 00:05:07,720 --> 00:05:09,460 Um, not to mention the liability. 63 00:05:09,460 --> 00:05:17,120 What if they attack the wrong server or the attacks came from some other company and then that company realized they've been attacked by you, so they hacked back you, right? 64 00:05:17,120 --> 00:05:30,200 Like this escalation game, it's like the cyber, you know, the war games movie where all these guys are like hacking everybody else because one little guy, so basically I, I felt like that, that, uh, the AI's conclusion from that movie applies very well to this. 65 00:05:30,200 --> 00:05:33,800 It's probably the best strategy not to play this game at all. 66 00:05:34,340 --> 00:05:43,480 That being said, I do see a very useful or a very niche area where hacking back, it would be a good thing. 67 00:05:43,480 --> 00:05:47,400 And it wouldn't be a good thing in terms of revenge or taking the guys out. 68 00:05:47,540 --> 00:05:50,600 But you see, I work as a security researcher as my day job. 69 00:05:50,600 --> 00:05:56,040 So I try to track these, I try to track targeted attacks, I try to figure out who's behind this type of attack. 70 00:05:56,160 --> 00:06:13,520 And if I could figure out how the person acts that's behind the attack, what files they stole, who else they're targeting, like this kind of information, if I was to hack back and sit on their machine and, and observe, that kind of information is great for defenders because then I could tell you, 71 00:06:13,520 --> 00:06:17,260 these are the other tools they use, this is the industries they're targeting, this is the files they want. 72 00:06:17,260 --> 00:06:23,380 It's very useful in that sense, not so much in the sense of just striking back to get revenge. 73 00:06:23,820 --> 00:06:29,420 And to be honest, to be fair to the ACDC act, that's actually the verbiage it's trying to convey. 74 00:06:29,440 --> 00:06:45,520 Uh, the act itself clearly says that you cannot attack back for the purposes of causing physical or financial injury or to try to destroy data or, or machines that, you basically can't just try to break their machine, which is a good idea anyways because if you break their machine, 75 00:06:45,520 --> 00:06:48,260 they're probably just gonna show up somewhere else anyways. 76 00:06:48,800 --> 00:06:59,280 But instead, the act says you can, you can attack back for these purposes, um, is to establish attribution of the criminal activity and to monitor the behavior of an attacker. 77 00:06:59,620 --> 00:07:07,660 Also in the bill, it says you, you must, um, share with law enforcement that you plan to do this attack and how you plan to do this and gonna give them some details beforehand. 78 00:07:08,060 --> 00:07:18,080 Um, I don't know, I, anyways, I don't plan to spend forever talking about legal stuff and I know that's not why you came here either. 79 00:07:18,260 --> 00:07:26,580 But I just wanna, uh, so I'll end my rants now, but I just wanna kinda convey that what I'm about to discuss in the very near future could be legal. 80 00:07:26,580 --> 00:07:32,840 So this is maybe potential tools like it could be legal and this is showing it could be very plausible. 81 00:07:33,560 --> 00:07:37,880 So before I get into some things, I wanna make sure we got terminology clear. 82 00:07:37,880 --> 00:07:44,660 In some circles, I've seen the client and server names for rats reversed and that really bothers me. 83 00:07:44,820 --> 00:07:53,120 So the person who has the implant or the malware running is going to be the victim or the tar- I'm gonna call him the target. 84 00:07:53,120 --> 00:07:58,500 I'm gonna try and avoid victim and I'm gonna try and avoid client just because that one gets some people confused. 85 00:07:58,500 --> 00:08:04,260 And the reason I'm avoiding victim is because the attacker in the original scenario is gonna be our victim. 86 00:08:04,260 --> 00:08:07,460 So attacker, victim, probably terms I'm gonna try to stay away from. 87 00:08:07,700 --> 00:08:12,340 Um, and I'm introducing a new one that is the person who's tacking back, I will call the retaliator. 88 00:08:12,340 --> 00:08:17,960 I really like that term because the dictionary definition is one who returns assault in kind. 89 00:08:18,060 --> 00:08:22,900 Uh, we're gonna be hitting them with our own medicine here so I felt like retaliator is the right name for this. 90 00:08:24,420 --> 00:08:35,320 Um, a little while ago, one of my co- colleagues, he took all the recent APT reports, the sophisticated actor reports and he kinda summed it up into, uh, most popular tools. 91 00:08:35,320 --> 00:08:40,320 Uh, most reference tools out of those papers and he posted this on a Twitter feed. 92 00:08:40,340 --> 00:08:44,440 And I saw this list and I was like, uh, that is my shopping list. 93 00:08:44,440 --> 00:08:49,500 I'm gonna start at the top and just start working my way down, finding an exploit in each. 94 00:08:49,960 --> 00:08:58,060 And so if you'll notice, the top one is poison ivy and if any of you recall or are aware, there is already an exploit out there for poison ivy. 95 00:08:58,060 --> 00:09:02,340 Uh, the two individuals at the bottom of this slide developed that. 96 00:09:02,340 --> 00:09:06,080 I'm not gonna try to pronounce their names because I would not do well. 97 00:09:06,080 --> 00:09:12,440 Um, but uh, they developed a remote code execution vulnerability against the poison ivy C2 server. 98 00:09:13,080 --> 00:09:26,500 And interesting enough, after the Mandiant APT1 report, the malware LU guys noticed that that APT1 group was using the poison ivy server so they used this exploit to hack back into their infrastructure. 99 00:09:26,500 --> 00:09:29,100 But they documented the whole thing and published it. 100 00:09:29,100 --> 00:09:38,580 And this is one of the rare cases where we have of somebody doing a hack back for attribution or for monitoring purposes and it really shows how successful it can be. 101 00:09:38,640 --> 00:09:52,120 Um, this picture, the farthest picture on the right is a diagram that they show that they were giving, trying to show us how they built their, the attackers had their infrastructure set up, how they had some VMs and some proxies to try to protect things. 102 00:09:52,120 --> 00:09:57,900 They also were able to pull back some additional tools the attackers were using and they exposed them publicly. 103 00:09:58,000 --> 00:10:00,460 And it was, it's very insightful paper. 104 00:10:00,460 --> 00:10:03,460 Uh, they called it the APT1 technical backstage. 105 00:10:03,500 --> 00:10:05,900 Um, it came out I believe in 2013. 106 00:10:05,940 --> 00:10:07,640 It's been around for a little while now. 107 00:10:07,640 --> 00:10:13,620 It's a really good read but I think it's one of the rare cases where we can see how useful this type of uh, activity is. 108 00:10:14,140 --> 00:10:16,160 Another one on that list was dark comment. 109 00:10:16,160 --> 00:10:18,600 It also has public exploits. 110 00:10:18,600 --> 00:10:22,040 This is a blind file retrieval by these individuals. 111 00:10:22,080 --> 00:10:26,580 I don't have any, or I didn't find any public documentation of anybody using this publicly. 112 00:10:27,400 --> 00:10:30,260 But I just, I figured I'd mention it just for complete lists. 113 00:10:30,900 --> 00:10:33,940 And with that, we're gonna start playing with our new stuff. 114 00:10:34,180 --> 00:10:44,600 I'm gonna start, so I know I told you I started on my list and worked my way down, but I'm gonna work now when I present them from bottom up because I feel like it's uh, least interesting to most interesting in that order. 115 00:10:44,660 --> 00:10:50,280 So, fourth on the list, or the, the last one I looked at is called Extreme RAT. 116 00:10:50,360 --> 00:10:53,600 Um, anybody, how, who's familiar with Extreme RAT? 117 00:10:53,600 --> 00:10:54,340 Has seen it? 118 00:10:54,340 --> 00:10:55,140 Ran into it? 119 00:10:55,140 --> 00:10:56,220 Okay, okay. 120 00:10:56,240 --> 00:10:58,640 Yeah, it's not the most common APT tool kit. 121 00:10:58,640 --> 00:11:01,700 In fact, I wouldn't even really consider it an APT tool kit thing. 122 00:11:01,700 --> 00:11:04,400 It's actually, was a commercial product. 123 00:11:04,400 --> 00:11:08,100 This image here is of the CNC server component. 124 00:11:08,100 --> 00:11:15,260 I've got one victim and that drop down list, lists some of the features that the, the attacker can do to that victim. 125 00:11:15,620 --> 00:11:23,880 Uh, this tool was sold out there on the markets and uh, at some point the source code was leaked and, and the author just kind of quit selling it. 126 00:11:23,880 --> 00:11:27,260 So it's still out there, the source code's leaked out there and it's still kind of around. 127 00:11:27,260 --> 00:11:30,300 There's a lot of variants that base themselves now off that source code. 128 00:11:30,500 --> 00:11:38,800 Um, one of the, it, a lot of the features are very script kiddy-ish, like you can tell it targets script kiddy guys, like wannabe hackers. 129 00:11:38,980 --> 00:11:45,420 In fact, one of the features it has is you can play fat flash games in the app while you're waiting for somebody to click on your malware. 130 00:11:45,420 --> 00:11:54,740 It's like, if you're not very good, at least you can, you know, play some Candy Crush or Jewel Quest game while you wait because your phishing email sucks. 131 00:11:55,680 --> 00:12:02,740 But despite this, it's actually uh, been cited in numerous articles as part of targeted attacks. 132 00:12:02,740 --> 00:12:07,000 So, even sophisticated actors like using this tool. 133 00:12:07,000 --> 00:12:12,860 Um, it's been cited in attacks against the Israeli government, uh, in conflicts in Syria and the Gaza Strip. 134 00:12:12,860 --> 00:12:16,080 So, kind of hotbed areas do get hit by this guy. 135 00:12:16,460 --> 00:12:21,340 And the easiest way to identify this inside a network is it's uh, C2 communications. 136 00:12:21,680 --> 00:12:26,360 Most of the uh, targets we've seen, it either calls home one of two ways. 137 00:12:26,360 --> 00:12:30,780 Raw TCP or a fake HTTP message. 138 00:12:30,780 --> 00:12:39,200 The raw TCP is always start, start, starts out with the string, my version pipe and then the version, 3.6, 3.7, 3.8. 139 00:12:39,200 --> 00:12:40,740 Those are the, the most common. 140 00:12:40,800 --> 00:12:45,440 And the C2 server always responds with the character X followed by line feed carriage return. 141 00:12:45,440 --> 00:12:47,360 That's like super signatureable, right? 142 00:12:47,360 --> 00:12:50,400 Like, snore signatures already exist and such. 143 00:12:50,400 --> 00:12:52,260 It's, it's very easy to watch for that. 144 00:12:52,460 --> 00:13:00,680 Alternatively, if it does the HTTP requests, those always take the form of a get request slash some number dot functions. 145 00:13:00,740 --> 00:13:06,140 And that some number is the password that the script kitty uses when they first run the app. 146 00:13:06,140 --> 00:13:12,000 And the app makes sure that the password is up to ten characters, can't be longer than ten and they all have to be numeric. 147 00:13:12,080 --> 00:13:23,540 So, looking for any URL request for, you know, zero to nine or one to ten character numbers dot functions is gonna hit on this and most exclusively hit on this. 148 00:13:23,540 --> 00:13:26,600 I really doubt there's legitimate traffic going to that URL pattern. 149 00:13:27,540 --> 00:13:33,780 And so, this guy, like I said, their source code out there, it was in Delphi, so I really don't like to read Delphi. 150 00:13:33,780 --> 00:13:38,140 So I just kinda started reviewing some of the basic C2 comms. 151 00:13:38,140 --> 00:13:45,480 I, you know, I, I had myself a victim and I would do all the maneuvers to the victim and watch the C2 traffic go back and forth . 152 00:13:45,480 --> 00:13:55,520 And one thing I noticed that struck my eye was how the C2 server, um, pushes a file down to its victim. 153 00:13:55,520 --> 00:14:07,300 And what it'll do is it'll send a message to the target and say, hey, get ready to receive my file tool slash bad.exe and save it to your C drive temp as calc.exe. 154 00:14:07,480 --> 00:14:16,600 And then the target will respond back, okay, I'm ready to receive your tool named tool dot bad.exe and then the data is passed to the victim. 155 00:14:16,920 --> 00:14:24,760 And it made me think about this, why does the victim need to know at all where that file is stored on the server's hard drive? 156 00:14:24,840 --> 00:14:28,440 And I was like, well, maybe it does that because the server doesn't want to keep state. 157 00:14:28,440 --> 00:14:32,040 It doesn't want to keep the, in its memory, the fact that it made this request. 158 00:14:32,040 --> 00:14:35,820 Because all the data it really needs is in the response from the victim. 159 00:14:36,240 --> 00:14:39,800 So, turns out that the first packet is even necessary. 160 00:14:39,880 --> 00:14:50,080 As a victim, I can go to the extreme server and say, hey, I'm ready to receive your file, C drive slash whatever, duh, duh, duh, duh, and if that file exists, it gladly hands it to me. 161 00:14:55,680 --> 00:14:59,380 Yeah, it's kind of a blanket basic mistake. 162 00:14:59,400 --> 00:15:00,860 But what can I do with this? 163 00:15:00,860 --> 00:15:04,020 Unfortunately, I can't do a directory listing, so I have to know the file exists. 164 00:15:04,020 --> 00:15:08,900 I can do like brute force all the files, but there's better ideas than that. 165 00:15:08,920 --> 00:15:10,980 Um, I didn't take these, I didn't make these ideas up. 166 00:15:10,980 --> 00:15:13,040 This is um, from the link at the bottom. 167 00:15:13,100 --> 00:15:16,680 Blind file retrieval is an, is often a case pen testers get in. 168 00:15:16,680 --> 00:15:17,980 So they've thought about this a bit. 169 00:15:17,980 --> 00:15:20,280 And these are some things that they suggest pulling back. 170 00:15:20,280 --> 00:15:24,220 The first one is the winini file, because on any version of Windows, that file exists. 171 00:15:24,220 --> 00:15:25,400 So it's like a sanity check. 172 00:15:25,400 --> 00:15:27,220 If you can pull that file back, we're good. 173 00:15:27,420 --> 00:15:31,700 More so, if you can pull that file back, you might be able to tell what version of Windows they have. 174 00:15:31,700 --> 00:15:35,300 If you know what version of Windows they have, you know the path to the event logs. 175 00:15:35,300 --> 00:15:37,000 So we can start pulling event logs. 176 00:15:37,360 --> 00:15:40,780 If the event logs, there's usually a lot of good data in there. 177 00:15:40,780 --> 00:15:44,400 With fi- if applications crash, you know the path to the application. 178 00:15:44,760 --> 00:15:48,980 If a programming user runs crashes, you may know the pa- the user, username. 179 00:15:49,240 --> 00:15:54,320 So now if we know the username, we can start pulling files out of the user's home subdirectory, like the desktop.ini. 180 00:15:54,320 --> 00:15:58,040 Because that will tell us all the folders that person has, or files, on their desktop. 181 00:15:58,040 --> 00:16:02,640 And we can keep kind of iterating through their network, this, or, or their computer, finding out things like that. 182 00:16:03,260 --> 00:16:10,440 If it's running, if the attacker is running this program as administrator, then we can always pull the backup of the SAM database, and then we get their username and passwords. 183 00:16:10,640 --> 00:16:17,760 Maybe we can pull the backup of the registry, because the registry is going to have a whole lot of great information and things, more things that we can pull from their machine. 184 00:16:18,360 --> 00:16:21,000 These are just some ideas of the things you can do with that bug. 185 00:16:21,980 --> 00:16:24,160 And, uh, with that I'm going to move on to the next one. 186 00:16:24,160 --> 00:16:28,080 This one, uh, PlugX, CorePlug, or DeathStory. 187 00:16:28,080 --> 00:16:31,760 It's called DeathStory because somebody misspelled destroy in the source code. 188 00:16:31,920 --> 00:16:34,740 Um, but this is a, a, a more common tool. 189 00:16:34,740 --> 00:16:36,620 It's been around since 2008. 190 00:16:36,880 --> 00:16:43,480 Uh, the, the back window is the main tool, you see the CNC component, and the front window is the popup that you can get per victim. 191 00:16:43,480 --> 00:16:46,780 And each tab is a set of features you can do to a victim. 192 00:16:46,920 --> 00:16:52,640 This one is a little bit more, I don't know if I'll say professional, but it's a little bit more tailored. 193 00:16:52,940 --> 00:16:57,500 Um, I can tell the source code is passed around between groups. 194 00:16:57,500 --> 00:17:04,860 I see different variants of this out there, but the biggest changes I see in the variants is just the GUI and not so much the functions underneath. 195 00:17:04,860 --> 00:17:11,540 It's like every new hacker likes to like throw their own GUI on there and put their own QQID on there and claim that they wrote this. 196 00:17:11,540 --> 00:17:13,580 But it's all the same stuff under the hood. 197 00:17:14,060 --> 00:17:23,640 Uh, some of the cool features I've noticed though, uh, it has features for interacting with SQL databases, for directly hitting the registry, for capturing packets or doing network monitoring. 198 00:17:23,640 --> 00:17:26,120 So it's, it's a pretty feature rich RAP. 199 00:17:26,160 --> 00:17:29,620 And it's been cited in a lot of targeted attacks. 200 00:17:29,620 --> 00:17:35,140 Uh, most, uh, recently was one in February, the one that says, uh, oops, they did it again. 201 00:17:35,160 --> 00:17:37,800 Yeah, this tool has been around for quite some time. 202 00:17:37,800 --> 00:17:48,180 I can start naming places it's been used against Afghanistan and India, Mongolia, Jazakistan, Japan, Taiwan, Korea, Tibetan organizations and it just goes and goes and goes. 203 00:17:48,180 --> 00:17:50,000 This thing's been around for quite some time. 204 00:17:50,680 --> 00:17:54,380 This one I did not or I could not get a hold of the source code for. 205 00:17:54,380 --> 00:17:58,160 So I was gonna rely on dynamic analysis and, and fuzzing. 206 00:17:58,180 --> 00:18:04,460 And so I was building a fuzzer to try to fuzz the protocol, how the, the victim talks to the C2 server. 207 00:18:04,780 --> 00:18:08,700 And when I got my fuzzer up and running, this thing would fall over left and right. 208 00:18:08,700 --> 00:18:22,720 And I just had a hard enough time keeping the program running and getting, like, my, the list of bugs and the vulnerabilities and potential crashes that could be turned into exploits was so high that I got, kinda got overwhelmed with the fuzzing and decided just to go look at static analysis. 209 00:18:23,280 --> 00:18:30,900 And so I, I was looking at the code and one of the first areas I was looking at was when you receive a message from the victim, how does it handle it? 210 00:18:31,080 --> 00:18:32,640 And they handle it alright. 211 00:18:32,640 --> 00:18:41,960 When it receives a message from the victim, each message or packet as they call it, each message has a little header that's XOR encoded with their own little made up XOR scheme. 212 00:18:42,020 --> 00:18:50,500 And so they decode the message header and then they look that the message is small enough to sit, to fit on the stack buffer that they prepared for, right? 213 00:18:50,500 --> 00:18:52,260 That, that's a good security track. 214 00:18:52,260 --> 00:18:54,620 That, uh, 61, that F000. 215 00:18:54,620 --> 00:18:58,120 So it has to be smaller than 61K, which is a rather large message. 216 00:18:58,300 --> 00:19:01,360 If it doesn't fit, then it shows a pop up message. 217 00:19:01,900 --> 00:19:09,160 However, this code to check that the message will fit on the stack is down here in this decode packet function. 218 00:19:09,420 --> 00:19:10,740 Um, you can't see my mouse. 219 00:19:10,740 --> 00:19:14,360 It's on, it's on line 36. 220 00:19:14,680 --> 00:19:23,600 But you'll see up on line 29, it copies the packet to the stack and then later decides maybe I should have checked if it was gonna fit. 221 00:19:24,780 --> 00:19:30,720 And so I can, because it's on the stack, right, we can return, we can overwrite the return address. 222 00:19:30,720 --> 00:19:33,200 But the return address isn't hit until this function leaves. 223 00:19:33,200 --> 00:19:42,140 Which means, if I overflow this buffer, I'm gonna get control as soon as this function finishes, but before the function finishes, it pops up this pop up message. 224 00:19:42,140 --> 00:19:47,120 That very, very clearly tells the attacker what just happened, right? 225 00:19:47,360 --> 00:19:49,000 P, PED code packet. 226 00:19:49,000 --> 00:19:50,300 Come on, don't you understand? 227 00:19:50,300 --> 00:19:51,800 You just got exploited buddy. 228 00:19:52,380 --> 00:19:59,280 And the funny thing is, no matter what they do, if they click the X or they click the OK, it doesn't matter because I get code flow either way. 229 00:19:59,280 --> 00:20:02,120 They just have to acknowledge this in some sort of way. 230 00:20:02,460 --> 00:20:04,160 Now that's not cool, I agree. 231 00:20:04,340 --> 00:20:08,660 Um, but, uh, turns out that this message is like the de facto error. 232 00:20:08,660 --> 00:20:13,060 In fact, if you end map, uh, plug X server, it will show this message. 233 00:20:13,060 --> 00:20:17,520 It just doesn't, this is like, I don't know what happened message is really what this is trying to say. 234 00:20:18,120 --> 00:20:20,800 And so for this one I have a demo, real quick. 235 00:20:21,000 --> 00:20:22,640 Uh, I see my mouse. 236 00:20:22,640 --> 00:20:31,000 The right half of the screen is gonna represent, represent the attacker's computer and the left half of the screen represents the retaliator's computer. 237 00:20:31,240 --> 00:20:35,400 I'm gonna start up the, uh, plug X server. 238 00:20:36,720 --> 00:20:40,800 And then I will just point my, my Metasploit script at it. 239 00:20:40,800 --> 00:20:43,660 So I'll start up my plug X Metasploit script. 240 00:20:43,900 --> 00:20:50,460 Uh, because it's a VM I already know the IP address so I'm just gonna type in that IP address and set the attack at that, at that. 241 00:20:50,460 --> 00:20:52,960 We'll talk more about how to find out who to target later. 242 00:20:53,920 --> 00:20:57,700 Now, I'm gonna pause this real quick and, and have an aside. 243 00:20:57,940 --> 00:21:08,800 One of those papers or, or the articles I mentioned was a talk from Black Hat, uh, known as, uh, I Know You Wanna Unplug Me, where they talked about plug X RAT and talked about the, uh, that's not what I wanted to do. 244 00:21:09,860 --> 00:21:12,380 Alright, I'll just start this up while I talk some more. 245 00:21:12,520 --> 00:21:16,300 Um, and they talked about the different variants they observed. 246 00:21:16,300 --> 00:21:19,480 And they, in their terms they observed three types. 247 00:21:19,520 --> 00:21:21,720 Where basically they used three different XOR schemes. 248 00:21:21,720 --> 00:21:22,400 They changed. 249 00:21:22,400 --> 00:21:26,440 And so, I've written my module to be able to handle each type. 250 00:21:26,460 --> 00:21:29,860 But I can't know ahead of time what type you're targeting. 251 00:21:29,860 --> 00:21:37,400 So basically you, you run the check command and if it's not that right type, we'll change the type and run the check command again until you validate that you've got the right type. 252 00:21:37,480 --> 00:21:41,300 So you see, you see plug X type 1, type 1 old and type 2. 253 00:21:41,620 --> 00:21:42,940 So I run the check command. 254 00:21:42,940 --> 00:21:45,440 The check command says yep, you're good. 255 00:21:45,720 --> 00:21:47,260 So we'll hit exploit. 256 00:21:47,260 --> 00:21:49,340 It'll pass the attack against the server. 257 00:21:49,340 --> 00:21:51,420 There you see the pop up message over there. 258 00:21:51,680 --> 00:21:55,620 Uh, the attacker's like what the heck, kicked X or the victim now. 259 00:21:55,940 --> 00:21:58,640 And you see my interpreter session spinning up. 260 00:21:58,780 --> 00:22:00,560 I'm going to do a quick sys info. 261 00:22:01,060 --> 00:22:03,200 Yeah, I'll spawn a shell. 262 00:22:03,580 --> 00:22:07,200 And I think notepad, popping notepad, visually there it is. 263 00:22:14,740 --> 00:22:16,980 Alright, on to the last one. 264 00:22:16,980 --> 00:22:18,300 Uh, ghost rat. 265 00:22:18,300 --> 00:22:20,800 How many of you have seen or heard of ghost rat before? 266 00:22:21,040 --> 00:22:21,760 Yeah. 267 00:22:21,760 --> 00:22:22,820 Yeah, I like that hand. 268 00:22:22,820 --> 00:22:24,400 So that's, that's exactly what this guy is. 269 00:22:24,400 --> 00:22:27,020 Like, it is the one that's been around forever. 270 00:22:27,060 --> 00:22:28,580 Um, at least 10 years. 271 00:22:28,580 --> 00:22:31,700 It was really, originally written by a group that called themselves C. 272 00:22:31,700 --> 00:22:36,120 Rufus Security Team, also known as the Red Wolf Security Team. 273 00:22:36,340 --> 00:22:42,700 Uh, all, it's most often cited in tax, attacks that come out of uh, Asia region. 274 00:22:42,920 --> 00:22:48,880 Uh, this image is of the C2 cool toolkit and again you right click on a victim and there's your feature set. 275 00:22:48,920 --> 00:22:51,520 Kind of typical feature set, nothing fancy. 276 00:22:51,520 --> 00:22:56,940 Um, this is, this is almost in my opinion the uh, the measuring stick for rats, is ghost rat. 277 00:22:56,940 --> 00:22:59,460 Like they should at least be able to do what it, what it can do. 278 00:22:59,940 --> 00:23:03,880 And ghost rat, it has been cited in so many articles. 279 00:23:03,880 --> 00:23:05,180 So many articles. 280 00:23:05,460 --> 00:23:08,660 Um, these are just a few that I can fit on the screen there. 281 00:23:08,800 --> 00:23:13,860 Uh, most recently is the one down in the bottom left, which was just this year. 282 00:23:13,940 --> 00:23:17,260 Uh, ghost rat was being spread this eternal blue. 283 00:23:17,380 --> 00:23:19,480 So it's still very popular. 284 00:23:19,480 --> 00:23:22,740 I think the oldest one on there, I, I can't find the updates. 285 00:23:22,740 --> 00:23:24,760 But it's been around for at least 10 years. 286 00:23:25,300 --> 00:23:30,880 And again, it is uh, very easy to identify based on it's PCAP, based on it's uh, traffic. 287 00:23:31,040 --> 00:23:33,660 It has a signature 5 byte ghost pattern. 288 00:23:33,660 --> 00:23:40,860 The first 5 characters in, in each packet message from the victim to the C2 server or from the C2 server back to the victim. 289 00:23:41,440 --> 00:23:49,700 Now, the source code for ghost rat has been leaked online and so many people or many attackers chain, know that that ghost is like a big red flag. 290 00:23:49,700 --> 00:23:51,560 So they'll try to change it to something else. 291 00:23:51,560 --> 00:23:58,240 Uh, that second image is from a talk uh, Snora gave where he, these are different 5 byte characters he's seen that change to. 292 00:23:58,240 --> 00:24:05,980 They usually always only change the 5 bytes just because that's easiest and if you change it to something longer, it requires a lot of other changes in the code. 293 00:24:05,980 --> 00:24:15,060 But even still, it's very easy to identify this no matter what those 5 bytes are because it's always followed by another pattern of 2 integers and then a compressed buffer. 294 00:24:15,060 --> 00:24:18,760 So it's still very easy to identify no matter what the 5 byte character is. 295 00:24:19,220 --> 00:24:24,120 And like extreme rat, it was, it had a very similar logic bug. 296 00:24:24,120 --> 00:24:26,220 But this one is the other way around. 297 00:24:26,220 --> 00:24:36,680 When it's requesting a file from its victim, it will tell the victim, hey, give me your local file, you know, document user file dot doc so I can save it to this path. 298 00:24:36,880 --> 00:24:38,360 Like, well that's very nice. 299 00:24:38,360 --> 00:24:40,260 Here's the data, you can save it to that path. 300 00:24:40,260 --> 00:24:46,200 Oh, by the way, I also have the second file that I'd like you to save to your startup folder. 301 00:24:47,260 --> 00:24:51,220 And sure enough, if you know the path to their startup folder, it will put it right there. 302 00:24:51,400 --> 00:24:55,800 Now, the startup file folder changes in different versions of Windows. 303 00:24:55,800 --> 00:24:57,380 So that's not the most reliable way. 304 00:24:57,380 --> 00:25:01,200 If you can in map their machine and tell what version of Windows they have, then boom, you can do this. 305 00:25:01,200 --> 00:25:03,760 But, um, I had to find a better way. 306 00:25:04,260 --> 00:25:07,880 And sure enough, Ghost Rat has another very handy for me. 307 00:25:07,880 --> 00:25:10,920 It is, uh, vulnerable to a DLL side load attack. 308 00:25:10,980 --> 00:25:22,680 Meaning if I just drop a file named OLE D- DLG, uh, a dynamic library right in that same folder, the local folder, then it will try to load that file whenever Ghost starts up. 309 00:25:22,680 --> 00:25:28,440 And it's looking for only one function in that fol- in that, uh, DLL and that is OLE UI busy. 310 00:25:28,440 --> 00:25:31,500 It's basically a function that can ask, is the UI busy? 311 00:25:31,780 --> 00:25:34,700 And it expects to hear a 1 as a return from that. 312 00:25:34,700 --> 00:25:36,800 I don't know, a 1 means not busy. 313 00:25:36,800 --> 00:25:37,660 It's really confusing. 314 00:25:37,660 --> 00:25:48,900 But anyways, all you have to do is make a, you make your malware into a D- uh, DLL, have it export this 1 function that just returns 1 all the time and Ghost will be none the wiser. 315 00:25:48,900 --> 00:25:50,380 It doesn't break anything doing that. 316 00:25:50,560 --> 00:25:56,360 And the next time Ghost starts up, it'll load your malware and, or every time Ghost starts up, it'll load your malware. 317 00:25:56,560 --> 00:26:01,560 So that was cool, but it requires dropping something to disk and I, I wasn't done picking on Ghost yet. 318 00:26:02,000 --> 00:26:07,880 Cause Ghost, like I said, had the source code, so I started looking at the source code and right away this one stood out to me. 319 00:26:07,880 --> 00:26:10,480 It didn't, I mean I found it in like an hour or 2. 320 00:26:10,500 --> 00:26:15,380 It's basically, this is in the handling of the drive list as given from a victim. 321 00:26:15,380 --> 00:26:19,600 So when the victim says, oh I have drive C, D and E, it's, it's in a buffer, right? 322 00:26:19,600 --> 00:26:29,040 And you'll notice on that second line, it just assumes that the list, it takes the length as given from the victim rather than assuming the length is less than its buffer size. 323 00:26:29,040 --> 00:26:38,240 So if I pass it a list of drives that are longer than the usual max of 26, then I can overflow a buffer within this particular C class. 324 00:26:38,640 --> 00:26:49,400 So the buffer you're over, I'm overflowing is in line 45, the remote drive list, which means I can overwrite any one of those um, objects below inside the class. 325 00:26:49,540 --> 00:26:52,980 A lot of those objects below are other C classes. 326 00:26:53,040 --> 00:27:09,500 So I can overwrite the pointer to those C classes, then when a, when the actual code flow tries to call a function in one of those C classes, it's gonna end up calling a pointer to a pointer that I control that needs to point to another pointer that points to my code flow. 327 00:27:09,500 --> 00:27:13,300 So I basically have to set up a pointer to a pointer to a function that I want to run. 328 00:27:13,300 --> 00:27:14,980 Which is kind of messy. 329 00:27:15,080 --> 00:27:18,960 Uh, pointer to pointers aren't really the funnest things to use for exploitation. 330 00:27:19,940 --> 00:27:21,560 But um, they work. 331 00:27:21,640 --> 00:27:28,460 If I had an information disclosure or if that would give me the layout of memory, that would make pointer to pointer uh, code flow pretty easy. 332 00:27:28,460 --> 00:27:29,360 But I'm lazy. 333 00:27:29,360 --> 00:27:30,920 I didn't spend time looking for that. 334 00:27:30,920 --> 00:27:35,240 And I knew that I could just do a heap spray and have a really good chance of landing in my own heap. 335 00:27:35,240 --> 00:27:36,360 So that's what I did instead. 336 00:27:36,360 --> 00:27:37,820 I did the lazy man's approach. 337 00:27:37,900 --> 00:27:43,180 Um, after I released these modules, I would love to see somebody maybe who's more willing to do work than I am. 338 00:27:43,400 --> 00:27:47,420 Uh, make, make the exploit a little bit cleaner that way. 339 00:27:47,420 --> 00:27:49,720 But nonetheless, that's what I did. 340 00:27:49,960 --> 00:27:54,660 Um, depth would break this approach, but depth seems to break the, the executable. 341 00:27:54,660 --> 00:28:00,900 Wh- whenever I'd run ghost rat on a machine that forced depth execution or if I opted in, ghost would just crash. 342 00:28:00,900 --> 00:28:01,920 It wouldn't even run. 343 00:28:01,920 --> 00:28:04,340 So, didn't need to really worry about depth. 344 00:28:04,340 --> 00:28:07,760 That could probably be changed, but it wasn't a problem for me. 345 00:28:08,260 --> 00:28:16,780 Now before I go on to show that uh, demo there of the video, I wanted to talk about uh, something that uh, another researcher called Kevin the Hermit has done, or Kev the Hermit. 346 00:28:16,780 --> 00:28:19,340 Um, he has written a number of decoders. 347 00:28:19,340 --> 00:28:32,840 So if you're given a piece of malware from any one of the, the, these families, with the exception of PlugX, you can run the script on it and it'll extract from that piece of malware, the C2 address that it was spent, meant to call home to, along with some other configuration data. 348 00:28:32,960 --> 00:28:43,820 So if you're the victim of one of these attacks and you find this file, you can pass it to a script, find the address of the C2 server and then we can use Metasploit to attack that C2 server. 349 00:28:44,260 --> 00:28:57,960 But uh, if you're too imp- so if you're too impatient to wait for yourself to be attacked, you could always search virus total for, you know, these files or just do a quick search for ghost, you know, rat uh, samples and find quite a few. 350 00:28:57,960 --> 00:28:59,980 Some may be old, some might not. 351 00:29:00,000 --> 00:29:09,220 Or, Shodan was very nice recently and added a malware hunter feature that looks for C2 servers and one of the C2 servers that they look for is ghosts. 352 00:29:09,460 --> 00:29:14,300 So we could just do a quick shopping list off of Shodan and, and have some fun. 353 00:29:15,740 --> 00:29:24,380 Um, again, this demo is same setup, attacker or, or adversary on the right, uh, retaliator on the left. 354 00:29:24,500 --> 00:29:41,360 Um, and this one I'm gonna do just slightly different in that I'm gonna build a malware sample from the ghost rat tool and I'm gonna pass that malware sample to the retaliator and then using that script that uh, KevTheHermit wrote, extract the C2 info and then use that to attack back. 355 00:29:41,760 --> 00:29:45,660 So I made the sample and then I wasn't thinking and I closed ghost rat. 356 00:29:45,660 --> 00:29:47,000 Oops, I pressed a button. 357 00:29:48,920 --> 00:29:51,100 Alright, sorry to make you watch it again. 358 00:29:51,480 --> 00:29:55,720 Yeah, so I make the sample and then I'm gonna just drag it out of the VM. 359 00:29:55,740 --> 00:30:02,880 Uh, in a usual case, right, it'll arrive via an email or a watery hole attack but I'm not gonna go through all that. 360 00:30:02,880 --> 00:30:04,260 We all know how those work. 361 00:30:04,680 --> 00:30:11,560 So I just drag the file out of the VM and then I'm gonna run the rat decoder script on that sample. 362 00:30:13,040 --> 00:30:14,820 If I can type fast. 363 00:30:16,200 --> 00:30:17,300 There it is. 364 00:30:17,300 --> 00:30:22,520 Um, and you can see there the C2 address and the port that, that, that it's looking to go to. 365 00:30:22,520 --> 00:30:36,180 I realized my mistake, started back up the ghost rat server and on the left I'm starting up Metasploit and then I'm gonna load my module, um, set the remote address to the remote address that we extracted from the malware itself. 366 00:30:48,370 --> 00:30:51,290 Uh, just quick info showing what's available. 367 00:30:51,290 --> 00:30:53,610 I don't wanna click pause, I'll try, I'll try. 368 00:30:53,610 --> 00:30:54,830 No I won't, I don't dare. 369 00:30:54,830 --> 00:31:03,550 So if you find a C2 server that doesn't use the ghost magic, you can just set the magic to be, match whatever the ghost, the, the server is. 370 00:31:04,110 --> 00:31:05,650 And I throw my exploit. 371 00:31:05,830 --> 00:31:10,870 Now it's gonna take just a minute because I'm spraying the heap so I'm spending a lot of data, sending a lot of data over. 372 00:31:10,870 --> 00:31:14,630 But there we see the, uh, stage, uh, interpreter session starting. 373 00:31:15,170 --> 00:31:18,230 Uh, I'm going to do the same set of commands. 374 00:31:18,230 --> 00:31:26,670 I'm gonna, as soon as it comes back, uh, do the sysinfo, spawn a shell , and this time I think I'll pop calc just to be different. 375 00:31:27,390 --> 00:31:28,110 Yes. 376 00:31:28,110 --> 00:31:28,730 There she is. 377 00:31:28,790 --> 00:31:30,310 On a Windows 10 machine. 378 00:31:35,860 --> 00:31:38,340 So that begs the question, then what? 379 00:31:38,340 --> 00:31:39,580 What do we do now? 380 00:31:39,940 --> 00:31:42,780 To be honest, I'm not quite sure. 381 00:31:43,160 --> 00:31:47,660 This is an area that hasn't really been discussed, at least publicly. 382 00:31:48,300 --> 00:31:52,180 But here's what I would suggest maybe. 383 00:31:52,180 --> 00:31:54,800 And maybe these are bad ideas, I'm not sure. 384 00:31:55,120 --> 00:31:57,020 Um, somebody else should, could decide. 385 00:31:57,020 --> 00:31:57,520 I don't know. 386 00:31:57,520 --> 00:32:01,400 But, uh, one of the first things I would be interested in doing would be netstat. 387 00:32:01,440 --> 00:32:05,020 Because netstat would tell you all other connections to that box. 388 00:32:05,020 --> 00:32:10,380 If there are other victims behind, beside yourself, they would be, they would show up in this netstat listing. 389 00:32:10,380 --> 00:32:12,300 So you could find out who else was targeted. 390 00:32:12,800 --> 00:32:18,060 Um, every one of these C2 tools has a folder for the files that have been downloaded from victims. 391 00:32:18,060 --> 00:32:19,480 And I would look at that. 392 00:32:19,480 --> 00:32:21,800 I would see what files had they pulled from other victims. 393 00:32:21,800 --> 00:32:23,080 What were they interested in? 394 00:32:23,080 --> 00:32:24,540 What did they pull from you? 395 00:32:25,540 --> 00:32:31,640 Um, also, maybe you would want to install some sort of persistence so you can stick around longer. 396 00:32:31,640 --> 00:32:34,260 Maybe you'd want to install a keylogger to see what else they're up to. 397 00:32:34,260 --> 00:32:39,240 If they're dumb enough to log into Facebook from their, uh, ops machine, who knows? 398 00:32:39,780 --> 00:32:42,120 A lot of different things that are optional to do. 399 00:32:42,120 --> 00:32:49,060 But whatever you do, I highly suggest you don't go the revenge route, but you sit quiet and you listen. 400 00:32:49,300 --> 00:32:52,560 Because I feel like that's where the most value in these are, right? 401 00:32:52,560 --> 00:32:58,580 The more you observe about your adversary, the, the more likely you are to, to win in the long run. 402 00:32:59,640 --> 00:33:01,780 So with that, that's about all I had. 403 00:33:01,780 --> 00:33:04,620 I appreciate you guys coming and, and spending the time here. 404 00:33:04,720 --> 00:33:06,920 This URL and, thank you. 405 00:33:15,280 --> 00:33:16,140 Thank you. 406 00:33:16,140 --> 00:33:22,440 That URL is where I currently have a fork of the Metasploit until I can get them, um, pulled up into the main branch. 407 00:33:22,560 --> 00:33:26,800 And it depends on how well I am at, at, uh, meeting all the check marks before that'll happen. 408 00:33:26,800 --> 00:33:28,760 So you can grab it there until they're released. 409 00:33:28,760 --> 00:33:29,860 Again, thanks anyways.