WEBVTT 00:00.000 --> 00:09.200 So, like the title suggests, we're going to be exploiting some CNC servers today, or at least exploiting some CNC toolkits. 00:09.520 --> 00:16.240 Before I get right into that though, these are, at least best to my knowledge, new exploits. 00:16.520 --> 00:20.980 And at the end of this, I will be releasing the Metasploit modules for these exploits. 00:21.180 --> 00:26.460 Before I get there though, I just, I don't want the focus to be so much about these exploits. 00:26.460 --> 00:28.820 I mean, I think they're cool, they're remote code execution. 00:29.280 --> 00:37.900 But the take away should be, if you're a vulnerability researcher, like this field of looking at CNC servers for exploits, is a right field. 00:37.900 --> 00:47.120 There's low laying fruit everywhere and I really don't feel like people are, or a lot of researchers are looking at it, or if they're looking at it, they're very, they're using them just for themselves and not really sharing. 00:47.280 --> 00:54.680 So, um, key take away is this is, this is a really interesting field and I highly recommend anybody who's into vulnerability research to jump into it. 00:55.040 --> 00:58.700 So, before I get started on the exploits, I'm going to do a little bit of background. 00:58.700 --> 01:02.020 I'm going to talk a little bit about some legal stuff, but then we'll, then we'll get into the exploits. 01:02.820 --> 01:05.080 Um, so background on me a little bit. 01:05.340 --> 01:09.660 I've been in this computer, computer security community for over 10 years. 01:09.660 --> 01:12.920 I currently work at, uh, Symantec as a threat researcher. 01:13.080 --> 01:18.900 Before that, I worked for the, uh, DOD doing COE, C&E, C&O, C&A. 01:19.880 --> 01:23.840 Um, and I've had done some time in the trenches as well. 01:23.940 --> 01:28.800 I was an IT administrator before that, so I know what it's like down in the field. 01:28.800 --> 01:32.760 I feel like I kind of have a good round understanding of, uh, this particular area. 01:32.980 --> 01:37.000 With all that being said, the disclaimer should come as no surprise to anybody. 01:37.000 --> 01:46.560 Um, everything I'm about to say up here does not represent any of the opinions, uh, or my opinions do not represent the views of my current or former employers. 01:46.560 --> 01:48.000 Make that clear. 01:48.000 --> 01:54.560 Um, what I'm going to discuss is probably illegal, so what you do with it is up to you. 01:54.560 --> 01:59.080 If you do cool stuff with it, I'd love to hear about it, but what you do, it's your own risk. 01:59.080 --> 01:59.560 Cool? 01:59.560 --> 02:00.860 We got that covered. 02:01.280 --> 02:05.960 Alright, so, let me talk about what really led me into this field. 02:05.960 --> 02:13.740 And that's one thing that bothers me about the security community, the security defense industry, is that there's this defeatist attitude out there, right? 02:13.740 --> 02:16.760 Like, no matter how hard we try, we're gonna lose. 02:16.800 --> 02:21.260 And if you went into, like, a basketball game with that kind of attitude, like, it's not gonna work. 02:21.260 --> 02:25.580 But somehow we expect that it's okay for the security community, right? 02:25.580 --> 02:33.880 Like, I hear this sophisticated actor term passed around all the time as if it's some kind of excuse why a company got hacked. 02:34.180 --> 02:39.140 And I don't, I don't really understand what they're trying to convey by using that term. 02:39.360 --> 02:48.380 If, if I, I try to picture, like, that conversation with the sea levels when you're trying to explain what just happened, uh, sir, we've been hacked. 02:48.840 --> 02:50.740 What, what, how did, how did they get in? 02:50.740 --> 02:52.360 Oh, well, they were sophisticated. 02:53.320 --> 02:55.960 Like, how do you know they were sophisticated? 02:56.700 --> 03:01.040 Well, they were wearing a monocle , so they're clearly a sophisticated actor. 03:01.420 --> 03:04.760 You know, like, what, what does sophisticated mean in this context? 03:04.760 --> 03:09.420 Whatever it means, I don't think it means what they're even trying to persuade it means, right? 03:09.420 --> 03:21.160 I think they're trying to persuade, or, or, to convey, excuse me, that it means that this attacker was so far beyond what we can just, defenders can do that we just can't win. 03:21.280 --> 03:23.160 And so that's what I set out with this to say. 03:23.160 --> 03:32.020 I was like, well, I'm going to take a look at the tools that these sophisticated actors are using and let's just see if we're, if they're vulnerable to attacks, if somebody was to attack them back. 03:32.140 --> 03:33.920 And so that's where I went with this. 03:34.800 --> 03:38.900 Now, Hacking Pack has been a very hot topic over the years, right? 03:38.900 --> 03:46.220 Five years ago, at Black Hat, they did an anonymous survey asking people if they've participated in hacking back in some form. 03:46.300 --> 03:51.500 And anonymously, over a third of the people surveyed admitted to it. 03:51.740 --> 03:58.640 Uh, a lot of times, when a company's hacked, they want justice, they want revenge, they want that person to pay for what they've done. 03:58.640 --> 04:04.420 So they'll go to law enforcement and law enforcement has their hands tied, or can't do anything, or has no recourse. 04:04.420 --> 04:06.680 They, sorry, we can't do anything about this. 04:06.680 --> 04:09.820 And so, companies kind of feel obligated to take this on themselves. 04:09.820 --> 04:11.820 Uh, I, I'm just going to do it myself. 04:12.400 --> 04:20.020 Add to that, this, uh, new draft bill that, uh, Senator Tom Graves, uh, out of Georgia is preparing to present. 04:20.020 --> 04:25.240 It's called the Active Cyber Defense Certainty Act, the ACDC Act. 04:25.240 --> 04:26.420 I love the acronym. 04:27.320 --> 04:38.080 But, um, it's basically a bill that will allow those who have been hacked to be exempt from hacking laws when their aim is to attack their assailant. 04:38.120 --> 04:39.700 So this is kind of an interesting idea. 04:39.700 --> 04:43.020 If this was proposed, if this draft makes it through Congress. 04:43.620 --> 04:48.140 However, generally, like, first thought, this is a very, very bad idea, right? 04:48.140 --> 04:51.480 Like, this is a game you're not going to win in the end result. 04:51.920 --> 04:55.680 Uh, as a corporation , you're, it's first off, it's probably illegal. 04:55.680 --> 04:58.640 Even if that's made legal, it's still very iffy. 04:59.040 --> 05:07.580 Um, you, you gotta take into fact all the lost productivity while you send your best guys, rather than defending your network, you're now sending them to go attack. 05:07.720 --> 05:09.460 Um, not to mention the liability. 05:09.460 --> 05:17.120 What if they attack the wrong server or the attacks came from some other company and then that company realized they've been attacked by you, so they hacked back you, right? 05:17.120 --> 05:30.200 Like this escalation game, it's like the cyber, you know, the war games movie where all these guys are like hacking everybody else because one little guy, so basically I, I felt like that, that, uh, the AI's conclusion from that movie applies very well to this. 05:30.200 --> 05:33.800 It's probably the best strategy not to play this game at all. 05:34.340 --> 05:43.480 That being said, I do see a very useful or a very niche area where hacking back, it would be a good thing. 05:43.480 --> 05:47.400 And it wouldn't be a good thing in terms of revenge or taking the guys out. 05:47.540 --> 05:50.600 But you see, I work as a security researcher as my day job. 05:50.600 --> 05:56.040 So I try to track these, I try to track targeted attacks, I try to figure out who's behind this type of attack. 05:56.160 --> 06:13.520 And if I could figure out how the person acts that's behind the attack, what files they stole, who else they're targeting, like this kind of information, if I was to hack back and sit on their machine and, and observe, that kind of information is great for defenders because then I could tell you, 06:13.520 --> 06:17.260 these are the other tools they use, this is the industries they're targeting, this is the files they want. 06:17.260 --> 06:23.380 It's very useful in that sense, not so much in the sense of just striking back to get revenge. 06:23.820 --> 06:29.420 And to be honest, to be fair to the ACDC act, that's actually the verbiage it's trying to convey. 06:29.440 --> 06:45.520 Uh, the act itself clearly says that you cannot attack back for the purposes of causing physical or financial injury or to try to destroy data or, or machines that, you basically can't just try to break their machine, which is a good idea anyways because if you break their machine, 06:45.520 --> 06:48.260 they're probably just gonna show up somewhere else anyways. 06:48.800 --> 06:59.280 But instead, the act says you can, you can attack back for these purposes, um, is to establish attribution of the criminal activity and to monitor the behavior of an attacker. 06:59.620 --> 07:07.660 Also in the bill, it says you, you must, um, share with law enforcement that you plan to do this attack and how you plan to do this and gonna give them some details beforehand. 07:08.060 --> 07:18.080 Um, I don't know, I, anyways, I don't plan to spend forever talking about legal stuff and I know that's not why you came here either. 07:18.260 --> 07:26.580 But I just wanna, uh, so I'll end my rants now, but I just wanna kinda convey that what I'm about to discuss in the very near future could be legal. 07:26.580 --> 07:32.840 So this is maybe potential tools like it could be legal and this is showing it could be very plausible. 07:33.560 --> 07:37.880 So before I get into some things, I wanna make sure we got terminology clear. 07:37.880 --> 07:44.660 In some circles, I've seen the client and server names for rats reversed and that really bothers me. 07:44.820 --> 07:53.120 So the person who has the implant or the malware running is going to be the victim or the tar- I'm gonna call him the target. 07:53.120 --> 07:58.500 I'm gonna try and avoid victim and I'm gonna try and avoid client just because that one gets some people confused. 07:58.500 --> 08:04.260 And the reason I'm avoiding victim is because the attacker in the original scenario is gonna be our victim. 08:04.260 --> 08:07.460 So attacker, victim, probably terms I'm gonna try to stay away from. 08:07.700 --> 08:12.340 Um, and I'm introducing a new one that is the person who's tacking back, I will call the retaliator. 08:12.340 --> 08:17.960 I really like that term because the dictionary definition is one who returns assault in kind. 08:18.060 --> 08:22.900 Uh, we're gonna be hitting them with our own medicine here so I felt like retaliator is the right name for this. 08:24.420 --> 08:35.320 Um, a little while ago, one of my co- colleagues, he took all the recent APT reports, the sophisticated actor reports and he kinda summed it up into, uh, most popular tools. 08:35.320 --> 08:40.320 Uh, most reference tools out of those papers and he posted this on a Twitter feed. 08:40.340 --> 08:44.440 And I saw this list and I was like, uh, that is my shopping list. 08:44.440 --> 08:49.500 I'm gonna start at the top and just start working my way down, finding an exploit in each. 08:49.960 --> 08:58.060 And so if you'll notice, the top one is poison ivy and if any of you recall or are aware, there is already an exploit out there for poison ivy. 08:58.060 --> 09:02.340 Uh, the two individuals at the bottom of this slide developed that. 09:02.340 --> 09:06.080 I'm not gonna try to pronounce their names because I would not do well. 09:06.080 --> 09:12.440 Um, but uh, they developed a remote code execution vulnerability against the poison ivy C2 server. 09:13.080 --> 09:26.500 And interesting enough, after the Mandiant APT1 report, the malware LU guys noticed that that APT1 group was using the poison ivy server so they used this exploit to hack back into their infrastructure. 09:26.500 --> 09:29.100 But they documented the whole thing and published it. 09:29.100 --> 09:38.580 And this is one of the rare cases where we have of somebody doing a hack back for attribution or for monitoring purposes and it really shows how successful it can be. 09:38.640 --> 09:52.120 Um, this picture, the farthest picture on the right is a diagram that they show that they were giving, trying to show us how they built their, the attackers had their infrastructure set up, how they had some VMs and some proxies to try to protect things. 09:52.120 --> 09:57.900 They also were able to pull back some additional tools the attackers were using and they exposed them publicly. 09:58.000 --> 10:00.460 And it was, it's very insightful paper. 10:00.460 --> 10:03.460 Uh, they called it the APT1 technical backstage. 10:03.500 --> 10:05.900 Um, it came out I believe in 2013. 10:05.940 --> 10:07.640 It's been around for a little while now. 10:07.640 --> 10:13.620 It's a really good read but I think it's one of the rare cases where we can see how useful this type of uh, activity is. 10:14.140 --> 10:16.160 Another one on that list was dark comment. 10:16.160 --> 10:18.600 It also has public exploits. 10:18.600 --> 10:22.040 This is a blind file retrieval by these individuals. 10:22.080 --> 10:26.580 I don't have any, or I didn't find any public documentation of anybody using this publicly. 10:27.400 --> 10:30.260 But I just, I figured I'd mention it just for complete lists. 10:30.900 --> 10:33.940 And with that, we're gonna start playing with our new stuff. 10:34.180 --> 10:44.600 I'm gonna start, so I know I told you I started on my list and worked my way down, but I'm gonna work now when I present them from bottom up because I feel like it's uh, least interesting to most interesting in that order. 10:44.660 --> 10:50.280 So, fourth on the list, or the, the last one I looked at is called Extreme RAT. 10:50.360 --> 10:53.600 Um, anybody, how, who's familiar with Extreme RAT? 10:53.600 --> 10:54.340 Has seen it? 10:54.340 --> 10:55.140 Ran into it? 10:55.140 --> 10:56.220 Okay, okay. 10:56.240 --> 10:58.640 Yeah, it's not the most common APT tool kit. 10:58.640 --> 11:01.700 In fact, I wouldn't even really consider it an APT tool kit thing. 11:01.700 --> 11:04.400 It's actually, was a commercial product. 11:04.400 --> 11:08.100 This image here is of the CNC server component. 11:08.100 --> 11:15.260 I've got one victim and that drop down list, lists some of the features that the, the attacker can do to that victim. 11:15.620 --> 11:23.880 Uh, this tool was sold out there on the markets and uh, at some point the source code was leaked and, and the author just kind of quit selling it. 11:23.880 --> 11:27.260 So it's still out there, the source code's leaked out there and it's still kind of around. 11:27.260 --> 11:30.300 There's a lot of variants that base themselves now off that source code. 11:30.500 --> 11:38.800 Um, one of the, it, a lot of the features are very script kiddy-ish, like you can tell it targets script kiddy guys, like wannabe hackers. 11:38.980 --> 11:45.420 In fact, one of the features it has is you can play fat flash games in the app while you're waiting for somebody to click on your malware. 11:45.420 --> 11:54.740 It's like, if you're not very good, at least you can, you know, play some Candy Crush or Jewel Quest game while you wait because your phishing email sucks. 11:55.680 --> 12:02.740 But despite this, it's actually uh, been cited in numerous articles as part of targeted attacks. 12:02.740 --> 12:07.000 So, even sophisticated actors like using this tool. 12:07.000 --> 12:12.860 Um, it's been cited in attacks against the Israeli government, uh, in conflicts in Syria and the Gaza Strip. 12:12.860 --> 12:16.080 So, kind of hotbed areas do get hit by this guy. 12:16.460 --> 12:21.340 And the easiest way to identify this inside a network is it's uh, C2 communications. 12:21.680 --> 12:26.360 Most of the uh, targets we've seen, it either calls home one of two ways. 12:26.360 --> 12:30.780 Raw TCP or a fake HTTP message. 12:30.780 --> 12:39.200 The raw TCP is always start, start, starts out with the string, my version pipe and then the version, 3.6, 3.7, 3.8. 12:39.200 --> 12:40.740 Those are the, the most common. 12:40.800 --> 12:45.440 And the C2 server always responds with the character X followed by line feed carriage return. 12:45.440 --> 12:47.360 That's like super signatureable, right? 12:47.360 --> 12:50.400 Like, snore signatures already exist and such. 12:50.400 --> 12:52.260 It's, it's very easy to watch for that. 12:52.460 --> 13:00.680 Alternatively, if it does the HTTP requests, those always take the form of a get request slash some number dot functions. 13:00.740 --> 13:06.140 And that some number is the password that the script kitty uses when they first run the app. 13:06.140 --> 13:12.000 And the app makes sure that the password is up to ten characters, can't be longer than ten and they all have to be numeric. 13:12.080 --> 13:23.540 So, looking for any URL request for, you know, zero to nine or one to ten character numbers dot functions is gonna hit on this and most exclusively hit on this. 13:23.540 --> 13:26.600 I really doubt there's legitimate traffic going to that URL pattern. 13:27.540 --> 13:33.780 And so, this guy, like I said, their source code out there, it was in Delphi, so I really don't like to read Delphi. 13:33.780 --> 13:38.140 So I just kinda started reviewing some of the basic C2 comms. 13:38.140 --> 13:45.480 I, you know, I, I had myself a victim and I would do all the maneuvers to the victim and watch the C2 traffic go back and forth . 13:45.480 --> 13:55.520 And one thing I noticed that struck my eye was how the C2 server, um, pushes a file down to its victim. 13:55.520 --> 14:07.300 And what it'll do is it'll send a message to the target and say, hey, get ready to receive my file tool slash bad.exe and save it to your C drive temp as calc.exe. 14:07.480 --> 14:16.600 And then the target will respond back, okay, I'm ready to receive your tool named tool dot bad.exe and then the data is passed to the victim. 14:16.920 --> 14:24.760 And it made me think about this, why does the victim need to know at all where that file is stored on the server's hard drive? 14:24.840 --> 14:28.440 And I was like, well, maybe it does that because the server doesn't want to keep state. 14:28.440 --> 14:32.040 It doesn't want to keep the, in its memory, the fact that it made this request. 14:32.040 --> 14:35.820 Because all the data it really needs is in the response from the victim. 14:36.240 --> 14:39.800 So, turns out that the first packet is even necessary. 14:39.880 --> 14:50.080 As a victim, I can go to the extreme server and say, hey, I'm ready to receive your file, C drive slash whatever, duh, duh, duh, duh, and if that file exists, it gladly hands it to me. 14:55.680 --> 14:59.380 Yeah, it's kind of a blanket basic mistake. 14:59.400 --> 15:00.860 But what can I do with this? 15:00.860 --> 15:04.020 Unfortunately, I can't do a directory listing, so I have to know the file exists. 15:04.020 --> 15:08.900 I can do like brute force all the files, but there's better ideas than that. 15:08.920 --> 15:10.980 Um, I didn't take these, I didn't make these ideas up. 15:10.980 --> 15:13.040 This is um, from the link at the bottom. 15:13.100 --> 15:16.680 Blind file retrieval is an, is often a case pen testers get in. 15:16.680 --> 15:17.980 So they've thought about this a bit. 15:17.980 --> 15:20.280 And these are some things that they suggest pulling back. 15:20.280 --> 15:24.220 The first one is the winini file, because on any version of Windows, that file exists. 15:24.220 --> 15:25.400 So it's like a sanity check. 15:25.400 --> 15:27.220 If you can pull that file back, we're good. 15:27.420 --> 15:31.700 More so, if you can pull that file back, you might be able to tell what version of Windows they have. 15:31.700 --> 15:35.300 If you know what version of Windows they have, you know the path to the event logs. 15:35.300 --> 15:37.000 So we can start pulling event logs. 15:37.360 --> 15:40.780 If the event logs, there's usually a lot of good data in there. 15:40.780 --> 15:44.400 With fi- if applications crash, you know the path to the application. 15:44.760 --> 15:48.980 If a programming user runs crashes, you may know the pa- the user, username. 15:49.240 --> 15:54.320 So now if we know the username, we can start pulling files out of the user's home subdirectory, like the desktop.ini. 15:54.320 --> 15:58.040 Because that will tell us all the folders that person has, or files, on their desktop. 15:58.040 --> 16:02.640 And we can keep kind of iterating through their network, this, or, or their computer, finding out things like that. 16:03.260 --> 16:10.440 If it's running, if the attacker is running this program as administrator, then we can always pull the backup of the SAM database, and then we get their username and passwords. 16:10.640 --> 16:17.760 Maybe we can pull the backup of the registry, because the registry is going to have a whole lot of great information and things, more things that we can pull from their machine. 16:18.360 --> 16:21.000 These are just some ideas of the things you can do with that bug. 16:21.980 --> 16:24.160 And, uh, with that I'm going to move on to the next one. 16:24.160 --> 16:28.080 This one, uh, PlugX, CorePlug, or DeathStory. 16:28.080 --> 16:31.760 It's called DeathStory because somebody misspelled destroy in the source code. 16:31.920 --> 16:34.740 Um, but this is a, a, a more common tool. 16:34.740 --> 16:36.620 It's been around since 2008. 16:36.880 --> 16:43.480 Uh, the, the back window is the main tool, you see the CNC component, and the front window is the popup that you can get per victim. 16:43.480 --> 16:46.780 And each tab is a set of features you can do to a victim. 16:46.920 --> 16:52.640 This one is a little bit more, I don't know if I'll say professional, but it's a little bit more tailored. 16:52.940 --> 16:57.500 Um, I can tell the source code is passed around between groups. 16:57.500 --> 17:04.860 I see different variants of this out there, but the biggest changes I see in the variants is just the GUI and not so much the functions underneath. 17:04.860 --> 17:11.540 It's like every new hacker likes to like throw their own GUI on there and put their own QQID on there and claim that they wrote this. 17:11.540 --> 17:13.580 But it's all the same stuff under the hood. 17:14.060 --> 17:23.640 Uh, some of the cool features I've noticed though, uh, it has features for interacting with SQL databases, for directly hitting the registry, for capturing packets or doing network monitoring. 17:23.640 --> 17:26.120 So it's, it's a pretty feature rich RAP. 17:26.160 --> 17:29.620 And it's been cited in a lot of targeted attacks. 17:29.620 --> 17:35.140 Uh, most, uh, recently was one in February, the one that says, uh, oops, they did it again. 17:35.160 --> 17:37.800 Yeah, this tool has been around for quite some time. 17:37.800 --> 17:48.180 I can start naming places it's been used against Afghanistan and India, Mongolia, Jazakistan, Japan, Taiwan, Korea, Tibetan organizations and it just goes and goes and goes. 17:48.180 --> 17:50.000 This thing's been around for quite some time. 17:50.680 --> 17:54.380 This one I did not or I could not get a hold of the source code for. 17:54.380 --> 17:58.160 So I was gonna rely on dynamic analysis and, and fuzzing. 17:58.180 --> 18:04.460 And so I was building a fuzzer to try to fuzz the protocol, how the, the victim talks to the C2 server. 18:04.780 --> 18:08.700 And when I got my fuzzer up and running, this thing would fall over left and right. 18:08.700 --> 18:22.720 And I just had a hard enough time keeping the program running and getting, like, my, the list of bugs and the vulnerabilities and potential crashes that could be turned into exploits was so high that I got, kinda got overwhelmed with the fuzzing and decided just to go look at static analysis. 18:23.280 --> 18:30.900 And so I, I was looking at the code and one of the first areas I was looking at was when you receive a message from the victim, how does it handle it? 18:31.080 --> 18:32.640 And they handle it alright. 18:32.640 --> 18:41.960 When it receives a message from the victim, each message or packet as they call it, each message has a little header that's XOR encoded with their own little made up XOR scheme. 18:42.020 --> 18:50.500 And so they decode the message header and then they look that the message is small enough to sit, to fit on the stack buffer that they prepared for, right? 18:50.500 --> 18:52.260 That, that's a good security track. 18:52.260 --> 18:54.620 That, uh, 61, that F000. 18:54.620 --> 18:58.120 So it has to be smaller than 61K, which is a rather large message. 18:58.300 --> 19:01.360 If it doesn't fit, then it shows a pop up message. 19:01.900 --> 19:09.160 However, this code to check that the message will fit on the stack is down here in this decode packet function. 19:09.420 --> 19:10.740 Um, you can't see my mouse. 19:10.740 --> 19:14.360 It's on, it's on line 36. 19:14.680 --> 19:23.600 But you'll see up on line 29, it copies the packet to the stack and then later decides maybe I should have checked if it was gonna fit. 19:24.780 --> 19:30.720 And so I can, because it's on the stack, right, we can return, we can overwrite the return address. 19:30.720 --> 19:33.200 But the return address isn't hit until this function leaves. 19:33.200 --> 19:42.140 Which means, if I overflow this buffer, I'm gonna get control as soon as this function finishes, but before the function finishes, it pops up this pop up message. 19:42.140 --> 19:47.120 That very, very clearly tells the attacker what just happened, right? 19:47.360 --> 19:49.000 P, PED code packet. 19:49.000 --> 19:50.300 Come on, don't you understand? 19:50.300 --> 19:51.800 You just got exploited buddy. 19:52.380 --> 19:59.280 And the funny thing is, no matter what they do, if they click the X or they click the OK, it doesn't matter because I get code flow either way. 19:59.280 --> 20:02.120 They just have to acknowledge this in some sort of way. 20:02.460 --> 20:04.160 Now that's not cool, I agree. 20:04.340 --> 20:08.660 Um, but, uh, turns out that this message is like the de facto error. 20:08.660 --> 20:13.060 In fact, if you end map, uh, plug X server, it will show this message. 20:13.060 --> 20:17.520 It just doesn't, this is like, I don't know what happened message is really what this is trying to say. 20:18.120 --> 20:20.800 And so for this one I have a demo, real quick. 20:21.000 --> 20:22.640 Uh, I see my mouse. 20:22.640 --> 20:31.000 The right half of the screen is gonna represent, represent the attacker's computer and the left half of the screen represents the retaliator's computer. 20:31.240 --> 20:35.400 I'm gonna start up the, uh, plug X server. 20:36.720 --> 20:40.800 And then I will just point my, my Metasploit script at it. 20:40.800 --> 20:43.660 So I'll start up my plug X Metasploit script. 20:43.900 --> 20:50.460 Uh, because it's a VM I already know the IP address so I'm just gonna type in that IP address and set the attack at that, at that. 20:50.460 --> 20:52.960 We'll talk more about how to find out who to target later. 20:53.920 --> 20:57.700 Now, I'm gonna pause this real quick and, and have an aside. 20:57.940 --> 21:08.800 One of those papers or, or the articles I mentioned was a talk from Black Hat, uh, known as, uh, I Know You Wanna Unplug Me, where they talked about plug X RAT and talked about the, uh, that's not what I wanted to do. 21:09.860 --> 21:12.380 Alright, I'll just start this up while I talk some more. 21:12.520 --> 21:16.300 Um, and they talked about the different variants they observed. 21:16.300 --> 21:19.480 And they, in their terms they observed three types. 21:19.520 --> 21:21.720 Where basically they used three different XOR schemes. 21:21.720 --> 21:22.400 They changed. 21:22.400 --> 21:26.440 And so, I've written my module to be able to handle each type. 21:26.460 --> 21:29.860 But I can't know ahead of time what type you're targeting. 21:29.860 --> 21:37.400 So basically you, you run the check command and if it's not that right type, we'll change the type and run the check command again until you validate that you've got the right type. 21:37.480 --> 21:41.300 So you see, you see plug X type 1, type 1 old and type 2. 21:41.620 --> 21:42.940 So I run the check command. 21:42.940 --> 21:45.440 The check command says yep, you're good. 21:45.720 --> 21:47.260 So we'll hit exploit. 21:47.260 --> 21:49.340 It'll pass the attack against the server. 21:49.340 --> 21:51.420 There you see the pop up message over there. 21:51.680 --> 21:55.620 Uh, the attacker's like what the heck, kicked X or the victim now. 21:55.940 --> 21:58.640 And you see my interpreter session spinning up. 21:58.780 --> 22:00.560 I'm going to do a quick sys info. 22:01.060 --> 22:03.200 Yeah, I'll spawn a shell. 22:03.580 --> 22:07.200 And I think notepad, popping notepad, visually there it is. 22:14.740 --> 22:16.980 Alright, on to the last one. 22:16.980 --> 22:18.300 Uh, ghost rat. 22:18.300 --> 22:20.800 How many of you have seen or heard of ghost rat before? 22:21.040 --> 22:21.760 Yeah. 22:21.760 --> 22:22.820 Yeah, I like that hand. 22:22.820 --> 22:24.400 So that's, that's exactly what this guy is. 22:24.400 --> 22:27.020 Like, it is the one that's been around forever. 22:27.060 --> 22:28.580 Um, at least 10 years. 22:28.580 --> 22:31.700 It was really, originally written by a group that called themselves C. 22:31.700 --> 22:36.120 Rufus Security Team, also known as the Red Wolf Security Team. 22:36.340 --> 22:42.700 Uh, all, it's most often cited in tax, attacks that come out of uh, Asia region. 22:42.920 --> 22:48.880 Uh, this image is of the C2 cool toolkit and again you right click on a victim and there's your feature set. 22:48.920 --> 22:51.520 Kind of typical feature set, nothing fancy. 22:51.520 --> 22:56.940 Um, this is, this is almost in my opinion the uh, the measuring stick for rats, is ghost rat. 22:56.940 --> 22:59.460 Like they should at least be able to do what it, what it can do. 22:59.940 --> 23:03.880 And ghost rat, it has been cited in so many articles. 23:03.880 --> 23:05.180 So many articles. 23:05.460 --> 23:08.660 Um, these are just a few that I can fit on the screen there. 23:08.800 --> 23:13.860 Uh, most recently is the one down in the bottom left, which was just this year. 23:13.940 --> 23:17.260 Uh, ghost rat was being spread this eternal blue. 23:17.380 --> 23:19.480 So it's still very popular. 23:19.480 --> 23:22.740 I think the oldest one on there, I, I can't find the updates. 23:22.740 --> 23:24.760 But it's been around for at least 10 years. 23:25.300 --> 23:30.880 And again, it is uh, very easy to identify based on it's PCAP, based on it's uh, traffic. 23:31.040 --> 23:33.660 It has a signature 5 byte ghost pattern. 23:33.660 --> 23:40.860 The first 5 characters in, in each packet message from the victim to the C2 server or from the C2 server back to the victim. 23:41.440 --> 23:49.700 Now, the source code for ghost rat has been leaked online and so many people or many attackers chain, know that that ghost is like a big red flag. 23:49.700 --> 23:51.560 So they'll try to change it to something else. 23:51.560 --> 23:58.240 Uh, that second image is from a talk uh, Snora gave where he, these are different 5 byte characters he's seen that change to. 23:58.240 --> 24:05.980 They usually always only change the 5 bytes just because that's easiest and if you change it to something longer, it requires a lot of other changes in the code. 24:05.980 --> 24:15.060 But even still, it's very easy to identify this no matter what those 5 bytes are because it's always followed by another pattern of 2 integers and then a compressed buffer. 24:15.060 --> 24:18.760 So it's still very easy to identify no matter what the 5 byte character is. 24:19.220 --> 24:24.120 And like extreme rat, it was, it had a very similar logic bug. 24:24.120 --> 24:26.220 But this one is the other way around. 24:26.220 --> 24:36.680 When it's requesting a file from its victim, it will tell the victim, hey, give me your local file, you know, document user file dot doc so I can save it to this path. 24:36.880 --> 24:38.360 Like, well that's very nice. 24:38.360 --> 24:40.260 Here's the data, you can save it to that path. 24:40.260 --> 24:46.200 Oh, by the way, I also have the second file that I'd like you to save to your startup folder. 24:47.260 --> 24:51.220 And sure enough, if you know the path to their startup folder, it will put it right there. 24:51.400 --> 24:55.800 Now, the startup file folder changes in different versions of Windows. 24:55.800 --> 24:57.380 So that's not the most reliable way. 24:57.380 --> 25:01.200 If you can in map their machine and tell what version of Windows they have, then boom, you can do this. 25:01.200 --> 25:03.760 But, um, I had to find a better way. 25:04.260 --> 25:07.880 And sure enough, Ghost Rat has another very handy for me. 25:07.880 --> 25:10.920 It is, uh, vulnerable to a DLL side load attack. 25:10.980 --> 25:22.680 Meaning if I just drop a file named OLE D- DLG, uh, a dynamic library right in that same folder, the local folder, then it will try to load that file whenever Ghost starts up. 25:22.680 --> 25:28.440 And it's looking for only one function in that fol- in that, uh, DLL and that is OLE UI busy. 25:28.440 --> 25:31.500 It's basically a function that can ask, is the UI busy? 25:31.780 --> 25:34.700 And it expects to hear a 1 as a return from that. 25:34.700 --> 25:36.800 I don't know, a 1 means not busy. 25:36.800 --> 25:37.660 It's really confusing. 25:37.660 --> 25:48.900 But anyways, all you have to do is make a, you make your malware into a D- uh, DLL, have it export this 1 function that just returns 1 all the time and Ghost will be none the wiser. 25:48.900 --> 25:50.380 It doesn't break anything doing that. 25:50.560 --> 25:56.360 And the next time Ghost starts up, it'll load your malware and, or every time Ghost starts up, it'll load your malware. 25:56.560 --> 26:01.560 So that was cool, but it requires dropping something to disk and I, I wasn't done picking on Ghost yet. 26:02.000 --> 26:07.880 Cause Ghost, like I said, had the source code, so I started looking at the source code and right away this one stood out to me. 26:07.880 --> 26:10.480 It didn't, I mean I found it in like an hour or 2. 26:10.500 --> 26:15.380 It's basically, this is in the handling of the drive list as given from a victim. 26:15.380 --> 26:19.600 So when the victim says, oh I have drive C, D and E, it's, it's in a buffer, right? 26:19.600 --> 26:29.040 And you'll notice on that second line, it just assumes that the list, it takes the length as given from the victim rather than assuming the length is less than its buffer size. 26:29.040 --> 26:38.240 So if I pass it a list of drives that are longer than the usual max of 26, then I can overflow a buffer within this particular C class. 26:38.640 --> 26:49.400 So the buffer you're over, I'm overflowing is in line 45, the remote drive list, which means I can overwrite any one of those um, objects below inside the class. 26:49.540 --> 26:52.980 A lot of those objects below are other C classes. 26:53.040 --> 27:09.500 So I can overwrite the pointer to those C classes, then when a, when the actual code flow tries to call a function in one of those C classes, it's gonna end up calling a pointer to a pointer that I control that needs to point to another pointer that points to my code flow. 27:09.500 --> 27:13.300 So I basically have to set up a pointer to a pointer to a function that I want to run. 27:13.300 --> 27:14.980 Which is kind of messy. 27:15.080 --> 27:18.960 Uh, pointer to pointers aren't really the funnest things to use for exploitation. 27:19.940 --> 27:21.560 But um, they work. 27:21.640 --> 27:28.460 If I had an information disclosure or if that would give me the layout of memory, that would make pointer to pointer uh, code flow pretty easy. 27:28.460 --> 27:29.360 But I'm lazy. 27:29.360 --> 27:30.920 I didn't spend time looking for that. 27:30.920 --> 27:35.240 And I knew that I could just do a heap spray and have a really good chance of landing in my own heap. 27:35.240 --> 27:36.360 So that's what I did instead. 27:36.360 --> 27:37.820 I did the lazy man's approach. 27:37.900 --> 27:43.180 Um, after I released these modules, I would love to see somebody maybe who's more willing to do work than I am. 27:43.400 --> 27:47.420 Uh, make, make the exploit a little bit cleaner that way. 27:47.420 --> 27:49.720 But nonetheless, that's what I did. 27:49.960 --> 27:54.660 Um, depth would break this approach, but depth seems to break the, the executable. 27:54.660 --> 28:00.900 Wh- whenever I'd run ghost rat on a machine that forced depth execution or if I opted in, ghost would just crash. 28:00.900 --> 28:01.920 It wouldn't even run. 28:01.920 --> 28:04.340 So, didn't need to really worry about depth. 28:04.340 --> 28:07.760 That could probably be changed, but it wasn't a problem for me. 28:08.260 --> 28:16.780 Now before I go on to show that uh, demo there of the video, I wanted to talk about uh, something that uh, another researcher called Kevin the Hermit has done, or Kev the Hermit. 28:16.780 --> 28:19.340 Um, he has written a number of decoders. 28:19.340 --> 28:32.840 So if you're given a piece of malware from any one of the, the, these families, with the exception of PlugX, you can run the script on it and it'll extract from that piece of malware, the C2 address that it was spent, meant to call home to, along with some other configuration data. 28:32.960 --> 28:43.820 So if you're the victim of one of these attacks and you find this file, you can pass it to a script, find the address of the C2 server and then we can use Metasploit to attack that C2 server. 28:44.260 --> 28:57.960 But uh, if you're too imp- so if you're too impatient to wait for yourself to be attacked, you could always search virus total for, you know, these files or just do a quick search for ghost, you know, rat uh, samples and find quite a few. 28:57.960 --> 28:59.980 Some may be old, some might not. 29:00.000 --> 29:09.220 Or, Shodan was very nice recently and added a malware hunter feature that looks for C2 servers and one of the C2 servers that they look for is ghosts. 29:09.460 --> 29:14.300 So we could just do a quick shopping list off of Shodan and, and have some fun. 29:15.740 --> 29:24.380 Um, again, this demo is same setup, attacker or, or adversary on the right, uh, retaliator on the left. 29:24.500 --> 29:41.360 Um, and this one I'm gonna do just slightly different in that I'm gonna build a malware sample from the ghost rat tool and I'm gonna pass that malware sample to the retaliator and then using that script that uh, KevTheHermit wrote, extract the C2 info and then use that to attack back. 29:41.760 --> 29:45.660 So I made the sample and then I wasn't thinking and I closed ghost rat. 29:45.660 --> 29:47.000 Oops, I pressed a button. 29:48.920 --> 29:51.100 Alright, sorry to make you watch it again. 29:51.480 --> 29:55.720 Yeah, so I make the sample and then I'm gonna just drag it out of the VM. 29:55.740 --> 30:02.880 Uh, in a usual case, right, it'll arrive via an email or a watery hole attack but I'm not gonna go through all that. 30:02.880 --> 30:04.260 We all know how those work. 30:04.680 --> 30:11.560 So I just drag the file out of the VM and then I'm gonna run the rat decoder script on that sample. 30:13.040 --> 30:14.820 If I can type fast. 30:16.200 --> 30:17.300 There it is. 30:17.300 --> 30:22.520 Um, and you can see there the C2 address and the port that, that, that it's looking to go to. 30:22.520 --> 30:36.180 I realized my mistake, started back up the ghost rat server and on the left I'm starting up Metasploit and then I'm gonna load my module, um, set the remote address to the remote address that we extracted from the malware itself. 30:48.370 --> 30:51.290 Uh, just quick info showing what's available. 30:51.290 --> 30:53.610 I don't wanna click pause, I'll try, I'll try. 30:53.610 --> 30:54.830 No I won't, I don't dare. 30:54.830 --> 31:03.550 So if you find a C2 server that doesn't use the ghost magic, you can just set the magic to be, match whatever the ghost, the, the server is. 31:04.110 --> 31:05.650 And I throw my exploit. 31:05.830 --> 31:10.870 Now it's gonna take just a minute because I'm spraying the heap so I'm spending a lot of data, sending a lot of data over. 31:10.870 --> 31:14.630 But there we see the, uh, stage, uh, interpreter session starting. 31:15.170 --> 31:18.230 Uh, I'm going to do the same set of commands. 31:18.230 --> 31:26.670 I'm gonna, as soon as it comes back, uh, do the sysinfo, spawn a shell , and this time I think I'll pop calc just to be different. 31:27.390 --> 31:28.110 Yes. 31:28.110 --> 31:28.730 There she is. 31:28.790 --> 31:30.310 On a Windows 10 machine. 31:35.860 --> 31:38.340 So that begs the question, then what? 31:38.340 --> 31:39.580 What do we do now? 31:39.940 --> 31:42.780 To be honest, I'm not quite sure. 31:43.160 --> 31:47.660 This is an area that hasn't really been discussed, at least publicly. 31:48.300 --> 31:52.180 But here's what I would suggest maybe. 31:52.180 --> 31:54.800 And maybe these are bad ideas, I'm not sure. 31:55.120 --> 31:57.020 Um, somebody else should, could decide. 31:57.020 --> 31:57.520 I don't know. 31:57.520 --> 32:01.400 But, uh, one of the first things I would be interested in doing would be netstat. 32:01.440 --> 32:05.020 Because netstat would tell you all other connections to that box. 32:05.020 --> 32:10.380 If there are other victims behind, beside yourself, they would be, they would show up in this netstat listing. 32:10.380 --> 32:12.300 So you could find out who else was targeted. 32:12.800 --> 32:18.060 Um, every one of these C2 tools has a folder for the files that have been downloaded from victims. 32:18.060 --> 32:19.480 And I would look at that. 32:19.480 --> 32:21.800 I would see what files had they pulled from other victims. 32:21.800 --> 32:23.080 What were they interested in? 32:23.080 --> 32:24.540 What did they pull from you? 32:25.540 --> 32:31.640 Um, also, maybe you would want to install some sort of persistence so you can stick around longer. 32:31.640 --> 32:34.260 Maybe you'd want to install a keylogger to see what else they're up to. 32:34.260 --> 32:39.240 If they're dumb enough to log into Facebook from their, uh, ops machine, who knows? 32:39.780 --> 32:42.120 A lot of different things that are optional to do. 32:42.120 --> 32:49.060 But whatever you do, I highly suggest you don't go the revenge route, but you sit quiet and you listen. 32:49.300 --> 32:52.560 Because I feel like that's where the most value in these are, right? 32:52.560 --> 32:58.580 The more you observe about your adversary, the, the more likely you are to, to win in the long run. 32:59.640 --> 33:01.780 So with that, that's about all I had. 33:01.780 --> 33:04.620 I appreciate you guys coming and, and spending the time here. 33:04.720 --> 33:06.920 This URL and, thank you. 33:15.280 --> 33:16.140 Thank you. 33:16.140 --> 33:22.440 That URL is where I currently have a fork of the Metasploit until I can get them, um, pulled up into the main branch. 33:22.560 --> 33:26.800 And it depends on how well I am at, at, uh, meeting all the check marks before that'll happen. 33:26.800 --> 33:28.760 So you can grab it there until they're released. 33:28.760 --> 33:29.860 Again, thanks anyways.