1 00:00:00,970 --> 00:00:06,050 My name is Walter Cuestas and I'm from Peru in South America. 2 00:00:06,170 --> 00:00:12,550 I'm going to talk about a vector that is not very commented or used at red teaming exercises. 3 00:00:13,110 --> 00:00:17,410 And this is about using applications as the initial compromise. 4 00:00:19,230 --> 00:00:22,910 The not so classic Juanma in this case. 5 00:00:23,070 --> 00:00:29,710 I want to point out that everything I'm going to explain is what we've learned with the team I belong to. 6 00:00:29,710 --> 00:00:36,150 We are working together for several years doing pen testing and red teaming. 7 00:00:36,150 --> 00:00:38,980 Actually in some cases for more than 12 years. 8 00:00:39,390 --> 00:00:43,890 So you will see some examples of our collective effort. 9 00:00:45,010 --> 00:00:49,190 And the question may arise, why two applications? 10 00:00:49,690 --> 00:00:51,710 There are several reasons. 11 00:00:52,010 --> 00:00:58,630 Because we believe that red teaming is not only about getting domain admin or root. 12 00:00:58,630 --> 00:01:03,070 Because not always having that power means you can access data. 13 00:01:03,070 --> 00:01:07,330 Not every application is integrated with Active Directory for example. 14 00:01:08,030 --> 00:01:12,830 After some interaction with people on shares of threat management and hunting. 15 00:01:13,170 --> 00:01:16,390 They are so concentrated on AD and Windows 7. 16 00:01:17,070 --> 00:01:22,950 Organizations are not integrating application security yet in their effort to enhance security. 17 00:01:23,590 --> 00:01:28,470 Also defenders are always pushed to be warned about social engineering attacks. 18 00:01:28,470 --> 00:01:31,910 Or how attackers are bypassing endpoint security. 19 00:01:31,950 --> 00:01:38,290 Or the last password spray technique to common services such as email. 20 00:01:38,870 --> 00:01:43,710 Someone could say that applications today are in the cloud. 21 00:01:44,550 --> 00:01:50,310 But we are seeing that few companies are migrating their core to the cloud. 22 00:01:50,330 --> 00:01:55,850 They still keep it on-premises and modern applications just need to go down to the core. 23 00:01:55,850 --> 00:02:05,990 And finally, because as all of us know, remote access services are delivered through web applications. 24 00:02:07,390 --> 00:02:13,110 One more reason, besides this happens in every other aspect of security. 25 00:02:13,170 --> 00:02:17,650 Is that applications suffer of the same problems for a long time. 26 00:02:17,730 --> 00:02:21,030 As you can see in this image from exploit.db. 27 00:02:21,030 --> 00:02:26,430 This is not only true for common applications, but also for embedded ones. 28 00:02:26,470 --> 00:02:31,190 We can see a Cisco device suffering from local file inclusion. 29 00:02:31,510 --> 00:02:37,090 And a very old kind of vulnerability in the application field. 30 00:02:40,360 --> 00:02:43,480 We want to share this small framework. 31 00:02:43,700 --> 00:02:52,140 We developed it just to have an order in what we do during regular exercises. 32 00:02:52,140 --> 00:02:59,300 I am not going to cover every module, just some high level about information gathering and enumeration. 33 00:02:59,300 --> 00:03:02,680 And more on initial compromise, of course. 34 00:03:03,520 --> 00:03:09,780 So let's talk about recognition and especially about OSINT. 35 00:03:10,400 --> 00:03:17,220 As you know there are tons of tips, sources and how-tos about OSINT. 36 00:03:17,220 --> 00:03:20,600 We want to focus in some aspects. 37 00:03:20,600 --> 00:03:23,580 Searching DNS information is crucial. 38 00:03:24,000 --> 00:03:29,480 And it is important to know that we don't have to select just one tool for that task. 39 00:03:29,600 --> 00:03:35,740 Indeed, most of the time we have to aggregate the results from several of them. 40 00:03:37,320 --> 00:03:48,900 Search engines, such as Shodan, Census, Sunmine for example, are most useful here. 41 00:03:48,900 --> 00:03:54,500 Because we don't have to touch our target at first step. 42 00:03:54,500 --> 00:03:58,600 And these engines keep current data most of the time. 43 00:03:59,120 --> 00:04:04,460 Also, today a good search on surface internet is better than going deep. 44 00:04:04,460 --> 00:04:14,420 And special attention must be on source code leaked in the most innocent and honest ways by developers. 45 00:04:14,440 --> 00:04:19,400 And documents that you have to read very long documents. 46 00:04:20,300 --> 00:04:25,680 So, we have a lot of tools and a lot of data. 47 00:04:26,820 --> 00:04:29,540 And let's talk about real world. 48 00:04:29,540 --> 00:04:32,260 There is no magic neither perfect tool. 49 00:04:32,260 --> 00:04:38,380 And there is no way to learn about our target organization without doing manual investigation. 50 00:04:38,380 --> 00:04:44,360 Spending hours reading information and taking notes that we will share with the team. 51 00:04:44,960 --> 00:04:49,080 Another fun moment is when tool is not working as expected. 52 00:04:49,180 --> 00:04:51,300 Or we need more from it. 53 00:04:51,300 --> 00:04:57,700 That's when our developer skills are important and we start to feel happy. 54 00:05:01,060 --> 00:05:12,260 After a bunch of data, you need to give some form of order to this data to do your analysis. 55 00:05:12,260 --> 00:05:14,480 And it could be very simple. 56 00:05:14,580 --> 00:05:17,640 Just use human readable names for directories and files. 57 00:05:17,640 --> 00:05:21,440 I mean, not only for you, for the whole team. 58 00:05:21,880 --> 00:05:26,480 And you need to do a simple select to get data including images. 59 00:05:26,680 --> 00:05:35,980 There are very good tools, but if you don't have time or just don't want to install them, SQLite is a very good option. 60 00:05:38,040 --> 00:05:41,020 Then, what do we reckon? 61 00:05:41,020 --> 00:05:48,980 For us, the most important rule is not to underestimate your adversary. 62 00:05:48,980 --> 00:05:51,320 Who is your adversary? 63 00:05:51,320 --> 00:05:53,220 The blue guys, of course. 64 00:05:53,540 --> 00:06:03,360 We believe that not every admin is fool and not every developer makes applications without security in mind. 65 00:06:03,360 --> 00:06:07,580 And not every threat hunter is just looking for a DE event. 66 00:06:07,580 --> 00:06:09,300 At least I guess so. 67 00:06:09,300 --> 00:06:16,640 As we are going after applications, there will be a moment to scam something in a very smooth way. 68 00:06:17,060 --> 00:06:20,100 Not now, as blue team is expecting that. 69 00:06:20,780 --> 00:06:26,740 Also, we are going to use the same techniques and tools as when testing applications. 70 00:06:26,780 --> 00:06:34,600 But we have to forget about OWASP, for example, because this is not a pentest neither a bug bounty. 71 00:06:37,120 --> 00:06:40,380 Let's start with initial compromise. 72 00:06:40,380 --> 00:06:46,560 And a small note about these cases that came from real world. 73 00:06:46,560 --> 00:06:53,480 In one case, we were able to create the same scenario we found in another one not. 74 00:06:53,480 --> 00:07:01,160 The main reason is that we don't get the same applications versions of the ones that we got during red team exercises. 75 00:07:01,980 --> 00:07:06,000 So, case 1 is here, we call it jumping. 76 00:07:07,120 --> 00:07:10,280 Because we are going to jump several times. 77 00:07:10,280 --> 00:07:14,020 The scenario is like this. 78 00:07:14,160 --> 00:07:20,060 This is a very common scenario where an organization is using cloud for new applications. 79 00:07:20,100 --> 00:07:23,160 Hybrid cloud may be the right name. 80 00:07:23,540 --> 00:07:28,400 We have the frontend of the application, the cloud, with a database. 81 00:07:28,820 --> 00:07:33,780 But it needs data also from the business core applications. 82 00:07:34,080 --> 00:07:37,120 And data that are still on-premises. 83 00:07:37,120 --> 00:07:43,520 We are looking for the secrets on that core because it's the most valuable information. 84 00:07:43,780 --> 00:07:51,120 And as happens today, there are so many digital transformation projects and few security controls. 85 00:07:51,120 --> 00:07:53,200 Everything is sales-driven. 86 00:07:56,800 --> 00:08:03,820 I know that this seems like a hack the box case, but it's not. 87 00:08:03,820 --> 00:08:15,300 Our first security test for digital transformation projects showed us that there is no control over the initiatives coming from different teams in the same organization. 88 00:08:15,480 --> 00:08:21,050 So, our recognition found this exposed Jenkins administrative interface. 89 00:08:21,560 --> 00:08:26,020 In fact, it's exposed to the internet. 90 00:08:26,100 --> 00:08:31,120 With the option to create an account which is not a default. 91 00:08:31,120 --> 00:08:33,960 This is not a surprise. 92 00:08:34,020 --> 00:08:37,520 This is a very well-known issue. 93 00:08:38,140 --> 00:08:44,860 But, what is bad is that by default, locating users can do anything. 94 00:08:45,760 --> 00:08:56,320 Having this in mind, let's take a look at the credentials section where we found this case. 95 00:08:56,320 --> 00:09:06,350 One for SSH access and the other one to get access to the cloud. 96 00:09:09,580 --> 00:09:15,770 One is an Amazon XSK, but this is not enough. 97 00:09:17,700 --> 00:09:21,820 We need also the secret XSK. 98 00:09:21,820 --> 00:09:26,820 As you can see, it seems this is properly secured. 99 00:09:28,480 --> 00:09:41,620 One of the things we learned from doing pentesting on applications is that client-side source code is something we always want to review. 100 00:09:42,320 --> 00:09:49,920 Just use developer or inspect mode and you will find not only HTML and common JavaScript. 101 00:09:50,200 --> 00:09:55,180 There are still developers that trust on client-side protections. 102 00:09:55,180 --> 00:10:03,180 And not exactly related comment for this slide. 103 00:10:03,180 --> 00:10:07,580 Today JavaScript is very powerful at client-side. 104 00:10:07,580 --> 00:10:11,540 So, there are more reasons to review that code. 105 00:10:12,060 --> 00:10:17,340 But, as we can see, this case is encrypted. 106 00:10:18,220 --> 00:10:26,500 So, let's move on and check the SSH key to gain remote access. 107 00:10:27,560 --> 00:10:34,300 But, once again, this key is also encrypted. 108 00:10:35,500 --> 00:10:46,580 Now, Averik, today there are tons of information that we want and like, of course, to read, view and listen. 109 00:10:46,580 --> 00:10:52,980 And when talking about writing, there are no magic scanner working for us. 110 00:10:52,980 --> 00:11:02,080 But, there are several cases where you won't find any previous information and this is when you get a research moment. 111 00:11:05,300 --> 00:11:11,360 Jenkins itself needs a way to decrypt that information in order to use it. 112 00:11:11,940 --> 00:11:16,560 And it has an option to run a script that we are going to use. 113 00:11:16,560 --> 00:11:24,460 As you can see, Jenkins provides all we need to do our job. 114 00:11:28,010 --> 00:11:34,070 A small and simple script will do the magic. 115 00:11:34,790 --> 00:11:40,230 And, voila, we got our case decrypted. 116 00:11:45,180 --> 00:11:55,280 So, we use them to access the cloud with the same privileges as this project Jenkins have. 117 00:11:55,280 --> 00:11:59,720 Will be them for production environment? 118 00:12:00,400 --> 00:12:03,460 Well, let's take a look. 119 00:12:03,460 --> 00:12:14,740 It seems clear that we are looking for instances as long as these credentials are used in an application project. 120 00:12:14,740 --> 00:12:19,740 We found the information of an instance and the corresponding IP address. 121 00:12:20,400 --> 00:12:22,560 Let's check it. 122 00:12:23,600 --> 00:12:28,880 Well, it's obvious that this is not our target. 123 00:12:28,880 --> 00:12:35,920 Maybe we can use it for our first jump, but it's not what we are looking for. 124 00:12:38,520 --> 00:12:42,720 Let's try with the other kind of access. 125 00:12:42,880 --> 00:12:48,560 I mean, accessing by SSH. 126 00:12:49,980 --> 00:12:59,440 And we are to focus this time on searching source code and review this code. 127 00:12:59,440 --> 00:13:05,600 So, we start using the SSH key we got. 128 00:13:05,600 --> 00:13:10,740 And we got access to the cloud by SSH. 129 00:13:10,740 --> 00:13:13,740 And start to search for code. 130 00:13:13,960 --> 00:13:16,500 And we found some programs here. 131 00:13:19,080 --> 00:13:35,780 The first element to search, we are looking for endpoint information as long as they will show us some new paths, maybe credentials. 132 00:13:37,500 --> 00:13:40,960 And we got this config file. 133 00:13:41,840 --> 00:13:53,860 As I said, we can see that we got an endpoint and a set of credentials, username and pass. 134 00:13:54,060 --> 00:14:04,080 And, of course, the API text means that we have information to access an API. 135 00:14:04,480 --> 00:14:09,120 And, of course, it will be a RESTful API. 136 00:14:14,070 --> 00:14:18,190 Checking from inside the cloud. 137 00:14:18,790 --> 00:14:22,970 We use a cure and we got an answer. 138 00:14:23,150 --> 00:14:26,510 So, endpoint exists and could be working. 139 00:14:27,150 --> 00:14:29,650 Also, we got a redirection. 140 00:14:30,570 --> 00:14:34,990 And take a look that there is a cookie with a JSession ID. 141 00:14:35,070 --> 00:14:39,550 It smells to Java, besides the code analyzed was PHP. 142 00:14:39,550 --> 00:14:45,730 But we need to be more comfortable with a browser and other tools. 143 00:14:46,230 --> 00:15:07,490 So, using this SSH connection as a proxy and configuring our browser, we can see that we are identified with the IP from the instance. 144 00:15:13,810 --> 00:15:24,670 Also, when browsing an API URL, we got another application related directly to the previous one and the API. 145 00:15:26,770 --> 00:15:31,010 But we have no access to other databases. 146 00:15:31,570 --> 00:15:35,790 Only the API is exposed to the cloud instances. 147 00:15:36,290 --> 00:15:38,830 Just from the cloud instances. 148 00:15:38,830 --> 00:15:45,910 Our real target is on-premises with core applications, the legacy ones. 149 00:15:47,850 --> 00:15:52,130 Do you remember the JSession ID cookie? 150 00:15:52,130 --> 00:16:01,830 Well, that and the app server listening at 8080 port seems pretty much like Tomcat. 151 00:16:02,830 --> 00:16:11,950 It's better to make regular traffic with a browser or cure to do banner grabbing. 152 00:16:12,970 --> 00:16:19,010 I mean, we are not going to use our nmap, for example. 153 00:16:19,850 --> 00:16:31,810 And checking Tomcat related ports, we found 8009 port open for the Apache JServe protocol. 154 00:16:31,810 --> 00:16:45,670 This AGP is a binary protocol mainly used for reverse proxy between front-end web server and back-end application server, such as Apache and Tomcat itself. 155 00:16:46,110 --> 00:16:50,160 It's shorter, faster and, of course, vulnerable. 156 00:16:51,480 --> 00:17:05,440 Ghostcat was announced this year and this vulnerability allows arbitrary file reading and Java server pages, JSP, processing. 157 00:17:05,880 --> 00:17:12,380 It means real-world command execution. 158 00:17:12,580 --> 00:17:18,820 And, of course, there is AGP shooter to exploit it. 159 00:17:18,820 --> 00:17:24,660 We are going to start using proxy chains as long as this tool is not proxy aware. 160 00:17:24,740 --> 00:17:29,260 And since now we will be searching for configuration files mainly. 161 00:17:35,510 --> 00:17:40,150 Finding an abloved servlet doesn't mean everything is easy. 162 00:17:40,730 --> 00:17:43,570 Let's review that servlet source code. 163 00:17:44,490 --> 00:17:55,090 Again, getting the file with AGP shooter, we found the abloved directory. 164 00:17:55,990 --> 00:18:00,650 And it has some security control. 165 00:18:00,830 --> 00:18:07,950 It accepts only JPJ or PNJ extensions. 166 00:18:12,360 --> 00:18:17,520 So, we are going to use a simple web shell to start. 167 00:18:17,700 --> 00:18:20,600 We don't want web shell with fireworks. 168 00:18:20,740 --> 00:18:29,640 First task on arrival is to change the image name station from JPJ to JSP. 169 00:18:30,240 --> 00:18:39,780 And remember that Ghostcat allows for JSP processing, but you don't have to use that extension to ask AGP shooter to do that for you. 170 00:18:42,460 --> 00:18:47,760 Upload and execute our special image. 171 00:18:47,920 --> 00:18:52,020 Just a cure for the upload. 172 00:18:52,560 --> 00:18:59,180 And of course, AGP shooter for execution. 173 00:18:59,480 --> 00:19:05,120 This script accepts two parameters, read and eval. 174 00:19:05,120 --> 00:19:08,010 Eval is for processing the JSP. 175 00:19:08,010 --> 00:19:18,330 And as you can see at the bottom of the last image, the first command to execute is rename the JPJ to JSP. 176 00:19:18,530 --> 00:19:25,230 So, we start doing enumeration. 177 00:19:26,170 --> 00:19:33,150 For example, we are using an account called Tomcat. 178 00:19:33,150 --> 00:19:40,110 It's a limited account, no high-level privileges, but we can do some network enumeration. 179 00:19:40,870 --> 00:19:44,910 And we are going to search for configuration files. 180 00:19:45,450 --> 00:19:52,530 After that, we realize that we need to use an improved web shell. 181 00:19:52,650 --> 00:19:56,210 So, we upload this one. 182 00:19:57,510 --> 00:20:09,010 Searching through the configuration files, we found another endpoint and more credentials that are not from the cloud instance, neither the Tomcat server. 183 00:20:09,890 --> 00:20:13,710 You could ask MySQL in the core. 184 00:20:13,770 --> 00:20:18,090 Well, actually it was Oracle, but MySQL was enough for recreation. 185 00:20:18,850 --> 00:20:22,790 We are going to connect to this database server. 186 00:20:22,790 --> 00:20:27,530 And hopefully we will find the core secrets. 187 00:20:30,510 --> 00:20:37,230 Let's use the options of our improved web shell to connect to the database. 188 00:20:38,910 --> 00:20:50,110 And when showing databases, we could see that this is not the precious secret we are looking for. 189 00:20:52,240 --> 00:21:03,980 Also, this account doesn't have enough privileges, so we have to try harder. 190 00:21:09,130 --> 00:21:17,450 Well, we tried harder and found another set of credentials in another configuration file for another application. 191 00:21:17,810 --> 00:21:22,150 Same endpoint, but different credentials. 192 00:21:24,810 --> 00:21:29,110 Let's try these credentials. 193 00:21:29,670 --> 00:21:40,350 And finally, we got the core secrets with maximum privileges. 194 00:21:40,790 --> 00:21:46,830 From here, we can dump data and exfiltrate it. 195 00:21:46,830 --> 00:21:51,230 We can modify, add or delete databases. 196 00:21:51,230 --> 00:21:55,270 We didn't own the domain, we owned the database. 197 00:21:57,130 --> 00:21:59,610 So, here are the secrets. 198 00:22:04,190 --> 00:22:06,970 Some questions and tips. 199 00:22:07,550 --> 00:22:20,270 I guess that someone is monitoring this kind of activity, maybe those application firewalls that are looking for injections or sophisticated malware, not this kind of normal traffic. 200 00:22:20,270 --> 00:22:35,290 When we do red teaming, we start with a couple of red teamers, not extra ones as needed, just to have people with enough skills and experience. 201 00:22:37,330 --> 00:22:43,710 Indeed, also during pen testing, reviewing source code is a must. 202 00:22:44,970 --> 00:22:53,570 Sometimes, developers and admins follow guides strictly and keep some information that is not mandatory to do so. 203 00:22:54,690 --> 00:23:05,730 Maybe this is a new kind of default credentials, but we found cases in sample code from howtos in some application's production environment. 204 00:23:06,730 --> 00:23:25,190 Just one note, I was kidding when I said that this is normal traffic, but you understand that this is not a kind of sophisticated traffic that we read all the time in the news. 205 00:23:26,910 --> 00:23:34,690 Sometimes, it works better because protection devices are waiting for that sophisticated traffic. 206 00:23:35,430 --> 00:23:38,190 So, what's next? 207 00:23:39,450 --> 00:23:48,590 At least for us, main objectives are doing a red team exercise, is to test the time to detect and time to mitigate. 208 00:23:48,590 --> 00:24:00,330 But let's face it, most organizations just want to have an almost real-world experience with attackers, and real ones are looking for ways to get money from their attacks or some kind of power. 209 00:24:00,330 --> 00:24:05,830 So, let's think as them and elaborate ways to exploit the information. 210 00:24:06,790 --> 00:24:14,450 To keep everything organized, we have to add this initial compromise with our C2, my favorite one is push, of course. 211 00:24:14,450 --> 00:24:23,670 There are command executions in a couple of jams, maybe it could be useful for lateral movement. 212 00:24:30,260 --> 00:24:37,940 Let's move on to case 2, dynamic duo. 213 00:24:43,100 --> 00:24:50,020 Remote access is required, before COVID-19 it was needed and after this is a must. 214 00:24:50,280 --> 00:24:54,300 But how is this kind of service related to applications? 215 00:24:54,440 --> 00:25:17,380 Well, as long as these services use protocols like HTTPS, as long as the users and admins use their browser to do their thing, as long as these interfaces are using HTML, JavaScript and running CGI and several scripting languages, as long as they bleed also, 216 00:25:17,380 --> 00:25:21,180 I mean, they have common application vulnerabilities also. 217 00:25:22,700 --> 00:25:26,960 This is our scenario for this case. 218 00:25:26,960 --> 00:25:41,380 This company has two remote access servers, Y, migration, backup, both integrated with Active Directory, a perimeter with some good protection. 219 00:25:42,080 --> 00:25:50,860 They can't work together, we are going to see how. 220 00:25:50,860 --> 00:26:00,900 By the way, this will be the traditional red teaming, getting domain admin from the beginning. 221 00:26:03,260 --> 00:26:16,920 Let's find out what is the origin of these vulnerabilities, or when we realized that these vulnerabilities exist. 222 00:26:16,920 --> 00:26:25,060 Last year, these researchers showed several vulnerabilities they discovered on SSL VPN appliances. 223 00:26:25,380 --> 00:26:28,720 After that, exploits started to appear. 224 00:26:29,200 --> 00:26:42,980 But, as every people that knows how to use a GAN, this is not just point and shoot, you have to know how your GAN works, how your tool works, and take care of your GAN or your tool. 225 00:26:46,260 --> 00:26:53,460 In the more traditional service, there are always several exit paths to command execution. 226 00:26:54,220 --> 00:27:04,300 So, let's start with one of them, Pulse Connect Secure. 227 00:27:04,300 --> 00:27:11,420 One of the vulnerable appliances showed last year was this Pulse Connect Secure. 228 00:27:11,420 --> 00:27:13,660 There are several versions affected. 229 00:27:13,660 --> 00:27:19,100 Again, we found an administrative interface exposed to internet. 230 00:27:19,120 --> 00:27:39,080 We have several credentials to try coming from recognition, but maybe doing some kind of password spray to this device could start the alerts. 231 00:27:39,080 --> 00:27:56,060 So, maybe we shouldn't try them, and we are going to do some kind of special recognition in the way that we tested applications. 232 00:27:56,280 --> 00:28:01,460 Why don't we try with a proxy like Burp? 233 00:28:02,400 --> 00:28:09,260 As in case one, we keep updated, reading, viewing and listening a lot of information. 234 00:28:09,260 --> 00:28:11,500 Actually, we like that a lot. 235 00:28:11,500 --> 00:28:20,300 So, checking if this device is vulnerable to pre-authentication, arbitrary file reading is as easy as to send a request. 236 00:28:20,420 --> 00:28:27,600 We are using Burp just because it is our favorite tool for applications security testing. 237 00:28:27,600 --> 00:28:32,920 And as we can see, this appliance is vulnerable. 238 00:28:33,060 --> 00:28:54,000 We are reading files like PulseWD with a list of users and several other files, such as the one with a host registered manually in this file. 239 00:28:54,000 --> 00:28:56,980 So, this device is vulnerable. 240 00:28:57,220 --> 00:29:09,480 And we are going to use a script, which Fox made a bash script to exploit this vulnerability. 241 00:29:09,780 --> 00:29:19,560 Also, we want to give a small recognition to all these young people helping others automating the exploitation. 242 00:29:19,560 --> 00:29:29,560 That's the reason of that small white message there. 243 00:29:29,820 --> 00:29:33,720 This script will download several files. 244 00:29:34,220 --> 00:29:39,980 Some are pure plain text and some are data structured in another format. 245 00:29:39,980 --> 00:29:51,760 All contain critical information, case, usernames, passwords, IP addresses, operating systems of users and so on. 246 00:29:52,440 --> 00:30:08,880 For example, we got local users that are active directory users if the appliance is integrated with that directory service. 247 00:30:08,880 --> 00:30:18,080 And also VPN logins that are usernames with passwords all in plain text. 248 00:30:18,180 --> 00:30:29,340 Yes, 2020 there are still security appliances storing credentials in just plain or clear text. 249 00:30:29,340 --> 00:30:44,660 Also, we got SSH keys, but we are not going to use them because external firewall is doing its job very good. 250 00:30:44,980 --> 00:30:53,020 So, we have another group of information. 251 00:30:55,280 --> 00:30:57,920 We got clear text credentials. 252 00:30:58,920 --> 00:31:04,220 And we got inside Pulse Connect Secure with user level credentials. 253 00:31:04,220 --> 00:31:07,240 Just that, just loose user level. 254 00:31:08,060 --> 00:31:12,020 That's not too much to do with that. 255 00:31:12,380 --> 00:31:20,040 But some usernames have a kind of active directory look and feel. 256 00:31:20,520 --> 00:31:22,520 And they weren't on clear text. 257 00:31:22,520 --> 00:31:27,900 We got the hashes of the passwords. 258 00:31:27,900 --> 00:31:31,680 So, John the Ripper came and did its thing. 259 00:31:32,180 --> 00:31:33,720 Cracked hashes. 260 00:31:34,640 --> 00:31:41,120 And after that, we got access as user. 261 00:31:41,700 --> 00:31:47,720 Also, not too much applications delivered for end users. 262 00:31:48,040 --> 00:31:50,120 And as admin. 263 00:31:57,100 --> 00:32:09,880 So, doing more checks, there is integration with active directory enabled. 264 00:32:09,880 --> 00:32:13,940 As we can see with these authentication servers. 265 00:32:14,640 --> 00:32:22,280 And for that integration, of course, you need an account to access the active directory. 266 00:32:22,280 --> 00:32:27,260 An administrator level account for active directory. 267 00:32:27,260 --> 00:32:30,400 So, we got domain admin. 268 00:32:32,100 --> 00:32:41,540 And yes, as you can guess, there is credential reuse in this organization also. 269 00:32:42,520 --> 00:32:46,580 But then, this thing doesn't stop here. 270 00:32:46,580 --> 00:32:53,660 Because this software is also vulnerable to command execution. 271 00:32:54,860 --> 00:33:00,640 So, after doing some enumeration of users. 272 00:33:01,100 --> 00:33:08,980 And testing if we can reach the domain controllers of this active directory. 273 00:33:09,660 --> 00:33:13,660 We went for command execution. 274 00:33:13,660 --> 00:33:17,040 For this, we need credentials. 275 00:33:17,040 --> 00:33:19,040 We have those credentials. 276 00:33:19,260 --> 00:33:22,680 Because this vulnerability is post-authentication. 277 00:33:22,680 --> 00:33:26,360 We can inject commands and execute. 278 00:33:26,360 --> 00:33:28,480 There is a public exploit. 279 00:33:29,120 --> 00:33:32,980 This is another exploit made in Python. 280 00:33:33,360 --> 00:33:37,460 And what it does is take credentials we got. 281 00:33:37,460 --> 00:33:43,900 And do the magic to allow us to connect to the appliance by SSH. 282 00:33:44,240 --> 00:33:50,500 What it does is download our SSH case to the appliance. 283 00:33:51,040 --> 00:33:56,080 But there is a firewall, as I said, that doesn't allow to connect by SSH. 284 00:33:56,080 --> 00:34:03,260 So, we have to do small modifications to the script in order to use it. 285 00:34:04,920 --> 00:34:09,060 As you can see, just comment some lines. 286 00:34:09,540 --> 00:34:11,260 And add parameter manipulation. 287 00:34:11,260 --> 00:34:17,340 Plus, we are going to use burp for the output. 288 00:34:18,060 --> 00:34:20,780 This script is proxy-aware for debugging purposes. 289 00:34:20,780 --> 00:34:24,700 So, we don't have to add anything about that. 290 00:34:24,780 --> 00:34:30,560 And now, we are executing commands on the appliance. 291 00:34:31,400 --> 00:34:35,660 So, question arises, is this enough? 292 00:34:37,740 --> 00:34:38,580 Well... 293 00:34:38,580 --> 00:34:47,880 As there is a robin for every badman or vice versa. 294 00:34:48,900 --> 00:34:51,160 We got PulseConnect secure. 295 00:34:51,160 --> 00:34:54,840 And it has Citrix right by its side. 296 00:34:55,200 --> 00:34:59,940 That was perfect for us because having only one foot inside. 297 00:34:59,940 --> 00:35:02,040 Is not enough. 298 00:35:05,910 --> 00:35:08,270 And... guess what? 299 00:35:08,410 --> 00:35:10,630 Credential reuse is everywhere. 300 00:35:10,970 --> 00:35:16,350 We got access with same credentials as the ones in the other appliance. 301 00:35:17,150 --> 00:35:22,450 Of course, they are Active Directory integrated. 302 00:35:23,070 --> 00:35:27,350 And in this case, it has more applications deployed. 303 00:35:27,350 --> 00:35:31,610 And we started to check one by one. 304 00:35:33,370 --> 00:35:41,910 Special focus in traditional Windows applications delivered using distinct clients. 305 00:35:41,910 --> 00:35:46,850 Because there are several ways to escape to Windows Command Shell or PowerShell. 306 00:35:46,850 --> 00:35:51,490 So, this application looks as the one we are looking for. 307 00:35:51,810 --> 00:35:56,950 As you can see, it loads an instance of Windows. 308 00:35:58,250 --> 00:36:01,210 This is the application starting. 309 00:36:01,890 --> 00:36:07,230 And this is the application login pop-up. 310 00:36:11,110 --> 00:36:19,330 Escaping from Citrix jail has a long history from several years ago until today. 311 00:36:19,330 --> 00:36:24,390 At first, it is based on pressing some keys on the keyboard. 312 00:36:24,390 --> 00:36:30,590 For example, in this case, pressing CTRL plus ALT plus DELETE does a trick. 313 00:36:31,230 --> 00:36:39,710 In other cases, WINDOWS STICKY KEYS, pressing SHIFT five times or ICA KEYS from Citrix. 314 00:36:40,330 --> 00:36:51,090 To gain access to CMD or PowerShell, you can use dialogs such as FILE AND OPEN or FILE AND NEW TASK from Task Manager as you will see. 315 00:36:51,090 --> 00:36:55,350 There are more on this to bypass file restrictions. 316 00:36:55,350 --> 00:37:02,340 There are several documents showing how to do that. 317 00:37:04,170 --> 00:37:17,420 So, TASK MANAGER, NEW TASK, CMD EXE and we got CMD in action. 318 00:37:18,900 --> 00:37:29,770 From there on, we did some enumeration, classic WINDOWS and AD enumeration. 319 00:37:30,120 --> 00:37:34,450 But more important, search for valuable information. 320 00:37:35,500 --> 00:37:46,380 To tell the truth, you can see that we found here some files with credentials and IP addresses. 321 00:37:46,380 --> 00:37:55,800 But in this case, we just confirmed that this kind of information was accurate and updated. 322 00:37:55,800 --> 00:38:03,840 Because we got this information in one repository on GitHub during recognition. 323 00:38:07,750 --> 00:38:16,730 After this, we are going to see the light in terms of infrastructure penetration. 324 00:38:17,450 --> 00:38:21,070 Because good network segmentation is still a dream. 325 00:38:21,630 --> 00:38:26,230 There are yet several exceptions breaking ACLs. 326 00:38:26,230 --> 00:38:31,030 And in 2020 is not true that only end-users are good victims. 327 00:38:31,410 --> 00:38:40,610 We are going to try to shoot to developers, internal and external ones, IT people and security people. 328 00:38:40,610 --> 00:38:41,270 Why? 329 00:38:41,270 --> 00:38:45,870 Because they have more power on their machines than end-users. 330 00:38:45,870 --> 00:38:47,510 As simple as that. 331 00:38:51,920 --> 00:39:09,270 Some tips about this kind of initial compromise. 332 00:39:09,940 --> 00:39:12,960 We have two doors opened. 333 00:39:13,960 --> 00:39:19,440 In that moment, it was important to warn the customer about that. 334 00:39:20,440 --> 00:39:23,500 The customer had to warn the subguides. 335 00:39:23,500 --> 00:39:28,920 Also the prevention, correlation and event management solutions had to be warned. 336 00:39:29,120 --> 00:39:34,300 It is important to be as smooth as possible. 337 00:39:35,140 --> 00:39:46,580 But there are some cases that you cannot wait to end the redteam exercise to warn the customer. 338 00:39:46,580 --> 00:39:58,880 Also, as part of these smooth actions, you should avoid to create accounts. 339 00:39:58,880 --> 00:40:02,780 At least not god-level ones. 340 00:40:02,780 --> 00:40:08,760 It is better to use a simple user account and give power to that account. 341 00:40:08,760 --> 00:40:16,910 In some situations it won't be possible, so do that, create an account after several checks. 342 00:40:17,420 --> 00:40:19,890 Always keep logs in mind. 343 00:40:21,020 --> 00:40:28,800 And of course, delete just entries belonging to your work. 344 00:40:29,240 --> 00:40:33,840 Remember to never underestimate to your adversary. 345 00:40:33,840 --> 00:40:43,100 Be patient, this is not a game, and this is the reason why redteam exercises has enough time. 346 00:40:43,620 --> 00:40:45,280 Have fun, of course. 347 00:40:46,320 --> 00:40:53,880 Finally, I want to thank Omar and all the crew at Redteam Village. 348 00:40:54,000 --> 00:41:01,000 They do an awesome job all the time, just for giving back to the community. 349 00:41:01,000 --> 00:41:01,240 Ciao !