WEBVTT 00:05.750 --> 00:10.610 Hello, welcome to DEFCON 28 Demo Labs. 00:10.610 --> 00:15.490 Today I'm going to show you a tool called Circo, version 2. 00:16.030 --> 00:18.470 Hello, virtual friend. 00:18.470 --> 00:20.270 My name is Emilio. 00:20.410 --> 00:36.350 I'm from Argentina, I'm currently located in Japan, and I have a background of hacking, networks, firewall, packets, electronics, and a bit of 3D printing as well. 00:36.350 --> 00:51.490 I present tools in various conferences around Asia, US, Europe, a bit of here and there, and I'm actually 16 hours ahead DEFCON, so I'm in the future. 00:51.850 --> 00:58.870 As you can see, my English is very Argentinian, and I'm definitely not a native programmer. 00:58.870 --> 01:01.530 So, let's move on to Circo. 01:05.420 --> 01:11.280 All right, before I actually move on, let's talk about the legal disclaimer. 01:11.780 --> 01:16.420 This tool is provided for educational, research, or testing purposes. 01:16.420 --> 01:21.740 Using this tool against network systems without permission is illegal. 01:22.100 --> 01:32.540 Radio waves are per country regulated, so you must check your own country to see if that you're doing within compliant regulations, etc. 01:33.260 --> 01:38.620 I'm not responsible for any good or bad things you do with it, blah, blah, blah. 01:38.620 --> 01:40.080 Okay, great. 01:40.220 --> 01:43.680 Wait, what is Circo version 1 if this is version 2? 01:44.080 --> 01:52.320 All right, so Circo version 1 is actually based on Python 2. 01:52.320 --> 02:04.160 It was a network implant using cheap hardware like Raspberry Pi, and the idea is to exploit the zero trust that network automation tools have these days. 02:04.260 --> 02:10.980 The whole concept of the network automation tool is to auto-discover things, like Cisco switches, for example. 02:11.000 --> 02:12.980 So, what about if I am a Cisco switch? 02:12.980 --> 02:16.920 That means that they will try to connect to me to grab my configurations? 02:17.220 --> 02:18.020 Exactly. 02:18.020 --> 02:31.260 So, the whole concept of that was, okay, I build with cheap hardware in Cisco switch, behavior as a Cisco switch, as a honeypot, basically, and then I wait for automation tools to connect to me. 02:31.320 --> 02:40.160 So, once they connect to me and they give me the credentials, thank you very much, I will actually exfiltrate it to the Internet, to my own Internet server. 02:40.420 --> 02:51.200 For that, I come up with a few different techniques for exfiltration, and also some additions of encryptions and anti-forensics, etc. 02:51.960 --> 03:10.840 Over the past year, well, actually over 2019, most of the features and techniques used here were actually feedback from when I was presenting this tool in various conferences and friends and people suggesting things. 03:10.840 --> 03:14.540 So, it improved over the time. 03:14.540 --> 03:19.580 So, just to show you how it looks actually version 1. 03:20.880 --> 03:22.720 Let me turn off the camera. 03:22.720 --> 03:35.400 So, version 1 used to be like a network outlet that you have these things on top of your desk or under your desk where you put the network ports here, and inside was actually things like this, right? 03:35.420 --> 03:39.700 Raspberry Pi and some electronics, buttons, etc. 03:41.960 --> 03:48.260 Also, there's a bigger box of it, similar concept, the network ports here, right? 03:48.380 --> 03:59.060 And you actually, inside of this, let me see if I can open it like that, you will have a Raspberry Pi and electronics and PoE, etc, etc. 04:00.200 --> 04:04.280 So, that's pretty much what was done with version 1, right? 04:07.490 --> 04:08.970 Okay, great. 04:08.970 --> 04:10.110 Good to know. 04:11.470 --> 04:14.850 So, what's version 2 about it? 04:14.850 --> 04:23.290 Well, basically, Python 2 wasn't supposed to be allegedly end of life, blah, blah, blah, so it needed to be Python 3. 04:23.390 --> 04:32.290 So, I dedicated time and migrated everything to Python 3, which is not that simple as replacing Python with Python 3 on the top. 04:32.290 --> 04:34.090 Nope, doesn't work like that. 04:34.090 --> 04:36.990 So, most of the stuff was recoded. 04:36.990 --> 04:40.390 Probably 70-80% of the code was recoded. 04:40.390 --> 04:43.210 So, I took the opportunity and make it modular code. 04:43.270 --> 04:51.530 So, that will allow me to easily add all the features and exfiltration techniques using modular code, right? 04:51.710 --> 04:56.150 Also, I have a couple of features that people suggest over the past. 04:56.150 --> 05:00.710 For example, MAC IP addresses spoofing when you do exfiltration. 05:00.710 --> 05:13.710 Also, I've been suggested to actually, because I'm tapping, I'm man-in-the-middle between a phone and a network, I also record calls, like getting audio files. 05:13.710 --> 05:14.810 I do. 05:14.930 --> 05:27.790 I add support for a tool called netcreds, which actually captures unencrypted credentials or hashes of NTLM, HTTP, SMTP, IMAP, etc. 05:27.790 --> 05:29.270 Kerberos as well, right? 05:29.610 --> 05:30.950 FTP, etc. 05:30.950 --> 05:33.570 Yeah, various ones. 05:33.770 --> 05:39.390 I add as well, before I used to use either magnet or push buttons to detect if someone opened the alarm. 05:39.390 --> 05:43.470 And now I'm using LDR, which is a light sensor, basically. 05:44.530 --> 05:50.310 And I add an extra exfiltration method using FM. 05:50.630 --> 05:56.330 Because the phone itself will authenticate, I also collect in that zip authentication hash. 05:56.330 --> 06:03.070 And I add a new camouflage hardware, which will be something very familiar to you. 06:04.850 --> 06:14.350 If you recall, this is a power injector from Cisco, used for phones, also for APs as well. 06:14.590 --> 06:18.570 So I'm actually going to use this as a new camouflage hardware. 06:18.570 --> 06:24.650 Instead of using these boxes, network outlets, I'm going to use one of these. 06:24.650 --> 06:25.650 Why not? 06:26.330 --> 06:31.510 For that, I add also the TCP exfiltration. 06:31.790 --> 06:37.030 Before it used to be HTTP, HTTPS, now it's any TCP port you would like to use. 06:37.030 --> 06:39.270 80, 40, 25, whatever. 06:39.830 --> 06:45.370 Because I'm using a new method for exfiltration, FM, so you will probably need one of these. 06:45.370 --> 06:48.930 Which is actually an SDR dongle, right? 06:48.930 --> 06:52.950 To be able to capture those radio waves. 06:52.950 --> 06:59.070 And also improve a lot of the Cisco IOS and Honeypot. 06:59.070 --> 07:08.750 So the Telnet, when I recode it, I improve the Telnet, the SSH, the CDP and LLDP demos, right? 07:09.390 --> 07:16.900 OK, so let's go back to here, right? 07:16.900 --> 07:21.200 These are all the things that have been added in version 2. 07:21.200 --> 07:24.900 Which will go today, just to recap. 07:25.160 --> 07:29.580 We have what Honeypot will provide as a Cisco services. 07:29.580 --> 07:35.760 Remember, we are trying to emulate the Cisco switch, so we do provide CDP and LLDP advertisements. 07:36.100 --> 07:40.080 As a Cisco switch, or actually phone, if you want to run in single mode. 07:40.080 --> 07:43.780 We also provide an SNMP agent, so you can actually pull. 07:43.780 --> 07:50.880 That's the idea of the automation system, to pull the SNMP communities, SNMP MIPS from the Cisco switch. 07:50.880 --> 07:59.720 So we have one of those, we provide CLI via Telnet and SSH, with quite a few commands. 07:59.840 --> 08:08.100 And also a TCP stack, so when we get fingerprinting, we can actually reply saying that we are a Cisco switch indeed. 08:09.100 --> 08:20.740 For exfiltration, when we exfiltrate data, we actually send it, the Honeypot will send the credentials via Telnet or SSH or SNMP. 08:20.740 --> 08:23.640 So we have different various formats, right? 08:23.640 --> 08:28.760 The T for Telnet, the Telnet enable, the SSH, SSH enable, SNMP. 08:28.760 --> 08:36.960 And also because now we are sniffing credentials, that the actual phone could be cascaded to a PC behind it. 08:36.960 --> 08:40.640 So we are using netcreds, so that will be the end. 08:40.640 --> 08:47.420 And also the zip, which is the voice hashes that we actually capture. 08:47.900 --> 08:53.800 So I didn't want to make this longer, so now demo labs, demo time, right? 08:56.220 --> 09:03.980 Okay, so behind me, you will see I set up a lab, actually. 09:03.980 --> 09:06.800 I will explain you what the lab consists of. 09:06.800 --> 09:16.860 The lab actually has, on this side, this case you see here, this is actually the whole network infrastructure. 09:17.120 --> 09:21.120 I have the blue box on the top, it's actually my internet server. 09:21.120 --> 09:26.680 The yellow box is actually my network automation, so network administration server inside the network. 09:26.680 --> 09:34.100 The Cisco switch, real one, called TK, it's called SH-TKY01. 09:34.100 --> 09:43.800 I also have a black box, which is my file, my proxy, DNS, DHCP, pack file, server, etc. 09:44.400 --> 09:51.640 On this side, I have connected an IP phone, cascaded to a PC, right? 09:51.640 --> 09:56.640 And in the middle, you will see this box, right? 09:56.640 --> 10:01.940 This, which contains one cable going to the phone, the white cable, right? 10:01.940 --> 10:05.660 And the other cable going to the infrastructure, right? 10:05.860 --> 10:12.560 And of course, power, because this is using a magic power cable, right? 10:13.140 --> 10:14.000 Are we good? 10:14.000 --> 10:15.320 Yes, okay. 10:15.480 --> 10:20.000 So, let's move on. 10:22.820 --> 10:28.660 Okay, on the right side, I got access to my yellow box, which is my network automation. 10:28.660 --> 10:35.460 On the bottom, I have access to my blue box, which is my internet server, which will be receiving, called CARPA, right? 10:35.460 --> 10:38.120 Will be receiving the credentials from the internet. 10:38.120 --> 10:44.240 And on the top, I have access to the circo, which is actually out of band. 10:44.240 --> 10:47.540 So, first of all, let's start CARPA. 10:55.760 --> 11:02.540 And before I start circo, I want to connect to the real switch. 11:03.220 --> 11:05.980 This is the real circo switch on my infrastructure. 11:06.460 --> 11:09.640 Switch Tokyo 01, show CDP neighbors. 11:09.640 --> 11:13.800 Okay, I have a CDP, which is the phone, actually, that you saw on the back. 11:15.360 --> 11:16.640 LDP. 11:17.740 --> 11:20.880 Nothing, because that phone only speaks CDP. 11:21.040 --> 11:30.120 Right, so, I'm going to start circo on the reverse mode, bridge mode, and actually, maybe, ping, right? 11:30.860 --> 11:32.540 That's an exfiltration. 11:35.020 --> 11:37.860 So, I will explain you before. 11:38.680 --> 11:47.260 Before this happened, what I do is actually collect CDP details and LDP from the actual PR switch, just to get the names. 11:47.260 --> 11:52.240 I'm going to derivate the name, so if... similar name to what already exists. 11:52.580 --> 11:59.120 Okay, I change my MAC address, get an IP address from the server. 12:02.280 --> 12:17.080 I start a few as a sniffer, create a template, and bring all the honeypots, which is all of this, CDP, LDP, IOS, Telnet, SSH, SNMP, and also the name of OS Fuller to the TCP fingerprint. 12:17.660 --> 12:19.720 Service is actually fingerprinted, right? 12:19.720 --> 12:21.780 An exfiltration, I select ping, right? 12:21.780 --> 12:28.100 Okay, so now if I do show CDP neighbor from the real switch, I can see there is another switch here. 12:28.100 --> 12:31.740 Okay, so CDP neighbor details. 12:31.780 --> 12:42.340 I can see the switch is called SWTKY03, has a 10.10.10.152, and is 2960 ATC. 12:42.500 --> 12:44.540 So, what about LLDP? 12:45.500 --> 12:47.140 DP neighbors. 12:47.140 --> 12:52.100 Okay, LLDP as well, I can see the same switch connected via CDP and LLDP. 12:52.100 --> 13:04.840 If I do the details, I can see the chassis, which match the MAC address I'm setting up, the interface, the name, the software version running, and the capabilities from the switch itself. 13:04.840 --> 13:06.940 And the VLAN ID also, right? 13:06.940 --> 13:10.060 Standard LLDP information you get. 13:11.660 --> 13:14.370 Alright, so I'm in my automation tool. 13:14.680 --> 13:19.320 Let's see if I can ping that 152, 10.10.10.152. 13:19.380 --> 13:21.040 Yes, I can ping it. 13:22.240 --> 13:29.600 Alright, so let's try 10.10.10.152. 13:30.420 --> 13:32.420 Okay, I connect. 13:32.500 --> 13:34.080 So let me type. 13:36.320 --> 13:38.600 Username and a password. 13:38.600 --> 13:40.820 Okay, I got access to the Cisco switch. 13:40.820 --> 13:43.000 Show version. 13:43.600 --> 13:46.000 Give me a version of the Cisco switch. 13:46.000 --> 13:50.820 If you see on the circuit itself, it starts to say, sending credentials via ping. 13:50.820 --> 13:52.580 That means that he got credentials. 13:52.580 --> 13:56.440 So those credentials will appear on the bottom screen on Carpa, right? 13:56.440 --> 13:58.140 Because they're coming via ping. 13:58.140 --> 14:02.100 Carpa is on the internet, and Cisco is on the internal network, right? 14:04.460 --> 14:05.900 Show inventory. 14:06.760 --> 14:08.600 Show IP route. 14:08.780 --> 14:10.460 Show interface description. 14:10.460 --> 14:11.540 Behave like a Cisco. 14:11.540 --> 14:14.340 Show IP app. 14:14.340 --> 14:16.220 Show MAC address. 14:16.240 --> 14:18.680 Show status. 14:20.580 --> 14:21.380 Alright? 14:21.380 --> 14:27.360 As you can see on the bottom of the screen, you see that credentials coming from protocolternet. 14:27.360 --> 14:30.320 Username hola, password descon. 14:30.740 --> 14:31.600 You see? 14:31.660 --> 14:33.420 What about if I do enable now? 14:34.160 --> 14:36.060 I can enable as well. 14:36.060 --> 14:41.460 I can do some commands, like show run. 14:43.880 --> 14:46.000 And give me a configuration. 14:46.060 --> 14:47.640 But I cannot do some commands. 14:47.980 --> 14:53.380 I'm not authorizing, because I didn't code the whole iOS honeypot. 14:53.380 --> 14:56.500 Just enough for automation tool to find out. 14:57.480 --> 15:00.220 Similar should work by SSH. 15:00.800 --> 15:02.300 You can see in Carpa. 15:02.300 --> 15:06.200 Now Carpa received a credential via Ternet. 15:06.340 --> 15:08.660 And the credential was secret. 15:09.220 --> 15:10.720 Elite mode, right? 15:11.880 --> 15:15.840 So I can also, I should be able to SSH as well. 15:21.480 --> 15:24.160 Yep, I got this via SSH. 15:24.160 --> 15:25.240 Same thing. 15:25.240 --> 15:28.000 Same commands via SSH and Ternet are provided. 15:28.540 --> 15:29.280 Right? 15:29.600 --> 15:30.800 Inventory. 15:31.360 --> 15:33.500 Also I can put enable. 15:36.760 --> 15:39.320 Again, I get the same commands, right? 15:43.410 --> 15:45.370 So what else we can do? 15:45.370 --> 15:48.070 Well, we can do an SNMP walk, right? 15:49.770 --> 15:51.830 Version 2, community. 15:51.830 --> 15:53.330 Here's a trick, right? 15:53.370 --> 15:58.690 Automation tool will try first their own community, the internal community they use in all devices. 15:58.690 --> 16:02.950 If that fails, they will switch to public, right? 16:02.950 --> 16:08.700 So let's try community. 16:09.100 --> 16:13.140 10.10.10.152, right? 16:13.600 --> 16:16.380 I should escape that. 16:17.460 --> 16:19.060 Wrong key. 16:22.840 --> 16:30.220 So what happened here, you can see on the Carpa in the meantime, that credentials start to arrive. 16:30.640 --> 16:34.780 My pass, SSH, user admin, my pass, right? 16:34.780 --> 16:40.940 When I do an SNMP walk for this community, I don't get any answer. 16:41.140 --> 16:43.260 However, I did capture it. 16:44.160 --> 16:49.420 So automation tools will try public if they will fail back to public, right? 16:49.420 --> 16:51.620 And if I do that, let me cut it. 16:52.760 --> 17:00.220 When I do public, it actually replies as a Cisco switch with the name SWTKY03, right? 17:00.220 --> 17:02.320 So it behaves as a Cisco switch. 17:03.940 --> 17:07.000 Okay, what else we can try? 17:07.140 --> 17:15.960 Oh, by the way, let me show you all those credentials that Carpa is storing in a text file. 17:16.020 --> 17:18.380 There you go, the enable password. 17:18.980 --> 17:24.100 All those credentials are being stored in a text file, of course, but they're also being pushed to Faraday. 17:25.280 --> 17:40.820 So if I log to my Faraday dashboard, if I go to manage, hosts, it will create automatically a host and you also add credentials to it. 17:40.820 --> 17:45.380 So you see that host, it has a telnet, the username and the password. 17:45.840 --> 17:48.220 The E stands for enable, of course, right? 17:49.240 --> 17:53.600 So those are being pushed automatically from Carpa into Faraday, right? 17:55.480 --> 17:56.520 Oops. 17:58.280 --> 17:59.240 All right. 18:00.080 --> 18:02.760 The SNMP did not arrive yet. 18:03.980 --> 18:05.880 It should arrive soon. 18:06.320 --> 18:11.100 I think I'm cycling the credentials every 60 seconds, 30 seconds, I can't remember. 18:11.200 --> 18:12.440 So what about now? 18:12.440 --> 18:14.160 Let's try nmap. 18:16.740 --> 18:19.920 sv for 10.10.152. 18:20.220 --> 18:23.340 And this is funny, you will see some... 18:23.340 --> 18:32.840 When I run npm for service enumeration, you may see paramicos and errors here, but there's nothing wrong with it. 18:32.840 --> 18:38.880 It's just because this debug mode is showing that, but nothing crashed on Cisco, still running. 18:40.180 --> 18:50.840 So once I do the nmap, let's see what nmap say I have running on that 10.10.10.152, which is my fake Cisco switch, right? 18:52.720 --> 19:02.020 Okay, so it has recognized I have an SSH and a telnet, which is a Cisco daemons, and also they connect the device as a Cisco IOS router. 19:02.400 --> 19:03.420 Not bad. 19:03.420 --> 19:04.000 Here you go. 19:04.000 --> 19:12.560 I got the community as well here, the SNMP community, and that should be also pushed here. 19:12.560 --> 19:14.220 Let me refresh this. 19:15.080 --> 19:17.640 No, not pushed yet. 19:17.640 --> 19:21.480 It should be coming up. 19:25.730 --> 19:28.010 Maybe I need to refresh that. 19:31.650 --> 19:34.690 Or maybe I'm excluding, actually, SNMP. 19:34.770 --> 19:36.570 Yeah, most likely. 19:36.890 --> 19:38.330 I need to add it. 19:38.330 --> 19:40.870 Alright, no big deal. 19:42.470 --> 19:44.350 Okay, what else? 19:45.770 --> 19:48.330 Let's stop this for a second. 19:48.830 --> 19:53.010 So those are pretty much all the features that we've been running in the past. 19:53.010 --> 19:57.330 So now I'm going to show you the new features we've been working on. 19:58.030 --> 20:04.910 First of all, let's bring up Circo with DNS. 20:08.050 --> 20:12.290 And I'm going to connect to my PC on the back. 20:13.190 --> 20:15.530 I'm going to connect remotely. 20:17.790 --> 20:21.010 And I'm going to... 20:21.010 --> 20:28.110 So I'm going to generate, this is a PC running on the back, and I'm going to generate some FTP and Kerberos traffic. 20:28.470 --> 20:32.330 I'm going to replay some traffic, some pickups, basically. 20:32.790 --> 20:36.930 So when I start Cisco, I'm thinking this is minus D, DNS, right? 20:36.930 --> 20:38.990 If iteration DNS, for example. 20:39.290 --> 20:43.870 And here, it's a starting net cred sniffer, right? 20:44.230 --> 20:48.570 So the PC now is using FTP and Kerberos, etc. 20:48.570 --> 20:50.210 from the PC, right? 20:50.210 --> 20:55.710 So because I'm sniffing the traffic that comes from the PC, I'm also going to exfiltrate that traffic too. 20:56.950 --> 21:00.810 That's just running until all the packets run, right? 21:02.730 --> 21:08.110 So it clearly finds some credentials, and it gets exfiltrated by DNS. 21:08.610 --> 21:09.450 There you go. 21:09.450 --> 21:19.050 The end for net creds, username and a password, and the actual FTP and port destination that those credentials work. 21:19.050 --> 21:25.870 That's important because here is the source port of the automation tool or whoever connected it, right? 21:25.870 --> 21:29.830 But in net creds, I care about the destination. 21:32.790 --> 21:34.990 What else I have to show you? 21:35.850 --> 21:37.830 I actually should have some... 21:39.470 --> 21:43.630 Let's move on into something else, right? 21:43.630 --> 21:44.570 Let me cut this. 21:44.570 --> 21:46.010 You get the sense. 21:47.910 --> 21:49.370 Stop this. 21:50.750 --> 21:51.550 Okay. 21:51.890 --> 21:56.490 So I'm going to show you the spoofing feature, right? 21:59.690 --> 22:04.590 TCP 25 for exfiltration and minus minus spoof, right? 22:05.550 --> 22:08.490 For that, I'm going to connect into... 22:09.270 --> 22:10.950 I need to specify... 22:11.550 --> 22:19.190 I'm going to connect into the gateway, which is a black box on the lab, which is my firewall, right? 22:19.190 --> 22:22.370 So I'm filtering for port 25, right? 22:22.370 --> 22:26.990 So originally my MAC address is this one, right? 22:26.990 --> 22:30.470 And my IP was 152, 10.10.152. 22:30.470 --> 22:34.630 But because I specify minus minus spoof, right? 22:35.050 --> 22:38.590 I'm actually starting the spoof discovery. 22:38.590 --> 22:47.030 What it does is look in the other interface for packets and MAC address combination and use those when I do exfiltration, right? 22:48.930 --> 22:50.130 Okay. 22:55.060 --> 23:01.200 So for that, I probably... let's see if I can finish one. 23:02.280 --> 23:07.160 Okay, I found a MAC address, which is 100 and this MAC address. 23:07.580 --> 23:08.860 So I'm 25. 23:08.860 --> 23:10.040 So what I'm going to do is... 23:10.620 --> 23:15.660 I can ping this, so I'm going to connect again just to generate some credentials. 23:21.190 --> 23:22.550 All right. 23:22.550 --> 23:26.470 So that should trigger some credentials. 23:26.470 --> 23:30.680 And if I check the actual packet captures... 23:33.530 --> 23:35.310 Did I hit enter here? 23:35.310 --> 23:36.630 No. 23:38.810 --> 23:41.230 So I'm capturing packets. 23:41.230 --> 23:41.930 There you go. 23:41.930 --> 23:43.800 I start to see packets coming in. 23:44.170 --> 23:48.350 And as you can see, the source IP is 100. 23:48.350 --> 23:51.590 And the actual MAC address is matching. 23:51.590 --> 23:55.450 This is actually the PC, the PC behind me, probably. 23:58.340 --> 23:59.480 Okay. 23:59.780 --> 24:03.220 Something went wrong here. 24:03.240 --> 24:06.120 Probably some characters. 24:06.320 --> 24:08.340 Let me run it again. 24:09.320 --> 24:10.540 Okay. 24:10.580 --> 24:12.960 So that is done there. 24:12.960 --> 24:15.100 So now I'm going to do is... 24:15.960 --> 24:19.520 I'm going to show you the void features, right? 24:20.460 --> 24:21.500 Yes. 24:21.620 --> 24:22.900 Cancel, cancel. 24:23.420 --> 24:24.320 All right. 24:24.320 --> 24:29.580 For that, we use DNS and voice. 24:29.980 --> 24:30.620 Voip? 24:30.620 --> 24:31.100 Voip. 24:31.100 --> 24:32.140 I think it's Voip. 24:32.140 --> 24:32.900 Yes. 24:35.500 --> 24:38.600 For this, I will need the... 24:38.600 --> 24:40.360 I will need to make a phone call, actually. 24:41.420 --> 24:42.180 Right. 24:43.280 --> 24:46.220 Is this phone actually logging? 24:51.600 --> 24:53.040 Yep, it is actually. 24:53.720 --> 24:56.040 So what I'm going to do... 25:05.650 --> 25:07.110 Start Carpa. 25:07.190 --> 25:08.910 Exfiltration is DNS. 25:09.050 --> 25:11.370 And zip hash collector, right? 25:11.370 --> 25:13.610 And RTP captures, okay? 25:13.610 --> 25:15.370 So I'm going to make a phone call. 25:29.610 --> 25:30.890 Hello? 25:30.910 --> 25:32.230 Pick it up. 25:33.050 --> 25:34.010 Hello? 25:38.430 --> 25:39.930 All right. 25:40.150 --> 25:41.490 I make a call. 25:41.510 --> 25:42.310 Great. 25:42.310 --> 25:45.630 As you can see now, it says sending credentials via DNS. 25:45.630 --> 25:48.810 This is because that phone probably sent a zip request. 25:48.910 --> 25:51.570 So that means that it's going to get a zip hash, right? 25:53.190 --> 25:53.670 So... 25:56.390 --> 25:57.310 Here you go. 25:57.310 --> 25:57.690 Yeah. 25:57.690 --> 25:58.950 Zip credentials, right? 25:59.410 --> 26:01.750 So those should be arriving in Carpa. 26:01.750 --> 26:03.950 And they should have the format with a V. 26:03.950 --> 26:04.950 There you go. 26:05.290 --> 26:07.670 This is a zip hash, actually, right? 26:07.670 --> 26:09.750 These two pieces. 26:09.750 --> 26:15.470 And this is actually the registered zip, the username, and the type of phone system. 26:17.070 --> 26:17.670 So... 26:18.990 --> 26:29.270 Because we actually keep the captures of the RTP stream and the zip for control, so what we can do... 26:29.270 --> 26:38.670 We cannot actually trade these because they are big files, but what we can do is once we pick up Cisco after the assessment, we can actually grab the pickups. 26:38.670 --> 26:39.930 And... 26:41.490 --> 26:42.850 Pickup to WAP. 26:42.850 --> 26:44.690 Pickup to WAP. 26:44.990 --> 26:47.890 I'm going to use the RTP stream. 26:50.010 --> 26:51.670 And I'm going to use... 26:52.550 --> 26:53.990 I can't remember the... 26:55.190 --> 26:56.130 Pickup to WAP. 26:56.130 --> 26:57.210 Pickup to WAP. 26:57.210 --> 26:58.050 What was it? 26:58.050 --> 26:58.650 P. 26:58.650 --> 26:59.570 Okay. 27:01.230 --> 27:02.230 RTP. 27:02.230 --> 27:03.070 RTP. 27:03.070 --> 27:03.970 RTP. 27:03.970 --> 27:04.710 P. 27:04.950 --> 27:05.630 And... 27:05.630 --> 27:06.490 Mix. 27:11.200 --> 27:12.140 Okay. 27:12.140 --> 27:14.700 So this will generate the WAP file. 27:17.400 --> 27:21.840 I should be able to play it back. 27:22.320 --> 27:25.640 Of course I need to extract it, right? 27:27.260 --> 27:27.620 So... 27:27.980 --> 27:31.920 Let's copy this to my actually... 27:31.920 --> 27:34.760 10.10.117... 27:39.150 --> 27:40.590 Username as well. 27:47.140 --> 27:48.420 It's not. 27:49.520 --> 27:50.640 20.10. 27:50.640 --> 27:51.560 There you go. 27:57.360 --> 27:58.220 Okay. 27:58.980 --> 28:00.260 There you go. 28:00.460 --> 28:04.340 So if I do play of that file... 28:06.660 --> 28:06.980 Hello? 28:06.980 --> 28:07.680 Hello? 28:09.320 --> 28:11.440 As you can see, there you go. 28:11.520 --> 28:12.980 You get your WAP file. 28:13.440 --> 28:14.380 Great! 28:16.160 --> 28:16.640 So... 28:17.140 --> 28:20.200 I got one more feature to show you, which is... 28:20.200 --> 28:24.000 Let's bring up Circo, this time with FM and wireless... 28:25.200 --> 28:26.400 Exfiltration. 28:26.820 --> 28:28.900 But for here... 28:28.900 --> 28:30.500 I need to show you... 28:32.020 --> 28:32.740 Howla. 28:33.160 --> 28:34.740 Howla is actually my... 28:36.760 --> 28:38.700 Different computer. 28:38.700 --> 28:41.840 Different laptop running a wireless and the SDR dongle. 28:42.040 --> 28:44.600 So here I will run this... 28:44.600 --> 28:45.240 Verbose. 28:45.240 --> 28:47.040 I will specify the frequency. 28:47.040 --> 28:48.280 10.7. 28:48.280 --> 28:49.980 The wireless interface. 28:50.300 --> 28:52.140 And a log file. 28:56.010 --> 28:57.130 Alright? 28:57.610 --> 29:01.850 So, before I run that, I want you to understand that I'm going to be... 29:03.070 --> 29:05.750 Using FM, so I bring up a... 29:06.950 --> 29:09.210 Screen so you can see it. 29:09.490 --> 29:10.990 Let me bring this up. 29:10.990 --> 29:14.130 Channel 10 for wireless and frequency for FM. 29:15.090 --> 29:17.030 This is the decoder. 29:18.470 --> 29:20.390 And for RDS. 29:20.390 --> 29:22.770 Let me do that. 29:22.950 --> 29:24.170 Ok. 29:28.280 --> 29:29.680 Maybe there. 29:29.680 --> 29:30.820 Right. 29:31.360 --> 29:35.020 So, now I'm going to... 29:36.060 --> 29:38.800 Go back to my screen. 29:38.860 --> 29:42.220 And actually start Circo. 29:51.680 --> 29:57.120 I'm starting with the wireless and the FM modules on. 30:05.080 --> 30:08.260 Let me see if I can do something else here. 30:19.120 --> 30:20.060 Alright. 30:20.060 --> 30:21.320 This is started. 30:21.320 --> 30:23.540 So I'm going to telnet again. 30:23.940 --> 30:26.700 And I'm going to put some credentials. 30:32.560 --> 30:33.840 Alright. 30:34.940 --> 30:35.580 So... 30:36.160 --> 30:37.500 Starting exfiltration. 30:37.500 --> 30:40.460 So I'm going to switch to my Jaula. 30:42.160 --> 30:44.140 You see the silence now? 30:45.040 --> 30:48.780 You can see that there is a new station called Circo. 30:48.780 --> 30:51.820 With different program types and different PI. 30:51.820 --> 30:55.480 This is the RDS type of the FM protocol. 30:55.480 --> 30:58.520 Well , not the FM protocol but the RDS protocol. 30:58.620 --> 31:01.320 On the bottom you can see I already start to... 31:02.800 --> 31:07.160 To actually exfiltrate credentials here. 31:09.770 --> 31:11.550 The WiFi one. 31:11.550 --> 31:12.350 The telnet. 31:12.350 --> 31:13.330 The username. 31:13.330 --> 31:14.570 Mundoi. 31:14.570 --> 31:16.650 Clearly I typed it wrongly. 31:17.090 --> 31:18.810 And also from FM. 31:19.650 --> 31:23.570 So you can see both credentials getting from FM and actually... 31:24.590 --> 31:28.630 Let me cut it so we are not all deaf. 31:28.690 --> 31:33.030 So we get the credentials by FM and actually by wireless as well. 31:37.970 --> 31:39.330 Alright. 31:39.490 --> 31:42.490 That is pretty much. 31:43.730 --> 31:44.410 So... 31:44.410 --> 31:47.410 Before we move on I want to explain you about... 31:48.190 --> 31:49.700 One more thing. 31:51.970 --> 31:53.290 Let me... 31:54.230 --> 31:54.890 Go... 31:55.400 --> 31:56.390 Here. 31:56.690 --> 31:57.570 Ok. 31:58.110 --> 31:59.670 Close this. 32:01.150 --> 32:03.550 And let's start Circo one more time. 32:03.550 --> 32:04.330 Bridge. 32:04.330 --> 32:05.350 Spin. 32:07.980 --> 32:12.090 There is one more feature which is actually the light sensor, right? 32:12.090 --> 32:15.050 So for this I probably will... 32:15.050 --> 32:16.810 Need to go to switch. 32:16.810 --> 32:19.530 Let me see once Circo start. 32:20.030 --> 32:22.090 Carpa is already on. 32:23.010 --> 32:23.730 Ok. 32:23.730 --> 32:26.710 So I will need to move to... 32:26.710 --> 32:28.430 Back camera probably. 32:28.930 --> 32:31.410 Once this stuff is up. 32:32.650 --> 32:34.390 Yep, it's up. 32:35.250 --> 32:36.530 Alright. 32:38.430 --> 32:39.530 Ok. 32:41.090 --> 32:41.730 So... 32:41.730 --> 32:43.450 This is what I'm going to do. 32:44.930 --> 32:47.430 I'm going to open this box, right? 32:59.570 --> 33:00.530 Ok. 33:13.830 --> 33:15.470 Let me see if I can get it... 33:21.500 --> 33:22.680 There you go. 33:27.290 --> 33:29.390 Ok, what do we have inside? 33:30.290 --> 33:31.270 Let me see if... 33:31.270 --> 33:33.550 Maybe I do a bit like that. 33:34.290 --> 33:35.210 There you go. 33:35.630 --> 33:37.690 So we have a Raspberry Pi. 33:37.990 --> 33:39.630 Power components. 33:40.890 --> 33:41.370 And... 33:41.370 --> 33:44.750 On the bottom here we have a light sensor, right? 33:51.070 --> 33:53.750 So if I switch back... 33:53.750 --> 33:54.430 You will see... 33:56.010 --> 33:58.070 Carpa is receiving an alarm. 33:58.390 --> 33:59.290 And it actually... 34:02.570 --> 34:03.250 Circo... 34:03.250 --> 34:05.750 Recognize the case has been opened. 34:05.750 --> 34:06.170 Right . 34:06.170 --> 34:07.270 Circo. 34:08.510 --> 34:10.830 So that's pretty much. 34:10.830 --> 34:13.570 So one thing I want to show you guys. 34:13.590 --> 34:15.110 It's a magic cable. 34:21.300 --> 34:23.500 So the magic cable I told you was... 34:24.540 --> 34:26.660 It looked like a cable like that. 34:26.680 --> 34:27.360 You know. 34:28.000 --> 34:29.500 In Japan they come like that. 34:29.500 --> 34:31.180 This is for earth, right? 34:33.240 --> 34:33.720 This... 34:34.280 --> 34:36.200 This is not a magic cable. 34:36.200 --> 34:37.600 There's no magic here. 34:38.760 --> 34:40.760 You also can get magic here. 34:40.760 --> 34:42.520 This type of cables, right? 34:42.580 --> 34:43.560 This is earth. 34:43.560 --> 34:45.400 Or the British cables. 34:45.400 --> 34:46.860 Which is this one, right? 34:46.980 --> 34:48.940 So where the magic come from? 34:49.060 --> 34:50.620 Well, the magic is like... 34:50.620 --> 34:52.080 I'm using the GPO. 34:52.080 --> 34:54.760 A pin in the Raspberry to modulate the FM frequency. 34:54.760 --> 34:56.400 And I need basically an antenna. 34:56.560 --> 34:58.320 So one way to get an antenna. 34:58.400 --> 34:59.600 Is actually... 34:59.600 --> 35:02.700 There's an earth cable inside the power cable. 35:02.840 --> 35:04.880 So if you look into the... 35:04.880 --> 35:08.440 Where that earth cable connect into the... 35:08.440 --> 35:09.800 Circo. 35:09.800 --> 35:12.260 You will see there's a white cable coming out. 35:15.950 --> 35:17.590 This white cable. 35:18.610 --> 35:20.970 It come out from earth. 35:22.330 --> 35:25.290 And it goes to the GPO of the Raspberry. 35:26.370 --> 35:28.550 And that is my earth, right? 35:28.550 --> 35:29.970 So that basically... 35:34.900 --> 35:38.980 That give me actually a 2-3 meters FM antenna. 35:38.980 --> 35:39.440 Which great... 35:40.940 --> 35:42.980 Great distance reach. 35:43.220 --> 35:43.820 So... 35:43.820 --> 35:46.180 This is another method for exfiltrating. 35:46.180 --> 35:52.140 When wireless is not an option due to 50-80 meters length, right? 35:52.140 --> 35:54.580 You can go longer with FM. 35:55.340 --> 35:56.620 All right. 35:57.820 --> 35:59.540 That's all, guys. 36:01.000 --> 36:01.640 So... 36:01.640 --> 36:04.180 I hope you actually enjoy it. 36:04.180 --> 36:06.140 And let me know if anything... 36:07.760 --> 36:10.560 Questions, just shout out, right? 36:12.020 --> 36:14.020 Okay, thanks. 36:14.460 --> 36:15.520 See ya.