Hello, this is Forrest. I am here to speak to you today about some certain shenanigans that I pull
off once a year with hacking college kids and telling you exactly how they do it wrong.
Let's go ahead and get right into the slides.
So, if you want more information about me, you're welcome to look at JRWR.io. I'd be happy to
provide guidance. I have a contact page and sorts. You can get a hold of me on Twitter of sorts.
So, what I do... well, I should say, who am I? Some of you have probably seen me floating around
DEF CON before. I am Hachan, pretty much. Everybody knows me of this crazy hat of mine.
It's a pith helmet with a Wi-Fi access point on it. Everybody generally loves it. But I've
done a couple of other weird things over the years. Right now, I'm a Department of Defense
subcontractor, cybersecurity auditor. So, pretty much, I do audits for small military
manufacturers. You know, they make parts, whatever. And they do it terribly, usually.
It's rather boring, though. If you want to look up that in tomfoolery.
At one point, I was a Dogecoin mining pool operator for a fundraiser for the Doge car.
That was also awesome. And that's also where the pith helmet comes from. It was way back then.
As you can see, the Doge car was amazing. You should Google it. There's some videos
out there of me, you know, being chased with a beer cooler because I had to steal it for
some ice shenanigans. But for this talk, the really relevant is that I've been a red team
member for NECCDC for about three years now. It's Northeast Colgate Cyber Defense Competition.
The basics of the competition is that there is a blue team, which is college students,
being thrusted into a network of sorts, right? A standardized business network that they would
come across. And they have to do all the things. So, it's several teams of students from local
regions for the Northeast Corridor. And there's others for each region. And so,
they're kind of like an emergency blue team, right? So, they come in and they have to
fix the network, whatever's wrong with it, right, to get it stable. They have a list of services
that they have to keep online. We've already been given about an hour already to attack them as red
team before they could even get hands on keyboard the night before. So, we've got all of our
implants in place to make sure they're nice and pwned. Generally, it's a two-day event.
The red team is a group of chosen pen testers and infosec nerds. Generally, it's from mostly
people who've been working with a professor that's running at Daryl Johnson, at least for
the Northeast Corridor. Daryl's great. He goes to RIT, Rochester Institute of Technology,
and they run the red team. So, there are other teams of, you know, black and white support
as well. White teams is, you know, people in the rooms that help the teams out, kind of,
you know, just basic support roles, filing tickets if something explodes, things of that sort,
things get fired. The black team is the one who actually manages the infrastructure,
making sure everything's up and running and such. They generally have physical hardware
that they're dealing with. The previous one, they did not, of course, because it was virtual, but
the last two years, which is what we'll be covering, 2019 to 2018,
it was in person, and we could really futz with the hardware, with implants.
So, on top of defending themselves from red team, they also have to do other things that are worth
points, and some of it's worth a lot of points, right? There's incident response,
right? So, they have to write up a report stating that, you know, this is how we were compromised,
or this is what happened, you know, this is the current state of the system, this is what we did
to fix it, and such. These are called injects. Maybe it's a request from the CEO to do something
like change his password or allow him VPN access. Black team's always throwing them new stuff to do.
Those are worth a good amount of points. Those are considered daily operation stuff, right?
Stuff you'd have to do on a day-to-day basis as somebody who is blue team,
or just general IT in the network. So, then, from there, scoring is really based off of how long
red team had access, the reports made, and the services kept alive, and the scoring of
the services is automated, and we futz with that as well, you know, ARP spoofing and such.
So, the first hour that we get access to the network, we infect everything. We have all of
their passwords in a table already, so we have scripts in place, first thing we do is hit enter,
infects everything that we can get a hold of, and we do all the crazy. Cobalt strike,
which a lot of you might know from your toolkits, was actually written for NECCDC by Raphael Mudge,
great guy, by the way, if you ever meet him at DEF CON, he does float around there.
Dude is crazy good at it. He does these DNS slow burn beacons, so he will stack
beacons on top of one another, so he will do these really fast HTTP beacons,
but then he will have these beacons for, like, a special domain that he's only registered for this,
where it only pulls once every six hours, right? So, if they haven't removed it from the system,
they're not going to notice the traffic, and then he uses that to pivot more beacons into
the system for the faster ones, and that's the ones we work off of generally. He provides
the team server, and we, you know, futz with the system from there. He does, you know,
DNS fronting, IMCP pings, beacons, IPv6-based beacons we've done once before. That was fun,
because the Palo Altos don't filter that very well. But if you use Cobalt strike,
now you know why some of the features are like the way they are, because in all reality,
you know, at least from what I understand from Mudge, it was written for NECCDC, and it was
solving a problem that Armitage just wasn't solving, right? So, he was improving Armitage,
and he just got better with it, and he started selling it as a product, because it was a good
idea. You know, we disable the antivirus, infect the networking hardware, you know,
the Palo Alto, their switches, their firewalls. We have access to it all. So, we just go to town.
You know, we have full access to practically everything. We have the domain admin password,
so we just start deploying everything that we have in our arsenal. So, if you think of every
single piece of kit that you can deploy against what you have as domain admin for persistence,
we generally do it, right? We have a team of about 15. We're having to manage, I think it was
10 teams last year. So, we do have to kind of, it really is a high workload. That's why there's
a lot of grouping and stuff like that in Cobalt, is because we have to do it on a per team basis.
We have to score per team. I personally like doing Linux backdoors, because I'm a Linux nerd.
I do all kinds of footsie things. For instance, you know, PAM backdoors and things of that sort.
We'll cover that here in a moment. But we try to keep low, and we watch as teams try to find us,
right? Like, a lot of times, their services just go down, because they're just breaking
it for themselves, right? Like, we're just persisting. So, what we'll do is steal some
passwords. The Cobalt strike key logger is amazing for this. We will steal some SSH keys,
AWS keys, if they're doing cloud that year. They love just leaving them on their Linux boxes,
right? Who else are gonna put it? We'll reinfect using where we can. Some of the common backdoors
that we use, we have an IIS backdoor that was written. I don't think it's publicly released,
but it is signed. Using unleaked certificates, whenever he actually had a code signing cert,
but they wouldn't renew it on them this year. Some PAM SSH backdoors, we've been using that
thing forever. Still get students, we can just log in with whatever password we want as root.
Bash backdoors, these are my specialty. I've actually recompiled bash for systems and placed
backdoors. Run an extra curl command and pipe that into whatever. I've also been doing DNS
backdoors that way. There's an environmental variable that you can set. I can't remember
right offhand, but there's an environmental variable that you can set where it's a callback.
It's supposed to be the missing command callback or just a command callback, and it will run it
after every successful command. So you just run that every time, right? You set it in the ETC
profile. Nobody ever looks at their environmental variables for compromises, right? Not for two
years at least. We were piping dig directly into bash for that. We're doing TXT records and just
shoving shell in there and waiting for them to show up on their firewall. It wasn't like we're
encrypting it or anything. A lot of these times we'll have monitoring in place like Splunk,
and we'll just backdoor it. We had a guy who we call our Splunk nerd, and he has a custom
application that he'll attach to their Splunk instance. And what he'll do is then it'll become
his managed instance. So they're all kind of upstream to a centralized orchestra system,
and he just manages everybody's Splunk forum. So he can do deployment payloads that way. Most
team members don't notice that this is happening. It's very, very stealthy, and it's great. From
what I understand, the code for it's relatively easy to implement. You could just take one of
the sample applications and just have it be managed by something else. You're going to
play payloads through it. Most of the time they don't notice it's happening, and you'll see that
in some of the screenshots as well, that it's coming down through Splunk. We'll backdoor the
Palo Alto, put our own accounts in. There's certain hacks that particularly happen with
some of the web interface. They'll add little JavaScript snippets that report home. A lot of
times these get blocked because they're just blocking all HTTP traffic at this point, but
we'll actually inject custom theming where it'll send... when they change the password
to the web interface, it sends it back to us. I have a thing where I'll backdoor all the
else on a file system. I'll take BusyBox, full compile it, put the backdoor in there,
just runs the command through DNS again. Compile it, link it all out into the Debian system real
fast. Anytime they run an application at all, it gets compromised, and it links back to
the BusyBox parameter. And I futz with their path a little bit, and I point it,
I rearrange it so that it's in like user local bin is first, right? So you set that first,
you throw BusyBox in there, they'll never find it. Nobody, whoever looks in user local bin,
right? So we'll also do some tomfoolery. If we notice that they're trying to install
detection tools, right, on Windows or Linux, especially on Linux, they'll try to compile
stuff, we'll backdoor it. We have these CBackdoors that we just throw in any application
offhand, and we'll just... you can find them on GitHub, they're everywhere. You throw them in
there, and they compile it, and they run it. It's backdoored now. The rootkit-hunter is backdoored.
Mind you, we only have two days, so we're just throwing anything that we can, it'll stick,
right? So if we see somebody being clever, we'll just blue screen the box, right? Like,
we're not going to deal with any of their shit. You know, they're trying to be clever,
they're going through procmod and going, nope, and then crash the box, right? We'd rather just
crash the box before they get a hold of our loot. This is, you know, very rapid, you know,
this happened over the course of a couple of hours. We'll spot the screenshots coming in.
Through Cobalt Strike, we're like, well, he's up to no good. Eh, just crash the box.
We'll reboot it, that'll be fine, but maybe put some dancing bananas on the screen.
We'll get later to that. Sometimes we like to do annoyance. A lot of annoyance really kind of
annoys some of the teams. Like, there's some teams that really like to use tmux, and we'll
replace it with screen. You can't run tmux. Oh, but if you try to run screen, it just devurandoms
your terminal. But if you try to run ematics, it'll actually open vim, and if you try to open
vim, it opens up nano, which is super fun. They really hate that when you do that to somebody
who's trying to remediate a box, and his commands keep changing out underneath them.
And they're trying to figure out, how are you in the box? You're not even showing up. Well,
we have a tty in there through Metasploit or something like that, and we're just screwing
with you. Automation is key, though, right? If you're popping this many boxes, we're having
to handle over 100 boxes. Automation is key until you start noticing somebody trying to be clever,
and you go and futz with them for a couple of minutes. We'll reconfigure their DNS
to make them distracted. We'll just drop their DNS into a black hole. Our beacons still work,
but their DNS doesn't, right? They'll be pointing to our DNS servers, which drop everything but our
beacons. We've screwed up a couple of teams doing that. That was super fun. Reconfigure
the Palo Alto right underneath them, right? They keep adding a block rule,
we'll drop that block rule. Or we'll reconfigure that block rule where it doesn't work.
The order is out of place, and the allow rule is just stuck up there,
and all the block rules don't work. You know, order of operations.
And we'll reconfigure services to bring them down, right? That's part of the scoring. You know,
we don't have a particular score ourselves, but we want to make them score as least as they can
for all the teams. So we'll deface webpages, we'll deface their backgrounds, we'll deface
services, anything that we can get a hold of. Most services are scored with ping,
so if it doesn't match a checksum, then it's considered down, and we'll deface them,
bring them down. My personal favorite was uninstalling Nginx and replacing it with Apache,
kind of configuring it right, and then just leaving it half broken and letting them to fix it.
So, I mean, you know, trying to get as much time as you can to leave your main beacons alone,
have them misdirected, right? You want them to kind of focus on the craziness that is happening.
So, this is going faster than I expected, but hey, that's working. So day two is when the fun
really starts, right? Because we don't really want to blow up their boxes on the first day,
but we do want to do it on day two. So we install the new backdoors, anything that we cooked up
overnight, because we don't sleep, right? That's what caffeine's for. And then we just activate
all my prank scripts. I started doing that when I first joined. I just had some on hand.
Rotate their screen. We'll see some of these, by the way. I got a little treat for you.
Rotate the screen by 90 degrees every 30 seconds. Makes it really hard to admin a box.
Dancing bananas all over the screen. It's actually a fork bomb I written. You can see an example of
that in the bottom right-hand corner. Them trying to kill it and it's not working.
500% sized mouse. Super funny when it happens. They can't really use the mouse because it's
slightly broken, but it's good fun. Bad keyboard inputs. You know, now they're DORVAC. Good luck.
You can't change it now, by the way. We've disallowed administrators from changing that
registry key. You're going to have to change the ACL on that. Sorry. You're going to have to go
find it. ACLs are very powerful in Windows for registry keys. You can set some insanity in there
and make it where they can't remove your shit unless they actually go in and rip those ACLs out,
right? So, if you had, like, I had one where it was part of the banana script, actually,
there's a list of process image names. It's the debugger key. Go look up the image name
debugger key and you can do some really backdoor shit. And it just will run programs. It'll say
program not found or my particular instance, every time you run the program, it would just spawn a
new banana. Task manager, ProcMon, a lot of the AV software that they were trying to run
would kind of be dynamic with it, you know? So, you know, we kind of work with it.
And generally, it was kind of a dynamic environment on day two trying to really screw
with them because they had a lot to think about, right? Like, they're really trying to keep their
services up from us because, you know, they have 15 people going on and they're just, you know,
they're a team of eight. Later on in the day, we'll really start screwing with services,
memes, you know, defacing backgrounds, things like that, really let them know that we're home.
Deleting files, programs, changing passwords, right? We'll delete files underneath them. We'll,
when they're writing a report, we'll just delete it right there in front of them.
We're so mean. But that's what makes this so much fun. You gotta try something. So, we'll
delete stuff they're writing. They're drawing something in MS Paint. We'll draw something for
them and they freak out because we're controlling their computer. We'll start Googling things for
them on their own computer. That's super fun, you know, brick rolling them, things like that,
you know, just opening up URLs, sending them helpful messages, offering help.
Ransoming the domain controller for donuts. It was the funnest thing we've done. We did that a
couple of times where we would ransom a service and we'd want donuts and they would have to go
and hunt down donuts or other various things for us. We had a dance-off to get your domain
controller back after we'd pwned like six of them. The Air Force won. So, as you can see,
this is the most fun you'll ever have as Red Team. Ever. Two days of packed full of craziness.
But it gets better. So, after we've done all the shenanigans,
there's a slight story here. So, if you look on the very, very bottom there,
there is a search warrant. We had one year, the local police department decided that they were
going to help out and we asked them, hey, you want to do a no-knock raid on some of the students'
rooms? So, we coordinated that with them and they did it for all the teams. They raided and took
their domain controller. Just stole it. Came in there, looking all official, scared the crap out
of most of them. It was great, though. It was hilarious the whole time. There is some video
of this I will show you later. But shenanigans. Lots and lots of shenanigans. The most shenanigans
you will ever have being a Red Teamer. So, the burn. This is the last hour. We're nuking the
disks. You can see here we're doing RMRF, no preserve route. Screw the disk. Blue screen the
boxes. Delete the AWS account. It doesn't like when you do that, by the way. Nine cat the boot
loaders. Anything we can do to destroy their systems. Anything we have access to left is
destroyed. Nuclear, right? So, after all of this is, you know, done, we tell them what we did,
right? We actually sit down with them, with every team, and say, well, okay, so you're team seven.
You kept giving us your password to the key loggers. You never found the PAM backdoor,
right? It's here. It's here every year. We told you this last year.
You know, you didn't block us, right? Were you checking for DNS traffic? Or were you too busy
doing injects? Or did your firewall guy not look because it was a new guy? Did he not check for
DNS traffic? Did he not check for IMCP traffic? Things of that sort. We would sit down with them
and tell them what they did wrong. A lot of it was they just weren't looking.
You know, anybody with Wireshark and a mirror port can really see us. Like,
when 90% of the traffic coming out of your box is DNS, and it's like gigs of it,
you have a problem. And a lot of times they just don't block it. I always said,
if you had a good firewall guy, somebody who had Wireshark open, mirror port,
just streaming logs, right? Maybe booted off of Live CD or something.
That they'd be able to find us, right? We're very noisy, right? Maybe this is long-term beacons.
Maybe not, but you just do standard incident response. And you know,
most of our stuff is detected, right? Cobalt strikes, super detectable.
You know, you open up ProcMod and you see the crap that's going on, and alas, right?
Kick us out as fast as you can, right? Even if you bring services down in incident response,
mind you, this is a compressed time frame. And this kind of goes for most incident response,
right? Don't be afraid to turn off the network. I mean, even if it's just, you know, 10 minutes,
right, to get your bearings and start looking at traffic, you know, hands off keyboard,
plug the Ethernet back in, see what's happening, right? See what's talking.
Track those traces down, kick us out, because if we kick us out, we can't get back in. If we don't
have your passwords, we don't have any beacons, we're not getting back in, right? Like, we have
some of the backdoors, and sometimes they stay, but a lot of the older ones, you know, they're
all picked up by AV nowadays. So, but a lot of it is they just haven't had a lot of experience
with dealing with these computers and dealing with systems like this, right? Like, they're in
a system administration role trying to do security, and all they've been taught is security.
So, and they kind of treat the operating system as hostile. They're not doing that most of the
time, right? They trust in the permission. They trust in the files they're leaving on the system.
They're trusting their backups. We've infected the backups. We've done that. They're going to
restore from a backup, and we'll reinfect them again, because it's an old password. And we always
try the old passwords, right? Like, this is how it works. So, you know, mostly it's just trying to
get the air out about what we're doing, right? It's really easy to spot us once you know what
we're doing, because we're up to all kinds of shenanigans. And so, it's not, it's not,
most of this stuff is just a grab bag of anything that we can find off of GitHub, for the most part.
I mean, Cobalt Strikes really nice. We do write some shenanigans for some of the scripts, but
really, though, we're not doing anything particularly special. But year after year,
and we have students, we have teams, we have teams that are amazing at this, right?
They'll kick us out in 15 minutes, and maybe we'll get back in second day, right? Maybe they'll
file for a phishing email. We've had that happen once. Or we'll steal something from their room.
They're supposed to, there's physical security kind, kind of involved. We keep it, you know,
we don't do it that much, but we'll steal a laptop, or, you know, or, you know, give it
back to them with, put SXP on it, and expect them to use it, because there was a service on it.
So, I have videos I'm going to show you. I'm going to talk over them. I'm not going to play
the terrible music that's on them. Both of these are on YouTube. You can look up NECCDC,
and you can find all of our previous year's videos, right? They're not very long. And they
really showcase some of the payloads that we're getting back, right? In a lot better way than I
can show. So, I'm going to play number one here. So, this is from 2019. I'm going to,
just a smidgen ahead here. So, we have backdoored their Wi-Fi router. It was,
we just get a custom update server. Here, they're Googling how to do security,
you know, Wi-Fi passwords. So, we get a little bit of a backdoor stream from white team,
and they'll post in the Slack some of the things that they find from us. But, ah, red team,
you know, passwords to the key loggers. And you can see, you know, we really,
it's just password discipline is so terrible with these people sometimes.
Um, you know, they're trying to track us down in ProcMon and
managementcorp.beaver. I don't think it's supposed to be that.
You know, we're futzing with their DNS. You know, changing their administrative passwords,
because if they don't know it, might as well rerun it. King Size Mouse just ran on a couple
of machines. You can see it here in action in Cobalt Strike.
Makes the machine very hard to use, but you can get rid of it.
They're trying to figure out why their DNS has been changed to another server, because it's ours now.
Yeah, we were dropping some rickrolls on them several times. A lot of kids, they just don't,
they just don't know the memes. Uh, yeah, we did that a couple of times. We'll change out the
Wi-Fi password, uh, the Wi-Fi AP to what their, what their password was. Just, just to show we
care. That's our little Wi-Fi. So we were, we had a backdoor, but they had to keep Wi-Fi up.
And so we had a little Wi-Fi router up that we were actually using as a backdoor.
We were getting all the teams with it. You know, making some puns and jokes and things of that
sort. We, we did it a lot. Um, uh, sometimes they'll accidentally paste the password into the
Slack. Don't do that. Um, there's bunkers being managed by red team. That's a pretty common
problem. This is all set to terrible music that I'd rather not play. Um,
I'm trying to install security essentials. Are they not teaching them what accounts as
antivirus on windows nowadays? Uh, APG does not work on windows server. Sorry.
Uh, you really should turn that on and setting your password is not going to do any good if
we have a key logger on the box, right? Um, we'll send them helpful messages, you know,
to annoy them that we see them that they're editing their firewall. It's not doing any good.
Um, more passwords, of course, uh, really the key logger is a key lockers are so old school,
right? Like, Oh, who installs a key logger? But they just give every time really looking
to install them key loggers. If you're popping a box, more dancing, bananas, shenanigans,
as usual. Uh, I always like to drop them on boxes that we kind of have access to that haven't done
anything on it in a while. Um, or just to show us the proof that we're, we're in their box,
right? We want to give them that little tickler that, uh, we're still fussing with their systems.
Uh, they'd try killing it, but each banana is a separate process. So if they don't know how
to mass kill stuff, then Malwarebytes ain't going to help you. Uh, you can see here they're,
they're actively being ran. Mind you, these, these recap videos are made like an hour before
the competition ends. So they're made in a rush. Uh, more helpful messages of banana man. They
weren't killing them fast enough. So I just kept spawning more of them just to annoy them.
Um, banana itself, it's not backdoored. Uh, it does change some, um, uh, yes. Yeah. So this is,
this is it rotating by 90 degrees every 30 seconds. And we actually got video from one
of the white team, these ultra wide monitors making it super stupid. Um, it's just, you know,
it works fine now, but give it 30 seconds and it won't. Uh, they're trying to figure out how
to kill it. And I'm playing yackety sax over there, over there, uh, audio at the same time.
They still haven't closed it. Uh, we do this to all the teams. This is the one we got video of.
And so this cracks me up every time I watch it. Um, you know, we give them some encouragement.
They get demoralized very quickly. Um, but, uh, we'll actually back off of people that we have
access to towards the end there. Uh, mostly because, you know, kicking the puppy while it's
down. We don't like to do that too terribly much, but you know, bananas on, on write-ups
is super great. Oh yeah. Nothing's infected. Bananas everywhere. Um, they write on the board.
Sometimes we'll, we'll steal passwords off the whiteboards. We'll, we'll take photos from
cracks in the walls and stuff. Uh, more bananas. Uh, I have one that'll just fork bomb a machine
to the point where it just won't run anymore. Um, a team challenged us saying, Hey, we don't
have any bananas on ours. Yeah. Give it 10 minutes. Um, yeah, you really shouldn't be
killing SVC hosts. Uh, they had sign-in cheats and we did actually sign in as red team and
nobody checked. Um, they're trying to run Clam AV on the box and that's not going to do any good.
The definitions are too old. These are examples of some of the injects. Um, some of it is quite
going fast, but, uh, you know, more, more words of encouragement.
I think at this particular point, right, they got so much stuff running that it's,
it's starting to bog down their boxes, but you know, they'll give us keys and
really we're just Googling stuff better than them. Uh, we're, we're letting, you know,
them know that their, their boxes still pops. There's really the WAP. That's what they had
in the rooms. One of the teams did that. Um, yeah, so we stole the laptops and we gave them
Windows XP. It was great. We put all of our malware on it too. And, uh, we stole it without
them knowing. It was great. All the teams did not notice that we had stolen their laptop
and we just gave it back to them. Uh, some encouragement from remote tech support.
Um, so this one, so they're doing some role-playing here. So this guy is yelling at them.
If you watch this video on YouTube, it's a little bit better, but this guy's yelling at him. Like,
well, why did he steal the laptop? Didn't you like record it down? Like, who was this person?
And, and like, well, I mean, you know, the student doesn't know what the hell's going on at this
point, right? Like he doesn't know how to respond. So the students are given real world scenarios
like, well, what the fuck? Why did the laptop walk off? Right. So he's trying to explain to
himself and it's, it's, it's, it's not very good. He's trying to figure out, well, did they just
steal it from underneath your keyboard? Like, how did this work? Why did you give him the laptop?
And why is he playing Tetris? Tetris is his boot letter.
So that happens so many times, right? We, we hardly get to see that as red team, but here's
us imaging them all. Somebody actually had an image for this laptop for Windows XP,
and they just downloaded it from work. And we kept, we were getting beacons off of them.
So we, this is some of the searches and typings that's coming in while we still have beacons for
days. Bad passwords. At this point, they've changed their password six, seven, eight times,
and they're just done, right? Like, oh, he, we, we, we made good friends with him. He's
going to pwn his own box, but unfortunately the beacon had disconnected. So, but he was
one of the team members. He, he'd wanted to dance off to get his domain controller back.
So it's like, here, you can pwn your domain controller again.
They had sign-in sheets. We were signing in with anything and everything under the sun,
and nobody was checking in when they should have been. They got scored against that too.
We're starting to delete things now, and it's just out of control at this point, right? So,
you know, a CEO is asking, why are you playing Tetris? We still run gateways. I thought we all
had Dells because their gateway was down. They didn't have internet because we nuked the Palo
Alto. More bananas just because wall messages back and forth, you know, chatting with the teammates
going, you know, can we pop, can we pop your box? As always, women are technical and capable of
breathing fire. Definitely so. So this one's where, you know, the network's down and he's
losing money. And he's yelling at the teammates going, well, what's going on? Like, I'm not going
to sell the other house in the Hamptons. I'm going to fire you first. Classic CEO speak,
and he just walks out. We saw Mr. Dino a lot of times. You'll still have beacons.
This is the group shot. This is all the red team for 2019. You can see me there in the corner,
Mudge in the center, you know, I don't remember half these people's names at this particular
point. We don't meet that often, but I have a mug with all their names on it, though.
Daryl's on the left there, but this is who they have to defend themselves against, right? They're
Silas. He used to work at VirusTotal. He would weaponize malware that he would get
from Google and VirusTotal and stick it on students. That madman! He would neuter it,
right? There was an incident, but he would neuter it and repurpose it for students,
so he would actually infect them with malware, just the beacons were going back to him instead.
Crazy, crazy fellow. Most of these guys are networking engineers. Most of them aren't
even Red Team. They aren't like, this is what they do as Red Team. They're more dangerous
because they're in the field every day, right? They're networking engineers, Splunk engineers,
but they know the full depth of those applications. They know what they can do,
and then you take that and twist it. That's what I think is fundamental to being a Red Teamer,
right? You know how that stuff's supposed to work, and then you twist it to your needs,
your evil, evil needs to do what you needed to do, right? You have much more scope availability.
You have the ability to hide better if you know more about what you're dealing with,
especially with applications. Well, I've just talked about Neroff. We'll go ahead and go on
to the second video here. Skip ahead a little. This is from 2018. More shenanigans, you know,
giving us their keys for AWS. Yes, we would persist with a team name called White Team on the box.
They had to go in through the serial console that year. They really didn't understand what was going
on. They didn't know it was serial. I think they were trying to screw with each other,
allowing us to say traffic's always a bad idea. These are, by the way, generally very flat
networks. You know, us and our Spunk admin going, hey, do you need to get your Spunk working?
Yes, we've done that. We've installed Linux on a box. You know, always check your agent names.
We're always changing your passwords for you because you should be changing them often,
and if you're not, we're going to. We'll wipe your backups always. That's just what we do.
PowerShell is in great gasps of what we do as well.
No, you can't get rid of DNS. That's just terrible. More keys. That's our key added in.
Us taking surveillance photos of passwords on the whiteboard. That's not a good place to put them.
Docker should not be running on your laptop. This is kind of what our desktop would look like,
right, because we have all the teams open. Somebody futzing with the Palo Alto, at least trying to.
Mudge sending beacons down. This is just, you know, SSH keys being sent in. Me playing annoying
noises because they had all in ones and I couldn't turn off the speakers. Oh, that was great.
We'll meme them up, change their logins to whatever we want. We'll change their
MODT and they forget it's there and it's backdooring every time that MODT runs.
We will sometimes, if you ask us to stop, sometimes we will, if you're nice to us,
just let our beacons live and we'll stop messing with your box.
That actually is probably pretty good advice to somebody who's actively in your network
and you're trying to fight them, but really you should just be unplugging the internet.
I played Tetris with, I attempted, and this is a really bad demo, but I attempted to play
a Tetris with somebody over their own TMUX session while in front of them. So I'm actually
attached to the TMUX session and I'm trying to get BSD games to work. But you know, if you've
lived in Debian land, that's actually kind of hard, but I'm playing some Worm with them, at least
trying to, well, attempting to. It's actually kind of a FUB. Why did I put that in here?
Oh, well, there's their keys. But while I'm for various effects, you know, their AWS access keys,
because they're leaving them in configs everywhere. Yes, it is our router.
Some people don't know what CloudTrail is. It's great.
Yes, the box is fucked. It is a technical term. That's always, always DNS's problem.
Yes, we stole all your passwords. They Google weird shit all the time.
One team decided to go this kind of advanced format for their passwords.
They didn't know what echo is. We find that a lot. A lot of kids don't know what is going on.
We'll send the messages to their Splunk. We'll actually interject bad Google results. We've
actually had it where Google would redirect to Bing and it would be the third page of Bing and
that's all they could access. This is beacons coming in from Splunk as they started to manage
their system for them. Somebody trying to do some art because they were bored and they didn't have
anything to do. We decided, I did at least, that I was going to make a little bit of fun.
I printed out this stupid piece of paper that said, hey, you're trying to get into SSH. Would
you like to try Telnet instead? Slipped it under everybody's door. We actually got them back,
a couple of them. There's the search warrant. That was fun. There's Clippy.
We got them back from a couple of teams. This is us ransomware-ing their team.
Yes, that happens a lot now. This is great. We made them take this photo for us.
And we made them apologize for trying to steal our firewall, which was their firewall,
but it was really our firewall now. We gave them back their firewall eventually, but
no, no guarantees there. Then we just start deleting stuff from them. It's the same stick
every year, practically. I know running Docker, we'll have beacons inside of Docker and they'll
never see them in there. We're starting to get beacons timing out now. Me DDing you random the
TTY for shits, and that's always super fun when it goes beepy hell.
Yep. And we're starting to delete sys32 now. Teams start usually playing music at this point
because there's not a whole lot they can do because we're just starting to pop boxes now.
Disable their internet, anything that we can do to destroy the box
at this point. So you get the general idea.
We start deleting all their AWS instances, which are scored, which has a bunch of stuff in it.
Making sure to delete all the snapshots, all the beacons are dead. This is the write-up where they
had to do the search and seizure. We'll actually kind of go back to that a little bit.
This is us deleting sys32.
And as such. So as you can see, we're up to all kinds of shenanigans.
Obviously, we've had some disruptions this morning in numerous ways. Under my standing
as law enforcement officer in the room, we collected some device or devices.
This is obviously concerning to the executive staff as we need to talk and make sure we
understand all the facts we know. This is the search and seizure.
That was pretty good. We don't have any video of it, though. It wasn't recorded,
because they just kind of surprised us on it. They even raided red team room at one point.
So as you can see, we generally have our standard reams. This is just the northeast
corridor, right? There's teams for every corridor. And yeah. So there's teams for every corridor.
And then they go to nationals, and they fight there, and they have some real red teamers there,
right? They'll actually bring out some stops. They have some amazing tools up there. A lot of
them they don't release, and it's for good reason, because they're very dangerous, actually.
And they're meant for only use in competitions. But you can find it, right? Now that you know
this terminology, CCDC, start trying to find some of the red teamer tools out there. There's some
amazing stuff out there. And we generally do tag it for CCDC. If you take a look here,
I got some URLs for you. If you want to check some stuff out for the northeastern corridor,
you could do NECCDL.org. If you want to check out the national competitions,
you know, maybe even become a red teamer there, check out nationalCCDC.org.
But overall, check your local colleges. You never know, they may want to participate in this,
and they haven't had anybody to actually start a program there, right? Volunteer some time to
start a program, get with a professor, something along those lines. See if they already participate.
You can help them with training, become a red teamer for them, set up a scenario for them,
let them attack you, attack them, that type of thing. It's good fun, and it allows you to kind
of stretch your muscles as a red teamer without having to really worry about scope, right? Like,
if you blow up a box, who cares, right? But as, like, normal red team, you know, if you're trying
to do pen testing, you really can't just, like, destroy a box, right? You can't really simulate
being a hacker, because you're really not going to, you know, delete the domain controller,
you would. It's the best two days you could have, right? Just outright. It's the best two days you
could possibly have. It allows you to test new tools and tactics in a controlled, wild environment.
You can just let it loose and go to town. As long as it doesn't leave the network, they don't really
care what it does. As long as it doesn't, like, make the box catch fire, like, literally catch
fire. I think we had that one year. But, well, I've had my 50 minutes. Omar, you want to come on
back?