1
00:00:01,830 --> 00:00:03,450
Hello, this is Forrest.

2
00:00:03,450 --> 00:00:12,970
I am here to speak to you today about some certain shenanigans that I pull off once a year with hacking college kids and telling you exactly how they do it wrong.

3
00:00:13,170 --> 00:00:15,230
Let's go ahead and get right into the slides.

4
00:00:16,990 --> 00:00:21,590
So, if you want more information about me, you're welcome to look at JRWR.io.

5
00:00:21,590 --> 00:00:23,590
I'd be happy to provide guidance.

6
00:00:23,590 --> 00:00:24,970
I have a contact page and sorts.

7
00:00:24,970 --> 00:00:26,850
You can get a hold of me on Twitter of sorts.

8
00:00:28,770 --> 00:00:32,650
So, what I do... well, I should say, who am I?

9
00:00:32,650 --> 00:00:35,710
Some of you have probably seen me floating around DEF CON before.

10
00:00:36,630 --> 00:00:39,070
I am Hachan, pretty much.

11
00:00:39,070 --> 00:00:41,790
Everybody knows me of this crazy hat of mine.

12
00:00:41,790 --> 00:00:44,230
It's a pith helmet with a Wi-Fi access point on it.

13
00:00:44,230 --> 00:00:46,050
Everybody generally loves it.

14
00:00:46,130 --> 00:00:49,070
But I've done a couple of other weird things over the years.

15
00:00:49,330 --> 00:00:53,630
Right now, I'm a Department of Defense subcontractor, cybersecurity auditor.

16
00:00:53,630 --> 00:00:59,790
So, pretty much, I do audits for small military manufacturers.

17
00:00:59,850 --> 00:01:01,870
You know, they make parts, whatever.

18
00:01:02,150 --> 00:01:04,270
And they do it terribly, usually.

19
00:01:04,890 --> 00:01:06,170
It's rather boring, though.

20
00:01:06,350 --> 00:01:10,530
If you want to look up that in tomfoolery.

21
00:01:11,370 --> 00:01:17,630
At one point, I was a Dogecoin mining pool operator for a fundraiser for the Doge car.

22
00:01:17,630 --> 00:01:18,930
That was also awesome.

23
00:01:18,930 --> 00:01:20,690
And that's also where the pith helmet comes from.

24
00:01:20,690 --> 00:01:21,970
It was way back then.

25
00:01:23,370 --> 00:01:25,790
As you can see, the Doge car was amazing.

26
00:01:25,790 --> 00:01:26,630
You should Google it.

27
00:01:26,630 --> 00:01:33,630
There's some videos out there of me, you know, being chased with a beer cooler because I had to steal it for some ice shenanigans.

28
00:01:35,230 --> 00:01:41,870
But for this talk, the really relevant is that I've been a red team member for NECCDC for about three years now.

29
00:01:42,050 --> 00:01:45,170
It's Northeast Colgate Cyber Defense Competition.

30
00:01:46,890 --> 00:02:00,610
The basics of the competition is that there is a blue team, which is college students, being thrusted into a network of sorts, right?

31
00:02:00,610 --> 00:02:03,630
A standardized business network that they would come across.

32
00:02:03,830 --> 00:02:06,710
And they have to do all the things.

33
00:02:07,590 --> 00:02:13,030
So, it's several teams of students from local regions for the Northeast Corridor.

34
00:02:13,030 --> 00:02:15,950
And there's others for each region.

35
00:02:16,610 --> 00:02:21,390
And so, they're kind of like an emergency blue team, right?

36
00:02:21,390 --> 00:02:30,790
So, they come in and they have to fix the network, whatever's wrong with it, right, to get it stable.

37
00:02:30,790 --> 00:02:34,050
They have a list of services that they have to keep online.

38
00:02:35,650 --> 00:02:43,250
We've already been given about an hour already to attack them as red team before they could even get hands on keyboard the night before.

39
00:02:43,250 --> 00:02:48,870
So, we've got all of our implants in place to make sure they're nice and pwned.

40
00:02:50,910 --> 00:02:53,070
Generally, it's a two-day event.

41
00:02:53,550 --> 00:02:57,370
The red team is a group of chosen pen testers and infosec nerds.

42
00:02:57,710 --> 00:03:06,090
Generally, it's from mostly people who've been working with a professor that's running at Daryl Johnson, at least for the Northeast Corridor.

43
00:03:06,610 --> 00:03:07,790
Daryl's great.

44
00:03:08,030 --> 00:03:13,810
He goes to RIT, Rochester Institute of Technology, and they run the red team.

45
00:03:14,910 --> 00:03:19,370
So, there are other teams of, you know, black and white support as well.

46
00:03:19,370 --> 00:03:30,150
White teams is, you know, people in the rooms that help the teams out, kind of, you know, just basic support roles, filing tickets if something explodes, things of that sort, things get fired.

47
00:03:30,490 --> 00:03:36,690
The black team is the one who actually manages the infrastructure, making sure everything's up and running and such.

48
00:03:36,690 --> 00:03:39,170
They generally have physical hardware that they're dealing with.

49
00:03:39,170 --> 00:03:51,370
The previous one, they did not, of course, because it was virtual, but the last two years, which is what we'll be covering, 2019 to 2018, it was in person, and we could really futz with the hardware, with implants.

50
00:03:52,850 --> 00:04:01,850
So, on top of defending themselves from red team, they also have to do other things that are worth points, and some of it's worth a lot of points, right?

51
00:04:02,450 --> 00:04:04,010
There's incident response, right?

52
00:04:04,010 --> 00:04:17,150
So, they have to write up a report stating that, you know, this is how we were compromised, or this is what happened, you know, this is the current state of the system, this is what we did to fix it, and such.

53
00:04:17,150 --> 00:04:18,690
These are called injects.

54
00:04:19,050 --> 00:04:25,670
Maybe it's a request from the CEO to do something like change his password or allow him VPN access.

55
00:04:25,790 --> 00:04:28,450
Black team's always throwing them new stuff to do.

56
00:04:29,210 --> 00:04:30,530
Those are worth a good amount of points.

57
00:04:30,530 --> 00:04:32,870
Those are considered daily operation stuff, right?

58
00:04:32,870 --> 00:04:39,210
Stuff you'd have to do on a day-to-day basis as somebody who is blue team, or just general IT in the network.

59
00:04:40,630 --> 00:04:56,790
So, then, from there, scoring is really based off of how long red team had access, the reports made, and the services kept alive, and the scoring of the services is automated, and we futz with that as well, you know, ARP spoofing and such.

60
00:04:58,270 --> 00:05:05,790
So, the first hour that we get access to the network, we infect everything.

61
00:05:05,790 --> 00:05:16,470
We have all of their passwords in a table already, so we have scripts in place, first thing we do is hit enter, infects everything that we can get a hold of, and we do all the crazy.

62
00:05:16,790 --> 00:05:27,210
Cobalt strike, which a lot of you might know from your toolkits, was actually written for NECCDC by Raphael Mudge, great guy, by the way, if you ever meet him at DEF CON, he does float around there.

63
00:05:27,890 --> 00:05:30,130
Dude is crazy good at it.

64
00:05:30,130 --> 00:05:45,890
He does these DNS slow burn beacons, so he will stack beacons on top of one another, so he will do these really fast HTTP beacons, but then he will have these beacons for, like, a special domain that he's only registered for this, where it only pulls once every six hours,

65
00:05:45,890 --> 00:05:46,630
right?

66
00:05:46,630 --> 00:05:56,990
So, if they haven't removed it from the system, they're not going to notice the traffic, and then he uses that to pivot more beacons into the system for the faster ones, and that's the ones we work off of generally.

67
00:05:56,990 --> 00:06:01,990
He provides the team server, and we, you know, futz with the system from there.

68
00:06:03,350 --> 00:06:13,630
He does, you know, DNS fronting, IMCP pings, beacons, IPv6-based beacons we've done once before.

69
00:06:13,630 --> 00:06:16,810
That was fun, because the Palo Altos don't filter that very well.

70
00:06:18,910 --> 00:06:36,590
But if you use Cobalt strike, now you know why some of the features are like the way they are, because in all reality, you know, at least from what I understand from Mudge, it was written for NECCDC, and it was solving a problem that Armitage just wasn't solving,

71
00:06:36,590 --> 00:06:37,070
right?

72
00:06:37,070 --> 00:06:45,610
So, he was improving Armitage, and he just got better with it, and he started selling it as a product, because it was a good idea.

73
00:06:46,590 --> 00:06:54,370
You know, we disable the antivirus, infect the networking hardware, you know, the Palo Alto, their switches, their firewalls.

74
00:06:54,370 --> 00:06:56,110
We have access to it all.

75
00:06:56,110 --> 00:06:58,210
So, we just go to town.

76
00:06:58,970 --> 00:07:01,450
You know, we have full access to practically everything.

77
00:07:01,450 --> 00:07:06,070
We have the domain admin password, so we just start deploying everything that we have in our arsenal.

78
00:07:06,730 --> 00:07:15,530
So, if you think of every single piece of kit that you can deploy against what you have as domain admin for persistence, we generally do it, right?

79
00:07:15,530 --> 00:07:17,450
We have a team of about 15.

80
00:07:17,610 --> 00:07:22,870
We're having to manage, I think it was 10 teams last year.

81
00:07:22,870 --> 00:07:25,770
So, we do have to kind of, it really is a high workload.

82
00:07:25,770 --> 00:07:33,570
That's why there's a lot of grouping and stuff like that in Cobalt, is because we have to do it on a per team basis.

83
00:07:33,570 --> 00:07:35,250
We have to score per team.

84
00:07:37,890 --> 00:07:41,010
I personally like doing Linux backdoors, because I'm a Linux nerd.

85
00:07:41,010 --> 00:07:44,670
I do all kinds of footsie things.

86
00:07:45,310 --> 00:07:50,510
For instance, you know, PAM backdoors and things of that sort.

87
00:07:50,510 --> 00:07:52,310
We'll cover that here in a moment.

88
00:07:52,970 --> 00:07:58,610
But we try to keep low, and we watch as teams try to find us, right?

89
00:07:58,610 --> 00:08:03,310
Like, a lot of times, their services just go down, because they're just breaking it for themselves, right?

90
00:08:03,310 --> 00:08:05,010
Like, we're just persisting.

91
00:08:05,670 --> 00:08:11,090
So, what we'll do is steal some passwords.

92
00:08:11,090 --> 00:08:14,390
The Cobalt strike key logger is amazing for this.

93
00:08:14,910 --> 00:08:21,290
We will steal some SSH keys, AWS keys, if they're doing cloud that year.

94
00:08:21,410 --> 00:08:24,890
They love just leaving them on their Linux boxes, right?

95
00:08:24,890 --> 00:08:26,650
Who else are gonna put it?

96
00:08:28,550 --> 00:08:31,250
We'll reinfect using where we can.

97
00:08:31,250 --> 00:08:35,190
Some of the common backdoors that we use, we have an IIS backdoor that was written.

98
00:08:35,710 --> 00:08:39,450
I don't think it's publicly released, but it is signed.

99
00:08:40,450 --> 00:08:48,590
Using unleaked certificates, whenever he actually had a code signing cert, but they wouldn't renew it on them this year.

100
00:08:49,610 --> 00:08:52,890
Some PAM SSH backdoors, we've been using that thing forever.

101
00:08:53,410 --> 00:08:56,990
Still get students, we can just log in with whatever password we want as root.

102
00:08:57,790 --> 00:09:00,170
Bash backdoors, these are my specialty.

103
00:09:00,170 --> 00:09:04,570
I've actually recompiled bash for systems and placed backdoors.

104
00:09:04,570 --> 00:09:09,850
Run an extra curl command and pipe that into whatever.

105
00:09:10,210 --> 00:09:13,030
I've also been doing DNS backdoors that way.

106
00:09:13,550 --> 00:09:17,630
There's an environmental variable that you can set.

107
00:09:17,630 --> 00:09:24,390
I can't remember right offhand, but there's an environmental variable that you can set where it's a callback.

108
00:09:24,390 --> 00:09:30,890
It's supposed to be the missing command callback or just a command callback, and it will run it after every successful command.

109
00:09:31,590 --> 00:09:33,110
So you just run that every time, right?

110
00:09:33,110 --> 00:09:34,550
You set it in the ETC profile.

111
00:09:34,550 --> 00:09:40,730
Nobody ever looks at their environmental variables for compromises, right?

112
00:09:41,710 --> 00:09:43,950
Not for two years at least.

113
00:09:45,010 --> 00:09:48,710
We were piping dig directly into bash for that.

114
00:09:48,730 --> 00:09:54,630
We're doing TXT records and just shoving shell in there and waiting for them to show up on their firewall.

115
00:09:54,630 --> 00:09:56,750
It wasn't like we're encrypting it or anything.

116
00:09:58,450 --> 00:10:03,270
A lot of these times we'll have monitoring in place like Splunk, and we'll just backdoor it.

117
00:10:03,270 --> 00:10:12,950
We had a guy who we call our Splunk nerd, and he has a custom application that he'll attach to their Splunk instance.

118
00:10:13,430 --> 00:10:19,030
And what he'll do is then it'll become his managed instance.

119
00:10:19,030 --> 00:10:26,630
So they're all kind of upstream to a centralized orchestra system, and he just manages everybody's Splunk forum.

120
00:10:26,630 --> 00:10:28,930
So he can do deployment payloads that way.

121
00:10:28,930 --> 00:10:32,190
Most team members don't notice that this is happening.

122
00:10:32,870 --> 00:10:37,930
It's very, very stealthy, and it's great.

123
00:10:37,930 --> 00:10:40,810
From what I understand, the code for it's relatively easy to implement.

124
00:10:40,810 --> 00:10:46,130
You could just take one of the sample applications and just have it be managed by something else.

125
00:10:46,810 --> 00:10:48,890
You're going to play payloads through it.

126
00:10:49,770 --> 00:10:55,950
Most of the time they don't notice it's happening, and you'll see that in some of the screenshots as well, that it's coming down through Splunk.

127
00:10:57,830 --> 00:11:01,590
We'll backdoor the Palo Alto, put our own accounts in.

128
00:11:01,590 --> 00:11:05,490
There's certain hacks that particularly happen with some of the web interface.

129
00:11:05,490 --> 00:11:10,030
They'll add little JavaScript snippets that report home.

130
00:11:10,030 --> 00:11:23,630
A lot of times these get blocked because they're just blocking all HTTP traffic at this point, but we'll actually inject custom theming where it'll send... when they change the password to the web interface, it sends it back to us.

131
00:11:25,530 --> 00:11:30,290
I have a thing where I'll backdoor all the else on a file system.

132
00:11:30,290 --> 00:11:38,010
I'll take BusyBox, full compile it, put the backdoor in there, just runs the command through DNS again.

133
00:11:39,670 --> 00:11:43,890
Compile it, link it all out into the Debian system real fast.

134
00:11:43,890 --> 00:11:50,730
Anytime they run an application at all, it gets compromised, and it links back to the BusyBox parameter.

135
00:11:50,850 --> 00:12:01,650
And I futz with their path a little bit, and I point it, I rearrange it so that it's in like user local bin is first, right?

136
00:12:01,650 --> 00:12:06,070
So you set that first, you throw BusyBox in there, they'll never find it.

137
00:12:06,210 --> 00:12:09,690
Nobody, whoever looks in user local bin, right?

138
00:12:10,470 --> 00:12:16,530
So we'll also do some tomfoolery.

139
00:12:16,530 --> 00:12:26,570
If we notice that they're trying to install detection tools, right, on Windows or Linux, especially on Linux, they'll try to compile stuff, we'll backdoor it.

140
00:12:26,570 --> 00:12:33,670
We have these CBackdoors that we just throw in any application offhand, and we'll just... you can find them on GitHub, they're everywhere.

141
00:12:33,670 --> 00:12:37,310
You throw them in there, and they compile it, and they run it.

142
00:12:37,310 --> 00:12:38,550
It's backdoored now.

143
00:12:38,550 --> 00:12:40,450
The rootkit-hunter is backdoored.

144
00:12:42,230 --> 00:12:46,030
Mind you, we only have two days, so we're just throwing anything that we can, it'll stick, right?

145
00:12:47,690 --> 00:12:54,570
So if we see somebody being clever, we'll just blue screen the box, right?

146
00:12:54,570 --> 00:12:56,930
Like, we're not going to deal with any of their shit.

147
00:12:57,370 --> 00:13:05,370
You know, they're trying to be clever, they're going through procmod and going, nope, and then crash the box, right?

148
00:13:05,370 --> 00:13:08,290
We'd rather just crash the box before they get a hold of our loot.

149
00:13:09,870 --> 00:13:15,230
This is, you know, very rapid, you know, this happened over the course of a couple of hours.

150
00:13:15,230 --> 00:13:17,790
We'll spot the screenshots coming in.

151
00:13:18,010 --> 00:13:22,850
Through Cobalt Strike, we're like, well, he's up to no good.

152
00:13:22,850 --> 00:13:24,370
Eh, just crash the box.

153
00:13:24,970 --> 00:13:28,750
We'll reboot it, that'll be fine, but maybe put some dancing bananas on the screen.

154
00:13:28,770 --> 00:13:30,570
We'll get later to that.

155
00:13:31,930 --> 00:13:33,710
Sometimes we like to do annoyance.

156
00:13:33,710 --> 00:13:36,570
A lot of annoyance really kind of annoys some of the teams.

157
00:13:36,570 --> 00:13:42,010
Like, there's some teams that really like to use tmux, and we'll replace it with screen.

158
00:13:42,710 --> 00:13:44,070
You can't run tmux.

159
00:13:44,110 --> 00:13:48,470
Oh, but if you try to run screen, it just devurandoms your terminal.

160
00:13:49,050 --> 00:13:57,090
But if you try to run ematics, it'll actually open vim, and if you try to open vim, it opens up nano, which is super fun.

161
00:13:57,710 --> 00:14:05,010
They really hate that when you do that to somebody who's trying to remediate a box, and his commands keep changing out underneath them.

162
00:14:05,810 --> 00:14:08,550
And they're trying to figure out, how are you in the box?

163
00:14:08,550 --> 00:14:09,750
You're not even showing up.

164
00:14:09,750 --> 00:14:15,330
Well, we have a tty in there through Metasploit or something like that, and we're just screwing with you.

165
00:14:16,990 --> 00:14:19,170
Automation is key, though, right?

166
00:14:19,170 --> 00:14:23,030
If you're popping this many boxes, we're having to handle over 100 boxes.

167
00:14:24,390 --> 00:14:30,270
Automation is key until you start noticing somebody trying to be clever, and you go and futz with them for a couple of minutes.

168
00:14:31,670 --> 00:14:37,810
We'll reconfigure their DNS to make them distracted.

169
00:14:37,810 --> 00:14:40,570
We'll just drop their DNS into a black hole.

170
00:14:41,150 --> 00:14:44,230
Our beacons still work, but their DNS doesn't, right?

171
00:14:44,230 --> 00:14:48,490
They'll be pointing to our DNS servers, which drop everything but our beacons.

172
00:14:49,430 --> 00:14:51,710
We've screwed up a couple of teams doing that.

173
00:14:51,710 --> 00:14:53,070
That was super fun.

174
00:14:54,970 --> 00:14:58,270
Reconfigure the Palo Alto right underneath them, right?

175
00:14:58,270 --> 00:15:00,870
They keep adding a block rule, we'll drop that block rule.

176
00:15:00,870 --> 00:15:05,510
Or we'll reconfigure that block rule where it doesn't work.

177
00:15:05,730 --> 00:15:11,190
The order is out of place, and the allow rule is just stuck up there, and all the block rules don't work.

178
00:15:11,190 --> 00:15:13,230
You know, order of operations.

179
00:15:15,150 --> 00:15:19,830
And we'll reconfigure services to bring them down, right?

180
00:15:19,830 --> 00:15:21,410
That's part of the scoring.

181
00:15:21,410 --> 00:15:27,950
You know, we don't have a particular score ourselves, but we want to make them score as least as they can for all the teams.

182
00:15:27,950 --> 00:15:37,070
So we'll deface webpages, we'll deface their backgrounds, we'll deface services, anything that we can get a hold of.

183
00:15:37,310 --> 00:15:50,270
Most services are scored with ping, so if it doesn't match a checksum, then it's considered down, and we'll deface them, bring them down.

184
00:15:50,290 --> 00:16:01,750
My personal favorite was uninstalling Nginx and replacing it with Apache, kind of configuring it right, and then just leaving it half broken and letting them to fix it.

185
00:16:01,810 --> 00:16:13,030
So, I mean, you know, trying to get as much time as you can to leave your main beacons alone, have them misdirected, right?

186
00:16:13,030 --> 00:16:17,430
You want them to kind of focus on the craziness that is happening.

187
00:16:19,690 --> 00:16:25,110
So, this is going faster than I expected, but hey, that's working.

188
00:16:25,830 --> 00:16:28,670
So day two is when the fun really starts, right?

189
00:16:28,670 --> 00:16:35,810
Because we don't really want to blow up their boxes on the first day, but we do want to do it on day two.

190
00:16:36,170 --> 00:16:40,930
So we install the new backdoors, anything that we cooked up overnight, because we don't sleep, right?

191
00:16:40,930 --> 00:16:42,930
That's what caffeine's for.

192
00:16:43,650 --> 00:16:46,890
And then we just activate all my prank scripts.

193
00:16:46,890 --> 00:16:48,830
I started doing that when I first joined.

194
00:16:48,830 --> 00:16:50,950
I just had some on hand.

195
00:16:52,910 --> 00:16:53,850
Rotate their screen.

196
00:16:53,850 --> 00:16:55,210
We'll see some of these, by the way.

197
00:16:55,210 --> 00:16:56,650
I got a little treat for you.

198
00:16:56,830 --> 00:16:59,870
Rotate the screen by 90 degrees every 30 seconds.

199
00:16:59,870 --> 00:17:02,530
Makes it really hard to admin a box.

200
00:17:03,430 --> 00:17:05,050
Dancing bananas all over the screen.

201
00:17:05,050 --> 00:17:06,530
It's actually a fork bomb I written.

202
00:17:06,530 --> 00:17:09,110
You can see an example of that in the bottom right-hand corner.

203
00:17:09,110 --> 00:17:12,010
Them trying to kill it and it's not working.

204
00:17:13,550 --> 00:17:15,690
500% sized mouse.

205
00:17:15,810 --> 00:17:17,650
Super funny when it happens.

206
00:17:17,650 --> 00:17:23,190
They can't really use the mouse because it's slightly broken, but it's good fun.

207
00:17:23,810 --> 00:17:25,970
Bad keyboard inputs.

208
00:17:26,210 --> 00:17:27,730
You know, now they're DORVAC.

209
00:17:27,730 --> 00:17:28,830
Good luck.

210
00:17:28,830 --> 00:17:30,310
You can't change it now, by the way.

211
00:17:30,310 --> 00:17:34,570
We've disallowed administrators from changing that registry key.

212
00:17:34,570 --> 00:17:36,930
You're going to have to change the ACL on that.

213
00:17:36,930 --> 00:17:37,650
Sorry.

214
00:17:37,650 --> 00:17:39,870
You're going to have to go find it.

215
00:17:40,710 --> 00:17:44,490
ACLs are very powerful in Windows for registry keys.

216
00:17:44,490 --> 00:17:55,110
You can set some insanity in there and make it where they can't remove your shit unless they actually go in and rip those ACLs out, right?

217
00:17:55,610 --> 00:18:04,810
So, if you had, like, I had one where it was part of the banana script, actually, there's a list of process image names.

218
00:18:04,810 --> 00:18:06,190
It's the debugger key.

219
00:18:06,190 --> 00:18:10,830
Go look up the image name debugger key and you can do some really backdoor shit.

220
00:18:11,910 --> 00:18:14,550
And it just will run programs.

221
00:18:14,550 --> 00:18:20,010
It'll say program not found or my particular instance, every time you run the program, it would just spawn a new banana.

222
00:18:20,810 --> 00:18:28,950
Task manager, ProcMon, a lot of the AV software that they were trying to run would kind of be dynamic with it, you know?

223
00:18:28,950 --> 00:18:31,150
So, you know, we kind of work with it.

224
00:18:31,490 --> 00:18:40,890
And generally, it was kind of a dynamic environment on day two trying to really screw with them because they had a lot to think about, right?

225
00:18:40,890 --> 00:18:49,610
Like, they're really trying to keep their services up from us because, you know, they have 15 people going on and they're just, you know, they're a team of eight.

226
00:18:52,170 --> 00:18:59,890
Later on in the day, we'll really start screwing with services, memes, you know, defacing backgrounds, things like that, really let them know that we're home.

227
00:19:01,490 --> 00:19:04,650
Deleting files, programs, changing passwords, right?

228
00:19:04,650 --> 00:19:06,690
We'll delete files underneath them.

229
00:19:06,690 --> 00:19:14,050
We'll, when they're writing a report, we'll just delete it right there in front of them.

230
00:19:14,470 --> 00:19:16,550
We're so mean.

231
00:19:17,170 --> 00:19:20,690
But that's what makes this so much fun.

232
00:19:20,930 --> 00:19:22,330
You gotta try something.

233
00:19:22,330 --> 00:19:25,270
So, we'll delete stuff they're writing.

234
00:19:25,270 --> 00:19:27,870
They're drawing something in MS Paint.

235
00:19:27,870 --> 00:19:32,770
We'll draw something for them and they freak out because we're controlling their computer.

236
00:19:33,850 --> 00:19:36,830
We'll start Googling things for them on their own computer.

237
00:19:36,830 --> 00:19:44,150
That's super fun, you know, brick rolling them, things like that, you know, just opening up URLs, sending them helpful messages, offering help.

238
00:19:45,470 --> 00:19:47,670
Ransoming the domain controller for donuts.

239
00:19:47,670 --> 00:19:49,790
It was the funnest thing we've done.

240
00:19:50,350 --> 00:20:01,710
We did that a couple of times where we would ransom a service and we'd want donuts and they would have to go and hunt down donuts or other various things for us.

241
00:20:01,710 --> 00:20:07,430
We had a dance-off to get your domain controller back after we'd pwned like six of them.

242
00:20:07,770 --> 00:20:09,130
The Air Force won.

243
00:20:12,190 --> 00:20:17,450
So, as you can see, this is the most fun you'll ever have as Red Team.

244
00:20:17,450 --> 00:20:18,270
Ever.

245
00:20:18,430 --> 00:20:21,950
Two days of packed full of craziness.

246
00:20:21,950 --> 00:20:24,030
But it gets better.

247
00:20:24,490 --> 00:20:28,790
So, after we've done all the shenanigans, there's a slight story here.

248
00:20:28,790 --> 00:20:34,290
So, if you look on the very, very bottom there, there is a search warrant.

249
00:20:34,410 --> 00:20:44,670
We had one year, the local police department decided that they were going to help out and we asked them, hey, you want to do a no-knock raid on some of the students' rooms?

250
00:20:45,710 --> 00:20:48,810
So, we coordinated that with them and they did it for all the teams.

251
00:20:48,810 --> 00:20:50,990
They raided and took their domain controller.

252
00:20:50,990 --> 00:20:52,630
Just stole it.

253
00:20:53,130 --> 00:20:59,010
Came in there, looking all official, scared the crap out of most of them.

254
00:20:59,010 --> 00:21:00,770
It was great, though.

255
00:21:00,770 --> 00:21:04,070
It was hilarious the whole time.

256
00:21:04,290 --> 00:21:06,690
There is some video of this I will show you later.

257
00:21:07,610 --> 00:21:09,350
But shenanigans.

258
00:21:09,350 --> 00:21:11,130
Lots and lots of shenanigans.

259
00:21:11,130 --> 00:21:14,950
The most shenanigans you will ever have being a Red Teamer.

260
00:21:16,770 --> 00:21:19,230
So, the burn.

261
00:21:19,230 --> 00:21:20,650
This is the last hour.

262
00:21:21,830 --> 00:21:23,730
We're nuking the disks.

263
00:21:24,110 --> 00:21:28,050
You can see here we're doing RMRF, no preserve route.

264
00:21:28,050 --> 00:21:28,950
Screw the disk.

265
00:21:30,190 --> 00:21:32,570
Blue screen the boxes.

266
00:21:32,690 --> 00:21:34,550
Delete the AWS account.

267
00:21:34,550 --> 00:21:36,790
It doesn't like when you do that, by the way.

268
00:21:37,090 --> 00:21:38,850
Nine cat the boot loaders.

269
00:21:38,850 --> 00:21:40,950
Anything we can do to destroy their systems.

270
00:21:41,790 --> 00:21:45,970
Anything we have access to left is destroyed.

271
00:21:46,650 --> 00:21:48,190
Nuclear, right?

272
00:21:49,610 --> 00:21:58,050
So, after all of this is, you know, done, we tell them what we did, right?

273
00:21:58,050 --> 00:22:04,630
We actually sit down with them, with every team, and say, well, okay, so you're team seven.

274
00:22:05,270 --> 00:22:08,530
You kept giving us your password to the key loggers.

275
00:22:08,530 --> 00:22:11,110
You never found the PAM backdoor, right?

276
00:22:11,150 --> 00:22:11,910
It's here.

277
00:22:11,910 --> 00:22:13,150
It's here every year.

278
00:22:13,150 --> 00:22:15,010
We told you this last year.

279
00:22:16,990 --> 00:22:21,210
You know, you didn't block us, right?

280
00:22:21,210 --> 00:22:22,970
Were you checking for DNS traffic?

281
00:22:22,970 --> 00:22:25,190
Or were you too busy doing injects?

282
00:22:25,190 --> 00:22:28,590
Or did your firewall guy not look because it was a new guy?

283
00:22:28,590 --> 00:22:30,130
Did he not check for DNS traffic?

284
00:22:30,130 --> 00:22:31,810
Did he not check for IMCP traffic?

285
00:22:31,810 --> 00:22:32,690
Things of that sort.

286
00:22:32,690 --> 00:22:35,730
We would sit down with them and tell them what they did wrong.

287
00:22:36,830 --> 00:22:39,410
A lot of it was they just weren't looking.

288
00:22:40,970 --> 00:22:44,750
You know, anybody with Wireshark and a mirror port can really see us.

289
00:22:44,750 --> 00:22:53,450
Like, when 90% of the traffic coming out of your box is DNS, and it's like gigs of it, you have a problem.

290
00:22:54,430 --> 00:22:56,210
And a lot of times they just don't block it.

291
00:22:56,210 --> 00:23:04,430
I always said, if you had a good firewall guy, somebody who had Wireshark open, mirror port, just streaming logs, right?

292
00:23:04,530 --> 00:23:07,090
Maybe booted off of Live CD or something.

293
00:23:07,530 --> 00:23:10,270
That they'd be able to find us, right?

294
00:23:10,270 --> 00:23:12,170
We're very noisy, right?

295
00:23:12,170 --> 00:23:14,550
Maybe this is long-term beacons.

296
00:23:15,290 --> 00:23:18,770
Maybe not, but you just do standard incident response.

297
00:23:18,770 --> 00:23:21,870
And you know, most of our stuff is detected, right?

298
00:23:21,870 --> 00:23:24,090
Cobalt strikes, super detectable.

299
00:23:24,270 --> 00:23:29,350
You know, you open up ProcMod and you see the crap that's going on, and alas, right?

300
00:23:30,570 --> 00:23:33,390
Kick us out as fast as you can, right?

301
00:23:33,430 --> 00:23:39,750
Even if you bring services down in incident response, mind you, this is a compressed time frame.

302
00:23:39,750 --> 00:23:42,150
And this kind of goes for most incident response, right?

303
00:23:42,470 --> 00:23:44,850
Don't be afraid to turn off the network.

304
00:23:45,510 --> 00:23:57,350
I mean, even if it's just, you know, 10 minutes, right, to get your bearings and start looking at traffic, you know, hands off keyboard, plug the Ethernet back in, see what's happening, right?

305
00:23:57,350 --> 00:23:59,330
See what's talking.

306
00:24:01,250 --> 00:24:05,090
Track those traces down, kick us out, because if we kick us out, we can't get back in.

307
00:24:05,090 --> 00:24:09,390
If we don't have your passwords, we don't have any beacons, we're not getting back in, right?

308
00:24:09,390 --> 00:24:18,090
Like, we have some of the backdoors, and sometimes they stay, but a lot of the older ones, you know, they're all picked up by AV nowadays.

309
00:24:18,190 --> 00:24:26,790
So, but a lot of it is they just haven't had a lot of experience with dealing with these computers and dealing with systems like this, right?

310
00:24:26,790 --> 00:24:32,770
Like, they're in a system administration role trying to do security, and all they've been taught is security.

311
00:24:34,550 --> 00:24:37,650
So, and they kind of treat the operating system as hostile.

312
00:24:37,830 --> 00:24:40,930
They're not doing that most of the time, right?

313
00:24:40,930 --> 00:24:43,170
They trust in the permission.

314
00:24:43,170 --> 00:24:45,690
They trust in the files they're leaving on the system.

315
00:24:45,690 --> 00:24:47,350
They're trusting their backups.

316
00:24:47,350 --> 00:24:48,830
We've infected the backups.

317
00:24:48,830 --> 00:24:49,450
We've done that.

318
00:24:49,450 --> 00:24:54,350
They're going to restore from a backup, and we'll reinfect them again, because it's an old password.

319
00:24:54,350 --> 00:24:57,710
And we always try the old passwords, right?

320
00:24:57,710 --> 00:24:59,290
Like, this is how it works.

321
00:24:59,910 --> 00:25:08,190
So, you know, mostly it's just trying to get the air out about what we're doing, right?

322
00:25:08,190 --> 00:25:13,390
It's really easy to spot us once you know what we're doing, because we're up to all kinds of shenanigans.

323
00:25:13,810 --> 00:25:25,190
And so, it's not, it's not, most of this stuff is just a grab bag of anything that we can find off of GitHub, for the most part.

324
00:25:25,190 --> 00:25:28,130
I mean, Cobalt Strikes really nice.

325
00:25:28,130 --> 00:25:36,330
We do write some shenanigans for some of the scripts, but really, though, we're not doing anything particularly special.

326
00:25:36,330 --> 00:25:41,930
But year after year, and we have students, we have teams, we have teams that are amazing at this, right?

327
00:25:42,690 --> 00:25:48,410
They'll kick us out in 15 minutes, and maybe we'll get back in second day, right?

328
00:25:48,990 --> 00:25:50,890
Maybe they'll file for a phishing email.

329
00:25:51,010 --> 00:25:52,170
We've had that happen once.

330
00:25:52,170 --> 00:25:54,450
Or we'll steal something from their room.

331
00:25:55,630 --> 00:25:59,010
They're supposed to, there's physical security kind, kind of involved.

332
00:25:59,010 --> 00:26:12,750
We keep it, you know, we don't do it that much, but we'll steal a laptop, or, you know, or, you know, give it back to them with, put SXP on it, and expect them to use it, because there was a service on it.

333
00:26:15,270 --> 00:26:19,850
So, I have videos I'm going to show you.

334
00:26:19,850 --> 00:26:20,850
I'm going to talk over them.

335
00:26:20,850 --> 00:26:23,230
I'm not going to play the terrible music that's on them.

336
00:26:23,250 --> 00:26:24,870
Both of these are on YouTube.

337
00:26:25,170 --> 00:26:31,510
You can look up NECCDC, and you can find all of our previous year's videos, right?

338
00:26:31,510 --> 00:26:32,590
They're not very long.

339
00:26:32,730 --> 00:26:37,250
And they really showcase some of the payloads that we're getting back, right?

340
00:26:37,250 --> 00:26:39,050
In a lot better way than I can show.

341
00:26:39,150 --> 00:26:42,670
So, I'm going to play number one here.

342
00:26:43,370 --> 00:26:45,270
So, this is from 2019.

343
00:26:46,790 --> 00:26:50,350
I'm going to, just a smidgen ahead here.

344
00:26:50,350 --> 00:26:53,230
So, we have backdoored their Wi-Fi router.

345
00:26:53,230 --> 00:26:57,790
It was, we just get a custom update server.

346
00:26:58,530 --> 00:27:05,070
Here, they're Googling how to do security, you know, Wi-Fi passwords.

347
00:27:05,530 --> 00:27:11,790
So, we get a little bit of a backdoor stream from white team, and they'll post in the Slack some of the things that they find from us.

348
00:27:11,790 --> 00:27:16,570
But, ah, red team, you know, passwords to the key loggers.

349
00:27:23,600 --> 00:27:32,020
And you can see, you know, we really, it's just password discipline is so terrible with these people sometimes.

350
00:27:33,580 --> 00:27:42,120
Um, you know, they're trying to track us down in ProcMon and managementcorp.beaver.

351
00:27:42,120 --> 00:27:44,060
I don't think it's supposed to be that.

352
00:27:45,220 --> 00:27:48,640
You know, we're futzing with their DNS.

353
00:27:49,820 --> 00:27:57,500
You know, changing their administrative passwords, because if they don't know it, might as well rerun it.

354
00:27:58,060 --> 00:28:00,380
King Size Mouse just ran on a couple of machines.

355
00:28:00,380 --> 00:28:02,960
You can see it here in action in Cobalt Strike.

356
00:28:04,340 --> 00:28:08,320
Makes the machine very hard to use, but you can get rid of it.

357
00:28:10,900 --> 00:28:17,080
They're trying to figure out why their DNS has been changed to another server, because it's ours now.

358
00:28:23,480 --> 00:28:28,040
Yeah, we were dropping some rickrolls on them several times.

359
00:28:28,920 --> 00:28:32,640
A lot of kids, they just don't, they just don't know the memes.

360
00:28:34,520 --> 00:28:37,220
Uh, yeah, we did that a couple of times.

361
00:28:37,220 --> 00:28:41,540
We'll change out the Wi-Fi password, uh, the Wi-Fi AP to what their, what their password was.

362
00:28:41,540 --> 00:28:43,860
Just, just to show we care.

363
00:28:47,070 --> 00:28:48,290
That's our little Wi-Fi.

364
00:28:48,290 --> 00:28:51,070
So we were, we had a backdoor, but they had to keep Wi-Fi up.

365
00:28:51,170 --> 00:28:55,250
And so we had a little Wi-Fi router up that we were actually using as a backdoor.

366
00:28:55,250 --> 00:28:57,390
We were getting all the teams with it.

367
00:28:59,540 --> 00:29:02,800
You know, making some puns and jokes and things of that sort.

368
00:29:02,800 --> 00:29:04,300
We, we did it a lot.

369
00:29:05,140 --> 00:29:11,700
Um, uh, sometimes they'll accidentally paste the password into the Slack.

370
00:29:11,700 --> 00:29:13,060
Don't do that.

371
00:29:14,480 --> 00:29:17,080
Um, there's bunkers being managed by red team.

372
00:29:17,080 --> 00:29:19,140
That's a pretty common problem.

373
00:29:22,310 --> 00:29:25,850
This is all set to terrible music that I'd rather not play.

374
00:29:27,230 --> 00:29:31,550
Um, I'm trying to install security essentials.

375
00:29:31,550 --> 00:29:35,990
Are they not teaching them what accounts as antivirus on windows nowadays?

376
00:29:37,050 --> 00:29:39,710
Uh, APG does not work on windows server.

377
00:29:39,710 --> 00:29:40,650
Sorry.

378
00:29:41,670 --> 00:29:50,130
Uh, you really should turn that on and setting your password is not going to do any good if we have a key logger on the box, right?

379
00:29:52,870 --> 00:30:01,010
Um, we'll send them helpful messages, you know, to annoy them that we see them that they're editing their firewall.

380
00:30:01,010 --> 00:30:02,150
It's not doing any good.

381
00:30:03,070 --> 00:30:11,670
Um, more passwords, of course, uh, really the key logger is a key lockers are so old school, right?

382
00:30:11,670 --> 00:30:13,930
Like, Oh, who installs a key logger?

383
00:30:13,930 --> 00:30:17,790
But they just give every time really looking to install them key loggers.

384
00:30:17,790 --> 00:30:23,410
If you're popping a box, more dancing, bananas, shenanigans, as usual.

385
00:30:24,910 --> 00:30:29,550
Uh, I always like to drop them on boxes that we kind of have access to that haven't done anything on it in a while.

386
00:30:29,990 --> 00:30:33,330
Um, or just to show us the proof that we're, we're in their box, right?

387
00:30:33,330 --> 00:30:38,710
We want to give them that little tickler that, uh, we're still fussing with their systems.

388
00:30:39,350 --> 00:30:43,810
Uh, they'd try killing it, but each banana is a separate process.

389
00:30:44,050 --> 00:30:50,130
So if they don't know how to mass kill stuff, then Malwarebytes ain't going to help you.

390
00:30:51,510 --> 00:30:54,370
Uh, you can see here they're, they're actively being ran.

391
00:30:54,370 --> 00:30:59,510
Mind you, these, these recap videos are made like an hour before the competition ends.

392
00:30:59,650 --> 00:31:03,090
So they're made in a rush.

393
00:31:04,410 --> 00:31:07,550
Uh, more helpful messages of banana man.

394
00:31:07,550 --> 00:31:09,190
They weren't killing them fast enough.

395
00:31:09,190 --> 00:31:12,750
So I just kept spawning more of them just to annoy them.

396
00:31:13,650 --> 00:31:18,530
Um, banana itself, it's not backdoored.

397
00:31:18,530 --> 00:31:22,830
Uh, it does change some, um, uh, yes.

398
00:31:22,830 --> 00:31:23,030
Yeah.

399
00:31:23,030 --> 00:31:28,150
So this is, this is it rotating by 90 degrees every 30 seconds.

400
00:31:28,150 --> 00:31:34,370
And we actually got video from one of the white team, these ultra wide monitors making it super stupid.

401
00:31:35,310 --> 00:31:41,990
Um, it's just, you know, it works fine now, but give it 30 seconds and it won't.

402
00:31:42,190 --> 00:31:43,750
Uh, they're trying to figure out how to kill it.

403
00:31:43,750 --> 00:31:47,690
And I'm playing yackety sax over there, over there, uh, audio at the same time.

404
00:31:47,690 --> 00:31:48,930
They still haven't closed it.

405
00:31:51,190 --> 00:31:52,870
Uh, we do this to all the teams.

406
00:31:52,870 --> 00:31:54,570
This is the one we got video of.

407
00:31:57,330 --> 00:32:02,270
And so this cracks me up every time I watch it.

408
00:32:03,650 --> 00:32:06,570
Um, you know, we give them some encouragement.

409
00:32:06,570 --> 00:32:08,670
They get demoralized very quickly.

410
00:32:09,450 --> 00:32:16,030
Um, but, uh, we'll actually back off of people that we have access to towards the end there.

411
00:32:16,370 --> 00:32:20,510
Uh, mostly because, you know, kicking the puppy while it's down.

412
00:32:20,510 --> 00:32:27,490
We don't like to do that too terribly much, but you know, bananas on, on write-ups is super great.

413
00:32:27,490 --> 00:32:27,870
Oh yeah.

414
00:32:27,910 --> 00:32:29,030
Nothing's infected.

415
00:32:29,030 --> 00:32:30,210
Bananas everywhere.

416
00:32:32,450 --> 00:32:34,030
Um, they write on the board.

417
00:32:34,030 --> 00:32:36,590
Sometimes we'll, we'll steal passwords off the whiteboards.

418
00:32:36,590 --> 00:32:40,070
We'll, we'll take photos from cracks in the walls and stuff.

419
00:32:40,850 --> 00:32:42,290
Uh, more bananas.

420
00:32:42,510 --> 00:32:47,670
Uh, I have one that'll just fork bomb a machine to the point where it just won't run anymore.

421
00:32:48,110 --> 00:32:53,710
Um, a team challenged us saying, Hey, we don't have any bananas on ours.

422
00:32:53,710 --> 00:32:54,090
Yeah.

423
00:32:54,090 --> 00:32:55,530
Give it 10 minutes.

424
00:32:56,330 --> 00:33:00,550
Um, yeah, you really shouldn't be killing SVC hosts.

425
00:33:01,890 --> 00:33:06,770
Uh, they had sign-in cheats and we did actually sign in as red team and nobody checked.

426
00:33:08,030 --> 00:33:14,630
Um, they're trying to run Clam AV on the box and that's not going to do any good.

427
00:33:14,630 --> 00:33:16,550
The definitions are too old.

428
00:33:17,050 --> 00:33:20,170
These are examples of some of the injects.

429
00:33:20,170 --> 00:33:26,050
Um, some of it is quite going fast, but, uh, you know, more, more words of encouragement.

430
00:33:28,250 --> 00:33:39,450
I think at this particular point, right, they got so much stuff running that it's, it's starting to bog down their boxes, but you know, they'll give us keys and really we're just Googling stuff better than them.

431
00:33:40,310 --> 00:33:45,910
Uh, we're, we're letting, you know, them know that their, their boxes still pops.

432
00:33:45,910 --> 00:33:46,970
There's really the WAP.

433
00:33:46,970 --> 00:33:48,130
That's what they had in the rooms.

434
00:33:48,130 --> 00:33:49,690
One of the teams did that.

435
00:33:51,030 --> 00:33:57,150
Um, yeah, so we stole the laptops and we gave them Windows XP.

436
00:33:57,810 --> 00:33:58,710
It was great.

437
00:33:58,710 --> 00:34:00,310
We put all of our malware on it too.

438
00:34:00,310 --> 00:34:03,030
And, uh, we stole it without them knowing.

439
00:34:03,030 --> 00:34:04,190
It was great.

440
00:34:04,710 --> 00:34:10,270
All the teams did not notice that we had stolen their laptop and we just gave it back to them.

441
00:34:10,330 --> 00:34:13,090
Uh, some encouragement from remote tech support.

442
00:34:13,650 --> 00:34:18,450
Um, so this one, so they're doing some role-playing here.

443
00:34:18,450 --> 00:34:20,490
So this guy is yelling at them.

444
00:34:20,650 --> 00:34:23,970
If you watch this video on YouTube, it's a little bit better, but this guy's yelling at him.

445
00:34:23,970 --> 00:34:26,770
Like, well, why did he steal the laptop?

446
00:34:26,770 --> 00:34:28,410
Didn't you like record it down?

447
00:34:28,410 --> 00:34:29,890
Like, who was this person?

448
00:34:30,590 --> 00:34:37,090
And, and like, well, I mean, you know, the student doesn't know what the hell's going on at this point, right?

449
00:34:37,090 --> 00:34:38,850
Like he doesn't know how to respond.

450
00:34:38,930 --> 00:34:42,350
So the students are given real world scenarios like, well, what the fuck?

451
00:34:42,350 --> 00:34:44,850
Why did the laptop walk off?

452
00:34:45,430 --> 00:34:46,010
Right.

453
00:34:46,650 --> 00:34:52,030
So he's trying to explain to himself and it's, it's, it's, it's not very good.

454
00:34:52,410 --> 00:34:56,470
He's trying to figure out, well, did they just steal it from underneath your keyboard?

455
00:34:56,470 --> 00:34:57,910
Like, how did this work?

456
00:34:57,910 --> 00:34:59,950
Why did you give him the laptop?

457
00:35:01,790 --> 00:35:03,730
And why is he playing Tetris?

458
00:35:03,830 --> 00:35:05,710
Tetris is his boot letter.

459
00:35:09,750 --> 00:35:13,130
So that happens so many times, right?

460
00:35:13,130 --> 00:35:17,030
We, we hardly get to see that as red team, but here's us imaging them all.

461
00:35:17,070 --> 00:35:23,290
Somebody actually had an image for this laptop for Windows XP, and they just downloaded it from work.

462
00:35:25,950 --> 00:35:28,270
And we kept, we were getting beacons off of them.

463
00:35:32,390 --> 00:35:38,230
So we, this is some of the searches and typings that's coming in while we still have beacons for days.

464
00:35:40,710 --> 00:35:41,990
Bad passwords.

465
00:35:41,990 --> 00:35:46,170
At this point, they've changed their password six, seven, eight times, and they're just done, right?

466
00:35:46,170 --> 00:35:50,990
Like, oh, he, we, we, we made good friends with him.

467
00:35:50,990 --> 00:35:55,250
He's going to pwn his own box, but unfortunately the beacon had disconnected.

468
00:35:55,630 --> 00:35:58,790
So, but he was one of the team members.

469
00:35:58,790 --> 00:36:01,590
He, he'd wanted to dance off to get his domain controller back.

470
00:36:02,190 --> 00:36:05,190
So it's like, here, you can pwn your domain controller again.

471
00:36:10,260 --> 00:36:11,660
They had sign-in sheets.

472
00:36:11,660 --> 00:36:17,200
We were signing in with anything and everything under the sun, and nobody was checking in when they should have been.

473
00:36:17,200 --> 00:36:19,160
They got scored against that too.

474
00:36:20,520 --> 00:36:28,700
We're starting to delete things now, and it's just out of control at this point, right?

475
00:36:28,820 --> 00:36:33,540
So, you know, a CEO is asking, why are you playing Tetris?

476
00:36:33,600 --> 00:36:34,780
We still run gateways.

477
00:36:34,780 --> 00:36:38,660
I thought we all had Dells because their gateway was down.

478
00:36:38,660 --> 00:36:41,120
They didn't have internet because we nuked the Palo Alto.

479
00:36:41,940 --> 00:36:53,900
More bananas just because wall messages back and forth, you know, chatting with the teammates going, you know, can we pop, can we pop your box?

480
00:36:53,900 --> 00:36:57,180
As always, women are technical and capable of breathing fire.

481
00:36:57,300 --> 00:36:58,660
Definitely so.

482
00:37:05,610 --> 00:37:09,030
So this one's where, you know, the network's down and he's losing money.

483
00:37:10,650 --> 00:37:15,670
And he's yelling at the teammates going, well, what's going on?

484
00:37:15,670 --> 00:37:17,950
Like, I'm not going to sell the other house in the Hamptons.

485
00:37:17,950 --> 00:37:19,950
I'm going to fire you first.

486
00:37:21,150 --> 00:37:23,830
Classic CEO speak, and he just walks out.

487
00:37:25,550 --> 00:37:26,590
We saw Mr.

488
00:37:26,590 --> 00:37:27,510
Dino a lot of times.

489
00:37:27,510 --> 00:37:28,430
You'll still have beacons.

490
00:37:28,430 --> 00:37:30,150
This is the group shot.

491
00:37:31,750 --> 00:37:34,310
This is all the red team for 2019.

492
00:37:34,310 --> 00:37:41,450
You can see me there in the corner, Mudge in the center, you know, I don't remember half these people's names at this particular point.

493
00:37:41,450 --> 00:37:45,350
We don't meet that often, but I have a mug with all their names on it, though.

494
00:37:45,830 --> 00:37:51,390
Daryl's on the left there, but this is who they have to defend themselves against, right?

495
00:37:51,390 --> 00:37:52,090
They're Silas.

496
00:37:52,090 --> 00:37:53,610
He used to work at VirusTotal.

497
00:37:53,830 --> 00:38:02,530
He would weaponize malware that he would get from Google and VirusTotal and stick it on students.

498
00:38:02,610 --> 00:38:04,190
That madman!

499
00:38:04,810 --> 00:38:06,910
He would neuter it, right?

500
00:38:07,070 --> 00:38:15,790
There was an incident, but he would neuter it and repurpose it for students, so he would actually infect them with malware, just the beacons were going back to him instead.

501
00:38:16,610 --> 00:38:18,350
Crazy, crazy fellow.

502
00:38:20,610 --> 00:38:22,990
Most of these guys are networking engineers.

503
00:38:23,130 --> 00:38:24,350
Most of them aren't even Red Team.

504
00:38:24,350 --> 00:38:27,230
They aren't like, this is what they do as Red Team.

505
00:38:27,550 --> 00:38:31,850
They're more dangerous because they're in the field every day, right?

506
00:38:31,850 --> 00:38:41,450
They're networking engineers, Splunk engineers, but they know the full depth of those applications.

507
00:38:41,450 --> 00:38:45,610
They know what they can do, and then you take that and twist it.

508
00:38:45,610 --> 00:38:47,930
That's what I think is fundamental to being a Red Teamer, right?

509
00:38:47,930 --> 00:38:56,330
You know how that stuff's supposed to work, and then you twist it to your needs, your evil, evil needs to do what you needed to do, right?

510
00:38:57,570 --> 00:38:59,990
You have much more scope availability.

511
00:38:59,990 --> 00:39:06,470
You have the ability to hide better if you know more about what you're dealing with, especially with applications.

512
00:39:07,870 --> 00:39:09,770
Well, I've just talked about Neroff.

513
00:39:09,850 --> 00:39:12,550
We'll go ahead and go on to the second video here.

514
00:39:12,550 --> 00:39:13,630
Skip ahead a little.

515
00:39:14,830 --> 00:39:16,770
This is from 2018.

516
00:39:17,350 --> 00:39:22,470
More shenanigans, you know, giving us their keys for AWS.

517
00:39:24,230 --> 00:39:29,910
Yes, we would persist with a team name called White Team on the box.

518
00:39:32,670 --> 00:39:34,970
They had to go in through the serial console that year.

519
00:39:34,970 --> 00:39:37,350
They really didn't understand what was going on.

520
00:39:37,390 --> 00:39:38,970
They didn't know it was serial.

521
00:39:41,710 --> 00:39:49,370
I think they were trying to screw with each other, allowing us to say traffic's always a bad idea.

522
00:39:50,290 --> 00:39:53,830
These are, by the way, generally very flat networks.

523
00:39:54,290 --> 00:39:58,530
You know, us and our Spunk admin going, hey, do you need to get your Spunk working?

524
00:40:01,450 --> 00:40:03,030
Yes, we've done that.

525
00:40:03,030 --> 00:40:05,250
We've installed Linux on a box.

526
00:40:05,830 --> 00:40:07,810
You know, always check your agent names.

527
00:40:08,330 --> 00:40:14,830
We're always changing your passwords for you because you should be changing them often, and if you're not, we're going to.

528
00:40:14,830 --> 00:40:16,850
We'll wipe your backups always.

529
00:40:16,850 --> 00:40:18,250
That's just what we do.

530
00:40:20,070 --> 00:40:23,410
PowerShell is in great gasps of what we do as well.

531
00:40:25,170 --> 00:40:27,250
No, you can't get rid of DNS.

532
00:40:27,250 --> 00:40:28,710
That's just terrible.

533
00:40:29,170 --> 00:40:30,130
More keys.

534
00:40:30,130 --> 00:40:32,090
That's our key added in.

535
00:40:33,430 --> 00:40:37,870
Us taking surveillance photos of passwords on the whiteboard.

536
00:40:37,930 --> 00:40:39,890
That's not a good place to put them.

537
00:40:39,890 --> 00:40:42,870
Docker should not be running on your laptop.

538
00:40:43,410 --> 00:40:48,310
This is kind of what our desktop would look like, right, because we have all the teams open.

539
00:40:49,010 --> 00:40:53,010
Somebody futzing with the Palo Alto, at least trying to.

540
00:40:53,990 --> 00:40:56,410
Mudge sending beacons down.

541
00:40:58,110 --> 00:41:03,150
This is just, you know, SSH keys being sent in.

542
00:41:03,390 --> 00:41:09,010
Me playing annoying noises because they had all in ones and I couldn't turn off the speakers.

543
00:41:09,150 --> 00:41:10,930
Oh, that was great.

544
00:41:13,630 --> 00:41:18,190
We'll meme them up, change their logins to whatever we want.

545
00:41:18,970 --> 00:41:25,390
We'll change their MODT and they forget it's there and it's backdooring every time that MODT runs.

546
00:41:29,550 --> 00:41:38,310
We will sometimes, if you ask us to stop, sometimes we will, if you're nice to us, just let our beacons live and we'll stop messing with your box.

547
00:41:39,530 --> 00:41:47,270
That actually is probably pretty good advice to somebody who's actively in your network and you're trying to fight them, but really you should just be unplugging the internet.

548
00:41:48,590 --> 00:42:02,710
I played Tetris with, I attempted, and this is a really bad demo, but I attempted to play a Tetris with somebody over their own TMUX session while in front of them.

549
00:42:02,710 --> 00:42:07,890
So I'm actually attached to the TMUX session and I'm trying to get BSD games to work.

550
00:42:08,150 --> 00:42:17,290
But you know, if you've lived in Debian land, that's actually kind of hard, but I'm playing some Worm with them, at least trying to,

551
00:42:20,480 --> 00:42:24,720
well, attempting to.

552
00:42:25,300 --> 00:42:26,720
It's actually kind of a FUB.

553
00:42:26,720 --> 00:42:28,200
Why did I put that in here?

554
00:42:28,720 --> 00:42:31,040
Oh, well, there's their keys.

555
00:42:34,890 --> 00:42:41,310
But while I'm for various effects, you know, their AWS access keys, because they're leaving them in configs everywhere.

556
00:42:42,270 --> 00:42:44,270
Yes, it is our router.

557
00:42:45,850 --> 00:42:48,070
Some people don't know what CloudTrail is.

558
00:42:48,070 --> 00:42:49,250
It's great.

559
00:42:50,130 --> 00:42:52,030
Yes, the box is fucked.

560
00:42:52,030 --> 00:42:53,730
It is a technical term.

561
00:42:54,410 --> 00:42:59,420
That's always, always DNS's problem.

562
00:43:00,020 --> 00:43:02,380
Yes, we stole all your passwords.

563
00:43:04,400 --> 00:43:07,340
They Google weird shit all the time.

564
00:43:07,340 --> 00:43:11,080
One team decided to go this kind of advanced format for their passwords.

565
00:43:13,220 --> 00:43:15,740
They didn't know what echo is.

566
00:43:16,340 --> 00:43:17,600
We find that a lot.

567
00:43:17,600 --> 00:43:20,400
A lot of kids don't know what is going on.

568
00:43:20,400 --> 00:43:22,800
We'll send the messages to their Splunk.

569
00:43:25,000 --> 00:43:28,300
We'll actually interject bad Google results.

570
00:43:28,300 --> 00:43:35,000
We've actually had it where Google would redirect to Bing and it would be the third page of Bing and that's all they could access.

571
00:43:37,020 --> 00:43:42,040
This is beacons coming in from Splunk as they started to manage their system for them.

572
00:43:47,170 --> 00:43:51,750
Somebody trying to do some art because they were bored and they didn't have anything to do.

573
00:43:53,330 --> 00:43:58,310
We decided, I did at least, that I was going to make a little bit of fun.

574
00:43:58,370 --> 00:44:04,310
I printed out this stupid piece of paper that said, hey, you're trying to get into SSH.

575
00:44:04,310 --> 00:44:06,050
Would you like to try Telnet instead?

576
00:44:06,110 --> 00:44:07,750
Slipped it under everybody's door.

577
00:44:07,750 --> 00:44:10,150
We actually got them back, a couple of them.

578
00:44:10,150 --> 00:44:11,490
There's the search warrant.

579
00:44:11,530 --> 00:44:12,550
That was fun.

580
00:44:12,550 --> 00:44:13,490
There's Clippy.

581
00:44:14,130 --> 00:44:16,010
We got them back from a couple of teams.

582
00:44:16,790 --> 00:44:19,050
This is us ransomware-ing their team.

583
00:44:21,770 --> 00:44:24,130
Yes, that happens a lot now.

584
00:44:24,570 --> 00:44:26,690
This is great.

585
00:44:27,850 --> 00:44:30,670
We made them take this photo for us.

586
00:44:30,670 --> 00:44:39,590
And we made them apologize for trying to steal our firewall, which was their firewall, but it was really our firewall now.

587
00:44:40,070 --> 00:44:46,490
We gave them back their firewall eventually, but no, no guarantees there.

588
00:44:49,910 --> 00:44:52,750
Then we just start deleting stuff from them.

589
00:44:52,750 --> 00:44:55,230
It's the same stick every year, practically.

590
00:44:56,970 --> 00:45:01,690
I know running Docker, we'll have beacons inside of Docker and they'll never see them in there.

591
00:45:01,690 --> 00:45:04,510
We're starting to get beacons timing out now.

592
00:45:04,670 --> 00:45:11,730
Me DDing you random the TTY for shits, and that's always super fun when it goes beepy hell.

593
00:45:17,520 --> 00:45:18,100
Yep.

594
00:45:18,100 --> 00:45:20,700
And we're starting to delete sys32 now.

595
00:45:22,620 --> 00:45:28,400
Teams start usually playing music at this point because there's not a whole lot they can do because we're just starting to pop boxes now.

596
00:45:30,540 --> 00:45:37,780
Disable their internet, anything that we can do to destroy the box at this point.

597
00:45:37,780 --> 00:45:39,080
So you get the general idea.

598
00:45:42,920 --> 00:45:47,660
We start deleting all their AWS instances, which are scored, which has a bunch of stuff in it.

599
00:45:48,060 --> 00:45:51,440
Making sure to delete all the snapshots, all the beacons are dead.

600
00:45:52,100 --> 00:45:54,860
This is the write-up where they had to do the search and seizure.

601
00:45:56,020 --> 00:45:58,920
We'll actually kind of go back to that a little bit

602
00:46:02,400 --> 00:46:02,760
.

603
00:46:03,320 --> 00:46:05,320
This is us deleting sys32.

604
00:46:07,560 --> 00:46:08,900
And as such.

605
00:46:08,980 --> 00:46:14,560
So as you can see, we're up to all kinds of shenanigans.

606
00:46:18,020 --> 00:46:21,000
Obviously, we've had some disruptions this morning in numerous ways.

607
00:46:21,000 --> 00:46:25,640
Under my standing as law enforcement officer in the room, we collected some device or devices.

608
00:46:25,760 --> 00:46:31,800
This is obviously concerning to the executive staff as we need to talk and make sure we understand all the facts we know.

609
00:46:33,480 --> 00:46:35,300
This is the search and seizure.

610
00:46:35,320 --> 00:46:36,380
That was pretty good.

611
00:46:36,380 --> 00:46:37,740
We don't have any video of it, though.

612
00:46:37,740 --> 00:46:40,620
It wasn't recorded, because they just kind of surprised us on it.

613
00:46:41,200 --> 00:46:43,420
They even raided red team room at one point.

614
00:46:44,860 --> 00:46:52,410
So as you can see, we generally have our standard reams.

615
00:46:52,410 --> 00:46:54,190
This is just the northeast corridor, right?

616
00:46:54,930 --> 00:46:56,790
There's teams for every corridor.

617
00:46:58,110 --> 00:47:02,500
And yeah.

618
00:47:02,500 --> 00:47:04,560
So there's teams for every corridor.

619
00:47:04,560 --> 00:47:09,460
And then they go to nationals, and they fight there, and they have some real red teamers there, right?

620
00:47:09,460 --> 00:47:11,440
They'll actually bring out some stops.

621
00:47:11,440 --> 00:47:13,860
They have some amazing tools up there.

622
00:47:13,860 --> 00:47:18,280
A lot of them they don't release, and it's for good reason, because they're very dangerous, actually.

623
00:47:18,760 --> 00:47:21,500
And they're meant for only use in competitions.

624
00:47:21,520 --> 00:47:23,520
But you can find it, right?

625
00:47:23,520 --> 00:47:30,420
Now that you know this terminology, CCDC, start trying to find some of the red teamer tools out there.

626
00:47:30,420 --> 00:47:32,520
There's some amazing stuff out there.

627
00:47:32,520 --> 00:47:36,320
And we generally do tag it for CCDC.

628
00:47:37,640 --> 00:47:40,000
If you take a look here, I got some URLs for you.

629
00:47:40,000 --> 00:47:49,220
If you want to check some stuff out for the northeastern corridor, you could do NECCDL.org.

630
00:47:49,240 --> 00:47:57,240
If you want to check out the national competitions, you know, maybe even become a red teamer there, check out nationalCCDC.org.

631
00:47:58,660 --> 00:48:00,780
But overall, check your local colleges.

632
00:48:00,780 --> 00:48:05,320
You never know, they may want to participate in this, and they haven't had anybody to actually start a program there, right?

633
00:48:05,320 --> 00:48:09,320
Volunteer some time to start a program, get with a professor, something along those lines.

634
00:48:10,080 --> 00:48:11,680
See if they already participate.

635
00:48:12,300 --> 00:48:21,280
You can help them with training, become a red teamer for them, set up a scenario for them, let them attack you, attack them, that type of thing.

636
00:48:21,340 --> 00:48:28,480
It's good fun, and it allows you to kind of stretch your muscles as a red teamer without having to really worry about scope, right?

637
00:48:28,480 --> 00:48:31,500
Like, if you blow up a box, who cares, right?

638
00:48:31,500 --> 00:48:38,800
But as, like, normal red team, you know, if you're trying to do pen testing, you really can't just, like, destroy a box, right?

639
00:48:38,800 --> 00:48:48,080
You can't really simulate being a hacker, because you're really not going to, you know, delete the domain controller, you would.

640
00:48:50,780 --> 00:48:53,520
It's the best two days you could have, right?

641
00:48:53,520 --> 00:48:54,820
Just outright.

642
00:48:55,000 --> 00:48:57,360
It's the best two days you could possibly have.

643
00:48:57,520 --> 00:49:02,420
It allows you to test new tools and tactics in a controlled, wild environment.

644
00:49:02,420 --> 00:49:05,120
You can just let it loose and go to town.

645
00:49:05,120 --> 00:49:08,380
As long as it doesn't leave the network, they don't really care what it does.

646
00:49:08,500 --> 00:49:13,160
As long as it doesn't, like, make the box catch fire, like, literally catch fire.

647
00:49:13,160 --> 00:49:14,680
I think we had that one year.

648
00:49:16,800 --> 00:49:21,580
But, well, I've had my 50 minutes.

649
00:49:21,860 --> 00:49:23,980
Omar, you want to come on back?