So, like the title suggests, we're going to be exploiting some CNC servers today, or at
least exploiting some CNC toolkits. Before I get right into that though, these are, at least
best to my knowledge, new exploits. And at the end of this, I will be releasing the
Metasploit modules for these exploits. Before I get there though, I just, I don't want the
focus to be so much about these exploits. I mean, I think they're cool, they're remote code
execution. But the take away should be, if you're a vulnerability researcher, like this
field of looking at CNC servers for exploits, is a right field. There's low laying fruit
everywhere and I really don't feel like people are, or a lot of researchers are looking at it,
or if they're looking at it, they're very, they're using them just for themselves and not
really sharing. So, um, key take away is this is, this is a really interesting field and I
highly recommend anybody who's into vulnerability research to jump into it. So, before I get
started on the exploits, I'm going to do a little bit of background. I'm going to talk a
little bit about some legal stuff, but then we'll, then we'll get into the exploits. Um, so
background on me a little bit. I've been in this computer, computer security community for
over 10 years. I currently work at, uh, Symantec as a threat researcher. Before that, I
worked for the, uh, DOD doing COE, C&E, C&O, C&A. Um, and I've had done some time in the
trenches as well. I was an IT administrator before that, so I know what it's like down in
the field. I feel like I kind of have a good round understanding of, uh, this particular
area. With all that being said, the disclaimer should come as no surprise to anybody. Um,
everything I'm about to say up here does not represent any of the opinions, uh, or my
opinions do not represent the views of my current or former employers. Make that clear. Um,
what I'm going to discuss is probably illegal, so what you do with it is up to you. If you do
cool stuff with it, I'd love to hear about it, but what you do, it's your own risk. Cool? We
got that covered. Alright, so, let me talk about what really led me into this field. And
that's one thing that bothers me about the security community, the security defense
industry, is that there's this defeatist attitude out there, right? Like, no matter how hard
we try, we're gonna lose. And if you went into, like, a basketball game with that kind of
attitude, like, it's not gonna work. But somehow we expect that it's okay for the security
community, right? Like, I hear this sophisticated actor term passed around all the time as if
it's some kind of excuse why a company got hacked. And I don't, I don't really understand
what they're trying to convey by using that term. If, if I, I try to picture, like, that
conversation with the sea levels when you're trying to explain what just happened, uh, sir,
we've been hacked. What, what, how did, how did they get in? Oh, well, they were
sophisticated. Like, how do you know they were sophisticated? Well, they were wearing a
monocle, so they're clearly a sophisticated actor. You know, like, what, what does
sophisticated mean in this context? Whatever it means, I don't think it means what they're
even trying to persuade it means, right? I think they're trying to persuade, or, or, to
convey, excuse me, that it means that this attacker was so far beyond what we can just,
defenders can do that we just can't win. And so that's what I set out with this to say. I
was like, well, I'm going to take a look at the tools that these sophisticated actors are
using and let's just see if we're, if they're vulnerable to attacks, if somebody was to
attack them back. And so that's where I went with this. Now, Hacking Pack has been a very
hot topic over the years, right? Five years ago, at Black Hat, they did an anonymous
survey asking people if they've participated in hacking back in some form. And
anonymously, over a third of the people surveyed admitted to it. Uh, a lot of times, when
a company's hacked, they want justice, they want revenge, they want that person to pay for
what they've done. So they'll go to law enforcement and law enforcement has their hands
tied, or can't do anything, or has no recourse. They, sorry, we can't do anything about
this. And so, companies kind of feel obligated to take this on themselves. Uh, I, I'm
just going to do it myself. Add to that, this, uh, new draft bill that, uh, Senator Tom
Graves, uh, out of Georgia is preparing to present. It's called the Active Cyber Defense
Certainty Act, the ACDC Act. I love the acronym. But, um, it's basically a bill that will allow
those who have been hacked to be exempt from hacking laws when their aim is to attack their
assailant. So this is kind of an interesting idea. If this was proposed, if this draft makes
it through Congress. However, generally, like, first thought, this is a very, very bad
idea, right? Like, this is a game you're not going to win in the end result. Uh, as a
corporation, you're, it's first off, it's probably illegal. Even if that's made legal, it's
still very iffy. Um, you, you gotta take into fact all the lost productivity while you send
your best guys, rather than defending your network, you're now sending them to go attack.
Um, not to mention the liability. What if they attack the wrong server or the attacks came
from some other company and then that company realized they've been attacked by you, so
they hacked back you, right? Like this escalation game, it's like the cyber, you know, the
war games movie where all these guys are like hacking everybody else because one little
guy, so basically I, I felt like that, that, uh, the AI's conclusion from that movie applies
very well to this. It's probably the best strategy not to play this game at all. That being
said, I do see a very useful or a very niche area where hacking back, it would be a good
thing. And it wouldn't be a good thing in terms of revenge or taking the guys out. But you
see, I work as a security researcher as my day job. So I try to track these, I try to track
targeted attacks, I try to figure out who's behind this type of attack. And if I could
figure out how the person acts that's behind the attack, what files they stole, who else
they're targeting, like this kind of information, if I was to hack back and sit on their
machine and, and observe, that kind of information is great for defenders because then I
could tell you, these are the other tools they use, this is the industries they're
targeting, this is the files they want. It's very useful in that sense, not so much in the
sense of just striking back to get revenge. And to be honest, to be fair to the ACDC act,
that's actually the verbiage it's trying to convey. Uh, the act itself clearly says that you
cannot attack back for the purposes of causing physical or financial injury or to try to
destroy data or, or machines that, you basically can't just try to break their machine,
which is a good idea anyways because if you break their machine, they're probably just
gonna show up somewhere else anyways. But instead, the act says you can, you can attack
back for these purposes, um, is to establish attribution of the criminal activity and to
monitor the behavior of an attacker. Also in the bill, it says you, you must, um, share with
law enforcement that you plan to do this attack and how you plan to do this and gonna give
them some details beforehand. Um, I don't know, I, anyways, I don't plan to spend forever
talking about legal stuff and I know that's not why you came here either. But I just wanna,
uh, so I'll end my rants now, but I just wanna kinda convey that what I'm about to discuss in
the very near future could be legal. So this is maybe potential tools like it could be
legal and this is showing it could be very plausible. So before I get into some things, I
wanna make sure we got terminology clear. In some circles, I've seen the client and server
names for rats reversed and that really bothers me. So the person who has the implant or the
malware running is going to be the victim or the tar- I'm gonna call him the target. I'm
gonna try and avoid victim and I'm gonna try and avoid client just because that one gets some
people confused. And the reason I'm avoiding victim is because the attacker in the original
scenario is gonna be our victim. So attacker, victim, probably terms I'm gonna try to stay
away from. Um, and I'm introducing a new one that is the person who's tacking back, I will
call the retaliator. I really like that term because the dictionary definition is one who
returns assault in kind. Uh, we're gonna be hitting them with our own medicine here so I
felt like retaliator is the right name for this. Um, a little while ago, one of my co-
colleagues, he took all the recent APT reports, the sophisticated actor reports and he kinda
summed it up into, uh, most popular tools. Uh, most reference tools out of those papers and
he posted this on a Twitter feed. And I saw this list and I was like, uh, that is my shopping
list. I'm gonna start at the top and just start working my way down, finding an exploit in
each. And so if you'll notice, the top one is poison ivy and if any of you recall or are
aware, there is already an exploit out there for poison ivy. Uh, the two individuals at the
bottom of this slide developed that. I'm not gonna try to pronounce their names because I
would not do well. Um, but uh, they developed a remote code execution vulnerability against
the poison ivy C2 server. And interesting enough, after the Mandiant APT1 report, the malware
LU guys noticed that that APT1 group was using the poison ivy server so they used this
exploit to hack back into their infrastructure. But they documented the whole thing and
published it. And this is one of the rare cases where we have of somebody doing a hack back for
attribution or for monitoring purposes and it really shows how successful it can be. Um,
this picture, the farthest picture on the right is a diagram that they show that they were
giving, trying to show us how they built their, the attackers had their infrastructure set
up, how they had some VMs and some proxies to try to protect things. They also were able to
pull back some additional tools the attackers were using and they exposed them publicly. And
it was, it's very insightful paper. Uh, they called it the APT1 technical backstage. Um, it
came out I believe in 2013. It's been around for a little while now. It's a really good read
but I think it's one of the rare cases where we can see how useful this type of uh, activity
is. Another one on that list was dark comment. It also has public exploits. This is a blind
file retrieval by these individuals. I don't have any, or I didn't find any public
documentation of anybody using this publicly. But I just, I figured I'd mention it just for
complete lists. And with that, we're gonna start playing with our new stuff. I'm gonna
start, so I know I told you I started on my list and worked my way down, but I'm gonna work
now when I present them from bottom up because I feel like it's uh, least interesting to
most interesting in that order. So, fourth on the list, or the, the last one I looked at is
called Extreme RAT. Um, anybody, how, who's familiar with Extreme RAT? Has seen it? Ran
into it? Okay, okay. Yeah, it's not the most common APT tool kit. In fact, I wouldn't even
really consider it an APT tool kit thing. It's actually, was a commercial product. This
image here is of the CNC server component. I've got one victim and that drop down list,
lists some of the features that the, the attacker can do to that victim. Uh, this tool was
sold out there on the markets and uh, at some point the source code was leaked and, and the
author just kind of quit selling it. So it's still out there, the source code's leaked out
there and it's still kind of around. There's a lot of variants that base themselves now off
that source code. Um, one of the, it, a lot of the features are very script kiddy-ish, like
you can tell it targets script kiddy guys, like wannabe hackers. In fact, one of the features
it has is you can play fat flash games in the app while you're waiting for somebody to click
on your malware. It's like, if you're not very good, at least you can, you know, play some
Candy Crush or Jewel Quest game while you wait because your phishing email sucks. But
despite this, it's actually uh, been cited in numerous articles as part of targeted
attacks. So, even sophisticated actors like using this tool. Um, it's been cited in attacks
against the Israeli government, uh, in conflicts in Syria and the Gaza Strip. So, kind of
hotbed areas do get hit by this guy. And the easiest way to identify this inside a network is
it's uh, C2 communications. Most of the uh, targets we've seen, it either calls home one of
two ways. Raw TCP or a fake HTTP message. The raw TCP is always start, start, starts out
with the string, my version pipe and then the version, 3.6, 3.7, 3.8. Those are the, the most
common. And the C2 server always responds with the character X followed by line feed
carriage return. That's like super signatureable, right? Like, snore signatures already exist
and such. It's, it's very easy to watch for that. Alternatively, if it does the HTTP requests,
those always take the form of a get request slash some number dot functions. And that some
number is the password that the script kitty uses when they first run the app. And the app
makes sure that the password is up to ten characters, can't be longer than ten and they all
have to be numeric. So, looking for any URL request for, you know, zero to nine or one to
ten character numbers dot functions is gonna hit on this and most exclusively hit on this. I
really doubt there's legitimate traffic going to that URL pattern. And so, this guy, like I
said, their source code out there, it was in Delphi, so I really don't like to read Delphi. So
I just kinda started reviewing some of the basic C2 comms. I, you know, I, I had myself a
victim and I would do all the maneuvers to the victim and watch the C2 traffic go back and
forth. And one thing I noticed that struck my eye was how the C2 server, um, pushes a file down
to its victim. And what it'll do is it'll send a message to the target and say, hey, get ready
to receive my file tool slash bad.exe and save it to your C drive temp as calc.exe. And then
the target will respond back, okay, I'm ready to receive your tool named tool dot bad.exe and
then the data is passed to the victim. And it made me think about this, why does the victim
need to know at all where that file is stored on the server's hard drive? And I was like,
well, maybe it does that because the server doesn't want to keep state. It doesn't want to
keep the, in its memory, the fact that it made this request. Because all the data it really
needs is in the response from the victim. So, turns out that the first packet is even
necessary. As a victim, I can go to the extreme server and say, hey, I'm ready to receive your
file, C drive slash whatever, duh, duh, duh, duh, and if that file exists, it gladly hands it
to me. Yeah, it's kind of a blanket basic mistake. But what can I do with this?
Unfortunately, I can't do a directory listing, so I have to know the file exists. I can do
like brute force all the files, but there's better ideas than that. Um, I didn't take
these, I didn't make these ideas up. This is um, from the link at the bottom. Blind file
retrieval is an, is often a case pen testers get in. So they've thought about this a bit. And
these are some things that they suggest pulling back. The first one is the winini file,
because on any version of Windows, that file exists. So it's like a sanity check. If you can
pull that file back, we're good. More so, if you can pull that file back, you might be able to
tell what version of Windows they have. If you know what version of Windows they have, you
know the path to the event logs. So we can start pulling event logs. If the event logs,
there's usually a lot of good data in there. With fi- if applications crash, you know the
path to the application. If a programming user runs crashes, you may know the pa- the
user, username. So now if we know the username, we can start pulling files out of the
user's home subdirectory, like the desktop.ini. Because that will tell us all the folders
that person has, or files, on their desktop. And we can keep kind of iterating through their
network, this, or, or their computer, finding out things like that. If it's running, if the
attacker is running this program as administrator, then we can always pull the backup of the
SAM database, and then we get their username and passwords. Maybe we can pull the backup of
the registry, because the registry is going to have a whole lot of great information and
things, more things that we can pull from their machine. These are just some ideas of the
things you can do with that bug. And, uh, with that I'm going to move on to the next one.
This one, uh, PlugX, CorePlug, or DeathStory. It's called DeathStory because somebody
misspelled destroy in the source code. Um, but this is a, a, a more common tool. It's been
around since 2008. Uh, the, the back window is the main tool, you see the CNC component, and
the front window is the popup that you can get per victim. And each tab is a set of features
you can do to a victim. This one is a little bit more, I don't know if I'll say
professional, but it's a little bit more tailored. Um, I can tell the source code is
passed around between groups. I see different variants of this out there, but the biggest
changes I see in the variants is just the GUI and not so much the functions underneath. It's
like every new hacker likes to like throw their own GUI on there and put their own QQID on
there and claim that they wrote this. But it's all the same stuff under the hood. Uh, some of
the cool features I've noticed though, uh, it has features for interacting with SQL
databases, for directly hitting the registry, for capturing packets or doing network
monitoring. So it's, it's a pretty feature rich RAP. And it's been cited in a lot of targeted
attacks. Uh, most, uh, recently was one in February, the one that says, uh, oops, they did
it again. Yeah, this tool has been around for quite some time. I can start naming places it's
been used against Afghanistan and India, Mongolia, Jazakistan, Japan, Taiwan, Korea,
Tibetan organizations and it just goes and goes and goes. This thing's been around for quite
some time. This one I did not or I could not get a hold of the source code for. So I was
gonna rely on dynamic analysis and, and fuzzing. And so I was building a fuzzer to try to
fuzz the protocol, how the, the victim talks to the C2 server. And when I got my fuzzer up
and running, this thing would fall over left and right. And I just had a hard enough time
keeping the program running and getting, like, my, the list of bugs and the vulnerabilities
and potential crashes that could be turned into exploits was so high that I got, kinda got
overwhelmed with the fuzzing and decided just to go look at static analysis. And so I, I was
looking at the code and one of the first areas I was looking at was when you receive a
message from the victim, how does it handle it? And they handle it alright. When it receives a
message from the victim, each message or packet as they call it, each message has a little
header that's XOR encoded with their own little made up XOR scheme. And so they decode the
message header and then they look that the message is small enough to sit, to fit on the
stack buffer that they prepared for, right? That, that's a good security track. That, uh,
61, that F000. So it has to be smaller than 61K, which is a rather large message. If it
doesn't fit, then it shows a pop up message. However, this code to check that the message
will fit on the stack is down here in this decode packet function. Um, you can't see my
mouse. It's on, it's on line 36. But you'll see up on line 29, it copies the packet to the
stack and then later decides maybe I should have checked if it was gonna fit. And so I can,
because it's on the stack, right, we can return, we can overwrite the return address. But the
return address isn't hit until this function leaves. Which means, if I overflow this
buffer, I'm gonna get control as soon as this function finishes, but before the function
finishes, it pops up this pop up message. That very, very clearly tells the attacker what just
happened, right? P, PED code packet. Come on, don't you understand? You just got exploited
buddy. And the funny thing is, no matter what they do, if they click the X or they click the
OK, it doesn't matter because I get code flow either way. They just have to acknowledge this
in some sort of way. Now that's not cool, I agree. Um, but, uh, turns out that this message
is like the de facto error. In fact, if you end map, uh, plug X server, it will show this
message. It just doesn't, this is like, I don't know what happened message is really what
this is trying to say. And so for this one I have a demo, real quick. Uh, I see my mouse. The
right half of the screen is gonna represent, represent the attacker's computer and the left
half of the screen represents the retaliator's computer. I'm gonna start up the, uh, plug X
server. And then I will just point my, my Metasploit script at it. So I'll start up my
plug X Metasploit script. Uh, because it's a VM I already know the IP address so I'm just
gonna type in that IP address and set the attack at that, at that. We'll talk more about how
to find out who to target later. Now, I'm gonna pause this real quick and, and have an
aside. One of those papers or, or the articles I mentioned was a talk from Black Hat, uh,
known as, uh, I Know You Wanna Unplug Me, where they talked about plug X RAT and talked
about the, uh, that's not what I wanted to do. Alright, I'll just start this up while I
talk some more. Um, and they talked about the different variants they observed. And they, in
their terms they observed three types. Where basically they used three different XOR schemes.
They changed. And so, I've written my module to be able to handle each type. But I can't
know ahead of time what type you're targeting. So basically you, you run the check command
and if it's not that right type, we'll change the type and run the check command again until
you validate that you've got the right type. So you see, you see plug X type 1, type 1 old
and type 2. So I run the check command. The check command says yep, you're good. So we'll
hit exploit. It'll pass the attack against the server. There you see the pop up message over
there. Uh, the attacker's like what the heck, kicked X or the victim now. And you see my
interpreter session spinning up. I'm going to do a quick sys info. Yeah, I'll spawn a shell. And
I think notepad, popping notepad, visually there it is. Alright, on to the last one. Uh,
ghost rat. How many of you have seen or heard of ghost rat before? Yeah. Yeah, I like that
hand. So that's, that's exactly what this guy is. Like, it is the one that's been around
forever. Um, at least 10 years. It was really, originally written by a group that called
themselves C. Rufus Security Team, also known as the Red Wolf Security Team. Uh, all, it's
most often cited in tax, attacks that come out of uh, Asia region. Uh, this image is of the C2
cool toolkit and again you right click on a victim and there's your feature set. Kind of
typical feature set, nothing fancy. Um, this is, this is almost in my opinion the uh, the
measuring stick for rats, is ghost rat. Like they should at least be able to do what it, what
it can do. And ghost rat, it has been cited in so many articles. So many articles. Um, these
are just a few that I can fit on the screen there. Uh, most recently is the one down in the
bottom left, which was just this year. Uh, ghost rat was being spread this eternal blue. So
it's still very popular. I think the oldest one on there, I, I can't find the updates. But
it's been around for at least 10 years. And again, it is uh, very easy to identify based on
it's PCAP, based on it's uh, traffic. It has a signature 5 byte ghost pattern. The first 5
characters in, in each packet message from the victim to the C2 server or from the C2 server
back to the victim. Now, the source code for ghost rat has been leaked online and so many
people or many attackers chain, know that that ghost is like a big red flag. So they'll try to
change it to something else. Uh, that second image is from a talk uh, Snora gave where he,
these are different 5 byte characters he's seen that change to. They usually always only
change the 5 bytes just because that's easiest and if you change it to something longer, it
requires a lot of other changes in the code. But even still, it's very easy to identify this
no matter what those 5 bytes are because it's always followed by another pattern of 2
integers and then a compressed buffer. So it's still very easy to identify no matter what the
5 byte character is. And like extreme rat, it was, it had a very similar logic bug. But this
one is the other way around. When it's requesting a file from its victim, it will tell the
victim, hey, give me your local file, you know, document user file dot doc so I can save it to
this path. Like, well that's very nice. Here's the data, you can save it to that path. Oh, by
the way, I also have the second file that I'd like you to save to your startup folder.
And sure enough, if you know the path to their startup folder, it will put it right there. Now,
the startup file folder changes in different versions of Windows. So that's not the most
reliable way. If you can in map their machine and tell what version of Windows they have, then
boom, you can do this. But, um, I had to find a better way. And sure enough, Ghost Rat has
another very handy for me. It is, uh, vulnerable to a DLL side load attack. Meaning if I just
drop a file named OLE D- DLG, uh, a dynamic library right in that same folder, the local
folder, then it will try to load that file whenever Ghost starts up. And it's looking for
only one function in that fol- in that, uh, DLL and that is OLE UI busy. It's basically a
function that can ask, is the UI busy? And it expects to hear a 1 as a return from that. I
don't know, a 1 means not busy. It's really confusing. But anyways, all you have to do is
make a, you make your malware into a D- uh, DLL, have it export this 1 function that just
returns 1 all the time and Ghost will be none the wiser. It doesn't break anything doing that.
And the next time Ghost starts up, it'll load your malware and, or every time Ghost starts
up, it'll load your malware. So that was cool, but it requires dropping something to disk and
I, I wasn't done picking on Ghost yet. Cause Ghost, like I said, had the source code, so I
started looking at the source code and right away this one stood out to me. It didn't, I
mean I found it in like an hour or 2. It's basically, this is in the handling of the drive
list as given from a victim. So when the victim says, oh I have drive C, D and E, it's, it's
in a buffer, right? And you'll notice on that second line, it just assumes that the list, it
takes the length as given from the victim rather than assuming the length is less than its
buffer size. So if I pass it a list of drives that are longer than the usual max of 26, then I
can overflow a buffer within this particular C class. So the buffer you're over, I'm
overflowing is in line 45, the remote drive list, which means I can overwrite any one of those
um, objects below inside the class. A lot of those objects below are other C classes. So I can
overwrite the pointer to those C classes, then when a, when the actual code flow tries to
call a function in one of those C classes, it's gonna end up calling a pointer to a pointer
that I control that needs to point to another pointer that points to my code flow. So I
basically have to set up a pointer to a pointer to a function that I want to run. Which is
kind of messy. Uh, pointer to pointers aren't really the funnest things to use for
exploitation. But um, they work. If I had an information disclosure or if that would give me
the layout of memory, that would make pointer to pointer uh, code flow pretty easy. But I'm
lazy. I didn't spend time looking for that. And I knew that I could just do a heap spray and
have a really good chance of landing in my own heap. So that's what I did instead. I did the
lazy man's approach. Um, after I released these modules, I would love to see somebody maybe
who's more willing to do work than I am. Uh, make, make the exploit a little bit cleaner
that way. But nonetheless, that's what I did. Um, depth would break this approach, but depth
seems to break the, the executable. Wh- whenever I'd run ghost rat on a machine that forced
depth execution or if I opted in, ghost would just crash. It wouldn't even run. So, didn't
need to really worry about depth. That could probably be changed, but it wasn't a problem for
me. Now before I go on to show that uh, demo there of the video, I wanted to talk about
uh, something that uh, another researcher called Kevin the Hermit has done, or Kev the
Hermit. Um, he has written a number of decoders. So if you're given a piece of malware from
any one of the, the, these families, with the exception of PlugX, you can run the script on it
and it'll extract from that piece of malware, the C2 address that it was spent, meant to call
home to, along with some other configuration data. So if you're the victim of one of these
attacks and you find this file, you can pass it to a script, find the address of the C2 server
and then we can use Metasploit to attack that C2 server. But uh, if you're too imp- so if
you're too impatient to wait for yourself to be attacked, you could always search virus
total for, you know, these files or just do a quick search for ghost, you know, rat uh,
samples and find quite a few. Some may be old, some might not. Or, Shodan was very nice
recently and added a malware hunter feature that looks for C2 servers and one of the C2
servers that they look for is ghosts. So we could just do a quick shopping list off of Shodan
and, and have some fun. Um, again, this demo is same setup, attacker or, or adversary on the
right, uh, retaliator on the left. Um, and this one I'm gonna do just slightly different in
that I'm gonna build a malware sample from the ghost rat tool and I'm gonna pass that
malware sample to the retaliator and then using that script that uh, KevTheHermit wrote,
extract the C2 info and then use that to attack back. So I made the sample and then I wasn't
thinking and I closed ghost rat. Oops, I pressed a button. Alright, sorry to make you watch
it again. Yeah, so I make the sample and then I'm gonna just drag it out of the VM. Uh, in a
usual case, right, it'll arrive via an email or a watery hole attack but I'm not gonna go
through all that. We all know how those work. So I just drag the file out of the VM and then
I'm gonna run the rat decoder script on that sample. If I can type fast. There it is. Um, and
you can see there the C2 address and the port that, that, that it's looking to go to. I
realized my mistake, started back up the ghost rat server and on the left I'm starting up
Metasploit and then I'm gonna load my module, um, set the remote address to the remote
address that we extracted from the malware itself. Uh, just quick info showing what's
available. I don't wanna click pause, I'll try, I'll try. No I won't, I don't dare. So if you
find a C2 server that doesn't use the ghost magic, you can just set the magic to be, match
whatever the ghost, the, the server is. And I throw my exploit. Now it's gonna take just a
minute because I'm spraying the heap so I'm spending a lot of data, sending a lot of data
over. But there we see the, uh, stage, uh, interpreter session starting. Uh, I'm going to do
the same set of commands. I'm gonna, as soon as it comes back, uh, do the sysinfo, spawn a
shell, and this time I think I'll pop calc just to be different. Yes. There she is. On a
Windows 10 machine. So that begs the question, then what? What do we do now? To be honest, I'm
not quite sure. This is an area that hasn't really been discussed, at least publicly. But
here's what I would suggest maybe. And maybe these are bad ideas, I'm not sure. Um,
somebody else should, could decide. I don't know. But, uh, one of the first things I would be
interested in doing would be netstat. Because netstat would tell you all other connections to
that box. If there are other victims behind, beside yourself, they would be, they would show
up in this netstat listing. So you could find out who else was targeted. Um, every one of
these C2 tools has a folder for the files that have been downloaded from victims. And I
would look at that. I would see what files had they pulled from other victims. What were
they interested in? What did they pull from you? Um, also, maybe you would want to install
some sort of persistence so you can stick around longer. Maybe you'd want to install a
keylogger to see what else they're up to. If they're dumb enough to log into Facebook from
their, uh, ops machine, who knows? A lot of different things that are optional to do. But
whatever you do, I highly suggest you don't go the revenge route, but you sit quiet and you
listen. Because I feel like that's where the most value in these are, right? The more you
observe about your adversary, the, the more likely you are to, to win in the long run. So
with that, that's about all I had. I appreciate you guys coming and, and spending the time
here. This URL and, thank you. Thank you. That URL is where I currently have a fork of the
Metasploit until I can get them, um, pulled up into the main branch. And it depends on how
well I am at, at, uh, meeting all the check marks before that'll happen. So you can grab it
there until they're released. Again, thanks anyways.