[00:00.000 --> 00:05.700] So, like the title suggests, we're going to be exploiting some CNC servers today, or at [00:05.700 --> 00:13.900] least exploiting some CNC toolkits. Before I get right into that though, these are, at least [00:13.900 --> 00:18.480] best to my knowledge, new exploits. And at the end of this, I will be releasing the [00:18.480 --> 00:24.520] Metasploit modules for these exploits. Before I get there though, I just, I don't want the [00:24.520 --> 00:28.000] focus to be so much about these exploits. I mean, I think they're cool, they're remote code [00:28.000 --> 00:33.120] execution. But the take away should be, if you're a vulnerability researcher, like this [00:33.120 --> 00:39.080] field of looking at CNC servers for exploits, is a right field. There's low laying fruit [00:39.080 --> 00:43.280] everywhere and I really don't feel like people are, or a lot of researchers are looking at it, [00:43.280 --> 00:46.140] or if they're looking at it, they're very, they're using them just for themselves and not [00:46.140 --> 00:51.320] really sharing. So, um, key take away is this is, this is a really interesting field and I [00:51.320 --> 00:55.960] highly recommend anybody who's into vulnerability research to jump into it. So, before I get [00:55.960 --> 00:59.260] started on the exploits, I'm going to do a little bit of background. I'm going to talk a [00:59.260 --> 01:04.120] little bit about some legal stuff, but then we'll, then we'll get into the exploits. Um, so [01:04.120 --> 01:08.860] background on me a little bit. I've been in this computer, computer security community for [01:08.860 --> 01:14.820] over 10 years. I currently work at, uh, Symantec as a threat researcher. Before that, I [01:14.820 --> 01:22.540] worked for the, uh, DOD doing COE, C&E, C&O, C&A. Um, and I've had done some time in the [01:22.540 --> 01:28.360] trenches as well. I was an IT administrator before that, so I know what it's like down in [01:28.360 --> 01:31.960] the field. I feel like I kind of have a good round understanding of, uh, this particular [01:31.960 --> 01:37.320] area. With all that being said, the disclaimer should come as no surprise to anybody. Um, [01:37.320 --> 01:41.700] everything I'm about to say up here does not represent any of the opinions, uh, or my [01:41.700 --> 01:48.340] opinions do not represent the views of my current or former employers. Make that clear. Um, [01:48.340 --> 01:54.900] what I'm going to discuss is probably illegal, so what you do with it is up to you. If you do [01:54.900 --> 01:59.900] cool stuff with it, I'd love to hear about it, but what you do, it's your own risk. Cool? We [01:59.900 --> 02:06.200] got that covered. Alright, so, let me talk about what really led me into this field. And [02:06.200 --> 02:10.160] that's one thing that bothers me about the security community, the security defense [02:10.160 --> 02:15.160] industry, is that there's this defeatist attitude out there, right? Like, no matter how hard [02:15.160 --> 02:19.200] we try, we're gonna lose. And if you went into, like, a basketball game with that kind of [02:19.200 --> 02:24.560] attitude, like, it's not gonna work. But somehow we expect that it's okay for the security [02:24.560 --> 02:30.520] community, right? Like, I hear this sophisticated actor term passed around all the time as if [02:30.520 --> 02:36.620] it's some kind of excuse why a company got hacked. And I don't, I don't really understand [02:36.620 --> 02:41.820] what they're trying to convey by using that term. If, if I, I try to picture, like, that [02:41.820 --> 02:47.320] conversation with the sea levels when you're trying to explain what just happened, uh, sir, [02:47.320 --> 02:51.440] we've been hacked. What, what, how did, how did they get in? Oh, well, they were [02:51.440 --> 02:58.520] sophisticated. Like, how do you know they were sophisticated? Well, they were wearing a [02:58.520 --> 03:04.000] monocle, so they're clearly a sophisticated actor. You know, like, what, what does [03:04.000 --> 03:07.420] sophisticated mean in this context? Whatever it means, I don't think it means what they're [03:07.420 --> 03:11.680] even trying to persuade it means, right? I think they're trying to persuade, or, or, to [03:11.680 --> 03:18.300] convey, excuse me, that it means that this attacker was so far beyond what we can just, [03:18.300 --> 03:23.220] defenders can do that we just can't win. And so that's what I set out with this to say. I [03:23.220 --> 03:26.740] was like, well, I'm going to take a look at the tools that these sophisticated actors are [03:26.740 --> 03:30.820] using and let's just see if we're, if they're vulnerable to attacks, if somebody was to [03:30.820 --> 03:37.320] attack them back. And so that's where I went with this. Now, Hacking Pack has been a very [03:37.320 --> 03:41.420] hot topic over the years, right? Five years ago, at Black Hat, they did an anonymous [03:41.420 --> 03:46.440] survey asking people if they've participated in hacking back in some form. And [03:47.040 --> 03:53.880] anonymously, over a third of the people surveyed admitted to it. Uh, a lot of times, when [03:53.980 --> 03:57.980] a company's hacked, they want justice, they want revenge, they want that person to pay for [03:57.980 --> 04:01.560] what they've done. So they'll go to law enforcement and law enforcement has their hands [04:01.560 --> 04:06.040] tied, or can't do anything, or has no recourse. They, sorry, we can't do anything about [04:06.040 --> 04:10.400] this. And so, companies kind of feel obligated to take this on themselves. Uh, I, I'm [04:10.400 --> 04:16.380] just going to do it myself. Add to that, this, uh, new draft bill that, uh, Senator Tom [04:16.380 --> 04:22.680] Graves, uh, out of Georgia is preparing to present. It's called the Active Cyber Defense [04:22.680 --> 04:31.180] Certainty Act, the ACDC Act. I love the acronym. But, um, it's basically a bill that will allow [04:31.600 --> 04:37.200] those who have been hacked to be exempt from hacking laws when their aim is to attack their [04:37.200 --> 04:41.920] assailant. So this is kind of an interesting idea. If this was proposed, if this draft makes [04:41.920 --> 04:47.380] it through Congress. However, generally, like, first thought, this is a very, very bad [04:47.380 --> 04:52.900] idea, right? Like, this is a game you're not going to win in the end result. Uh, as a [04:52.900 --> 04:57.220] corporation, you're, it's first off, it's probably illegal. Even if that's made legal, it's [04:57.220 --> 05:03.860] still very iffy. Um, you, you gotta take into fact all the lost productivity while you send [05:03.860 --> 05:07.580] your best guys, rather than defending your network, you're now sending them to go attack. [05:07.720 --> 05:12.080] Um, not to mention the liability. What if they attack the wrong server or the attacks came [05:12.080 --> 05:15.760] from some other company and then that company realized they've been attacked by you, so [05:15.760 --> 05:19.600] they hacked back you, right? Like this escalation game, it's like the cyber, you know, the [05:19.600 --> 05:22.980] war games movie where all these guys are like hacking everybody else because one little [05:22.980 --> 05:29.260] guy, so basically I, I felt like that, that, uh, the AI's conclusion from that movie applies [05:29.260 --> 05:35.140] very well to this. It's probably the best strategy not to play this game at all. That being [05:35.140 --> 05:42.900] said, I do see a very useful or a very niche area where hacking back, it would be a good [05:42.900 --> 05:47.960] thing. And it wouldn't be a good thing in terms of revenge or taking the guys out. But you [05:47.960 --> 05:52.800] see, I work as a security researcher as my day job. So I try to track these, I try to track [05:52.800 --> 05:57.000] targeted attacks, I try to figure out who's behind this type of attack. And if I could [05:57.000 --> 06:03.260] figure out how the person acts that's behind the attack, what files they stole, who else [06:03.260 --> 06:07.880] they're targeting, like this kind of information, if I was to hack back and sit on their [06:07.880 --> 06:12.640] machine and, and observe, that kind of information is great for defenders because then I [06:12.640 --> 06:15.540] could tell you, these are the other tools they use, this is the industries they're [06:15.540 --> 06:20.780] targeting, this is the files they want. It's very useful in that sense, not so much in the [06:20.780 --> 06:26.820] sense of just striking back to get revenge. And to be honest, to be fair to the ACDC act, [06:26.820 --> 06:31.820] that's actually the verbiage it's trying to convey. Uh, the act itself clearly says that you [06:31.820 --> 06:37.980] cannot attack back for the purposes of causing physical or financial injury or to try to [06:37.980 --> 06:43.200] destroy data or, or machines that, you basically can't just try to break their machine, [06:43.200 --> 06:46.120] which is a good idea anyways because if you break their machine, they're probably just [06:46.120 --> 06:51.300] gonna show up somewhere else anyways. But instead, the act says you can, you can attack [06:51.300 --> 06:57.240] back for these purposes, um, is to establish attribution of the criminal activity and to [06:57.240 --> 07:02.920] monitor the behavior of an attacker. Also in the bill, it says you, you must, um, share with [07:02.920 --> 07:06.120] law enforcement that you plan to do this attack and how you plan to do this and gonna give [07:06.120 --> 07:12.620] them some details beforehand. Um, I don't know, I, anyways, I don't plan to spend forever [07:12.620 --> 07:19.120] talking about legal stuff and I know that's not why you came here either. But I just wanna, [07:19.120 --> 07:24.260] uh, so I'll end my rants now, but I just wanna kinda convey that what I'm about to discuss in [07:24.260 --> 07:29.960] the very near future could be legal. So this is maybe potential tools like it could be [07:29.960 --> 07:35.360] legal and this is showing it could be very plausible. So before I get into some things, I [07:35.360 --> 07:40.840] wanna make sure we got terminology clear. In some circles, I've seen the client and server [07:40.840 --> 07:47.900] names for rats reversed and that really bothers me. So the person who has the implant or the [07:47.900 --> 07:53.280] malware running is going to be the victim or the tar- I'm gonna call him the target. I'm [07:53.280 --> 07:57.460] gonna try and avoid victim and I'm gonna try and avoid client just because that one gets some [07:57.460 --> 08:02.000] people confused. And the reason I'm avoiding victim is because the attacker in the original [08:02.000 --> 08:06.700] scenario is gonna be our victim. So attacker, victim, probably terms I'm gonna try to stay [08:06.700 --> 08:11.160] away from. Um, and I'm introducing a new one that is the person who's tacking back, I will [08:11.160 --> 08:16.440] call the retaliator. I really like that term because the dictionary definition is one who [08:16.440 --> 08:20.820] returns assault in kind. Uh, we're gonna be hitting them with our own medicine here so I [08:20.820 --> 08:27.080] felt like retaliator is the right name for this. Um, a little while ago, one of my co- [08:27.080 --> 08:31.800] colleagues, he took all the recent APT reports, the sophisticated actor reports and he kinda [08:31.800 --> 08:37.780] summed it up into, uh, most popular tools. Uh, most reference tools out of those papers and [08:37.780 --> 08:43.620] he posted this on a Twitter feed. And I saw this list and I was like, uh, that is my shopping [08:43.620 --> 08:48.760] list. I'm gonna start at the top and just start working my way down, finding an exploit in [08:48.760 --> 08:54.780] each. And so if you'll notice, the top one is poison ivy and if any of you recall or are [08:54.780 --> 08:59.700] aware, there is already an exploit out there for poison ivy. Uh, the two individuals at the [08:59.700 --> 09:04.340] bottom of this slide developed that. I'm not gonna try to pronounce their names because I [09:04.340 --> 09:10.160] would not do well. Um, but uh, they developed a remote code execution vulnerability against [09:10.160 --> 09:17.700] the poison ivy C2 server. And interesting enough, after the Mandiant APT1 report, the malware [09:17.700 --> 09:23.560] LU guys noticed that that APT1 group was using the poison ivy server so they used this [09:23.560 --> 09:28.380] exploit to hack back into their infrastructure. But they documented the whole thing and [09:28.380 --> 09:33.020] published it. And this is one of the rare cases where we have of somebody doing a hack back for [09:33.020 --> 09:39.280] attribution or for monitoring purposes and it really shows how successful it can be. Um, [09:39.280 --> 09:44.060] this picture, the farthest picture on the right is a diagram that they show that they were [09:44.060 --> 09:48.500] giving, trying to show us how they built their, the attackers had their infrastructure set [09:48.500 --> 09:53.360] up, how they had some VMs and some proxies to try to protect things. They also were able to [09:53.360 --> 09:58.400] pull back some additional tools the attackers were using and they exposed them publicly. And [09:58.400 --> 10:03.980] it was, it's very insightful paper. Uh, they called it the APT1 technical backstage. Um, it [10:03.980 --> 10:08.420] came out I believe in 2013. It's been around for a little while now. It's a really good read [10:08.420 --> 10:12.860] but I think it's one of the rare cases where we can see how useful this type of uh, activity [10:12.860 --> 10:19.300] is. Another one on that list was dark comment. It also has public exploits. This is a blind [10:19.300 --> 10:24.160] file retrieval by these individuals. I don't have any, or I didn't find any public [10:24.160 --> 10:29.260] documentation of anybody using this publicly. But I just, I figured I'd mention it just for [10:29.260 --> 10:34.700] complete lists. And with that, we're gonna start playing with our new stuff. I'm gonna [10:34.700 --> 10:38.940] start, so I know I told you I started on my list and worked my way down, but I'm gonna work [10:38.940 --> 10:43.040] now when I present them from bottom up because I feel like it's uh, least interesting to [10:43.040 --> 10:48.380] most interesting in that order. So, fourth on the list, or the, the last one I looked at is [10:48.380 --> 10:54.540] called Extreme RAT. Um, anybody, how, who's familiar with Extreme RAT? Has seen it? Ran [10:54.540 --> 10:59.740] into it? Okay, okay. Yeah, it's not the most common APT tool kit. In fact, I wouldn't even [10:59.740 --> 11:04.600] really consider it an APT tool kit thing. It's actually, was a commercial product. This [11:04.600 --> 11:11.140] image here is of the CNC server component. I've got one victim and that drop down list, [11:11.140 --> 11:16.680] lists some of the features that the, the attacker can do to that victim. Uh, this tool was [11:16.680 --> 11:22.300] sold out there on the markets and uh, at some point the source code was leaked and, and the [11:22.300 --> 11:25.800] author just kind of quit selling it. So it's still out there, the source code's leaked out [11:25.800 --> 11:29.460] there and it's still kind of around. There's a lot of variants that base themselves now off [11:29.460 --> 11:34.900] that source code. Um, one of the, it, a lot of the features are very script kiddy-ish, like [11:34.900 --> 11:40.320] you can tell it targets script kiddy guys, like wannabe hackers. In fact, one of the features [11:40.320 --> 11:44.580] it has is you can play fat flash games in the app while you're waiting for somebody to click [11:44.580 --> 11:49.920] on your malware. It's like, if you're not very good, at least you can, you know, play some [11:49.920 --> 11:56.200] Candy Crush or Jewel Quest game while you wait because your phishing email sucks. But [11:56.200 --> 12:02.020] despite this, it's actually uh, been cited in numerous articles as part of targeted [12:02.020 --> 12:08.300] attacks. So, even sophisticated actors like using this tool. Um, it's been cited in attacks [12:08.300 --> 12:13.700] against the Israeli government, uh, in conflicts in Syria and the Gaza Strip. So, kind of [12:13.700 --> 12:19.420] hotbed areas do get hit by this guy. And the easiest way to identify this inside a network is [12:19.420 --> 12:25.760] it's uh, C2 communications. Most of the uh, targets we've seen, it either calls home one of [12:25.760 --> 12:34.040] two ways. Raw TCP or a fake HTTP message. The raw TCP is always start, start, starts out [12:34.040 --> 12:39.940] with the string, my version pipe and then the version, 3.6, 3.7, 3.8. Those are the, the most [12:39.940 --> 12:44.420] common. And the C2 server always responds with the character X followed by line feed [12:44.420 --> 12:49.420] carriage return. That's like super signatureable, right? Like, snore signatures already exist [12:49.420 --> 12:55.260] and such. It's, it's very easy to watch for that. Alternatively, if it does the HTTP requests, [12:55.260 --> 13:01.240] those always take the form of a get request slash some number dot functions. And that some [13:01.240 --> 13:06.620] number is the password that the script kitty uses when they first run the app. And the app [13:06.620 --> 13:10.660] makes sure that the password is up to ten characters, can't be longer than ten and they all [13:10.660 --> 13:17.400] have to be numeric. So, looking for any URL request for, you know, zero to nine or one to [13:17.400 --> 13:23.600] ten character numbers dot functions is gonna hit on this and most exclusively hit on this. I [13:23.600 --> 13:29.100] really doubt there's legitimate traffic going to that URL pattern. And so, this guy, like I [13:29.100 --> 13:34.000] said, their source code out there, it was in Delphi, so I really don't like to read Delphi. So [13:34.000 --> 13:39.460] I just kinda started reviewing some of the basic C2 comms. I, you know, I, I had myself a [13:39.460 --> 13:45.100] victim and I would do all the maneuvers to the victim and watch the C2 traffic go back and [13:45.100 --> 13:54.560] forth. And one thing I noticed that struck my eye was how the C2 server, um, pushes a file down [13:54.560 --> 14:00.800] to its victim. And what it'll do is it'll send a message to the target and say, hey, get ready [14:00.800 --> 14:08.040] to receive my file tool slash bad.exe and save it to your C drive temp as calc.exe. And then [14:08.040 --> 14:14.560] the target will respond back, okay, I'm ready to receive your tool named tool dot bad.exe and [14:14.560 --> 14:19.440] then the data is passed to the victim. And it made me think about this, why does the victim [14:19.440 --> 14:25.220] need to know at all where that file is stored on the server's hard drive? And I was like, [14:25.220 --> 14:28.880] well, maybe it does that because the server doesn't want to keep state. It doesn't want to [14:28.880 --> 14:33.440] keep the, in its memory, the fact that it made this request. Because all the data it really [14:33.440 --> 14:38.820] needs is in the response from the victim. So, turns out that the first packet is even [14:38.820 --> 14:44.480] necessary. As a victim, I can go to the extreme server and say, hey, I'm ready to receive your [14:44.480 --> 14:49.360] file, C drive slash whatever, duh, duh, duh, duh, and if that file exists, it gladly hands it [14:49.360 --> 15:00.860] to me. Yeah, it's kind of a blanket basic mistake. But what can I do with this? [15:00.860 --> 15:04.600] Unfortunately, I can't do a directory listing, so I have to know the file exists. I can do [15:04.600 --> 15:09.720] like brute force all the files, but there's better ideas than that. Um, I didn't take [15:09.720 --> 15:13.740] these, I didn't make these ideas up. This is um, from the link at the bottom. Blind file [15:13.740 --> 15:18.220] retrieval is an, is often a case pen testers get in. So they've thought about this a bit. And [15:18.220 --> 15:21.920] these are some things that they suggest pulling back. The first one is the winini file, [15:21.920 --> 15:25.720] because on any version of Windows, that file exists. So it's like a sanity check. If you can [15:25.720 --> 15:29.680] pull that file back, we're good. More so, if you can pull that file back, you might be able to [15:29.680 --> 15:33.660] tell what version of Windows they have. If you know what version of Windows they have, you [15:33.660 --> 15:38.660] know the path to the event logs. So we can start pulling event logs. If the event logs, [15:38.660 --> 15:43.040] there's usually a lot of good data in there. With fi- if applications crash, you know the [15:43.040 --> 15:47.600] path to the application. If a programming user runs crashes, you may know the pa- the [15:47.600 --> 15:51.560] user, username. So now if we know the username, we can start pulling files out of the [15:51.560 --> 15:55.840] user's home subdirectory, like the desktop.ini. Because that will tell us all the folders [15:55.840 --> 15:59.740] that person has, or files, on their desktop. And we can keep kind of iterating through their [15:59.740 --> 16:04.400] network, this, or, or their computer, finding out things like that. If it's running, if the [16:04.400 --> 16:08.140] attacker is running this program as administrator, then we can always pull the backup of the [16:08.140 --> 16:12.740] SAM database, and then we get their username and passwords. Maybe we can pull the backup of [16:12.740 --> 16:15.620] the registry, because the registry is going to have a whole lot of great information and [16:15.620 --> 16:19.760] things, more things that we can pull from their machine. These are just some ideas of the [16:19.760 --> 16:24.160] things you can do with that bug. And, uh, with that I'm going to move on to the next one. [16:24.160 --> 16:29.500] This one, uh, PlugX, CorePlug, or DeathStory. It's called DeathStory because somebody [16:29.500 --> 16:34.940] misspelled destroy in the source code. Um, but this is a, a, a more common tool. It's been [16:34.940 --> 16:40.200] around since 2008. Uh, the, the back window is the main tool, you see the CNC component, and [16:40.200 --> 16:45.120] the front window is the popup that you can get per victim. And each tab is a set of features [16:45.120 --> 16:50.340] you can do to a victim. This one is a little bit more, I don't know if I'll say [16:50.340 --> 16:55.840] professional, but it's a little bit more tailored. Um, I can tell the source code is [16:55.840 --> 17:00.920] passed around between groups. I see different variants of this out there, but the biggest [17:00.920 --> 17:05.020] changes I see in the variants is just the GUI and not so much the functions underneath. It's [17:05.020 --> 17:09.880] like every new hacker likes to like throw their own GUI on there and put their own QQID on [17:09.880 --> 17:14.420] there and claim that they wrote this. But it's all the same stuff under the hood. Uh, some of [17:14.420 --> 17:18.480] the cool features I've noticed though, uh, it has features for interacting with SQL [17:18.480 --> 17:23.120] databases, for directly hitting the registry, for capturing packets or doing network [17:23.120 --> 17:28.660] monitoring. So it's, it's a pretty feature rich RAP. And it's been cited in a lot of targeted [17:28.660 --> 17:34.220] attacks. Uh, most, uh, recently was one in February, the one that says, uh, oops, they did [17:34.220 --> 17:39.420] it again. Yeah, this tool has been around for quite some time. I can start naming places it's [17:39.420 --> 17:44.920] been used against Afghanistan and India, Mongolia, Jazakistan, Japan, Taiwan, Korea, [17:44.920 --> 17:49.160] Tibetan organizations and it just goes and goes and goes. This thing's been around for quite [17:49.160 --> 17:54.900] some time. This one I did not or I could not get a hold of the source code for. So I was [17:54.900 --> 18:00.660] gonna rely on dynamic analysis and, and fuzzing. And so I was building a fuzzer to try to [18:00.660 --> 18:06.100] fuzz the protocol, how the, the victim talks to the C2 server. And when I got my fuzzer up [18:06.100 --> 18:10.140] and running, this thing would fall over left and right. And I just had a hard enough time [18:10.140 --> 18:15.040] keeping the program running and getting, like, my, the list of bugs and the vulnerabilities [18:15.040 --> 18:19.120] and potential crashes that could be turned into exploits was so high that I got, kinda got [18:19.120 --> 18:24.220] overwhelmed with the fuzzing and decided just to go look at static analysis. And so I, I was [18:24.220 --> 18:28.780] looking at the code and one of the first areas I was looking at was when you receive a [18:28.780 --> 18:33.920] message from the victim, how does it handle it? And they handle it alright. When it receives a [18:33.920 --> 18:38.320] message from the victim, each message or packet as they call it, each message has a little [18:38.320 --> 18:43.180] header that's XOR encoded with their own little made up XOR scheme. And so they decode the [18:43.180 --> 18:48.500] message header and then they look that the message is small enough to sit, to fit on the [18:48.500 --> 18:52.900] stack buffer that they prepared for, right? That, that's a good security track. That, uh, [18:52.900 --> 18:58.800] 61, that F000. So it has to be smaller than 61K, which is a rather large message. If it [18:58.800 --> 19:04.680] doesn't fit, then it shows a pop up message. However, this code to check that the message [19:04.680 --> 19:10.220] will fit on the stack is down here in this decode packet function. Um, you can't see my [19:10.220 --> 19:18.820] mouse. It's on, it's on line 36. But you'll see up on line 29, it copies the packet to the [19:18.820 --> 19:26.900] stack and then later decides maybe I should have checked if it was gonna fit. And so I can, [19:26.900 --> 19:31.160] because it's on the stack, right, we can return, we can overwrite the return address. But the [19:31.160 --> 19:35.300] return address isn't hit until this function leaves. Which means, if I overflow this [19:35.300 --> 19:39.320] buffer, I'm gonna get control as soon as this function finishes, but before the function [19:39.320 --> 19:45.800] finishes, it pops up this pop up message. That very, very clearly tells the attacker what just [19:45.800 --> 19:51.080] happened, right? P, PED code packet. Come on, don't you understand? You just got exploited [19:51.080 --> 19:56.140] buddy. And the funny thing is, no matter what they do, if they click the X or they click the [19:56.140 --> 20:00.520] OK, it doesn't matter because I get code flow either way. They just have to acknowledge this [20:00.520 --> 20:06.720] in some sort of way. Now that's not cool, I agree. Um, but, uh, turns out that this message [20:06.720 --> 20:12.480] is like the de facto error. In fact, if you end map, uh, plug X server, it will show this [20:12.480 --> 20:16.280] message. It just doesn't, this is like, I don't know what happened message is really what [20:16.280 --> 20:23.000] this is trying to say. And so for this one I have a demo, real quick. Uh, I see my mouse. The [20:23.000 --> 20:27.620] right half of the screen is gonna represent, represent the attacker's computer and the left [20:27.620 --> 20:34.520] half of the screen represents the retaliator's computer. I'm gonna start up the, uh, plug X [20:34.520 --> 20:41.920] server. And then I will just point my, my Metasploit script at it. So I'll start up my [20:41.920 --> 20:46.800] plug X Metasploit script. Uh, because it's a VM I already know the IP address so I'm just [20:46.800 --> 20:51.240] gonna type in that IP address and set the attack at that, at that. We'll talk more about how [20:51.240 --> 20:56.960] to find out who to target later. Now, I'm gonna pause this real quick and, and have an [20:56.960 --> 21:02.260] aside. One of those papers or, or the articles I mentioned was a talk from Black Hat, uh, [21:02.260 --> 21:06.520] known as, uh, I Know You Wanna Unplug Me, where they talked about plug X RAT and talked [21:06.520 --> 21:11.520] about the, uh, that's not what I wanted to do. Alright, I'll just start this up while I [21:11.520 --> 21:16.880] talk some more. Um, and they talked about the different variants they observed. And they, in [21:16.880 --> 21:21.720] their terms they observed three types. Where basically they used three different XOR schemes. [21:21.720 --> 21:27.820] They changed. And so, I've written my module to be able to handle each type. But I can't [21:27.820 --> 21:31.500] know ahead of time what type you're targeting. So basically you, you run the check command [21:31.500 --> 21:35.440] and if it's not that right type, we'll change the type and run the check command again until [21:35.440 --> 21:40.200] you validate that you've got the right type. So you see, you see plug X type 1, type 1 old [21:40.200 --> 21:46.280] and type 2. So I run the check command. The check command says yep, you're good. So we'll [21:46.280 --> 21:50.700] hit exploit. It'll pass the attack against the server. There you see the pop up message over [21:50.700 --> 21:56.680] there. Uh, the attacker's like what the heck, kicked X or the victim now. And you see my [21:56.680 --> 22:04.020] interpreter session spinning up. I'm going to do a quick sys info. Yeah, I'll spawn a shell. And [22:04.020 --> 22:17.400] I think notepad, popping notepad, visually there it is. Alright, on to the last one. Uh, [22:17.400 --> 22:22.600] ghost rat. How many of you have seen or heard of ghost rat before? Yeah. Yeah, I like that [22:22.600 --> 22:26.060] hand. So that's, that's exactly what this guy is. Like, it is the one that's been around [22:26.060 --> 22:30.800] forever. Um, at least 10 years. It was really, originally written by a group that called [22:30.800 --> 22:37.540] themselves C. Rufus Security Team, also known as the Red Wolf Security Team. Uh, all, it's [22:37.540 --> 22:44.720] most often cited in tax, attacks that come out of uh, Asia region. Uh, this image is of the C2 [22:44.720 --> 22:49.220] cool toolkit and again you right click on a victim and there's your feature set. Kind of [22:49.220 --> 22:54.680] typical feature set, nothing fancy. Um, this is, this is almost in my opinion the uh, the [22:54.680 --> 22:58.500] measuring stick for rats, is ghost rat. Like they should at least be able to do what it, what [22:58.500 --> 23:06.400] it can do. And ghost rat, it has been cited in so many articles. So many articles. Um, these [23:06.400 --> 23:10.900] are just a few that I can fit on the screen there. Uh, most recently is the one down in the [23:10.900 --> 23:17.660] bottom left, which was just this year. Uh, ghost rat was being spread this eternal blue. So [23:17.660 --> 23:22.840] it's still very popular. I think the oldest one on there, I, I can't find the updates. But [23:22.840 --> 23:28.760] it's been around for at least 10 years. And again, it is uh, very easy to identify based on [23:28.760 --> 23:34.200] it's PCAP, based on it's uh, traffic. It has a signature 5 byte ghost pattern. The first 5 [23:34.200 --> 23:39.760] characters in, in each packet message from the victim to the C2 server or from the C2 server [23:39.760 --> 23:45.720] back to the victim. Now, the source code for ghost rat has been leaked online and so many [23:45.720 --> 23:50.340] people or many attackers chain, know that that ghost is like a big red flag. So they'll try to [23:50.340 --> 23:55.140] change it to something else. Uh, that second image is from a talk uh, Snora gave where he, [23:55.140 --> 23:59.860] these are different 5 byte characters he's seen that change to. They usually always only [23:59.860 --> 24:03.940] change the 5 bytes just because that's easiest and if you change it to something longer, it [24:03.940 --> 24:08.600] requires a lot of other changes in the code. But even still, it's very easy to identify this [24:08.600 --> 24:12.420] no matter what those 5 bytes are because it's always followed by another pattern of 2 [24:12.420 --> 24:17.260] integers and then a compressed buffer. So it's still very easy to identify no matter what the [24:17.260 --> 24:24.480] 5 byte character is. And like extreme rat, it was, it had a very similar logic bug. But this [24:24.480 --> 24:29.620] one is the other way around. When it's requesting a file from its victim, it will tell the [24:29.620 --> 24:35.620] victim, hey, give me your local file, you know, document user file dot doc so I can save it to [24:35.620 --> 24:40.640] this path. Like, well that's very nice. Here's the data, you can save it to that path. Oh, by [24:40.640 --> 24:46.200] the way, I also have the second file that I'd like you to save to your startup folder. [24:47.260 --> 24:52.100] And sure enough, if you know the path to their startup folder, it will put it right there. Now, [24:52.100 --> 24:56.640] the startup file folder changes in different versions of Windows. So that's not the most [24:56.640 --> 25:00.260] reliable way. If you can in map their machine and tell what version of Windows they have, then [25:00.260 --> 25:05.980] boom, you can do this. But, um, I had to find a better way. And sure enough, Ghost Rat has [25:05.980 --> 25:12.260] another very handy for me. It is, uh, vulnerable to a DLL side load attack. Meaning if I just [25:12.260 --> 25:18.520] drop a file named OLE D- DLG, uh, a dynamic library right in that same folder, the local [25:18.520 --> 25:23.580] folder, then it will try to load that file whenever Ghost starts up. And it's looking for [25:23.580 --> 25:29.640] only one function in that fol- in that, uh, DLL and that is OLE UI busy. It's basically a [25:29.640 --> 25:35.000] function that can ask, is the UI busy? And it expects to hear a 1 as a return from that. I [25:35.000 --> 25:39.220] don't know, a 1 means not busy. It's really confusing. But anyways, all you have to do is [25:39.220 --> 25:45.060] make a, you make your malware into a D- uh, DLL, have it export this 1 function that just [25:45.060 --> 25:50.380] returns 1 all the time and Ghost will be none the wiser. It doesn't break anything doing that. [25:50.560 --> 25:55.120] And the next time Ghost starts up, it'll load your malware and, or every time Ghost starts [25:55.120 --> 25:59.560] up, it'll load your malware. So that was cool, but it requires dropping something to disk and [25:59.560 --> 26:04.360] I, I wasn't done picking on Ghost yet. Cause Ghost, like I said, had the source code, so I [26:04.360 --> 26:08.540] started looking at the source code and right away this one stood out to me. It didn't, I [26:08.540 --> 26:13.940] mean I found it in like an hour or 2. It's basically, this is in the handling of the drive [26:13.940 --> 26:18.840] list as given from a victim. So when the victim says, oh I have drive C, D and E, it's, it's [26:18.840 --> 26:24.460] in a buffer, right? And you'll notice on that second line, it just assumes that the list, it [26:24.460 --> 26:28.120] takes the length as given from the victim rather than assuming the length is less than its [26:28.120 --> 26:34.160] buffer size. So if I pass it a list of drives that are longer than the usual max of 26, then I [26:34.160 --> 26:40.160] can overflow a buffer within this particular C class. So the buffer you're over, I'm [26:40.160 --> 26:45.600] overflowing is in line 45, the remote drive list, which means I can overwrite any one of those [26:45.600 --> 26:53.800] um, objects below inside the class. A lot of those objects below are other C classes. So I can [26:53.800 --> 26:58.200] overwrite the pointer to those C classes, then when a, when the actual code flow tries to [26:58.200 --> 27:04.740] call a function in one of those C classes, it's gonna end up calling a pointer to a pointer [27:04.740 --> 27:09.700] that I control that needs to point to another pointer that points to my code flow. So I [27:09.700 --> 27:13.860] basically have to set up a pointer to a pointer to a function that I want to run. Which is [27:13.860 --> 27:18.060] kind of messy. Uh, pointer to pointers aren't really the funnest things to use for [27:18.060 --> 27:24.540] exploitation. But um, they work. If I had an information disclosure or if that would give me [27:24.540 --> 27:28.880] the layout of memory, that would make pointer to pointer uh, code flow pretty easy. But I'm [27:28.880 --> 27:33.180] lazy. I didn't spend time looking for that. And I knew that I could just do a heap spray and [27:33.180 --> 27:36.660] have a really good chance of landing in my own heap. So that's what I did instead. I did the [27:36.660 --> 27:40.660] lazy man's approach. Um, after I released these modules, I would love to see somebody maybe [27:41.160 --> 27:46.840] who's more willing to do work than I am. Uh, make, make the exploit a little bit cleaner [27:46.840 --> 27:52.820] that way. But nonetheless, that's what I did. Um, depth would break this approach, but depth [27:52.820 --> 27:57.820] seems to break the, the executable. Wh- whenever I'd run ghost rat on a machine that forced [27:57.820 --> 28:03.060] depth execution or if I opted in, ghost would just crash. It wouldn't even run. So, didn't [28:03.060 --> 28:07.180] need to really worry about depth. That could probably be changed, but it wasn't a problem for [28:07.180 --> 28:12.420] me. Now before I go on to show that uh, demo there of the video, I wanted to talk about [28:12.420 --> 28:16.160] uh, something that uh, another researcher called Kevin the Hermit has done, or Kev the [28:16.160 --> 28:21.100] Hermit. Um, he has written a number of decoders. So if you're given a piece of malware from [28:21.100 --> 28:25.820] any one of the, the, these families, with the exception of PlugX, you can run the script on it [28:25.820 --> 28:30.380] and it'll extract from that piece of malware, the C2 address that it was spent, meant to call [28:30.380 --> 28:35.520] home to, along with some other configuration data. So if you're the victim of one of these [28:35.520 --> 28:40.680] attacks and you find this file, you can pass it to a script, find the address of the C2 server [28:40.680 --> 28:46.520] and then we can use Metasploit to attack that C2 server. But uh, if you're too imp- so if [28:46.520 --> 28:50.440] you're too impatient to wait for yourself to be attacked, you could always search virus [28:50.440 --> 28:56.000] total for, you know, these files or just do a quick search for ghost, you know, rat uh, [28:56.000 --> 29:02.060] samples and find quite a few. Some may be old, some might not. Or, Shodan was very nice [29:02.060 --> 29:07.220] recently and added a malware hunter feature that looks for C2 servers and one of the C2 [29:07.220 --> 29:12.320] servers that they look for is ghosts. So we could just do a quick shopping list off of Shodan [29:12.320 --> 29:21.980] and, and have some fun. Um, again, this demo is same setup, attacker or, or adversary on the [29:21.980 --> 29:27.900] right, uh, retaliator on the left. Um, and this one I'm gonna do just slightly different in [29:27.900 --> 29:33.340] that I'm gonna build a malware sample from the ghost rat tool and I'm gonna pass that [29:33.340 --> 29:38.580] malware sample to the retaliator and then using that script that uh, KevTheHermit wrote, [29:38.580 --> 29:43.960] extract the C2 info and then use that to attack back. So I made the sample and then I wasn't [29:43.960 --> 29:50.480] thinking and I closed ghost rat. Oops, I pressed a button. Alright, sorry to make you watch [29:50.480 --> 29:56.520] it again. Yeah, so I make the sample and then I'm gonna just drag it out of the VM. Uh, in a [29:56.520 --> 30:02.580] usual case, right, it'll arrive via an email or a watery hole attack but I'm not gonna go [30:02.580 --> 30:07.700] through all that. We all know how those work. So I just drag the file out of the VM and then [30:07.700 --> 30:17.700] I'm gonna run the rat decoder script on that sample. If I can type fast. There it is. Um, and [30:17.700 --> 30:22.800] you can see there the C2 address and the port that, that, that it's looking to go to. I [30:22.800 --> 30:27.480] realized my mistake, started back up the ghost rat server and on the left I'm starting up [30:27.480 --> 30:33.140] Metasploit and then I'm gonna load my module, um, set the remote address to the remote [30:33.140 --> 30:50.390] address that we extracted from the malware itself. Uh, just quick info showing what's [30:50.390 --> 30:55.950] available. I don't wanna click pause, I'll try, I'll try. No I won't, I don't dare. So if you [30:55.950 --> 31:01.610] find a C2 server that doesn't use the ghost magic, you can just set the magic to be, match [31:01.610 --> 31:07.030] whatever the ghost, the, the server is. And I throw my exploit. Now it's gonna take just a [31:07.030 --> 31:10.350] minute because I'm spraying the heap so I'm spending a lot of data, sending a lot of data [31:10.350 --> 31:17.070] over. But there we see the, uh, stage, uh, interpreter session starting. Uh, I'm going to do [31:17.070 --> 31:22.330] the same set of commands. I'm gonna, as soon as it comes back, uh, do the sysinfo, spawn a [31:23.450 --> 31:29.530] shell, and this time I think I'll pop calc just to be different. Yes. There she is. On a [31:29.530 --> 31:41.280] Windows 10 machine. So that begs the question, then what? What do we do now? To be honest, I'm [31:41.280 --> 31:48.640] not quite sure. This is an area that hasn't really been discussed, at least publicly. But [31:49.680 --> 31:55.540] here's what I would suggest maybe. And maybe these are bad ideas, I'm not sure. Um, [31:55.540 --> 31:59.360] somebody else should, could decide. I don't know. But, uh, one of the first things I would be [31:59.360 --> 32:04.140] interested in doing would be netstat. Because netstat would tell you all other connections to [32:04.140 --> 32:08.480] that box. If there are other victims behind, beside yourself, they would be, they would show [32:08.480 --> 32:13.600] up in this netstat listing. So you could find out who else was targeted. Um, every one of [32:13.600 --> 32:18.380] these C2 tools has a folder for the files that have been downloaded from victims. And I [32:18.380 --> 32:22.040] would look at that. I would see what files had they pulled from other victims. What were [32:22.040 --> 32:29.320] they interested in? What did they pull from you? Um, also, maybe you would want to install [32:29.320 --> 32:33.040] some sort of persistence so you can stick around longer. Maybe you'd want to install a [32:33.040 --> 32:36.160] keylogger to see what else they're up to. If they're dumb enough to log into Facebook from [32:36.160 --> 32:42.340] their, uh, ops machine, who knows? A lot of different things that are optional to do. But [32:42.340 --> 32:48.300] whatever you do, I highly suggest you don't go the revenge route, but you sit quiet and you [32:48.300 --> 32:53.300] listen. Because I feel like that's where the most value in these are, right? The more you [32:53.300 --> 33:00.080] observe about your adversary, the, the more likely you are to, to win in the long run. So [33:00.080 --> 33:04.020] with that, that's about all I had. I appreciate you guys coming and, and spending the time [33:04.020 --> 33:19.000] here. This URL and, thank you. Thank you. That URL is where I currently have a fork of the [33:19.000 --> 33:23.720] Metasploit until I can get them, um, pulled up into the main branch. And it depends on how [33:23.720 --> 33:27.600] well I am at, at, uh, meeting all the check marks before that'll happen. So you can grab it [33:27.600 --> 33:29.860] there until they're released. Again, thanks anyways.