start	end	text
0	5700	So, like the title suggests, we're going to be exploiting some CNC servers today, or at
5700	13900	least exploiting some CNC toolkits. Before I get right into that though, these are, at least
13900	18480	best to my knowledge, new exploits. And at the end of this, I will be releasing the
18480	24520	Metasploit modules for these exploits. Before I get there though, I just, I don't want the
24520	28000	focus to be so much about these exploits. I mean, I think they're cool, they're remote code
28000	33120	execution. But the take away should be, if you're a vulnerability researcher, like this
33120	39080	field of looking at CNC servers for exploits, is a right field. There's low laying fruit
39080	43280	everywhere and I really don't feel like people are, or a lot of researchers are looking at it,
43280	46140	or if they're looking at it, they're very, they're using them just for themselves and not
46140	51320	really sharing. So, um, key take away is this is, this is a really interesting field and I
51320	55960	highly recommend anybody who's into vulnerability research to jump into it. So, before I get
55960	59260	started on the exploits, I'm going to do a little bit of background. I'm going to talk a
59260	64120	little bit about some legal stuff, but then we'll, then we'll get into the exploits. Um, so
64120	68860	background on me a little bit. I've been in this computer, computer security community for
68860	74820	over 10 years. I currently work at, uh, Symantec as a threat researcher. Before that, I
74820	82540	worked for the, uh, DOD doing COE, C&E, C&O, C&A. Um, and I've had done some time in the
82540	88360	trenches as well. I was an IT administrator before that, so I know what it's like down in
88360	91960	the field. I feel like I kind of have a good round understanding of, uh, this particular
91960	97320	area. With all that being said, the disclaimer should come as no surprise to anybody. Um,
97320	101700	everything I'm about to say up here does not represent any of the opinions, uh, or my
101700	108340	opinions do not represent the views of my current or former employers. Make that clear. Um,
108340	114900	what I'm going to discuss is probably illegal, so what you do with it is up to you. If you do
114900	119900	cool stuff with it, I'd love to hear about it, but what you do, it's your own risk. Cool? We
119900	126200	got that covered. Alright, so, let me talk about what really led me into this field. And
126200	130160	that's one thing that bothers me about the security community, the security defense
130160	135160	industry, is that there's this defeatist attitude out there, right? Like, no matter how hard
135160	139200	we try, we're gonna lose. And if you went into, like, a basketball game with that kind of
139200	144560	attitude, like, it's not gonna work. But somehow we expect that it's okay for the security
144560	150520	community, right? Like, I hear this sophisticated actor term passed around all the time as if
150520	156620	it's some kind of excuse why a company got hacked. And I don't, I don't really understand
156620	161820	what they're trying to convey by using that term. If, if I, I try to picture, like, that
161820	167320	conversation with the sea levels when you're trying to explain what just happened, uh, sir,
167320	171440	we've been hacked. What, what, how did, how did they get in? Oh, well, they were
171440	178520	sophisticated. Like, how do you know they were sophisticated? Well, they were wearing a
178520	184000	monocle, so they're clearly a sophisticated actor. You know, like, what, what does
184000	187420	sophisticated mean in this context? Whatever it means, I don't think it means what they're
187420	191680	even trying to persuade it means, right? I think they're trying to persuade, or, or, to
191680	198300	convey, excuse me, that it means that this attacker was so far beyond what we can just,
198300	203220	defenders can do that we just can't win. And so that's what I set out with this to say. I
203220	206740	was like, well, I'm going to take a look at the tools that these sophisticated actors are
206740	210820	using and let's just see if we're, if they're vulnerable to attacks, if somebody was to
210820	217320	attack them back. And so that's where I went with this. Now, Hacking Pack has been a very
217320	221420	hot topic over the years, right? Five years ago, at Black Hat, they did an anonymous
221420	226440	survey asking people if they've participated in hacking back in some form. And
227040	233880	anonymously, over a third of the people surveyed admitted to it. Uh, a lot of times, when
233980	237980	a company's hacked, they want justice, they want revenge, they want that person to pay for
237980	241560	what they've done. So they'll go to law enforcement and law enforcement has their hands
241560	246040	tied, or can't do anything, or has no recourse. They, sorry, we can't do anything about
246040	250400	this. And so, companies kind of feel obligated to take this on themselves. Uh, I, I'm
250400	256380	just going to do it myself. Add to that, this, uh, new draft bill that, uh, Senator Tom
256380	262680	Graves, uh, out of Georgia is preparing to present. It's called the Active Cyber Defense
262680	271180	Certainty Act, the ACDC Act. I love the acronym. But, um, it's basically a bill that will allow
271600	277200	those who have been hacked to be exempt from hacking laws when their aim is to attack their
277200	281920	assailant. So this is kind of an interesting idea. If this was proposed, if this draft makes
281920	287380	it through Congress. However, generally, like, first thought, this is a very, very bad
287380	292900	idea, right? Like, this is a game you're not going to win in the end result. Uh, as a
292900	297220	corporation, you're, it's first off, it's probably illegal. Even if that's made legal, it's
297220	303860	still very iffy. Um, you, you gotta take into fact all the lost productivity while you send
303860	307580	your best guys, rather than defending your network, you're now sending them to go attack.
307720	312080	Um, not to mention the liability. What if they attack the wrong server or the attacks came
312080	315760	from some other company and then that company realized they've been attacked by you, so
315760	319600	they hacked back you, right? Like this escalation game, it's like the cyber, you know, the
319600	322980	war games movie where all these guys are like hacking everybody else because one little
322980	329260	guy, so basically I, I felt like that, that, uh, the AI's conclusion from that movie applies
329260	335140	very well to this. It's probably the best strategy not to play this game at all. That being
335140	342900	said, I do see a very useful or a very niche area where hacking back, it would be a good
342900	347960	thing. And it wouldn't be a good thing in terms of revenge or taking the guys out. But you
347960	352800	see, I work as a security researcher as my day job. So I try to track these, I try to track
352800	357000	targeted attacks, I try to figure out who's behind this type of attack. And if I could
357000	363260	figure out how the person acts that's behind the attack, what files they stole, who else
363260	367880	they're targeting, like this kind of information, if I was to hack back and sit on their
367880	372640	machine and, and observe, that kind of information is great for defenders because then I
372640	375540	could tell you, these are the other tools they use, this is the industries they're
375540	380780	targeting, this is the files they want. It's very useful in that sense, not so much in the
380780	386820	sense of just striking back to get revenge. And to be honest, to be fair to the ACDC act,
386820	391820	that's actually the verbiage it's trying to convey. Uh, the act itself clearly says that you
391820	397980	cannot attack back for the purposes of causing physical or financial injury or to try to
397980	403200	destroy data or, or machines that, you basically can't just try to break their machine,
403200	406120	which is a good idea anyways because if you break their machine, they're probably just
406120	411300	gonna show up somewhere else anyways. But instead, the act says you can, you can attack
411300	417240	back for these purposes, um, is to establish attribution of the criminal activity and to
417240	422920	monitor the behavior of an attacker. Also in the bill, it says you, you must, um, share with
422920	426120	law enforcement that you plan to do this attack and how you plan to do this and gonna give
426120	432620	them some details beforehand. Um, I don't know, I, anyways, I don't plan to spend forever
432620	439120	talking about legal stuff and I know that's not why you came here either. But I just wanna,
439120	444260	uh, so I'll end my rants now, but I just wanna kinda convey that what I'm about to discuss in
444260	449960	the very near future could be legal. So this is maybe potential tools like it could be
449960	455360	legal and this is showing it could be very plausible. So before I get into some things, I
455360	460840	wanna make sure we got terminology clear. In some circles, I've seen the client and server
460840	467900	names for rats reversed and that really bothers me. So the person who has the implant or the
467900	473280	malware running is going to be the victim or the tar- I'm gonna call him the target. I'm
473280	477460	gonna try and avoid victim and I'm gonna try and avoid client just because that one gets some
477460	482000	people confused. And the reason I'm avoiding victim is because the attacker in the original
482000	486700	scenario is gonna be our victim. So attacker, victim, probably terms I'm gonna try to stay
486700	491160	away from. Um, and I'm introducing a new one that is the person who's tacking back, I will
491160	496440	call the retaliator. I really like that term because the dictionary definition is one who
496440	500820	returns assault in kind. Uh, we're gonna be hitting them with our own medicine here so I
500820	507080	felt like retaliator is the right name for this. Um, a little while ago, one of my co-
507080	511800	colleagues, he took all the recent APT reports, the sophisticated actor reports and he kinda
511800	517780	summed it up into, uh, most popular tools. Uh, most reference tools out of those papers and
517780	523620	he posted this on a Twitter feed. And I saw this list and I was like, uh, that is my shopping
523620	528760	list. I'm gonna start at the top and just start working my way down, finding an exploit in
528760	534780	each. And so if you'll notice, the top one is poison ivy and if any of you recall or are
534780	539700	aware, there is already an exploit out there for poison ivy. Uh, the two individuals at the
539700	544340	bottom of this slide developed that. I'm not gonna try to pronounce their names because I
544340	550160	would not do well. Um, but uh, they developed a remote code execution vulnerability against
550160	557700	the poison ivy C2 server. And interesting enough, after the Mandiant APT1 report, the malware
557700	563560	LU guys noticed that that APT1 group was using the poison ivy server so they used this
563560	568380	exploit to hack back into their infrastructure. But they documented the whole thing and
568380	573020	published it. And this is one of the rare cases where we have of somebody doing a hack back for
573020	579280	attribution or for monitoring purposes and it really shows how successful it can be. Um,
579280	584060	this picture, the farthest picture on the right is a diagram that they show that they were
584060	588500	giving, trying to show us how they built their, the attackers had their infrastructure set
588500	593360	up, how they had some VMs and some proxies to try to protect things. They also were able to
593360	598400	pull back some additional tools the attackers were using and they exposed them publicly. And
598400	603980	it was, it's very insightful paper. Uh, they called it the APT1 technical backstage. Um, it
603980	608420	came out I believe in 2013. It's been around for a little while now. It's a really good read
608420	612860	but I think it's one of the rare cases where we can see how useful this type of uh, activity
612860	619300	is. Another one on that list was dark comment. It also has public exploits. This is a blind
619300	624160	file retrieval by these individuals. I don't have any, or I didn't find any public
624160	629260	documentation of anybody using this publicly. But I just, I figured I'd mention it just for
629260	634700	complete lists. And with that, we're gonna start playing with our new stuff. I'm gonna
634700	638940	start, so I know I told you I started on my list and worked my way down, but I'm gonna work
638940	643040	now when I present them from bottom up because I feel like it's uh, least interesting to
643040	648380	most interesting in that order. So, fourth on the list, or the, the last one I looked at is
648380	654540	called Extreme RAT. Um, anybody, how, who's familiar with Extreme RAT? Has seen it? Ran
654540	659740	into it? Okay, okay. Yeah, it's not the most common APT tool kit. In fact, I wouldn't even
659740	664600	really consider it an APT tool kit thing. It's actually, was a commercial product. This
664600	671140	image here is of the CNC server component. I've got one victim and that drop down list,
671140	676680	lists some of the features that the, the attacker can do to that victim. Uh, this tool was
676680	682300	sold out there on the markets and uh, at some point the source code was leaked and, and the
682300	685800	author just kind of quit selling it. So it's still out there, the source code's leaked out
685800	689460	there and it's still kind of around. There's a lot of variants that base themselves now off
689460	694900	that source code. Um, one of the, it, a lot of the features are very script kiddy-ish, like
694900	700320	you can tell it targets script kiddy guys, like wannabe hackers. In fact, one of the features
700320	704580	it has is you can play fat flash games in the app while you're waiting for somebody to click
704580	709920	on your malware. It's like, if you're not very good, at least you can, you know, play some
709920	716200	Candy Crush or Jewel Quest game while you wait because your phishing email sucks. But
716200	722020	despite this, it's actually uh, been cited in numerous articles as part of targeted
722020	728300	attacks. So, even sophisticated actors like using this tool. Um, it's been cited in attacks
728300	733700	against the Israeli government, uh, in conflicts in Syria and the Gaza Strip. So, kind of
733700	739420	hotbed areas do get hit by this guy. And the easiest way to identify this inside a network is
739420	745760	it's uh, C2 communications. Most of the uh, targets we've seen, it either calls home one of
745760	754040	two ways. Raw TCP or a fake HTTP message. The raw TCP is always start, start, starts out
754040	759940	with the string, my version pipe and then the version, 3.6, 3.7, 3.8. Those are the, the most
759940	764420	common. And the C2 server always responds with the character X followed by line feed
764420	769420	carriage return. That's like super signatureable, right? Like, snore signatures already exist
769420	775260	and such. It's, it's very easy to watch for that. Alternatively, if it does the HTTP requests,
775260	781240	those always take the form of a get request slash some number dot functions. And that some
781240	786620	number is the password that the script kitty uses when they first run the app. And the app
786620	790660	makes sure that the password is up to ten characters, can't be longer than ten and they all
790660	797400	have to be numeric. So, looking for any URL request for, you know, zero to nine or one to
797400	803600	ten character numbers dot functions is gonna hit on this and most exclusively hit on this. I
803600	809100	really doubt there's legitimate traffic going to that URL pattern. And so, this guy, like I
809100	814000	said, their source code out there, it was in Delphi, so I really don't like to read Delphi. So
814000	819460	I just kinda started reviewing some of the basic C2 comms. I, you know, I, I had myself a
819460	825100	victim and I would do all the maneuvers to the victim and watch the C2 traffic go back and
825100	834560	forth. And one thing I noticed that struck my eye was how the C2 server, um, pushes a file down
834560	840800	to its victim. And what it'll do is it'll send a message to the target and say, hey, get ready
840800	848040	to receive my file tool slash bad.exe and save it to your C drive temp as calc.exe. And then
848040	854560	the target will respond back, okay, I'm ready to receive your tool named tool dot bad.exe and
854560	859440	then the data is passed to the victim. And it made me think about this, why does the victim
859440	865220	need to know at all where that file is stored on the server's hard drive? And I was like,
865220	868880	well, maybe it does that because the server doesn't want to keep state. It doesn't want to
868880	873440	keep the, in its memory, the fact that it made this request. Because all the data it really
873440	878820	needs is in the response from the victim. So, turns out that the first packet is even
878820	884480	necessary. As a victim, I can go to the extreme server and say, hey, I'm ready to receive your
884480	889360	file, C drive slash whatever, duh, duh, duh, duh, and if that file exists, it gladly hands it
889360	900860	to me. Yeah, it's kind of a blanket basic mistake. But what can I do with this?
900860	904600	Unfortunately, I can't do a directory listing, so I have to know the file exists. I can do
904600	909720	like brute force all the files, but there's better ideas than that. Um, I didn't take
909720	913740	these, I didn't make these ideas up. This is um, from the link at the bottom. Blind file
913740	918220	retrieval is an, is often a case pen testers get in. So they've thought about this a bit. And
918220	921920	these are some things that they suggest pulling back. The first one is the winini file,
921920	925720	because on any version of Windows, that file exists. So it's like a sanity check. If you can
925720	929680	pull that file back, we're good. More so, if you can pull that file back, you might be able to
929680	933660	tell what version of Windows they have. If you know what version of Windows they have, you
933660	938660	know the path to the event logs. So we can start pulling event logs. If the event logs,
938660	943040	there's usually a lot of good data in there. With fi- if applications crash, you know the
943040	947600	path to the application. If a programming user runs crashes, you may know the pa- the
947600	951560	user, username. So now if we know the username, we can start pulling files out of the
951560	955840	user's home subdirectory, like the desktop.ini. Because that will tell us all the folders
955840	959740	that person has, or files, on their desktop. And we can keep kind of iterating through their
959740	964400	network, this, or, or their computer, finding out things like that. If it's running, if the
964400	968140	attacker is running this program as administrator, then we can always pull the backup of the
968140	972740	SAM database, and then we get their username and passwords. Maybe we can pull the backup of
972740	975620	the registry, because the registry is going to have a whole lot of great information and
975620	979760	things, more things that we can pull from their machine. These are just some ideas of the
979760	984160	things you can do with that bug. And, uh, with that I'm going to move on to the next one.
984160	989500	This one, uh, PlugX, CorePlug, or DeathStory. It's called DeathStory because somebody
989500	994940	misspelled destroy in the source code. Um, but this is a, a, a more common tool. It's been
994940	1000200	around since 2008. Uh, the, the back window is the main tool, you see the CNC component, and
1000200	1005120	the front window is the popup that you can get per victim. And each tab is a set of features
1005120	1010340	you can do to a victim. This one is a little bit more, I don't know if I'll say
1010340	1015840	professional, but it's a little bit more tailored. Um, I can tell the source code is
1015840	1020920	passed around between groups. I see different variants of this out there, but the biggest
1020920	1025020	changes I see in the variants is just the GUI and not so much the functions underneath. It's
1025020	1029880	like every new hacker likes to like throw their own GUI on there and put their own QQID on
1029880	1034420	there and claim that they wrote this. But it's all the same stuff under the hood. Uh, some of
1034420	1038480	the cool features I've noticed though, uh, it has features for interacting with SQL
1038480	1043120	databases, for directly hitting the registry, for capturing packets or doing network
1043120	1048660	monitoring. So it's, it's a pretty feature rich RAP. And it's been cited in a lot of targeted
1048660	1054220	attacks. Uh, most, uh, recently was one in February, the one that says, uh, oops, they did
1054220	1059420	it again. Yeah, this tool has been around for quite some time. I can start naming places it's
1059420	1064920	been used against Afghanistan and India, Mongolia, Jazakistan, Japan, Taiwan, Korea,
1064920	1069160	Tibetan organizations and it just goes and goes and goes. This thing's been around for quite
1069160	1074900	some time. This one I did not or I could not get a hold of the source code for. So I was
1074900	1080660	gonna rely on dynamic analysis and, and fuzzing. And so I was building a fuzzer to try to
1080660	1086100	fuzz the protocol, how the, the victim talks to the C2 server. And when I got my fuzzer up
1086100	1090140	and running, this thing would fall over left and right. And I just had a hard enough time
1090140	1095040	keeping the program running and getting, like, my, the list of bugs and the vulnerabilities
1095040	1099120	and potential crashes that could be turned into exploits was so high that I got, kinda got
1099120	1104220	overwhelmed with the fuzzing and decided just to go look at static analysis. And so I, I was
1104220	1108780	looking at the code and one of the first areas I was looking at was when you receive a
1108780	1113920	message from the victim, how does it handle it? And they handle it alright. When it receives a
1113920	1118320	message from the victim, each message or packet as they call it, each message has a little
1118320	1123180	header that's XOR encoded with their own little made up XOR scheme. And so they decode the
1123180	1128500	message header and then they look that the message is small enough to sit, to fit on the
1128500	1132900	stack buffer that they prepared for, right? That, that's a good security track. That, uh,
1132900	1138800	61, that F000. So it has to be smaller than 61K, which is a rather large message. If it
1138800	1144680	doesn't fit, then it shows a pop up message. However, this code to check that the message
1144680	1150220	will fit on the stack is down here in this decode packet function. Um, you can't see my
1150220	1158820	mouse. It's on, it's on line 36. But you'll see up on line 29, it copies the packet to the
1158820	1166900	stack and then later decides maybe I should have checked if it was gonna fit. And so I can,
1166900	1171160	because it's on the stack, right, we can return, we can overwrite the return address. But the
1171160	1175300	return address isn't hit until this function leaves. Which means, if I overflow this
1175300	1179320	buffer, I'm gonna get control as soon as this function finishes, but before the function
1179320	1185800	finishes, it pops up this pop up message. That very, very clearly tells the attacker what just
1185800	1191080	happened, right? P, PED code packet. Come on, don't you understand? You just got exploited
1191080	1196140	buddy. And the funny thing is, no matter what they do, if they click the X or they click the
1196140	1200520	OK, it doesn't matter because I get code flow either way. They just have to acknowledge this
1200520	1206720	in some sort of way. Now that's not cool, I agree. Um, but, uh, turns out that this message
1206720	1212480	is like the de facto error. In fact, if you end map, uh, plug X server, it will show this
1212480	1216280	message. It just doesn't, this is like, I don't know what happened message is really what
1216280	1223000	this is trying to say. And so for this one I have a demo, real quick. Uh, I see my mouse. The
1223000	1227620	right half of the screen is gonna represent, represent the attacker's computer and the left
1227620	1234520	half of the screen represents the retaliator's computer. I'm gonna start up the, uh, plug X
1234520	1241920	server. And then I will just point my, my Metasploit script at it. So I'll start up my
1241920	1246800	plug X Metasploit script. Uh, because it's a VM I already know the IP address so I'm just
1246800	1251240	gonna type in that IP address and set the attack at that, at that. We'll talk more about how
1251240	1256960	to find out who to target later. Now, I'm gonna pause this real quick and, and have an
1256960	1262260	aside. One of those papers or, or the articles I mentioned was a talk from Black Hat, uh,
1262260	1266520	known as, uh, I Know You Wanna Unplug Me, where they talked about plug X RAT and talked
1266520	1271520	about the, uh, that's not what I wanted to do. Alright, I'll just start this up while I
1271520	1276880	talk some more. Um, and they talked about the different variants they observed. And they, in
1276880	1281720	their terms they observed three types. Where basically they used three different XOR schemes.
1281720	1287820	They changed. And so, I've written my module to be able to handle each type. But I can't
1287820	1291500	know ahead of time what type you're targeting. So basically you, you run the check command
1291500	1295440	and if it's not that right type, we'll change the type and run the check command again until
1295440	1300200	you validate that you've got the right type. So you see, you see plug X type 1, type 1 old
1300200	1306280	and type 2. So I run the check command. The check command says yep, you're good. So we'll
1306280	1310700	hit exploit. It'll pass the attack against the server. There you see the pop up message over
1310700	1316680	there. Uh, the attacker's like what the heck, kicked X or the victim now. And you see my
1316680	1324020	interpreter session spinning up. I'm going to do a quick sys info. Yeah, I'll spawn a shell. And
1324020	1337400	I think notepad, popping notepad, visually there it is. Alright, on to the last one. Uh,
1337400	1342600	ghost rat. How many of you have seen or heard of ghost rat before? Yeah. Yeah, I like that
1342600	1346060	hand. So that's, that's exactly what this guy is. Like, it is the one that's been around
1346060	1350800	forever. Um, at least 10 years. It was really, originally written by a group that called
1350800	1357540	themselves C. Rufus Security Team, also known as the Red Wolf Security Team. Uh, all, it's
1357540	1364720	most often cited in tax, attacks that come out of uh, Asia region. Uh, this image is of the C2
1364720	1369220	cool toolkit and again you right click on a victim and there's your feature set. Kind of
1369220	1374680	typical feature set, nothing fancy. Um, this is, this is almost in my opinion the uh, the
1374680	1378500	measuring stick for rats, is ghost rat. Like they should at least be able to do what it, what
1378500	1386400	it can do. And ghost rat, it has been cited in so many articles. So many articles. Um, these
1386400	1390900	are just a few that I can fit on the screen there. Uh, most recently is the one down in the
1390900	1397660	bottom left, which was just this year. Uh, ghost rat was being spread this eternal blue. So
1397660	1402840	it's still very popular. I think the oldest one on there, I, I can't find the updates. But
1402840	1408760	it's been around for at least 10 years. And again, it is uh, very easy to identify based on
1408760	1414200	it's PCAP, based on it's uh, traffic. It has a signature 5 byte ghost pattern. The first 5
1414200	1419760	characters in, in each packet message from the victim to the C2 server or from the C2 server
1419760	1425720	back to the victim. Now, the source code for ghost rat has been leaked online and so many
1425720	1430340	people or many attackers chain, know that that ghost is like a big red flag. So they'll try to
1430340	1435140	change it to something else. Uh, that second image is from a talk uh, Snora gave where he,
1435140	1439860	these are different 5 byte characters he's seen that change to. They usually always only
1439860	1443940	change the 5 bytes just because that's easiest and if you change it to something longer, it
1443940	1448600	requires a lot of other changes in the code. But even still, it's very easy to identify this
1448600	1452420	no matter what those 5 bytes are because it's always followed by another pattern of 2
1452420	1457260	integers and then a compressed buffer. So it's still very easy to identify no matter what the
1457260	1464480	5 byte character is. And like extreme rat, it was, it had a very similar logic bug. But this
1464480	1469620	one is the other way around. When it's requesting a file from its victim, it will tell the
1469620	1475620	victim, hey, give me your local file, you know, document user file dot doc so I can save it to
1475620	1480640	this path. Like, well that's very nice. Here's the data, you can save it to that path. Oh, by
1480640	1486200	the way, I also have the second file that I'd like you to save to your startup folder.
1487260	1492100	And sure enough, if you know the path to their startup folder, it will put it right there. Now,
1492100	1496640	the startup file folder changes in different versions of Windows. So that's not the most
1496640	1500260	reliable way. If you can in map their machine and tell what version of Windows they have, then
1500260	1505980	boom, you can do this. But, um, I had to find a better way. And sure enough, Ghost Rat has
1505980	1512260	another very handy for me. It is, uh, vulnerable to a DLL side load attack. Meaning if I just
1512260	1518520	drop a file named OLE D- DLG, uh, a dynamic library right in that same folder, the local
1518520	1523580	folder, then it will try to load that file whenever Ghost starts up. And it's looking for
1523580	1529640	only one function in that fol- in that, uh, DLL and that is OLE UI busy. It's basically a
1529640	1535000	function that can ask, is the UI busy? And it expects to hear a 1 as a return from that. I
1535000	1539220	don't know, a 1 means not busy. It's really confusing. But anyways, all you have to do is
1539220	1545060	make a, you make your malware into a D- uh, DLL, have it export this 1 function that just
1545060	1550380	returns 1 all the time and Ghost will be none the wiser. It doesn't break anything doing that.
1550560	1555120	And the next time Ghost starts up, it'll load your malware and, or every time Ghost starts
1555120	1559560	up, it'll load your malware. So that was cool, but it requires dropping something to disk and
1559560	1564360	I, I wasn't done picking on Ghost yet. Cause Ghost, like I said, had the source code, so I
1564360	1568540	started looking at the source code and right away this one stood out to me. It didn't, I
1568540	1573940	mean I found it in like an hour or 2. It's basically, this is in the handling of the drive
1573940	1578840	list as given from a victim. So when the victim says, oh I have drive C, D and E, it's, it's
1578840	1584460	in a buffer, right? And you'll notice on that second line, it just assumes that the list, it
1584460	1588120	takes the length as given from the victim rather than assuming the length is less than its
1588120	1594160	buffer size. So if I pass it a list of drives that are longer than the usual max of 26, then I
1594160	1600160	can overflow a buffer within this particular C class. So the buffer you're over, I'm
1600160	1605600	overflowing is in line 45, the remote drive list, which means I can overwrite any one of those
1605600	1613800	um, objects below inside the class. A lot of those objects below are other C classes. So I can
1613800	1618200	overwrite the pointer to those C classes, then when a, when the actual code flow tries to
1618200	1624740	call a function in one of those C classes, it's gonna end up calling a pointer to a pointer
1624740	1629700	that I control that needs to point to another pointer that points to my code flow. So I
1629700	1633860	basically have to set up a pointer to a pointer to a function that I want to run. Which is
1633860	1638060	kind of messy. Uh, pointer to pointers aren't really the funnest things to use for
1638060	1644540	exploitation. But um, they work. If I had an information disclosure or if that would give me
1644540	1648880	the layout of memory, that would make pointer to pointer uh, code flow pretty easy. But I'm
1648880	1653180	lazy. I didn't spend time looking for that. And I knew that I could just do a heap spray and
1653180	1656660	have a really good chance of landing in my own heap. So that's what I did instead. I did the
1656660	1660660	lazy man's approach. Um, after I released these modules, I would love to see somebody maybe
1661160	1666840	who's more willing to do work than I am. Uh, make, make the exploit a little bit cleaner
1666840	1672820	that way. But nonetheless, that's what I did. Um, depth would break this approach, but depth
1672820	1677820	seems to break the, the executable. Wh- whenever I'd run ghost rat on a machine that forced
1677820	1683060	depth execution or if I opted in, ghost would just crash. It wouldn't even run. So, didn't
1683060	1687180	need to really worry about depth. That could probably be changed, but it wasn't a problem for
1687180	1692420	me. Now before I go on to show that uh, demo there of the video, I wanted to talk about
1692420	1696160	uh, something that uh, another researcher called Kevin the Hermit has done, or Kev the
1696160	1701100	Hermit. Um, he has written a number of decoders. So if you're given a piece of malware from
1701100	1705820	any one of the, the, these families, with the exception of PlugX, you can run the script on it
1705820	1710380	and it'll extract from that piece of malware, the C2 address that it was spent, meant to call
1710380	1715520	home to, along with some other configuration data. So if you're the victim of one of these
1715520	1720680	attacks and you find this file, you can pass it to a script, find the address of the C2 server
1720680	1726520	and then we can use Metasploit to attack that C2 server. But uh, if you're too imp- so if
1726520	1730440	you're too impatient to wait for yourself to be attacked, you could always search virus
1730440	1736000	total for, you know, these files or just do a quick search for ghost, you know, rat uh,
1736000	1742060	samples and find quite a few. Some may be old, some might not. Or, Shodan was very nice
1742060	1747220	recently and added a malware hunter feature that looks for C2 servers and one of the C2
1747220	1752320	servers that they look for is ghosts. So we could just do a quick shopping list off of Shodan
1752320	1761980	and, and have some fun. Um, again, this demo is same setup, attacker or, or adversary on the
1761980	1767900	right, uh, retaliator on the left. Um, and this one I'm gonna do just slightly different in
1767900	1773340	that I'm gonna build a malware sample from the ghost rat tool and I'm gonna pass that
1773340	1778580	malware sample to the retaliator and then using that script that uh, KevTheHermit wrote,
1778580	1783960	extract the C2 info and then use that to attack back. So I made the sample and then I wasn't
1783960	1790480	thinking and I closed ghost rat. Oops, I pressed a button. Alright, sorry to make you watch
1790480	1796520	it again. Yeah, so I make the sample and then I'm gonna just drag it out of the VM. Uh, in a
1796520	1802580	usual case, right, it'll arrive via an email or a watery hole attack but I'm not gonna go
1802580	1807700	through all that. We all know how those work. So I just drag the file out of the VM and then
1807700	1817700	I'm gonna run the rat decoder script on that sample. If I can type fast. There it is. Um, and
1817700	1822800	you can see there the C2 address and the port that, that, that it's looking to go to. I
1822800	1827480	realized my mistake, started back up the ghost rat server and on the left I'm starting up
1827480	1833140	Metasploit and then I'm gonna load my module, um, set the remote address to the remote
1833140	1850390	address that we extracted from the malware itself. Uh, just quick info showing what's
1850390	1855950	available. I don't wanna click pause, I'll try, I'll try. No I won't, I don't dare. So if you
1855950	1861610	find a C2 server that doesn't use the ghost magic, you can just set the magic to be, match
1861610	1867030	whatever the ghost, the, the server is. And I throw my exploit. Now it's gonna take just a
1867030	1870350	minute because I'm spraying the heap so I'm spending a lot of data, sending a lot of data
1870350	1877070	over. But there we see the, uh, stage, uh, interpreter session starting. Uh, I'm going to do
1877070	1882330	the same set of commands. I'm gonna, as soon as it comes back, uh, do the sysinfo, spawn a
1883450	1889530	shell, and this time I think I'll pop calc just to be different. Yes. There she is. On a
1889530	1901280	Windows 10 machine. So that begs the question, then what? What do we do now? To be honest, I'm
1901280	1908640	not quite sure. This is an area that hasn't really been discussed, at least publicly. But
1909680	1915540	here's what I would suggest maybe. And maybe these are bad ideas, I'm not sure. Um,
1915540	1919360	somebody else should, could decide. I don't know. But, uh, one of the first things I would be
1919360	1924140	interested in doing would be netstat. Because netstat would tell you all other connections to
1924140	1928480	that box. If there are other victims behind, beside yourself, they would be, they would show
1928480	1933600	up in this netstat listing. So you could find out who else was targeted. Um, every one of
1933600	1938380	these C2 tools has a folder for the files that have been downloaded from victims. And I
1938380	1942040	would look at that. I would see what files had they pulled from other victims. What were
1942040	1949320	they interested in? What did they pull from you? Um, also, maybe you would want to install
1949320	1953040	some sort of persistence so you can stick around longer. Maybe you'd want to install a
1953040	1956160	keylogger to see what else they're up to. If they're dumb enough to log into Facebook from
1956160	1962340	their, uh, ops machine, who knows? A lot of different things that are optional to do. But
1962340	1968300	whatever you do, I highly suggest you don't go the revenge route, but you sit quiet and you
1968300	1973300	listen. Because I feel like that's where the most value in these are, right? The more you
1973300	1980080	observe about your adversary, the, the more likely you are to, to win in the long run. So
1980080	1984020	with that, that's about all I had. I appreciate you guys coming and, and spending the time
1984020	1999000	here. This URL and, thank you. Thank you. That URL is where I currently have a fork of the
1999000	2003720	Metasploit until I can get them, um, pulled up into the main branch. And it depends on how
2003720	2007600	well I am at, at, uh, meeting all the check marks before that'll happen. So you can grab it
2007600	2009860	there until they're released. Again, thanks anyways.