1
00:00:05,750 --> 00:00:10,610
Hello, welcome to DEFCON 28 Demo Labs.

2
00:00:10,610 --> 00:00:15,490
Today I'm going to show you a tool called Circo, version 2.

3
00:00:16,030 --> 00:00:18,470
Hello, virtual friend.

4
00:00:18,470 --> 00:00:20,270
My name is Emilio.

5
00:00:20,410 --> 00:00:36,350
I'm from Argentina, I'm currently located in Japan, and I have a background of hacking, networks, firewall, packets, electronics, and a bit of 3D printing as well.

6
00:00:36,350 --> 00:00:51,490
I present tools in various conferences around Asia, US, Europe, a bit of here and there, and I'm actually 16 hours ahead DEFCON, so I'm in the future.

7
00:00:51,850 --> 00:00:58,870
As you can see, my English is very Argentinian, and I'm definitely not a native programmer.

8
00:00:58,870 --> 00:01:01,530
So, let's move on to Circo.

9
00:01:05,420 --> 00:01:11,280
All right, before I actually move on, let's talk about the legal disclaimer.

10
00:01:11,780 --> 00:01:16,420
This tool is provided for educational, research, or testing purposes.

11
00:01:16,420 --> 00:01:21,740
Using this tool against network systems without permission is illegal.

12
00:01:22,100 --> 00:01:32,540
Radio waves are per country regulated, so you must check your own country to see if that you're doing within compliant regulations, etc.

13
00:01:33,260 --> 00:01:38,620
I'm not responsible for any good or bad things you do with it, blah, blah, blah.

14
00:01:38,620 --> 00:01:40,080
Okay, great.

15
00:01:40,220 --> 00:01:43,680
Wait, what is Circo version 1 if this is version 2?

16
00:01:44,080 --> 00:01:52,320
All right, so Circo version 1 is actually based on Python 2.

17
00:01:52,320 --> 00:02:04,160
It was a network implant using cheap hardware like Raspberry Pi, and the idea is to exploit the zero trust that network automation tools have these days.

18
00:02:04,260 --> 00:02:10,980
The whole concept of the network automation tool is to auto-discover things, like Cisco switches, for example.

19
00:02:11,000 --> 00:02:12,980
So, what about if I am a Cisco switch?

20
00:02:12,980 --> 00:02:16,920
That means that they will try to connect to me to grab my configurations?

21
00:02:17,220 --> 00:02:18,020
Exactly.

22
00:02:18,020 --> 00:02:31,260
So, the whole concept of that was, okay, I build with cheap hardware in Cisco switch, behavior as a Cisco switch, as a honeypot, basically, and then I wait for automation tools to connect to me.

23
00:02:31,320 --> 00:02:40,160
So, once they connect to me and they give me the credentials, thank you very much, I will actually exfiltrate it to the Internet, to my own Internet server.

24
00:02:40,420 --> 00:02:51,200
For that, I come up with a few different techniques for exfiltration, and also some additions of encryptions and anti-forensics, etc.

25
00:02:51,960 --> 00:03:10,840
Over the past year, well, actually over 2019, most of the features and techniques used here were actually feedback from when I was presenting this tool in various conferences and friends and people suggesting things.

26
00:03:10,840 --> 00:03:14,540
So, it improved over the time.

27
00:03:14,540 --> 00:03:19,580
So, just to show you how it looks actually version 1.

28
00:03:20,880 --> 00:03:22,720
Let me turn off the camera.

29
00:03:22,720 --> 00:03:35,400
So, version 1 used to be like a network outlet that you have these things on top of your desk or under your desk where you put the network ports here, and inside was actually things like this, right?

30
00:03:35,420 --> 00:03:39,700
Raspberry Pi and some electronics, buttons, etc.

31
00:03:41,960 --> 00:03:48,260
Also, there's a bigger box of it, similar concept, the network ports here, right?

32
00:03:48,380 --> 00:03:59,060
And you actually, inside of this, let me see if I can open it like that, you will have a Raspberry Pi and electronics and PoE, etc, etc.

33
00:04:00,200 --> 00:04:04,280
So, that's pretty much what was done with version 1, right?

34
00:04:07,490 --> 00:04:08,970
Okay, great.

35
00:04:08,970 --> 00:04:10,110
Good to know.

36
00:04:11,470 --> 00:04:14,850
So, what's version 2 about it?

37
00:04:14,850 --> 00:04:23,290
Well, basically, Python 2 wasn't supposed to be allegedly end of life, blah, blah, blah, so it needed to be Python 3.

38
00:04:23,390 --> 00:04:32,290
So, I dedicated time and migrated everything to Python 3, which is not that simple as replacing Python with Python 3 on the top.

39
00:04:32,290 --> 00:04:34,090
Nope, doesn't work like that.

40
00:04:34,090 --> 00:04:36,990
So, most of the stuff was recoded.

41
00:04:36,990 --> 00:04:40,390
Probably 70-80% of the code was recoded.

42
00:04:40,390 --> 00:04:43,210
So, I took the opportunity and make it modular code.

43
00:04:43,270 --> 00:04:51,530
So, that will allow me to easily add all the features and exfiltration techniques using modular code, right?

44
00:04:51,710 --> 00:04:56,150
Also, I have a couple of features that people suggest over the past.

45
00:04:56,150 --> 00:05:00,710
For example, MAC IP addresses spoofing when you do exfiltration.

46
00:05:00,710 --> 00:05:13,710
Also, I've been suggested to actually, because I'm tapping, I'm man-in-the-middle between a phone and a network, I also record calls, like getting audio files.

47
00:05:13,710 --> 00:05:14,810
I do.

48
00:05:14,930 --> 00:05:27,790
I add support for a tool called netcreds, which actually captures unencrypted credentials or hashes of NTLM, HTTP, SMTP, IMAP, etc.

49
00:05:27,790 --> 00:05:29,270
Kerberos as well, right?

50
00:05:29,610 --> 00:05:30,950
FTP, etc.

51
00:05:30,950 --> 00:05:33,570
Yeah, various ones.

52
00:05:33,770 --> 00:05:39,390
I add as well, before I used to use either magnet or push buttons to detect if someone opened the alarm.

53
00:05:39,390 --> 00:05:43,470
And now I'm using LDR, which is a light sensor, basically.

54
00:05:44,530 --> 00:05:50,310
And I add an extra exfiltration method using FM.

55
00:05:50,630 --> 00:05:56,330
Because the phone itself will authenticate, I also collect in that zip authentication hash.

56
00:05:56,330 --> 00:06:03,070
And I add a new camouflage hardware, which will be something very familiar to you.

57
00:06:04,850 --> 00:06:14,350
If you recall, this is a power injector from Cisco, used for phones, also for APs as well.

58
00:06:14,590 --> 00:06:18,570
So I'm actually going to use this as a new camouflage hardware.

59
00:06:18,570 --> 00:06:24,650
Instead of using these boxes, network outlets, I'm going to use one of these.

60
00:06:24,650 --> 00:06:25,650
Why not?

61
00:06:26,330 --> 00:06:31,510
For that, I add also the TCP exfiltration.

62
00:06:31,790 --> 00:06:37,030
Before it used to be HTTP, HTTPS, now it's any TCP port you would like to use.

63
00:06:37,030 --> 00:06:39,270
80, 40, 25, whatever.

64
00:06:39,830 --> 00:06:45,370
Because I'm using a new method for exfiltration, FM, so you will probably need one of these.

65
00:06:45,370 --> 00:06:48,930
Which is actually an SDR dongle, right?

66
00:06:48,930 --> 00:06:52,950
To be able to capture those radio waves.

67
00:06:52,950 --> 00:06:59,070
And also improve a lot of the Cisco IOS and Honeypot.

68
00:06:59,070 --> 00:07:08,750
So the Telnet, when I recode it, I improve the Telnet, the SSH, the CDP and LLDP demos, right?

69
00:07:09,390 --> 00:07:16,900
OK, so let's go back to here, right?

70
00:07:16,900 --> 00:07:21,200
These are all the things that have been added in version 2.

71
00:07:21,200 --> 00:07:24,900
Which will go today, just to recap.

72
00:07:25,160 --> 00:07:29,580
We have what Honeypot will provide as a Cisco services.

73
00:07:29,580 --> 00:07:35,760
Remember, we are trying to emulate the Cisco switch, so we do provide CDP and LLDP advertisements.

74
00:07:36,100 --> 00:07:40,080
As a Cisco switch, or actually phone, if you want to run in single mode.

75
00:07:40,080 --> 00:07:43,780
We also provide an SNMP agent, so you can actually pull.

76
00:07:43,780 --> 00:07:50,880
That's the idea of the automation system, to pull the SNMP communities, SNMP MIPS from the Cisco switch.

77
00:07:50,880 --> 00:07:59,720
So we have one of those, we provide CLI via Telnet and SSH, with quite a few commands.

78
00:07:59,840 --> 00:08:08,100
And also a TCP stack, so when we get fingerprinting, we can actually reply saying that we are a Cisco switch indeed.

79
00:08:09,100 --> 00:08:20,740
For exfiltration, when we exfiltrate data, we actually send it, the Honeypot will send the credentials via Telnet or SSH or SNMP.

80
00:08:20,740 --> 00:08:23,640
So we have different various formats, right?

81
00:08:23,640 --> 00:08:28,760
The T for Telnet, the Telnet enable, the SSH, SSH enable, SNMP.

82
00:08:28,760 --> 00:08:36,960
And also because now we are sniffing credentials, that the actual phone could be cascaded to a PC behind it.

83
00:08:36,960 --> 00:08:40,640
So we are using netcreds, so that will be the end.

84
00:08:40,640 --> 00:08:47,420
And also the zip, which is the voice hashes that we actually capture.

85
00:08:47,900 --> 00:08:53,800
So I didn't want to make this longer, so now demo labs, demo time, right?

86
00:08:56,220 --> 00:09:03,980
Okay, so behind me, you will see I set up a lab, actually.

87
00:09:03,980 --> 00:09:06,800
I will explain you what the lab consists of.

88
00:09:06,800 --> 00:09:16,860
The lab actually has, on this side, this case you see here, this is actually the whole network infrastructure.

89
00:09:17,120 --> 00:09:21,120
I have the blue box on the top, it's actually my internet server.

90
00:09:21,120 --> 00:09:26,680
The yellow box is actually my network automation, so network administration server inside the network.

91
00:09:26,680 --> 00:09:34,100
The Cisco switch, real one, called TK, it's called SH-TKY01.

92
00:09:34,100 --> 00:09:43,800
I also have a black box, which is my file, my proxy, DNS, DHCP, pack file, server, etc.

93
00:09:44,400 --> 00:09:51,640
On this side, I have connected an IP phone, cascaded to a PC, right?

94
00:09:51,640 --> 00:09:56,640
And in the middle, you will see this box, right?

95
00:09:56,640 --> 00:10:01,940
This, which contains one cable going to the phone, the white cable, right?

96
00:10:01,940 --> 00:10:05,660
And the other cable going to the infrastructure, right?

97
00:10:05,860 --> 00:10:12,560
And of course, power, because this is using a magic power cable, right?

98
00:10:13,140 --> 00:10:14,000
Are we good?

99
00:10:14,000 --> 00:10:15,320
Yes, okay.

100
00:10:15,480 --> 00:10:20,000
So, let's move on.

101
00:10:22,820 --> 00:10:28,660
Okay, on the right side, I got access to my yellow box, which is my network automation.

102
00:10:28,660 --> 00:10:35,460
On the bottom, I have access to my blue box, which is my internet server, which will be receiving, called CARPA, right?

103
00:10:35,460 --> 00:10:38,120
Will be receiving the credentials from the internet.

104
00:10:38,120 --> 00:10:44,240
And on the top, I have access to the circo, which is actually out of band.

105
00:10:44,240 --> 00:10:47,540
So, first of all, let's start CARPA.

106
00:10:55,760 --> 00:11:02,540
And before I start circo, I want to connect to the real switch.

107
00:11:03,220 --> 00:11:05,980
This is the real circo switch on my infrastructure.

108
00:11:06,460 --> 00:11:09,640
Switch Tokyo 01, show CDP neighbors.

109
00:11:09,640 --> 00:11:13,800
Okay, I have a CDP, which is the phone, actually, that you saw on the back.

110
00:11:15,360 --> 00:11:16,640
LDP.

111
00:11:17,740 --> 00:11:20,880
Nothing, because that phone only speaks CDP.

112
00:11:21,040 --> 00:11:30,120
Right, so, I'm going to start circo on the reverse mode, bridge mode, and actually, maybe, ping, right?

113
00:11:30,860 --> 00:11:32,540
That's an exfiltration.

114
00:11:35,020 --> 00:11:37,860
So, I will explain you before.

115
00:11:38,680 --> 00:11:47,260
Before this happened, what I do is actually collect CDP details and LDP from the actual PR switch, just to get the names.

116
00:11:47,260 --> 00:11:52,240
I'm going to derivate the name, so if... similar name to what already exists.

117
00:11:52,580 --> 00:11:59,120
Okay, I change my MAC address, get an IP address from the server.

118
00:12:02,280 --> 00:12:17,080
I start a few as a sniffer, create a template, and bring all the honeypots, which is all of this, CDP, LDP, IOS, Telnet, SSH, SNMP, and also the name of OS Fuller to the TCP fingerprint.

119
00:12:17,660 --> 00:12:19,720
Service is actually fingerprinted, right?

120
00:12:19,720 --> 00:12:21,780
An exfiltration, I select ping, right?

121
00:12:21,780 --> 00:12:28,100
Okay, so now if I do show CDP neighbor from the real switch, I can see there is another switch here.

122
00:12:28,100 --> 00:12:31,740
Okay, so CDP neighbor details.

123
00:12:31,780 --> 00:12:42,340
I can see the switch is called SWTKY03, has a 10.10.10.152, and is 2960 ATC.

124
00:12:42,500 --> 00:12:44,540
So, what about LLDP?

125
00:12:45,500 --> 00:12:47,140
DP neighbors.

126
00:12:47,140 --> 00:12:52,100
Okay, LLDP as well, I can see the same switch connected via CDP and LLDP.

127
00:12:52,100 --> 00:13:04,840
If I do the details, I can see the chassis, which match the MAC address I'm setting up, the interface, the name, the software version running, and the capabilities from the switch itself.

128
00:13:04,840 --> 00:13:06,940
And the VLAN ID also, right?

129
00:13:06,940 --> 00:13:10,060
Standard LLDP information you get.

130
00:13:11,660 --> 00:13:14,370
Alright, so I'm in my automation tool.

131
00:13:14,680 --> 00:13:19,320
Let's see if I can ping that 152, 10.10.10.152.

132
00:13:19,380 --> 00:13:21,040
Yes, I can ping it.

133
00:13:22,240 --> 00:13:29,600
Alright, so let's try 10.10.10.152.

134
00:13:30,420 --> 00:13:32,420
Okay, I connect.

135
00:13:32,500 --> 00:13:34,080
So let me type.

136
00:13:36,320 --> 00:13:38,600
Username and a password.

137
00:13:38,600 --> 00:13:40,820
Okay, I got access to the Cisco switch.

138
00:13:40,820 --> 00:13:43,000
Show version.

139
00:13:43,600 --> 00:13:46,000
Give me a version of the Cisco switch.

140
00:13:46,000 --> 00:13:50,820
If you see on the circuit itself, it starts to say, sending credentials via ping.

141
00:13:50,820 --> 00:13:52,580
That means that he got credentials.

142
00:13:52,580 --> 00:13:56,440
So those credentials will appear on the bottom screen on Carpa, right?

143
00:13:56,440 --> 00:13:58,140
Because they're coming via ping.

144
00:13:58,140 --> 00:14:02,100
Carpa is on the internet, and Cisco is on the internal network, right?

145
00:14:04,460 --> 00:14:05,900
Show inventory.

146
00:14:06,760 --> 00:14:08,600
Show IP route.

147
00:14:08,780 --> 00:14:10,460
Show interface description.

148
00:14:10,460 --> 00:14:11,540
Behave like a Cisco.

149
00:14:11,540 --> 00:14:14,340
Show IP app.

150
00:14:14,340 --> 00:14:16,220
Show MAC address.

151
00:14:16,240 --> 00:14:18,680
Show status.

152
00:14:20,580 --> 00:14:21,380
Alright?

153
00:14:21,380 --> 00:14:27,360
As you can see on the bottom of the screen, you see that credentials coming from protocolternet.

154
00:14:27,360 --> 00:14:30,320
Username hola, password descon.

155
00:14:30,740 --> 00:14:31,600
You see?

156
00:14:31,660 --> 00:14:33,420
What about if I do enable now?

157
00:14:34,160 --> 00:14:36,060
I can enable as well.

158
00:14:36,060 --> 00:14:41,460
I can do some commands, like show run.

159
00:14:43,880 --> 00:14:46,000
And give me a configuration.

160
00:14:46,060 --> 00:14:47,640
But I cannot do some commands.

161
00:14:47,980 --> 00:14:53,380
I'm not authorizing, because I didn't code the whole iOS honeypot.

162
00:14:53,380 --> 00:14:56,500
Just enough for automation tool to find out.

163
00:14:57,480 --> 00:15:00,220
Similar should work by SSH.

164
00:15:00,800 --> 00:15:02,300
You can see in Carpa.

165
00:15:02,300 --> 00:15:06,200
Now Carpa received a credential via Ternet.

166
00:15:06,340 --> 00:15:08,660
And the credential was secret.

167
00:15:09,220 --> 00:15:10,720
Elite mode, right?

168
00:15:11,880 --> 00:15:15,840
So I can also, I should be able to SSH as well.

169
00:15:21,480 --> 00:15:24,160
Yep, I got this via SSH.

170
00:15:24,160 --> 00:15:25,240
Same thing.

171
00:15:25,240 --> 00:15:28,000
Same commands via SSH and Ternet are provided.

172
00:15:28,540 --> 00:15:29,280
Right?

173
00:15:29,600 --> 00:15:30,800
Inventory.

174
00:15:31,360 --> 00:15:33,500
Also I can put enable.

175
00:15:36,760 --> 00:15:39,320
Again, I get the same commands, right?

176
00:15:43,410 --> 00:15:45,370
So what else we can do?

177
00:15:45,370 --> 00:15:48,070
Well, we can do an SNMP walk, right?

178
00:15:49,770 --> 00:15:51,830
Version 2, community.

179
00:15:51,830 --> 00:15:53,330
Here's a trick, right?

180
00:15:53,370 --> 00:15:58,690
Automation tool will try first their own community, the internal community they use in all devices.

181
00:15:58,690 --> 00:16:02,950
If that fails, they will switch to public, right?

182
00:16:02,950 --> 00:16:08,700
So let's try community.

183
00:16:09,100 --> 00:16:13,140
10.10.10.152, right?

184
00:16:13,600 --> 00:16:16,380
I should escape that.

185
00:16:17,460 --> 00:16:19,060
Wrong key.

186
00:16:22,840 --> 00:16:30,220
So what happened here, you can see on the Carpa in the meantime, that credentials start to arrive.

187
00:16:30,640 --> 00:16:34,780
My pass, SSH, user admin, my pass, right?

188
00:16:34,780 --> 00:16:40,940
When I do an SNMP walk for this community, I don't get any answer.

189
00:16:41,140 --> 00:16:43,260
However, I did capture it.

190
00:16:44,160 --> 00:16:49,420
So automation tools will try public if they will fail back to public, right?

191
00:16:49,420 --> 00:16:51,620
And if I do that, let me cut it.

192
00:16:52,760 --> 00:17:00,220
When I do public, it actually replies as a Cisco switch with the name SWTKY03, right?

193
00:17:00,220 --> 00:17:02,320
So it behaves as a Cisco switch.

194
00:17:03,940 --> 00:17:07,000
Okay, what else we can try?

195
00:17:07,140 --> 00:17:15,960
Oh, by the way, let me show you all those credentials that Carpa is storing in a text file.

196
00:17:16,020 --> 00:17:18,380
There you go, the enable password.

197
00:17:18,980 --> 00:17:24,100
All those credentials are being stored in a text file, of course, but they're also being pushed to Faraday.

198
00:17:25,280 --> 00:17:40,820
So if I log to my Faraday dashboard, if I go to manage, hosts, it will create automatically a host and you also add credentials to it.

199
00:17:40,820 --> 00:17:45,380
So you see that host, it has a telnet, the username and the password.

200
00:17:45,840 --> 00:17:48,220
The E stands for enable, of course, right?

201
00:17:49,240 --> 00:17:53,600
So those are being pushed automatically from Carpa into Faraday, right?

202
00:17:55,480 --> 00:17:56,520
Oops.

203
00:17:58,280 --> 00:17:59,240
All right.

204
00:18:00,080 --> 00:18:02,760
The SNMP did not arrive yet.

205
00:18:03,980 --> 00:18:05,880
It should arrive soon.

206
00:18:06,320 --> 00:18:11,100
I think I'm cycling the credentials every 60 seconds, 30 seconds, I can't remember.

207
00:18:11,200 --> 00:18:12,440
So what about now?

208
00:18:12,440 --> 00:18:14,160
Let's try nmap.

209
00:18:16,740 --> 00:18:19,920
sv for 10.10.152.

210
00:18:20,220 --> 00:18:23,340
And this is funny, you will see some...

211
00:18:23,340 --> 00:18:32,840
When I run npm for service enumeration, you may see paramicos and errors here, but there's nothing wrong with it.

212
00:18:32,840 --> 00:18:38,880
It's just because this debug mode is showing that, but nothing crashed on Cisco, still running.

213
00:18:40,180 --> 00:18:50,840
So once I do the nmap, let's see what nmap say I have running on that 10.10.10.152, which is my fake Cisco switch, right?

214
00:18:52,720 --> 00:19:02,020
Okay, so it has recognized I have an SSH and a telnet, which is a Cisco daemons, and also they connect the device as a Cisco IOS router.

215
00:19:02,400 --> 00:19:03,420
Not bad.

216
00:19:03,420 --> 00:19:04,000
Here you go.

217
00:19:04,000 --> 00:19:12,560
I got the community as well here, the SNMP community, and that should be also pushed here.

218
00:19:12,560 --> 00:19:14,220
Let me refresh this.

219
00:19:15,080 --> 00:19:17,640
No, not pushed yet.

220
00:19:17,640 --> 00:19:21,480
It should be coming up.

221
00:19:25,730 --> 00:19:28,010
Maybe I need to refresh that.

222
00:19:31,650 --> 00:19:34,690
Or maybe I'm excluding, actually, SNMP.

223
00:19:34,770 --> 00:19:36,570
Yeah, most likely.

224
00:19:36,890 --> 00:19:38,330
I need to add it.

225
00:19:38,330 --> 00:19:40,870
Alright, no big deal.

226
00:19:42,470 --> 00:19:44,350
Okay, what else?

227
00:19:45,770 --> 00:19:48,330
Let's stop this for a second.

228
00:19:48,830 --> 00:19:53,010
So those are pretty much all the features that we've been running in the past.

229
00:19:53,010 --> 00:19:57,330
So now I'm going to show you the new features we've been working on.

230
00:19:58,030 --> 00:20:04,910
First of all, let's bring up Circo with DNS.

231
00:20:08,050 --> 00:20:12,290
And I'm going to connect to my PC on the back.

232
00:20:13,190 --> 00:20:15,530
I'm going to connect remotely.

233
00:20:17,790 --> 00:20:21,010
And I'm going to...

234
00:20:21,010 --> 00:20:28,110
So I'm going to generate, this is a PC running on the back, and I'm going to generate some FTP and Kerberos traffic.

235
00:20:28,470 --> 00:20:32,330
I'm going to replay some traffic, some pickups, basically.

236
00:20:32,790 --> 00:20:36,930
So when I start Cisco, I'm thinking this is minus D, DNS, right?

237
00:20:36,930 --> 00:20:38,990
If iteration DNS, for example.

238
00:20:39,290 --> 00:20:43,870
And here, it's a starting net cred sniffer, right?

239
00:20:44,230 --> 00:20:48,570
So the PC now is using FTP and Kerberos, etc.

240
00:20:48,570 --> 00:20:50,210
from the PC, right?

241
00:20:50,210 --> 00:20:55,710
So because I'm sniffing the traffic that comes from the PC, I'm also going to exfiltrate that traffic too.

242
00:20:56,950 --> 00:21:00,810
That's just running until all the packets run, right?

243
00:21:02,730 --> 00:21:08,110
So it clearly finds some credentials, and it gets exfiltrated by DNS.

244
00:21:08,610 --> 00:21:09,450
There you go.

245
00:21:09,450 --> 00:21:19,050
The end for net creds, username and a password, and the actual FTP and port destination that those credentials work.

246
00:21:19,050 --> 00:21:25,870
That's important because here is the source port of the automation tool or whoever connected it, right?

247
00:21:25,870 --> 00:21:29,830
But in net creds, I care about the destination.

248
00:21:32,790 --> 00:21:34,990
What else I have to show you?

249
00:21:35,850 --> 00:21:37,830
I actually should have some...

250
00:21:39,470 --> 00:21:43,630
Let's move on into something else, right?

251
00:21:43,630 --> 00:21:44,570
Let me cut this.

252
00:21:44,570 --> 00:21:46,010
You get the sense.

253
00:21:47,910 --> 00:21:49,370
Stop this.

254
00:21:50,750 --> 00:21:51,550
Okay.

255
00:21:51,890 --> 00:21:56,490
So I'm going to show you the spoofing feature, right?

256
00:21:59,690 --> 00:22:04,590
TCP 25 for exfiltration and minus minus spoof, right?

257
00:22:05,550 --> 00:22:08,490
For that, I'm going to connect into...

258
00:22:09,270 --> 00:22:10,950
I need to specify...

259
00:22:11,550 --> 00:22:19,190
I'm going to connect into the gateway, which is a black box on the lab, which is my firewall, right?

260
00:22:19,190 --> 00:22:22,370
So I'm filtering for port 25, right?

261
00:22:22,370 --> 00:22:26,990
So originally my MAC address is this one, right?

262
00:22:26,990 --> 00:22:30,470
And my IP was 152, 10.10.152.

263
00:22:30,470 --> 00:22:34,630
But because I specify minus minus spoof, right?

264
00:22:35,050 --> 00:22:38,590
I'm actually starting the spoof discovery.

265
00:22:38,590 --> 00:22:47,030
What it does is look in the other interface for packets and MAC address combination and use those when I do exfiltration, right?

266
00:22:48,930 --> 00:22:50,130
Okay.

267
00:22:55,060 --> 00:23:01,200
So for that, I probably... let's see if I can finish one.

268
00:23:02,280 --> 00:23:07,160
Okay, I found a MAC address, which is 100 and this MAC address.

269
00:23:07,580 --> 00:23:08,860
So I'm 25.

270
00:23:08,860 --> 00:23:10,040
So what I'm going to do is...

271
00:23:10,620 --> 00:23:15,660
I can ping this, so I'm going to connect again just to generate some credentials.

272
00:23:21,190 --> 00:23:22,550
All right.

273
00:23:22,550 --> 00:23:26,470
So that should trigger some credentials.

274
00:23:26,470 --> 00:23:30,680
And if I check the actual packet captures...

275
00:23:33,530 --> 00:23:35,310
Did I hit enter here?

276
00:23:35,310 --> 00:23:36,630
No.

277
00:23:38,810 --> 00:23:41,230
So I'm capturing packets.

278
00:23:41,230 --> 00:23:41,930
There you go.

279
00:23:41,930 --> 00:23:43,800
I start to see packets coming in.

280
00:23:44,170 --> 00:23:48,350
And as you can see, the source IP is 100.

281
00:23:48,350 --> 00:23:51,590
And the actual MAC address is matching.

282
00:23:51,590 --> 00:23:55,450
This is actually the PC, the PC behind me, probably.

283
00:23:58,340 --> 00:23:59,480
Okay.

284
00:23:59,780 --> 00:24:03,220
Something went wrong here.

285
00:24:03,240 --> 00:24:06,120
Probably some characters.

286
00:24:06,320 --> 00:24:08,340
Let me run it again.

287
00:24:09,320 --> 00:24:10,540
Okay.

288
00:24:10,580 --> 00:24:12,960
So that is done there.

289
00:24:12,960 --> 00:24:15,100
So now I'm going to do is...

290
00:24:15,960 --> 00:24:19,520
I'm going to show you the void features, right?

291
00:24:20,460 --> 00:24:21,500
Yes.

292
00:24:21,620 --> 00:24:22,900
Cancel, cancel.

293
00:24:23,420 --> 00:24:24,320
All right.

294
00:24:24,320 --> 00:24:29,580
For that, we use DNS and voice.

295
00:24:29,980 --> 00:24:30,620
Voip?

296
00:24:30,620 --> 00:24:31,100
Voip.

297
00:24:31,100 --> 00:24:32,140
I think it's Voip.

298
00:24:32,140 --> 00:24:32,900
Yes.

299
00:24:35,500 --> 00:24:38,600
For this, I will need the...

300
00:24:38,600 --> 00:24:40,360
I will need to make a phone call, actually.

301
00:24:41,420 --> 00:24:42,180
Right.

302
00:24:43,280 --> 00:24:46,220
Is this phone actually logging?

303
00:24:51,600 --> 00:24:53,040
Yep, it is actually.

304
00:24:53,720 --> 00:24:56,040
So what I'm going to do...

305
00:25:05,650 --> 00:25:07,110
Start Carpa.

306
00:25:07,190 --> 00:25:08,910
Exfiltration is DNS.

307
00:25:09,050 --> 00:25:11,370
And zip hash collector, right?

308
00:25:11,370 --> 00:25:13,610
And RTP captures, okay?

309
00:25:13,610 --> 00:25:15,370
So I'm going to make a phone call.

310
00:25:29,610 --> 00:25:30,890
Hello?

311
00:25:30,910 --> 00:25:32,230
Pick it up.

312
00:25:33,050 --> 00:25:34,010
Hello?

313
00:25:38,430 --> 00:25:39,930
All right.

314
00:25:40,150 --> 00:25:41,490
I make a call.

315
00:25:41,510 --> 00:25:42,310
Great.

316
00:25:42,310 --> 00:25:45,630
As you can see now, it says sending credentials via DNS.

317
00:25:45,630 --> 00:25:48,810
This is because that phone probably sent a zip request.

318
00:25:48,910 --> 00:25:51,570
So that means that it's going to get a zip hash, right?

319
00:25:53,190 --> 00:25:53,670
So...

320
00:25:56,390 --> 00:25:57,310
Here you go.

321
00:25:57,310 --> 00:25:57,690
Yeah.

322
00:25:57,690 --> 00:25:58,950
Zip credentials, right?

323
00:25:59,410 --> 00:26:01,750
So those should be arriving in Carpa.

324
00:26:01,750 --> 00:26:03,950
And they should have the format with a V.

325
00:26:03,950 --> 00:26:04,950
There you go.

326
00:26:05,290 --> 00:26:07,670
This is a zip hash, actually, right?

327
00:26:07,670 --> 00:26:09,750
These two pieces.

328
00:26:09,750 --> 00:26:15,470
And this is actually the registered zip, the username, and the type of phone system.

329
00:26:17,070 --> 00:26:17,670
So...

330
00:26:18,990 --> 00:26:29,270
Because we actually keep the captures of the RTP stream and the zip for control, so what we can do...

331
00:26:29,270 --> 00:26:38,670
We cannot actually trade these because they are big files, but what we can do is once we pick up Cisco after the assessment, we can actually grab the pickups.

332
00:26:38,670 --> 00:26:39,930
And...

333
00:26:41,490 --> 00:26:42,850
Pickup to WAP.

334
00:26:42,850 --> 00:26:44,690
Pickup to WAP.

335
00:26:44,990 --> 00:26:47,890
I'm going to use the RTP stream.

336
00:26:50,010 --> 00:26:51,670
And I'm going to use...

337
00:26:52,550 --> 00:26:53,990
I can't remember the...

338
00:26:55,190 --> 00:26:56,130
Pickup to WAP.

339
00:26:56,130 --> 00:26:57,210
Pickup to WAP.

340
00:26:57,210 --> 00:26:58,050
What was it?

341
00:26:58,050 --> 00:26:58,650
P.

342
00:26:58,650 --> 00:26:59,570
Okay.

343
00:27:01,230 --> 00:27:02,230
RTP.

344
00:27:02,230 --> 00:27:03,070
RTP.

345
00:27:03,070 --> 00:27:03,970
RTP.

346
00:27:03,970 --> 00:27:04,710
P.

347
00:27:04,950 --> 00:27:05,630
And...

348
00:27:05,630 --> 00:27:06,490
Mix.

349
00:27:11,200 --> 00:27:12,140
Okay.

350
00:27:12,140 --> 00:27:14,700
So this will generate the WAP file.

351
00:27:17,400 --> 00:27:21,840
I should be able to play it back.

352
00:27:22,320 --> 00:27:25,640
Of course I need to extract it, right?

353
00:27:27,260 --> 00:27:27,620
So...

354
00:27:27,980 --> 00:27:31,920
Let's copy this to my actually...

355
00:27:31,920 --> 00:27:34,760
10.10.117...

356
00:27:39,150 --> 00:27:40,590
Username as well.

357
00:27:47,140 --> 00:27:48,420
It's not.

358
00:27:49,520 --> 00:27:50,640
20.10.

359
00:27:50,640 --> 00:27:51,560
There you go.

360
00:27:57,360 --> 00:27:58,220
Okay.

361
00:27:58,980 --> 00:28:00,260
There you go.

362
00:28:00,460 --> 00:28:04,340
So if I do play of that file...

363
00:28:06,660 --> 00:28:06,980
Hello?

364
00:28:06,980 --> 00:28:07,680
Hello?

365
00:28:09,320 --> 00:28:11,440
As you can see, there you go.

366
00:28:11,520 --> 00:28:12,980
You get your WAP file.

367
00:28:13,440 --> 00:28:14,380
Great!

368
00:28:16,160 --> 00:28:16,640
So...

369
00:28:17,140 --> 00:28:20,200
I got one more feature to show you, which is...

370
00:28:20,200 --> 00:28:24,000
Let's bring up Circo, this time with FM and wireless...

371
00:28:25,200 --> 00:28:26,400
Exfiltration.

372
00:28:26,820 --> 00:28:28,900
But for here...

373
00:28:28,900 --> 00:28:30,500
I need to show you...

374
00:28:32,020 --> 00:28:32,740
Howla.

375
00:28:33,160 --> 00:28:34,740
Howla is actually my...

376
00:28:36,760 --> 00:28:38,700
Different computer.

377
00:28:38,700 --> 00:28:41,840
Different laptop running a wireless and the SDR dongle.

378
00:28:42,040 --> 00:28:44,600
So here I will run this...

379
00:28:44,600 --> 00:28:45,240
Verbose.

380
00:28:45,240 --> 00:28:47,040
I will specify the frequency.

381
00:28:47,040 --> 00:28:48,280
10.7.

382
00:28:48,280 --> 00:28:49,980
The wireless interface.

383
00:28:50,300 --> 00:28:52,140
And a log file.

384
00:28:56,010 --> 00:28:57,130
Alright?

385
00:28:57,610 --> 00:29:01,850
So, before I run that, I want you to understand that I'm going to be...

386
00:29:03,070 --> 00:29:05,750
Using FM, so I bring up a...

387
00:29:06,950 --> 00:29:09,210
Screen so you can see it.

388
00:29:09,490 --> 00:29:10,990
Let me bring this up.

389
00:29:10,990 --> 00:29:14,130
Channel 10 for wireless and frequency for FM.

390
00:29:15,090 --> 00:29:17,030
This is the decoder.

391
00:29:18,470 --> 00:29:20,390
And for RDS.

392
00:29:20,390 --> 00:29:22,770
Let me do that.

393
00:29:22,950 --> 00:29:24,170
Ok.

394
00:29:28,280 --> 00:29:29,680
Maybe there.

395
00:29:29,680 --> 00:29:30,820
Right.

396
00:29:31,360 --> 00:29:35,020
So, now I'm going to...

397
00:29:36,060 --> 00:29:38,800
Go back to my screen.

398
00:29:38,860 --> 00:29:42,220
And actually start Circo.

399
00:29:51,680 --> 00:29:57,120
I'm starting with the wireless and the FM modules on.

400
00:30:05,080 --> 00:30:08,260
Let me see if I can do something else here.

401
00:30:19,120 --> 00:30:20,060
Alright.

402
00:30:20,060 --> 00:30:21,320
This is started.

403
00:30:21,320 --> 00:30:23,540
So I'm going to telnet again.

404
00:30:23,940 --> 00:30:26,700
And I'm going to put some credentials.

405
00:30:32,560 --> 00:30:33,840
Alright.

406
00:30:34,940 --> 00:30:35,580
So...

407
00:30:36,160 --> 00:30:37,500
Starting exfiltration.

408
00:30:37,500 --> 00:30:40,460
So I'm going to switch to my Jaula.

409
00:30:42,160 --> 00:30:44,140
You see the silence now?

410
00:30:45,040 --> 00:30:48,780
You can see that there is a new station called Circo.

411
00:30:48,780 --> 00:30:51,820
With different program types and different PI.

412
00:30:51,820 --> 00:30:55,480
This is the RDS type of the FM protocol.

413
00:30:55,480 --> 00:30:58,520
Well , not the FM protocol but the RDS protocol.

414
00:30:58,620 --> 00:31:01,320
On the bottom you can see I already start to...

415
00:31:02,800 --> 00:31:07,160
To actually exfiltrate credentials here.

416
00:31:09,770 --> 00:31:11,550
The WiFi one.

417
00:31:11,550 --> 00:31:12,350
The telnet.

418
00:31:12,350 --> 00:31:13,330
The username.

419
00:31:13,330 --> 00:31:14,570
Mundoi.

420
00:31:14,570 --> 00:31:16,650
Clearly I typed it wrongly.

421
00:31:17,090 --> 00:31:18,810
And also from FM.

422
00:31:19,650 --> 00:31:23,570
So you can see both credentials getting from FM and actually...

423
00:31:24,590 --> 00:31:28,630
Let me cut it so we are not all deaf.

424
00:31:28,690 --> 00:31:33,030
So we get the credentials by FM and actually by wireless as well.

425
00:31:37,970 --> 00:31:39,330
Alright.

426
00:31:39,490 --> 00:31:42,490
That is pretty much.

427
00:31:43,730 --> 00:31:44,410
So...

428
00:31:44,410 --> 00:31:47,410
Before we move on I want to explain you about...

429
00:31:48,190 --> 00:31:49,700
One more thing.

430
00:31:51,970 --> 00:31:53,290
Let me...

431
00:31:54,230 --> 00:31:54,890
Go...

432
00:31:55,400 --> 00:31:56,390
Here.

433
00:31:56,690 --> 00:31:57,570
Ok.

434
00:31:58,110 --> 00:31:59,670
Close this.

435
00:32:01,150 --> 00:32:03,550
And let's start Circo one more time.

436
00:32:03,550 --> 00:32:04,330
Bridge.

437
00:32:04,330 --> 00:32:05,350
Spin.

438
00:32:07,980 --> 00:32:12,090
There is one more feature which is actually the light sensor, right?

439
00:32:12,090 --> 00:32:15,050
So for this I probably will...

440
00:32:15,050 --> 00:32:16,810
Need to go to switch.

441
00:32:16,810 --> 00:32:19,530
Let me see once Circo start.

442
00:32:20,030 --> 00:32:22,090
Carpa is already on.

443
00:32:23,010 --> 00:32:23,730
Ok.

444
00:32:23,730 --> 00:32:26,710
So I will need to move to...

445
00:32:26,710 --> 00:32:28,430
Back camera probably.

446
00:32:28,930 --> 00:32:31,410
Once this stuff is up.

447
00:32:32,650 --> 00:32:34,390
Yep, it's up.

448
00:32:35,250 --> 00:32:36,530
Alright.

449
00:32:38,430 --> 00:32:39,530
Ok.

450
00:32:41,090 --> 00:32:41,730
So...

451
00:32:41,730 --> 00:32:43,450
This is what I'm going to do.

452
00:32:44,930 --> 00:32:47,430
I'm going to open this box, right?

453
00:32:59,570 --> 00:33:00,530
Ok.

454
00:33:13,830 --> 00:33:15,470
Let me see if I can get it...

455
00:33:21,500 --> 00:33:22,680
There you go.

456
00:33:27,290 --> 00:33:29,390
Ok, what do we have inside?

457
00:33:30,290 --> 00:33:31,270
Let me see if...

458
00:33:31,270 --> 00:33:33,550
Maybe I do a bit like that.

459
00:33:34,290 --> 00:33:35,210
There you go.

460
00:33:35,630 --> 00:33:37,690
So we have a Raspberry Pi.

461
00:33:37,990 --> 00:33:39,630
Power components.

462
00:33:40,890 --> 00:33:41,370
And...

463
00:33:41,370 --> 00:33:44,750
On the bottom here we have a light sensor, right?

464
00:33:51,070 --> 00:33:53,750
So if I switch back...

465
00:33:53,750 --> 00:33:54,430
You will see...

466
00:33:56,010 --> 00:33:58,070
Carpa is receiving an alarm.

467
00:33:58,390 --> 00:33:59,290
And it actually...

468
00:34:02,570 --> 00:34:03,250
Circo...

469
00:34:03,250 --> 00:34:05,750
Recognize the case has been opened.

470
00:34:05,750 --> 00:34:06,170
Right .

471
00:34:06,170 --> 00:34:07,270
Circo.

472
00:34:08,510 --> 00:34:10,830
So that's pretty much.

473
00:34:10,830 --> 00:34:13,570
So one thing I want to show you guys.

474
00:34:13,590 --> 00:34:15,110
It's a magic cable.

475
00:34:21,300 --> 00:34:23,500
So the magic cable I told you was...

476
00:34:24,540 --> 00:34:26,660
It looked like a cable like that.

477
00:34:26,680 --> 00:34:27,360
You know.

478
00:34:28,000 --> 00:34:29,500
In Japan they come like that.

479
00:34:29,500 --> 00:34:31,180
This is for earth, right?

480
00:34:33,240 --> 00:34:33,720
This...

481
00:34:34,280 --> 00:34:36,200
This is not a magic cable.

482
00:34:36,200 --> 00:34:37,600
There's no magic here.

483
00:34:38,760 --> 00:34:40,760
You also can get magic here.

484
00:34:40,760 --> 00:34:42,520
This type of cables, right?

485
00:34:42,580 --> 00:34:43,560
This is earth.

486
00:34:43,560 --> 00:34:45,400
Or the British cables.

487
00:34:45,400 --> 00:34:46,860
Which is this one, right?

488
00:34:46,980 --> 00:34:48,940
So where the magic come from?

489
00:34:49,060 --> 00:34:50,620
Well, the magic is like...

490
00:34:50,620 --> 00:34:52,080
I'm using the GPO.

491
00:34:52,080 --> 00:34:54,760
A pin in the Raspberry to modulate the FM frequency.

492
00:34:54,760 --> 00:34:56,400
And I need basically an antenna.

493
00:34:56,560 --> 00:34:58,320
So one way to get an antenna.

494
00:34:58,400 --> 00:34:59,600
Is actually...

495
00:34:59,600 --> 00:35:02,700
There's an earth cable inside the power cable.

496
00:35:02,840 --> 00:35:04,880
So if you look into the...

497
00:35:04,880 --> 00:35:08,440
Where that earth cable connect into the...

498
00:35:08,440 --> 00:35:09,800
Circo.

499
00:35:09,800 --> 00:35:12,260
You will see there's a white cable coming out.

500
00:35:15,950 --> 00:35:17,590
This white cable.

501
00:35:18,610 --> 00:35:20,970
It come out from earth.

502
00:35:22,330 --> 00:35:25,290
And it goes to the GPO of the Raspberry.

503
00:35:26,370 --> 00:35:28,550
And that is my earth, right?

504
00:35:28,550 --> 00:35:29,970
So that basically...

505
00:35:34,900 --> 00:35:38,980
That give me actually a 2-3 meters FM antenna.

506
00:35:38,980 --> 00:35:39,440
Which great...

507
00:35:40,940 --> 00:35:42,980
Great distance reach.

508
00:35:43,220 --> 00:35:43,820
So...

509
00:35:43,820 --> 00:35:46,180
This is another method for exfiltrating.

510
00:35:46,180 --> 00:35:52,140
When wireless is not an option due to 50-80 meters length, right?

511
00:35:52,140 --> 00:35:54,580
You can go longer with FM.

512
00:35:55,340 --> 00:35:56,620
All right.

513
00:35:57,820 --> 00:35:59,540
That's all, guys.

514
00:36:01,000 --> 00:36:01,640
So...

515
00:36:01,640 --> 00:36:04,180
I hope you actually enjoy it.

516
00:36:04,180 --> 00:36:06,140
And let me know if anything...

517
00:36:07,760 --> 00:36:10,560
Questions, just shout out, right?

518
00:36:12,020 --> 00:36:14,020
Okay, thanks.

519
00:36:14,460 --> 00:36:15,520
See ya.