start	end	text
6570	11730	Hi everybody, I'm Anthony. I go by Koin and I'm one of the developers of Starkiller and Empire.
11850	20050	I'm also here with Jake and Vince. Hey, I'm Jake. I go by Hubble. I'm also one of the developers for
20050	25450	Starkiller and Empire. And I'm Vince. I created Starkiller and I'm the lead developer.
26510	30670	So we're going to be talking about Starkiller today, which is our threat emulation platform
30670	35510	that we use for red teaming. What this allows us to do is to have an intuitive interface
35510	40490	that multiple users can log in from and interact with the team server, as well as it has some
40490	44870	hooks built into it to the MITRE ATT&CK framework that gives links to techniques
44870	50590	inside of all our modules. And what this setup allows us to do is to have our teams most accurately
50590	57110	emulate the threats for our assessments. Since we're trying to emulate that threat,
57110	61270	what we're really focusing on is trying to make sure that we're replicating their TTPs,
61270	66690	those tactics, techniques, and procedures. Since this is what the threat is going to use to obtain
66690	71130	their objectives, we're going to make sure that everything we do in our tests focus around what
71130	76410	the threat's going to be and be representative. That includes our infrastructure. We want to make
76410	82870	sure that our infrastructure mirrors exactly what an APT setup is going to look like. For example,
82870	88650	our stagers and payloads, as well as our implants will mirror the threats. Our setup will typically
88650	94010	include multiple operators across different locations, all connected to the team server.
94710	99170	They may be spread out as well to make sure that everything is segregated. So that way,
99170	104150	if one server goes down, we're not going to lose our entire operation and burn it. We want to make
104150	108950	sure that our infrastructure mirrors what the threat's going to do and are going to be able
108950	120960	to emulate what they're going to be running for their attacks. So what you kind of saw in the
120960	129640	that connects to our team server. So Starkiller provides a UI on top of the C2 server,
129640	136940	in this case, Empire. And it allows us to interact as a team. So we have multi-user support.
136940	144520	We have a live reporting interface. So anytime a team member runs a module or a command,
144520	149980	we're able to instantly see those commands through the interface. And it simplifies a lot
149980	153200	of the workflows that are a little bit more tedious through the CLI.
155820	164060	So as we mentioned, Starkiller is a GUI interface that interacts with the Empire C2 server. Empire
164060	169360	is built on PowerShell and Python, for those of you that aren't aware. With the addition of
169360	175340	Starkiller, it can now be ran as either a team server or an all-in-one C2, which means just a
175340	179860	person's running the C2 on the command line directly, like there's no other infrastructure
179860	187200	required to run that C2. It has a bunch of adaptive modules. We're up to about 300 now.
187420	193800	And then the original project ended support back in August of 2019, but we forked it and have been
193800	198840	maintaining and updating it ever since, which is why we built Starkiller on top of it. And we
198840	205240	really built Starkiller to address some of the shortfalls that Vincent mentioned, to allow for
205240	211400	threat emulation and just like a modern red team engagement when using Empire as your primary C2.
214000	219880	So ever since we forked Empire when it was originally, when support was originally ended,
219880	224840	we get asked a lot why we still think PowerShell is important, because there's a whole bunch of
224840	230300	mitigations in place, you know, like script block logging and AMSI and all those kinds of things
230300	236340	that do make PowerShell much more difficult when it is implemented properly. But even though
236340	241960	red teams have started moving on to C-Sharp and other .NET tradecraft and Microsoft has started
241960	250460	kind of focusing protections elsewhere, PowerShell is still a huge attack vector that's utilized
250460	257480	like every day by APTs. CrowdStrike came out with a report in 2019 that said as many as 90%
257480	263180	of breaches use PowerShell in some way. Now that doesn't mean that PowerShell is their primary
263180	268580	means of operations, or even that it's the majority of what's being done, but it's still
268580	274440	used in 90% of breaches according to CrowdStrike. So we still think it's really worthwhile for red
274440	279800	teams to emulate threats using PowerShell, because even though all those mitigations
279800	285400	do exist for it, we still see many, many organizations that are vulnerable to PowerShell
285400	293570	because they don't have those mitigations properly implemented. So what we have here is our team
293570	298330	server setup running Empire. We also have multiple Starkiller instances all connected
298330	303750	to that team server. That team server is then sitting in a secure location that could be either
303750	310410	in the cloud or like one of our offices. There is then a secure line directly into our server,
310410	315510	our cloud server. In this case, it's AWS. That cloud server is then going to reach out to all
315510	319910	of our redirectors. We have these multiple redirectors up in case one of them gets burned,
319910	324870	that way if it does happen, we don't lose our entire infrastructure. Why we do this is this
324870	329870	setup allows us to rebuild certain parts of our infrastructure very easily, so we don't lose
329870	337270	critical pieces. Yeah, and then just another advantage of setting up our infrastructure this
337270	344730	way is it allows us to really lock down our Empire server on top of using like reverse port forwarding
344730	350970	to connect to the AWS server so that the Empire server can't be accessed directly from external
350970	356730	our network. We can also lock down it down internally because we can basically lock
356730	362690	everything down except for the Starkiller ports. And that way, if our network is compromised,
362690	369190	it limits the ability for an attacker to access the Empire server, and more importantly, access
369190	373550	the customer data that we're going to be handling since many times that data is extremely sensitive.
374270	380870	So really, the main two goals for Starkiller for us is one, we want to make our workflows
380870	386450	for red teams to be more efficient. And we do that by eliminating some of the menu options that were
386450	391170	in Empire and making them more simplified. Previously in Empire, what you had to do was you
391170	396190	had to memorize or go through multiple menus to be able to set up your listeners, your stagers,
396190	401030	and your modules. Through Starkiller, what you have now is you have these menus that are
401030	406170	pre-populated. Sometimes they have drop-down menus. And this makes workflows much, much easier
406170	413150	for teams. The second thing is the team-oriented engagements. With Empire previously, you can only
413150	417750	have one person logged in at a time. They're using that command line interface. And if somebody else
417750	422690	wanted to do an engagement, you have to stand up a completely separate server. Now with Starkiller,
422690	427610	you can have multiple users all using the same team server. They can share credentials. They can
427610	432670	share their results from their modules. And they can generate a single report for their entire
432670	440690	engagement. Yeah, and then just to add a little more to that, we plan on future growth for this
440690	445190	capability as well. But it also provides more oversight for the team lead by giving them a
445190	450350	centralized location to see what their operators are doing, what things have been done, as well as
450350	453970	when things are ran on individual boxes and that kind of thing. It gives them a centralized location
453970	459280	to see all that data and keep an eye on the operation as it's progressing.
462900	468920	So setting up Starkiller is fairly simple. When you run Empire, you're going to pass the REST
468920	475160	parameter, which tells it to run the REST API. There's a default login and password, which you
475160	482380	can change. And then to actually run Starkiller, you can either download the installer for Windows,
482380	490380	off of the releases page on GitHub, or there's instructions in the readme to build it from the
490380	499480	source. All right, thanks, guys. We're going to demo the features of Starkiller now. So Vince
499480	505040	has an instance set up already, back into our personal range, where Empire is already
505040	509140	running on a team server. And then we have Starkiller connecting into that.
511400	517600	Okay, so this is the Starkiller login page. I'm going to log in using the default username and
517600	523620	password. And we're connecting to an Empire instance that we have, that we already have running.
525460	533780	When I go to the settings page, we can change our password, we can turn dark mode on and off,
533780	542080	we have access to our API token for connecting to the Empire API. This is useful if you want to
542080	547120	interact with the Empire API outside of Starkiller, or if you wanted to use some
547120	555180	other tool like Deathstar to interact with the Empire API. The next piece is the user
555180	561040	management page. So on this page, we get a list of all the users that have an account for Starkiller.
561040	567120	We can see when they when they last logged in, and we're able to enable and disable those users.
567960	572380	I'm going to go ahead and create a user account for myself
574440	583090	with the password of password. And we can see that I now have an account.
586600	592980	So the next thing is the modules list page. So this page gives you a list of all of the modules
592980	599840	that we have access to in our instance of Empire. And using the search box, we can search down by
599840	606840	the name of the module, we can search down by the MITRE attack techniques, and also
607740	614320	the descriptions of the modules. So here I'm going to filter down by a MITRE attack technique,
614320	620480	and I get the two modules that are in this technique. And if I click into it,
620480	626000	it'll bring us to the web page for that MITRE attack technique so that we can
626480	634950	get more information about it. And then here, if we expand an individual module,
635330	640710	we can get the author information, we can get the description about that module,
640710	646310	and then often the comments will have a link back to the source material for that module.
651380	656860	Okay, so this is the listeners list page. And here we can see all the listeners that have
656860	664160	already been created in Empire. So let's go ahead and create another one. We're going to choose a
664160	671480	type. And then once we choose that type, we get the form pre-filled out with all the defaults.
671480	678340	And we're going to go ahead and just update this so it doesn't overlap with the previously created.
678340	684720	And any optional fields are just in this expandable context here.
685420	688940	I'm going to submit, and that listener has been created.
690480	697360	The next page is the stagers page. Stagers are the initial payload that we send to the agent
698020	702380	to initiate the connection back to our C2 server. So you can see that we already have
702480	706700	a couple of stagers created here. I'm going to go ahead and generate a couple more.
707620	713720	So the first one that I'm going to create is a multi-launcher. And we're going to have it
713720	718580	connect to the listener that I just created. And we're going to keep the rest of the settings the
718580	724920	same. Up here, I can expand the information box, and that'll give us some more info about the
724920	741280	stager. Okay, so that one's been created. Now I'm going to create one more. This one is going to be
741280	748100	downloadable DLL. And again, I'm going to choose the listener that we just created.
748120	755460	I'm going to hit submit. Okay, so now that we've created those two stagers, we can see
756160	761700	some information about it, which listener it connects back to, the language, and when it was
761700	767800	created. And then over here, we have the ability to copy or download. So this first one that we
767800	773800	generated, multi-launcher, has a little paperclip icon. And when you click that, it copies it to the
773800	779820	clipboard, because this is like a one-liner that you can then paste into a command prompt or your
779820	787520	PowerShell window. And the second one here has a download icon, because it's a file. And you can
787520	792060	download this file and then get that to your target, however you need to get it to them.
793340	800960	Yeah, and something that's really nice about this over Empire is that our stagers remain persistent,
800960	807280	not only for when we change between menus, but also if you log out of StarKiller and then log
807280	813860	back in, your agents will still be there. Because in Empire, especially when we create one-liners,
813860	817980	as soon as we move to another menu, it's gone. And we have to regenerate it and then cut and
817980	822360	paste it and save it and all those things, whereas StarKiller just keeps it all in one
822360	827800	place for us and saves it between sessions and all that kind of stuff, which is just
827800	831900	significantly more convenient than operating directly in Empire.
834080	840940	Okay, so now that we've sent those stagers out, we've gotten some callbacks into our Empire
840940	847620	server. And so that brings us to the agents list. And here we can see all of the agents that have
847620	854220	back to us. We can see the last time they checked in. We can see the username of the account that
854220	860320	we're connected to. And if we click into it, that brings us to probably the screen that you'll spend
860320	865360	the most time in when you're using StarKiller, which is the agent interaction screen. And this
865360	868920	is where I'm going to hand it off to Quinn to talk about interacting with agents.
869960	874920	So we have here is our agent screen, as Vince talked about before. This allows us to do our
874920	880800	shell commands as well as execute modules. There's a couple of nice features here. All we can see at
880800	885860	the bottom is Hubble actually just ran something. This interface allows multiple users to interact
885860	889960	with the same agent. And every command that you run is going to be tagged with the username that
889960	896340	you have associated with yourself. So for example, I ran earlier, I set my beacon to be delay zero,
896340	901120	and I ran that command under my Empire admin account. While Hubble ran, who am I? And then
901120	907140	got his results back. I can also go in here and I can go to shell commands. I can type in ps,
907140	911940	just like I would in Empire, to get my process list. It's now going to run that. It puts it in
912080	916620	a queue. All commands are set into a queue, regardless of who sends it, and it'll execute
916620	922060	that queue throughout and then drop all the results in the screen. Your results aren't just
922060	925920	going to be in the screen. It's also saved in a database that then gets populated on a reports
925920	932400	page. So everything everybody does will be aggregated together into one master log. And you
932400	936800	can see here, the process list just came back. So you can come in, take a look. I can scroll through
936800	941540	and see all the different processes that are running, as well as I can also adjust the size
941540	947260	of this screen if I wanted to expand it a little bit as well. Next is the modules. So you have
947260	951260	access to all the modules that are inside of Empire. It's nice because you don't have to
951260	955100	navigate all the menus. You can actually come in here and just type in exactly what you want to run.
955920	961380	I can type in Mimikatz. In this case, we're actually going to run Sherlock. I come in, select
961380	965180	Sherlock, which is a nice little tool that'll allow me to look at some privilege escalation
965180	971380	opportunities. We still have access to those MITRE ATT&CK techniques from before, so I can click on
971380	977300	those, as well as a description and information about the module I want to run. So once I hit
977300	983980	submit, it's going to run that module. It's going to queue it up, and then we'll get the results,
983980	988720	and we can see that later in the reporting function. Next, we're going to go over into
988720	993740	an elevated process agent. That way, we can show off another feature. So now I can come in here.
993740	998420	Now that I'm in an elevated process, I can go in and run some techniques that maybe I don't have
998420	1004840	access to under a normal user, such as Mimikatz. So I'm going to go in, pull up Mimikatz. I have
1004840	1008840	all the same interface stuff, as well. I'm going to hit submit there, as well. So now both of those
1008840	1013440	are queued up, and I can see those results later inside of my reporting function.
1017410	1022730	So now we're going to look at the credentials page. And you can see here, we already have a
1022730	1029150	couple entries from running Mimikatz. And so the nice thing about this credentials page is it's
1029150	1037670	central to everybody, all of the team members engaging on this Empire server. So whether I
1037670	1043730	run Mimikatz or Hubble is getting credentials, they're all going to be dumped to this page,
1043730	1050430	and we can all see all of the credentials. And these password hashes are going to be useful to
1050430	1061340	us when we want to try to do lateral movement. Now, the last piece that we want to show you
1061340	1068080	with Starkiller is this reporting interface. It's going to show you, in order of when it ran,
1068080	1076720	when a command was run on an agent, who ran it, and what the response was. So for example,
1076720	1083160	this is the last command that was run. We can see that it was run by Empire Admin, which is me,
1083160	1090300	and we can see the agent that it was run on, and we can see the full output of that command.
1090440	1096420	And now just a side note here, you'll notice this function name is just a random five-character
1096420	1103380	string. That's one of the features that are built into Empire for keyword randomization. So this
1103380	1109180	function name is just a random five-character string. That string is typically known as
1109180	1117080	Mimikatz, and so that randomization just allows us to prevent strings that are known flags from
1117080	1125780	showing up in memory when Empire is being ran. Okay, so now if we expand another one, we can see
1125780	1134640	the output of the ps command in its entirety. And this page is really useful to the operator of the
1134640	1140520	engagement, so that they can get a holistic view of all of the different things that are going on
1140520	1150540	during the engagement. So at the bottom of Starkiller, we have links to the Empire and
1150540	1157320	Starkiller repos. We'd love to get feature requests and bug tickets that we can fix,
1157320	1159320	and we look forward to your feedback.