WEBVTT 00:06.570 --> 00:08.090 Hi everybody, I'm Anthony. 00:08.090 --> 00:11.730 I go by Koin and I'm one of the developers of Starkiller and Empire. 00:11.850 --> 00:14.090 I'm also here with Jake and Vince. 00:15.050 --> 00:16.690 Hey, I'm Jake. 00:16.690 --> 00:18.170 I go by Hubble. 00:18.170 --> 00:21.490 I'm also one of the developers for Starkiller and Empire. 00:21.710 --> 00:22.630 And I'm Vince. 00:22.630 --> 00:25.450 I created Starkiller and I'm the lead developer. 00:26.510 --> 00:32.130 So we're going to be talking about Starkiller today, which is our threat emulation platform that we use for red teaming. 00:32.270 --> 00:46.810 What this allows us to do is to have an intuitive interface that multiple users can log in from and interact with the team server, as well as it has some hooks built into it to the MITRE ATT&CK framework that gives links to techniques inside of all our modules. 00:47.170 --> 00:53.050 And what this setup allows us to do is to have our teams most accurately emulate the threats for our assessments. 00:55.350 --> 01:03.350 Since we're trying to emulate that threat, what we're really focusing on is trying to make sure that we're replicating their TTPs, those tactics, techniques, and procedures. 01:03.550 --> 01:13.830 Since this is what the threat is going to use to obtain their objectives, we're going to make sure that everything we do in our tests focus around what the threat's going to be and be representative. 01:14.010 --> 01:15.850 That includes our infrastructure. 01:15.890 --> 01:22.010 We want to make sure that our infrastructure mirrors exactly what an APT setup is going to look like. 01:22.010 --> 01:27.330 For example, our stagers and payloads, as well as our implants will mirror the threats. 01:27.350 --> 01:34.010 Our setup will typically include multiple operators across different locations, all connected to the team server. 01:34.710 --> 01:38.410 They may be spread out as well to make sure that everything is segregated. 01:38.630 --> 01:43.490 So that way, if one server goes down, we're not going to lose our entire operation and burn it. 01:43.590 --> 01:52.210 We want to make sure that our infrastructure mirrors what the threat's going to do and are going to be able to emulate what they're going to be running for their attacks. 01:56.500 --> 02:03.720 So what you kind of saw in the that connects to our team server. 02:03.800 --> 02:10.880 So Starkiller provides a UI on top of the C2 server, in this case, Empire. 02:10.880 --> 02:15.040 And it allows us to interact as a team. 02:15.040 --> 02:16.940 So we have multi-user support. 02:16.940 --> 02:19.300 We have a live reporting interface. 02:19.300 --> 02:28.400 So anytime a team member runs a module or a command, we're able to instantly see those commands through the interface. 02:28.400 --> 02:33.200 And it simplifies a lot of the workflows that are a little bit more tedious through the CLI. 02:35.820 --> 02:43.620 So as we mentioned, Starkiller is a GUI interface that interacts with the Empire C2 server. 02:43.700 --> 02:47.820 Empire is built on PowerShell and Python, for those of you that aren't aware. 02:48.100 --> 03:02.860 With the addition of Starkiller, it can now be ran as either a team server or an all-in-one C2, which means just a person's running the C2 on the command line directly, like there's no other infrastructure required to run that C2. 03:03.020 --> 03:04.760 It has a bunch of adaptive modules. 03:04.760 --> 03:07.200 We're up to about 300 now. 03:07.420 --> 03:18.680 And then the original project ended support back in August of 2019, but we forked it and have been maintaining and updating it ever since, which is why we built Starkiller on top of it. 03:18.680 --> 03:31.400 And we really built Starkiller to address some of the shortfalls that Vincent mentioned, to allow for threat emulation and just like a modern red team engagement when using Empire as your primary C2. 03:34.000 --> 03:55.280 So ever since we forked Empire when it was originally, when support was originally ended, we get asked a lot why we still think PowerShell is important, because there's a whole bunch of mitigations in place, you know, like script block logging and AMSI and all those kinds of things that do make PowerShell much more difficult when it is implemented properly. 03:55.280 --> 04:12.660 But even though red teams have started moving on to C-Sharp and other .NET tradecraft and Microsoft has started kind of focusing protections elsewhere, PowerShell is still a huge attack vector that's utilized like every day by APTs. 04:12.660 --> 04:21.140 CrowdStrike came out with a report in 2019 that said as many as 90% of breaches use PowerShell in some way. 04:21.140 --> 04:31.480 Now that doesn't mean that PowerShell is their primary means of operations, or even that it's the majority of what's being done, but it's still used in 90% of breaches according to CrowdStrike. 04:31.480 --> 04:48.360 So we still think it's really worthwhile for red teams to emulate threats using PowerShell, because even though all those mitigations do exist for it, we still see many, many organizations that are vulnerable to PowerShell because they don't have those mitigations properly implemented. 04:51.930 --> 04:55.230 So what we have here is our team server setup running Empire. 04:55.230 --> 04:59.530 We also have multiple Starkiller instances all connected to that team server. 04:59.910 --> 05:06.430 That team server is then sitting in a secure location that could be either in the cloud or like one of our offices. 05:06.710 --> 05:11.470 There is then a secure line directly into our server, our cloud server. 05:11.470 --> 05:13.130 In this case, it's AWS. 05:13.570 --> 05:16.730 That cloud server is then going to reach out to all of our redirectors. 05:16.790 --> 05:23.890 We have these multiple redirectors up in case one of them gets burned, that way if it does happen, we don't lose our entire infrastructure. 05:23.990 --> 05:31.290 Why we do this is this setup allows us to rebuild certain parts of our infrastructure very easily, so we don't lose critical pieces. 05:33.470 --> 05:52.650 Yeah, and then just another advantage of setting up our infrastructure this way is it allows us to really lock down our Empire server on top of using like reverse port forwarding to connect to the AWS server so that the Empire server can't be accessed directly from external our network. 05:52.650 --> 06:00.190 We can also lock down it down internally because we can basically lock everything down except for the Starkiller ports. 06:00.550 --> 06:13.550 And that way, if our network is compromised, it limits the ability for an attacker to access the Empire server, and more importantly, access the customer data that we're going to be handling since many times that data is extremely sensitive. 06:14.270 --> 06:22.890 So really, the main two goals for Starkiller for us is one, we want to make our workflows for red teams to be more efficient. 06:22.890 --> 06:29.110 And we do that by eliminating some of the menu options that were in Empire and making them more simplified. 06:29.310 --> 06:37.250 Previously in Empire, what you had to do was you had to memorize or go through multiple menus to be able to set up your listeners, your stagers, and your modules. 06:37.510 --> 06:41.950 Through Starkiller, what you have now is you have these menus that are pre-populated. 06:41.950 --> 06:43.790 Sometimes they have drop-down menus. 06:44.110 --> 06:47.250 And this makes workflows much, much easier for teams. 06:47.630 --> 06:50.630 The second thing is the team-oriented engagements. 06:50.850 --> 06:55.530 With Empire previously, you can only have one person logged in at a time. 06:55.590 --> 06:57.230 They're using that command line interface. 06:57.230 --> 07:01.390 And if somebody else wanted to do an engagement, you have to stand up a completely separate server. 07:01.530 --> 07:05.850 Now with Starkiller, you can have multiple users all using the same team server. 07:05.870 --> 07:07.410 They can share credentials. 07:07.410 --> 07:09.850 They can share their results from their modules. 07:09.850 --> 07:13.570 And they can generate a single report for their entire engagement. 07:14.610 --> 07:21.370 Yeah, and then just to add a little more to that, we plan on future growth for this capability as well. 07:21.370 --> 07:32.830 But it also provides more oversight for the team lead by giving them a centralized location to see what their operators are doing, what things have been done, as well as when things are ran on individual boxes and that kind of thing. 07:32.830 --> 07:39.280 It gives them a centralized location to see all that data and keep an eye on the operation as it's progressing. 07:42.900 --> 07:46.020 So setting up Starkiller is fairly simple. 07:46.020 --> 07:52.600 When you run Empire, you're going to pass the REST parameter, which tells it to run the REST API. 07:52.600 --> 07:56.300 There's a default login and password, which you can change. 07:56.460 --> 08:11.240 And then to actually run Starkiller, you can either download the installer for Windows, off of the releases page on GitHub, or there's instructions in the readme to build it from the source. 08:14.600 --> 08:16.100 All right, thanks, guys. 08:16.100 --> 08:19.120 We're going to demo the features of Starkiller now. 08:19.120 --> 08:26.540 So Vince has an instance set up already, back into our personal range, where Empire is already running on a team server. 08:26.540 --> 08:29.140 And then we have Starkiller connecting into that. 08:31.400 --> 08:34.760 Okay, so this is the Starkiller login page. 08:34.760 --> 08:38.600 I'm going to log in using the default username and password. 08:38.600 --> 08:43.620 And we're connecting to an Empire instance that we have, that we already have running. 08:45.460 --> 09:00.500 When I go to the settings page, we can change our password, we can turn dark mode on and off, we have access to our API token for connecting to the Empire API. 09:00.600 --> 09:11.400 This is useful if you want to interact with the Empire API outside of Starkiller, or if you wanted to use some other tool like Deathstar to interact with the Empire API. 09:12.720 --> 09:16.340 The next piece is the user management page. 09:16.340 --> 09:21.040 So on this page, we get a list of all the users that have an account for Starkiller. 09:21.040 --> 09:27.120 We can see when they when they last logged in, and we're able to enable and disable those users. 09:27.960 --> 09:36.700 I'm going to go ahead and create a user account for myself with the password of password. 09:40.410 --> 09:43.090 And we can see that I now have an account. 09:46.600 --> 09:49.920 So the next thing is the modules list page. 09:49.920 --> 09:56.680 So this page gives you a list of all of the modules that we have access to in our instance of Empire. 09:56.940 --> 10:09.460 And using the search box, we can search down by the name of the module, we can search down by the MITRE attack techniques, and also the descriptions of the modules. 10:09.460 --> 10:19.120 So here I'm going to filter down by a MITRE attack technique, and I get the two modules that are in this technique. 10:19.120 --> 10:28.520 And if I click into it, it'll bring us to the web page for that MITRE attack technique so that we can get more information about it. 10:30.850 --> 10:46.310 And then here, if we expand an individual module, we can get the author information, we can get the description about that module, and then often the comments will have a link back to the source material for that module. 10:51.380 --> 10:55.200 Okay, so this is the listeners list page. 10:55.200 --> 10:59.040 And here we can see all the listeners that have already been created in Empire. 10:59.140 --> 11:01.500 So let's go ahead and create another one. 11:02.040 --> 11:04.640 We're going to choose a type . 11:04.800 --> 11:11.180 And then once we choose that type, we get the form pre-filled out with all the defaults. 11:11.180 --> 11:18.340 And we're going to go ahead and just update this so it doesn't overlap with the previously created. 11:18.340 --> 11:24.720 And any optional fields are just in this expandable context here. 11:25.420 --> 11:28.940 I'm going to submit, and that listener has been created. 11:30.480 --> 11:33.520 The next page is the stagers page. 11:33.700 --> 11:41.140 Stagers are the initial payload that we send to the agent to initiate the connection back to our C2 server. 11:41.140 --> 11:44.420 So you can see that we already have a couple of stagers created here. 11:44.880 --> 11:46.700 I'm going to go ahead and generate a couple more. 11:47.620 --> 11:51.880 So the first one that I'm going to create is a multi-launcher. 11:52.640 --> 11:56.520 And we're going to have it connect to the listener that I just created. 11:56.520 --> 11:59.300 And we're going to keep the rest of the settings the same. 11:59.480 --> 12:05.620 Up here, I can expand the information box, and that'll give us some more info about the stager. 12:15.240 --> 12:17.020 Okay, so that one's been created. 12:17.100 --> 12:18.900 Now I'm going to create one more. 12:19.880 --> 12:23.180 This one is going to be downloadable DLL. 12:24.700 --> 12:28.100 And again, I'm going to choose the listener that we just created. 12:28.120 --> 12:29.660 I'm going to hit submit. 12:32.120 --> 12:42.440 Okay, so now that we've created those two stagers, we can see some information about it, which listener it connects back to, the language, and when it was created. 12:42.440 --> 12:46.700 And then over here, we have the ability to copy or download. 12:46.700 --> 12:52.160 So this first one that we generated, multi-launcher, has a little paperclip icon. 12:52.160 --> 13:01.460 And when you click that, it copies it to the clipboard, because this is like a one-liner that you can then paste into a command prompt or your PowerShell window. 13:01.740 --> 13:06.980 And the second one here has a download icon, because it's a file. 13:06.980 --> 13:12.060 And you can download this file and then get that to your target, however you need to get it to them. 13:13.340 --> 13:30.100 Yeah, and something that's really nice about this over Empire is that our stagers remain persistent, not only for when we change between menus, but also if you log out of StarKiller and then log back in, your agents will still be there. 13:30.220 --> 13:35.940 Because in Empire, especially when we create one-liners, as soon as we move to another menu, it's gone. 13:35.940 --> 13:51.900 And we have to regenerate it and then cut and paste it and save it and all those things, whereas StarKiller just keeps it all in one place for us and saves it between sessions and all that kind of stuff, which is just significantly more convenient than operating directly in Empire. 13:54.080 --> 14:01.880 Okay, so now that we've sent those stagers out, we've gotten some callbacks into our Empire server. 14:02.180 --> 14:04.940 And so that brings us to the agents list. 14:04.960 --> 14:08.620 And here we can see all of the agents that have back to us. 14:08.620 --> 14:11.340 We can see the last time they checked in. 14:11.340 --> 14:15.520 We can see the username of the account that we're connected to. 14:15.880 --> 14:24.580 And if we click into it, that brings us to probably the screen that you'll spend the most time in when you're using StarKiller, which is the agent interaction screen. 14:25.040 --> 14:28.920 And this is where I'm going to hand it off to Quinn to talk about interacting with agents. 14:29.960 --> 14:33.480 So we have here is our agent screen, as Vince talked about before. 14:33.480 --> 14:38.060 This allows us to do our shell commands as well as execute modules. 14:38.160 --> 14:40.300 There's a couple of nice features here. 14:40.300 --> 14:43.380 All we can see at the bottom is Hubble actually just ran something. 14:43.380 --> 14:47.080 This interface allows multiple users to interact with the same agent. 14:47.100 --> 14:51.500 And every command that you run is going to be tagged with the username that you have associated with yourself. 14:51.580 --> 14:59.400 So for example, I ran earlier, I set my beacon to be delay zero, and I ran that command under my Empire admin account. 14:59.400 --> 15:00.880 While Hubble ran, who am I? 15:00.880 --> 15:02.580 And then got his results back. 15:02.760 --> 15:05.740 I can also go in here and I can go to shell commands. 15:05.920 --> 15:10.180 I can type in ps, just like I would in Empire, to get my process list. 15:10.180 --> 15:11.360 It's now going to run that. 15:11.360 --> 15:12.620 It puts it in a queue. 15:12.620 --> 15:20.720 All commands are set into a queue, regardless of who sends it, and it'll execute that queue throughout and then drop all the results in the screen. 15:21.120 --> 15:22.880 Your results aren't just going to be in the screen. 15:22.880 --> 15:26.500 It's also saved in a database that then gets populated on a reports page. 15:26.820 --> 15:31.760 So everything everybody does will be aggregated together into one master log. 15:32.140 --> 15:34.580 And you can see here, the process list just came back. 15:34.580 --> 15:36.120 So you can come in, take a look. 15:36.120 --> 15:44.480 I can scroll through and see all the different processes that are running, as well as I can also adjust the size of this screen if I wanted to expand it a little bit as well. 15:45.060 --> 15:46.660 Next is the modules. 15:46.660 --> 15:49.880 So you have access to all the modules that are inside of Empire. 15:50.000 --> 15:52.280 It's nice because you don't have to navigate all the menus. 15:52.280 --> 15:55.100 You can actually come in here and just type in exactly what you want to run. 15:55.920 --> 15:57.600 I can type in Mimikatz. 15:57.600 --> 15:59.520 In this case, we're actually going to run Sherlock. 16:00.180 --> 16:06.080 I come in, select Sherlock, which is a nice little tool that'll allow me to look at some privilege escalation opportunities. 16:06.660 --> 16:16.300 We still have access to those MITRE ATT&CK techniques from before, so I can click on those, as well as a description and information about the module I want to run. 16:16.640 --> 16:22.160 So once I hit submit, it's going to run that module. 16:22.160 --> 16:26.200 It's going to queue it up, and then we'll get the results, and we can see that later in the reporting function. 16:27.100 --> 16:30.640 Next, we're going to go over into an elevated process agent. 16:30.640 --> 16:32.320 That way, we can show off another feature. 16:32.680 --> 16:33.740 So now I can come in here. 16:33.740 --> 16:41.980 Now that I'm in an elevated process, I can go in and run some techniques that maybe I don't have access to under a normal user, such as Mimikatz. 16:42.600 --> 16:44.560 So I'm going to go in, pull up Mimikatz. 16:44.560 --> 16:46.700 I have all the same interface stuff, as well. 16:46.760 --> 16:48.120 I'm going to hit submit there, as well. 16:48.120 --> 16:53.440 So now both of those are queued up, and I can see those results later inside of my reporting function. 16:57.410 --> 17:00.670 So now we're going to look at the credentials page. 17:00.670 --> 17:05.270 And you can see here, we already have a couple entries from running Mimikatz. 17:05.270 --> 17:16.290 And so the nice thing about this credentials page is it's central to everybody, all of the team members engaging on this Empire server. 17:16.290 --> 17:26.990 So whether I run Mimikatz or Hubble is getting credentials, they're all going to be dumped to this page, and we can all see all of the credentials. 17:27.010 --> 17:32.970 And these password hashes are going to be useful to us when we want to try to do lateral movement. 17:38.260 --> 17:43.740 Now, the last piece that we want to show you with Starkiller is this reporting interface. 17:43.740 --> 17:55.160 It's going to show you, in order of when it ran, when a command was run on an agent, who ran it, and what the response was. 17:55.160 --> 17:59.600 So for example, this is the last command that was run. 17:59.600 --> 18:10.300 We can see that it was run by Empire Admin, which is me, and we can see the agent that it was run on, and we can see the full output of that command. 18:10.440 --> 18:17.440 And now just a side note here, you'll notice this function name is just a random five-character string. 18:17.440 --> 18:23.120 That's one of the features that are built into Empire for keyword randomization. 18:23.120 --> 18:26.920 So this function name is just a random five-character string. 18:27.180 --> 18:39.880 That string is typically known as Mimikatz, and so that randomization just allows us to prevent strings that are known flags from showing up in memory when Empire is being ran. 18:41.620 --> 18:50.160 Okay, so now if we expand another one, we can see the output of the ps command in its entirety. 18:50.440 --> 19:02.080 And this page is really useful to the operator of the engagement, so that they can get a holistic view of all of the different things that are going on during the engagement. 19:06.240 --> 19:12.020 So at the bottom of Starkiller, we have links to the Empire and Starkiller repos. 19:12.020 --> 19:19.320 We'd love to get feature requests and bug tickets that we can fix, and we look forward to your feedback.