Hello, welcome to DEFCON 28 Demo Labs.
Today I'm going to show you a tool called Circo, version 2.
Hello, virtual friend. My name is Emilio.
I'm from Argentina, I'm currently located in Japan,
and I have a background of hacking, networks, firewall, packets, electronics,
and a bit of 3D printing as well.
I present tools in various conferences around Asia, US, Europe, a bit of here and there,
and I'm actually 16 hours ahead DEFCON, so I'm in the future.
As you can see, my English is very Argentinian, and I'm definitely not a native programmer.
So, let's move on to Circo.
All right, before I actually move on, let's talk about the legal disclaimer.
This tool is provided for educational, research, or testing purposes.
Using this tool against network systems without permission is illegal.
Radio waves are per country regulated, so you must check your own country
to see if that you're doing within compliant regulations, etc.
I'm not responsible for any good or bad things you do with it, blah, blah, blah.
Okay, great.
Wait, what is Circo version 1 if this is version 2?
All right, so Circo version 1 is actually based on Python 2.
It was a network implant using cheap hardware like Raspberry Pi,
and the idea is to exploit the zero trust that network automation tools have these days.
The whole concept of the network automation tool is to auto-discover things,
like Cisco switches, for example.
So, what about if I am a Cisco switch?
That means that they will try to connect to me to grab my configurations?
Exactly.
So, the whole concept of that was, okay, I build with cheap hardware in Cisco switch,
behavior as a Cisco switch, as a honeypot, basically,
and then I wait for automation tools to connect to me.
So, once they connect to me and they give me the credentials, thank you very much,
I will actually exfiltrate it to the Internet, to my own Internet server.
For that, I come up with a few different techniques for exfiltration,
and also some additions of encryptions and anti-forensics, etc.
Over the past year, well, actually over 2019,
most of the features and techniques used here were actually feedback
from when I was presenting this tool in various conferences and friends
and people suggesting things.
So, it improved over the time.
So, just to show you how it looks actually version 1.
Let me turn off the camera.
So, version 1 used to be like a network outlet that you have these things on top of your desk
or under your desk where you put the network ports here,
and inside was actually things like this, right?
Raspberry Pi and some electronics, buttons, etc.
Also, there's a bigger box of it, similar concept,
the network ports here, right?
And you actually, inside of this, let me see if I can open it like that,
you will have a Raspberry Pi and electronics and PoE, etc, etc.
So, that's pretty much what was done with version 1, right?
Okay, great. Good to know.
So, what's version 2 about it?
Well, basically, Python 2 wasn't supposed to be allegedly end of life, blah, blah, blah,
so it needed to be Python 3.
So, I dedicated time and migrated everything to Python 3,
which is not that simple as replacing Python with Python 3 on the top.
Nope, doesn't work like that.
So, most of the stuff was recoded.
Probably 70-80% of the code was recoded.
So, I took the opportunity and make it modular code.
So, that will allow me to easily add all the features and exfiltration techniques using modular code, right?
Also, I have a couple of features that people suggest over the past.
For example, MAC IP addresses spoofing when you do exfiltration.
Also, I've been suggested to actually, because I'm tapping, I'm man-in-the-middle between a phone and a network,
I also record calls, like getting audio files. I do.
I add support for a tool called netcreds, which actually captures unencrypted credentials or hashes of NTLM, HTTP, SMTP, IMAP, etc.
Kerberos as well, right? FTP, etc.
Yeah, various ones.
I add as well, before I used to use either magnet or push buttons to detect if someone opened the alarm.
And now I'm using LDR, which is a light sensor, basically.
And I add an extra exfiltration method using FM.
Because the phone itself will authenticate, I also collect in that zip authentication hash.
And I add a new camouflage hardware, which will be something very familiar to you.
If you recall, this is a power injector from Cisco, used for phones, also for APs as well.
So I'm actually going to use this as a new camouflage hardware.
Instead of using these boxes, network outlets, I'm going to use one of these.
Why not?
For that, I add also the TCP exfiltration.
Before it used to be HTTP, HTTPS, now it's any TCP port you would like to use.
80, 40, 25, whatever.
Because I'm using a new method for exfiltration, FM, so you will probably need one of these.
Which is actually an SDR dongle, right?
To be able to capture those radio waves.
And also improve a lot of the Cisco IOS and Honeypot.
So the Telnet, when I recode it, I improve the Telnet, the SSH, the CDP and LLDP demos, right?
OK, so let's go back to here, right?
These are all the things that have been added in version 2.
Which will go today, just to recap.
We have what Honeypot will provide as a Cisco services.
Remember, we are trying to emulate the Cisco switch, so we do provide CDP and LLDP advertisements.
As a Cisco switch, or actually phone, if you want to run in single mode.
We also provide an SNMP agent, so you can actually pull.
That's the idea of the automation system, to pull the SNMP communities, SNMP MIPS from the Cisco switch.
So we have one of those, we provide CLI via Telnet and SSH, with quite a few commands.
And also a TCP stack, so when we get fingerprinting, we can actually reply saying that we are a Cisco switch indeed.
For exfiltration, when we exfiltrate data, we actually send it, the Honeypot will send the credentials via Telnet or SSH or SNMP.
So we have different various formats, right?
The T for Telnet, the Telnet enable, the SSH, SSH enable, SNMP.
And also because now we are sniffing credentials, that the actual phone could be cascaded to a PC behind it.
So we are using netcreds, so that will be the end.
And also the zip, which is the voice hashes that we actually capture.
So I didn't want to make this longer, so now demo labs, demo time, right?
Okay, so behind me, you will see I set up a lab, actually.
I will explain you what the lab consists of.
The lab actually has, on this side, this case you see here, this is actually the whole network infrastructure.
I have the blue box on the top, it's actually my internet server.
The yellow box is actually my network automation, so network administration server inside the network.
The Cisco switch, real one, called TK, it's called SH-TKY01.
I also have a black box, which is my file, my proxy, DNS, DHCP, pack file, server, etc.
On this side, I have connected an IP phone, cascaded to a PC, right?
And in the middle, you will see this box, right?
This, which contains one cable going to the phone, the white cable, right?
And the other cable going to the infrastructure, right?
And of course, power, because this is using a magic power cable, right?
Are we good? Yes, okay.
So, let's move on.
Okay, on the right side, I got access to my yellow box, which is my network automation.
On the bottom, I have access to my blue box, which is my internet server, which will be receiving, called CARPA, right?
Will be receiving the credentials from the internet.
And on the top, I have access to the circo, which is actually out of band.
So, first of all, let's start CARPA.
And before I start circo, I want to connect to the real switch.
This is the real circo switch on my infrastructure.
Switch Tokyo 01, show CDP neighbors.
Okay, I have a CDP, which is the phone, actually, that you saw on the back.
LDP.
Nothing, because that phone only speaks CDP.
Right, so, I'm going to start circo on the reverse mode, bridge mode, and actually, maybe, ping, right?
That's an exfiltration.
So, I will explain you before.
Before this happened, what I do is actually collect CDP details and LDP from the actual PR switch, just to get the names.
I'm going to derivate the name, so if... similar name to what already exists.
Okay, I change my MAC address, get an IP address from the server.
I start a few as a sniffer, create a template, and bring all the honeypots, which is all of this, CDP, LDP, IOS, Telnet, SSH, SNMP, and also the name of OS Fuller to the TCP fingerprint.
Service is actually fingerprinted, right?
An exfiltration, I select ping, right?
Okay, so now if I do show CDP neighbor from the real switch, I can see there is another switch here.
Okay, so CDP neighbor details.
I can see the switch is called SWTKY03, has a 10.10.10.152, and is 2960 ATC.
So, what about LLDP?
DP neighbors.
Okay, LLDP as well, I can see the same switch connected via CDP and LLDP.
If I do the details, I can see the chassis, which match the MAC address I'm setting up, the interface, the name, the software version running, and the capabilities from the switch itself.
And the VLAN ID also, right?
Standard LLDP information you get.
Alright, so I'm in my automation tool.
Let's see if I can ping that 152, 10.10.10.152.
Yes, I can ping it.
Alright, so let's try 10.10.10.152.
Okay, I connect.
So let me type.
Username and a password.
Okay, I got access to the Cisco switch.
Show version.
Give me a version of the Cisco switch.
If you see on the circuit itself, it starts to say, sending credentials via ping.
That means that he got credentials.
So those credentials will appear on the bottom screen on Carpa, right?
Because they're coming via ping.
Carpa is on the internet, and Cisco is on the internal network, right?
Show inventory.
Show IP route.
Show interface description.
Behave like a Cisco.
Show IP app.
Show MAC address.
Show status.
Alright?
As you can see on the bottom of the screen, you see that credentials coming from protocolternet.
Username hola, password descon.
You see?
What about if I do enable now?
I can enable as well.
I can do some commands, like show run.
And give me a configuration.
But I cannot do some commands.
I'm not authorizing, because I didn't code the whole iOS honeypot.
Just enough for automation tool to find out.
Similar should work by SSH.
You can see in Carpa.
Now Carpa received a credential via Ternet.
And the credential was secret.
Elite mode, right?
So I can also, I should be able to SSH as well.
Yep, I got this via SSH.
Same thing.
Same commands via SSH and Ternet are provided.
Right?
Inventory.
Also I can put enable.
Again, I get the same commands, right?
So what else we can do?
Well, we can do an SNMP walk, right?
Version 2, community.
Here's a trick, right?
Automation tool will try first their own community, the internal community they use in all devices.
If that fails, they will switch to public, right?
So let's try community.
10.10.10.152, right?
I should escape that.
Wrong key.
So what happened here, you can see on the Carpa in the meantime, that credentials start to arrive.
My pass, SSH, user admin, my pass, right?
When I do an SNMP walk for this community, I don't get any answer.
However, I did capture it.
So automation tools will try public if they will fail back to public, right?
And if I do that, let me cut it.
When I do public, it actually replies as a Cisco switch with the name SWTKY03, right?
So it behaves as a Cisco switch.
Okay, what else we can try?
Oh, by the way, let me show you all those credentials that Carpa is storing in a text file.
There you go, the enable password.
All those credentials are being stored in a text file, of course, but they're also being pushed to Faraday.
So if I log to my Faraday dashboard,
if I go to manage, hosts, it will create automatically a host and you also add credentials to it.
So you see that host, it has a telnet, the username and the password.
The E stands for enable, of course, right?
So those are being pushed automatically from Carpa into Faraday, right?
Oops.
All right.
The SNMP did not arrive yet.
It should arrive soon.
I think I'm cycling the credentials every 60 seconds, 30 seconds, I can't remember.
So what about now? Let's try nmap.
sv for 10.10.152.
And this is funny, you will see some...
When I run npm for service enumeration, you may see paramicos and errors here, but there's nothing wrong with it.
It's just because this debug mode is showing that, but nothing crashed on Cisco, still running.
So once I do the nmap, let's see what nmap say I have running on that 10.10.10.152, which is my fake Cisco switch, right?
Okay, so it has recognized I have an SSH and a telnet, which is a Cisco daemons, and also they connect the device as a Cisco IOS router.
Not bad. Here you go. I got the community as well here, the SNMP community, and that should be also pushed here.
Let me refresh this.
No, not pushed yet.
It should be coming up.
Maybe I need to refresh that.
Or maybe I'm excluding, actually, SNMP. Yeah, most likely.
I need to add it. Alright, no big deal.
Okay, what else?
Let's stop this for a second.
So those are pretty much all the features that we've been running in the past.
So now I'm going to show you the new features we've been working on.
First of all, let's bring up Circo with DNS.
And I'm going to connect to my PC on the back.
I'm going to connect remotely.
And I'm going to...
So I'm going to generate, this is a PC running on the back, and I'm going to generate some FTP and Kerberos traffic.
I'm going to replay some traffic, some pickups, basically.
So when I start Cisco, I'm thinking this is minus D, DNS, right? If iteration DNS, for example.
And here, it's a starting net cred sniffer, right?
So the PC now is using FTP and Kerberos, etc. from the PC, right?
So because I'm sniffing the traffic that comes from the PC, I'm also going to exfiltrate that traffic too.
That's just running until all the packets run, right?
So it clearly finds some credentials, and it gets exfiltrated by DNS.
There you go. The end for net creds, username and a password, and the actual FTP and port destination that those credentials work.
That's important because here is the source port of the automation tool or whoever connected it, right?
But in net creds, I care about the destination.
What else I have to show you?
I actually should have some...
Let's move on into something else, right?
Let me cut this. You get the sense.
Stop this.
Okay.
So I'm going to show you the spoofing feature, right?
TCP 25 for exfiltration and minus minus spoof, right?
For that, I'm going to connect into...
I need to specify...
I'm going to connect into the gateway, which is a black box on the lab, which is my firewall, right?
So I'm filtering for port 25, right?
So originally my MAC address is this one, right?
And my IP was 152, 10.10.152.
But because I specify minus minus spoof, right?
I'm actually starting the spoof discovery.
What it does is look in the other interface for packets and MAC address combination and use those when I do exfiltration, right?
Okay.
So for that, I probably... let's see if I can finish one.
Okay, I found a MAC address, which is 100 and this MAC address.
So I'm 25. So what I'm going to do is...
I can ping this, so I'm going to connect again just to generate some credentials.
All right.
So that should trigger some credentials.
And if I check the actual packet captures...
Did I hit enter here? No.
So I'm capturing packets. There you go.
I start to see packets coming in.
And as you can see, the source IP is 100.
And the actual MAC address is matching.
This is actually the PC, the PC behind me, probably.
Okay.
Something went wrong here.
Probably some characters.
Let me run it again.
Okay.
So that is done there.
So now I'm going to do is...
I'm going to show you the void features, right?
Yes.
Cancel, cancel.
All right.
For that, we use DNS and voice.
Voip? Voip. I think it's Voip.
Yes.
For this, I will need the...
I will need to make a phone call, actually.
Right.
Is this phone actually logging?
Yep, it is actually.
So what I'm going to do...
Start Carpa.
Exfiltration is DNS.
And zip hash collector, right?
And RTP captures, okay?
So I'm going to make a phone call.
Hello?
Pick it up.
Hello?
All right.
I make a call.
Great.
As you can see now, it says sending credentials via DNS.
This is because that phone probably sent a zip request.
So that means that it's going to get a zip hash, right?
So...
Here you go.
Yeah.
Zip credentials, right?
So those should be arriving in Carpa.
And they should have the format with a V.
There you go.
This is a zip hash, actually, right?
These two pieces.
And this is actually the registered zip, the username, and the type of phone system.
So...
Because we actually keep the captures of the RTP stream and the zip for control,
so what we can do...
We cannot actually trade these because they are big files,
but what we can do is once we pick up Cisco after the assessment,
we can actually grab the pickups.
And...
Pickup to WAP.
Pickup to WAP.
I'm going to use the RTP stream.
And I'm going to use...
I can't remember the...
Pickup to WAP.
Pickup to WAP.
What was it?
P. Okay.
RTP.
RTP.
RTP.
P.
And...
Mix.
Okay.
So this will generate the WAP file.
I should be able to play it back.
Of course I need to extract it, right?
So...
Let's copy this to my actually...
10.10.117...
Username as well.
It's not.
20.10. There you go.
Okay.
There you go.
So if I do play of that file...
Hello? Hello?
As you can see, there you go.
You get your WAP file.
Great!
So...
I got one more feature to show you,
which is...
Let's bring up Circo, this time with FM and wireless...
Exfiltration.
But for here...
I need to show you...
Howla.
Howla is actually my...
Different computer.
Different laptop running a wireless and the SDR dongle.
So here I will run this...
Verbose.
I will specify the frequency.
10.7. The wireless interface.
And a log file.
Alright?
So, before I run that, I want you to understand that I'm going to be...
Using FM, so I bring up a...
Screen so you can see it.
Let me bring this up.
Channel 10 for wireless and frequency for FM.
This is the decoder.
And for RDS.
Let me do that.
Ok.
Maybe there.
Right.
So, now I'm going to...
Go back to my screen.
And actually start Circo.
I'm starting with the wireless and the FM modules on.
Let me see if I can do something else here.
Alright.
This is started.
So I'm going to telnet again.
And I'm going to put some credentials.
Alright.
So...
Starting exfiltration.
So I'm going to switch to my Jaula.
You see the silence now?
You can see that there is a new station called Circo.
With different program types and different PI.
This is the RDS type of the FM protocol.
Well, not the FM protocol but the RDS protocol.
On the bottom you can see I already start to...
To actually exfiltrate credentials here.
The WiFi one.
The telnet.
The username.
Mundoi.
Clearly I typed it wrongly.
And also from FM.
So you can see both credentials getting from FM and actually...
Let me cut it so we are not all deaf.
So we get the credentials by FM and actually by wireless as well.
Alright.
That is pretty much.
So...
Before we move on I want to explain you about...
One more thing.
Let me...
Go...
Here.
Ok.
Close this.
And let's start Circo one more time.
Bridge.
Spin.
There is one more feature which is actually the light sensor, right?
So for this I probably will...
Need to go to switch.
Let me see once Circo start.
Carpa is already on.
Ok.
So I will need to move to...
Back camera probably.
Once this stuff is up.
Yep, it's up.
Alright.
Ok.
So...
This is what I'm going to do.
I'm going to open this box, right?
Ok.
Let me see if I can get it...
There you go.
Ok, what do we have inside?
Let me see if...
Maybe I do a bit like that.
There you go.
So we have a Raspberry Pi.
Power components.
And...
On the bottom here we have a light sensor, right?
So if I switch back...
You will see...
Carpa is receiving an alarm.
And it actually...
Circo...
Recognize the case has been opened.
Right.
Circo.
So that's pretty much.
So one thing I want to show you guys.
It's a magic cable.
So the magic cable I told you was...
It looked like a cable like that.
You know.
In Japan they come like that. This is for earth, right?
This...
This is not a magic cable.
There's no magic here.
You also can get magic here.
This type of cables, right?
This is earth.
Or the British cables.
Which is this one, right?
So where the magic come from?
Well, the magic is like...
I'm using the GPO.
A pin in the Raspberry to modulate the FM frequency.
And I need basically an antenna.
So one way to get an antenna.
Is actually...
There's an earth cable inside the power cable.
So if you look into the...
Where that earth cable connect into the...
Circo.
You will see there's a white cable coming out.
This white cable.
It come out from earth.
And it goes to the GPO of the Raspberry.
And that is my earth, right?
So that basically...
That give me actually a 2-3 meters FM antenna.
Which great...
Great distance reach.
So...
This is another method for exfiltrating.
When wireless is not an option due to 50-80 meters length, right?
You can go longer with FM.
All right.
That's all, guys.
So...
I hope you actually enjoy it.
And let me know if anything...
Questions, just shout out, right?
Okay, thanks.
See ya.