1 00:00:06,570 --> 00:00:08,090 Hi everybody, I'm Anthony. 2 00:00:08,090 --> 00:00:11,730 I go by Koin and I'm one of the developers of Starkiller and Empire. 3 00:00:11,850 --> 00:00:14,090 I'm also here with Jake and Vince. 4 00:00:15,050 --> 00:00:16,690 Hey, I'm Jake. 5 00:00:16,690 --> 00:00:18,170 I go by Hubble. 6 00:00:18,170 --> 00:00:21,490 I'm also one of the developers for Starkiller and Empire. 7 00:00:21,710 --> 00:00:22,630 And I'm Vince. 8 00:00:22,630 --> 00:00:25,450 I created Starkiller and I'm the lead developer. 9 00:00:26,510 --> 00:00:32,130 So we're going to be talking about Starkiller today, which is our threat emulation platform that we use for red teaming. 10 00:00:32,270 --> 00:00:46,810 What this allows us to do is to have an intuitive interface that multiple users can log in from and interact with the team server, as well as it has some hooks built into it to the MITRE ATT&CK framework that gives links to techniques inside of all our modules. 11 00:00:47,170 --> 00:00:53,050 And what this setup allows us to do is to have our teams most accurately emulate the threats for our assessments. 12 00:00:55,350 --> 00:01:03,350 Since we're trying to emulate that threat, what we're really focusing on is trying to make sure that we're replicating their TTPs, those tactics, techniques, and procedures. 13 00:01:03,550 --> 00:01:13,830 Since this is what the threat is going to use to obtain their objectives, we're going to make sure that everything we do in our tests focus around what the threat's going to be and be representative. 14 00:01:14,010 --> 00:01:15,850 That includes our infrastructure. 15 00:01:15,890 --> 00:01:22,010 We want to make sure that our infrastructure mirrors exactly what an APT setup is going to look like. 16 00:01:22,010 --> 00:01:27,330 For example, our stagers and payloads, as well as our implants will mirror the threats. 17 00:01:27,350 --> 00:01:34,010 Our setup will typically include multiple operators across different locations, all connected to the team server. 18 00:01:34,710 --> 00:01:38,410 They may be spread out as well to make sure that everything is segregated. 19 00:01:38,630 --> 00:01:43,490 So that way, if one server goes down, we're not going to lose our entire operation and burn it. 20 00:01:43,590 --> 00:01:52,210 We want to make sure that our infrastructure mirrors what the threat's going to do and are going to be able to emulate what they're going to be running for their attacks. 21 00:01:56,500 --> 00:02:03,720 So what you kind of saw in the that connects to our team server. 22 00:02:03,800 --> 00:02:10,880 So Starkiller provides a UI on top of the C2 server, in this case, Empire. 23 00:02:10,880 --> 00:02:15,040 And it allows us to interact as a team. 24 00:02:15,040 --> 00:02:16,940 So we have multi-user support. 25 00:02:16,940 --> 00:02:19,300 We have a live reporting interface. 26 00:02:19,300 --> 00:02:28,400 So anytime a team member runs a module or a command, we're able to instantly see those commands through the interface. 27 00:02:28,400 --> 00:02:33,200 And it simplifies a lot of the workflows that are a little bit more tedious through the CLI. 28 00:02:35,820 --> 00:02:43,620 So as we mentioned, Starkiller is a GUI interface that interacts with the Empire C2 server. 29 00:02:43,700 --> 00:02:47,820 Empire is built on PowerShell and Python, for those of you that aren't aware. 30 00:02:48,100 --> 00:03:02,860 With the addition of Starkiller, it can now be ran as either a team server or an all-in-one C2, which means just a person's running the C2 on the command line directly, like there's no other infrastructure required to run that C2. 31 00:03:03,020 --> 00:03:04,760 It has a bunch of adaptive modules. 32 00:03:04,760 --> 00:03:07,200 We're up to about 300 now. 33 00:03:07,420 --> 00:03:18,680 And then the original project ended support back in August of 2019, but we forked it and have been maintaining and updating it ever since, which is why we built Starkiller on top of it. 34 00:03:18,680 --> 00:03:31,400 And we really built Starkiller to address some of the shortfalls that Vincent mentioned, to allow for threat emulation and just like a modern red team engagement when using Empire as your primary C2. 35 00:03:34,000 --> 00:03:55,280 So ever since we forked Empire when it was originally, when support was originally ended, we get asked a lot why we still think PowerShell is important, because there's a whole bunch of mitigations in place, you know, like script block logging and AMSI and all those kinds of things that do make PowerShell much more difficult when it is implemented properly. 36 00:03:55,280 --> 00:04:12,660 But even though red teams have started moving on to C-Sharp and other .NET tradecraft and Microsoft has started kind of focusing protections elsewhere, PowerShell is still a huge attack vector that's utilized like every day by APTs. 37 00:04:12,660 --> 00:04:21,140 CrowdStrike came out with a report in 2019 that said as many as 90% of breaches use PowerShell in some way. 38 00:04:21,140 --> 00:04:31,480 Now that doesn't mean that PowerShell is their primary means of operations, or even that it's the majority of what's being done, but it's still used in 90% of breaches according to CrowdStrike. 39 00:04:31,480 --> 00:04:48,360 So we still think it's really worthwhile for red teams to emulate threats using PowerShell, because even though all those mitigations do exist for it, we still see many, many organizations that are vulnerable to PowerShell because they don't have those mitigations properly implemented. 40 00:04:51,930 --> 00:04:55,230 So what we have here is our team server setup running Empire. 41 00:04:55,230 --> 00:04:59,530 We also have multiple Starkiller instances all connected to that team server. 42 00:04:59,910 --> 00:05:06,430 That team server is then sitting in a secure location that could be either in the cloud or like one of our offices. 43 00:05:06,710 --> 00:05:11,470 There is then a secure line directly into our server, our cloud server. 44 00:05:11,470 --> 00:05:13,130 In this case, it's AWS. 45 00:05:13,570 --> 00:05:16,730 That cloud server is then going to reach out to all of our redirectors. 46 00:05:16,790 --> 00:05:23,890 We have these multiple redirectors up in case one of them gets burned, that way if it does happen, we don't lose our entire infrastructure. 47 00:05:23,990 --> 00:05:31,290 Why we do this is this setup allows us to rebuild certain parts of our infrastructure very easily, so we don't lose critical pieces. 48 00:05:33,470 --> 00:05:52,650 Yeah, and then just another advantage of setting up our infrastructure this way is it allows us to really lock down our Empire server on top of using like reverse port forwarding to connect to the AWS server so that the Empire server can't be accessed directly from external our network. 49 00:05:52,650 --> 00:06:00,190 We can also lock down it down internally because we can basically lock everything down except for the Starkiller ports. 50 00:06:00,550 --> 00:06:13,550 And that way, if our network is compromised, it limits the ability for an attacker to access the Empire server, and more importantly, access the customer data that we're going to be handling since many times that data is extremely sensitive. 51 00:06:14,270 --> 00:06:22,890 So really, the main two goals for Starkiller for us is one, we want to make our workflows for red teams to be more efficient. 52 00:06:22,890 --> 00:06:29,110 And we do that by eliminating some of the menu options that were in Empire and making them more simplified. 53 00:06:29,310 --> 00:06:37,250 Previously in Empire, what you had to do was you had to memorize or go through multiple menus to be able to set up your listeners, your stagers, and your modules. 54 00:06:37,510 --> 00:06:41,950 Through Starkiller, what you have now is you have these menus that are pre-populated. 55 00:06:41,950 --> 00:06:43,790 Sometimes they have drop-down menus. 56 00:06:44,110 --> 00:06:47,250 And this makes workflows much, much easier for teams. 57 00:06:47,630 --> 00:06:50,630 The second thing is the team-oriented engagements. 58 00:06:50,850 --> 00:06:55,530 With Empire previously, you can only have one person logged in at a time. 59 00:06:55,590 --> 00:06:57,230 They're using that command line interface. 60 00:06:57,230 --> 00:07:01,390 And if somebody else wanted to do an engagement, you have to stand up a completely separate server. 61 00:07:01,530 --> 00:07:05,850 Now with Starkiller, you can have multiple users all using the same team server. 62 00:07:05,870 --> 00:07:07,410 They can share credentials. 63 00:07:07,410 --> 00:07:09,850 They can share their results from their modules. 64 00:07:09,850 --> 00:07:13,570 And they can generate a single report for their entire engagement. 65 00:07:14,610 --> 00:07:21,370 Yeah, and then just to add a little more to that, we plan on future growth for this capability as well. 66 00:07:21,370 --> 00:07:32,830 But it also provides more oversight for the team lead by giving them a centralized location to see what their operators are doing, what things have been done, as well as when things are ran on individual boxes and that kind of thing. 67 00:07:32,830 --> 00:07:39,280 It gives them a centralized location to see all that data and keep an eye on the operation as it's progressing. 68 00:07:42,900 --> 00:07:46,020 So setting up Starkiller is fairly simple. 69 00:07:46,020 --> 00:07:52,600 When you run Empire, you're going to pass the REST parameter, which tells it to run the REST API. 70 00:07:52,600 --> 00:07:56,300 There's a default login and password, which you can change. 71 00:07:56,460 --> 00:08:11,240 And then to actually run Starkiller, you can either download the installer for Windows, off of the releases page on GitHub, or there's instructions in the readme to build it from the source. 72 00:08:14,600 --> 00:08:16,100 All right, thanks, guys. 73 00:08:16,100 --> 00:08:19,120 We're going to demo the features of Starkiller now. 74 00:08:19,120 --> 00:08:26,540 So Vince has an instance set up already, back into our personal range, where Empire is already running on a team server. 75 00:08:26,540 --> 00:08:29,140 And then we have Starkiller connecting into that. 76 00:08:31,400 --> 00:08:34,760 Okay, so this is the Starkiller login page. 77 00:08:34,760 --> 00:08:38,600 I'm going to log in using the default username and password. 78 00:08:38,600 --> 00:08:43,620 And we're connecting to an Empire instance that we have, that we already have running. 79 00:08:45,460 --> 00:09:00,500 When I go to the settings page, we can change our password, we can turn dark mode on and off, we have access to our API token for connecting to the Empire API. 80 00:09:00,600 --> 00:09:11,400 This is useful if you want to interact with the Empire API outside of Starkiller, or if you wanted to use some other tool like Deathstar to interact with the Empire API. 81 00:09:12,720 --> 00:09:16,340 The next piece is the user management page. 82 00:09:16,340 --> 00:09:21,040 So on this page, we get a list of all the users that have an account for Starkiller. 83 00:09:21,040 --> 00:09:27,120 We can see when they when they last logged in, and we're able to enable and disable those users. 84 00:09:27,960 --> 00:09:36,700 I'm going to go ahead and create a user account for myself with the password of password. 85 00:09:40,410 --> 00:09:43,090 And we can see that I now have an account. 86 00:09:46,600 --> 00:09:49,920 So the next thing is the modules list page. 87 00:09:49,920 --> 00:09:56,680 So this page gives you a list of all of the modules that we have access to in our instance of Empire. 88 00:09:56,940 --> 00:10:09,460 And using the search box, we can search down by the name of the module, we can search down by the MITRE attack techniques, and also the descriptions of the modules. 89 00:10:09,460 --> 00:10:19,120 So here I'm going to filter down by a MITRE attack technique, and I get the two modules that are in this technique. 90 00:10:19,120 --> 00:10:28,520 And if I click into it, it'll bring us to the web page for that MITRE attack technique so that we can get more information about it. 91 00:10:30,850 --> 00:10:46,310 And then here, if we expand an individual module, we can get the author information, we can get the description about that module, and then often the comments will have a link back to the source material for that module. 92 00:10:51,380 --> 00:10:55,200 Okay, so this is the listeners list page. 93 00:10:55,200 --> 00:10:59,040 And here we can see all the listeners that have already been created in Empire. 94 00:10:59,140 --> 00:11:01,500 So let's go ahead and create another one. 95 00:11:02,040 --> 00:11:04,640 We're going to choose a type . 96 00:11:04,800 --> 00:11:11,180 And then once we choose that type, we get the form pre-filled out with all the defaults. 97 00:11:11,180 --> 00:11:18,340 And we're going to go ahead and just update this so it doesn't overlap with the previously created. 98 00:11:18,340 --> 00:11:24,720 And any optional fields are just in this expandable context here. 99 00:11:25,420 --> 00:11:28,940 I'm going to submit, and that listener has been created. 100 00:11:30,480 --> 00:11:33,520 The next page is the stagers page. 101 00:11:33,700 --> 00:11:41,140 Stagers are the initial payload that we send to the agent to initiate the connection back to our C2 server. 102 00:11:41,140 --> 00:11:44,420 So you can see that we already have a couple of stagers created here. 103 00:11:44,880 --> 00:11:46,700 I'm going to go ahead and generate a couple more. 104 00:11:47,620 --> 00:11:51,880 So the first one that I'm going to create is a multi-launcher. 105 00:11:52,640 --> 00:11:56,520 And we're going to have it connect to the listener that I just created. 106 00:11:56,520 --> 00:11:59,300 And we're going to keep the rest of the settings the same. 107 00:11:59,480 --> 00:12:05,620 Up here, I can expand the information box, and that'll give us some more info about the stager. 108 00:12:15,240 --> 00:12:17,020 Okay, so that one's been created. 109 00:12:17,100 --> 00:12:18,900 Now I'm going to create one more. 110 00:12:19,880 --> 00:12:23,180 This one is going to be downloadable DLL. 111 00:12:24,700 --> 00:12:28,100 And again, I'm going to choose the listener that we just created. 112 00:12:28,120 --> 00:12:29,660 I'm going to hit submit. 113 00:12:32,120 --> 00:12:42,440 Okay, so now that we've created those two stagers, we can see some information about it, which listener it connects back to, the language, and when it was created. 114 00:12:42,440 --> 00:12:46,700 And then over here, we have the ability to copy or download. 115 00:12:46,700 --> 00:12:52,160 So this first one that we generated, multi-launcher, has a little paperclip icon. 116 00:12:52,160 --> 00:13:01,460 And when you click that, it copies it to the clipboard, because this is like a one-liner that you can then paste into a command prompt or your PowerShell window. 117 00:13:01,740 --> 00:13:06,980 And the second one here has a download icon, because it's a file. 118 00:13:06,980 --> 00:13:12,060 And you can download this file and then get that to your target, however you need to get it to them. 119 00:13:13,340 --> 00:13:30,100 Yeah, and something that's really nice about this over Empire is that our stagers remain persistent, not only for when we change between menus, but also if you log out of StarKiller and then log back in, your agents will still be there. 120 00:13:30,220 --> 00:13:35,940 Because in Empire, especially when we create one-liners, as soon as we move to another menu, it's gone. 121 00:13:35,940 --> 00:13:51,900 And we have to regenerate it and then cut and paste it and save it and all those things, whereas StarKiller just keeps it all in one place for us and saves it between sessions and all that kind of stuff, which is just significantly more convenient than operating directly in Empire. 122 00:13:54,080 --> 00:14:01,880 Okay, so now that we've sent those stagers out, we've gotten some callbacks into our Empire server. 123 00:14:02,180 --> 00:14:04,940 And so that brings us to the agents list. 124 00:14:04,960 --> 00:14:08,620 And here we can see all of the agents that have back to us. 125 00:14:08,620 --> 00:14:11,340 We can see the last time they checked in. 126 00:14:11,340 --> 00:14:15,520 We can see the username of the account that we're connected to. 127 00:14:15,880 --> 00:14:24,580 And if we click into it, that brings us to probably the screen that you'll spend the most time in when you're using StarKiller, which is the agent interaction screen. 128 00:14:25,040 --> 00:14:28,920 And this is where I'm going to hand it off to Quinn to talk about interacting with agents. 129 00:14:29,960 --> 00:14:33,480 So we have here is our agent screen, as Vince talked about before. 130 00:14:33,480 --> 00:14:38,060 This allows us to do our shell commands as well as execute modules. 131 00:14:38,160 --> 00:14:40,300 There's a couple of nice features here. 132 00:14:40,300 --> 00:14:43,380 All we can see at the bottom is Hubble actually just ran something. 133 00:14:43,380 --> 00:14:47,080 This interface allows multiple users to interact with the same agent. 134 00:14:47,100 --> 00:14:51,500 And every command that you run is going to be tagged with the username that you have associated with yourself. 135 00:14:51,580 --> 00:14:59,400 So for example, I ran earlier, I set my beacon to be delay zero, and I ran that command under my Empire admin account. 136 00:14:59,400 --> 00:15:00,880 While Hubble ran, who am I? 137 00:15:00,880 --> 00:15:02,580 And then got his results back. 138 00:15:02,760 --> 00:15:05,740 I can also go in here and I can go to shell commands. 139 00:15:05,920 --> 00:15:10,180 I can type in ps, just like I would in Empire, to get my process list. 140 00:15:10,180 --> 00:15:11,360 It's now going to run that. 141 00:15:11,360 --> 00:15:12,620 It puts it in a queue. 142 00:15:12,620 --> 00:15:20,720 All commands are set into a queue, regardless of who sends it, and it'll execute that queue throughout and then drop all the results in the screen. 143 00:15:21,120 --> 00:15:22,880 Your results aren't just going to be in the screen. 144 00:15:22,880 --> 00:15:26,500 It's also saved in a database that then gets populated on a reports page. 145 00:15:26,820 --> 00:15:31,760 So everything everybody does will be aggregated together into one master log. 146 00:15:32,140 --> 00:15:34,580 And you can see here, the process list just came back. 147 00:15:34,580 --> 00:15:36,120 So you can come in, take a look. 148 00:15:36,120 --> 00:15:44,480 I can scroll through and see all the different processes that are running, as well as I can also adjust the size of this screen if I wanted to expand it a little bit as well. 149 00:15:45,060 --> 00:15:46,660 Next is the modules. 150 00:15:46,660 --> 00:15:49,880 So you have access to all the modules that are inside of Empire. 151 00:15:50,000 --> 00:15:52,280 It's nice because you don't have to navigate all the menus. 152 00:15:52,280 --> 00:15:55,100 You can actually come in here and just type in exactly what you want to run. 153 00:15:55,920 --> 00:15:57,600 I can type in Mimikatz. 154 00:15:57,600 --> 00:15:59,520 In this case, we're actually going to run Sherlock. 155 00:16:00,180 --> 00:16:06,080 I come in, select Sherlock, which is a nice little tool that'll allow me to look at some privilege escalation opportunities. 156 00:16:06,660 --> 00:16:16,300 We still have access to those MITRE ATT&CK techniques from before, so I can click on those, as well as a description and information about the module I want to run. 157 00:16:16,640 --> 00:16:22,160 So once I hit submit, it's going to run that module. 158 00:16:22,160 --> 00:16:26,200 It's going to queue it up, and then we'll get the results, and we can see that later in the reporting function. 159 00:16:27,100 --> 00:16:30,640 Next, we're going to go over into an elevated process agent. 160 00:16:30,640 --> 00:16:32,320 That way, we can show off another feature. 161 00:16:32,680 --> 00:16:33,740 So now I can come in here. 162 00:16:33,740 --> 00:16:41,980 Now that I'm in an elevated process, I can go in and run some techniques that maybe I don't have access to under a normal user, such as Mimikatz. 163 00:16:42,600 --> 00:16:44,560 So I'm going to go in, pull up Mimikatz. 164 00:16:44,560 --> 00:16:46,700 I have all the same interface stuff, as well. 165 00:16:46,760 --> 00:16:48,120 I'm going to hit submit there, as well. 166 00:16:48,120 --> 00:16:53,440 So now both of those are queued up, and I can see those results later inside of my reporting function. 167 00:16:57,410 --> 00:17:00,670 So now we're going to look at the credentials page. 168 00:17:00,670 --> 00:17:05,270 And you can see here, we already have a couple entries from running Mimikatz. 169 00:17:05,270 --> 00:17:16,290 And so the nice thing about this credentials page is it's central to everybody, all of the team members engaging on this Empire server. 170 00:17:16,290 --> 00:17:26,990 So whether I run Mimikatz or Hubble is getting credentials, they're all going to be dumped to this page, and we can all see all of the credentials. 171 00:17:27,010 --> 00:17:32,970 And these password hashes are going to be useful to us when we want to try to do lateral movement. 172 00:17:38,260 --> 00:17:43,740 Now, the last piece that we want to show you with Starkiller is this reporting interface. 173 00:17:43,740 --> 00:17:55,160 It's going to show you, in order of when it ran, when a command was run on an agent, who ran it, and what the response was. 174 00:17:55,160 --> 00:17:59,600 So for example, this is the last command that was run. 175 00:17:59,600 --> 00:18:10,300 We can see that it was run by Empire Admin, which is me, and we can see the agent that it was run on, and we can see the full output of that command. 176 00:18:10,440 --> 00:18:17,440 And now just a side note here, you'll notice this function name is just a random five-character string. 177 00:18:17,440 --> 00:18:23,120 That's one of the features that are built into Empire for keyword randomization. 178 00:18:23,120 --> 00:18:26,920 So this function name is just a random five-character string. 179 00:18:27,180 --> 00:18:39,880 That string is typically known as Mimikatz, and so that randomization just allows us to prevent strings that are known flags from showing up in memory when Empire is being ran. 180 00:18:41,620 --> 00:18:50,160 Okay, so now if we expand another one, we can see the output of the ps command in its entirety. 181 00:18:50,440 --> 00:19:02,080 And this page is really useful to the operator of the engagement, so that they can get a holistic view of all of the different things that are going on during the engagement. 182 00:19:06,240 --> 00:19:12,020 So at the bottom of Starkiller, we have links to the Empire and Starkiller repos. 183 00:19:12,020 --> 00:19:19,320 We'd love to get feature requests and bug tickets that we can fix, and we look forward to your feedback.