1 00:00:02,340 --> 00:00:06,800 Hello, my name is Pablo González and this is my colleague, Fran Ramírez. 2 00:00:06,800 --> 00:00:13,480 We are proud to introduce the ATTPound, Adversarial Emulation and Offensive Technical Collaborative Project. 3 00:00:13,500 --> 00:00:16,420 We are proud to be at DEF CON this year. 4 00:00:16,460 --> 00:00:27,020 Besides, we like very much the offensive part, and that's why we bring a tool called ATTPound, which helps to perform the emulation of adversaries. 5 00:00:27,560 --> 00:00:33,500 Also, we want to tell you about the collaborative side of the project. 6 00:00:33,540 --> 00:00:37,560 First of all, let's introduce ourselves. 7 00:00:38,680 --> 00:00:40,680 I am Pablo González. 8 00:00:40,680 --> 00:00:50,600 I work at Telefónica in Spain in the pre-innovation department, where we are very lucky to play with cybersecurity and artificial intelligence. 9 00:00:50,860 --> 00:00:58,780 We develop several open source tools and AGIAR, and try to contribute with crazy ideas. 10 00:00:58,780 --> 00:01:02,640 I am MVP of Microsoft since 2017. 11 00:01:03,020 --> 00:01:12,420 I have written some books in Spanish about cybersecurity, and I am a teacher at several universities in Spain. 12 00:01:13,000 --> 00:01:23,400 My partner, Fran Ramírez, works with me at Telefónica in the same pre-innovation department, focusing on cybersecurity and machine learning projects. 13 00:01:23,400 --> 00:01:34,180 He has worked several years in the USA as a system administrator, and has written some books about Docker and machine learning. 14 00:01:34,440 --> 00:01:44,060 Before we discuss the tool and show the use cases first-hand, let's have a look at the ATT&CK. 15 00:01:47,480 --> 00:01:52,600 The emulation of adversaries has become extremely important in the Red Team world. 16 00:01:52,600 --> 00:02:04,720 It's an exercise that provides a glimpse into the potential for a real threat, like many others that both business and society have experienced, to affect an organization. 17 00:02:04,720 --> 00:02:17,080 The goal is to be capable of verifying if the organization controls are efficient and effective by detecting the threats or displaying weaponry weakness in response to them. 18 00:02:17,200 --> 00:02:21,100 The purpose of a Red Team exercise are the following. 19 00:02:21,100 --> 00:02:24,520 Demonstration of the exposure-run risk level. 20 00:02:24,520 --> 00:02:26,340 Demonstration of the business impact. 21 00:02:26,340 --> 00:02:28,920 Demonstration of the prevention capabilities. 22 00:02:28,920 --> 00:02:31,280 Demonstration of the detection capabilities. 23 00:02:31,280 --> 00:02:35,360 Demonstration of the capabilities of reacting or addressing incidents. 24 00:02:35,640 --> 00:02:39,400 Now, we are going to speak about ATT&CK. 25 00:02:39,940 --> 00:02:47,880 Mitre ATT&CK is a database containing the most common techniques, tactics, and methods being used by attackers. 26 00:02:47,880 --> 00:02:51,660 Tactics are the high-level vectors of ATT&CK. 27 00:02:52,020 --> 00:02:55,720 The techniques represent the implementation of methods of ATT&CK. 28 00:02:55,720 --> 00:03:02,940 The organizations can perform an adversarial emulation and keep mapping the security controls that are applied to the techniques. 29 00:03:02,940 --> 00:03:08,740 Organizations can also have several security controls related to a given technique. 30 00:03:09,100 --> 00:03:15,940 The goal is to verify the performance and efficiency as regards the security control by techniques implemented. 31 00:03:16,720 --> 00:03:22,960 The Mitre ATT&CK framework takes on the security bridge. 32 00:03:23,360 --> 00:03:27,600 So, the starting point is the original intrusion tactic. 33 00:03:27,600 --> 00:03:37,040 Any activity that has been previously carried out will be covered by a framework called Mitre ATT&CK. 34 00:03:39,480 --> 00:03:44,100 Now, let's find out more about ATTBOUND. 35 00:03:44,100 --> 00:03:58,040 ATTBOUND is a computer security tool designed to emulate the tool aims to bring emulation of a real threat into closer contact with implementation based on the techniques and tactics from the Mitre ATT&CK framework. 36 00:03:58,040 --> 00:04:08,080 The goal is to simulate how a threat works in an intrusion scenario where the threat has been successfully deployed. 37 00:04:08,220 --> 00:04:13,220 It's focused on Microsoft Windows systems through the use of the PowerShell command line. 38 00:04:13,220 --> 00:04:18,400 This enables the different techniques based on Mitre ATT&CK to be applied. 39 00:04:18,480 --> 00:04:32,020 ATTBOUND is designed to allow the emulation of adversaries as for a red team exercise and to verify the effectiveness and efficiency of the organization control in the face of a real threat. 40 00:04:32,140 --> 00:04:34,360 What is the ATTBOUND core? 41 00:04:34,360 --> 00:04:35,280 PowerShell. 42 00:04:36,060 --> 00:04:41,560 PowerShell is released along with Microsoft Windows Vista. 43 00:04:42,200 --> 00:04:54,100 It's not natively embedded in the operating system which makes it very interesting for both IT administrators and pen testers. 44 00:04:54,100 --> 00:05:08,160 Its new version includes a large number of new features and modules that will help to integrate interestingly with the operating system and its many tools. 45 00:05:08,720 --> 00:05:16,580 And the first version was released in 2006. 46 00:05:16,860 --> 00:05:18,740 The first stable version. 47 00:05:18,740 --> 00:05:25,960 Okay, two versions appeared in 2009 with the release of Windows 7. 48 00:05:25,960 --> 00:05:34,420 Version 3 appeared in 2012 with the release of Windows 8. 49 00:05:34,950 --> 00:05:43,650 Later, the last version, version 7, appeared in the year 2020. 50 00:05:47,400 --> 00:05:57,040 The idea underlying ATTBOUND to link the Mitre ATT&CK framework along with the techniques that are implemented via the Microsoft Windows PowerShell command line. 51 00:05:57,040 --> 00:06:08,960 The many techniques implemented to using PowerShell support a high percentage of techniques laced in the ATT&CK matrix that can be replicated. 52 00:06:09,280 --> 00:06:11,900 The project is also collaborative. 53 00:06:11,900 --> 00:06:30,980 It means that the user can have his initial knowledge base based on ATT&CK but can import new implementations of the techniques used in PowerShell and relaunch them using the techniques and tactics in the file. 54 00:06:30,980 --> 00:06:41,160 We have used JSON format files to export this new code knowledge and import it in other environments where ATTBOUND has been deployed. 55 00:06:41,160 --> 00:06:45,480 In this way, the comparative knowledge has become very significant. 56 00:06:46,200 --> 00:06:52,880 This facilitates multiple users to share knowledge between separate environments. 57 00:06:52,880 --> 00:06:58,720 The techniques are dynamic elements that are emerging through the evolution of offensive security. 58 00:06:59,800 --> 00:07:06,760 Now, my colleague, Fran Ramirez, is going to give you a little insight into ATTBOUND. 59 00:07:07,860 --> 00:07:09,960 Okay, thank you, Pablo. 60 00:07:09,960 --> 00:07:11,600 And hello, everyone. 61 00:07:11,600 --> 00:07:16,800 Now, let's see what the architecture of ATTBOUND looks like. 62 00:07:18,640 --> 00:07:22,500 ATTBOUND has three main different components. 63 00:07:22,680 --> 00:07:25,700 The first one is the console. 64 00:07:25,700 --> 00:07:32,900 That is the PowerShell code that will be running on the Windows machines emulating the treat. 65 00:07:34,580 --> 00:07:45,720 After this code is executed on Windows machines, it connects towards a command and control and it waits for the adversary's commands to be emulated. 66 00:07:47,240 --> 00:07:50,580 The second one are the functions. 67 00:07:51,240 --> 00:07:58,260 These are the technical implementations that are mapped in Mitre, ATT, and CK. 68 00:07:59,140 --> 00:08:06,960 This is interesting since any user can create their functions written in PowerShell. 69 00:08:07,460 --> 00:08:18,460 This makes ATTBOUND collaborative and a project where any user can contribute with their knowledge in the form of technical implementations. 70 00:08:19,140 --> 00:08:26,050 All the functions will be carried out by the console when it is executed through Windows machines. 71 00:08:28,850 --> 00:08:33,410 And the last one is the command and control MVC or C2. 72 00:08:34,010 --> 00:08:37,050 This is the ATTBOUND control panel. 73 00:08:37,810 --> 00:08:42,780 From this panel, you can set up the treat or adversary to be emulated. 74 00:08:45,240 --> 00:08:51,160 You can use already pre-setup treats or you can build new treats or tests. 75 00:08:55,500 --> 00:09:06,780 The tool's knowledge can be imported and exported from this panel since the user can create its content in the form of an implementation of a technique in PowerShell. 76 00:09:10,070 --> 00:09:16,950 In other words, a basic architecture scheme has two main elements from the networking point of view. 77 00:09:18,590 --> 00:09:21,250 The first is the agent or warrior. 78 00:09:21,990 --> 00:09:27,950 It's the adversarial emulation and its code is in PowerShell. 79 00:09:29,930 --> 00:09:33,710 The second one is the root node or command and control. 80 00:09:34,570 --> 00:09:43,530 From this web application, it is possible to manage the application of the treat to be simulated by the different deployed warriors. 81 00:09:44,510 --> 00:09:51,070 Also, you can manage the results of the emulation and make decisions about the controls. 82 00:09:52,290 --> 00:09:58,430 Everything is fully connected with the identifiers of the ATT and CK metrics. 83 00:10:00,770 --> 00:10:09,230 Again, from the networking point of view, the deployment of warriors over the network will be accomplished through different options. 84 00:10:09,690 --> 00:10:16,670 Remote invocation through the network privilege, invocation of remote machine without privilege, lock and invocation, etc. 85 00:10:20,120 --> 00:10:28,780 It is commendable not to include more than 10 or 15 computers in this process, as indicated by the ATT and CK. 86 00:10:33,180 --> 00:10:42,020 These exercises are simulation, but you must have a real as possible environment for better results. 87 00:10:45,610 --> 00:10:49,330 Okay, and now let's talk about the operational flows. 88 00:10:52,090 --> 00:10:59,090 These are the different flows between the console or agent and the ATT bound command and control. 89 00:11:01,130 --> 00:11:04,250 The first flow is the connection flow. 90 00:11:04,570 --> 00:11:09,950 When a console is running on a Windows machine, it sends a high command. 91 00:11:12,860 --> 00:11:21,680 When the console is running, it gathers information from the machine and then passes it on the control panel through this packet. 92 00:11:25,640 --> 00:11:31,080 During the warrior generation, the IP address to be connected must be specified. 93 00:11:32,680 --> 00:11:35,600 But this is discussed further below. 94 00:11:37,040 --> 00:11:54,520 When the warrior needs to register as a compromised computer, it sends a request through the HTTP POST method of the root node, stating the warrior ID and the collected information from the computer. 95 00:11:58,050 --> 00:12:08,910 When this information is received by the root node, the data will be stored into the database and will be made available for the user. 96 00:12:09,430 --> 00:12:15,710 That is, in order to assign the plan set in a treat and perform its execution. 97 00:12:17,630 --> 00:12:26,850 When all this information reaches the command and control, it saves the information into a database and sends an OK signal. 98 00:12:28,590 --> 00:12:34,710 The second flow refers to the adversarial planning and execution process. 99 00:12:35,950 --> 00:12:42,170 The console or agent will ask for information about the treat plan to be performed. 100 00:12:43,070 --> 00:12:50,310 If the user has not created a treat plan for that console, the answer will be no treat plan. 101 00:12:51,210 --> 00:13:04,450 When there is already a treat plan created for that console, an OK signal will be sent Later, the console will start asking for the functions that are part of the treat plan. 102 00:13:05,850 --> 00:13:13,090 For each function downloaded and executed, the results will be reported to the command and control. 103 00:13:16,030 --> 00:13:24,350 In other words, when the warrior connects to HTTPound, it requests a new treat plan through the GETPLAN function. 104 00:13:25,850 --> 00:13:34,470 If the user has assigned already any plan to the warrior, it answers OK and the treat plan will be delivered. 105 00:13:35,030 --> 00:13:40,210 This plan is generated in a JSON format. 106 00:13:40,990 --> 00:13:44,910 More details about this file will be provided later. 107 00:13:45,550 --> 00:13:54,330 Once the treat plan is available for the warrior, it will perform the request of each function or task to be accomplished. 108 00:13:55,530 --> 00:13:59,510 This is made through the GETTASK function. 109 00:14:00,430 --> 00:14:11,570 A GETTASK function will be run for each technique implementation that the warrior requires to be performed in order to fulfill the treat plan. 110 00:14:14,070 --> 00:14:20,610 For each prior run, two values will be returned through the PUTRESULT function. 111 00:14:21,570 --> 00:14:28,590 The first one, whether or not the ATTCK technique has been executed successfully. 112 00:14:29,770 --> 00:14:41,190 In the second case, we get the output from the function that implements the returned technique ready for a technical review that can check the results. 113 00:14:41,850 --> 00:14:45,670 OK, and now the third flow is the SIGNOUT flow. 114 00:14:46,470 --> 00:14:53,170 After all the techniques have been performed, the communication close and the treat emulation is finished. 115 00:14:53,970 --> 00:14:57,970 So the console will send the BYE command. 116 00:15:01,010 --> 00:15:11,710 Therefore, the root node will also assume the warrior as dead if it does not report any activity for a long period of time. 117 00:15:11,710 --> 00:15:20,630 In the other side, the warrior will show activity if, before a treat plan is associated, the warrior is requesting a plan. 118 00:15:22,900 --> 00:15:28,160 Now let's talk about some key elements in the ATPAM to go a little deeper. 119 00:15:28,640 --> 00:15:38,200 The console will be created from the web application specifying the IP address from where the console file will be downloaded. 120 00:15:39,000 --> 00:15:53,100 There is a file called console template that houses the instructions that will manage the connection, the treat plan, and the connection clause we mentioned in the previous section. 121 00:15:53,660 --> 00:16:05,660 When the instruction provided is being executed on a Windows machine, the PowerShell code necessary to carry out the warrior instantiation will be launched. 122 00:16:06,300 --> 00:16:12,160 The console has two parts with a large if in the middle. 123 00:16:12,340 --> 00:16:18,080 The first part of the basic starting path is the beginning of the thread. 124 00:16:18,120 --> 00:16:23,800 As seen in the previous section, a connection request shall be made. 125 00:16:23,800 --> 00:16:33,420 First, a unique ID is generated for this instance to be identified in the root node. 126 00:16:33,420 --> 00:16:39,600 Also, the information on the operating system where it's running is gathered. 127 00:16:40,060 --> 00:16:48,200 The second part is driven by a case that can happen in many thread emulations. 128 00:16:48,560 --> 00:17:02,060 The process where a privilege escalation or lateral movement to another machine produces a new privilege process, or one that can be executed in another environment, has been called splitting. 129 00:17:02,060 --> 00:17:07,040 In this case, the console will be invoked with an ID. 130 00:17:07,040 --> 00:17:15,900 That is, it will not have to generate the warrior ID that identifies the warrior to the root node. 131 00:17:15,920 --> 00:17:33,820 In other words, if there is a plan with three tasks, and the second task is a privilege escalation, and this one is successful, then the third task will be executed in another process at an operating system level. 132 00:17:34,000 --> 00:17:39,160 But from the 80-pound logical point of view, it's the same warrior. 133 00:17:39,160 --> 00:17:42,560 That is, it inherits the same warrior ID. 134 00:17:45,700 --> 00:17:47,800 How do we define a thread? 135 00:17:48,080 --> 00:17:51,660 Simple, through a JSON file. 136 00:17:51,660 --> 00:17:56,580 The thread plan is generated in the root node according to the user's needs. 137 00:17:56,580 --> 00:18:04,680 The user can use real threads already created or build their threads and see the output of their monitoring techniques. 138 00:18:04,680 --> 00:18:08,720 The document format delivered with the plan is JSON. 139 00:18:11,590 --> 00:18:18,110 Let's talk about how to create your ATT-bound functions using the skeleton function. 140 00:18:20,100 --> 00:18:27,960 Any user can create or add features to implement techniques from the Mitre ATT and CK. 141 00:18:29,620 --> 00:18:36,700 Its implemented function is linked to a technique and one or more tactics in the framework. 142 00:18:38,700 --> 00:18:50,640 The main components from the skeleton functions are the technique to be launched or the function and the main program. 143 00:18:51,020 --> 00:18:56,520 This main program will be in charge of managing the flow of the technique to be performed. 144 00:18:59,410 --> 00:19:03,910 And this main program is in charge of another three tasks. 145 00:19:05,330 --> 00:19:13,590 The first one is request the necessary data to the root node for the technique to be executed. 146 00:19:13,890 --> 00:19:17,990 This is an execution prerequisite. 147 00:19:19,390 --> 00:19:26,750 The second one is check if the execution of the technique has been successful or not. 148 00:19:28,110 --> 00:19:32,770 The output will be stored in a true-false variable. 149 00:19:34,690 --> 00:19:53,570 And the last one is if there is some data collected such as credentials dump, AP addresses or user enumeration that can be used by another technique because all this information will be dumped to a data store that has the root node. 150 00:19:54,630 --> 00:20:01,090 This scheme can be visualized in any of the functions that can be found in ATT-bound. 151 00:20:02,290 --> 00:20:09,370 ATT-bound is a collaborative project where the goal is to share knowledge through treat plans. 152 00:20:11,090 --> 00:20:20,850 For this reason, the tool allows exporting user-generated treats and importing them into other ATT-bound instances. 153 00:20:23,690 --> 00:20:31,310 During the treat plan generation or query, the export plan option can be used as shown in the image. 154 00:20:35,560 --> 00:20:40,820 Once the file is stored in JSON format, it can be shared with the community. 155 00:20:42,240 --> 00:20:56,860 The JSON file contains all the information needed to recreate the treat plan with all the tasks and implementation of techniques involved, even if these are not available in the new scenario. 156 00:20:58,220 --> 00:21:01,960 Now, let's look at some use cases. 157 00:21:02,040 --> 00:21:09,320 In ATT-bound, you can execute the default or known threats and threats or adversaries that we create. 158 00:21:09,320 --> 00:21:37,220 With our custom threats, we can make our own version of a known threat with HTTP techniques selected by us, create our own version of an attack with HTTP techniques, and perform an execution of a threat now created by us that implements our own functions through the skeleton function. 159 00:21:38,760 --> 00:21:44,780 In this section, we will perform different scenarios and explain them. 160 00:21:50,370 --> 00:21:54,470 Okay, in this first demo, let's see what a warrior is. 161 00:21:55,300 --> 00:22:03,630 To do this, we will create the warrior in this option and copy the code that ATT-bound delivers to us. 162 00:22:08,580 --> 00:22:24,600 Then, we go to the computer where we will make the adversary or threat test, paste the code, it will be executed in a new PowerShell, and finally, it connects with ATT-bound downloading a console. 163 00:22:27,110 --> 00:22:35,030 If we go to the home section, we will be able to see the computer where the warrior is running. 164 00:22:35,870 --> 00:22:46,670 Here, we have the architecture data, the process that it's running, the AP address to which it belongs, and the warriors identified. 165 00:22:49,420 --> 00:23:01,120 In the plan section, we have some predetermined threats as we can see here, like WannaCry, NotPetya, Flame, DarkComet, or Dooku. 166 00:23:02,600 --> 00:23:14,940 Let's select, for example, WannaCry, and here we can see the techniques and the ATT and CK tactic identified that forms this version of WannaCry. 167 00:23:21,070 --> 00:23:34,250 We could use it against a warrior, launch the warrior plan, and finally execute it, step by step, all those techniques that correspond to WannaCry in this case. 168 00:23:40,060 --> 00:23:57,600 In this second demo, we are going to gather information to verify that there are different techniques within ATT and CK and ATT-bound to be able to collect that information to recreate the malware threat. 169 00:24:00,520 --> 00:24:08,700 Next, we are going to do a privilege escalation technique that will split the ATT-bound console process in two. 170 00:24:09,340 --> 00:24:13,660 One without privilege and the new one with privilege. 171 00:24:16,770 --> 00:24:23,670 The first step will be to create the warrior, copy the code, 172 00:24:27,530 --> 00:24:35,090 go to the PowerShell, run the code, 173 00:24:46,250 --> 00:24:50,530 and finally obtain the warrior executed. 174 00:24:56,430 --> 00:24:59,100 Okay, now let's go to the plan option, 175 00:25:02,250 --> 00:25:05,010 create a new one, 176 00:25:11,180 --> 00:25:24,100 select the gathering tactic where we can see here, besides the implemented techniques, we also have the discovery tactic where we can see some ATT and CK techniques generated. 177 00:25:26,180 --> 00:25:33,620 In this case, we are simply going to make a selection of the processes that the machine has. 178 00:25:33,980 --> 00:25:45,620 We will add this technique, then we'll go to the escalation of privilege, where we are going to use a bypass of USC technique named 1088. 179 00:25:45,980 --> 00:25:51,060 We add it, we put a name to the thread, 180 00:26:00,490 --> 00:26:03,690 and finally we will create the plan. 181 00:26:04,230 --> 00:26:08,570 Once we have the plan created, we can select it here. 182 00:26:12,180 --> 00:26:18,960 We see the elements of our plan with which Mitre tactics the mapping is performed. 183 00:26:20,960 --> 00:26:27,220 And we can identify the warrior over the warrior we want to launch it, and finally we launch the plan. 184 00:26:28,960 --> 00:26:39,860 At this moment, the ATT bound console will start working and it will read the plan, and here we have the pending task. 185 00:26:42,260 --> 00:26:47,760 If we go to the result option, we will see how the first technique has already been executed. 186 00:26:51,380 --> 00:26:57,280 In bulk process, which is just a collection of processes, we can see success. 187 00:26:59,140 --> 00:27:03,560 If we refresh it or we wait for a little while, 188 00:27:07,910 --> 00:27:20,930 we will find that USC bypass has also been successful, and we really get a double process. 189 00:27:21,840 --> 00:27:39,850 The one on the left is without privilege, but the one on the right is a process in which instructions with privilege are being executed, but we had no more technique after the privilege elevation of execution. 190 00:27:40,010 --> 00:27:45,660 In the ATT bound technical part, we can see the technique's output. 191 00:27:48,680 --> 00:27:57,320 We can check the processes that the computer has, and here we can also see the UAC bypass result. 192 00:28:02,040 --> 00:28:04,240 And here's the second demo. 193 00:28:10,940 --> 00:28:19,080 In this third demo, we are going to perform an escalation of privilege, but also a credential stamp. 194 00:28:22,960 --> 00:28:36,220 To do this, let's create a warrior pointing to the ATT bound IP panel, copy the code, and run it on the PowerShell console as we saw before. 195 00:28:41,190 --> 00:28:48,910 Here we can see the information about the new warrior connected to the panel, and now we are going to create a plan. 196 00:28:55,070 --> 00:28:58,270 The plan will have a privilege escalation. 197 00:28:58,880 --> 00:29:17,050 We will use again 1088, that is the UAC bypass, and we will execute a credential access tactic using a power dump, but we could also use Mimikatz to perform the credential dump. 198 00:29:28,950 --> 00:29:42,570 The interesting part is that once we get the privilege escalation working, we will get a new process with privilege, and this process will be able to perform the credential dump. 199 00:29:45,100 --> 00:29:52,460 Okay, so let's create the plan, deploy the treat, select the treat, select the warrior, and finally launch the plan. 200 00:30:01,140 --> 00:30:10,800 Okay, and now let's go to the ATT bound output section, and here we'll be able to see the techniques or tasks pending execution. 201 00:30:13,510 --> 00:30:26,020 Like the 1088, if we give it a little time, we will see that it has been successful. 202 00:30:26,400 --> 00:30:30,260 This new process with privilege has not been created yet. 203 00:30:30,260 --> 00:30:32,340 We will see in the next refresh. 204 00:30:34,880 --> 00:30:38,600 Here we can see the console without privilege, 205 00:30:43,140 --> 00:30:48,860 and this second panel, we will find the credential dump still running. 206 00:30:57,010 --> 00:31:01,590 And now we can see that the power dump technique is finished. 207 00:31:02,490 --> 00:31:05,850 But where can we see the results? 208 00:31:05,870 --> 00:31:11,510 Like in the previous demo, here we can see the output that this technique has. 209 00:31:12,770 --> 00:31:14,990 In this case, the UAC bypass. 210 00:31:16,610 --> 00:31:24,090 While the second technique executed in this process, the credential dumping, has returned us all this information. 211 00:31:25,430 --> 00:31:28,030 This information is very important. 212 00:31:28,250 --> 00:31:34,670 As we see here, we have users, user ID, has lm, has ntlm. 213 00:31:34,670 --> 00:31:42,130 As I said, this information is very important because we will be able to use it through a datastore. 214 00:31:45,600 --> 00:31:50,990 The datastore can be used by techniques that are performed afterward. 215 00:31:51,400 --> 00:32:00,200 For example, a lateral movement technique can be used by these hashes and these users because of this datastore. 216 00:32:01,180 --> 00:32:05,800 This is a very, very important element within ADDbound. 217 00:32:12,410 --> 00:32:16,850 In this fourth demo, we will perform the following scenario. 218 00:32:17,810 --> 00:32:21,290 First, an escalation of relays. 219 00:32:21,290 --> 00:32:24,330 Second, credential dumping. 220 00:32:25,670 --> 00:32:33,450 And finally, we will make a lateral movement from a computer with Windows 7 to a computer with Windows 10. 221 00:32:34,050 --> 00:32:39,210 First, we are going to deploy a warrior on the Windows 7 machine. 222 00:32:42,380 --> 00:32:52,600 Okay, as we have done in previous demos, we type in the ADDbound IP address and finally create the code. 223 00:32:52,720 --> 00:32:58,900 We copy the code from PowerShell and run it on Windows 7. 224 00:33:02,090 --> 00:33:11,970 Okay, we copy the code from ADDbound and run it on Windows 7 on PowerShell. 225 00:33:14,350 --> 00:33:25,370 Okay, once executed, we go to home and obtain, as before, the new warrior running Windows 7. 226 00:33:29,780 --> 00:33:43,360 Okay, well, now let's generate a plan where the first step is to execute this technique. 227 00:33:43,360 --> 00:33:49,500 For example, by the counts T1078. 228 00:33:49,740 --> 00:33:56,400 Okay, the second technique is an escalation of privileges. 229 00:33:56,400 --> 00:34:01,080 And third technique is credential dumping. 230 00:34:01,080 --> 00:34:06,940 And the fourth step or fourth technique will be a lateral movement. 231 00:34:11,160 --> 00:34:27,300 Okay, now insert plan and select a plan, new plan or new thread. 232 00:34:27,840 --> 00:34:37,860 And we assign warrior ID to new plan. 233 00:34:37,860 --> 00:34:50,100 Okay, and look at results view and we have a data store. 234 00:34:50,100 --> 00:34:52,400 Okay, 235 00:34:56,940 --> 00:35:06,860 these are several techniques about the new plan and data store. 236 00:35:06,860 --> 00:35:10,900 We add an IP address to the data store. 237 00:35:10,900 --> 00:35:11,020 Okay 238 00:35:21,990 --> 00:35:32,570 , well, refresh the web page several times until the lateral movement is complete. 239 00:35:32,570 --> 00:35:37,710 The technique of lateral movement is complete. 240 00:35:39,190 --> 00:35:48,130 Now ADDbound is still executing, execute all process. 241 00:35:51,690 --> 00:35:57,650 And now refresh the web page several times until the lateral movement is complete. 242 00:35:57,650 --> 00:36:05,170 Okay, observe that we have an ADDbound console running on Windows 10. 243 00:36:10,970 --> 00:36:11,910 Yeah. 244 00:36:11,930 --> 00:36:16,310 Then now we can conclude this demo 4. 245 00:36:19,600 --> 00:36:27,080 Okay, now we are going to do a speech about demo 5. 246 00:36:37,310 --> 00:36:59,410 Well, in this 5th demo, we will work on an all-in-one thread concept where we will automate the service discovery and the discovery of machines within a network as a thread or an adversary could do. 247 00:36:59,810 --> 00:37:06,290 The data discovery will be stored on the data store by a technique being used. 248 00:37:06,290 --> 00:37:13,730 Then we will perform a privilege escalation, obtain a new privilege process on the Windows 7 machine. 249 00:37:14,030 --> 00:37:25,030 Then we will make a credential dump thanks to that privilege escalation where we will acquire hashes and users. 250 00:37:25,290 --> 00:37:42,370 Then we will make a lateral move where we will use the hashes, users, and the IP addresses from the computers within the network to try to make that lateral move through the metered CKE technique. 251 00:37:43,070 --> 00:37:54,910 In this way, the whole process is fully automatic, so we can test the effectiveness or efficiency of security controls within the organization. 252 00:37:55,690 --> 00:37:58,590 We will start, as always, by generating a warrior. 253 00:37:58,590 --> 00:38:01,750 In this case, we check the IP address again. 254 00:38:01,750 --> 00:38:06,510 Copy the code and go to PowerShell to paste the code. 255 00:38:06,510 --> 00:38:07,310 Okay? 256 00:38:09,730 --> 00:38:10,610 Okay. 257 00:38:10,610 --> 00:38:17,230 In the home section, we will see the control connected soon. 258 00:38:17,230 --> 00:38:19,490 Here we see the data. 259 00:38:19,490 --> 00:38:22,190 Now we go to the plan section. 260 00:38:24,760 --> 00:38:25,580 Okay. 261 00:38:25,580 --> 00:38:28,600 Waiting for the warrior. 262 00:38:34,330 --> 00:38:36,930 And we go to the plan section. 263 00:38:36,930 --> 00:38:56,030 We create a new plan beginning with the discovery tactic using the T1046 technique where this port scanning will allow us to discover computers. 264 00:38:56,030 --> 00:38:57,230 Okay. 265 00:38:57,530 --> 00:39:08,570 We add the technique to the plan indicating an escalation of privilege and then credential dump with power dump or mini cuts. 266 00:39:08,570 --> 00:39:15,810 And finally, the last technique, again, a lateral movement. 267 00:39:16,650 --> 00:39:17,470 Okay. 268 00:39:18,050 --> 00:39:28,450 And thread name, DEF CON GIMU5, and thread description, blah, blah. 269 00:39:31,830 --> 00:39:32,570 Okay. 270 00:39:32,570 --> 00:39:37,050 We put the name on the one, create a plan, and link it with the warrior. 271 00:39:37,050 --> 00:39:41,070 We go now to the results. 272 00:39:42,210 --> 00:39:42,810 Okay. 273 00:39:42,810 --> 00:39:45,710 Well, first locate plan. 274 00:39:45,730 --> 00:39:49,730 And now we go to the results. 275 00:39:51,920 --> 00:39:55,390 We see the control begins to work. 276 00:39:58,010 --> 00:40:03,670 Now we can see here the task to be done. 277 00:40:03,670 --> 00:40:05,440 And the scan begins. 278 00:40:08,510 --> 00:40:09,970 One moment here. 279 00:40:09,970 --> 00:40:10,650 Yeah. 280 00:40:12,170 --> 00:40:18,310 The scan is a technique that can take quite a long time. 281 00:40:18,310 --> 00:40:20,750 Can be seconds or minutes. 282 00:40:21,270 --> 00:40:28,550 So, we will speed up the demo a little bit so that this part goes as fast as possible. 283 00:40:32,320 --> 00:40:33,260 Okay. 284 00:40:33,440 --> 00:40:44,540 Once the scan has finished, we will be able to check that it has been successful if we go to the data store. 285 00:40:45,860 --> 00:40:47,220 Okay. 286 00:40:47,220 --> 00:40:50,980 Now, we go to the data store. 287 00:40:50,980 --> 00:40:57,420 We will be able to see the computer IP addresses that are currently alive on the network. 288 00:40:58,880 --> 00:41:06,760 Right now, the second technique, that is the escalation of village has also been successful. 289 00:41:06,800 --> 00:41:10,160 So, the process has been unfolded. 290 00:41:10,160 --> 00:41:12,420 Right now, the process is done. 291 00:41:15,920 --> 00:41:17,280 Okay. 292 00:41:17,840 --> 00:41:23,780 If we refresh the page, we will see the credential dumping has been successful, too. 293 00:41:23,780 --> 00:41:33,240 And if we go to the data store, we see that we have IP addresses, users, and hostess. 294 00:41:34,440 --> 00:41:39,260 This hostess can be from here directly. 295 00:41:39,260 --> 00:41:46,880 Like any data from the data store and the changes will be saved by clicking on the update code. 296 00:41:46,880 --> 00:41:47,520 Okay. 297 00:41:47,520 --> 00:41:54,620 For the thread to finish, we will have to check if the result is correct or not in the lateral movement. 298 00:41:54,620 --> 00:42:07,040 And we must consider that these techniques are used to test the efficiency and effectiveness of the security controls within the organization. 299 00:42:07,360 --> 00:42:15,300 Therefore, certain implementations may be dated and avoid the execution of some codes. 300 00:42:17,300 --> 00:42:18,360 Okay. 301 00:42:18,460 --> 00:42:22,900 Now, a new process on Windows 10 has been implemented. 302 00:42:22,900 --> 00:42:27,240 There are no tasks and we have performed the lateral movement. 303 00:42:27,240 --> 00:42:35,620 In other words, the thread has moved from Windows 7 to Windows 10 from one machine to another over the network. 304 00:42:35,900 --> 00:42:42,880 We have also done the whole process of thread that is real for us. 305 00:42:42,880 --> 00:42:44,340 Detecting computers in the network . 306 00:42:45,920 --> 00:42:51,260 Dumping and accessing information such as hashes. 307 00:42:51,260 --> 00:42:58,860 And finally, a lateral move with one of the techniques that can be implemented within the lateral movement. 308 00:42:58,860 --> 00:42:59,880 Move tactics. 309 00:43:03,290 --> 00:43:12,130 In this final demo, we are going to export the thread plan and then import it into HTTP. 310 00:43:12,130 --> 00:43:24,740 To make a simple example, we can choose notepad, select the thread, get the techniques to use, and proceed with the plan export. 311 00:43:26,830 --> 00:43:34,410 In this button, we export this knowledge. 312 00:43:34,670 --> 00:43:57,610 If we want to share knowledge with other users, our thread knowledge that we already have created, or even techniques that we have implemented in PowerShell, we can create a new plan, set a name, create a plan, choose it, and proceed to export it. 313 00:44:10,570 --> 00:44:21,890 If we want to share this plan with another user, we will send him the JSON file which we are going to open to see the content. 314 00:44:27,880 --> 00:44:33,340 Okay, JSON, opening JSON file in Firefox, okay. 315 00:44:35,880 --> 00:44:48,060 Okay, as you can see, even the function definition written in PowerShell, exactly as we have created it, is transferred. 316 00:44:48,620 --> 00:45:05,640 So, if we want to share this information with another user, we can export those plans containing the functions that we have created in PowerShell and added to HTTP and send this JSON. 317 00:45:12,290 --> 00:45:12,730 Okay. 318 00:45:12,730 --> 00:45:22,730 It's a very simple and collaborative way to provide the knowledge to other users with offensive techniques within the HTTP mapping. 319 00:45:23,210 --> 00:45:29,610 Well, this is the last demo, and I will pass the word on to my partner, Fran. 320 00:45:30,970 --> 00:45:33,090 Okay, so that's all. 321 00:45:33,090 --> 00:45:37,570 Feel free to visit the ATTPound GitHub and download the software. 322 00:45:38,550 --> 00:45:43,930 This is a new tool we are currently working on, and we are adding new techniques. 323 00:45:45,410 --> 00:45:49,630 Also, the project is collaborative, and everyone can help the project grow. 324 00:45:50,890 --> 00:45:55,990 And now, we are ready to answer any questions you may have about HTTP.