WEBVTT 00:00.970 --> 00:06.050 My name is Walter Cuestas and I'm from Peru in South America. 00:06.170 --> 00:12.550 I'm going to talk about a vector that is not very commented or used at red teaming exercises. 00:13.110 --> 00:17.410 And this is about using applications as the initial compromise. 00:19.230 --> 00:22.910 The not so classic Juanma in this case. 00:23.070 --> 00:29.710 I want to point out that everything I'm going to explain is what we've learned with the team I belong to. 00:29.710 --> 00:36.150 We are working together for several years doing pen testing and red teaming. 00:36.150 --> 00:38.980 Actually in some cases for more than 12 years. 00:39.390 --> 00:43.890 So you will see some examples of our collective effort. 00:45.010 --> 00:49.190 And the question may arise, why two applications? 00:49.690 --> 00:51.710 There are several reasons. 00:52.010 --> 00:58.630 Because we believe that red teaming is not only about getting domain admin or root. 00:58.630 --> 01:03.070 Because not always having that power means you can access data. 01:03.070 --> 01:07.330 Not every application is integrated with Active Directory for example. 01:08.030 --> 01:12.830 After some interaction with people on shares of threat management and hunting. 01:13.170 --> 01:16.390 They are so concentrated on AD and Windows 7. 01:17.070 --> 01:22.950 Organizations are not integrating application security yet in their effort to enhance security. 01:23.590 --> 01:28.470 Also defenders are always pushed to be warned about social engineering attacks. 01:28.470 --> 01:31.910 Or how attackers are bypassing endpoint security. 01:31.950 --> 01:38.290 Or the last password spray technique to common services such as email. 01:38.870 --> 01:43.710 Someone could say that applications today are in the cloud. 01:44.550 --> 01:50.310 But we are seeing that few companies are migrating their core to the cloud. 01:50.330 --> 01:55.850 They still keep it on-premises and modern applications just need to go down to the core. 01:55.850 --> 02:05.990 And finally, because as all of us know, remote access services are delivered through web applications. 02:07.390 --> 02:13.110 One more reason, besides this happens in every other aspect of security. 02:13.170 --> 02:17.650 Is that applications suffer of the same problems for a long time. 02:17.730 --> 02:21.030 As you can see in this image from exploit.db. 02:21.030 --> 02:26.430 This is not only true for common applications, but also for embedded ones. 02:26.470 --> 02:31.190 We can see a Cisco device suffering from local file inclusion. 02:31.510 --> 02:37.090 And a very old kind of vulnerability in the application field. 02:40.360 --> 02:43.480 We want to share this small framework. 02:43.700 --> 02:52.140 We developed it just to have an order in what we do during regular exercises. 02:52.140 --> 02:59.300 I am not going to cover every module, just some high level about information gathering and enumeration. 02:59.300 --> 03:02.680 And more on initial compromise, of course. 03:03.520 --> 03:09.780 So let's talk about recognition and especially about OSINT. 03:10.400 --> 03:17.220 As you know there are tons of tips, sources and how-tos about OSINT. 03:17.220 --> 03:20.600 We want to focus in some aspects. 03:20.600 --> 03:23.580 Searching DNS information is crucial. 03:24.000 --> 03:29.480 And it is important to know that we don't have to select just one tool for that task. 03:29.600 --> 03:35.740 Indeed, most of the time we have to aggregate the results from several of them. 03:37.320 --> 03:48.900 Search engines, such as Shodan, Census, Sunmine for example, are most useful here. 03:48.900 --> 03:54.500 Because we don't have to touch our target at first step. 03:54.500 --> 03:58.600 And these engines keep current data most of the time. 03:59.120 --> 04:04.460 Also, today a good search on surface internet is better than going deep. 04:04.460 --> 04:14.420 And special attention must be on source code leaked in the most innocent and honest ways by developers. 04:14.440 --> 04:19.400 And documents that you have to read very long documents. 04:20.300 --> 04:25.680 So, we have a lot of tools and a lot of data. 04:26.820 --> 04:29.540 And let's talk about real world. 04:29.540 --> 04:32.260 There is no magic neither perfect tool. 04:32.260 --> 04:38.380 And there is no way to learn about our target organization without doing manual investigation. 04:38.380 --> 04:44.360 Spending hours reading information and taking notes that we will share with the team. 04:44.960 --> 04:49.080 Another fun moment is when tool is not working as expected. 04:49.180 --> 04:51.300 Or we need more from it. 04:51.300 --> 04:57.700 That's when our developer skills are important and we start to feel happy. 05:01.060 --> 05:12.260 After a bunch of data, you need to give some form of order to this data to do your analysis. 05:12.260 --> 05:14.480 And it could be very simple. 05:14.580 --> 05:17.640 Just use human readable names for directories and files. 05:17.640 --> 05:21.440 I mean, not only for you, for the whole team. 05:21.880 --> 05:26.480 And you need to do a simple select to get data including images. 05:26.680 --> 05:35.980 There are very good tools, but if you don't have time or just don't want to install them, SQLite is a very good option. 05:38.040 --> 05:41.020 Then, what do we reckon? 05:41.020 --> 05:48.980 For us, the most important rule is not to underestimate your adversary. 05:48.980 --> 05:51.320 Who is your adversary? 05:51.320 --> 05:53.220 The blue guys, of course. 05:53.540 --> 06:03.360 We believe that not every admin is fool and not every developer makes applications without security in mind. 06:03.360 --> 06:07.580 And not every threat hunter is just looking for a DE event. 06:07.580 --> 06:09.300 At least I guess so. 06:09.300 --> 06:16.640 As we are going after applications, there will be a moment to scam something in a very smooth way. 06:17.060 --> 06:20.100 Not now, as blue team is expecting that. 06:20.780 --> 06:26.740 Also, we are going to use the same techniques and tools as when testing applications. 06:26.780 --> 06:34.600 But we have to forget about OWASP, for example, because this is not a pentest neither a bug bounty. 06:37.120 --> 06:40.380 Let's start with initial compromise. 06:40.380 --> 06:46.560 And a small note about these cases that came from real world. 06:46.560 --> 06:53.480 In one case, we were able to create the same scenario we found in another one not. 06:53.480 --> 07:01.160 The main reason is that we don't get the same applications versions of the ones that we got during red team exercises. 07:01.980 --> 07:06.000 So, case 1 is here, we call it jumping. 07:07.120 --> 07:10.280 Because we are going to jump several times. 07:10.280 --> 07:14.020 The scenario is like this. 07:14.160 --> 07:20.060 This is a very common scenario where an organization is using cloud for new applications. 07:20.100 --> 07:23.160 Hybrid cloud may be the right name. 07:23.540 --> 07:28.400 We have the frontend of the application, the cloud, with a database. 07:28.820 --> 07:33.780 But it needs data also from the business core applications. 07:34.080 --> 07:37.120 And data that are still on-premises. 07:37.120 --> 07:43.520 We are looking for the secrets on that core because it's the most valuable information. 07:43.780 --> 07:51.120 And as happens today, there are so many digital transformation projects and few security controls. 07:51.120 --> 07:53.200 Everything is sales-driven. 07:56.800 --> 08:03.820 I know that this seems like a hack the box case, but it's not. 08:03.820 --> 08:15.300 Our first security test for digital transformation projects showed us that there is no control over the initiatives coming from different teams in the same organization. 08:15.480 --> 08:21.050 So, our recognition found this exposed Jenkins administrative interface. 08:21.560 --> 08:26.020 In fact, it's exposed to the internet. 08:26.100 --> 08:31.120 With the option to create an account which is not a default. 08:31.120 --> 08:33.960 This is not a surprise. 08:34.020 --> 08:37.520 This is a very well-known issue. 08:38.140 --> 08:44.860 But, what is bad is that by default, locating users can do anything. 08:45.760 --> 08:56.320 Having this in mind, let's take a look at the credentials section where we found this case. 08:56.320 --> 09:06.350 One for SSH access and the other one to get access to the cloud. 09:09.580 --> 09:15.770 One is an Amazon XSK, but this is not enough. 09:17.700 --> 09:21.820 We need also the secret XSK. 09:21.820 --> 09:26.820 As you can see, it seems this is properly secured. 09:28.480 --> 09:41.620 One of the things we learned from doing pentesting on applications is that client-side source code is something we always want to review. 09:42.320 --> 09:49.920 Just use developer or inspect mode and you will find not only HTML and common JavaScript. 09:50.200 --> 09:55.180 There are still developers that trust on client-side protections. 09:55.180 --> 10:03.180 And not exactly related comment for this slide. 10:03.180 --> 10:07.580 Today JavaScript is very powerful at client-side. 10:07.580 --> 10:11.540 So, there are more reasons to review that code. 10:12.060 --> 10:17.340 But, as we can see, this case is encrypted. 10:18.220 --> 10:26.500 So, let's move on and check the SSH key to gain remote access. 10:27.560 --> 10:34.300 But, once again, this key is also encrypted. 10:35.500 --> 10:46.580 Now, Averik, today there are tons of information that we want and like, of course, to read, view and listen. 10:46.580 --> 10:52.980 And when talking about writing, there are no magic scanner working for us. 10:52.980 --> 11:02.080 But, there are several cases where you won't find any previous information and this is when you get a research moment. 11:05.300 --> 11:11.360 Jenkins itself needs a way to decrypt that information in order to use it. 11:11.940 --> 11:16.560 And it has an option to run a script that we are going to use. 11:16.560 --> 11:24.460 As you can see, Jenkins provides all we need to do our job. 11:28.010 --> 11:34.070 A small and simple script will do the magic. 11:34.790 --> 11:40.230 And, voila, we got our case decrypted. 11:45.180 --> 11:55.280 So, we use them to access the cloud with the same privileges as this project Jenkins have. 11:55.280 --> 11:59.720 Will be them for production environment? 12:00.400 --> 12:03.460 Well, let's take a look. 12:03.460 --> 12:14.740 It seems clear that we are looking for instances as long as these credentials are used in an application project. 12:14.740 --> 12:19.740 We found the information of an instance and the corresponding IP address. 12:20.400 --> 12:22.560 Let's check it. 12:23.600 --> 12:28.880 Well, it's obvious that this is not our target. 12:28.880 --> 12:35.920 Maybe we can use it for our first jump, but it's not what we are looking for. 12:38.520 --> 12:42.720 Let's try with the other kind of access. 12:42.880 --> 12:48.560 I mean, accessing by SSH. 12:49.980 --> 12:59.440 And we are to focus this time on searching source code and review this code. 12:59.440 --> 13:05.600 So, we start using the SSH key we got. 13:05.600 --> 13:10.740 And we got access to the cloud by SSH. 13:10.740 --> 13:13.740 And start to search for code. 13:13.960 --> 13:16.500 And we found some programs here. 13:19.080 --> 13:35.780 The first element to search, we are looking for endpoint information as long as they will show us some new paths, maybe credentials. 13:37.500 --> 13:40.960 And we got this config file. 13:41.840 --> 13:53.860 As I said, we can see that we got an endpoint and a set of credentials, username and pass. 13:54.060 --> 14:04.080 And, of course, the API text means that we have information to access an API. 14:04.480 --> 14:09.120 And, of course, it will be a RESTful API. 14:14.070 --> 14:18.190 Checking from inside the cloud. 14:18.790 --> 14:22.970 We use a cure and we got an answer. 14:23.150 --> 14:26.510 So, endpoint exists and could be working. 14:27.150 --> 14:29.650 Also, we got a redirection. 14:30.570 --> 14:34.990 And take a look that there is a cookie with a JSession ID. 14:35.070 --> 14:39.550 It smells to Java, besides the code analyzed was PHP. 14:39.550 --> 14:45.730 But we need to be more comfortable with a browser and other tools. 14:46.230 --> 15:07.490 So, using this SSH connection as a proxy and configuring our browser, we can see that we are identified with the IP from the instance. 15:13.810 --> 15:24.670 Also, when browsing an API URL, we got another application related directly to the previous one and the API. 15:26.770 --> 15:31.010 But we have no access to other databases. 15:31.570 --> 15:35.790 Only the API is exposed to the cloud instances. 15:36.290 --> 15:38.830 Just from the cloud instances. 15:38.830 --> 15:45.910 Our real target is on-premises with core applications, the legacy ones. 15:47.850 --> 15:52.130 Do you remember the JSession ID cookie? 15:52.130 --> 16:01.830 Well, that and the app server listening at 8080 port seems pretty much like Tomcat. 16:02.830 --> 16:11.950 It's better to make regular traffic with a browser or cure to do banner grabbing. 16:12.970 --> 16:19.010 I mean, we are not going to use our nmap, for example. 16:19.850 --> 16:31.810 And checking Tomcat related ports, we found 8009 port open for the Apache JServe protocol. 16:31.810 --> 16:45.670 This AGP is a binary protocol mainly used for reverse proxy between front-end web server and back-end application server, such as Apache and Tomcat itself. 16:46.110 --> 16:50.160 It's shorter, faster and, of course, vulnerable. 16:51.480 --> 17:05.440 Ghostcat was announced this year and this vulnerability allows arbitrary file reading and Java server pages, JSP, processing. 17:05.880 --> 17:12.380 It means real-world command execution. 17:12.580 --> 17:18.820 And, of course, there is AGP shooter to exploit it. 17:18.820 --> 17:24.660 We are going to start using proxy chains as long as this tool is not proxy aware. 17:24.740 --> 17:29.260 And since now we will be searching for configuration files mainly. 17:35.510 --> 17:40.150 Finding an abloved servlet doesn't mean everything is easy. 17:40.730 --> 17:43.570 Let's review that servlet source code. 17:44.490 --> 17:55.090 Again, getting the file with AGP shooter, we found the abloved directory. 17:55.990 --> 18:00.650 And it has some security control. 18:00.830 --> 18:07.950 It accepts only JPJ or PNJ extensions. 18:12.360 --> 18:17.520 So, we are going to use a simple web shell to start. 18:17.700 --> 18:20.600 We don't want web shell with fireworks. 18:20.740 --> 18:29.640 First task on arrival is to change the image name station from JPJ to JSP. 18:30.240 --> 18:39.780 And remember that Ghostcat allows for JSP processing, but you don't have to use that extension to ask AGP shooter to do that for you. 18:42.460 --> 18:47.760 Upload and execute our special image. 18:47.920 --> 18:52.020 Just a cure for the upload. 18:52.560 --> 18:59.180 And of course, AGP shooter for execution. 18:59.480 --> 19:05.120 This script accepts two parameters, read and eval. 19:05.120 --> 19:08.010 Eval is for processing the JSP. 19:08.010 --> 19:18.330 And as you can see at the bottom of the last image, the first command to execute is rename the JPJ to JSP. 19:18.530 --> 19:25.230 So, we start doing enumeration. 19:26.170 --> 19:33.150 For example, we are using an account called Tomcat. 19:33.150 --> 19:40.110 It's a limited account, no high-level privileges, but we can do some network enumeration. 19:40.870 --> 19:44.910 And we are going to search for configuration files. 19:45.450 --> 19:52.530 After that, we realize that we need to use an improved web shell. 19:52.650 --> 19:56.210 So, we upload this one. 19:57.510 --> 20:09.010 Searching through the configuration files, we found another endpoint and more credentials that are not from the cloud instance, neither the Tomcat server. 20:09.890 --> 20:13.710 You could ask MySQL in the core. 20:13.770 --> 20:18.090 Well, actually it was Oracle, but MySQL was enough for recreation. 20:18.850 --> 20:22.790 We are going to connect to this database server. 20:22.790 --> 20:27.530 And hopefully we will find the core secrets. 20:30.510 --> 20:37.230 Let's use the options of our improved web shell to connect to the database. 20:38.910 --> 20:50.110 And when showing databases, we could see that this is not the precious secret we are looking for. 20:52.240 --> 21:03.980 Also, this account doesn't have enough privileges, so we have to try harder. 21:09.130 --> 21:17.450 Well, we tried harder and found another set of credentials in another configuration file for another application. 21:17.810 --> 21:22.150 Same endpoint, but different credentials. 21:24.810 --> 21:29.110 Let's try these credentials. 21:29.670 --> 21:40.350 And finally, we got the core secrets with maximum privileges. 21:40.790 --> 21:46.830 From here, we can dump data and exfiltrate it. 21:46.830 --> 21:51.230 We can modify, add or delete databases. 21:51.230 --> 21:55.270 We didn't own the domain, we owned the database. 21:57.130 --> 21:59.610 So, here are the secrets. 22:04.190 --> 22:06.970 Some questions and tips. 22:07.550 --> 22:20.270 I guess that someone is monitoring this kind of activity, maybe those application firewalls that are looking for injections or sophisticated malware, not this kind of normal traffic. 22:20.270 --> 22:35.290 When we do red teaming, we start with a couple of red teamers, not extra ones as needed, just to have people with enough skills and experience. 22:37.330 --> 22:43.710 Indeed, also during pen testing, reviewing source code is a must. 22:44.970 --> 22:53.570 Sometimes, developers and admins follow guides strictly and keep some information that is not mandatory to do so. 22:54.690 --> 23:05.730 Maybe this is a new kind of default credentials, but we found cases in sample code from howtos in some application's production environment. 23:06.730 --> 23:25.190 Just one note, I was kidding when I said that this is normal traffic, but you understand that this is not a kind of sophisticated traffic that we read all the time in the news. 23:26.910 --> 23:34.690 Sometimes, it works better because protection devices are waiting for that sophisticated traffic. 23:35.430 --> 23:38.190 So, what's next? 23:39.450 --> 23:48.590 At least for us, main objectives are doing a red team exercise, is to test the time to detect and time to mitigate. 23:48.590 --> 24:00.330 But let's face it, most organizations just want to have an almost real-world experience with attackers, and real ones are looking for ways to get money from their attacks or some kind of power. 24:00.330 --> 24:05.830 So, let's think as them and elaborate ways to exploit the information. 24:06.790 --> 24:14.450 To keep everything organized, we have to add this initial compromise with our C2, my favorite one is push, of course. 24:14.450 --> 24:23.670 There are command executions in a couple of jams, maybe it could be useful for lateral movement. 24:30.260 --> 24:37.940 Let's move on to case 2, dynamic duo. 24:43.100 --> 24:50.020 Remote access is required, before COVID-19 it was needed and after this is a must. 24:50.280 --> 24:54.300 But how is this kind of service related to applications? 24:54.440 --> 25:17.380 Well, as long as these services use protocols like HTTPS, as long as the users and admins use their browser to do their thing, as long as these interfaces are using HTML, JavaScript and running CGI and several scripting languages, as long as they bleed also, 25:17.380 --> 25:21.180 I mean, they have common application vulnerabilities also. 25:22.700 --> 25:26.960 This is our scenario for this case. 25:26.960 --> 25:41.380 This company has two remote access servers, Y, migration, backup, both integrated with Active Directory, a perimeter with some good protection. 25:42.080 --> 25:50.860 They can't work together, we are going to see how. 25:50.860 --> 26:00.900 By the way, this will be the traditional red teaming, getting domain admin from the beginning. 26:03.260 --> 26:16.920 Let's find out what is the origin of these vulnerabilities, or when we realized that these vulnerabilities exist. 26:16.920 --> 26:25.060 Last year, these researchers showed several vulnerabilities they discovered on SSL VPN appliances. 26:25.380 --> 26:28.720 After that, exploits started to appear. 26:29.200 --> 26:42.980 But, as every people that knows how to use a GAN, this is not just point and shoot, you have to know how your GAN works, how your tool works, and take care of your GAN or your tool. 26:46.260 --> 26:53.460 In the more traditional service, there are always several exit paths to command execution. 26:54.220 --> 27:04.300 So, let's start with one of them, Pulse Connect Secure. 27:04.300 --> 27:11.420 One of the vulnerable appliances showed last year was this Pulse Connect Secure. 27:11.420 --> 27:13.660 There are several versions affected. 27:13.660 --> 27:19.100 Again, we found an administrative interface exposed to internet. 27:19.120 --> 27:39.080 We have several credentials to try coming from recognition, but maybe doing some kind of password spray to this device could start the alerts. 27:39.080 --> 27:56.060 So, maybe we shouldn't try them, and we are going to do some kind of special recognition in the way that we tested applications. 27:56.280 --> 28:01.460 Why don't we try with a proxy like Burp? 28:02.400 --> 28:09.260 As in case one, we keep updated, reading, viewing and listening a lot of information. 28:09.260 --> 28:11.500 Actually, we like that a lot. 28:11.500 --> 28:20.300 So, checking if this device is vulnerable to pre-authentication, arbitrary file reading is as easy as to send a request. 28:20.420 --> 28:27.600 We are using Burp just because it is our favorite tool for applications security testing. 28:27.600 --> 28:32.920 And as we can see, this appliance is vulnerable. 28:33.060 --> 28:54.000 We are reading files like PulseWD with a list of users and several other files, such as the one with a host registered manually in this file. 28:54.000 --> 28:56.980 So, this device is vulnerable. 28:57.220 --> 29:09.480 And we are going to use a script, which Fox made a bash script to exploit this vulnerability. 29:09.780 --> 29:19.560 Also, we want to give a small recognition to all these young people helping others automating the exploitation. 29:19.560 --> 29:29.560 That's the reason of that small white message there. 29:29.820 --> 29:33.720 This script will download several files. 29:34.220 --> 29:39.980 Some are pure plain text and some are data structured in another format. 29:39.980 --> 29:51.760 All contain critical information, case, usernames, passwords, IP addresses, operating systems of users and so on. 29:52.440 --> 30:08.880 For example, we got local users that are active directory users if the appliance is integrated with that directory service. 30:08.880 --> 30:18.080 And also VPN logins that are usernames with passwords all in plain text. 30:18.180 --> 30:29.340 Yes, 2020 there are still security appliances storing credentials in just plain or clear text. 30:29.340 --> 30:44.660 Also, we got SSH keys, but we are not going to use them because external firewall is doing its job very good. 30:44.980 --> 30:53.020 So, we have another group of information. 30:55.280 --> 30:57.920 We got clear text credentials. 30:58.920 --> 31:04.220 And we got inside Pulse Connect Secure with user level credentials. 31:04.220 --> 31:07.240 Just that, just loose user level. 31:08.060 --> 31:12.020 That's not too much to do with that. 31:12.380 --> 31:20.040 But some usernames have a kind of active directory look and feel. 31:20.520 --> 31:22.520 And they weren't on clear text. 31:22.520 --> 31:27.900 We got the hashes of the passwords. 31:27.900 --> 31:31.680 So, John the Ripper came and did its thing. 31:32.180 --> 31:33.720 Cracked hashes. 31:34.640 --> 31:41.120 And after that, we got access as user. 31:41.700 --> 31:47.720 Also, not too much applications delivered for end users. 31:48.040 --> 31:50.120 And as admin. 31:57.100 --> 32:09.880 So, doing more checks, there is integration with active directory enabled. 32:09.880 --> 32:13.940 As we can see with these authentication servers. 32:14.640 --> 32:22.280 And for that integration, of course, you need an account to access the active directory. 32:22.280 --> 32:27.260 An administrator level account for active directory. 32:27.260 --> 32:30.400 So, we got domain admin. 32:32.100 --> 32:41.540 And yes, as you can guess, there is credential reuse in this organization also. 32:42.520 --> 32:46.580 But then, this thing doesn't stop here. 32:46.580 --> 32:53.660 Because this software is also vulnerable to command execution. 32:54.860 --> 33:00.640 So, after doing some enumeration of users. 33:01.100 --> 33:08.980 And testing if we can reach the domain controllers of this active directory. 33:09.660 --> 33:13.660 We went for command execution. 33:13.660 --> 33:17.040 For this, we need credentials. 33:17.040 --> 33:19.040 We have those credentials. 33:19.260 --> 33:22.680 Because this vulnerability is post-authentication. 33:22.680 --> 33:26.360 We can inject commands and execute. 33:26.360 --> 33:28.480 There is a public exploit. 33:29.120 --> 33:32.980 This is another exploit made in Python. 33:33.360 --> 33:37.460 And what it does is take credentials we got. 33:37.460 --> 33:43.900 And do the magic to allow us to connect to the appliance by SSH. 33:44.240 --> 33:50.500 What it does is download our SSH case to the appliance. 33:51.040 --> 33:56.080 But there is a firewall, as I said, that doesn't allow to connect by SSH. 33:56.080 --> 34:03.260 So, we have to do small modifications to the script in order to use it. 34:04.920 --> 34:09.060 As you can see, just comment some lines. 34:09.540 --> 34:11.260 And add parameter manipulation. 34:11.260 --> 34:17.340 Plus, we are going to use burp for the output. 34:18.060 --> 34:20.780 This script is proxy-aware for debugging purposes. 34:20.780 --> 34:24.700 So, we don't have to add anything about that. 34:24.780 --> 34:30.560 And now, we are executing commands on the appliance. 34:31.400 --> 34:35.660 So, question arises, is this enough? 34:37.740 --> 34:38.580 Well... 34:38.580 --> 34:47.880 As there is a robin for every badman or vice versa. 34:48.900 --> 34:51.160 We got PulseConnect secure. 34:51.160 --> 34:54.840 And it has Citrix right by its side. 34:55.200 --> 34:59.940 That was perfect for us because having only one foot inside. 34:59.940 --> 35:02.040 Is not enough. 35:05.910 --> 35:08.270 And... guess what? 35:08.410 --> 35:10.630 Credential reuse is everywhere. 35:10.970 --> 35:16.350 We got access with same credentials as the ones in the other appliance. 35:17.150 --> 35:22.450 Of course, they are Active Directory integrated. 35:23.070 --> 35:27.350 And in this case, it has more applications deployed. 35:27.350 --> 35:31.610 And we started to check one by one. 35:33.370 --> 35:41.910 Special focus in traditional Windows applications delivered using distinct clients. 35:41.910 --> 35:46.850 Because there are several ways to escape to Windows Command Shell or PowerShell. 35:46.850 --> 35:51.490 So, this application looks as the one we are looking for. 35:51.810 --> 35:56.950 As you can see, it loads an instance of Windows. 35:58.250 --> 36:01.210 This is the application starting. 36:01.890 --> 36:07.230 And this is the application login pop-up. 36:11.110 --> 36:19.330 Escaping from Citrix jail has a long history from several years ago until today. 36:19.330 --> 36:24.390 At first, it is based on pressing some keys on the keyboard. 36:24.390 --> 36:30.590 For example, in this case, pressing CTRL plus ALT plus DELETE does a trick. 36:31.230 --> 36:39.710 In other cases, WINDOWS STICKY KEYS, pressing SHIFT five times or ICA KEYS from Citrix. 36:40.330 --> 36:51.090 To gain access to CMD or PowerShell, you can use dialogs such as FILE AND OPEN or FILE AND NEW TASK from Task Manager as you will see. 36:51.090 --> 36:55.350 There are more on this to bypass file restrictions. 36:55.350 --> 37:02.340 There are several documents showing how to do that. 37:04.170 --> 37:17.420 So, TASK MANAGER, NEW TASK, CMD EXE and we got CMD in action. 37:18.900 --> 37:29.770 From there on, we did some enumeration, classic WINDOWS and AD enumeration. 37:30.120 --> 37:34.450 But more important, search for valuable information. 37:35.500 --> 37:46.380 To tell the truth, you can see that we found here some files with credentials and IP addresses. 37:46.380 --> 37:55.800 But in this case, we just confirmed that this kind of information was accurate and updated. 37:55.800 --> 38:03.840 Because we got this information in one repository on GitHub during recognition. 38:07.750 --> 38:16.730 After this, we are going to see the light in terms of infrastructure penetration. 38:17.450 --> 38:21.070 Because good network segmentation is still a dream. 38:21.630 --> 38:26.230 There are yet several exceptions breaking ACLs. 38:26.230 --> 38:31.030 And in 2020 is not true that only end-users are good victims. 38:31.410 --> 38:40.610 We are going to try to shoot to developers, internal and external ones, IT people and security people. 38:40.610 --> 38:41.270 Why? 38:41.270 --> 38:45.870 Because they have more power on their machines than end-users. 38:45.870 --> 38:47.510 As simple as that. 38:51.920 --> 39:09.270 Some tips about this kind of initial compromise. 39:09.940 --> 39:12.960 We have two doors opened. 39:13.960 --> 39:19.440 In that moment, it was important to warn the customer about that. 39:20.440 --> 39:23.500 The customer had to warn the subguides. 39:23.500 --> 39:28.920 Also the prevention, correlation and event management solutions had to be warned. 39:29.120 --> 39:34.300 It is important to be as smooth as possible. 39:35.140 --> 39:46.580 But there are some cases that you cannot wait to end the redteam exercise to warn the customer. 39:46.580 --> 39:58.880 Also, as part of these smooth actions, you should avoid to create accounts. 39:58.880 --> 40:02.780 At least not god-level ones. 40:02.780 --> 40:08.760 It is better to use a simple user account and give power to that account. 40:08.760 --> 40:16.910 In some situations it won't be possible, so do that, create an account after several checks. 40:17.420 --> 40:19.890 Always keep logs in mind. 40:21.020 --> 40:28.800 And of course, delete just entries belonging to your work. 40:29.240 --> 40:33.840 Remember to never underestimate to your adversary. 40:33.840 --> 40:43.100 Be patient, this is not a game, and this is the reason why redteam exercises has enough time. 40:43.620 --> 40:45.280 Have fun, of course. 40:46.320 --> 40:53.880 Finally, I want to thank Omar and all the crew at Redteam Village. 40:54.000 --> 41:01.000 They do an awesome job all the time, just for giving back to the community. 41:01.000 --> 41:01.240 Ciao !