start	end	text
970	6050	My name is Walter Cuestas and I'm from Peru in South America.
6170	12550	I'm going to talk about a vector that is not very commented or used at red teaming exercises.
13110	17410	And this is about using applications as the initial compromise.
19230	22910	The not so classic Juanma in this case.
23070	29710	I want to point out that everything I'm going to explain is what we've learned with the team I belong to.
29710	36150	We are working together for several years doing pen testing and red teaming.
36150	38980	Actually in some cases for more than 12 years.
39390	43890	So you will see some examples of our collective effort.
45010	49190	And the question may arise, why two applications?
49690	51710	There are several reasons.
52010	58630	Because we believe that red teaming is not only about getting domain admin or root.
58630	63070	Because not always having that power means you can access data.
63070	67330	Not every application is integrated with Active Directory for example.
68030	72830	After some interaction with people on shares of threat management and hunting.
73170	76390	They are so concentrated on AD and Windows 7.
77070	82950	Organizations are not integrating application security yet in their effort to enhance security.
83590	88470	Also defenders are always pushed to be warned about social engineering attacks.
88470	91910	Or how attackers are bypassing endpoint security.
91950	98290	Or the last password spray technique to common services such as email.
98870	103710	Someone could say that applications today are in the cloud.
104550	110310	But we are seeing that few companies are migrating their core to the cloud.
110330	115850	They still keep it on-premises and modern applications just need to go down to the core.
115850	125990	And finally, because as all of us know, remote access services are delivered through web applications.
127390	133110	One more reason, besides this happens in every other aspect of security.
133170	137650	Is that applications suffer of the same problems for a long time.
137730	141030	As you can see in this image from exploit.db.
141030	146430	This is not only true for common applications, but also for embedded ones.
146470	151190	We can see a Cisco device suffering from local file inclusion.
151510	157090	And a very old kind of vulnerability in the application field.
160360	163480	We want to share this small framework.
163700	172140	We developed it just to have an order in what we do during regular exercises.
172140	179300	I am not going to cover every module, just some high level about information gathering and enumeration.
179300	182680	And more on initial compromise, of course.
183520	189780	So let's talk about recognition and especially about OSINT.
190400	197220	As you know there are tons of tips, sources and how-tos about OSINT.
197220	200600	We want to focus in some aspects.
200600	203580	Searching DNS information is crucial.
204000	209480	And it is important to know that we don't have to select just one tool for that task.
209600	215740	Indeed, most of the time we have to aggregate the results from several of them.
217320	228900	Search engines, such as Shodan, Census, Sunmine for example, are most useful here.
228900	234500	Because we don't have to touch our target at first step.
234500	238600	And these engines keep current data most of the time.
239120	244460	Also, today a good search on surface internet is better than going deep.
244460	254420	And special attention must be on source code leaked in the most innocent and honest ways by developers.
254440	259400	And documents that you have to read very long documents.
260300	265680	So, we have a lot of tools and a lot of data.
266820	269540	And let's talk about real world.
269540	272260	There is no magic neither perfect tool.
272260	278380	And there is no way to learn about our target organization without doing manual investigation.
278380	284360	Spending hours reading information and taking notes that we will share with the team.
284960	289080	Another fun moment is when tool is not working as expected.
289180	291300	Or we need more from it.
291300	297700	That's when our developer skills are important and we start to feel happy.
301060	312260	After a bunch of data, you need to give some form of order to this data to do your analysis.
312260	314480	And it could be very simple.
314580	317640	Just use human readable names for directories and files.
317640	321440	I mean, not only for you, for the whole team.
321880	326480	And you need to do a simple select to get data including images.
326680	333040	There are very good tools, but if you don't have time or just don't want to install them,
333040	335980	SQLite is a very good option.
338040	341020	Then, what do we reckon?
341020	348980	For us, the most important rule is not to underestimate your adversary.
348980	351320	Who is your adversary?
351320	353220	The blue guys, of course.
353540	363360	We believe that not every admin is fool and not every developer makes applications without security in mind.
363360	367580	And not every threat hunter is just looking for a DE event.
367580	369300	At least I guess so.
369300	376640	As we are going after applications, there will be a moment to scam something in a very smooth way.
377060	380100	Not now, as blue team is expecting that.
380780	386740	Also, we are going to use the same techniques and tools as when testing applications.
386780	394600	But we have to forget about OWASP, for example, because this is not a pentest neither a bug bounty.
397120	400380	Let's start with initial compromise.
400380	406560	And a small note about these cases that came from real world.
406560	413480	In one case, we were able to create the same scenario we found in another one not.
413480	421160	The main reason is that we don't get the same applications versions of the ones that we got during red team exercises.
421980	426000	So, case 1 is here, we call it jumping.
427120	430280	Because we are going to jump several times.
430280	434020	The scenario is like this.
434160	440060	This is a very common scenario where an organization is using cloud for new applications.
440100	443160	Hybrid cloud may be the right name.
443540	448400	We have the frontend of the application, the cloud, with a database.
448820	453780	But it needs data also from the business core applications.
454080	457120	And data that are still on-premises.
457120	463520	We are looking for the secrets on that core because it's the most valuable information.
463780	471120	And as happens today, there are so many digital transformation projects and few security controls.
471120	473200	Everything is sales-driven.
476800	483820	I know that this seems like a hack the box case, but it's not.
483820	495300	Our first security test for digital transformation projects showed us that there is no control over the initiatives coming from different teams in the same organization.
495480	501050	So, our recognition found this exposed Jenkins administrative interface.
501560	506020	In fact, it's exposed to the internet.
506100	511120	With the option to create an account which is not a default.
511120	517520	This is not a surprise. This is a very well-known issue.
518140	524860	But, what is bad is that by default, locating users can do anything.
525760	536320	Having this in mind, let's take a look at the credentials section where we found this case.
536320	546350	One for SSH access and the other one to get access to the cloud.
549580	555770	One is an Amazon XSK, but this is not enough.
557700	561820	We need also the secret XSK.
561820	566820	As you can see, it seems this is properly secured.
568480	581620	One of the things we learned from doing pentesting on applications is that client-side source code is something we always want to review.
582320	589920	Just use developer or inspect mode and you will find not only HTML and common JavaScript.
590200	595180	There are still developers that trust on client-side protections.
595180	603180	And not exactly related comment for this slide.
603180	607580	Today JavaScript is very powerful at client-side.
607580	611540	So, there are more reasons to review that code.
612060	617340	But, as we can see, this case is encrypted.
618220	626500	So, let's move on and check the SSH key to gain remote access.
627560	634300	But, once again, this key is also encrypted.
635500	646580	Now, Averik, today there are tons of information that we want and like, of course, to read, view and listen.
646580	652980	And when talking about writing, there are no magic scanner working for us.
652980	662080	But, there are several cases where you won't find any previous information and this is when you get a research moment.
665300	671360	Jenkins itself needs a way to decrypt that information in order to use it.
671940	676560	And it has an option to run a script that we are going to use.
676560	684460	As you can see, Jenkins provides all we need to do our job.
688010	694070	A small and simple script will do the magic.
694790	700230	And, voila, we got our case decrypted.
705180	715280	So, we use them to access the cloud with the same privileges as this project Jenkins have.
715280	719720	Will be them for production environment?
720400	723460	Well, let's take a look.
723460	734740	It seems clear that we are looking for instances as long as these credentials are used in an application project.
734740	739740	We found the information of an instance and the corresponding IP address.
740400	742560	Let's check it.
743600	748880	Well, it's obvious that this is not our target.
748880	755920	Maybe we can use it for our first jump, but it's not what we are looking for.
758520	762720	Let's try with the other kind of access.
762880	768560	I mean, accessing by SSH.
769980	779440	And we are to focus this time on searching source code and review this code.
779440	785600	So, we start using the SSH key we got.
785600	790740	And we got access to the cloud by SSH.
790740	793740	And start to search for code.
793960	796500	And we found some programs here.
799080	815780	The first element to search, we are looking for endpoint information as long as they will show us some new paths, maybe credentials.
817500	820960	And we got this config file.
821840	833860	As I said, we can see that we got an endpoint and a set of credentials, username and pass.
834060	844080	And, of course, the API text means that we have information to access an API.
844480	849120	And, of course, it will be a RESTful API.
854070	858190	Checking from inside the cloud.
858790	862970	We use a cure and we got an answer.
863150	866510	So, endpoint exists and could be working.
867150	869650	Also, we got a redirection.
870570	874990	And take a look that there is a cookie with a JSession ID.
875070	879550	It smells to Java, besides the code analyzed was PHP.
879550	885730	But we need to be more comfortable with a browser and other tools.
886230	907490	So, using this SSH connection as a proxy and configuring our browser, we can see that we are identified with the IP from the instance.
913810	924670	Also, when browsing an API URL, we got another application related directly to the previous one and the API.
926770	931010	But we have no access to other databases.
931570	935790	Only the API is exposed to the cloud instances.
936290	938830	Just from the cloud instances.
938830	945910	Our real target is on-premises with core applications, the legacy ones.
947850	952130	Do you remember the JSession ID cookie?
952130	961830	Well, that and the app server listening at 8080 port seems pretty much like Tomcat.
962830	971950	It's better to make regular traffic with a browser or cure to do banner grabbing.
972970	979010	I mean, we are not going to use our nmap, for example.
979850	991810	And checking Tomcat related ports, we found 8009 port open for the Apache JServe protocol.
991810	1005670	This AGP is a binary protocol mainly used for reverse proxy between front-end web server and back-end application server, such as Apache and Tomcat itself.
1006110	1010160	It's shorter, faster and, of course, vulnerable.
1011480	1025440	Ghostcat was announced this year and this vulnerability allows arbitrary file reading and Java server pages, JSP, processing.
1025880	1032380	It means real-world command execution.
1032580	1038820	And, of course, there is AGP shooter to exploit it.
1038820	1044660	We are going to start using proxy chains as long as this tool is not proxy aware.
1044740	1049260	And since now we will be searching for configuration files mainly.
1055510	1060150	Finding an abloved servlet doesn't mean everything is easy.
1060730	1063570	Let's review that servlet source code.
1064490	1075090	Again, getting the file with AGP shooter, we found the abloved directory.
1075990	1080650	And it has some security control.
1080830	1087950	It accepts only JPJ or PNJ extensions.
1092360	1097520	So, we are going to use a simple web shell to start.
1097700	1100600	We don't want web shell with fireworks.
1100740	1109640	First task on arrival is to change the image name station from JPJ to JSP.
1110240	1119780	And remember that Ghostcat allows for JSP processing, but you don't have to use that extension to ask AGP shooter to do that for you.
1122460	1127760	Upload and execute our special image.
1127920	1132020	Just a cure for the upload.
1132560	1139180	And of course, AGP shooter for execution.
1139480	1145120	This script accepts two parameters, read and eval.
1145120	1148010	Eval is for processing the JSP.
1148010	1158330	And as you can see at the bottom of the last image, the first command to execute is rename the JPJ to JSP.
1158530	1165230	So, we start doing enumeration.
1166170	1173150	For example, we are using an account called Tomcat.
1173150	1180110	It's a limited account, no high-level privileges, but we can do some network enumeration.
1180870	1184910	And we are going to search for configuration files.
1185450	1192530	After that, we realize that we need to use an improved web shell.
1192650	1196210	So, we upload this one.
1197510	1209010	Searching through the configuration files, we found another endpoint and more credentials that are not from the cloud instance, neither the Tomcat server.
1209890	1213710	You could ask MySQL in the core.
1213770	1218090	Well, actually it was Oracle, but MySQL was enough for recreation.
1218850	1222790	We are going to connect to this database server.
1222790	1227530	And hopefully we will find the core secrets.
1230510	1237230	Let's use the options of our improved web shell to connect to the database.
1238910	1250110	And when showing databases, we could see that this is not the precious secret we are looking for.
1252240	1263980	Also, this account doesn't have enough privileges, so we have to try harder.
1269130	1277450	Well, we tried harder and found another set of credentials in another configuration file for another application.
1277810	1282150	Same endpoint, but different credentials.
1284810	1289110	Let's try these credentials.
1289670	1300350	And finally, we got the core secrets with maximum privileges.
1300790	1306830	From here, we can dump data and exfiltrate it.
1306830	1311230	We can modify, add or delete databases.
1311230	1315270	We didn't own the domain, we owned the database.
1317130	1319610	So, here are the secrets.
1324190	1326970	Some questions and tips.
1327550	1340270	I guess that someone is monitoring this kind of activity, maybe those application firewalls that are looking for injections or sophisticated malware, not this kind of normal traffic.
1340270	1355290	When we do red teaming, we start with a couple of red teamers, not extra ones as needed, just to have people with enough skills and experience.
1357330	1363710	Indeed, also during pen testing, reviewing source code is a must.
1364970	1373570	Sometimes, developers and admins follow guides strictly and keep some information that is not mandatory to do so.
1374690	1385730	Maybe this is a new kind of default credentials, but we found cases in sample code from howtos in some application's production environment.
1386730	1405190	Just one note, I was kidding when I said that this is normal traffic, but you understand that this is not a kind of sophisticated traffic that we read all the time in the news.
1406910	1414690	Sometimes, it works better because protection devices are waiting for that sophisticated traffic.
1415430	1418190	So, what's next?
1419450	1428590	At least for us, main objectives are doing a red team exercise, is to test the time to detect and time to mitigate.
1428590	1440330	But let's face it, most organizations just want to have an almost real-world experience with attackers, and real ones are looking for ways to get money from their attacks or some kind of power.
1440330	1445830	So, let's think as them and elaborate ways to exploit the information.
1446790	1454450	To keep everything organized, we have to add this initial compromise with our C2, my favorite one is push, of course.
1454450	1463670	There are command executions in a couple of jams, maybe it could be useful for lateral movement.
1470260	1477940	Let's move on to case 2, dynamic duo.
1483100	1490020	Remote access is required, before COVID-19 it was needed and after this is a must.
1490280	1494300	But how is this kind of service related to applications?
1494440	1506780	Well, as long as these services use protocols like HTTPS, as long as the users and admins use their browser to do their thing,
1506780	1514980	as long as these interfaces are using HTML, JavaScript and running CGI and several scripting languages,
1515600	1521180	as long as they bleed also, I mean, they have common application vulnerabilities also.
1522700	1526960	This is our scenario for this case.
1526960	1541380	This company has two remote access servers, Y, migration, backup, both integrated with Active Directory, a perimeter with some good protection.
1542080	1550860	They can't work together, we are going to see how.
1550860	1560900	By the way, this will be the traditional red teaming, getting domain admin from the beginning.
1563260	1576920	Let's find out what is the origin of these vulnerabilities, or when we realized that these vulnerabilities exist.
1576920	1585060	Last year, these researchers showed several vulnerabilities they discovered on SSL VPN appliances.
1585380	1588720	After that, exploits started to appear.
1589200	1602980	But, as every people that knows how to use a GAN, this is not just point and shoot, you have to know how your GAN works, how your tool works, and take care of your GAN or your tool.
1606260	1613460	In the more traditional service, there are always several exit paths to command execution.
1614220	1624300	So, let's start with one of them, Pulse Connect Secure.
1624300	1631420	One of the vulnerable appliances showed last year was this Pulse Connect Secure.
1631420	1633660	There are several versions affected.
1633660	1639100	Again, we found an administrative interface exposed to internet.
1639120	1659080	We have several credentials to try coming from recognition, but maybe doing some kind of password spray to this device could start the alerts.
1659080	1676060	So, maybe we shouldn't try them, and we are going to do some kind of special recognition in the way that we tested applications.
1676280	1681460	Why don't we try with a proxy like Burp?
1682400	1691500	As in case one, we keep updated, reading, viewing and listening a lot of information. Actually, we like that a lot.
1691500	1700300	So, checking if this device is vulnerable to pre-authentication, arbitrary file reading is as easy as to send a request.
1700420	1707600	We are using Burp just because it is our favorite tool for applications security testing.
1707600	1712920	And as we can see, this appliance is vulnerable.
1713060	1734000	We are reading files like PulseWD with a list of users and several other files, such as the one with a host registered manually in this file.
1734000	1736980	So, this device is vulnerable.
1737220	1749480	And we are going to use a script, which Fox made a bash script to exploit this vulnerability.
1749780	1759560	Also, we want to give a small recognition to all these young people helping others automating the exploitation.
1759560	1769560	That's the reason of that small white message there.
1769820	1773720	This script will download several files.
1774220	1779980	Some are pure plain text and some are data structured in another format.
1779980	1791760	All contain critical information, case, usernames, passwords, IP addresses, operating systems of users and so on.
1792440	1808880	For example, we got local users that are active directory users if the appliance is integrated with that directory service.
1808880	1818080	And also VPN logins that are usernames with passwords all in plain text.
1818180	1829340	Yes, 2020 there are still security appliances storing credentials in just plain or clear text.
1829340	1844660	Also, we got SSH keys, but we are not going to use them because external firewall is doing its job very good.
1844980	1853020	So, we have another group of information.
1855280	1857920	We got clear text credentials.
1858920	1864220	And we got inside Pulse Connect Secure with user level credentials.
1864220	1867240	Just that, just loose user level.
1868060	1872020	That's not too much to do with that.
1872380	1880040	But some usernames have a kind of active directory look and feel.
1880520	1882520	And they weren't on clear text.
1882520	1887900	We got the hashes of the passwords.
1887900	1891680	So, John the Ripper came and did its thing.
1892180	1893720	Cracked hashes.
1894640	1901120	And after that, we got access as user.
1901700	1907720	Also, not too much applications delivered for end users.
1908040	1910120	And as admin.
1917100	1929880	So, doing more checks, there is integration with active directory enabled.
1929880	1933940	As we can see with these authentication servers.
1934640	1942280	And for that integration, of course, you need an account to access the active directory.
1942280	1947260	An administrator level account for active directory.
1947260	1950400	So, we got domain admin.
1952100	1961540	And yes, as you can guess, there is credential reuse in this organization also.
1962520	1966580	But then, this thing doesn't stop here.
1966580	1973660	Because this software is also vulnerable to command execution.
1974860	1980640	So, after doing some enumeration of users.
1981100	1988980	And testing if we can reach the domain controllers of this active directory.
1989660	1993660	We went for command execution.
1993660	1999040	For this, we need credentials. We have those credentials.
1999260	2002680	Because this vulnerability is post-authentication.
2002680	2006360	We can inject commands and execute.
2006360	2008480	There is a public exploit.
2009120	2012980	This is another exploit made in Python.
2013360	2017460	And what it does is take credentials we got.
2017460	2023900	And do the magic to allow us to connect to the appliance by SSH.
2024240	2030500	What it does is download our SSH case to the appliance.
2031040	2036080	But there is a firewall, as I said, that doesn't allow to connect by SSH.
2036080	2043260	So, we have to do small modifications to the script in order to use it.
2044920	2049060	As you can see, just comment some lines.
2049540	2051260	And add parameter manipulation.
2051260	2057340	Plus, we are going to use burp for the output.
2058060	2060780	This script is proxy-aware for debugging purposes.
2060780	2064700	So, we don't have to add anything about that.
2064780	2070560	And now, we are executing commands on the appliance.
2071400	2075660	So, question arises, is this enough?
2077740	2078580	Well...
2078580	2087880	As there is a robin for every badman or vice versa.
2088900	2091160	We got PulseConnect secure.
2091160	2094840	And it has Citrix right by its side.
2095200	2099940	That was perfect for us because having only one foot inside.
2099940	2102040	Is not enough.
2105910	2108270	And... guess what?
2108410	2110630	Credential reuse is everywhere.
2110970	2116350	We got access with same credentials as the ones in the other appliance.
2117150	2122450	Of course, they are Active Directory integrated.
2123070	2127350	And in this case, it has more applications deployed.
2127350	2131610	And we started to check one by one.
2133370	2141910	Special focus in traditional Windows applications delivered using distinct clients.
2141910	2146850	Because there are several ways to escape to Windows Command Shell or PowerShell.
2146850	2151490	So, this application looks as the one we are looking for.
2151810	2156950	As you can see, it loads an instance of Windows.
2158250	2161210	This is the application starting.
2161890	2167230	And this is the application login pop-up.
2171110	2179330	Escaping from Citrix jail has a long history from several years ago until today.
2179330	2184390	At first, it is based on pressing some keys on the keyboard.
2184390	2190590	For example, in this case, pressing CTRL plus ALT plus DELETE does a trick.
2191230	2199710	In other cases, WINDOWS STICKY KEYS, pressing SHIFT five times or ICA KEYS from Citrix.
2200330	2211090	To gain access to CMD or PowerShell, you can use dialogs such as FILE AND OPEN or FILE AND NEW TASK from Task Manager as you will see.
2211090	2215350	There are more on this to bypass file restrictions.
2215350	2222340	There are several documents showing how to do that.
2224170	2237420	So, TASK MANAGER, NEW TASK, CMD EXE and we got CMD in action.
2238900	2249770	From there on, we did some enumeration, classic WINDOWS and AD enumeration.
2250120	2254450	But more important, search for valuable information.
2255500	2266380	To tell the truth, you can see that we found here some files with credentials and IP addresses.
2266380	2275800	But in this case, we just confirmed that this kind of information was accurate and updated.
2275800	2283840	Because we got this information in one repository on GitHub during recognition.
2287750	2296730	After this, we are going to see the light in terms of infrastructure penetration.
2297450	2301070	Because good network segmentation is still a dream.
2301630	2306230	There are yet several exceptions breaking ACLs.
2306230	2311030	And in 2020 is not true that only end-users are good victims.
2311410	2320610	We are going to try to shoot to developers, internal and external ones, IT people and security people.
2320610	2325870	Why? Because they have more power on their machines than end-users.
2325870	2327510	As simple as that.
2331920	2349270	Some tips about this kind of initial compromise.
2349940	2352960	We have two doors opened.
2353960	2359440	In that moment, it was important to warn the customer about that.
2360440	2363500	The customer had to warn the subguides.
2363500	2368920	Also the prevention, correlation and event management solutions had to be warned.
2369120	2374300	It is important to be as smooth as possible.
2375140	2386580	But there are some cases that you cannot wait to end the redteam exercise to warn the customer.
2386580	2398880	Also, as part of these smooth actions, you should avoid to create accounts.
2398880	2402780	At least not god-level ones.
2402780	2408760	It is better to use a simple user account and give power to that account.
2408760	2416910	In some situations it won't be possible, so do that, create an account after several checks.
2417420	2419890	Always keep logs in mind.
2421020	2428800	And of course, delete just entries belonging to your work.
2429240	2433840	Remember to never underestimate to your adversary.
2433840	2443100	Be patient, this is not a game, and this is the reason why redteam exercises has enough time.
2443620	2445280	Have fun, of course.
2446320	2453880	Finally, I want to thank Omar and all the crew at Redteam Village.
2454000	2461000	They do an awesome job all the time, just for giving back to the community.
2461000	2461240	Ciao!