start	end	text
1830	7550	Hello, this is Forrest. I am here to speak to you today about some certain shenanigans that I pull
7550	12970	off once a year with hacking college kids and telling you exactly how they do it wrong.
13170	15230	Let's go ahead and get right into the slides.
16990	22110	So, if you want more information about me, you're welcome to look at JRWR.io. I'd be happy to
22110	26850	provide guidance. I have a contact page and sorts. You can get a hold of me on Twitter of sorts.
28770	34430	So, what I do... well, I should say, who am I? Some of you have probably seen me floating around
34430	41790	DEF CON before. I am Hachan, pretty much. Everybody knows me of this crazy hat of mine.
41790	46390	It's a pith helmet with a Wi-Fi access point on it. Everybody generally loves it. But I've
46390	51110	done a couple of other weird things over the years. Right now, I'm a Department of Defense
51730	58090	subcontractor, cybersecurity auditor. So, pretty much, I do audits for small military
58750	64270	manufacturers. You know, they make parts, whatever. And they do it terribly, usually.
64890	70530	It's rather boring, though. If you want to look up that in tomfoolery.
71370	77630	At one point, I was a Dogecoin mining pool operator for a fundraiser for the Doge car.
77630	81970	That was also awesome. And that's also where the pith helmet comes from. It was way back then.
83370	87490	As you can see, the Doge car was amazing. You should Google it. There's some videos
87490	92110	out there of me, you know, being chased with a beer cooler because I had to steal it for
92110	98430	some ice shenanigans. But for this talk, the really relevant is that I've been a red team
98430	105170	member for NECCDC for about three years now. It's Northeast Colgate Cyber Defense Competition.
106890	113290	The basics of the competition is that there is a blue team, which is college students,
113810	122370	being thrusted into a network of sorts, right? A standardized business network that they would
122370	130590	come across. And they have to do all the things. So, it's several teams of students from local
130590	137890	regions for the Northeast Corridor. And there's others for each region. And so,
137890	146070	they're kind of like an emergency blue team, right? So, they come in and they have to
147550	151990	fix the network, whatever's wrong with it, right, to get it stable. They have a list of services
151990	159870	that they have to keep online. We've already been given about an hour already to attack them as red
159870	164510	team before they could even get hands on keyboard the night before. So, we've got all of our
164510	173070	implants in place to make sure they're nice and pwned. Generally, it's a two-day event.
173550	181470	The red team is a group of chosen pen testers and infosec nerds. Generally, it's from mostly
181470	184910	people who've been working with a professor that's running at Daryl Johnson, at least for
184910	190810	the Northeast Corridor. Daryl's great. He goes to RIT, Rochester Institute of Technology,
191630	198230	and they run the red team. So, there are other teams of, you know, black and white support
198230	203750	as well. White teams is, you know, people in the rooms that help the teams out, kind of,
203750	208910	you know, just basic support roles, filing tickets if something explodes, things of that sort,
208910	213850	things get fired. The black team is the one who actually manages the infrastructure,
214350	218010	making sure everything's up and running and such. They generally have physical hardware
218010	221770	that they're dealing with. The previous one, they did not, of course, because it was virtual, but
222330	225990	the last two years, which is what we'll be covering, 2019 to 2018,
226910	231370	it was in person, and we could really futz with the hardware, with implants.
232850	239210	So, on top of defending themselves from red team, they also have to do other things that are worth
239210	243770	points, and some of it's worth a lot of points, right? There's incident response,
243770	251570	right? So, they have to write up a report stating that, you know, this is how we were compromised,
251570	254970	or this is what happened, you know, this is the current state of the system, this is what we did
254970	261690	to fix it, and such. These are called injects. Maybe it's a request from the CEO to do something
261690	268450	like change his password or allow him VPN access. Black team's always throwing them new stuff to do.
269210	272870	Those are worth a good amount of points. Those are considered daily operation stuff, right?
272870	276650	Stuff you'd have to do on a day-to-day basis as somebody who is blue team,
276650	286310	or just general IT in the network. So, then, from there, scoring is really based off of how long
286310	291890	red team had access, the reports made, and the services kept alive, and the scoring of
291890	296790	the services is automated, and we futz with that as well, you know, ARP spoofing and such.
298270	306970	So, the first hour that we get access to the network, we infect everything. We have all of
306970	311590	their passwords in a table already, so we have scripts in place, first thing we do is hit enter,
311590	317650	infects everything that we can get a hold of, and we do all the crazy. Cobalt strike,
317650	323450	which a lot of you might know from your toolkits, was actually written for NECCDC by Raphael Mudge,
323450	327210	great guy, by the way, if you ever meet him at DEF CON, he does float around there.
327890	333770	Dude is crazy good at it. He does these DNS slow burn beacons, so he will stack
333770	338250	beacons on top of one another, so he will do these really fast HTTP beacons,
338250	343290	but then he will have these beacons for, like, a special domain that he's only registered for this,
343290	348590	where it only pulls once every six hours, right? So, if they haven't removed it from the system,
348590	353170	they're not going to notice the traffic, and then he uses that to pivot more beacons into
353170	357550	the system for the faster ones, and that's the ones we work off of generally. He provides
357550	365430	the team server, and we, you know, futz with the system from there. He does, you know,
365430	374190	DNS fronting, IMCP pings, beacons, IPv6-based beacons we've done once before. That was fun,
374190	381330	because the Palo Altos don't filter that very well. But if you use Cobalt strike,
381330	387230	now you know why some of the features are like the way they are, because in all reality,
387230	393450	you know, at least from what I understand from Mudge, it was written for NECCDC, and it was
393450	399750	solving a problem that Armitage just wasn't solving, right? So, he was improving Armitage,
400890	404830	and he just got better with it, and he started selling it as a product, because it was a good
404830	411850	idea. You know, we disable the antivirus, infect the networking hardware, you know,
411850	418210	the Palo Alto, their switches, their firewalls. We have access to it all. So, we just go to town.
418970	422830	You know, we have full access to practically everything. We have the domain admin password,
422830	428370	so we just start deploying everything that we have in our arsenal. So, if you think of every
428370	434170	single piece of kit that you can deploy against what you have as domain admin for persistence,
434170	441390	we generally do it, right? We have a team of about 15. We're having to manage, I think it was
441390	446610	10 teams last year. So, we do have to kind of, it really is a high workload. That's why there's
447310	453570	a lot of grouping and stuff like that in Cobalt, is because we have to do it on a per team basis.
453570	461010	We have to score per team. I personally like doing Linux backdoors, because I'm a Linux nerd.
461010	470510	I do all kinds of footsie things. For instance, you know, PAM backdoors and things of that sort.
470510	478330	We'll cover that here in a moment. But we try to keep low, and we watch as teams try to find us,
478330	481830	right? Like, a lot of times, their services just go down, because they're just breaking
481830	490370	it for themselves, right? Like, we're just persisting. So, what we'll do is steal some
490370	498510	passwords. The Cobalt strike key logger is amazing for this. We will steal some SSH keys,
498510	504490	AWS keys, if they're doing cloud that year. They love just leaving them on their Linux boxes,
504490	512270	right? Who else are gonna put it? We'll reinfect using where we can. Some of the common backdoors
512270	517650	that we use, we have an IIS backdoor that was written. I don't think it's publicly released,
517650	526730	but it is signed. Using unleaked certificates, whenever he actually had a code signing cert,
526730	531830	but they wouldn't renew it on them this year. Some PAM SSH backdoors, we've been using that
531830	536990	thing forever. Still get students, we can just log in with whatever password we want as root.
537790	543950	Bash backdoors, these are my specialty. I've actually recompiled bash for systems and placed
543950	551390	backdoors. Run an extra curl command and pipe that into whatever. I've also been doing DNS
551390	558090	backdoors that way. There's an environmental variable that you can set. I can't remember
558090	564390	right offhand, but there's an environmental variable that you can set where it's a callback.
564390	568350	It's supposed to be the missing command callback or just a command callback, and it will run it
568350	573970	after every successful command. So you just run that every time, right? You set it in the ETC
573970	582610	profile. Nobody ever looks at their environmental variables for compromises, right? Not for two
582610	590510	years at least. We were piping dig directly into bash for that. We're doing TXT records and just
590510	595290	shoving shell in there and waiting for them to show up on their firewall. It wasn't like we're
595290	601590	encrypting it or anything. A lot of these times we'll have monitoring in place like Splunk,
601590	608570	and we'll just backdoor it. We had a guy who we call our Splunk nerd, and he has a custom
608570	616870	application that he'll attach to their Splunk instance. And what he'll do is then it'll become
616870	624010	his managed instance. So they're all kind of upstream to a centralized orchestra system,
624010	629290	and he just manages everybody's Splunk forum. So he can do deployment payloads that way. Most
629290	638290	team members don't notice that this is happening. It's very, very stealthy, and it's great. From
638290	641550	what I understand, the code for it's relatively easy to implement. You could just take one of
641550	647210	the sample applications and just have it be managed by something else. You're going to
647210	652130	play payloads through it. Most of the time they don't notice it's happening, and you'll see that
652130	658770	in some of the screenshots as well, that it's coming down through Splunk. We'll backdoor the
658770	664050	Palo Alto, put our own accounts in. There's certain hacks that particularly happen with
664050	670270	some of the web interface. They'll add little JavaScript snippets that report home. A lot of
670270	674070	times these get blocked because they're just blocking all HTTP traffic at this point, but
674070	681090	we'll actually inject custom theming where it'll send... when they change the password
681090	688630	to the web interface, it sends it back to us. I have a thing where I'll backdoor all the
688630	695750	else on a file system. I'll take BusyBox, full compile it, put the backdoor in there,
695750	703470	just runs the command through DNS again. Compile it, link it all out into the Debian system real
703470	707990	fast. Anytime they run an application at all, it gets compromised, and it links back to
708710	714630	the BusyBox parameter. And I futz with their path a little bit, and I point it,
714630	722770	I rearrange it so that it's in like user local bin is first, right? So you set that first,
722770	728770	you throw BusyBox in there, they'll never find it. Nobody, whoever looks in user local bin,
728770	739490	right? So we'll also do some tomfoolery. If we notice that they're trying to install
740250	744750	detection tools, right, on Windows or Linux, especially on Linux, they'll try to compile
744750	749590	stuff, we'll backdoor it. We have these CBackdoors that we just throw in any application
750470	754290	offhand, and we'll just... you can find them on GitHub, they're everywhere. You throw them in
754290	760450	there, and they compile it, and they run it. It's backdoored now. The rootkit-hunter is backdoored.
762230	765430	Mind you, we only have two days, so we're just throwing anything that we can, it'll stick,
765430	774850	right? So if we see somebody being clever, we'll just blue screen the box, right? Like,
774850	778770	we're not going to deal with any of their shit. You know, they're trying to be clever,
778770	786050	they're going through procmod and going, nope, and then crash the box, right? We'd rather just
786050	792070	crash the box before they get a hold of our loot. This is, you know, very rapid, you know,
792070	797790	this happened over the course of a couple of hours. We'll spot the screenshots coming in.
798010	804370	Through Cobalt Strike, we're like, well, he's up to no good. Eh, just crash the box.
804970	808750	We'll reboot it, that'll be fine, but maybe put some dancing bananas on the screen.
808770	815270	We'll get later to that. Sometimes we like to do annoyance. A lot of annoyance really kind of
815270	820710	annoys some of the teams. Like, there's some teams that really like to use tmux, and we'll
820710	827670	replace it with screen. You can't run tmux. Oh, but if you try to run screen, it just devurandoms
827670	833470	your terminal. But if you try to run ematics, it'll actually open vim, and if you try to open
833470	840490	vim, it opens up nano, which is super fun. They really hate that when you do that to somebody
840490	845010	who's trying to remediate a box, and his commands keep changing out underneath them.
845810	849950	And they're trying to figure out, how are you in the box? You're not even showing up. Well,
849950	854510	we have a tty in there through Metasploit or something like that, and we're just screwing
854510	860930	with you. Automation is key, though, right? If you're popping this many boxes, we're having
860930	867590	to handle over 100 boxes. Automation is key until you start noticing somebody trying to be clever,
867590	875430	and you go and futz with them for a couple of minutes. We'll reconfigure their DNS
876390	882370	to make them distracted. We'll just drop their DNS into a black hole. Our beacons still work,
882370	887610	but their DNS doesn't, right? They'll be pointing to our DNS servers, which drop everything but our
887610	895410	beacons. We've screwed up a couple of teams doing that. That was super fun. Reconfigure
895410	899670	the Palo Alto right underneath them, right? They keep adding a block rule,
899670	905510	we'll drop that block rule. Or we'll reconfigure that block rule where it doesn't work.
905730	909450	The order is out of place, and the allow rule is just stuck up there,
909450	913230	and all the block rules don't work. You know, order of operations.
915150	921630	And we'll reconfigure services to bring them down, right? That's part of the scoring. You know,
921630	926950	we don't have a particular score ourselves, but we want to make them score as least as they can
926950	934310	for all the teams. So we'll deface webpages, we'll deface their backgrounds, we'll deface
934310	943210	services, anything that we can get a hold of. Most services are scored with ping,
943210	949110	so if it doesn't match a checksum, then it's considered down, and we'll deface them,
949110	955190	bring them down. My personal favorite was uninstalling Nginx and replacing it with Apache,
955690	961750	kind of configuring it right, and then just leaving it half broken and letting them to fix it.
961810	970790	So, I mean, you know, trying to get as much time as you can to leave your main beacons alone,
970790	977430	have them misdirected, right? You want them to kind of focus on the craziness that is happening.
979690	987590	So, this is going faster than I expected, but hey, that's working. So day two is when the fun
987590	993090	really starts, right? Because we don't really want to blow up their boxes on the first day,
993090	998850	but we do want to do it on day two. So we install the new backdoors, anything that we cooked up
998850	1005630	overnight, because we don't sleep, right? That's what caffeine's for. And then we just activate
1005630	1010950	all my prank scripts. I started doing that when I first joined. I just had some on hand.
1012910	1016650	Rotate their screen. We'll see some of these, by the way. I got a little treat for you.
1016830	1022530	Rotate the screen by 90 degrees every 30 seconds. Makes it really hard to admin a box.
1023430	1027610	Dancing bananas all over the screen. It's actually a fork bomb I written. You can see an example of
1027610	1032010	that in the bottom right-hand corner. Them trying to kill it and it's not working.
1033550	1039810	500% sized mouse. Super funny when it happens. They can't really use the mouse because it's
1039810	1048830	slightly broken, but it's good fun. Bad keyboard inputs. You know, now they're DORVAC. Good luck.
1048830	1053490	You can't change it now, by the way. We've disallowed administrators from changing that
1053490	1058650	registry key. You're going to have to change the ACL on that. Sorry. You're going to have to go
1058650	1066710	find it. ACLs are very powerful in Windows for registry keys. You can set some insanity in there
1067350	1074290	and make it where they can't remove your shit unless they actually go in and rip those ACLs out,
1074290	1081490	right? So, if you had, like, I had one where it was part of the banana script, actually,
1082150	1087330	there's a list of process image names. It's the debugger key. Go look up the image name
1087330	1094830	debugger key and you can do some really backdoor shit. And it just will run programs. It'll say
1094830	1099110	program not found or my particular instance, every time you run the program, it would just spawn a
1099110	1106570	new banana. Task manager, ProcMon, a lot of the AV software that they were trying to run
1106570	1111150	would kind of be dynamic with it, you know? So, you know, we kind of work with it.
1111490	1118810	And generally, it was kind of a dynamic environment on day two trying to really screw
1118810	1122710	with them because they had a lot to think about, right? Like, they're really trying to keep their
1122710	1128150	services up from us because, you know, they have 15 people going on and they're just, you know,
1128150	1135770	they're a team of eight. Later on in the day, we'll really start screwing with services,
1135770	1139890	memes, you know, defacing backgrounds, things like that, really let them know that we're home.
1141490	1147190	Deleting files, programs, changing passwords, right? We'll delete files underneath them. We'll,
1147190	1154050	when they're writing a report, we'll just delete it right there in front of them.
1154470	1163070	We're so mean. But that's what makes this so much fun. You gotta try something. So, we'll
1163070	1169670	delete stuff they're writing. They're drawing something in MS Paint. We'll draw something for
1169670	1175630	them and they freak out because we're controlling their computer. We'll start Googling things for
1175630	1179930	them on their own computer. That's super fun, you know, brick rolling them, things like that,
1179930	1184150	you know, just opening up URLs, sending them helpful messages, offering help.
1185470	1191390	Ransoming the domain controller for donuts. It was the funnest thing we've done. We did that a
1191390	1195490	couple of times where we would ransom a service and we'd want donuts and they would have to go
1195490	1204610	and hunt down donuts or other various things for us. We had a dance-off to get your domain
1204610	1214950	controller back after we'd pwned like six of them. The Air Force won. So, as you can see,
1214950	1221950	this is the most fun you'll ever have as Red Team. Ever. Two days of packed full of craziness.
1221950	1226790	But it gets better. So, after we've done all the shenanigans,
1226790	1231850	there's a slight story here. So, if you look on the very, very bottom there,
1231850	1238830	there is a search warrant. We had one year, the local police department decided that they were
1238830	1244050	going to help out and we asked them, hey, you want to do a no-knock raid on some of the students'
1244050	1250010	rooms? So, we coordinated that with them and they did it for all the teams. They raided and took
1250010	1257730	their domain controller. Just stole it. Came in there, looking all official, scared the crap out
1257730	1264910	of most of them. It was great, though. It was hilarious the whole time. There is some video
1264910	1271810	of this I will show you later. But shenanigans. Lots and lots of shenanigans. The most shenanigans
1271810	1282930	you will ever have being a Red Teamer. So, the burn. This is the last hour. We're nuking the
1282930	1291710	disks. You can see here we're doing RMRF, no preserve route. Screw the disk. Blue screen the
1291710	1298190	boxes. Delete the AWS account. It doesn't like when you do that, by the way. Nine cat the boot
1298190	1304790	loaders. Anything we can do to destroy their systems. Anything we have access to left is
1304790	1317650	destroyed. Nuclear, right? So, after all of this is, you know, done, we tell them what we did,
1317650	1324630	right? We actually sit down with them, with every team, and say, well, okay, so you're team seven.
1325270	1330690	You kept giving us your password to the key loggers. You never found the PAM backdoor,
1330690	1335010	right? It's here. It's here every year. We told you this last year.
1336990	1344010	You know, you didn't block us, right? Were you checking for DNS traffic? Or were you too busy
1344010	1349370	doing injects? Or did your firewall guy not look because it was a new guy? Did he not check for
1349370	1353870	DNS traffic? Did he not check for IMCP traffic? Things of that sort. We would sit down with them
1353870	1359410	and tell them what they did wrong. A lot of it was they just weren't looking.
1360970	1365270	You know, anybody with Wireshark and a mirror port can really see us. Like,
1365270	1371670	when 90% of the traffic coming out of your box is DNS, and it's like gigs of it,
1371670	1378290	you have a problem. And a lot of times they just don't block it. I always said,
1378290	1382190	if you had a good firewall guy, somebody who had Wireshark open, mirror port,
1382190	1387090	just streaming logs, right? Maybe booted off of Live CD or something.
1387530	1394550	That they'd be able to find us, right? We're very noisy, right? Maybe this is long-term beacons.
1395290	1399370	Maybe not, but you just do standard incident response. And you know,
1399370	1404090	most of our stuff is detected, right? Cobalt strikes, super detectable.
1404270	1409350	You know, you open up ProcMod and you see the crap that's going on, and alas, right?
1410570	1417550	Kick us out as fast as you can, right? Even if you bring services down in incident response,
1417550	1421670	mind you, this is a compressed time frame. And this kind of goes for most incident response,
1421670	1428510	right? Don't be afraid to turn off the network. I mean, even if it's just, you know, 10 minutes,
1428510	1434150	right, to get your bearings and start looking at traffic, you know, hands off keyboard,
1434150	1439330	plug the Ethernet back in, see what's happening, right? See what's talking.
1441250	1445490	Track those traces down, kick us out, because if we kick us out, we can't get back in. If we don't
1445490	1450310	have your passwords, we don't have any beacons, we're not getting back in, right? Like, we have
1450310	1456030	some of the backdoors, and sometimes they stay, but a lot of the older ones, you know, they're
1456030	1461870	all picked up by AV nowadays. So, but a lot of it is they just haven't had a lot of experience
1462630	1467750	with dealing with these computers and dealing with systems like this, right? Like, they're in
1467910	1472770	a system administration role trying to do security, and all they've been taught is security.
1474550	1479930	So, and they kind of treat the operating system as hostile. They're not doing that most of the
1479930	1485690	time, right? They trust in the permission. They trust in the files they're leaving on the system.
1485690	1489830	They're trusting their backups. We've infected the backups. We've done that. They're going to
1489830	1495570	restore from a backup, and we'll reinfect them again, because it's an old password. And we always
1495570	1505610	try the old passwords, right? Like, this is how it works. So, you know, mostly it's just trying to
1505610	1510710	get the air out about what we're doing, right? It's really easy to spot us once you know what
1510710	1519810	we're doing, because we're up to all kinds of shenanigans. And so, it's not, it's not,
1520310	1525190	most of this stuff is just a grab bag of anything that we can find off of GitHub, for the most part.
1525190	1531350	I mean, Cobalt Strikes really nice. We do write some shenanigans for some of the scripts, but
1531970	1537410	really, though, we're not doing anything particularly special. But year after year,
1537410	1541930	and we have students, we have teams, we have teams that are amazing at this, right?
1542690	1549590	They'll kick us out in 15 minutes, and maybe we'll get back in second day, right? Maybe they'll
1549590	1554450	file for a phishing email. We've had that happen once. Or we'll steal something from their room.
1555630	1560790	They're supposed to, there's physical security kind, kind of involved. We keep it, you know,
1560790	1566770	we don't do it that much, but we'll steal a laptop, or, you know, or, you know, give it
1566770	1572750	back to them with, put SXP on it, and expect them to use it, because there was a service on it.
1575270	1581470	So, I have videos I'm going to show you. I'm going to talk over them. I'm not going to play
1581470	1587630	the terrible music that's on them. Both of these are on YouTube. You can look up NECCDC,
1587630	1593150	and you can find all of our previous year's videos, right? They're not very long. And they
1593150	1598090	really showcase some of the payloads that we're getting back, right? In a lot better way than I
1598090	1608310	can show. So, I'm going to play number one here. So, this is from 2019. I'm going to,
1608310	1615410	just a smidgen ahead here. So, we have backdoored their Wi-Fi router. It was,
1615410	1622950	we just get a custom update server. Here, they're Googling how to do security,
1622950	1628710	you know, Wi-Fi passwords. So, we get a little bit of a backdoor stream from white team,
1628710	1634170	and they'll post in the Slack some of the things that they find from us. But, ah, red team,
1634170	1648040	you know, passwords to the key loggers. And you can see, you know, we really,
1648040	1652020	it's just password discipline is so terrible with these people sometimes.
1653580	1658180	Um, you know, they're trying to track us down in ProcMon and
1661100	1664060	managementcorp.beaver. I don't think it's supposed to be that.
1665220	1673960	You know, we're futzing with their DNS. You know, changing their administrative passwords,
1673960	1679740	because if they don't know it, might as well rerun it. King Size Mouse just ran on a couple
1679740	1682960	of machines. You can see it here in action in Cobalt Strike.
1684340	1688320	Makes the machine very hard to use, but you can get rid of it.
1690900	1697080	They're trying to figure out why their DNS has been changed to another server, because it's ours now.
1703480	1710920	Yeah, we were dropping some rickrolls on them several times. A lot of kids, they just don't,
1710920	1717860	they just don't know the memes. Uh, yeah, we did that a couple of times. We'll change out the
1717860	1723020	Wi-Fi password, uh, the Wi-Fi AP to what their, what their password was. Just, just to show we
1723020	1731070	care. That's our little Wi-Fi. So we were, we had a backdoor, but they had to keep Wi-Fi up.
1731170	1735250	And so we had a little Wi-Fi router up that we were actually using as a backdoor.
1735250	1742440	We were getting all the teams with it. You know, making some puns and jokes and things of that
1742440	1751320	sort. We, we did it a lot. Um, uh, sometimes they'll accidentally paste the password into the
1751320	1758020	Slack. Don't do that. Um, there's bunkers being managed by red team. That's a pretty common
1758020	1769230	problem. This is all set to terrible music that I'd rather not play. Um,
1769230	1773930	I'm trying to install security essentials. Are they not teaching them what accounts as
1773930	1780650	antivirus on windows nowadays? Uh, APG does not work on windows server. Sorry.
1781670	1787650	Uh, you really should turn that on and setting your password is not going to do any good if
1787650	1797290	we have a key logger on the box, right? Um, we'll send them helpful messages, you know,
1797290	1802150	to annoy them that we see them that they're editing their firewall. It's not doing any good.
1803070	1811250	Um, more passwords, of course, uh, really the key logger is a key lockers are so old school,
1811250	1816730	right? Like, Oh, who installs a key logger? But they just give every time really looking
1816730	1822070	to install them key loggers. If you're popping a box, more dancing, bananas, shenanigans,
1822070	1828290	as usual. Uh, I always like to drop them on boxes that we kind of have access to that haven't done
1828290	1833010	anything on it in a while. Um, or just to show us the proof that we're, we're in their box,
1833010	1838710	right? We want to give them that little tickler that, uh, we're still fussing with their systems.
1839350	1845210	Uh, they'd try killing it, but each banana is a separate process. So if they don't know how
1845210	1852670	to mass kill stuff, then Malwarebytes ain't going to help you. Uh, you can see here they're,
1852670	1858330	they're actively being ran. Mind you, these, these recap videos are made like an hour before
1858330	1867690	the competition ends. So they're made in a rush. Uh, more helpful messages of banana man. They
1867690	1872750	weren't killing them fast enough. So I just kept spawning more of them just to annoy them.
1873650	1884410	Um, banana itself, it's not backdoored. Uh, it does change some, um, uh, yes. Yeah. So this is,
1884410	1890010	this is it rotating by 90 degrees every 30 seconds. And we actually got video from one
1890010	1898130	of the white team, these ultra wide monitors making it super stupid. Um, it's just, you know,
1898130	1903150	it works fine now, but give it 30 seconds and it won't. Uh, they're trying to figure out how
1903150	1907690	to kill it. And I'm playing yackety sax over there, over there, uh, audio at the same time.
1907690	1914570	They still haven't closed it. Uh, we do this to all the teams. This is the one we got video of.
1917330	1926570	And so this cracks me up every time I watch it. Um, you know, we give them some encouragement.
1926570	1934490	They get demoralized very quickly. Um, but, uh, we'll actually back off of people that we have
1934490	1939950	access to towards the end there. Uh, mostly because, you know, kicking the puppy while it's
1939950	1946510	down. We don't like to do that too terribly much, but you know, bananas on, on write-ups
1946510	1954030	is super great. Oh yeah. Nothing's infected. Bananas everywhere. Um, they write on the board.
1954030	1957870	Sometimes we'll, we'll steal passwords off the whiteboards. We'll, we'll take photos from
1957870	1965330	cracks in the walls and stuff. Uh, more bananas. Uh, I have one that'll just fork bomb a machine
1965330	1972350	to the point where it just won't run anymore. Um, a team challenged us saying, Hey, we don't
1972350	1978850	have any bananas on ours. Yeah. Give it 10 minutes. Um, yeah, you really shouldn't be
1978850	1985570	killing SVC hosts. Uh, they had sign-in cheats and we did actually sign in as red team and
1985570	1994630	nobody checked. Um, they're trying to run Clam AV on the box and that's not going to do any good.
1994630	2001210	The definitions are too old. These are examples of some of the injects. Um, some of it is quite
2001210	2006050	going fast, but, uh, you know, more, more words of encouragement.
2008250	2011970	I think at this particular point, right, they got so much stuff running that it's,
2011970	2015670	it's starting to bog down their boxes, but you know, they'll give us keys and
2016630	2023570	really we're just Googling stuff better than them. Uh, we're, we're letting, you know,
2023570	2027530	them know that their, their boxes still pops. There's really the WAP. That's what they had
2027530	2036310	in the rooms. One of the teams did that. Um, yeah, so we stole the laptops and we gave them
2036310	2042310	Windows XP. It was great. We put all of our malware on it too. And, uh, we stole it without
2042310	2047430	them knowing. It was great. All the teams did not notice that we had stolen their laptop
2048070	2053090	and we just gave it back to them. Uh, some encouragement from remote tech support.
2053650	2060490	Um, so this one, so they're doing some role-playing here. So this guy is yelling at them.
2060650	2064250	If you watch this video on YouTube, it's a little bit better, but this guy's yelling at him. Like,
2064250	2069890	well, why did he steal the laptop? Didn't you like record it down? Like, who was this person?
2070590	2076630	And, and like, well, I mean, you know, the student doesn't know what the hell's going on at this
2076630	2080710	point, right? Like he doesn't know how to respond. So the students are given real world scenarios
2080710	2088390	like, well, what the fuck? Why did the laptop walk off? Right. So he's trying to explain to
2088390	2094330	himself and it's, it's, it's, it's not very good. He's trying to figure out, well, did they just
2094330	2099950	steal it from underneath your keyboard? Like, how did this work? Why did you give him the laptop?
2101790	2105710	And why is he playing Tetris? Tetris is his boot letter.
2109750	2115590	So that happens so many times, right? We, we hardly get to see that as red team, but here's
2115590	2121110	us imaging them all. Somebody actually had an image for this laptop for Windows XP,
2121110	2128270	and they just downloaded it from work. And we kept, we were getting beacons off of them.
2132390	2137310	So we, this is some of the searches and typings that's coming in while we still have beacons for
2137310	2144670	days. Bad passwords. At this point, they've changed their password six, seven, eight times,
2144670	2151150	and they're just done, right? Like, oh, he, we, we, we made good friends with him. He's
2151150	2157610	going to pwn his own box, but unfortunately the beacon had disconnected. So, but he was
2157610	2161590	one of the team members. He, he'd wanted to dance off to get his domain controller back.
2162190	2165190	So it's like, here, you can pwn your domain controller again.
2170260	2174120	They had sign-in sheets. We were signing in with anything and everything under the sun,
2174120	2179160	and nobody was checking in when they should have been. They got scored against that too.
2180520	2190300	We're starting to delete things now, and it's just out of control at this point, right? So,
2190300	2195180	you know, a CEO is asking, why are you playing Tetris? We still run gateways. I thought we all
2195180	2200320	had Dells because their gateway was down. They didn't have internet because we nuked the Palo
2200320	2210440	Alto. More bananas just because wall messages back and forth, you know, chatting with the teammates
2210440	2216380	going, you know, can we pop, can we pop your box? As always, women are technical and capable of
2216380	2228230	breathing fire. Definitely so. So this one's where, you know, the network's down and he's
2228230	2236190	losing money. And he's yelling at the teammates going, well, what's going on? Like, I'm not going
2236190	2242570	to sell the other house in the Hamptons. I'm going to fire you first. Classic CEO speak,
2242570	2248430	and he just walks out. We saw Mr. Dino a lot of times. You'll still have beacons.
2248430	2255970	This is the group shot. This is all the red team for 2019. You can see me there in the corner,
2255970	2261070	Mudge in the center, you know, I don't remember half these people's names at this particular
2261070	2265350	point. We don't meet that often, but I have a mug with all their names on it, though.
2265830	2271530	Daryl's on the left there, but this is who they have to defend themselves against, right? They're
2271530	2278350	Silas. He used to work at VirusTotal. He would weaponize malware that he would get
2278350	2286190	from Google and VirusTotal and stick it on students. That madman! He would neuter it,
2286190	2291870	right? There was an incident, but he would neuter it and repurpose it for students,
2291870	2295790	so he would actually infect them with malware, just the beacons were going back to him instead.
2296610	2303610	Crazy, crazy fellow. Most of these guys are networking engineers. Most of them aren't
2303610	2308750	even Red Team. They aren't like, this is what they do as Red Team. They're more dangerous
2308750	2315150	because they're in the field every day, right? They're networking engineers, Splunk engineers,
2315690	2323370	but they know the full depth of those applications. They know what they can do,
2323370	2327710	and then you take that and twist it. That's what I think is fundamental to being a Red Teamer,
2327710	2332090	right? You know how that stuff's supposed to work, and then you twist it to your needs,
2332090	2339990	your evil, evil needs to do what you needed to do, right? You have much more scope availability.
2339990	2344890	You have the ability to hide better if you know more about what you're dealing with,
2344890	2350990	especially with applications. Well, I've just talked about Neroff. We'll go ahead and go on
2350990	2359910	to the second video here. Skip ahead a little. This is from 2018. More shenanigans, you know,
2359910	2369910	giving us their keys for AWS. Yes, we would persist with a team name called White Team on the box.
2372670	2376530	They had to go in through the serial console that year. They really didn't understand what was going
2376530	2386370	on. They didn't know it was serial. I think they were trying to screw with each other,
2386370	2392790	allowing us to say traffic's always a bad idea. These are, by the way, generally very flat
2392790	2398530	networks. You know, us and our Spunk admin going, hey, do you need to get your Spunk working?
2401450	2407810	Yes, we've done that. We've installed Linux on a box. You know, always check your agent names.
2408330	2413170	We're always changing your passwords for you because you should be changing them often,
2413170	2418250	and if you're not, we're going to. We'll wipe your backups always. That's just what we do.
2420070	2423410	PowerShell is in great gasps of what we do as well.
2425170	2432090	No, you can't get rid of DNS. That's just terrible. More keys. That's our key added in.
2433430	2439890	Us taking surveillance photos of passwords on the whiteboard. That's not a good place to put them.
2439890	2446290	Docker should not be running on your laptop. This is kind of what our desktop would look like,
2446290	2453010	right, because we have all the teams open. Somebody futzing with the Palo Alto, at least trying to.
2453990	2464530	Mudge sending beacons down. This is just, you know, SSH keys being sent in. Me playing annoying
2464530	2470930	noises because they had all in ones and I couldn't turn off the speakers. Oh, that was great.
2473630	2480270	We'll meme them up, change their logins to whatever we want. We'll change their
2480270	2485390	MODT and they forget it's there and it's backdooring every time that MODT runs.
2489550	2494890	We will sometimes, if you ask us to stop, sometimes we will, if you're nice to us,
2494890	2498310	just let our beacons live and we'll stop messing with your box.
2499530	2503330	That actually is probably pretty good advice to somebody who's actively in your network
2503330	2507270	and you're trying to fight them, but really you should just be unplugging the internet.
2508590	2514770	I played Tetris with, I attempted, and this is a really bad demo, but I attempted to play
2515970	2523130	a Tetris with somebody over their own TMUX session while in front of them. So I'm actually
2523130	2529550	attached to the TMUX session and I'm trying to get BSD games to work. But you know, if you've
2529550	2536130	lived in Debian land, that's actually kind of hard, but I'm playing some Worm with them, at least
2536130	2548200	trying to, well, attempting to. It's actually kind of a FUB. Why did I put that in here?
2548720	2559050	Oh, well, there's their keys. But while I'm for various effects, you know, their AWS access keys,
2559050	2564270	because they're leaving them in configs everywhere. Yes, it is our router.
2565850	2569250	Some people don't know what CloudTrail is. It's great.
2570130	2579420	Yes, the box is fucked. It is a technical term. That's always, always DNS's problem.
2580020	2587340	Yes, we stole all your passwords. They Google weird shit all the time.
2587340	2591080	One team decided to go this kind of advanced format for their passwords.
2593220	2600400	They didn't know what echo is. We find that a lot. A lot of kids don't know what is going on.
2600400	2608480	We'll send the messages to their Splunk. We'll actually interject bad Google results. We've
2608480	2613320	actually had it where Google would redirect to Bing and it would be the third page of Bing and
2613320	2620460	that's all they could access. This is beacons coming in from Splunk as they started to manage
2620460	2630590	their system for them. Somebody trying to do some art because they were bored and they didn't have
2630590	2638310	anything to do. We decided, I did at least, that I was going to make a little bit of fun.
2638370	2644390	I printed out this stupid piece of paper that said, hey, you're trying to get into SSH. Would
2644390	2648930	you like to try Telnet instead? Slipped it under everybody's door. We actually got them back,
2649310	2653490	a couple of them. There's the search warrant. That was fun. There's Clippy.
2654130	2659050	We got them back from a couple of teams. This is us ransomware-ing their team.
2661770	2670670	Yes, that happens a lot now. This is great. We made them take this photo for us.
2670670	2676830	And we made them apologize for trying to steal our firewall, which was their firewall,
2677330	2682970	but it was really our firewall now. We gave them back their firewall eventually, but
2683590	2693650	no, no guarantees there. Then we just start deleting stuff from them. It's the same stick
2693650	2700250	every year, practically. I know running Docker, we'll have beacons inside of Docker and they'll
2700250	2707410	never see them in there. We're starting to get beacons timing out now. Me DDing you random the
2707410	2711730	TTY for shits, and that's always super fun when it goes beepy hell.
2717520	2724540	Yep. And we're starting to delete sys32 now. Teams start usually playing music at this point
2724540	2728400	because there's not a whole lot they can do because we're just starting to pop boxes now.
2730540	2735120	Disable their internet, anything that we can do to destroy the box
2736600	2739080	at this point. So you get the general idea.
2742920	2747660	We start deleting all their AWS instances, which are scored, which has a bunch of stuff in it.
2748060	2753220	Making sure to delete all the snapshots, all the beacons are dead. This is the write-up where they
2753220	2762760	had to do the search and seizure. We'll actually kind of go back to that a little bit.
2763320	2765320	This is us deleting sys32.
2767560	2774560	And as such. So as you can see, we're up to all kinds of shenanigans.
2778020	2781540	Obviously, we've had some disruptions this morning in numerous ways. Under my standing
2781540	2785640	as law enforcement officer in the room, we collected some device or devices.
2785760	2790000	This is obviously concerning to the executive staff as we need to talk and make sure we
2790000	2795300	understand all the facts we know. This is the search and seizure.
2795320	2798520	That was pretty good. We don't have any video of it, though. It wasn't recorded,
2798520	2803420	because they just kind of surprised us on it. They even raided red team room at one point.
2804860	2813430	So as you can see, we generally have our standard reams. This is just the northeast
2813430	2824560	corridor, right? There's teams for every corridor. And yeah. So there's teams for every corridor.
2824560	2829260	And then they go to nationals, and they fight there, and they have some real red teamers there,
2829260	2834140	right? They'll actually bring out some stops. They have some amazing tools up there. A lot of
2834140	2838280	them they don't release, and it's for good reason, because they're very dangerous, actually.
2838760	2844260	And they're meant for only use in competitions. But you can find it, right? Now that you know
2844260	2850860	this terminology, CCDC, start trying to find some of the red teamer tools out there. There's some
2850860	2858880	amazing stuff out there. And we generally do tag it for CCDC. If you take a look here,
2858880	2863500	I got some URLs for you. If you want to check some stuff out for the northeastern corridor,
2863500	2871280	you could do NECCDL.org. If you want to check out the national competitions,
2871880	2877240	you know, maybe even become a red teamer there, check out nationalCCDC.org.
2878660	2882580	But overall, check your local colleges. You never know, they may want to participate in this,
2882580	2886240	and they haven't had anybody to actually start a program there, right? Volunteer some time to
2886240	2891680	start a program, get with a professor, something along those lines. See if they already participate.
2892300	2897620	You can help them with training, become a red teamer for them, set up a scenario for them,
2897620	2903740	let them attack you, attack them, that type of thing. It's good fun, and it allows you to kind
2903740	2908700	of stretch your muscles as a red teamer without having to really worry about scope, right? Like,
2908700	2914480	if you blow up a box, who cares, right? But as, like, normal red team, you know, if you're trying
2914480	2920360	to do pen testing, you really can't just, like, destroy a box, right? You can't really simulate
2920360	2926320	being a hacker, because you're really not going to, you know, delete the domain controller,
2926320	2936000	you would. It's the best two days you could have, right? Just outright. It's the best two days you
2936000	2942420	could possibly have. It allows you to test new tools and tactics in a controlled, wild environment.
2942420	2947180	You can just let it loose and go to town. As long as it doesn't leave the network, they don't really
2947180	2952720	care what it does. As long as it doesn't, like, make the box catch fire, like, literally catch
2952720	2963440	fire. I think we had that one year. But, well, I've had my 50 minutes. Omar, you want to come on
2963440	2963980	back?