Hello, my name is Pablo González and this is my colleague, Fran Ramírez.
We are proud to introduce the ATTPound,
Adversarial Emulation and Offensive Technical Collaborative Project.
We are proud to be at DEF CON this year.
Besides, we like very much the offensive part,
and that's why we bring a tool called ATTPound,
which helps to perform the emulation of adversaries.
Also, we want to tell you about the collaborative
side of the project.
First of all, let's introduce ourselves.
I am Pablo González.
I work at Telefónica in Spain in the pre-innovation department,
where we are very lucky to play with cybersecurity and artificial intelligence.
We develop several open source tools and AGIAR,
and try to contribute with crazy ideas.
I am MVP of Microsoft since 2017.
I have written some books in Spanish about cybersecurity,
and I am a teacher at several universities in Spain.
My partner, Fran Ramírez, works with me at Telefónica
in the same pre-innovation department,
focusing on cybersecurity and machine learning projects.
He has worked several years in the USA as a system administrator,
and has written some books about Docker and machine learning.
Before we discuss the tool and show the use cases first-hand,
let's have a look at the ATT&CK.
The emulation of adversaries has become extremely important in the Red Team world.
It's an exercise that provides a glimpse into the potential for a real threat,
like many others that both business and society have experienced,
to affect an organization.
The goal is to be capable of verifying if the organization controls are efficient and effective
by detecting the threats or displaying weaponry weakness in response to them.
The purpose of a Red Team exercise are the following.
Demonstration of the exposure-run risk level.
Demonstration of the business impact.
Demonstration of the prevention capabilities.
Demonstration of the detection capabilities.
Demonstration of the capabilities of reacting or addressing incidents.
Now, we are going to speak about ATT&CK.
Mitre ATT&CK is a database containing the most common techniques,
tactics, and methods being used by attackers.
Tactics are the high-level vectors of ATT&CK.
The techniques represent the implementation of methods of ATT&CK.
The organizations can perform an adversarial emulation
and keep mapping the security controls that are applied to the techniques.
Organizations can also have several security controls related to a given technique.
The goal is to verify the performance and efficiency
as regards the security control by techniques implemented.
The Mitre ATT&CK framework takes on the security bridge.
So, the starting point is the original intrusion tactic.
Any activity that has been previously carried out
will be covered by a framework called Mitre ATT&CK.
Now, let's find out more about ATTBOUND.
ATTBOUND is a computer security tool designed to emulate
the tool aims to bring emulation of a real threat into closer contact with
implementation based on the techniques and tactics from the Mitre ATT&CK framework.
The goal is to simulate how a threat works in an intrusion scenario
where the threat has been successfully deployed.
It's focused on Microsoft Windows systems through the use of the PowerShell command line.
This enables the different techniques based on Mitre ATT&CK to be applied.
ATTBOUND is designed to allow the emulation of adversaries as for a red team exercise
and to verify the effectiveness and efficiency of the organization control in the face of a real threat.
What is the ATTBOUND core? PowerShell.
PowerShell is released along with Microsoft Windows Vista.
It's not natively embedded in the operating system which makes it very interesting for both
IT administrators and pen testers.
Its new version includes a large number of new features and modules that will help
to integrate interestingly with the operating system and its many tools.
And the first version was released in 2006.
The first stable version.
Okay, two versions appeared in 2009 with the release of Windows 7.
Version 3 appeared in 2012 with the release of Windows 8.
Later, the last version, version 7, appeared in the year 2020.
The idea underlying ATTBOUND to link the Mitre ATT&CK framework along with the techniques that
are implemented via the Microsoft Windows PowerShell command line.
The many techniques implemented to using PowerShell support a high percentage of techniques
laced in the ATT&CK matrix that can be replicated.
The project is also collaborative.
It means that the user can have his initial knowledge base based on ATT&CK but can import
new implementations of the techniques used in PowerShell and relaunch them using the
techniques and tactics in the file.
We have used JSON format files to export this new code knowledge and import it in other
environments where ATTBOUND has been deployed.
In this way, the comparative knowledge has become very significant.
This facilitates multiple users to share knowledge between separate environments.
The techniques are dynamic elements that are emerging through the evolution of offensive
security.
Now, my colleague, Fran Ramirez, is going to give you a little insight into ATTBOUND.
Okay, thank you, Pablo.
And hello, everyone.
Now, let's see what the architecture of ATTBOUND looks like.
ATTBOUND has three main different components.
The first one is the console.
That is the PowerShell code that will be running on the Windows machines emulating the treat.
After this code is executed on Windows machines, it connects towards a command and control
and it waits for the adversary's commands to be emulated.
The second one are the functions.
These are the technical implementations that are mapped in Mitre, ATT, and CK.
This is interesting since any user can create their functions written in PowerShell.
This makes ATTBOUND collaborative and a project where any user can contribute with their
knowledge in the form of technical implementations.
All the functions will be carried out by the console when it is executed through Windows
machines.
And the last one is the command and control MVC or C2.
This is the ATTBOUND control panel.
From this panel, you can set up the treat or adversary to be emulated.
You can use already pre-setup treats or you can build new treats or tests.
The tool's knowledge can be imported and exported from this panel since the user can
create its content in the form of an implementation of a technique in PowerShell.
In other words, a basic architecture scheme has two main elements from the networking
point of view.
The first is the agent or warrior.
It's the adversarial emulation and its code is in PowerShell.
The second one is the root node or command and control.
From this web application, it is possible to manage the application of the treat to
be simulated by the different deployed warriors.
Also, you can manage the results of the emulation and make decisions about the controls.
Everything is fully connected with the identifiers of the ATT and CK metrics.
Again, from the networking point of view, the deployment of warriors over the network
will be accomplished through different options.
Remote invocation through the network privilege, invocation of remote machine without privilege,
lock and invocation, etc.
It is commendable not to include more than 10 or 15 computers in this process, as indicated
by the ATT and CK.
These exercises are simulation, but you must have a real as possible environment for better
results.
Okay, and now let's talk about the operational flows.
These are the different flows between the console or agent and the ATT bound command
and control.
The first flow is the connection flow.
When a console is running on a Windows machine, it sends a high command.
When the console is running, it gathers information from the machine and then passes it on the
control panel through this packet.
During the warrior generation, the IP address to be connected must be specified.
But this is discussed further below.
When the warrior needs to register as a compromised computer, it sends a request through the
HTTP POST method of the root node, stating the warrior ID and the collected information
from the computer.
When this information is received by the root node, the data will be stored into the database
and will be made available for the user.
That is, in order to assign the plan set in a treat and perform its execution.
When all this information reaches the command and control, it saves the information into
a database and sends an OK signal.
The second flow refers to the adversarial planning and execution process.
The console or agent will ask for information about the treat plan to be performed.
If the user has not created a treat plan for that console, the answer will be no treat
plan.
When there is already a treat plan created for that console, an OK signal will be sent
Later, the console will start asking for the functions that are part of the treat plan.
For each function downloaded and executed, the results will be reported to the command
and control.
In other words, when the warrior connects to HTTPound, it requests a new treat plan
through the GETPLAN function.
If the user has assigned already any plan to the warrior, it answers OK and the treat
plan will be delivered.
This plan is generated in a JSON format.
More details about this file will be provided later.
Once the treat plan is available for the warrior, it will perform the request of each function
or task to be accomplished.
This is made through the GETTASK function.
A GETTASK function will be run for each technique implementation that the warrior requires to
be performed in order to fulfill the treat plan.
For each prior run, two values will be returned through the PUTRESULT function.
The first one, whether or not the ATTCK technique has been executed successfully.
In the second case, we get the output from the function that implements the returned
technique ready for a technical review that can check the results.
OK, and now the third flow is the SIGNOUT flow.
After all the techniques have been performed, the communication close and the treat emulation
is finished.
So the console will send the BYE command.
Therefore, the root node will also assume the warrior as dead if it does not report
any activity for a long period of time.
In the other side, the warrior will show activity if, before a treat plan is associated,
the warrior is requesting a plan.
Now let's talk about some key elements in the ATPAM to go a little deeper.
The console will be created from the web application specifying the IP address from where
the console file will be downloaded.
There is a file called console template that houses the instructions that will manage the
connection, the treat plan, and the connection clause we mentioned in the previous section.
When the instruction provided is being executed on a Windows machine, the PowerShell code
necessary to carry out the warrior instantiation will be launched.
The console has two parts with a large if in the middle.
The first part of the basic starting path is the beginning of the thread.
As seen in the previous section, a connection request shall be made.
First, a unique ID is generated for this instance to be identified in the root node.
Also, the information on the operating system where it's running is gathered.
The second part is driven by a case that can happen in many thread emulations.
The process where a privilege escalation or lateral movement to another machine
produces a new privilege process, or one that can be executed in another environment,
has been called splitting.
In this case, the console will be invoked with an ID.
That is, it will not have to generate the warrior ID that identifies the warrior to the root node.
In other words, if there is a plan with three tasks, and the second task is a privilege
escalation, and this one is successful, then the third task will be executed in another
process at an operating system level.
But from the 80-pound logical point of view, it's the same warrior.
That is, it inherits the same warrior ID.
How do we define a thread?
Simple, through a JSON file.
The thread plan is generated in the root node according to the user's needs.
The user can use real threads already created or build their threads and see the output
of their monitoring techniques.
The document format delivered with the plan is JSON.
Let's talk about how to create your ATT-bound functions using the skeleton function.
Any user can create or add features to implement techniques from the Mitre ATT and CK.
Its implemented function is linked to a technique and one or more tactics in the framework.
The main components from the skeleton functions are the technique to be launched or the function
and the main program.
This main program will be in charge of managing the flow of the technique to be performed.
And this main program is in charge of another three tasks.
The first one is request the necessary data to the root node for the technique to be executed.
This is an execution prerequisite.
The second one is check if the execution of the technique has been successful or not.
The output will be stored in a true-false variable.
And the last one is if there is some data collected such as credentials dump,
AP addresses or user enumeration that can be used by another technique because
all this information will be dumped to a data store that has the root node.
This scheme can be visualized in any of the functions that can be found in ATT-bound.
ATT-bound is a collaborative project where the goal is to share knowledge through treat plans.
For this reason, the tool allows exporting user-generated treats and importing them into
other ATT-bound instances. During the treat plan generation or query,
the export plan option can be used as shown in the image.
Once the file is stored in JSON format, it can be shared with the community.
The JSON file contains all the information needed to recreate the treat plan with all the tasks
and implementation of techniques involved, even if these are not available in the new scenario.
Now, let's look at some use cases. In ATT-bound, you can execute the
default or known threats and threats or adversaries that we create. With our custom
threats, we can make our own version of a known threat with HTTP techniques selected by us,
create our own version of an attack with HTTP techniques, and perform an execution of a threat
now created by us that implements our own functions through the skeleton function.
In this section, we will perform different scenarios and explain them.
Okay, in this first demo, let's see what a warrior is.
To do this, we will create the warrior in this option and copy the code that ATT-bound delivers
to us. Then, we go to the computer where we will make the adversary or threat test, paste the code,
it will be executed in a new PowerShell, and finally, it connects with ATT-bound downloading
a console. If we go to the home section, we will be able to see the computer where the warrior is
running. Here, we have the architecture data, the process that it's running, the AP address to which
it belongs, and the warriors identified. In the plan section, we have some predetermined threats
as we can see here, like WannaCry, NotPetya, Flame, DarkComet, or Dooku.
Let's select, for example, WannaCry, and here we can see the techniques and the ATT and CK
tactic identified that forms this version of WannaCry. We could use it against a warrior,
launch the warrior plan, and finally execute it, step by step, all those techniques that correspond
to WannaCry in this case. In this second demo, we are going to gather information to verify that
there are different techniques within ATT and CK and ATT-bound to be able to collect that
information to recreate the malware threat. Next, we are going to do a privilege escalation technique
that will split the ATT-bound console process in two. One without privilege and the new one
with privilege. The first step will be to create the warrior, copy the code, go to the PowerShell,
run the code, and finally obtain the warrior executed. Okay, now let's go to the plan option,
create a new one, select the gathering tactic where we can see here, besides the implemented
techniques, we also have the discovery tactic where we can see some ATT and CK techniques generated.
In this case, we are simply going to make a selection of the processes that the machine has.
We will add this technique, then we'll go to the escalation of privilege,
where we are going to use a bypass of USC technique named 1088. We add it,
we put a name to the thread, and finally we will create the plan.
Once we have the plan created, we can select it here.
We see the elements of our plan with which Mitre tactics the mapping is performed.
And we can identify the warrior over the warrior we want to launch it, and finally we launch the
plan. At this moment, the ATT bound console will start working and it will read the plan, and
here we have the pending task.
If we go to the result option, we will see how the first technique has already been executed.
In bulk process, which is just a collection of processes, we can see success.
If we refresh it or we wait for a little while,
we will find that USC bypass has also been successful, and we really get a double process.
The one on the left is without privilege,
but the one on the right is a process in which instructions with privilege are being executed,
but we had no more technique after the privilege elevation of execution.
In the ATT bound technical part, we can see the technique's output.
We can check the processes that the computer has, and here we can also see the UAC bypass result.
And here's the second demo. In this third demo, we are going to perform an escalation of privilege,
but also a credential stamp. To do this, let's create a warrior pointing to the ATT bound IP
panel, copy the code, and run it on the PowerShell console as we saw before.
Here we can see the information about the new warrior connected to the panel,
and now we are going to create a plan. The plan will have a privilege escalation.
We will use again 1088, that is the UAC bypass,
and we will execute a credential access tactic using a power dump, but we could also use
Mimikatz to perform the credential dump. The interesting part is that once we get the
privilege escalation working, we will get a new process with privilege, and this process
will be able to perform the credential dump. Okay, so let's create the plan, deploy the treat,
select the treat, select the warrior, and finally launch the plan. Okay, and now let's go to the
ATT bound output section, and here we'll be able to see the techniques or tasks pending execution.
Like the 1088, if we give it a little time, we will see that it has been successful.
This new process with privilege has not been created yet. We will see in the next refresh.
Here we can see the console without privilege,
and this second panel, we will find the credential dump still running.
And now we can see that the power dump technique is finished. But where can we see the results?
Like in the previous demo, here we can see the output that this technique has.
In this case, the UAC bypass.
While the second technique executed in this process, the credential dumping,
has returned us all this information.
This information is very important. As we see here, we have users, user ID,
has lm, has ntlm. As I said, this information is very important because we will be able to use it
through a datastore. The datastore can be used by techniques that are performed afterward.
For example, a lateral movement technique can be used by these hashes and these users because of
this datastore. This is a very, very important element within ADDbound.
In this fourth demo, we will perform the following scenario.
First, an escalation of relays. Second, credential dumping.
And finally, we will make a lateral movement from a computer with Windows 7 to a computer with
Windows 10. First, we are going to deploy a warrior on the Windows 7 machine.
Okay, as we have done in previous demos, we type in the ADDbound IP address and finally create
the code. We copy the code from PowerShell and run it on Windows 7. Okay, we copy the code
from ADDbound and run it on Windows 7 on PowerShell.
Okay, once executed, we go to home and obtain, as before, the new warrior running Windows 7.
Okay, well, now let's generate a plan where the first step is to execute this technique.
For example, by the counts T1078. Okay, the second technique is an escalation of privileges.
And third technique is credential dumping. And the fourth step or fourth technique will be a
lateral movement. Okay, now insert plan and select a plan, new plan or new thread.
And we assign warrior ID to new plan. Okay, and look at results view and we have a data store.
Okay, these are several techniques about the new plan and data store. We add an IP address
to the data store. Okay, well, refresh the web page several times until the lateral movement
is complete. The technique of lateral movement is complete.
Now ADDbound is still executing, execute all process.
And now refresh the web page several times until the lateral movement is complete. Okay,
observe that we have an ADDbound console running on Windows 10.
Yeah. Then now we can conclude this demo 4. Okay, now we are going to
do a speech about demo 5. Well, in this 5th demo, we will work on an all-in-one thread concept
where we will automate the service discovery and the discovery of machines within a network
as a thread or an adversary could do. The data discovery will be stored on the data store by a
technique being used. Then we will perform a privilege escalation, obtain a new privilege
process on the Windows 7 machine. Then we will make a credential dump thanks to that privilege
escalation where we will acquire hashes and users. Then we will make a lateral move where we will
use the hashes, users, and the IP addresses from the computers within the network to try to make
that lateral move through the metered CKE technique. In this way, the whole process is
fully automatic, so we can test the effectiveness or efficiency of security
controls within the organization. We will start, as always, by generating a warrior. In this case,
we check the IP address again. Copy the code and go to PowerShell to paste the code. Okay?
Okay. In the home section, we will see the control connected soon. Here we see the data.
Now we go to the plan section. Okay. Waiting for the warrior. And we go to the plan section.
We create a new plan beginning with the discovery tactic using the T1046 technique
where this port scanning will allow us to discover computers. Okay.
We add the technique to the plan indicating an escalation of privilege and then credential dump
with power dump or mini cuts. And finally, the last technique, again, a lateral movement.
Okay. And thread name, DEF CON GIMU5, and thread description, blah, blah.
Okay. We put the name on the one, create a plan, and link it with the warrior.
We go now to the results. Okay. Well, first locate plan. And now we go to the results.
We see the control begins to work.
Now we can see here the task to be done. And the scan begins.
One moment here. Yeah. The scan is a technique that can take quite a long time.
Can be seconds or minutes. So, we will speed up the demo a little bit so that this part goes as
fast as possible. Okay. Once the scan has finished, we will be able to check that it has been successful
if we go to the data store. Okay. Now, we go to the data store. We will be able to see the
computer IP addresses that are currently alive on the network. Right now, the second technique,
that is the escalation of village has also been successful. So, the process has been unfolded.
Right now, the process is done. Okay. If we refresh the page, we will see the credential
dumping has been successful, too. And if we go to the data store, we see that we have IP addresses,
users, and hostess. This hostess can be from here directly. Like any data from the data store
and the changes will be saved by clicking on the update code. Okay. For the thread to finish,
we will have to check if the result is correct or not in the lateral movement.
And we must consider that these techniques are used to test the efficiency and effectiveness
of the security controls within the organization. Therefore, certain implementations may be
dated and avoid the execution of some codes. Okay. Now, a new process on Windows 10 has
been implemented. There are no tasks and we have performed the lateral movement. In other words,
the thread has moved from Windows 7 to Windows 10 from one machine to another over the network.
We have also done the whole process of thread that is real for us. Detecting computers in the
network. Dumping and accessing information such as hashes. And finally, a lateral move
with one of the techniques that can be implemented within the lateral movement. Move tactics.
In this final demo, we are going to export the thread plan and then import it into
HTTP. To make a simple example, we can choose notepad, select the thread,
get the techniques to use, and proceed with the plan export.
In this button, we export this knowledge. If we want to share knowledge with other users,
our thread knowledge that we already have created, or even techniques that we have implemented
in PowerShell, we can create a new plan, set a name, create a plan, choose it, and proceed to
export it. If we want to share this plan with another user, we will send him the JSON file
which we are going to open to see the content. Okay, JSON, opening JSON file in Firefox, okay.
Okay, as you can see, even the function definition written in PowerShell,
exactly as we have created it, is transferred. So, if we want to share this information with
another user, we can export those plans containing the functions that we have
created in PowerShell and added to HTTP and send this JSON. Okay. It's a very simple and
collaborative way to provide the knowledge to other users with offensive techniques
within the HTTP mapping. Well, this is the last demo, and I will pass the word on to my partner, Fran.
Okay, so that's all. Feel free to visit the ATTPound GitHub and download the software.
This is a new tool we are currently working on, and we are adding new techniques.
Also, the project is collaborative, and everyone can help the project grow.
And now, we are ready to answer any questions you may have about HTTP.