WEBVTT 00:02.340 --> 00:06.800 Hello, my name is Pablo González and this is my colleague, Fran Ramírez. 00:06.800 --> 00:13.480 We are proud to introduce the ATTPound, Adversarial Emulation and Offensive Technical Collaborative Project. 00:13.500 --> 00:16.420 We are proud to be at DEF CON this year. 00:16.460 --> 00:27.020 Besides, we like very much the offensive part, and that's why we bring a tool called ATTPound, which helps to perform the emulation of adversaries. 00:27.560 --> 00:33.500 Also, we want to tell you about the collaborative side of the project. 00:33.540 --> 00:37.560 First of all, let's introduce ourselves. 00:38.680 --> 00:40.680 I am Pablo González. 00:40.680 --> 00:50.600 I work at Telefónica in Spain in the pre-innovation department, where we are very lucky to play with cybersecurity and artificial intelligence. 00:50.860 --> 00:58.780 We develop several open source tools and AGIAR, and try to contribute with crazy ideas. 00:58.780 --> 01:02.640 I am MVP of Microsoft since 2017. 01:03.020 --> 01:12.420 I have written some books in Spanish about cybersecurity, and I am a teacher at several universities in Spain. 01:13.000 --> 01:23.400 My partner, Fran Ramírez, works with me at Telefónica in the same pre-innovation department, focusing on cybersecurity and machine learning projects. 01:23.400 --> 01:34.180 He has worked several years in the USA as a system administrator, and has written some books about Docker and machine learning. 01:34.440 --> 01:44.060 Before we discuss the tool and show the use cases first-hand, let's have a look at the ATT&CK. 01:47.480 --> 01:52.600 The emulation of adversaries has become extremely important in the Red Team world. 01:52.600 --> 02:04.720 It's an exercise that provides a glimpse into the potential for a real threat, like many others that both business and society have experienced, to affect an organization. 02:04.720 --> 02:17.080 The goal is to be capable of verifying if the organization controls are efficient and effective by detecting the threats or displaying weaponry weakness in response to them. 02:17.200 --> 02:21.100 The purpose of a Red Team exercise are the following. 02:21.100 --> 02:24.520 Demonstration of the exposure-run risk level. 02:24.520 --> 02:26.340 Demonstration of the business impact. 02:26.340 --> 02:28.920 Demonstration of the prevention capabilities. 02:28.920 --> 02:31.280 Demonstration of the detection capabilities. 02:31.280 --> 02:35.360 Demonstration of the capabilities of reacting or addressing incidents. 02:35.640 --> 02:39.400 Now, we are going to speak about ATT&CK. 02:39.940 --> 02:47.880 Mitre ATT&CK is a database containing the most common techniques, tactics, and methods being used by attackers. 02:47.880 --> 02:51.660 Tactics are the high-level vectors of ATT&CK. 02:52.020 --> 02:55.720 The techniques represent the implementation of methods of ATT&CK. 02:55.720 --> 03:02.940 The organizations can perform an adversarial emulation and keep mapping the security controls that are applied to the techniques. 03:02.940 --> 03:08.740 Organizations can also have several security controls related to a given technique. 03:09.100 --> 03:15.940 The goal is to verify the performance and efficiency as regards the security control by techniques implemented. 03:16.720 --> 03:22.960 The Mitre ATT&CK framework takes on the security bridge. 03:23.360 --> 03:27.600 So, the starting point is the original intrusion tactic. 03:27.600 --> 03:37.040 Any activity that has been previously carried out will be covered by a framework called Mitre ATT&CK. 03:39.480 --> 03:44.100 Now, let's find out more about ATTBOUND. 03:44.100 --> 03:58.040 ATTBOUND is a computer security tool designed to emulate the tool aims to bring emulation of a real threat into closer contact with implementation based on the techniques and tactics from the Mitre ATT&CK framework. 03:58.040 --> 04:08.080 The goal is to simulate how a threat works in an intrusion scenario where the threat has been successfully deployed. 04:08.220 --> 04:13.220 It's focused on Microsoft Windows systems through the use of the PowerShell command line. 04:13.220 --> 04:18.400 This enables the different techniques based on Mitre ATT&CK to be applied. 04:18.480 --> 04:32.020 ATTBOUND is designed to allow the emulation of adversaries as for a red team exercise and to verify the effectiveness and efficiency of the organization control in the face of a real threat. 04:32.140 --> 04:34.360 What is the ATTBOUND core? 04:34.360 --> 04:35.280 PowerShell. 04:36.060 --> 04:41.560 PowerShell is released along with Microsoft Windows Vista. 04:42.200 --> 04:54.100 It's not natively embedded in the operating system which makes it very interesting for both IT administrators and pen testers. 04:54.100 --> 05:08.160 Its new version includes a large number of new features and modules that will help to integrate interestingly with the operating system and its many tools. 05:08.720 --> 05:16.580 And the first version was released in 2006. 05:16.860 --> 05:18.740 The first stable version. 05:18.740 --> 05:25.960 Okay, two versions appeared in 2009 with the release of Windows 7. 05:25.960 --> 05:34.420 Version 3 appeared in 2012 with the release of Windows 8. 05:34.950 --> 05:43.650 Later, the last version, version 7, appeared in the year 2020. 05:47.400 --> 05:57.040 The idea underlying ATTBOUND to link the Mitre ATT&CK framework along with the techniques that are implemented via the Microsoft Windows PowerShell command line. 05:57.040 --> 06:08.960 The many techniques implemented to using PowerShell support a high percentage of techniques laced in the ATT&CK matrix that can be replicated. 06:09.280 --> 06:11.900 The project is also collaborative. 06:11.900 --> 06:30.980 It means that the user can have his initial knowledge base based on ATT&CK but can import new implementations of the techniques used in PowerShell and relaunch them using the techniques and tactics in the file. 06:30.980 --> 06:41.160 We have used JSON format files to export this new code knowledge and import it in other environments where ATTBOUND has been deployed. 06:41.160 --> 06:45.480 In this way, the comparative knowledge has become very significant. 06:46.200 --> 06:52.880 This facilitates multiple users to share knowledge between separate environments. 06:52.880 --> 06:58.720 The techniques are dynamic elements that are emerging through the evolution of offensive security. 06:59.800 --> 07:06.760 Now, my colleague, Fran Ramirez, is going to give you a little insight into ATTBOUND. 07:07.860 --> 07:09.960 Okay, thank you, Pablo. 07:09.960 --> 07:11.600 And hello, everyone. 07:11.600 --> 07:16.800 Now, let's see what the architecture of ATTBOUND looks like. 07:18.640 --> 07:22.500 ATTBOUND has three main different components. 07:22.680 --> 07:25.700 The first one is the console. 07:25.700 --> 07:32.900 That is the PowerShell code that will be running on the Windows machines emulating the treat. 07:34.580 --> 07:45.720 After this code is executed on Windows machines, it connects towards a command and control and it waits for the adversary's commands to be emulated. 07:47.240 --> 07:50.580 The second one are the functions. 07:51.240 --> 07:58.260 These are the technical implementations that are mapped in Mitre, ATT, and CK. 07:59.140 --> 08:06.960 This is interesting since any user can create their functions written in PowerShell. 08:07.460 --> 08:18.460 This makes ATTBOUND collaborative and a project where any user can contribute with their knowledge in the form of technical implementations. 08:19.140 --> 08:26.050 All the functions will be carried out by the console when it is executed through Windows machines. 08:28.850 --> 08:33.410 And the last one is the command and control MVC or C2. 08:34.010 --> 08:37.050 This is the ATTBOUND control panel. 08:37.810 --> 08:42.780 From this panel, you can set up the treat or adversary to be emulated. 08:45.240 --> 08:51.160 You can use already pre-setup treats or you can build new treats or tests. 08:55.500 --> 09:06.780 The tool's knowledge can be imported and exported from this panel since the user can create its content in the form of an implementation of a technique in PowerShell. 09:10.070 --> 09:16.950 In other words, a basic architecture scheme has two main elements from the networking point of view. 09:18.590 --> 09:21.250 The first is the agent or warrior. 09:21.990 --> 09:27.950 It's the adversarial emulation and its code is in PowerShell. 09:29.930 --> 09:33.710 The second one is the root node or command and control. 09:34.570 --> 09:43.530 From this web application, it is possible to manage the application of the treat to be simulated by the different deployed warriors. 09:44.510 --> 09:51.070 Also, you can manage the results of the emulation and make decisions about the controls. 09:52.290 --> 09:58.430 Everything is fully connected with the identifiers of the ATT and CK metrics. 10:00.770 --> 10:09.230 Again, from the networking point of view, the deployment of warriors over the network will be accomplished through different options. 10:09.690 --> 10:16.670 Remote invocation through the network privilege, invocation of remote machine without privilege, lock and invocation, etc. 10:20.120 --> 10:28.780 It is commendable not to include more than 10 or 15 computers in this process, as indicated by the ATT and CK. 10:33.180 --> 10:42.020 These exercises are simulation, but you must have a real as possible environment for better results. 10:45.610 --> 10:49.330 Okay, and now let's talk about the operational flows. 10:52.090 --> 10:59.090 These are the different flows between the console or agent and the ATT bound command and control. 11:01.130 --> 11:04.250 The first flow is the connection flow. 11:04.570 --> 11:09.950 When a console is running on a Windows machine, it sends a high command. 11:12.860 --> 11:21.680 When the console is running, it gathers information from the machine and then passes it on the control panel through this packet. 11:25.640 --> 11:31.080 During the warrior generation, the IP address to be connected must be specified. 11:32.680 --> 11:35.600 But this is discussed further below. 11:37.040 --> 11:54.520 When the warrior needs to register as a compromised computer, it sends a request through the HTTP POST method of the root node, stating the warrior ID and the collected information from the computer. 11:58.050 --> 12:08.910 When this information is received by the root node, the data will be stored into the database and will be made available for the user. 12:09.430 --> 12:15.710 That is, in order to assign the plan set in a treat and perform its execution. 12:17.630 --> 12:26.850 When all this information reaches the command and control, it saves the information into a database and sends an OK signal. 12:28.590 --> 12:34.710 The second flow refers to the adversarial planning and execution process. 12:35.950 --> 12:42.170 The console or agent will ask for information about the treat plan to be performed. 12:43.070 --> 12:50.310 If the user has not created a treat plan for that console, the answer will be no treat plan. 12:51.210 --> 13:04.450 When there is already a treat plan created for that console, an OK signal will be sent Later, the console will start asking for the functions that are part of the treat plan. 13:05.850 --> 13:13.090 For each function downloaded and executed, the results will be reported to the command and control. 13:16.030 --> 13:24.350 In other words, when the warrior connects to HTTPound, it requests a new treat plan through the GETPLAN function. 13:25.850 --> 13:34.470 If the user has assigned already any plan to the warrior, it answers OK and the treat plan will be delivered. 13:35.030 --> 13:40.210 This plan is generated in a JSON format. 13:40.990 --> 13:44.910 More details about this file will be provided later. 13:45.550 --> 13:54.330 Once the treat plan is available for the warrior, it will perform the request of each function or task to be accomplished. 13:55.530 --> 13:59.510 This is made through the GETTASK function. 14:00.430 --> 14:11.570 A GETTASK function will be run for each technique implementation that the warrior requires to be performed in order to fulfill the treat plan. 14:14.070 --> 14:20.610 For each prior run, two values will be returned through the PUTRESULT function. 14:21.570 --> 14:28.590 The first one, whether or not the ATTCK technique has been executed successfully. 14:29.770 --> 14:41.190 In the second case, we get the output from the function that implements the returned technique ready for a technical review that can check the results. 14:41.850 --> 14:45.670 OK, and now the third flow is the SIGNOUT flow. 14:46.470 --> 14:53.170 After all the techniques have been performed, the communication close and the treat emulation is finished. 14:53.970 --> 14:57.970 So the console will send the BYE command. 15:01.010 --> 15:11.710 Therefore, the root node will also assume the warrior as dead if it does not report any activity for a long period of time. 15:11.710 --> 15:20.630 In the other side, the warrior will show activity if, before a treat plan is associated, the warrior is requesting a plan. 15:22.900 --> 15:28.160 Now let's talk about some key elements in the ATPAM to go a little deeper. 15:28.640 --> 15:38.200 The console will be created from the web application specifying the IP address from where the console file will be downloaded. 15:39.000 --> 15:53.100 There is a file called console template that houses the instructions that will manage the connection, the treat plan, and the connection clause we mentioned in the previous section. 15:53.660 --> 16:05.660 When the instruction provided is being executed on a Windows machine, the PowerShell code necessary to carry out the warrior instantiation will be launched. 16:06.300 --> 16:12.160 The console has two parts with a large if in the middle. 16:12.340 --> 16:18.080 The first part of the basic starting path is the beginning of the thread. 16:18.120 --> 16:23.800 As seen in the previous section, a connection request shall be made. 16:23.800 --> 16:33.420 First, a unique ID is generated for this instance to be identified in the root node. 16:33.420 --> 16:39.600 Also, the information on the operating system where it's running is gathered. 16:40.060 --> 16:48.200 The second part is driven by a case that can happen in many thread emulations. 16:48.560 --> 17:02.060 The process where a privilege escalation or lateral movement to another machine produces a new privilege process, or one that can be executed in another environment, has been called splitting. 17:02.060 --> 17:07.040 In this case, the console will be invoked with an ID. 17:07.040 --> 17:15.900 That is, it will not have to generate the warrior ID that identifies the warrior to the root node. 17:15.920 --> 17:33.820 In other words, if there is a plan with three tasks, and the second task is a privilege escalation, and this one is successful, then the third task will be executed in another process at an operating system level. 17:34.000 --> 17:39.160 But from the 80-pound logical point of view, it's the same warrior. 17:39.160 --> 17:42.560 That is, it inherits the same warrior ID. 17:45.700 --> 17:47.800 How do we define a thread? 17:48.080 --> 17:51.660 Simple, through a JSON file. 17:51.660 --> 17:56.580 The thread plan is generated in the root node according to the user's needs. 17:56.580 --> 18:04.680 The user can use real threads already created or build their threads and see the output of their monitoring techniques. 18:04.680 --> 18:08.720 The document format delivered with the plan is JSON. 18:11.590 --> 18:18.110 Let's talk about how to create your ATT-bound functions using the skeleton function. 18:20.100 --> 18:27.960 Any user can create or add features to implement techniques from the Mitre ATT and CK. 18:29.620 --> 18:36.700 Its implemented function is linked to a technique and one or more tactics in the framework. 18:38.700 --> 18:50.640 The main components from the skeleton functions are the technique to be launched or the function and the main program. 18:51.020 --> 18:56.520 This main program will be in charge of managing the flow of the technique to be performed. 18:59.410 --> 19:03.910 And this main program is in charge of another three tasks. 19:05.330 --> 19:13.590 The first one is request the necessary data to the root node for the technique to be executed. 19:13.890 --> 19:17.990 This is an execution prerequisite. 19:19.390 --> 19:26.750 The second one is check if the execution of the technique has been successful or not. 19:28.110 --> 19:32.770 The output will be stored in a true-false variable. 19:34.690 --> 19:53.570 And the last one is if there is some data collected such as credentials dump, AP addresses or user enumeration that can be used by another technique because all this information will be dumped to a data store that has the root node. 19:54.630 --> 20:01.090 This scheme can be visualized in any of the functions that can be found in ATT-bound. 20:02.290 --> 20:09.370 ATT-bound is a collaborative project where the goal is to share knowledge through treat plans. 20:11.090 --> 20:20.850 For this reason, the tool allows exporting user-generated treats and importing them into other ATT-bound instances. 20:23.690 --> 20:31.310 During the treat plan generation or query, the export plan option can be used as shown in the image. 20:35.560 --> 20:40.820 Once the file is stored in JSON format, it can be shared with the community. 20:42.240 --> 20:56.860 The JSON file contains all the information needed to recreate the treat plan with all the tasks and implementation of techniques involved, even if these are not available in the new scenario. 20:58.220 --> 21:01.960 Now, let's look at some use cases. 21:02.040 --> 21:09.320 In ATT-bound, you can execute the default or known threats and threats or adversaries that we create. 21:09.320 --> 21:37.220 With our custom threats, we can make our own version of a known threat with HTTP techniques selected by us, create our own version of an attack with HTTP techniques, and perform an execution of a threat now created by us that implements our own functions through the skeleton function. 21:38.760 --> 21:44.780 In this section, we will perform different scenarios and explain them. 21:50.370 --> 21:54.470 Okay, in this first demo, let's see what a warrior is. 21:55.300 --> 22:03.630 To do this, we will create the warrior in this option and copy the code that ATT-bound delivers to us. 22:08.580 --> 22:24.600 Then, we go to the computer where we will make the adversary or threat test, paste the code, it will be executed in a new PowerShell, and finally, it connects with ATT-bound downloading a console. 22:27.110 --> 22:35.030 If we go to the home section, we will be able to see the computer where the warrior is running. 22:35.870 --> 22:46.670 Here, we have the architecture data, the process that it's running, the AP address to which it belongs, and the warriors identified. 22:49.420 --> 23:01.120 In the plan section, we have some predetermined threats as we can see here, like WannaCry, NotPetya, Flame, DarkComet, or Dooku. 23:02.600 --> 23:14.940 Let's select, for example, WannaCry, and here we can see the techniques and the ATT and CK tactic identified that forms this version of WannaCry. 23:21.070 --> 23:34.250 We could use it against a warrior, launch the warrior plan, and finally execute it, step by step, all those techniques that correspond to WannaCry in this case. 23:40.060 --> 23:57.600 In this second demo, we are going to gather information to verify that there are different techniques within ATT and CK and ATT-bound to be able to collect that information to recreate the malware threat. 24:00.520 --> 24:08.700 Next, we are going to do a privilege escalation technique that will split the ATT-bound console process in two. 24:09.340 --> 24:13.660 One without privilege and the new one with privilege. 24:16.770 --> 24:23.670 The first step will be to create the warrior, copy the code, 24:27.530 --> 24:35.090 go to the PowerShell, run the code, 24:46.250 --> 24:50.530 and finally obtain the warrior executed. 24:56.430 --> 24:59.100 Okay, now let's go to the plan option, 25:02.250 --> 25:05.010 create a new one, 25:11.180 --> 25:24.100 select the gathering tactic where we can see here, besides the implemented techniques, we also have the discovery tactic where we can see some ATT and CK techniques generated. 25:26.180 --> 25:33.620 In this case, we are simply going to make a selection of the processes that the machine has. 25:33.980 --> 25:45.620 We will add this technique, then we'll go to the escalation of privilege, where we are going to use a bypass of USC technique named 1088. 25:45.980 --> 25:51.060 We add it, we put a name to the thread, 26:00.490 --> 26:03.690 and finally we will create the plan. 26:04.230 --> 26:08.570 Once we have the plan created, we can select it here. 26:12.180 --> 26:18.960 We see the elements of our plan with which Mitre tactics the mapping is performed. 26:20.960 --> 26:27.220 And we can identify the warrior over the warrior we want to launch it, and finally we launch the plan. 26:28.960 --> 26:39.860 At this moment, the ATT bound console will start working and it will read the plan, and here we have the pending task. 26:42.260 --> 26:47.760 If we go to the result option, we will see how the first technique has already been executed. 26:51.380 --> 26:57.280 In bulk process, which is just a collection of processes, we can see success. 26:59.140 --> 27:03.560 If we refresh it or we wait for a little while, 27:07.910 --> 27:20.930 we will find that USC bypass has also been successful, and we really get a double process. 27:21.840 --> 27:39.850 The one on the left is without privilege, but the one on the right is a process in which instructions with privilege are being executed, but we had no more technique after the privilege elevation of execution. 27:40.010 --> 27:45.660 In the ATT bound technical part, we can see the technique's output. 27:48.680 --> 27:57.320 We can check the processes that the computer has, and here we can also see the UAC bypass result. 28:02.040 --> 28:04.240 And here's the second demo. 28:10.940 --> 28:19.080 In this third demo, we are going to perform an escalation of privilege, but also a credential stamp. 28:22.960 --> 28:36.220 To do this, let's create a warrior pointing to the ATT bound IP panel, copy the code, and run it on the PowerShell console as we saw before. 28:41.190 --> 28:48.910 Here we can see the information about the new warrior connected to the panel, and now we are going to create a plan. 28:55.070 --> 28:58.270 The plan will have a privilege escalation. 28:58.880 --> 29:17.050 We will use again 1088, that is the UAC bypass, and we will execute a credential access tactic using a power dump, but we could also use Mimikatz to perform the credential dump. 29:28.950 --> 29:42.570 The interesting part is that once we get the privilege escalation working, we will get a new process with privilege, and this process will be able to perform the credential dump. 29:45.100 --> 29:52.460 Okay, so let's create the plan, deploy the treat, select the treat, select the warrior, and finally launch the plan. 30:01.140 --> 30:10.800 Okay, and now let's go to the ATT bound output section, and here we'll be able to see the techniques or tasks pending execution. 30:13.510 --> 30:26.020 Like the 1088, if we give it a little time, we will see that it has been successful. 30:26.400 --> 30:30.260 This new process with privilege has not been created yet. 30:30.260 --> 30:32.340 We will see in the next refresh. 30:34.880 --> 30:38.600 Here we can see the console without privilege, 30:43.140 --> 30:48.860 and this second panel, we will find the credential dump still running. 30:57.010 --> 31:01.590 And now we can see that the power dump technique is finished. 31:02.490 --> 31:05.850 But where can we see the results? 31:05.870 --> 31:11.510 Like in the previous demo, here we can see the output that this technique has. 31:12.770 --> 31:14.990 In this case, the UAC bypass. 31:16.610 --> 31:24.090 While the second technique executed in this process, the credential dumping, has returned us all this information. 31:25.430 --> 31:28.030 This information is very important. 31:28.250 --> 31:34.670 As we see here, we have users, user ID, has lm, has ntlm. 31:34.670 --> 31:42.130 As I said, this information is very important because we will be able to use it through a datastore. 31:45.600 --> 31:50.990 The datastore can be used by techniques that are performed afterward. 31:51.400 --> 32:00.200 For example, a lateral movement technique can be used by these hashes and these users because of this datastore. 32:01.180 --> 32:05.800 This is a very, very important element within ADDbound. 32:12.410 --> 32:16.850 In this fourth demo, we will perform the following scenario. 32:17.810 --> 32:21.290 First, an escalation of relays. 32:21.290 --> 32:24.330 Second, credential dumping. 32:25.670 --> 32:33.450 And finally, we will make a lateral movement from a computer with Windows 7 to a computer with Windows 10. 32:34.050 --> 32:39.210 First, we are going to deploy a warrior on the Windows 7 machine. 32:42.380 --> 32:52.600 Okay, as we have done in previous demos, we type in the ADDbound IP address and finally create the code. 32:52.720 --> 32:58.900 We copy the code from PowerShell and run it on Windows 7. 33:02.090 --> 33:11.970 Okay, we copy the code from ADDbound and run it on Windows 7 on PowerShell. 33:14.350 --> 33:25.370 Okay, once executed, we go to home and obtain, as before, the new warrior running Windows 7. 33:29.780 --> 33:43.360 Okay, well, now let's generate a plan where the first step is to execute this technique. 33:43.360 --> 33:49.500 For example, by the counts T1078. 33:49.740 --> 33:56.400 Okay, the second technique is an escalation of privileges. 33:56.400 --> 34:01.080 And third technique is credential dumping. 34:01.080 --> 34:06.940 And the fourth step or fourth technique will be a lateral movement. 34:11.160 --> 34:27.300 Okay, now insert plan and select a plan, new plan or new thread. 34:27.840 --> 34:37.860 And we assign warrior ID to new plan. 34:37.860 --> 34:50.100 Okay, and look at results view and we have a data store. 34:50.100 --> 34:52.400 Okay, 34:56.940 --> 35:06.860 these are several techniques about the new plan and data store. 35:06.860 --> 35:10.900 We add an IP address to the data store. 35:10.900 --> 35:11.020 Okay 35:21.990 --> 35:32.570 , well, refresh the web page several times until the lateral movement is complete. 35:32.570 --> 35:37.710 The technique of lateral movement is complete. 35:39.190 --> 35:48.130 Now ADDbound is still executing, execute all process. 35:51.690 --> 35:57.650 And now refresh the web page several times until the lateral movement is complete. 35:57.650 --> 36:05.170 Okay, observe that we have an ADDbound console running on Windows 10. 36:10.970 --> 36:11.910 Yeah. 36:11.930 --> 36:16.310 Then now we can conclude this demo 4. 36:19.600 --> 36:27.080 Okay, now we are going to do a speech about demo 5. 36:37.310 --> 36:59.410 Well, in this 5th demo, we will work on an all-in-one thread concept where we will automate the service discovery and the discovery of machines within a network as a thread or an adversary could do. 36:59.810 --> 37:06.290 The data discovery will be stored on the data store by a technique being used. 37:06.290 --> 37:13.730 Then we will perform a privilege escalation, obtain a new privilege process on the Windows 7 machine. 37:14.030 --> 37:25.030 Then we will make a credential dump thanks to that privilege escalation where we will acquire hashes and users. 37:25.290 --> 37:42.370 Then we will make a lateral move where we will use the hashes, users, and the IP addresses from the computers within the network to try to make that lateral move through the metered CKE technique. 37:43.070 --> 37:54.910 In this way, the whole process is fully automatic, so we can test the effectiveness or efficiency of security controls within the organization. 37:55.690 --> 37:58.590 We will start, as always, by generating a warrior. 37:58.590 --> 38:01.750 In this case, we check the IP address again. 38:01.750 --> 38:06.510 Copy the code and go to PowerShell to paste the code. 38:06.510 --> 38:07.310 Okay? 38:09.730 --> 38:10.610 Okay. 38:10.610 --> 38:17.230 In the home section, we will see the control connected soon. 38:17.230 --> 38:19.490 Here we see the data. 38:19.490 --> 38:22.190 Now we go to the plan section. 38:24.760 --> 38:25.580 Okay. 38:25.580 --> 38:28.600 Waiting for the warrior. 38:34.330 --> 38:36.930 And we go to the plan section. 38:36.930 --> 38:56.030 We create a new plan beginning with the discovery tactic using the T1046 technique where this port scanning will allow us to discover computers. 38:56.030 --> 38:57.230 Okay. 38:57.530 --> 39:08.570 We add the technique to the plan indicating an escalation of privilege and then credential dump with power dump or mini cuts. 39:08.570 --> 39:15.810 And finally, the last technique, again, a lateral movement. 39:16.650 --> 39:17.470 Okay. 39:18.050 --> 39:28.450 And thread name, DEF CON GIMU5, and thread description, blah, blah. 39:31.830 --> 39:32.570 Okay. 39:32.570 --> 39:37.050 We put the name on the one, create a plan, and link it with the warrior. 39:37.050 --> 39:41.070 We go now to the results. 39:42.210 --> 39:42.810 Okay. 39:42.810 --> 39:45.710 Well, first locate plan. 39:45.730 --> 39:49.730 And now we go to the results. 39:51.920 --> 39:55.390 We see the control begins to work. 39:58.010 --> 40:03.670 Now we can see here the task to be done. 40:03.670 --> 40:05.440 And the scan begins. 40:08.510 --> 40:09.970 One moment here. 40:09.970 --> 40:10.650 Yeah. 40:12.170 --> 40:18.310 The scan is a technique that can take quite a long time. 40:18.310 --> 40:20.750 Can be seconds or minutes. 40:21.270 --> 40:28.550 So, we will speed up the demo a little bit so that this part goes as fast as possible. 40:32.320 --> 40:33.260 Okay. 40:33.440 --> 40:44.540 Once the scan has finished, we will be able to check that it has been successful if we go to the data store. 40:45.860 --> 40:47.220 Okay. 40:47.220 --> 40:50.980 Now, we go to the data store. 40:50.980 --> 40:57.420 We will be able to see the computer IP addresses that are currently alive on the network. 40:58.880 --> 41:06.760 Right now, the second technique, that is the escalation of village has also been successful. 41:06.800 --> 41:10.160 So, the process has been unfolded. 41:10.160 --> 41:12.420 Right now, the process is done. 41:15.920 --> 41:17.280 Okay. 41:17.840 --> 41:23.780 If we refresh the page, we will see the credential dumping has been successful, too. 41:23.780 --> 41:33.240 And if we go to the data store, we see that we have IP addresses, users, and hostess. 41:34.440 --> 41:39.260 This hostess can be from here directly. 41:39.260 --> 41:46.880 Like any data from the data store and the changes will be saved by clicking on the update code. 41:46.880 --> 41:47.520 Okay. 41:47.520 --> 41:54.620 For the thread to finish, we will have to check if the result is correct or not in the lateral movement. 41:54.620 --> 42:07.040 And we must consider that these techniques are used to test the efficiency and effectiveness of the security controls within the organization. 42:07.360 --> 42:15.300 Therefore, certain implementations may be dated and avoid the execution of some codes. 42:17.300 --> 42:18.360 Okay. 42:18.460 --> 42:22.900 Now, a new process on Windows 10 has been implemented. 42:22.900 --> 42:27.240 There are no tasks and we have performed the lateral movement. 42:27.240 --> 42:35.620 In other words, the thread has moved from Windows 7 to Windows 10 from one machine to another over the network. 42:35.900 --> 42:42.880 We have also done the whole process of thread that is real for us. 42:42.880 --> 42:44.340 Detecting computers in the network . 42:45.920 --> 42:51.260 Dumping and accessing information such as hashes. 42:51.260 --> 42:58.860 And finally, a lateral move with one of the techniques that can be implemented within the lateral movement. 42:58.860 --> 42:59.880 Move tactics. 43:03.290 --> 43:12.130 In this final demo, we are going to export the thread plan and then import it into HTTP. 43:12.130 --> 43:24.740 To make a simple example, we can choose notepad, select the thread, get the techniques to use, and proceed with the plan export. 43:26.830 --> 43:34.410 In this button, we export this knowledge. 43:34.670 --> 43:57.610 If we want to share knowledge with other users, our thread knowledge that we already have created, or even techniques that we have implemented in PowerShell, we can create a new plan, set a name, create a plan, choose it, and proceed to export it. 44:10.570 --> 44:21.890 If we want to share this plan with another user, we will send him the JSON file which we are going to open to see the content. 44:27.880 --> 44:33.340 Okay, JSON, opening JSON file in Firefox, okay. 44:35.880 --> 44:48.060 Okay, as you can see, even the function definition written in PowerShell, exactly as we have created it, is transferred. 44:48.620 --> 45:05.640 So, if we want to share this information with another user, we can export those plans containing the functions that we have created in PowerShell and added to HTTP and send this JSON. 45:12.290 --> 45:12.730 Okay. 45:12.730 --> 45:22.730 It's a very simple and collaborative way to provide the knowledge to other users with offensive techniques within the HTTP mapping. 45:23.210 --> 45:29.610 Well, this is the last demo, and I will pass the word on to my partner, Fran. 45:30.970 --> 45:33.090 Okay, so that's all. 45:33.090 --> 45:37.570 Feel free to visit the ATTPound GitHub and download the software. 45:38.550 --> 45:43.930 This is a new tool we are currently working on, and we are adding new techniques. 45:45.410 --> 45:49.630 Also, the project is collaborative, and everyone can help the project grow. 45:50.890 --> 45:55.990 And now, we are ready to answer any questions you may have about HTTP.