1 00:00:01,500 --> 00:00:05,860 Hey everyone, welcome to my talk, Guerrilla Red Team, Decentralize the Adversary. 2 00:00:06,000 --> 00:00:08,620 It's a project I've been working on for the past few months. 3 00:00:08,620 --> 00:00:12,380 I decided to write a white paper on it, it's published actually today. 4 00:00:12,780 --> 00:00:20,280 And the more and more I worked on the project, the more I realized that it meant a lot to the people that were involved, so I decided to talk about it. 5 00:00:20,280 --> 00:00:22,240 So without further ado, let's get in. 6 00:00:23,220 --> 00:00:27,260 This is a brief overview of what this talk is going to cover. 7 00:00:27,260 --> 00:00:30,960 This is a journey that we're going to take together. 8 00:00:30,960 --> 00:00:33,600 It's divided into two parts, Phase 1 and Phase 2. 9 00:00:33,600 --> 00:00:36,100 I'm going to walk through Phase 1 first, obviously. 10 00:00:36,220 --> 00:00:42,120 Phase 2 is going to come a little bit later when I talk about the so what of the program. 11 00:00:42,240 --> 00:00:45,460 The yes, we did this thing, so what. 12 00:00:45,460 --> 00:00:46,940 That's going to be Phase 2. 13 00:00:48,540 --> 00:00:49,980 So, who am I? 14 00:00:50,340 --> 00:00:51,700 My name is Chris Cottrell. 15 00:00:51,700 --> 00:00:54,200 I usually go by iSpareFriends. 16 00:00:54,200 --> 00:00:58,660 Chances are, if you see a picture of iSpare, it could be me. 17 00:00:58,660 --> 00:01:02,320 There's a couple others out there, but iSpareFriends is usually where I go. 18 00:01:02,320 --> 00:01:07,700 I'm on Twitter, GitHub, I have a few ScriptKitty things on GitHub and LinkedIn. 19 00:01:08,300 --> 00:01:10,480 I'm open, just hit me up. 20 00:01:12,800 --> 00:01:18,360 I have been in the Red Team Offensive Security field since 2012. 21 00:01:19,520 --> 00:01:22,240 I'm currently leading my own team right now. 22 00:01:22,240 --> 00:01:23,300 It's pretty fun. 23 00:01:23,300 --> 00:01:25,820 We kind of get nasty around then. 24 00:01:26,600 --> 00:01:30,260 I took my OSCP a few years ago, passed that. 25 00:01:30,260 --> 00:01:37,380 Fun fact about that test is I actually consumed over a gram of caffeine the whole time I was doing the test and writing the report. 26 00:01:37,780 --> 00:01:40,200 That made me very sick later on. 27 00:01:40,200 --> 00:01:44,160 And I hope I never have to do that test or anything like it ever again. 28 00:01:45,360 --> 00:01:50,980 And I've also started to delve into the cloud security components of everything. 29 00:01:50,980 --> 00:01:55,880 Mainly because me personally, I see a lot of security trends going that route. 30 00:01:55,880 --> 00:01:59,600 And I want to try to get ahead of that as much as I can. 31 00:01:59,600 --> 00:02:06,420 Not only to build my own automated Red Team infrastructure, but just to pen test various things in the cloud. 32 00:02:06,420 --> 00:02:12,480 Pretty much if you learn one, you can kind of understand the other three, or the big three. 33 00:02:13,100 --> 00:02:17,420 So with my company, we focus on AWS, so that's where I'm starting. 34 00:02:17,420 --> 00:02:20,520 Hopefully I'll have my solutions architect soon. 35 00:02:21,920 --> 00:02:24,220 Who is this talk for? 36 00:02:24,220 --> 00:02:25,720 That is a great question. 37 00:02:26,080 --> 00:02:32,260 This talk is aimed at anybody that is trying to get into the Red Team field. 38 00:02:32,280 --> 00:02:35,720 Anybody that runs a Red Team and is looking for friends. 39 00:02:35,720 --> 00:02:43,680 Or anybody that is looking to expand or do anything out of the box for their Red Team. 40 00:02:43,680 --> 00:02:48,380 And I will get into what the out of the box aspects are for the guerrilla portion. 41 00:02:49,120 --> 00:02:52,380 But mainly it's for people that are managers. 42 00:02:52,400 --> 00:02:56,260 You're looking for somebody, you're looking for friends, you're looking for more people on the Red Team. 43 00:02:56,340 --> 00:02:59,540 People that are trying to get into the Red Team, you're looking for a way in. 44 00:02:59,740 --> 00:03:09,860 You're in a company, you're in a help desk or something, and you're trying to break into the InfoSec field, or maybe you're trying to get into the OffSec component. 45 00:03:10,520 --> 00:03:12,100 And you don't know where to start. 46 00:03:12,100 --> 00:03:14,940 This is a program that's going to take you there. 47 00:03:16,360 --> 00:03:19,100 So, just some learning expectations. 48 00:03:19,120 --> 00:03:21,540 Like I mentioned, we're going to walk through two phases. 49 00:03:22,220 --> 00:03:25,680 Phase 1 is going to be all about upscaling the assets. 50 00:03:25,800 --> 00:03:28,680 Phase 2 is going to be about unleashing those assets. 51 00:03:28,700 --> 00:03:32,080 Together, those things make up the Guerrilla Red Team. 52 00:03:32,080 --> 00:03:40,000 However, this project first started under the moniker of the Red Team Development Program. 53 00:03:40,000 --> 00:03:41,360 That's originally what it was called. 54 00:03:41,360 --> 00:03:43,060 It was only one phase. 55 00:03:43,100 --> 00:03:47,040 And it was Red Team Dev Program, RDTP. 56 00:03:47,680 --> 00:03:49,560 Why did I make this program? 57 00:03:49,560 --> 00:03:54,500 First and foremost, because this was me for about a year and a half. 58 00:03:54,500 --> 00:04:02,460 Just lonely, isolated, by myself, trying to make magic happen by doing ops. 59 00:04:02,680 --> 00:04:07,040 Our security team is pretty small, so I was the Red Team component. 60 00:04:07,040 --> 00:04:10,340 I was setting up my own program, infrastructure, all that stuff. 61 00:04:10,340 --> 00:04:11,500 And it was lonely. 62 00:04:12,980 --> 00:04:17,220 I wasn't able to interface with a lot of the teams because they were the ones that I was testing. 63 00:04:17,380 --> 00:04:22,960 So , at its core, the Red Team Dev Program was there because I was just lonely. 64 00:04:22,960 --> 00:04:26,900 And I was either going to build friends, or I was going to go find them. 65 00:04:26,940 --> 00:04:33,500 So, since I couldn't really become friends' friends with a lot of the people that I was testing, I decided to just build my own. 66 00:04:33,500 --> 00:04:35,640 And that's where the Red Team Dev Program came into place. 67 00:04:37,740 --> 00:04:40,080 It turned into something else, though. 68 00:04:40,180 --> 00:04:42,000 And I'll get into that a little bit later on in the talk. 69 00:04:42,000 --> 00:04:45,060 But it turned into something magical, in my opinion. 70 00:04:45,360 --> 00:04:50,060 And not magical for me, but magical for the people involved. 71 00:04:50,280 --> 00:04:54,640 And that is why I'm here having this talk right now. 72 00:04:55,560 --> 00:05:00,060 So, at its core, the Red Team Dev Program was going to be, like I said, a way for me to make friends. 73 00:05:00,120 --> 00:05:02,240 And it was almost like a pyramid scheme. 74 00:05:02,560 --> 00:05:04,720 The Red Team was going to be at the top. 75 00:05:04,720 --> 00:05:09,540 And me and my partner that are on the Red Team, we were going to be at the top. 76 00:05:09,540 --> 00:05:18,060 And we were going to have all these little people that we could talk to and get ideas from and help with idea generation, campaign generation. 77 00:05:18,200 --> 00:05:26,360 If we needed assets to test a certain component of the business, we would have those assets kind of spread throughout the organization. 78 00:05:26,820 --> 00:05:32,860 So, not really a pyramid scheme, but kind of took on a similar aspect of it. 79 00:05:33,260 --> 00:05:34,940 So, I came up with this idea. 80 00:05:34,940 --> 00:05:40,660 We were going to post on our cybersecurity channel on our Slack that we were running this Red Team Dev Program. 81 00:05:40,660 --> 00:05:46,560 It was a pilot program, and I only posted it in one channel, and I posted it once. 82 00:05:46,900 --> 00:05:52,300 And I told everybody you had to fill out this form that had an open-ended question on it. 83 00:05:52,300 --> 00:05:56,240 The only question on the form was, tell me about something cool. 84 00:05:56,600 --> 00:06:01,740 And the results that we got from that question were super varied. 85 00:06:01,740 --> 00:06:08,420 And from those varied results, it was very obvious who was ready for the program and who was not. 86 00:06:08,500 --> 00:06:13,760 And we got over a dozen applications, and I would say over half of those didn't even come from this channel. 87 00:06:13,760 --> 00:06:16,800 So, there was definitely some word of mouth that happened with it. 88 00:06:20,700 --> 00:06:23,780 So, when you click that link, it led to this form. 89 00:06:23,840 --> 00:06:28,180 And just like the form I had mentioned, I was trying to dress it up a little bit, make people excited. 90 00:06:28,180 --> 00:06:33,020 And it had that one question, just tell me something cool. 91 00:06:33,800 --> 00:06:39,040 From that question, we were able to take five applications. 92 00:06:39,040 --> 00:06:42,680 We accepted five people with one alternate, in case somebody wasn't there. 93 00:06:43,100 --> 00:06:46,480 I created these templates for their managers. 94 00:06:46,840 --> 00:06:53,120 And I would go through and I would say, hey, so-and-so was accepted into the program. 95 00:06:53,120 --> 00:07:00,980 We were requesting up to four hours of their workday per week to take part in this program. 96 00:07:01,080 --> 00:07:02,200 Are you okay with that? 97 00:07:02,200 --> 00:07:08,240 If not, then let me know what you are okay with. 98 00:07:08,240 --> 00:07:13,140 And I made this sales pitch and everything to go with it, so they kind of get an idea of what the program was. 99 00:07:15,000 --> 00:07:20,220 And if their manager is accepted, then I would send this to them and say, hey, guess what? 100 00:07:20,220 --> 00:07:21,880 You're part of that cohort. 101 00:07:22,360 --> 00:07:24,480 I need you to fill out this pre-fine checklist. 102 00:07:24,480 --> 00:07:25,720 I'll get into that in a second. 103 00:07:25,840 --> 00:07:29,540 And also, we're going to provide you with some swag. 104 00:07:29,660 --> 00:07:38,460 And my thought process on this was I wanted people to join the Red Team Dev program because they wanted to be there. 105 00:07:38,460 --> 00:07:44,300 And I wanted them to be excited to be there, because if they're excited, they're going to really put forth a lot of effort. 106 00:07:44,520 --> 00:07:48,440 And what that turns into is I get a lot of really good assets later on. 107 00:07:48,860 --> 00:07:55,540 So the way that we did this was we paid for a Hackabox VIP subscription for the duration of the program. 108 00:07:55,900 --> 00:08:02,800 We paid for three books that they could have, and they could kind of follow along with some extended learning. 109 00:08:03,400 --> 00:08:06,280 And this came directly out of the cybersecurity budget. 110 00:08:06,280 --> 00:08:09,700 So all they had to do was show up, and we would pay for everything else. 111 00:08:09,700 --> 00:08:13,880 And I walked them through how to do this, how to submit expense reports for it and everything. 112 00:08:13,880 --> 00:08:16,900 I'm sure it could be streamlined, but that's for the next step. 113 00:08:16,900 --> 00:08:20,440 And I also let them take a look at the sales picture that I sent to the manager. 114 00:08:22,360 --> 00:08:26,300 And because I like to make it fun and exciting, I went with a Pokemon theme. 115 00:08:26,300 --> 00:08:28,040 These are laptop stickers that we have. 116 00:08:28,040 --> 00:08:31,960 This is Absol Cohort for Q2 2020. 117 00:08:32,260 --> 00:08:38,380 The idea behind this is every cohort would, you know, every quarter, every half, they would get their own Pokemon. 118 00:08:38,460 --> 00:08:41,480 And if you do well in the cohort, you get to stay on as a fellow. 119 00:08:41,800 --> 00:08:45,040 And the longer you stayed in, you got to collect them all. 120 00:08:45,040 --> 00:08:46,880 So you could collect all the Pokemon. 121 00:08:49,120 --> 00:08:50,400 I thought it was fun. 122 00:08:51,760 --> 00:09:00,240 So now that I got some branding attached to it, we're going to go through and we're going to say, I need you to fill out this pre-fide checklist. 123 00:09:01,640 --> 00:09:03,200 This is an example of it. 124 00:09:03,200 --> 00:09:05,040 But really, like, here's the meat and potatoes. 125 00:09:05,040 --> 00:09:08,320 This is how the students answered this question. 126 00:09:09,860 --> 00:09:16,060 And it seemed like most of the people came from the help desk field in this cohort. 127 00:09:16,060 --> 00:09:21,820 There was a couple that came from other technical disciplines, but a bulk of them came from help desk. 128 00:09:22,280 --> 00:09:26,540 And the comfort was kind of all over the place with what you would expect. 129 00:09:27,980 --> 00:09:31,040 One person said that they knew how to do an SMB relay. 130 00:09:31,040 --> 00:09:40,880 But most of the time, I try to gauge how they thought they were, like, what their technical skills were. 131 00:09:40,880 --> 00:09:42,820 So for example, Windows networking. 132 00:09:43,220 --> 00:09:46,240 I mean, to me, watching YouTube is a good way to get started. 133 00:09:46,240 --> 00:09:47,780 You at least know what you're trying to watch. 134 00:09:47,780 --> 00:09:53,420 But if you can mount a file share, maybe understand SMB a little bit more. 135 00:09:54,680 --> 00:09:56,200 Same thing with Linux. 136 00:09:56,200 --> 00:09:58,660 Seems like quite a few people knew what SSH was. 137 00:09:58,660 --> 00:10:02,680 A couple of them knew how to use SSH with keys, or at least understood what that meant. 138 00:10:03,400 --> 00:10:07,220 And just general ideas of what the people wanted to get out of this. 139 00:10:09,080 --> 00:10:12,520 For the bulk of it, it was everybody just wanted to learn about red teaming. 140 00:10:12,520 --> 00:10:16,400 A couple people wanted to take it a step further and say, like, I want to turn this into a career. 141 00:10:16,640 --> 00:10:21,500 I made it very clear that this was not what the program was, but that's fine. 142 00:10:21,500 --> 00:10:24,880 And I wanted to teach these students. 143 00:10:24,880 --> 00:10:33,340 I wanted to teach them how to fish, not necessarily how to be an operator, but how to get to a point where they know, OK, I have X problem in front of me. 144 00:10:33,340 --> 00:10:35,280 I'm going to go with Y solution. 145 00:10:35,380 --> 00:10:42,780 Whereas at the start of this program, they may not even know what X problem was or even how to search for Y solution. 146 00:10:42,780 --> 00:10:50,360 The program here was to help with them to get to a point where they could ask that question and start doing research on their own. 147 00:10:51,040 --> 00:10:57,400 So, like I mentioned, we primarily use Hack the Box for a lot of the practical application portions. 148 00:10:57,580 --> 00:11:01,520 And we did that by, you know, providing a VIP subscription. 149 00:11:03,800 --> 00:11:10,660 The reason we went in VIP is because some of the lessons that were being taught, we needed the actual walkthroughs. 150 00:11:10,660 --> 00:11:16,240 And if you have a VIP subscription, you can, you know, you can download the walkthroughs for retired machines. 151 00:11:16,460 --> 00:11:21,360 So it wasn't so much about, you know, getting points and everything, but it was about learning. 152 00:11:21,560 --> 00:11:25,100 And the best way to do that is just to say, try it for a few days. 153 00:11:25,100 --> 00:11:27,980 And if you can't figure it out, let's talk about it. 154 00:11:27,980 --> 00:11:33,560 And then if you still can't figure it out, just download the walkthrough, because I at least want to incorporate some sort of learning. 155 00:11:33,560 --> 00:11:39,400 I want to push the whole cohort forward at the same time, not just like one person, onesies, twosies. 156 00:11:39,920 --> 00:11:42,060 These are the three books that we picked. 157 00:11:42,780 --> 00:11:46,460 Slight caveat warning, my name is actually in the one on the left. 158 00:11:46,460 --> 00:11:51,060 I knew what was in the book because I helped do some technical review for it. 159 00:11:51,060 --> 00:11:54,300 And I knew that it would be a good resource to have for students later on. 160 00:11:54,820 --> 00:12:08,460 Waging Cyber War was there to kind of expose the students to what not just a red team is, but how do you take a red team to the next level of like, for real, not just exercises and wargaming. 161 00:12:08,460 --> 00:12:16,000 And then the Red Team Development and Operations book that Joe Vest and James Humberville released just this year, which is super awesome. 162 00:12:16,380 --> 00:12:19,860 If you are a red team manager, I highly suggest you read the first half of that book. 163 00:12:19,860 --> 00:12:23,100 If you're a red team operator, I highly suggest you read the second half of that book. 164 00:12:23,100 --> 00:12:26,860 If you just want to read the whole thing, go for it because it's awesome all the way around. 165 00:12:28,960 --> 00:12:32,180 So phase one, red team dev program started. 166 00:12:32,180 --> 00:12:34,100 So I had selected all the applications. 167 00:12:34,140 --> 00:12:36,180 We selected five people for our cohort. 168 00:12:36,180 --> 00:12:41,300 We got buy-in from their managers to come in for four hours a week on Fridays. 169 00:12:41,300 --> 00:12:46,800 The whole cohort met together and we would start going to town. 170 00:12:48,620 --> 00:12:55,600 So I made the syllabus for the program and it was broken up into two parts. 171 00:12:55,720 --> 00:13:00,500 There was the we're going to learn how to do this phase, which was the first five weeks. 172 00:13:00,500 --> 00:13:05,220 And then there was the live ops phase, which is the second, like the last four weeks. 173 00:13:05,860 --> 00:13:14,740 First five weeks are all going to be broken down into things like, here's Windows, here's Linux, here's how you do a Windows prev ask, here's how you do a Linux prev ask, here's how you do password cracking. 174 00:13:16,400 --> 00:13:23,220 And we would meet once a week to discuss those things and go over, you know, learning and everything that we needed. 175 00:13:23,540 --> 00:13:28,700 And just trying to impart as much knowledge as we could so that they could go out and try to research this. 176 00:13:31,700 --> 00:13:38,360 There was also a we incorporated in addition to the books, we did the podcast, Darknet Diaries. 177 00:13:38,360 --> 00:13:43,000 I tried to sync up whatever the lessons that we were trying to teach that week. 178 00:13:43,000 --> 00:13:46,120 I tried to sync up a podcast with Darknet Diaries for that. 179 00:13:46,120 --> 00:13:48,800 And sometimes they matched up very, very well. 180 00:13:48,800 --> 00:13:53,120 Sometimes it was just more of a hey, listen to this episode because it's really good. 181 00:13:55,910 --> 00:13:58,190 So this is just a quick breakdown of the syllabus. 182 00:13:58,190 --> 00:14:00,810 Week 1, Introduction to Red Teaming. 183 00:14:00,810 --> 00:14:02,550 We do Legacy. 184 00:14:02,590 --> 00:14:04,210 Week 2, Lame. 185 00:14:04,210 --> 00:14:06,410 Week 3 was all about password cracking. 186 00:14:06,410 --> 00:14:10,630 Week 4, Windows prev ask, Linux prev ask, LiveOps. 187 00:14:12,490 --> 00:14:15,410 So week 1 is Intro to Red Teaming. 188 00:14:15,550 --> 00:14:24,610 This week focused heavily on talking about what op notes were and how to take them correctly. 189 00:14:24,610 --> 00:14:31,170 And the reason I hark on this was because for me, the op notes are the deliverable that we're required every week. 190 00:14:31,170 --> 00:14:37,830 And if I can't read them and if I can't figure out the narrative that the operator is trying to do, then it's essentially useless. 191 00:14:37,830 --> 00:14:46,770 Because I need to be able to take those op notes, look at their op notes and do replay the op and do exactly the same thing that they did without ever talking to them. 192 00:14:46,810 --> 00:14:52,890 So this was a constant theme throughout the cohort was op notes, op notes, op notes. 193 00:14:52,890 --> 00:14:55,170 It needs to be in a certain narrative. 194 00:14:55,170 --> 00:14:57,410 It needs to have certain types of information. 195 00:14:57,650 --> 00:15:02,330 If I want raw logs, I'll go pull the raw logs myself, but I don't want raw logs. 196 00:15:02,330 --> 00:15:03,730 I want to know what you did. 197 00:15:03,730 --> 00:15:06,150 So we talked a lot about op notes. 198 00:15:06,750 --> 00:15:11,890 Fortunately, most people had an understanding of what Metasploit was and knew how to use it. 199 00:15:11,890 --> 00:15:18,710 So we could just get kind of straight to, you know, doing this first box, which is Legacy. 200 00:15:18,710 --> 00:15:24,910 I paired that up with the Darknet Diaries episode 57 over MS08067. 201 00:15:25,250 --> 00:15:26,370 And this was just a quick blend. 202 00:15:26,370 --> 00:15:29,350 This was like, let's see what your op notes look like. 203 00:15:29,350 --> 00:15:30,730 Let's see how you think. 204 00:15:30,730 --> 00:15:33,570 Let's get an idea of what being on target looks like. 205 00:15:33,990 --> 00:15:35,870 All the students completed this. 206 00:15:36,690 --> 00:15:41,550 So here's the episode, talked about it, you know, NetAPI. 207 00:15:42,630 --> 00:15:43,530 Here's the box. 208 00:15:43,530 --> 00:15:44,790 It was an easy box. 209 00:15:44,790 --> 00:15:49,750 Almost every boxes, almost all the boxes in this program are easy. 210 00:15:49,770 --> 00:15:55,670 And that's not like some are definitely easier than others in the easy category. 211 00:15:57,190 --> 00:16:00,070 But keep in mind, this is like we were just trying to do learning. 212 00:16:00,070 --> 00:16:02,570 It wasn't we're not trying to be super elite. 213 00:16:02,570 --> 00:16:07,110 We're trying to get these people to a certain level so that they can do things on their own. 214 00:16:07,690 --> 00:16:09,630 For this one, it was super easy. 215 00:16:09,630 --> 00:16:10,390 CBE. 216 00:16:10,390 --> 00:16:12,250 I think everybody got it pretty quickly. 217 00:16:12,990 --> 00:16:14,790 Week 2 was the other OS. 218 00:16:14,790 --> 00:16:16,690 I started talking about Linux here. 219 00:16:16,990 --> 00:16:25,730 And I paired that with just a podcast where you could get an idea of what some professional penetration testers would do. 220 00:16:26,290 --> 00:16:28,610 LAME was the box that we chose. 221 00:16:28,910 --> 00:16:36,250 And at this point, I started trying to profile and categorize everything so that the students weren't so lost all the time. 222 00:16:36,250 --> 00:16:38,290 So it was a Linux OS. 223 00:16:38,290 --> 00:16:41,050 I thought you probably have to use Nmap and Metasploit. 224 00:16:41,350 --> 00:16:44,810 And if they completed it, I was like, here's another box you can try. 225 00:16:44,810 --> 00:16:46,550 But like nobody did it. 226 00:16:46,550 --> 00:16:52,250 So as I built the syllabus, I was definitely overzealous in trying to make things. 227 00:16:52,910 --> 00:17:00,390 I could have focused on, you know, providing more learning links and less on, hey, if you actually complete this, why don't you try this super hard box. 228 00:17:01,690 --> 00:17:04,630 Just visiting, physical penetration test. 229 00:17:05,210 --> 00:17:07,910 LAME, again, pretty easy box. 230 00:17:08,450 --> 00:17:11,410 Most of the ones that I chose are pretty CVE heavy. 231 00:17:11,730 --> 00:17:14,370 And everybody completed this. 232 00:17:14,370 --> 00:17:16,750 We still were kind of harping on off limits a little bit. 233 00:17:16,750 --> 00:17:18,090 Some people were doing very well. 234 00:17:18,090 --> 00:17:20,290 Some people still needed some course corrections. 235 00:17:20,850 --> 00:17:24,490 It was super interesting to see this like template that I made. 236 00:17:24,490 --> 00:17:32,790 And I tried to show everybody like some students would go one way with it and some would go completely another way with how they structured their off notes. 237 00:17:32,790 --> 00:17:36,570 They were still giving me the information I wanted, but it made sense to them from their perspective. 238 00:17:36,570 --> 00:17:45,670 And it was really interesting to see how they how they chose to start capturing all this information, how their brains started making sense of everything. 239 00:17:45,670 --> 00:17:51,650 They were trying to make sense of it themselves, but they were also trying to make sure that I was happy with them. 240 00:17:53,730 --> 00:17:59,210 Week three, I decided, hey, let's do password cracking because you're going to get on a box. 241 00:17:59,210 --> 00:18:02,850 You're going to like they're not all going to be net APIs or immediately get system. 242 00:18:02,850 --> 00:18:06,690 So you're probably going to have to like crack some creds every now and then. 243 00:18:07,250 --> 00:18:12,130 And this this week is where things started to get interesting. 244 00:18:12,130 --> 00:18:15,190 So those are learning links at the bottom. 245 00:18:15,190 --> 00:18:19,550 Those were not there when I originally made the syllabus. 246 00:18:19,950 --> 00:18:27,410 As the week went on and people I started talking to everybody throughout the week because, you know, the other day we were me on Fridays. 247 00:18:27,410 --> 00:18:30,130 But we would also like talk throughout the week as well. 248 00:18:31,610 --> 00:18:36,210 People were running into some issues and I had to go through and research. 249 00:18:36,210 --> 00:18:43,390 And my co and my red team buddy, Steve, he went through there and he like we put all these learning links in there. 250 00:18:43,870 --> 00:18:47,630 And like, as you see at the bottom, there's a Kerberos primer, right? 251 00:18:47,630 --> 00:18:49,210 That's my fault. 252 00:18:49,210 --> 00:18:51,730 But it's my fault that I chose this box. 253 00:18:51,730 --> 00:18:57,970 I was looking for password cracking, but I had taken these people that were in helpdesk and I had thrown them into a Kerberos situation. 254 00:18:58,090 --> 00:19:02,350 Now, luckily for me, they all kind of did what they needed to do. 255 00:19:02,410 --> 00:19:12,910 And they talked to each other, which is great because part of the cohort was forming an internal mesh network of trusted ethical hackers. 256 00:19:12,930 --> 00:19:17,610 Not just for me, but for them, too, because it was for me, for the assets, for them. 257 00:19:17,610 --> 00:19:22,190 You may not always want to go to the instructor and say, hey, how do I do this for the fifth time? 258 00:19:22,190 --> 00:19:25,890 Maybe you want to go to your buddy because you're going to be judged a little bit less for that. 259 00:19:25,890 --> 00:19:30,430 So if I could build that trust into the cohort, that's amazing. 260 00:19:30,430 --> 00:19:34,130 And that's exactly what happened this week is they all talk to each other. 261 00:19:34,130 --> 00:19:41,010 And throughout the week, this portion of the syllabus changed and you had those learning links get added in. 262 00:19:41,010 --> 00:19:44,310 You had Kerberos primers popped in. 263 00:19:44,310 --> 00:19:53,790 I think by Wednesday, a couple people had downloaded the walkthrough and at least said, I'm going to get some learning out of this, even if I don't understand it. 264 00:19:53,790 --> 00:19:55,590 But at the end of the week, everybody did. 265 00:19:56,050 --> 00:19:59,510 In fact, paw in the box. 266 00:19:59,710 --> 00:20:00,630 So there's Roku. 267 00:20:00,830 --> 00:20:03,810 I got some... this is the podcast I chose for this week. 268 00:20:04,830 --> 00:20:07,830 And there was actually... I got a lot of really good feedback on that one. 269 00:20:07,830 --> 00:20:16,630 So thank you, Dark Knight Diaries, for having a podcast on Roku because they said it helped a lot with how they were going to attack the box. 270 00:20:19,570 --> 00:20:21,310 Again, Active is the one we chose. 271 00:20:21,310 --> 00:20:24,170 There was a CVE, but then there's some other things you had to do. 272 00:20:24,170 --> 00:20:25,730 I'm not going to spoil it for everybody. 273 00:20:27,670 --> 00:20:30,530 Week four, we're just getting worse and worse. 274 00:20:30,530 --> 00:20:33,170 I chose all these boxes and I was like, this is going to be great. 275 00:20:33,170 --> 00:20:35,470 They're going to figure out things pretty quickly. 276 00:20:35,470 --> 00:20:36,210 That didn't happen. 277 00:20:36,210 --> 00:20:38,530 More learning links had to get added in. 278 00:20:38,530 --> 00:20:45,450 And this was just a constant iterative process between myself and the students and my buddy Steve. 279 00:20:46,150 --> 00:20:47,290 How are you doing? 280 00:20:47,290 --> 00:20:48,330 How's everything going? 281 00:20:48,330 --> 00:20:50,730 Okay, so there's going to be some issues here. 282 00:20:50,770 --> 00:20:53,190 Let's go ahead and drop a learning link in. 283 00:20:54,150 --> 00:20:56,810 Maybe it'll kind of help speed things along. 284 00:20:57,990 --> 00:21:00,690 Had to do some living off the land stuff. 285 00:21:00,690 --> 00:21:10,330 Again, this week was a little bit interesting, mainly because there was some crazy stuff that happened with this box. 286 00:21:13,890 --> 00:21:22,950 And the constant feedback and connection that we had with the cohort was critical from this point forward. 287 00:21:23,050 --> 00:21:27,270 This point forward, people were starting to get a little upset. 288 00:21:27,270 --> 00:21:29,570 Not upset, but just like frustrated, right? 289 00:21:29,570 --> 00:21:32,110 You're not supposed to be frustrated when you're trying to learn stuff. 290 00:21:32,110 --> 00:21:34,610 And they were being frustrated for the wrong reasons. 291 00:21:34,610 --> 00:21:37,770 They weren't being frustrated because they were being, oh, this is challenging. 292 00:21:37,770 --> 00:21:43,550 They were being frustrated for something that they had no control over, this gap in knowledge that I didn't prepare them for. 293 00:21:43,550 --> 00:21:49,890 So by having that constant feedback and talking to them throughout the week, we were able to kind of overcome some things. 294 00:21:49,890 --> 00:21:51,070 It was a little rough at first. 295 00:21:51,070 --> 00:21:55,970 I mean, this is a pilot program, but the next one will be more streamlined. 296 00:21:55,970 --> 00:22:04,270 And because this was a Windows PrivEsc lesson, I picked Shamoon, a pretty famous attack. 297 00:22:06,090 --> 00:22:08,030 There's a buddy, Optimum. 298 00:22:09,010 --> 00:22:18,750 Some CVEs end with this, but what happened after Optimum was complete for that week, and we started talking about week five. 299 00:22:18,750 --> 00:22:24,770 You know, like we would show up week four, we'd show up, you know, Fridays for a four hour block. 300 00:22:24,770 --> 00:22:30,730 I'd start reviewing off notes and then I'd start trying to talk about what was going to happen for the next week. 301 00:22:31,310 --> 00:22:33,710 What happened was this. 302 00:22:34,930 --> 00:22:38,670 I got a Slack message from one of the students. 303 00:22:39,670 --> 00:22:47,030 And after our lessons had ended, all the students met together and they started talking about feedback and how things could be improved. 304 00:22:47,030 --> 00:22:49,670 Now, I could have taken this one of two ways. 305 00:22:49,730 --> 00:22:55,770 I'm not trying to, like, you know, have an ego about it or anything, but I could have been really offended by it. 306 00:22:55,770 --> 00:23:05,670 But because I was starting to see that the students really, really cared about the program, even though that they were frustrated, they really cared about it. 307 00:23:07,510 --> 00:23:10,830 And basically, this feedback was saying, like, we need help. 308 00:23:10,830 --> 00:23:11,750 We need help. 309 00:23:11,750 --> 00:23:14,290 We need we need some better walkthroughs. 310 00:23:14,290 --> 00:23:15,930 We need more direction. 311 00:23:15,930 --> 00:23:18,170 We need you to do a better job. 312 00:23:18,310 --> 00:23:21,650 And they weren't saying it in a way that was, you suck. 313 00:23:21,650 --> 00:23:24,330 It was, we want to make the program better. 314 00:23:24,330 --> 00:23:24,970 And I heard them. 315 00:23:25,570 --> 00:23:28,750 And as a result of that, I decided to implement something else. 316 00:23:28,750 --> 00:23:29,830 I was doing it live. 317 00:23:29,830 --> 00:23:33,110 I was going to do what I call a Sherpa op, right? 318 00:23:33,190 --> 00:23:40,590 Now, a Sherpa op, like I got the term from Destiny, because you have somebody that's really skilled and doing a raid or something. 319 00:23:40,590 --> 00:23:47,010 And they would take, I don't know, five other people through and they would just kind of guide them, right? 320 00:23:47,010 --> 00:23:48,890 People that didn't know what they were doing. 321 00:23:48,990 --> 00:23:50,310 They were just going to guide them through. 322 00:23:50,310 --> 00:23:53,690 So I was like, how can I do that for red teaming? 323 00:23:53,690 --> 00:23:55,790 So I came up with this term called Sherpa ops. 324 00:23:55,790 --> 00:23:56,710 And that's what we did. 325 00:23:56,710 --> 00:23:59,970 So at the start of week five, I was like, guess what, guys? 326 00:24:00,270 --> 00:24:02,770 All of us get on target because this is what we're doing. 327 00:24:02,810 --> 00:24:04,430 I have not done this box. 328 00:24:04,450 --> 00:24:06,350 I will not do this box. 329 00:24:06,990 --> 00:24:09,590 We are going to work together, all five of us. 330 00:24:09,590 --> 00:24:13,130 Myself included as the Sherpa. 331 00:24:13,370 --> 00:24:16,650 And we are going to go through this host together. 332 00:24:16,650 --> 00:24:19,530 And I'm going to try to guide you through without ever touching the keyboard. 333 00:24:19,910 --> 00:24:21,570 And I had done no research on this. 334 00:24:21,570 --> 00:24:28,030 I just thought it was super easy and had a complete total amount of user and root own. 335 00:24:28,030 --> 00:24:29,950 So I figured it was probably good to go. 336 00:24:30,010 --> 00:24:31,450 I didn't know what we were going to do with it. 337 00:24:31,450 --> 00:24:32,870 I didn't know how successful it was. 338 00:24:32,870 --> 00:24:35,490 All I knew was that it was a super easy Windows box. 339 00:24:35,490 --> 00:24:44,150 And at the end of one hour after we had started, everybody in the group had owned that box. 340 00:24:44,510 --> 00:24:52,370 And it was pretty awesome because I was asking them questions and sparking them ideas that they'd scan something. 341 00:24:52,370 --> 00:24:55,030 I'd say like, OK, tell me about this. 342 00:24:55,030 --> 00:24:55,690 Tell me about this. 343 00:24:55,690 --> 00:24:56,290 Tell me about this. 344 00:24:56,290 --> 00:24:57,210 They would scan. 345 00:24:57,290 --> 00:24:59,030 They would come up with their own ideas. 346 00:24:59,030 --> 00:24:59,930 They would give me feedback. 347 00:24:59,930 --> 00:25:01,610 And I'd say, OK, that's great. 348 00:25:02,070 --> 00:25:04,070 I need the information about this. 349 00:25:04,070 --> 00:25:04,990 How would you go find it? 350 00:25:04,990 --> 00:25:07,750 And just constant back and forth. 351 00:25:07,750 --> 00:25:10,130 It was almost like doing an escape room. 352 00:25:10,130 --> 00:25:13,310 Everybody gets their one hero moment in an escape room. 353 00:25:13,310 --> 00:25:14,670 That was pretty much the case for this. 354 00:25:14,670 --> 00:25:17,850 Everybody got their hero moment where they found one piece of the puzzle. 355 00:25:18,030 --> 00:25:21,110 And it was really awesome to help guide them through. 356 00:25:23,150 --> 00:25:28,370 It was a good experience because of what came after. 357 00:25:28,370 --> 00:25:35,830 It was good to do the Sherpa op, but afterwards when I was doing a feedback session on it, I was like, Hey, what do you guys think? 358 00:25:35,850 --> 00:25:37,670 What do you think of the program even? 359 00:25:37,670 --> 00:25:39,550 Because this is week five right now. 360 00:25:40,410 --> 00:25:45,170 And the feedback that I got is what made me decide to write a white paper about this program. 361 00:25:47,310 --> 00:25:58,050 They reported that their co-workers and colleagues were asking when they could apply for the program because they saw what the gorillas were doing. 362 00:26:00,490 --> 00:26:04,710 The students tried to find other similar programs at other places. 363 00:26:04,710 --> 00:26:05,810 They found nothing. 364 00:26:06,750 --> 00:26:11,530 I know that Ofsec has their academy now, but I was there first. 365 00:26:12,770 --> 00:26:18,650 But this was a straight up grassroots campaign to bring people into the field. 366 00:26:18,650 --> 00:26:24,910 And it started out as a way for the red team to get trusted assets throughout the organization to help fuel ops. 367 00:26:24,910 --> 00:26:27,770 But from this point forward, it turned into something else. 368 00:26:27,770 --> 00:26:32,430 It turned into this was more important to the students than it was for me. 369 00:26:32,910 --> 00:26:51,070 And this was giving them an opportunity to learn some skills, to talk with the red team dude, to ask questions in a non-judgmental environment, to marinate on some of the lessons that were being learned, to struggle and grow together as a group instead of just like one-on-one mentorship. 370 00:26:52,150 --> 00:26:54,230 And I was like, I got to write this up. 371 00:26:54,390 --> 00:26:55,390 And I did. 372 00:26:55,390 --> 00:26:57,470 So the white paper is being released today. 373 00:26:57,470 --> 00:26:58,790 So thank you, Sarvery. 374 00:27:00,230 --> 00:27:04,150 But after that, I was like, you know what, let's do week five. 375 00:27:04,150 --> 00:27:04,790 Let's go. 376 00:27:04,790 --> 00:27:07,730 And originally, the box that I picked was Calamity. 377 00:27:07,930 --> 00:27:10,010 And I did that. 378 00:27:10,010 --> 00:27:14,210 I picked Calamity like the very beginning, not knowing what that was. 379 00:27:14,410 --> 00:27:23,170 And a couple of days into that, I was like, y'all need to stop doing that immediately and go do this other box instead, which was Traceback. 380 00:27:23,170 --> 00:27:29,390 And I mean, some of the Linux learning links that we placed on there still apply. 381 00:27:30,710 --> 00:27:33,610 But I kind of led them into the slaughter on that one. 382 00:27:34,570 --> 00:27:44,650 And at this point, we kind of ran out of Darknet Diaries episodes that perfectly lined up with what we needed at the time. 383 00:27:44,650 --> 00:27:47,510 So I was like, hey, just listen to these mini-stories, I guess. 384 00:27:51,530 --> 00:27:53,810 But Traceback was a lot of fun. 385 00:27:53,810 --> 00:27:55,990 Everybody in the cohort pwned it. 386 00:27:56,370 --> 00:28:03,830 This was actually supposed to be the first box of the LiveOps, right? 387 00:28:04,110 --> 00:28:23,050 LiveOps was a shift in mentality, whereas the first five weeks were work together, succeed together, learn how to do these things, keep doing your op notes, keep learning about Windows, Linux, keep learning about all the offensive tools that are out there, 388 00:28:23,490 --> 00:28:29,430 keep challenging yourself, come to me with questions, come to your cohort with questions, just don't stop. 389 00:28:29,430 --> 00:28:33,530 If you hit a roadblock, don't just sit there at the roadblock, figure it out. 390 00:28:33,750 --> 00:28:42,730 And if all else fails, part of figuring out that roadblock is downloading the walkthrough from HackedBox, which is why we bought the VIP subscriptions in the first place. 391 00:28:43,530 --> 00:28:53,070 Week six through nine, well now week five because of Calamity, that was all about, like I bolded right there, work together, succeed individually. 392 00:28:53,070 --> 00:28:54,450 This is the struggle phase. 393 00:28:54,450 --> 00:28:56,090 This is the break me off phase. 394 00:28:56,090 --> 00:29:06,770 This was going to be the phase where people got to see what it was like, just a little taste of being dropped into a live network, and you can't just download the walkthrough. 395 00:29:08,610 --> 00:29:14,390 They're going to have to struggle, they're going to have to figure things out on their own, and it's going to suck. 396 00:29:14,490 --> 00:29:17,110 Some of the students did very, very well. 397 00:29:17,330 --> 00:29:19,430 And I'll give you a slight spoiler alert. 398 00:29:19,510 --> 00:29:27,590 I didn't intend to steal people from organizations, but one of these students is now on the red team because of the aptitude that they showed. 399 00:29:28,350 --> 00:29:30,350 And some of them, you know, it's to be expected. 400 00:29:30,350 --> 00:29:34,410 They hadn't seen these things before, and they struggled because there were knowledge gaps. 401 00:29:34,410 --> 00:29:44,970 Like, if you ask me to go do quantum theory, I'm not going to know, I can YouTube some stuff, but I'm not going to be able to talk to you because there's this huge gulf of knowledge that I can't overcome. 402 00:29:44,970 --> 00:29:51,090 It's the same thing for some of these students, and you have to recognize when those gulfs hit. 403 00:29:51,530 --> 00:29:53,430 Okay, time to take a step back. 404 00:29:53,430 --> 00:29:56,270 And that happened during the last weeks of the live ops. 405 00:29:56,270 --> 00:29:59,450 I had to redirect one of the students to do something else. 406 00:30:01,090 --> 00:30:10,010 So the way that we had set it up was you have to do two easy machines, you have to do one of the easy machines before you can move on to the hard ones, or to the medium ones. 407 00:30:10,010 --> 00:30:15,930 For this, it was Traceback and Remote, and because we were doing Traceback instead of Calamity, they already kind of got like a head start. 408 00:30:17,950 --> 00:30:19,470 Remote was pretty fun. 409 00:30:19,610 --> 00:30:22,030 All the students pwned that one. 410 00:30:22,130 --> 00:30:27,430 There was a CD attached to it, and then the actual ProDesk portion was pretty interesting. 411 00:30:27,590 --> 00:30:30,390 A lot of research went in to the students. 412 00:30:30,910 --> 00:30:33,150 And some of these things aged off. 413 00:30:33,550 --> 00:30:43,790 And the reason I chose all the live boxes, like I said, was so that they could get a taste of what it feels like to be in a network and not have any hope. 414 00:30:47,290 --> 00:30:49,350 And to get some points to go along with it. 415 00:30:49,350 --> 00:30:54,070 Because if you can get some real points, you can go back and say, like, hey, I'm not a script kid anymore, or like, hey, I'm not a noob. 416 00:30:55,650 --> 00:30:59,730 But anyway, so I was trying to gamify it as much as I could and get some points. 417 00:30:59,990 --> 00:31:04,930 So for the medium boxes, we chose Sauna and Servmon. 418 00:31:06,510 --> 00:31:13,770 Servmon was pretty fun, but it was kind of unstable, and I felt like I had to warn people about that because you don't know what you don't know at that point. 419 00:31:13,770 --> 00:31:14,970 Some of these people are pretty new. 420 00:31:14,970 --> 00:31:19,070 They may think that they're doing the right thing, and the boxes... it wasn't working. 421 00:31:19,330 --> 00:31:33,690 So I kind of wanted... I did a little pathfinder thing and went through and just blasted through, like, every easy medium box that I could so that I could kind of guide them and say, like, hey, by the way, on this one Servmon, it's going to be a little bit kind of a pain in the butt. 422 00:31:35,730 --> 00:31:42,690 The person that got chosen to come up to the red team completed both of these boxes. 423 00:31:43,650 --> 00:31:48,990 Almost everybody completed at least one of these, and one student did not complete either. 424 00:31:49,070 --> 00:31:56,990 So that student was pushed to a similar type box, but that had a walkthrough instead. 425 00:31:56,990 --> 00:31:59,590 And that didn't really happen until about week 8 or 9. 426 00:32:01,670 --> 00:32:11,230 So from this point on, like, the cadence for during the live op sections went from, hey, these are learning links to let's talk about what challenges you're running into. 427 00:32:11,230 --> 00:32:15,330 Let me see your op notes, even if they're not finished, like, upload them, let me look at them. 428 00:32:15,450 --> 00:32:17,030 Let's take a look at these things. 429 00:32:17,810 --> 00:32:23,370 So it turned into more of like a red team discussion and not so much as a lecture during the second half. 430 00:32:23,390 --> 00:32:28,890 Nobody made it to any of these, so I don't even know if we'll have the challenge boxes in during the next iteration. 431 00:32:30,150 --> 00:32:37,970 But at the end of 9 weeks, this is one of the op notes from one of the boxes, I forget which one it was. 432 00:32:38,150 --> 00:32:45,490 We went from somebody that had never done red teaming before, never done anything closely related to it. 433 00:32:46,450 --> 00:32:49,490 And at the end of 9 weeks, they were producing op notes like this. 434 00:32:49,510 --> 00:32:52,710 And this is not the person that was chosen to be on the red team. 435 00:32:52,710 --> 00:32:54,690 This is from one of the other operators. 436 00:32:56,790 --> 00:33:02,210 Just from this small snippet, you're able to tell, hey, I understand what the narrative is. 437 00:33:02,370 --> 00:33:03,630 I understand what they tried. 438 00:33:03,630 --> 00:33:05,130 I understand what they were thinking. 439 00:33:05,370 --> 00:33:08,110 Most of the op notes look like this by the end of 9 weeks. 440 00:33:08,270 --> 00:33:12,790 And this was a huge pain point that I kept harping on, and that was constant every week. 441 00:33:12,790 --> 00:33:14,510 Let me see your op notes, op notes, op notes. 442 00:33:14,750 --> 00:33:18,490 But these students can take this methodology with them. 443 00:33:18,490 --> 00:33:21,850 I mean, I even made an op note template generator for them. 444 00:33:21,850 --> 00:33:25,990 But the methodology here is now they are in their brain. 445 00:33:25,990 --> 00:33:31,030 If they do op, so they do hack the box, they're going to have their op notes up. 446 00:33:31,030 --> 00:33:36,110 If they try to do OSCP, they're going to be taking op notes now. 447 00:33:36,190 --> 00:33:39,550 They will understand where they've been, what they're trying to do. 448 00:33:39,690 --> 00:33:44,170 And maybe if they're stuck on something, they go back, they read their own narrative. 449 00:33:44,170 --> 00:33:45,970 They say, oh, yeah, I should try that. 450 00:33:45,970 --> 00:33:52,850 And to me, that was the most critical part of this for teaching these junior operators, these guerrilla operators how to fish. 451 00:33:54,010 --> 00:33:56,590 So at the end of the nine weeks, the cohort was over. 452 00:33:56,670 --> 00:34:07,730 I sent out the same exact questions that I had at the start of the cohort just to see where they thought they were. 453 00:34:07,730 --> 00:34:10,670 So on the left is the preflight survey that I had. 454 00:34:10,670 --> 00:34:12,730 And then on the left is the exit survey. 455 00:34:12,730 --> 00:34:17,850 So it looks like a pretty good increase with Windows networking. 456 00:34:19,590 --> 00:34:23,630 Great increase, actually, with the Windows networking. 457 00:34:23,630 --> 00:34:26,570 A lot of people really understood SMB a lot more. 458 00:34:29,610 --> 00:34:32,690 Similar situations with the Linux stuff. 459 00:34:32,690 --> 00:34:36,270 Pretty big increases with the Linux operating system. 460 00:34:36,270 --> 00:34:40,110 Comfort with Linux networking was pretty good. 461 00:34:40,730 --> 00:34:46,870 And then just what they thought, what they wanted to get out of the experience on the left. 462 00:34:46,870 --> 00:34:51,050 And then what they kind of felt like they did get out of the experience on the right. 463 00:34:52,970 --> 00:34:55,850 A lot of... I mean, it was pretty Windows heavy. 464 00:34:55,850 --> 00:34:59,950 So that's probably why the majority of the Windows stuff went up. 465 00:35:01,330 --> 00:35:18,030 But on the right, you're going to see a lot of people talk about how the methodologies, the recon, like the second comment there, putting theoretical knowledge in the test and then applying it, how to research, things like that. 466 00:35:18,030 --> 00:35:21,310 These are all the core things that I was trying to do. 467 00:35:21,390 --> 00:35:32,070 And at the start of my preflight survey, at the beginning of the thing, or I'm sorry, on my application process, I said, what this is, it's a chance to hang out with a red teamer and talk shop. 468 00:35:32,070 --> 00:35:33,910 What this isn't is an internship. 469 00:35:33,910 --> 00:35:38,990 So this feedback is actually exactly what I was looking for. 470 00:35:38,990 --> 00:35:41,570 And it could be streamlined a little bit better, 100%. 471 00:35:41,570 --> 00:35:45,610 I'm sure there's other people that if you take this program and you do it, you're going to do it better than I will. 472 00:35:45,610 --> 00:35:46,550 And that's awesome. 473 00:35:46,550 --> 00:35:47,810 Please publish that. 474 00:35:47,850 --> 00:35:50,570 But really, it's all about just like upskilling people. 475 00:35:51,390 --> 00:35:58,770 And if you have those upskilled assets throughout the organization, you have your security IQ is also raised as well. 476 00:35:58,890 --> 00:36:02,850 So it doesn't just benefit you, it benefits the whole business. 477 00:36:02,850 --> 00:36:06,750 And I just wanted to put this in here because I'm about to show all these noobs. 478 00:36:07,030 --> 00:36:11,610 I want to show that all six of them have said that, yes, I can use their picture. 479 00:36:12,090 --> 00:36:14,870 So this is the absolute cohort right here. 480 00:36:14,870 --> 00:36:17,950 And the biggest noob is up there in the top right. 481 00:36:19,170 --> 00:36:22,550 I was with this group for nine weeks. 482 00:36:22,550 --> 00:36:24,350 We still talk discord all the time. 483 00:36:24,350 --> 00:36:29,610 We still talk shop, even though the cohort has been over for about a month and a half now. 484 00:36:29,610 --> 00:36:31,990 It was great. 485 00:36:31,990 --> 00:36:33,810 It was an awesome opportunity. 486 00:36:33,950 --> 00:36:40,870 And I feel like some of these people are going to go forward and probably become InfoSec professionals. 487 00:36:40,930 --> 00:36:45,950 Some of these people may choose to go a different route, but they're always going to have that security mindset. 488 00:36:46,270 --> 00:36:46,450 Right. 489 00:36:46,450 --> 00:36:50,490 They got to see what an attacker looks like because they were one at some point. 490 00:36:51,970 --> 00:36:56,410 But wait, there's more, because I said that there were two phases to this. 491 00:36:56,410 --> 00:36:59,790 So phase two is the guerrilla red team aspect. 492 00:36:59,830 --> 00:37:06,190 Phase two came to me when I was actually writing up the paper for phase one. 493 00:37:06,370 --> 00:37:06,810 Right . 494 00:37:07,110 --> 00:37:08,730 I was writing up this paper. 495 00:37:08,730 --> 00:37:12,150 Like I said, the original intent was we're going to upskill people. 496 00:37:12,190 --> 00:37:14,850 Security IQ assets are going to be great. 497 00:37:14,850 --> 00:37:16,050 It's going to be awesome. 498 00:37:16,050 --> 00:37:17,170 But I was writing up the paper. 499 00:37:17,170 --> 00:37:24,730 I was like, we have these low tier trained, trusted adversaries in our network now. 500 00:37:25,830 --> 00:37:34,270 And at the same time, we also have these tools that we spend a lot of money on that say, oh, yeah, like we're going to go after the advanced adversary. 501 00:37:34,270 --> 00:37:42,070 It's going to protect you from the advanced adversary because all these low tier script KDAs are just going to get blasted straight out of the window by all these other tools. 502 00:37:42,070 --> 00:37:43,230 And you're protected. 503 00:37:43,250 --> 00:37:47,570 So I was thinking, you know, like, let's test that. 504 00:37:49,250 --> 00:37:51,950 Because I just spent nine weeks training these people. 505 00:37:52,290 --> 00:37:56,210 And at their core, like they're low tier actors, right? 506 00:37:56,210 --> 00:37:58,070 There's the script KDAs there. 507 00:37:58,070 --> 00:38:00,590 And more than that, they're trusted script KDAs. 508 00:38:00,950 --> 00:38:05,870 And I know that if I give them something to do, they're going to execute on it. 509 00:38:06,010 --> 00:38:07,190 They're going to take notes on it. 510 00:38:07,190 --> 00:38:08,750 I'll be able to deconflict with them. 511 00:38:09,470 --> 00:38:11,470 I was like, man, let's try it like this. 512 00:38:11,470 --> 00:38:13,170 The idea made so much sense to me. 513 00:38:13,270 --> 00:38:14,810 I was like, we just train these people. 514 00:38:14,810 --> 00:38:15,750 Let's let's use them. 515 00:38:15,750 --> 00:38:17,850 That's where the two phases came in. 516 00:38:17,850 --> 00:38:20,710 We upskill the assets, and now we're going to unleash hell on them. 517 00:38:20,710 --> 00:38:23,650 So I had to come up with this way to sell it because I had to sell it to everybody. 518 00:38:23,650 --> 00:38:28,130 I had to figure out how are we going to decentralize these adversaries? 519 00:38:28,430 --> 00:38:30,890 How are we going to arm these guerrillas? 520 00:38:32,030 --> 00:38:40,710 If the red team is the Green Berets, and these people that we just spent nine weeks training are the local indigenous population that now know how to shoot a gun. 521 00:38:41,270 --> 00:38:42,650 How do I get them a gun? 522 00:38:42,810 --> 00:38:44,650 How do I get them a target to attack? 523 00:38:44,650 --> 00:38:46,270 That was my problem to figure out. 524 00:38:46,270 --> 00:38:48,590 And I was like, I got to figure this out right now. 525 00:38:49,130 --> 00:38:51,310 And I got to incorporate this into my paper. 526 00:38:52,970 --> 00:38:55,030 So here's the guerrilla red team right here. 527 00:38:55,030 --> 00:38:56,870 This is what it is at its core. 528 00:38:57,770 --> 00:39:04,890 And just like I talked about, you have all these EDR platforms that say, oh, we'll protect you from all this stuff. 529 00:39:04,890 --> 00:39:06,350 Advanced sandboxing. 530 00:39:07,030 --> 00:39:08,370 EDR is essential. 531 00:39:08,370 --> 00:39:12,370 You have this EDR maturity model. 532 00:39:13,610 --> 00:39:15,870 We have AI built in and stuff. 533 00:39:15,870 --> 00:39:20,250 OK, let's see if you can kick off some low tier actors. 534 00:39:21,870 --> 00:39:25,590 So this is the flowchart that I came up with this, and I'm going to walk through it real quick. 535 00:39:25,590 --> 00:39:28,510 This is the guerrilla red team phase two flowchart. 536 00:39:30,230 --> 00:39:37,190 And before I really get into it, I just want to just kind of walk through just a brief how a guerrilla red team works. 537 00:39:37,190 --> 00:39:40,270 You train up, you upskill the guerrillas, right? 538 00:39:40,270 --> 00:39:41,410 That's the red team dev program. 539 00:39:41,410 --> 00:39:42,350 That's phase one. 540 00:39:42,470 --> 00:39:46,630 Phase two is the red team retains control of these assets. 541 00:39:46,930 --> 00:39:49,390 But to arm them, what does that mean exactly? 542 00:39:49,390 --> 00:39:53,970 Arming means you have to provide them with a way to attack, right? 543 00:39:54,210 --> 00:39:58,010 So that means you have to provide them with a platform to attack from. 544 00:39:58,010 --> 00:40:01,470 And you have to provide them with the ammunition to attack with. 545 00:40:01,470 --> 00:40:07,550 To translate that into cyber is basically you have to provide them an ops box to shoot from. 546 00:40:07,650 --> 00:40:11,670 And you have to give them credentials to shoot with. 547 00:40:11,670 --> 00:40:22,590 Because they may not be able to pop a box, but they can probably exploit a box with credentials. 548 00:40:22,610 --> 00:40:27,510 So now at this point, what do those credentials look like? 549 00:40:27,510 --> 00:40:30,890 Okay, those are probably basically canary credentials. 550 00:40:31,950 --> 00:40:34,970 I'm going to have to form some partnership with Helpdesk now. 551 00:40:35,230 --> 00:40:45,170 Some high-level partnership with the stakeholders so that we can get these certain credentials that are inactive to be used during the op. 552 00:40:45,970 --> 00:40:47,870 By the way, what does that look like? 553 00:40:47,870 --> 00:40:50,630 Let's keep the same cadence, four hours. 554 00:40:50,630 --> 00:40:53,730 Do four hours once a month per guerrilla operator. 555 00:40:53,730 --> 00:40:59,850 Okay , so for four hours once a month, instead of doing hack the box, they're going to do hacker network. 556 00:41:00,450 --> 00:41:03,450 And the red team is going to have to figure out a way to maintain control of that. 557 00:41:03,450 --> 00:41:05,430 So let's walk through how this is. 558 00:41:05,550 --> 00:41:07,790 So I call it an arms delivery, right? 559 00:41:07,790 --> 00:41:10,010 Does the guerrilla operator have an arms delivery? 560 00:41:10,010 --> 00:41:12,490 If the answer is no, they go to the space. 561 00:41:12,810 --> 00:41:20,170 So they're going to submit something that they want, an op plan, which is like this is a singular target that we want to attack. 562 00:41:20,170 --> 00:41:29,750 The red team is going to conduct safety checks on it to see, you know, make sure you're not like trying to pop the CEO's box or something, or you're going to take down some super critical production asset. 563 00:41:29,890 --> 00:41:35,350 They are not there to say yes or no to what the target is. 564 00:41:35,350 --> 00:41:39,070 The red team is there to say yes or no, this is safe. 565 00:41:39,930 --> 00:41:45,990 The red team is not allowed to say yes or no to what the target is because we're decentralizing the adversary. 566 00:41:45,990 --> 00:41:53,470 The red team might not see this particular target as worthwhile, but this guerrilla might. 567 00:41:53,810 --> 00:41:57,990 So if you're going to put all your EDR platforms on something that doesn't seem... 568 00:41:58,950 --> 00:42:08,850 If you're going to put your EDR platforms on something, on all your crown jewels, but you leave this other thing over here just open, maybe the guerrilla goes after that instead because they just want to, right? 569 00:42:08,850 --> 00:42:12,790 So that's part of the decentralization or decentralized process. 570 00:42:12,790 --> 00:42:16,750 Anyway, if it gets approved, we go into the arming phase, right? 571 00:42:16,750 --> 00:42:21,470 The red team will request accounts from the help desk or whoever it is. 572 00:42:21,550 --> 00:42:23,890 If they get approved, they will be held in trust. 573 00:42:23,890 --> 00:42:29,210 Like for our example, we're going to hold them in LastPass, right? 574 00:42:29,210 --> 00:42:30,470 But they'll be inactive. 575 00:42:30,470 --> 00:42:36,650 So you have like 10 accounts with varying sets of permissions, inactive, ready to go, right? 576 00:42:36,650 --> 00:42:38,150 And that requires a relationship. 577 00:42:38,150 --> 00:42:44,330 So if you're on a red team and you want to do this, you better start learning how to talk to people because you should be doing that anyway. 578 00:42:44,370 --> 00:42:48,190 But you're going to have to build a relationship and sell this thing. 579 00:42:48,790 --> 00:42:52,850 Anyway, so your credentials, you're going to build your target package. 580 00:42:53,070 --> 00:42:54,350 So what does that look like? 581 00:42:54,350 --> 00:42:55,470 That's credentials. 582 00:42:55,530 --> 00:42:57,710 You siphon off one of the credentials. 583 00:42:57,850 --> 00:43:03,150 You build them in EC2 instance that has a public IP or that is peered internally. 584 00:43:03,470 --> 00:43:06,150 You generate some SSH keys just for them. 585 00:43:06,150 --> 00:43:09,730 You push your creds and the keys to S3. 586 00:43:09,750 --> 00:43:11,210 It's locked down. 587 00:43:11,270 --> 00:43:14,010 The attack host is like sitting there waiting to go. 588 00:43:14,030 --> 00:43:19,390 All that is required now is for them to schedule their op for their four hours. 589 00:43:19,510 --> 00:43:22,330 So at this point, they've submitted something they want to attack. 590 00:43:22,330 --> 00:43:28,690 And that can come from like the red team can provide that list and say pick one of these 10 things because they're the most vulnerable. 591 00:43:28,690 --> 00:43:36,410 Like if you have a vulnerability management platform and you can pull that list, you can get an idea of whether or not it's going to be super hard or not. 592 00:43:36,410 --> 00:43:38,550 And you can just kind of farm this out through the gorillas. 593 00:43:40,470 --> 00:43:44,250 But you provide like, OK, here's what you're going to attack. 594 00:43:44,250 --> 00:43:46,390 Here's the cred you're going to use to attack it with. 595 00:43:47,850 --> 00:43:52,490 And here's your security mechanisms to get on this host. 596 00:43:52,690 --> 00:43:56,950 So now you need to schedule an arms delivery, which you have done. 597 00:43:56,950 --> 00:44:00,390 So now we go to the second phase of the flowchart. 598 00:44:00,390 --> 00:44:02,470 So, yes, the arms delivery is scheduled. 599 00:44:03,050 --> 00:44:09,210 Now, the day of the op, when it's scheduled, the gorilla is going to give you an IP address. 600 00:44:09,550 --> 00:44:14,030 And you as the red team are going to have to submit this IP address for whitelisting. 601 00:44:14,450 --> 00:44:18,690 You as the red team are going to have to notify helpdesk to make the account active. 602 00:44:18,870 --> 00:44:22,050 And there are automation steps in here all over the place. 603 00:44:22,050 --> 00:44:27,330 The more that you can automate this with Lambda or whatever, the better. 604 00:44:28,910 --> 00:44:34,650 But you know you're going to notify helpdesk, hey, I need you to make this account active in an hour or 30 minutes or something. 605 00:44:34,650 --> 00:44:36,110 They make it active. 606 00:44:36,290 --> 00:44:42,310 And then you go to EC2, whitelist that IP in the security groups. 607 00:44:42,310 --> 00:44:54,010 You go to S3, you can either figure out a way to whitelist the IP in S3 or generate a pre-signed URL and just give that to the gorilla so that they can pull down their target package. 608 00:44:54,210 --> 00:45:02,150 And maybe that pre-signed URL only lasts four hours, which is what we said we were going to do anyway. 609 00:45:02,170 --> 00:45:03,010 So you give it to them. 610 00:45:03,010 --> 00:45:04,670 You say, hey, man, it's 10 o'clock. 611 00:45:05,370 --> 00:45:08,110 I need you to pull down this and get ready to go. 612 00:45:08,110 --> 00:45:11,010 It's going to have your SSH keys to get into your ops box. 613 00:45:11,010 --> 00:45:12,210 Here's your target. 614 00:45:12,950 --> 00:45:13,990 Have fun. 615 00:45:14,710 --> 00:45:17,350 So they download the target package from S3. 616 00:45:17,350 --> 00:45:19,370 They connect to the host. 617 00:45:19,870 --> 00:45:22,090 They conduct their op for four hours. 618 00:45:22,090 --> 00:45:25,130 They're probably going to make a whole hell of a lot of noise. 619 00:45:25,130 --> 00:45:27,070 They're going to set off a lot of alarms. 620 00:45:27,070 --> 00:45:41,210 And then at the end of four hours, automation kicks in, security group blacklist or not blacklist, but their whitelist IP gets removed from the security group and they lose access to the box. 621 00:45:41,210 --> 00:45:43,770 And the op is over. 622 00:45:44,670 --> 00:46:00,050 Now, even if they weren't successful, even if the creds worked, but they couldn't get on anything at all, some random box in the network just got hit with some random account. 623 00:46:01,030 --> 00:46:05,210 And maybe the EDR caught the malware that they were trying to put on. 624 00:46:05,210 --> 00:46:06,430 Maybe it didn't. 625 00:46:06,430 --> 00:46:11,290 Maybe they just got on the box and it's like did a bunch of surveys or something. 626 00:46:12,110 --> 00:46:15,650 And by the way, like also the red team would put similar to hack the box. 627 00:46:15,650 --> 00:46:23,230 We would put user.txt and root.txt on the box as well to kind of simulate Sentinel data being stolen. 628 00:46:23,990 --> 00:46:25,870 It still gamifies it a little bit. 629 00:46:25,870 --> 00:46:29,110 So if they were able to get their user.txt and their root.txt. 630 00:46:29,770 --> 00:46:34,730 But even if none of that happened and they just set off a whole hell of a lot of alerts, think about that. 631 00:46:34,730 --> 00:46:43,030 Some random box that was just attacked by some random low tier person that's just making all kinds of noise. 632 00:46:43,150 --> 00:46:45,570 What's the blue team going to do with that, right? 633 00:46:45,630 --> 00:46:47,430 Are they going to treat it like real? 634 00:46:47,430 --> 00:46:51,330 Because that doesn't really fit the TTPs of the red team, which is typically stealthy. 635 00:46:51,330 --> 00:46:52,210 This is noisy. 636 00:46:52,210 --> 00:46:53,330 This is nasty. 637 00:46:54,170 --> 00:46:57,110 So it's a good training opportunity for everybody, really. 638 00:46:57,450 --> 00:46:58,670 The gorillas get it. 639 00:46:58,830 --> 00:47:02,530 You know, they get to sweat a little bit by like trying not to kick over a production box. 640 00:47:02,530 --> 00:47:05,930 The blue team gets to do some deconfliction. 641 00:47:06,230 --> 00:47:16,170 And if the EDR doesn't pick up anything, well, then you need to reevaluate your EDR because some low tier people just like kick down the front door. 642 00:47:16,690 --> 00:47:19,510 And like, that's a problem. 643 00:47:19,510 --> 00:47:26,470 And you should know that from a trusted source and not like getting ransomware in your entire network. 644 00:47:26,610 --> 00:47:31,670 But anyway, so after the op is over, the gorilla submits the notes to the red team. 645 00:47:31,670 --> 00:47:34,970 We debrief the gorilla and we store the op notes for deconfliction. 646 00:47:34,970 --> 00:47:38,090 I have a whole deconfliction process set up at my red team. 647 00:47:38,690 --> 00:47:40,770 And we just kind of wait for those things to come in. 648 00:47:40,990 --> 00:47:43,130 And then here's the fun part. 649 00:47:45,250 --> 00:47:50,050 Once that is done, the ops platform doesn't always have to be a Kali box. 650 00:47:50,050 --> 00:47:51,410 It could be a Windows box. 651 00:47:51,410 --> 00:47:52,870 It could be anything. 652 00:47:52,870 --> 00:48:02,190 But once it's done, you power off the EC2 and you take the hard disk and you image it. 653 00:48:04,170 --> 00:48:07,030 And what you do with that is you give it to the blue team. 654 00:48:07,310 --> 00:48:11,990 And it's up to the blue team to decide whether or not they want to do forensics training on it. 655 00:48:12,290 --> 00:48:15,890 They can do response training as the gorilla is banging around the network. 656 00:48:15,890 --> 00:48:21,810 But if they want to do forensics training, they have this image of a low tier actor with all their tools and stuff on there. 657 00:48:21,810 --> 00:48:29,350 And I'm sure there's... I had thoughts of maybe putting all kinds of logging and everything turned on in the ops box so that they could go find those. 658 00:48:29,710 --> 00:48:32,950 And then the blue team would have to go make the compromised account active. 659 00:48:32,950 --> 00:48:38,550 And if they don't do it within a certain amount of time, then the red team has that relationship with helpdesk already built in. 660 00:48:39,310 --> 00:48:44,270 But really, this whole process accomplishes so many things. 661 00:48:44,350 --> 00:48:48,850 And when I talk about decentralizing the adversary, here's what it accomplishes. 662 00:48:48,850 --> 00:48:54,530 It doesn't mean to decentralize in the physical sense. 663 00:48:54,650 --> 00:48:58,830 Like just because your operator is in Arizona, and they're attacking something in New York. 664 00:48:58,830 --> 00:49:02,830 Yes, that is one type of decentralization, but you're decentralizing TTPs. 665 00:49:02,950 --> 00:49:05,630 You're decentralizing target selection. 666 00:49:05,750 --> 00:49:08,310 You are decentralizing all sorts of things. 667 00:49:08,750 --> 00:49:13,650 And you're doing that by giving it to somebody that maybe writes their op notes a little bit differently. 668 00:49:13,650 --> 00:49:17,730 You tell them one thing, but their brain interprets it as something else. 669 00:49:17,730 --> 00:49:23,610 And they make their own set of op notes, not in any way that you had ever thought to even make them. 670 00:49:23,870 --> 00:49:25,390 People think differently. 671 00:49:25,390 --> 00:49:27,990 And at the end of the day, it is a person that's behind the keyboard. 672 00:49:27,990 --> 00:49:38,530 So if you can get as many variables into your network as possible in a controlled manner, that's just going to make your security program even stronger. 673 00:49:38,770 --> 00:49:43,370 And at the end of the day, you might also spin up some red teamers in the process. 674 00:49:43,370 --> 00:49:48,990 And they're going to come to you, or they're going to bring new life into the community. 675 00:49:49,150 --> 00:49:53,690 And I'll tell you, the only thing that this program really cost to do was time. 676 00:49:53,690 --> 00:49:55,990 It didn't cost thousands of dollars to do this. 677 00:49:55,990 --> 00:49:59,830 It cost my time, and it cost the time of the people that were in the program. 678 00:50:01,630 --> 00:50:03,050 So what's next? 679 00:50:03,050 --> 00:50:10,450 Well, unfortunately, I couldn't actually talk about the guerrilla ops that we are doing currently because they're still in progress. 680 00:50:10,450 --> 00:50:17,030 And I wanted to have a little bit more data to say, yes, these work, or no, they don't work, or we had to change these aspects. 681 00:50:17,230 --> 00:50:20,810 Maybe that'll be the 2021 talk, like guerrilla red team year two. 682 00:50:20,810 --> 00:50:21,650 I don't know. 683 00:50:22,290 --> 00:50:28,430 But what's next is we're going to continue to try to automate a lot of the build out process for arming the guerrillas. 684 00:50:29,710 --> 00:50:34,690 Trying to maybe automate some of the target generation. 685 00:50:35,510 --> 00:50:41,810 Just more of the processes of what we do with the platform, how we get things to the guerrillas. 686 00:50:42,450 --> 00:50:50,110 That's what we're going to try to do, is just keep testing it, gathering metrics and stuff, all that boring red team manager stuff. 687 00:50:50,610 --> 00:50:53,770 So that we can see how much of a business impact it actually did have. 688 00:50:53,770 --> 00:51:02,070 But at the end of the day, for the capital investment that was required for this, I imagine it's probably going to have significant return on investment. 689 00:51:02,070 --> 00:51:04,350 Because, I mean, it didn't cost anything. 690 00:51:04,350 --> 00:51:08,090 It cost like less than $100 per person for nine weeks. 691 00:51:10,250 --> 00:51:12,210 So I want to give a couple shout outs to that. 692 00:51:12,210 --> 00:51:14,070 That pretty much is the end of my talk. 693 00:51:15,130 --> 00:51:17,670 Remember phase one was the red team dev program. 694 00:51:17,670 --> 00:51:18,770 You upskill the assets. 695 00:51:18,770 --> 00:51:20,810 Phase two is in progress. 696 00:51:20,810 --> 00:51:28,090 The guerrilla red team, you let them loose on the network to decentralize as much of that thought and brain power as you can. 697 00:51:28,570 --> 00:51:29,810 Shout outs. 698 00:51:30,530 --> 00:51:36,770 I want to thank Cybrary for giving me a platform to write my paper and to work with me on everything. 699 00:51:38,050 --> 00:51:41,330 I had never done a white paper before and they were awesome to work with. 700 00:51:41,330 --> 00:51:49,490 So if you have anything that you want to talk about, they really help you out getting your thoughts on paper and editing and everything else. 701 00:51:50,510 --> 00:51:51,690 I want to thank Mr. 702 00:51:51,690 --> 00:51:57,350 Omar also for letting me slide into his DMs and like the last minute to get this talk approved. 703 00:51:57,350 --> 00:52:04,390 Because as I was writing it up, I was like, I really, really, really want to talk about this guerrilla aspect. 704 00:52:04,450 --> 00:52:09,350 Because I think it could change how a red team arms itself. 705 00:52:09,350 --> 00:52:16,670 You have your professionals and then you have these low tier assets that you've trained and they're supposed to be low tier. 706 00:52:16,730 --> 00:52:18,210 Like low tier ain't so bad. 707 00:52:18,210 --> 00:52:23,250 Like I said earlier, it's low tier is good if you have the right controls in place. 708 00:52:23,250 --> 00:52:24,870 So thank you Omar for letting me in. 709 00:52:26,210 --> 00:52:30,290 I want to thank the ABSOL cohort for sticking with me through this pilot process. 710 00:52:30,770 --> 00:52:34,150 I definitely should have streamlined it a little bit better. 711 00:52:34,150 --> 00:52:43,330 But because of your feedback, I've I think I've been able to make it a better place for the next cohort. 712 00:52:44,130 --> 00:52:47,790 And all of them have said that they want to decide to stay on as fellows. 713 00:52:47,850 --> 00:52:53,270 So we're going to continue to talk and I look forward to seeing how they grow. 714 00:52:53,910 --> 00:53:01,110 I want to thank Hack the Box for having a platform in which we could host a training platform on our own ad hoc. 715 00:53:01,330 --> 00:53:06,210 And I want to thank Darknet Diaries for being like one of the only hacking podcasts that I could find. 716 00:53:06,370 --> 00:53:07,850 And it was actually it's actually good. 717 00:53:07,850 --> 00:53:10,550 It's not just good because it's the like one of the only ones. 718 00:53:10,550 --> 00:53:11,550 It's good because it's good. 719 00:53:11,550 --> 00:53:12,730 So thank you for that. 720 00:53:15,390 --> 00:53:19,010 So thank you for walking through this whole process with me. 721 00:53:19,010 --> 00:53:20,210 It's been a lot. 722 00:53:20,210 --> 00:53:22,490 Phase one, phase two, a lot of talk. 723 00:53:22,490 --> 00:53:26,050 It's all about how to upscale and unleash assets. 724 00:53:27,730 --> 00:53:29,930 And that is the Guerrilla Red team. 725 00:53:30,010 --> 00:53:34,630 So if you have any questions, please feel free to reach out to me on Twitter. 726 00:53:34,870 --> 00:53:42,830 Then I think I'll be in Discord for a little bit to do some Q&A on this if anybody has any questions, but really take this and run with it. 727 00:53:42,830 --> 00:53:46,550 I have an op note generator if you want to steal it on my GitHub. 728 00:53:46,970 --> 00:53:48,590 It uses PyCharm. 729 00:53:48,790 --> 00:53:54,750 I'm sorry, it uses Sublime and JSON file. 730 00:53:54,750 --> 00:54:00,330 And you just all you got to do is plug a couple of things in and it crops out like really good op note template for you. 731 00:54:00,330 --> 00:54:03,310 It makes a bunch of folders and stuff, so it's easy to categorize. 732 00:54:03,490 --> 00:54:05,550 But other than that, just please feel free to reach out. 733 00:54:05,550 --> 00:54:12,430 And I hope that somebody takes this and just like makes it awesome, even more so than I made it awesome. 734 00:54:12,430 --> 00:54:18,590 But I really would like to see it spread because getting people into the field outside of the federal pipeline is hard. 735 00:54:18,710 --> 00:54:25,670 And if we could do this at the grassroots level, not only does the red team win, but the people win, which is what's important. 736 00:54:26,010 --> 00:54:29,010 And if the people win, the business wins too. 737 00:54:29,010 --> 00:54:31,970 I have to say that, but the people win the most. 738 00:54:31,970 --> 00:54:33,150 And that's what it's all about. 739 00:54:33,150 --> 00:54:34,030 So thank you. 740 00:54:34,190 --> 00:54:36,770 My name is Chris and take care.