WEBVTT 00:01.830 --> 00:03.450 Hello, this is Forrest. 00:03.450 --> 00:12.970 I am here to speak to you today about some certain shenanigans that I pull off once a year with hacking college kids and telling you exactly how they do it wrong. 00:13.170 --> 00:15.230 Let's go ahead and get right into the slides. 00:16.990 --> 00:21.590 So, if you want more information about me, you're welcome to look at JRWR.io. 00:21.590 --> 00:23.590 I'd be happy to provide guidance. 00:23.590 --> 00:24.970 I have a contact page and sorts. 00:24.970 --> 00:26.850 You can get a hold of me on Twitter of sorts. 00:28.770 --> 00:32.650 So, what I do... well, I should say, who am I? 00:32.650 --> 00:35.710 Some of you have probably seen me floating around DEF CON before. 00:36.630 --> 00:39.070 I am Hachan, pretty much. 00:39.070 --> 00:41.790 Everybody knows me of this crazy hat of mine. 00:41.790 --> 00:44.230 It's a pith helmet with a Wi-Fi access point on it. 00:44.230 --> 00:46.050 Everybody generally loves it. 00:46.130 --> 00:49.070 But I've done a couple of other weird things over the years. 00:49.330 --> 00:53.630 Right now, I'm a Department of Defense subcontractor, cybersecurity auditor. 00:53.630 --> 00:59.790 So, pretty much, I do audits for small military manufacturers. 00:59.850 --> 01:01.870 You know, they make parts, whatever. 01:02.150 --> 01:04.270 And they do it terribly, usually. 01:04.890 --> 01:06.170 It's rather boring, though. 01:06.350 --> 01:10.530 If you want to look up that in tomfoolery. 01:11.370 --> 01:17.630 At one point, I was a Dogecoin mining pool operator for a fundraiser for the Doge car. 01:17.630 --> 01:18.930 That was also awesome. 01:18.930 --> 01:20.690 And that's also where the pith helmet comes from. 01:20.690 --> 01:21.970 It was way back then. 01:23.370 --> 01:25.790 As you can see, the Doge car was amazing. 01:25.790 --> 01:26.630 You should Google it. 01:26.630 --> 01:33.630 There's some videos out there of me, you know, being chased with a beer cooler because I had to steal it for some ice shenanigans. 01:35.230 --> 01:41.870 But for this talk, the really relevant is that I've been a red team member for NECCDC for about three years now. 01:42.050 --> 01:45.170 It's Northeast Colgate Cyber Defense Competition. 01:46.890 --> 02:00.610 The basics of the competition is that there is a blue team, which is college students, being thrusted into a network of sorts, right? 02:00.610 --> 02:03.630 A standardized business network that they would come across. 02:03.830 --> 02:06.710 And they have to do all the things. 02:07.590 --> 02:13.030 So, it's several teams of students from local regions for the Northeast Corridor. 02:13.030 --> 02:15.950 And there's others for each region. 02:16.610 --> 02:21.390 And so, they're kind of like an emergency blue team, right? 02:21.390 --> 02:30.790 So, they come in and they have to fix the network, whatever's wrong with it, right, to get it stable. 02:30.790 --> 02:34.050 They have a list of services that they have to keep online. 02:35.650 --> 02:43.250 We've already been given about an hour already to attack them as red team before they could even get hands on keyboard the night before. 02:43.250 --> 02:48.870 So, we've got all of our implants in place to make sure they're nice and pwned. 02:50.910 --> 02:53.070 Generally, it's a two-day event. 02:53.550 --> 02:57.370 The red team is a group of chosen pen testers and infosec nerds. 02:57.710 --> 03:06.090 Generally, it's from mostly people who've been working with a professor that's running at Daryl Johnson, at least for the Northeast Corridor. 03:06.610 --> 03:07.790 Daryl's great. 03:08.030 --> 03:13.810 He goes to RIT, Rochester Institute of Technology, and they run the red team. 03:14.910 --> 03:19.370 So, there are other teams of, you know, black and white support as well. 03:19.370 --> 03:30.150 White teams is, you know, people in the rooms that help the teams out, kind of, you know, just basic support roles, filing tickets if something explodes, things of that sort, things get fired. 03:30.490 --> 03:36.690 The black team is the one who actually manages the infrastructure, making sure everything's up and running and such. 03:36.690 --> 03:39.170 They generally have physical hardware that they're dealing with. 03:39.170 --> 03:51.370 The previous one, they did not, of course, because it was virtual, but the last two years, which is what we'll be covering, 2019 to 2018, it was in person, and we could really futz with the hardware, with implants. 03:52.850 --> 04:01.850 So, on top of defending themselves from red team, they also have to do other things that are worth points, and some of it's worth a lot of points, right? 04:02.450 --> 04:04.010 There's incident response, right? 04:04.010 --> 04:17.150 So, they have to write up a report stating that, you know, this is how we were compromised, or this is what happened, you know, this is the current state of the system, this is what we did to fix it, and such. 04:17.150 --> 04:18.690 These are called injects. 04:19.050 --> 04:25.670 Maybe it's a request from the CEO to do something like change his password or allow him VPN access. 04:25.790 --> 04:28.450 Black team's always throwing them new stuff to do. 04:29.210 --> 04:30.530 Those are worth a good amount of points. 04:30.530 --> 04:32.870 Those are considered daily operation stuff, right? 04:32.870 --> 04:39.210 Stuff you'd have to do on a day-to-day basis as somebody who is blue team, or just general IT in the network. 04:40.630 --> 04:56.790 So, then, from there, scoring is really based off of how long red team had access, the reports made, and the services kept alive, and the scoring of the services is automated, and we futz with that as well, you know, ARP spoofing and such. 04:58.270 --> 05:05.790 So, the first hour that we get access to the network, we infect everything. 05:05.790 --> 05:16.470 We have all of their passwords in a table already, so we have scripts in place, first thing we do is hit enter, infects everything that we can get a hold of, and we do all the crazy. 05:16.790 --> 05:27.210 Cobalt strike, which a lot of you might know from your toolkits, was actually written for NECCDC by Raphael Mudge, great guy, by the way, if you ever meet him at DEF CON, he does float around there. 05:27.890 --> 05:30.130 Dude is crazy good at it. 05:30.130 --> 05:45.890 He does these DNS slow burn beacons, so he will stack beacons on top of one another, so he will do these really fast HTTP beacons, but then he will have these beacons for, like, a special domain that he's only registered for this, where it only pulls once every six hours, 05:45.890 --> 05:46.630 right? 05:46.630 --> 05:56.990 So, if they haven't removed it from the system, they're not going to notice the traffic, and then he uses that to pivot more beacons into the system for the faster ones, and that's the ones we work off of generally. 05:56.990 --> 06:01.990 He provides the team server, and we, you know, futz with the system from there. 06:03.350 --> 06:13.630 He does, you know, DNS fronting, IMCP pings, beacons, IPv6-based beacons we've done once before. 06:13.630 --> 06:16.810 That was fun, because the Palo Altos don't filter that very well. 06:18.910 --> 06:36.590 But if you use Cobalt strike, now you know why some of the features are like the way they are, because in all reality, you know, at least from what I understand from Mudge, it was written for NECCDC, and it was solving a problem that Armitage just wasn't solving, 06:36.590 --> 06:37.070 right? 06:37.070 --> 06:45.610 So, he was improving Armitage, and he just got better with it, and he started selling it as a product, because it was a good idea. 06:46.590 --> 06:54.370 You know, we disable the antivirus, infect the networking hardware, you know, the Palo Alto, their switches, their firewalls. 06:54.370 --> 06:56.110 We have access to it all. 06:56.110 --> 06:58.210 So, we just go to town. 06:58.970 --> 07:01.450 You know, we have full access to practically everything. 07:01.450 --> 07:06.070 We have the domain admin password, so we just start deploying everything that we have in our arsenal. 07:06.730 --> 07:15.530 So, if you think of every single piece of kit that you can deploy against what you have as domain admin for persistence, we generally do it, right? 07:15.530 --> 07:17.450 We have a team of about 15. 07:17.610 --> 07:22.870 We're having to manage, I think it was 10 teams last year. 07:22.870 --> 07:25.770 So, we do have to kind of, it really is a high workload. 07:25.770 --> 07:33.570 That's why there's a lot of grouping and stuff like that in Cobalt, is because we have to do it on a per team basis. 07:33.570 --> 07:35.250 We have to score per team. 07:37.890 --> 07:41.010 I personally like doing Linux backdoors, because I'm a Linux nerd. 07:41.010 --> 07:44.670 I do all kinds of footsie things. 07:45.310 --> 07:50.510 For instance, you know, PAM backdoors and things of that sort. 07:50.510 --> 07:52.310 We'll cover that here in a moment. 07:52.970 --> 07:58.610 But we try to keep low, and we watch as teams try to find us, right? 07:58.610 --> 08:03.310 Like, a lot of times, their services just go down, because they're just breaking it for themselves, right? 08:03.310 --> 08:05.010 Like, we're just persisting. 08:05.670 --> 08:11.090 So, what we'll do is steal some passwords. 08:11.090 --> 08:14.390 The Cobalt strike key logger is amazing for this. 08:14.910 --> 08:21.290 We will steal some SSH keys, AWS keys, if they're doing cloud that year. 08:21.410 --> 08:24.890 They love just leaving them on their Linux boxes, right? 08:24.890 --> 08:26.650 Who else are gonna put it? 08:28.550 --> 08:31.250 We'll reinfect using where we can. 08:31.250 --> 08:35.190 Some of the common backdoors that we use, we have an IIS backdoor that was written. 08:35.710 --> 08:39.450 I don't think it's publicly released, but it is signed. 08:40.450 --> 08:48.590 Using unleaked certificates, whenever he actually had a code signing cert, but they wouldn't renew it on them this year. 08:49.610 --> 08:52.890 Some PAM SSH backdoors, we've been using that thing forever. 08:53.410 --> 08:56.990 Still get students, we can just log in with whatever password we want as root. 08:57.790 --> 09:00.170 Bash backdoors, these are my specialty. 09:00.170 --> 09:04.570 I've actually recompiled bash for systems and placed backdoors. 09:04.570 --> 09:09.850 Run an extra curl command and pipe that into whatever. 09:10.210 --> 09:13.030 I've also been doing DNS backdoors that way. 09:13.550 --> 09:17.630 There's an environmental variable that you can set. 09:17.630 --> 09:24.390 I can't remember right offhand, but there's an environmental variable that you can set where it's a callback. 09:24.390 --> 09:30.890 It's supposed to be the missing command callback or just a command callback, and it will run it after every successful command. 09:31.590 --> 09:33.110 So you just run that every time, right? 09:33.110 --> 09:34.550 You set it in the ETC profile. 09:34.550 --> 09:40.730 Nobody ever looks at their environmental variables for compromises, right? 09:41.710 --> 09:43.950 Not for two years at least. 09:45.010 --> 09:48.710 We were piping dig directly into bash for that. 09:48.730 --> 09:54.630 We're doing TXT records and just shoving shell in there and waiting for them to show up on their firewall. 09:54.630 --> 09:56.750 It wasn't like we're encrypting it or anything. 09:58.450 --> 10:03.270 A lot of these times we'll have monitoring in place like Splunk, and we'll just backdoor it. 10:03.270 --> 10:12.950 We had a guy who we call our Splunk nerd, and he has a custom application that he'll attach to their Splunk instance. 10:13.430 --> 10:19.030 And what he'll do is then it'll become his managed instance. 10:19.030 --> 10:26.630 So they're all kind of upstream to a centralized orchestra system, and he just manages everybody's Splunk forum. 10:26.630 --> 10:28.930 So he can do deployment payloads that way. 10:28.930 --> 10:32.190 Most team members don't notice that this is happening. 10:32.870 --> 10:37.930 It's very, very stealthy, and it's great. 10:37.930 --> 10:40.810 From what I understand, the code for it's relatively easy to implement. 10:40.810 --> 10:46.130 You could just take one of the sample applications and just have it be managed by something else. 10:46.810 --> 10:48.890 You're going to play payloads through it. 10:49.770 --> 10:55.950 Most of the time they don't notice it's happening, and you'll see that in some of the screenshots as well, that it's coming down through Splunk. 10:57.830 --> 11:01.590 We'll backdoor the Palo Alto, put our own accounts in. 11:01.590 --> 11:05.490 There's certain hacks that particularly happen with some of the web interface. 11:05.490 --> 11:10.030 They'll add little JavaScript snippets that report home. 11:10.030 --> 11:23.630 A lot of times these get blocked because they're just blocking all HTTP traffic at this point, but we'll actually inject custom theming where it'll send... when they change the password to the web interface, it sends it back to us. 11:25.530 --> 11:30.290 I have a thing where I'll backdoor all the else on a file system. 11:30.290 --> 11:38.010 I'll take BusyBox, full compile it, put the backdoor in there, just runs the command through DNS again. 11:39.670 --> 11:43.890 Compile it, link it all out into the Debian system real fast. 11:43.890 --> 11:50.730 Anytime they run an application at all, it gets compromised, and it links back to the BusyBox parameter. 11:50.850 --> 12:01.650 And I futz with their path a little bit, and I point it, I rearrange it so that it's in like user local bin is first, right? 12:01.650 --> 12:06.070 So you set that first, you throw BusyBox in there, they'll never find it. 12:06.210 --> 12:09.690 Nobody, whoever looks in user local bin, right? 12:10.470 --> 12:16.530 So we'll also do some tomfoolery. 12:16.530 --> 12:26.570 If we notice that they're trying to install detection tools, right, on Windows or Linux, especially on Linux, they'll try to compile stuff, we'll backdoor it. 12:26.570 --> 12:33.670 We have these CBackdoors that we just throw in any application offhand, and we'll just... you can find them on GitHub, they're everywhere. 12:33.670 --> 12:37.310 You throw them in there, and they compile it, and they run it. 12:37.310 --> 12:38.550 It's backdoored now. 12:38.550 --> 12:40.450 The rootkit-hunter is backdoored. 12:42.230 --> 12:46.030 Mind you, we only have two days, so we're just throwing anything that we can, it'll stick, right? 12:47.690 --> 12:54.570 So if we see somebody being clever, we'll just blue screen the box, right? 12:54.570 --> 12:56.930 Like, we're not going to deal with any of their shit. 12:57.370 --> 13:05.370 You know, they're trying to be clever, they're going through procmod and going, nope, and then crash the box, right? 13:05.370 --> 13:08.290 We'd rather just crash the box before they get a hold of our loot. 13:09.870 --> 13:15.230 This is, you know, very rapid, you know, this happened over the course of a couple of hours. 13:15.230 --> 13:17.790 We'll spot the screenshots coming in. 13:18.010 --> 13:22.850 Through Cobalt Strike, we're like, well, he's up to no good. 13:22.850 --> 13:24.370 Eh, just crash the box. 13:24.970 --> 13:28.750 We'll reboot it, that'll be fine, but maybe put some dancing bananas on the screen. 13:28.770 --> 13:30.570 We'll get later to that. 13:31.930 --> 13:33.710 Sometimes we like to do annoyance. 13:33.710 --> 13:36.570 A lot of annoyance really kind of annoys some of the teams. 13:36.570 --> 13:42.010 Like, there's some teams that really like to use tmux, and we'll replace it with screen. 13:42.710 --> 13:44.070 You can't run tmux. 13:44.110 --> 13:48.470 Oh, but if you try to run screen, it just devurandoms your terminal. 13:49.050 --> 13:57.090 But if you try to run ematics, it'll actually open vim, and if you try to open vim, it opens up nano, which is super fun. 13:57.710 --> 14:05.010 They really hate that when you do that to somebody who's trying to remediate a box, and his commands keep changing out underneath them. 14:05.810 --> 14:08.550 And they're trying to figure out, how are you in the box? 14:08.550 --> 14:09.750 You're not even showing up. 14:09.750 --> 14:15.330 Well, we have a tty in there through Metasploit or something like that, and we're just screwing with you. 14:16.990 --> 14:19.170 Automation is key, though, right? 14:19.170 --> 14:23.030 If you're popping this many boxes, we're having to handle over 100 boxes. 14:24.390 --> 14:30.270 Automation is key until you start noticing somebody trying to be clever, and you go and futz with them for a couple of minutes. 14:31.670 --> 14:37.810 We'll reconfigure their DNS to make them distracted. 14:37.810 --> 14:40.570 We'll just drop their DNS into a black hole. 14:41.150 --> 14:44.230 Our beacons still work, but their DNS doesn't, right? 14:44.230 --> 14:48.490 They'll be pointing to our DNS servers, which drop everything but our beacons. 14:49.430 --> 14:51.710 We've screwed up a couple of teams doing that. 14:51.710 --> 14:53.070 That was super fun. 14:54.970 --> 14:58.270 Reconfigure the Palo Alto right underneath them, right? 14:58.270 --> 15:00.870 They keep adding a block rule, we'll drop that block rule. 15:00.870 --> 15:05.510 Or we'll reconfigure that block rule where it doesn't work. 15:05.730 --> 15:11.190 The order is out of place, and the allow rule is just stuck up there, and all the block rules don't work. 15:11.190 --> 15:13.230 You know, order of operations. 15:15.150 --> 15:19.830 And we'll reconfigure services to bring them down, right? 15:19.830 --> 15:21.410 That's part of the scoring. 15:21.410 --> 15:27.950 You know, we don't have a particular score ourselves, but we want to make them score as least as they can for all the teams. 15:27.950 --> 15:37.070 So we'll deface webpages, we'll deface their backgrounds, we'll deface services, anything that we can get a hold of. 15:37.310 --> 15:50.270 Most services are scored with ping, so if it doesn't match a checksum, then it's considered down, and we'll deface them, bring them down. 15:50.290 --> 16:01.750 My personal favorite was uninstalling Nginx and replacing it with Apache, kind of configuring it right, and then just leaving it half broken and letting them to fix it. 16:01.810 --> 16:13.030 So, I mean, you know, trying to get as much time as you can to leave your main beacons alone, have them misdirected, right? 16:13.030 --> 16:17.430 You want them to kind of focus on the craziness that is happening. 16:19.690 --> 16:25.110 So, this is going faster than I expected, but hey, that's working. 16:25.830 --> 16:28.670 So day two is when the fun really starts, right? 16:28.670 --> 16:35.810 Because we don't really want to blow up their boxes on the first day, but we do want to do it on day two. 16:36.170 --> 16:40.930 So we install the new backdoors, anything that we cooked up overnight, because we don't sleep, right? 16:40.930 --> 16:42.930 That's what caffeine's for. 16:43.650 --> 16:46.890 And then we just activate all my prank scripts. 16:46.890 --> 16:48.830 I started doing that when I first joined. 16:48.830 --> 16:50.950 I just had some on hand. 16:52.910 --> 16:53.850 Rotate their screen. 16:53.850 --> 16:55.210 We'll see some of these, by the way. 16:55.210 --> 16:56.650 I got a little treat for you. 16:56.830 --> 16:59.870 Rotate the screen by 90 degrees every 30 seconds. 16:59.870 --> 17:02.530 Makes it really hard to admin a box. 17:03.430 --> 17:05.050 Dancing bananas all over the screen. 17:05.050 --> 17:06.530 It's actually a fork bomb I written. 17:06.530 --> 17:09.110 You can see an example of that in the bottom right-hand corner. 17:09.110 --> 17:12.010 Them trying to kill it and it's not working. 17:13.550 --> 17:15.690 500% sized mouse. 17:15.810 --> 17:17.650 Super funny when it happens. 17:17.650 --> 17:23.190 They can't really use the mouse because it's slightly broken, but it's good fun. 17:23.810 --> 17:25.970 Bad keyboard inputs. 17:26.210 --> 17:27.730 You know, now they're DORVAC. 17:27.730 --> 17:28.830 Good luck. 17:28.830 --> 17:30.310 You can't change it now, by the way. 17:30.310 --> 17:34.570 We've disallowed administrators from changing that registry key. 17:34.570 --> 17:36.930 You're going to have to change the ACL on that. 17:36.930 --> 17:37.650 Sorry. 17:37.650 --> 17:39.870 You're going to have to go find it. 17:40.710 --> 17:44.490 ACLs are very powerful in Windows for registry keys. 17:44.490 --> 17:55.110 You can set some insanity in there and make it where they can't remove your shit unless they actually go in and rip those ACLs out, right? 17:55.610 --> 18:04.810 So, if you had, like, I had one where it was part of the banana script, actually, there's a list of process image names. 18:04.810 --> 18:06.190 It's the debugger key. 18:06.190 --> 18:10.830 Go look up the image name debugger key and you can do some really backdoor shit. 18:11.910 --> 18:14.550 And it just will run programs. 18:14.550 --> 18:20.010 It'll say program not found or my particular instance, every time you run the program, it would just spawn a new banana. 18:20.810 --> 18:28.950 Task manager, ProcMon, a lot of the AV software that they were trying to run would kind of be dynamic with it, you know? 18:28.950 --> 18:31.150 So, you know, we kind of work with it. 18:31.490 --> 18:40.890 And generally, it was kind of a dynamic environment on day two trying to really screw with them because they had a lot to think about, right? 18:40.890 --> 18:49.610 Like, they're really trying to keep their services up from us because, you know, they have 15 people going on and they're just, you know, they're a team of eight. 18:52.170 --> 18:59.890 Later on in the day, we'll really start screwing with services, memes, you know, defacing backgrounds, things like that, really let them know that we're home. 19:01.490 --> 19:04.650 Deleting files, programs, changing passwords, right? 19:04.650 --> 19:06.690 We'll delete files underneath them. 19:06.690 --> 19:14.050 We'll, when they're writing a report, we'll just delete it right there in front of them. 19:14.470 --> 19:16.550 We're so mean. 19:17.170 --> 19:20.690 But that's what makes this so much fun. 19:20.930 --> 19:22.330 You gotta try something. 19:22.330 --> 19:25.270 So, we'll delete stuff they're writing. 19:25.270 --> 19:27.870 They're drawing something in MS Paint. 19:27.870 --> 19:32.770 We'll draw something for them and they freak out because we're controlling their computer. 19:33.850 --> 19:36.830 We'll start Googling things for them on their own computer. 19:36.830 --> 19:44.150 That's super fun, you know, brick rolling them, things like that, you know, just opening up URLs, sending them helpful messages, offering help. 19:45.470 --> 19:47.670 Ransoming the domain controller for donuts. 19:47.670 --> 19:49.790 It was the funnest thing we've done. 19:50.350 --> 20:01.710 We did that a couple of times where we would ransom a service and we'd want donuts and they would have to go and hunt down donuts or other various things for us. 20:01.710 --> 20:07.430 We had a dance-off to get your domain controller back after we'd pwned like six of them. 20:07.770 --> 20:09.130 The Air Force won. 20:12.190 --> 20:17.450 So, as you can see, this is the most fun you'll ever have as Red Team. 20:17.450 --> 20:18.270 Ever. 20:18.430 --> 20:21.950 Two days of packed full of craziness. 20:21.950 --> 20:24.030 But it gets better. 20:24.490 --> 20:28.790 So, after we've done all the shenanigans, there's a slight story here. 20:28.790 --> 20:34.290 So, if you look on the very, very bottom there, there is a search warrant. 20:34.410 --> 20:44.670 We had one year, the local police department decided that they were going to help out and we asked them, hey, you want to do a no-knock raid on some of the students' rooms? 20:45.710 --> 20:48.810 So, we coordinated that with them and they did it for all the teams. 20:48.810 --> 20:50.990 They raided and took their domain controller. 20:50.990 --> 20:52.630 Just stole it. 20:53.130 --> 20:59.010 Came in there, looking all official, scared the crap out of most of them. 20:59.010 --> 21:00.770 It was great, though. 21:00.770 --> 21:04.070 It was hilarious the whole time. 21:04.290 --> 21:06.690 There is some video of this I will show you later. 21:07.610 --> 21:09.350 But shenanigans. 21:09.350 --> 21:11.130 Lots and lots of shenanigans. 21:11.130 --> 21:14.950 The most shenanigans you will ever have being a Red Teamer. 21:16.770 --> 21:19.230 So, the burn. 21:19.230 --> 21:20.650 This is the last hour. 21:21.830 --> 21:23.730 We're nuking the disks. 21:24.110 --> 21:28.050 You can see here we're doing RMRF, no preserve route. 21:28.050 --> 21:28.950 Screw the disk. 21:30.190 --> 21:32.570 Blue screen the boxes. 21:32.690 --> 21:34.550 Delete the AWS account. 21:34.550 --> 21:36.790 It doesn't like when you do that, by the way. 21:37.090 --> 21:38.850 Nine cat the boot loaders. 21:38.850 --> 21:40.950 Anything we can do to destroy their systems. 21:41.790 --> 21:45.970 Anything we have access to left is destroyed. 21:46.650 --> 21:48.190 Nuclear, right? 21:49.610 --> 21:58.050 So, after all of this is, you know, done, we tell them what we did, right? 21:58.050 --> 22:04.630 We actually sit down with them, with every team, and say, well, okay, so you're team seven. 22:05.270 --> 22:08.530 You kept giving us your password to the key loggers. 22:08.530 --> 22:11.110 You never found the PAM backdoor, right? 22:11.150 --> 22:11.910 It's here. 22:11.910 --> 22:13.150 It's here every year. 22:13.150 --> 22:15.010 We told you this last year. 22:16.990 --> 22:21.210 You know, you didn't block us, right? 22:21.210 --> 22:22.970 Were you checking for DNS traffic? 22:22.970 --> 22:25.190 Or were you too busy doing injects? 22:25.190 --> 22:28.590 Or did your firewall guy not look because it was a new guy? 22:28.590 --> 22:30.130 Did he not check for DNS traffic? 22:30.130 --> 22:31.810 Did he not check for IMCP traffic? 22:31.810 --> 22:32.690 Things of that sort. 22:32.690 --> 22:35.730 We would sit down with them and tell them what they did wrong. 22:36.830 --> 22:39.410 A lot of it was they just weren't looking. 22:40.970 --> 22:44.750 You know, anybody with Wireshark and a mirror port can really see us. 22:44.750 --> 22:53.450 Like, when 90% of the traffic coming out of your box is DNS, and it's like gigs of it, you have a problem. 22:54.430 --> 22:56.210 And a lot of times they just don't block it. 22:56.210 --> 23:04.430 I always said, if you had a good firewall guy, somebody who had Wireshark open, mirror port, just streaming logs, right? 23:04.530 --> 23:07.090 Maybe booted off of Live CD or something. 23:07.530 --> 23:10.270 That they'd be able to find us, right? 23:10.270 --> 23:12.170 We're very noisy, right? 23:12.170 --> 23:14.550 Maybe this is long-term beacons. 23:15.290 --> 23:18.770 Maybe not, but you just do standard incident response. 23:18.770 --> 23:21.870 And you know, most of our stuff is detected, right? 23:21.870 --> 23:24.090 Cobalt strikes, super detectable. 23:24.270 --> 23:29.350 You know, you open up ProcMod and you see the crap that's going on, and alas, right? 23:30.570 --> 23:33.390 Kick us out as fast as you can, right? 23:33.430 --> 23:39.750 Even if you bring services down in incident response, mind you, this is a compressed time frame. 23:39.750 --> 23:42.150 And this kind of goes for most incident response, right? 23:42.470 --> 23:44.850 Don't be afraid to turn off the network. 23:45.510 --> 23:57.350 I mean, even if it's just, you know, 10 minutes, right, to get your bearings and start looking at traffic, you know, hands off keyboard, plug the Ethernet back in, see what's happening, right? 23:57.350 --> 23:59.330 See what's talking. 24:01.250 --> 24:05.090 Track those traces down, kick us out, because if we kick us out, we can't get back in. 24:05.090 --> 24:09.390 If we don't have your passwords, we don't have any beacons, we're not getting back in, right? 24:09.390 --> 24:18.090 Like, we have some of the backdoors, and sometimes they stay, but a lot of the older ones, you know, they're all picked up by AV nowadays. 24:18.190 --> 24:26.790 So, but a lot of it is they just haven't had a lot of experience with dealing with these computers and dealing with systems like this, right? 24:26.790 --> 24:32.770 Like, they're in a system administration role trying to do security, and all they've been taught is security. 24:34.550 --> 24:37.650 So, and they kind of treat the operating system as hostile. 24:37.830 --> 24:40.930 They're not doing that most of the time, right? 24:40.930 --> 24:43.170 They trust in the permission. 24:43.170 --> 24:45.690 They trust in the files they're leaving on the system. 24:45.690 --> 24:47.350 They're trusting their backups. 24:47.350 --> 24:48.830 We've infected the backups. 24:48.830 --> 24:49.450 We've done that. 24:49.450 --> 24:54.350 They're going to restore from a backup, and we'll reinfect them again, because it's an old password. 24:54.350 --> 24:57.710 And we always try the old passwords, right? 24:57.710 --> 24:59.290 Like, this is how it works. 24:59.910 --> 25:08.190 So, you know, mostly it's just trying to get the air out about what we're doing, right? 25:08.190 --> 25:13.390 It's really easy to spot us once you know what we're doing, because we're up to all kinds of shenanigans. 25:13.810 --> 25:25.190 And so, it's not, it's not, most of this stuff is just a grab bag of anything that we can find off of GitHub, for the most part. 25:25.190 --> 25:28.130 I mean, Cobalt Strikes really nice. 25:28.130 --> 25:36.330 We do write some shenanigans for some of the scripts, but really, though, we're not doing anything particularly special. 25:36.330 --> 25:41.930 But year after year, and we have students, we have teams, we have teams that are amazing at this, right? 25:42.690 --> 25:48.410 They'll kick us out in 15 minutes, and maybe we'll get back in second day, right? 25:48.990 --> 25:50.890 Maybe they'll file for a phishing email. 25:51.010 --> 25:52.170 We've had that happen once. 25:52.170 --> 25:54.450 Or we'll steal something from their room. 25:55.630 --> 25:59.010 They're supposed to, there's physical security kind, kind of involved. 25:59.010 --> 26:12.750 We keep it, you know, we don't do it that much, but we'll steal a laptop, or, you know, or, you know, give it back to them with, put SXP on it, and expect them to use it, because there was a service on it. 26:15.270 --> 26:19.850 So, I have videos I'm going to show you. 26:19.850 --> 26:20.850 I'm going to talk over them. 26:20.850 --> 26:23.230 I'm not going to play the terrible music that's on them. 26:23.250 --> 26:24.870 Both of these are on YouTube. 26:25.170 --> 26:31.510 You can look up NECCDC, and you can find all of our previous year's videos, right? 26:31.510 --> 26:32.590 They're not very long. 26:32.730 --> 26:37.250 And they really showcase some of the payloads that we're getting back, right? 26:37.250 --> 26:39.050 In a lot better way than I can show. 26:39.150 --> 26:42.670 So, I'm going to play number one here. 26:43.370 --> 26:45.270 So, this is from 2019. 26:46.790 --> 26:50.350 I'm going to, just a smidgen ahead here. 26:50.350 --> 26:53.230 So, we have backdoored their Wi-Fi router. 26:53.230 --> 26:57.790 It was, we just get a custom update server. 26:58.530 --> 27:05.070 Here, they're Googling how to do security, you know, Wi-Fi passwords. 27:05.530 --> 27:11.790 So, we get a little bit of a backdoor stream from white team, and they'll post in the Slack some of the things that they find from us. 27:11.790 --> 27:16.570 But, ah, red team, you know, passwords to the key loggers. 27:23.600 --> 27:32.020 And you can see, you know, we really, it's just password discipline is so terrible with these people sometimes. 27:33.580 --> 27:42.120 Um, you know, they're trying to track us down in ProcMon and managementcorp.beaver. 27:42.120 --> 27:44.060 I don't think it's supposed to be that. 27:45.220 --> 27:48.640 You know, we're futzing with their DNS. 27:49.820 --> 27:57.500 You know, changing their administrative passwords, because if they don't know it, might as well rerun it. 27:58.060 --> 28:00.380 King Size Mouse just ran on a couple of machines. 28:00.380 --> 28:02.960 You can see it here in action in Cobalt Strike. 28:04.340 --> 28:08.320 Makes the machine very hard to use, but you can get rid of it. 28:10.900 --> 28:17.080 They're trying to figure out why their DNS has been changed to another server, because it's ours now. 28:23.480 --> 28:28.040 Yeah, we were dropping some rickrolls on them several times. 28:28.920 --> 28:32.640 A lot of kids, they just don't, they just don't know the memes. 28:34.520 --> 28:37.220 Uh, yeah, we did that a couple of times. 28:37.220 --> 28:41.540 We'll change out the Wi-Fi password, uh, the Wi-Fi AP to what their, what their password was. 28:41.540 --> 28:43.860 Just, just to show we care. 28:47.070 --> 28:48.290 That's our little Wi-Fi. 28:48.290 --> 28:51.070 So we were, we had a backdoor, but they had to keep Wi-Fi up. 28:51.170 --> 28:55.250 And so we had a little Wi-Fi router up that we were actually using as a backdoor. 28:55.250 --> 28:57.390 We were getting all the teams with it. 28:59.540 --> 29:02.800 You know, making some puns and jokes and things of that sort. 29:02.800 --> 29:04.300 We, we did it a lot. 29:05.140 --> 29:11.700 Um, uh, sometimes they'll accidentally paste the password into the Slack. 29:11.700 --> 29:13.060 Don't do that. 29:14.480 --> 29:17.080 Um, there's bunkers being managed by red team. 29:17.080 --> 29:19.140 That's a pretty common problem. 29:22.310 --> 29:25.850 This is all set to terrible music that I'd rather not play. 29:27.230 --> 29:31.550 Um, I'm trying to install security essentials. 29:31.550 --> 29:35.990 Are they not teaching them what accounts as antivirus on windows nowadays? 29:37.050 --> 29:39.710 Uh, APG does not work on windows server. 29:39.710 --> 29:40.650 Sorry. 29:41.670 --> 29:50.130 Uh, you really should turn that on and setting your password is not going to do any good if we have a key logger on the box, right? 29:52.870 --> 30:01.010 Um, we'll send them helpful messages, you know, to annoy them that we see them that they're editing their firewall. 30:01.010 --> 30:02.150 It's not doing any good. 30:03.070 --> 30:11.670 Um, more passwords, of course, uh, really the key logger is a key lockers are so old school, right? 30:11.670 --> 30:13.930 Like, Oh, who installs a key logger? 30:13.930 --> 30:17.790 But they just give every time really looking to install them key loggers. 30:17.790 --> 30:23.410 If you're popping a box, more dancing, bananas, shenanigans, as usual. 30:24.910 --> 30:29.550 Uh, I always like to drop them on boxes that we kind of have access to that haven't done anything on it in a while. 30:29.990 --> 30:33.330 Um, or just to show us the proof that we're, we're in their box, right? 30:33.330 --> 30:38.710 We want to give them that little tickler that, uh, we're still fussing with their systems. 30:39.350 --> 30:43.810 Uh, they'd try killing it, but each banana is a separate process. 30:44.050 --> 30:50.130 So if they don't know how to mass kill stuff, then Malwarebytes ain't going to help you. 30:51.510 --> 30:54.370 Uh, you can see here they're, they're actively being ran. 30:54.370 --> 30:59.510 Mind you, these, these recap videos are made like an hour before the competition ends. 30:59.650 --> 31:03.090 So they're made in a rush. 31:04.410 --> 31:07.550 Uh, more helpful messages of banana man. 31:07.550 --> 31:09.190 They weren't killing them fast enough. 31:09.190 --> 31:12.750 So I just kept spawning more of them just to annoy them. 31:13.650 --> 31:18.530 Um, banana itself, it's not backdoored. 31:18.530 --> 31:22.830 Uh, it does change some, um, uh, yes. 31:22.830 --> 31:23.030 Yeah. 31:23.030 --> 31:28.150 So this is, this is it rotating by 90 degrees every 30 seconds. 31:28.150 --> 31:34.370 And we actually got video from one of the white team, these ultra wide monitors making it super stupid. 31:35.310 --> 31:41.990 Um, it's just, you know, it works fine now, but give it 30 seconds and it won't. 31:42.190 --> 31:43.750 Uh, they're trying to figure out how to kill it. 31:43.750 --> 31:47.690 And I'm playing yackety sax over there, over there, uh, audio at the same time. 31:47.690 --> 31:48.930 They still haven't closed it. 31:51.190 --> 31:52.870 Uh, we do this to all the teams. 31:52.870 --> 31:54.570 This is the one we got video of. 31:57.330 --> 32:02.270 And so this cracks me up every time I watch it. 32:03.650 --> 32:06.570 Um, you know, we give them some encouragement. 32:06.570 --> 32:08.670 They get demoralized very quickly. 32:09.450 --> 32:16.030 Um, but, uh, we'll actually back off of people that we have access to towards the end there. 32:16.370 --> 32:20.510 Uh, mostly because, you know, kicking the puppy while it's down. 32:20.510 --> 32:27.490 We don't like to do that too terribly much, but you know, bananas on, on write-ups is super great. 32:27.490 --> 32:27.870 Oh yeah. 32:27.910 --> 32:29.030 Nothing's infected. 32:29.030 --> 32:30.210 Bananas everywhere. 32:32.450 --> 32:34.030 Um, they write on the board. 32:34.030 --> 32:36.590 Sometimes we'll, we'll steal passwords off the whiteboards. 32:36.590 --> 32:40.070 We'll, we'll take photos from cracks in the walls and stuff. 32:40.850 --> 32:42.290 Uh, more bananas. 32:42.510 --> 32:47.670 Uh, I have one that'll just fork bomb a machine to the point where it just won't run anymore. 32:48.110 --> 32:53.710 Um, a team challenged us saying, Hey, we don't have any bananas on ours. 32:53.710 --> 32:54.090 Yeah. 32:54.090 --> 32:55.530 Give it 10 minutes. 32:56.330 --> 33:00.550 Um, yeah, you really shouldn't be killing SVC hosts. 33:01.890 --> 33:06.770 Uh, they had sign-in cheats and we did actually sign in as red team and nobody checked. 33:08.030 --> 33:14.630 Um, they're trying to run Clam AV on the box and that's not going to do any good. 33:14.630 --> 33:16.550 The definitions are too old. 33:17.050 --> 33:20.170 These are examples of some of the injects. 33:20.170 --> 33:26.050 Um, some of it is quite going fast, but, uh, you know, more, more words of encouragement. 33:28.250 --> 33:39.450 I think at this particular point, right, they got so much stuff running that it's, it's starting to bog down their boxes, but you know, they'll give us keys and really we're just Googling stuff better than them. 33:40.310 --> 33:45.910 Uh, we're, we're letting, you know, them know that their, their boxes still pops. 33:45.910 --> 33:46.970 There's really the WAP. 33:46.970 --> 33:48.130 That's what they had in the rooms. 33:48.130 --> 33:49.690 One of the teams did that. 33:51.030 --> 33:57.150 Um, yeah, so we stole the laptops and we gave them Windows XP. 33:57.810 --> 33:58.710 It was great. 33:58.710 --> 34:00.310 We put all of our malware on it too. 34:00.310 --> 34:03.030 And, uh, we stole it without them knowing. 34:03.030 --> 34:04.190 It was great. 34:04.710 --> 34:10.270 All the teams did not notice that we had stolen their laptop and we just gave it back to them. 34:10.330 --> 34:13.090 Uh, some encouragement from remote tech support. 34:13.650 --> 34:18.450 Um, so this one, so they're doing some role-playing here. 34:18.450 --> 34:20.490 So this guy is yelling at them. 34:20.650 --> 34:23.970 If you watch this video on YouTube, it's a little bit better, but this guy's yelling at him. 34:23.970 --> 34:26.770 Like, well, why did he steal the laptop? 34:26.770 --> 34:28.410 Didn't you like record it down? 34:28.410 --> 34:29.890 Like, who was this person? 34:30.590 --> 34:37.090 And, and like, well, I mean, you know, the student doesn't know what the hell's going on at this point, right? 34:37.090 --> 34:38.850 Like he doesn't know how to respond. 34:38.930 --> 34:42.350 So the students are given real world scenarios like, well, what the fuck? 34:42.350 --> 34:44.850 Why did the laptop walk off? 34:45.430 --> 34:46.010 Right. 34:46.650 --> 34:52.030 So he's trying to explain to himself and it's, it's, it's, it's not very good. 34:52.410 --> 34:56.470 He's trying to figure out, well, did they just steal it from underneath your keyboard? 34:56.470 --> 34:57.910 Like, how did this work? 34:57.910 --> 34:59.950 Why did you give him the laptop? 35:01.790 --> 35:03.730 And why is he playing Tetris? 35:03.830 --> 35:05.710 Tetris is his boot letter. 35:09.750 --> 35:13.130 So that happens so many times, right? 35:13.130 --> 35:17.030 We, we hardly get to see that as red team, but here's us imaging them all. 35:17.070 --> 35:23.290 Somebody actually had an image for this laptop for Windows XP, and they just downloaded it from work. 35:25.950 --> 35:28.270 And we kept, we were getting beacons off of them. 35:32.390 --> 35:38.230 So we, this is some of the searches and typings that's coming in while we still have beacons for days. 35:40.710 --> 35:41.990 Bad passwords. 35:41.990 --> 35:46.170 At this point, they've changed their password six, seven, eight times, and they're just done, right? 35:46.170 --> 35:50.990 Like, oh, he, we, we, we made good friends with him. 35:50.990 --> 35:55.250 He's going to pwn his own box, but unfortunately the beacon had disconnected. 35:55.630 --> 35:58.790 So, but he was one of the team members. 35:58.790 --> 36:01.590 He, he'd wanted to dance off to get his domain controller back. 36:02.190 --> 36:05.190 So it's like, here, you can pwn your domain controller again. 36:10.260 --> 36:11.660 They had sign-in sheets. 36:11.660 --> 36:17.200 We were signing in with anything and everything under the sun, and nobody was checking in when they should have been. 36:17.200 --> 36:19.160 They got scored against that too. 36:20.520 --> 36:28.700 We're starting to delete things now, and it's just out of control at this point, right? 36:28.820 --> 36:33.540 So, you know, a CEO is asking, why are you playing Tetris? 36:33.600 --> 36:34.780 We still run gateways. 36:34.780 --> 36:38.660 I thought we all had Dells because their gateway was down. 36:38.660 --> 36:41.120 They didn't have internet because we nuked the Palo Alto. 36:41.940 --> 36:53.900 More bananas just because wall messages back and forth, you know, chatting with the teammates going, you know, can we pop, can we pop your box? 36:53.900 --> 36:57.180 As always, women are technical and capable of breathing fire. 36:57.300 --> 36:58.660 Definitely so. 37:05.610 --> 37:09.030 So this one's where, you know, the network's down and he's losing money. 37:10.650 --> 37:15.670 And he's yelling at the teammates going, well, what's going on? 37:15.670 --> 37:17.950 Like, I'm not going to sell the other house in the Hamptons. 37:17.950 --> 37:19.950 I'm going to fire you first. 37:21.150 --> 37:23.830 Classic CEO speak, and he just walks out. 37:25.550 --> 37:26.590 We saw Mr. 37:26.590 --> 37:27.510 Dino a lot of times. 37:27.510 --> 37:28.430 You'll still have beacons. 37:28.430 --> 37:30.150 This is the group shot. 37:31.750 --> 37:34.310 This is all the red team for 2019. 37:34.310 --> 37:41.450 You can see me there in the corner, Mudge in the center, you know, I don't remember half these people's names at this particular point. 37:41.450 --> 37:45.350 We don't meet that often, but I have a mug with all their names on it, though. 37:45.830 --> 37:51.390 Daryl's on the left there, but this is who they have to defend themselves against, right? 37:51.390 --> 37:52.090 They're Silas. 37:52.090 --> 37:53.610 He used to work at VirusTotal. 37:53.830 --> 38:02.530 He would weaponize malware that he would get from Google and VirusTotal and stick it on students. 38:02.610 --> 38:04.190 That madman! 38:04.810 --> 38:06.910 He would neuter it, right? 38:07.070 --> 38:15.790 There was an incident, but he would neuter it and repurpose it for students, so he would actually infect them with malware, just the beacons were going back to him instead. 38:16.610 --> 38:18.350 Crazy, crazy fellow. 38:20.610 --> 38:22.990 Most of these guys are networking engineers. 38:23.130 --> 38:24.350 Most of them aren't even Red Team. 38:24.350 --> 38:27.230 They aren't like, this is what they do as Red Team. 38:27.550 --> 38:31.850 They're more dangerous because they're in the field every day, right? 38:31.850 --> 38:41.450 They're networking engineers, Splunk engineers, but they know the full depth of those applications. 38:41.450 --> 38:45.610 They know what they can do, and then you take that and twist it. 38:45.610 --> 38:47.930 That's what I think is fundamental to being a Red Teamer, right? 38:47.930 --> 38:56.330 You know how that stuff's supposed to work, and then you twist it to your needs, your evil, evil needs to do what you needed to do, right? 38:57.570 --> 38:59.990 You have much more scope availability. 38:59.990 --> 39:06.470 You have the ability to hide better if you know more about what you're dealing with, especially with applications. 39:07.870 --> 39:09.770 Well, I've just talked about Neroff. 39:09.850 --> 39:12.550 We'll go ahead and go on to the second video here. 39:12.550 --> 39:13.630 Skip ahead a little. 39:14.830 --> 39:16.770 This is from 2018. 39:17.350 --> 39:22.470 More shenanigans, you know, giving us their keys for AWS. 39:24.230 --> 39:29.910 Yes, we would persist with a team name called White Team on the box. 39:32.670 --> 39:34.970 They had to go in through the serial console that year. 39:34.970 --> 39:37.350 They really didn't understand what was going on. 39:37.390 --> 39:38.970 They didn't know it was serial. 39:41.710 --> 39:49.370 I think they were trying to screw with each other, allowing us to say traffic's always a bad idea. 39:50.290 --> 39:53.830 These are, by the way, generally very flat networks. 39:54.290 --> 39:58.530 You know, us and our Spunk admin going, hey, do you need to get your Spunk working? 40:01.450 --> 40:03.030 Yes, we've done that. 40:03.030 --> 40:05.250 We've installed Linux on a box. 40:05.830 --> 40:07.810 You know, always check your agent names. 40:08.330 --> 40:14.830 We're always changing your passwords for you because you should be changing them often, and if you're not, we're going to. 40:14.830 --> 40:16.850 We'll wipe your backups always. 40:16.850 --> 40:18.250 That's just what we do. 40:20.070 --> 40:23.410 PowerShell is in great gasps of what we do as well. 40:25.170 --> 40:27.250 No, you can't get rid of DNS. 40:27.250 --> 40:28.710 That's just terrible. 40:29.170 --> 40:30.130 More keys. 40:30.130 --> 40:32.090 That's our key added in. 40:33.430 --> 40:37.870 Us taking surveillance photos of passwords on the whiteboard. 40:37.930 --> 40:39.890 That's not a good place to put them. 40:39.890 --> 40:42.870 Docker should not be running on your laptop. 40:43.410 --> 40:48.310 This is kind of what our desktop would look like, right, because we have all the teams open. 40:49.010 --> 40:53.010 Somebody futzing with the Palo Alto, at least trying to. 40:53.990 --> 40:56.410 Mudge sending beacons down. 40:58.110 --> 41:03.150 This is just, you know, SSH keys being sent in. 41:03.390 --> 41:09.010 Me playing annoying noises because they had all in ones and I couldn't turn off the speakers. 41:09.150 --> 41:10.930 Oh, that was great. 41:13.630 --> 41:18.190 We'll meme them up, change their logins to whatever we want. 41:18.970 --> 41:25.390 We'll change their MODT and they forget it's there and it's backdooring every time that MODT runs. 41:29.550 --> 41:38.310 We will sometimes, if you ask us to stop, sometimes we will, if you're nice to us, just let our beacons live and we'll stop messing with your box. 41:39.530 --> 41:47.270 That actually is probably pretty good advice to somebody who's actively in your network and you're trying to fight them, but really you should just be unplugging the internet. 41:48.590 --> 42:02.710 I played Tetris with, I attempted, and this is a really bad demo, but I attempted to play a Tetris with somebody over their own TMUX session while in front of them. 42:02.710 --> 42:07.890 So I'm actually attached to the TMUX session and I'm trying to get BSD games to work. 42:08.150 --> 42:17.290 But you know, if you've lived in Debian land, that's actually kind of hard, but I'm playing some Worm with them, at least trying to, 42:20.480 --> 42:24.720 well, attempting to. 42:25.300 --> 42:26.720 It's actually kind of a FUB. 42:26.720 --> 42:28.200 Why did I put that in here? 42:28.720 --> 42:31.040 Oh, well, there's their keys. 42:34.890 --> 42:41.310 But while I'm for various effects, you know, their AWS access keys, because they're leaving them in configs everywhere. 42:42.270 --> 42:44.270 Yes, it is our router. 42:45.850 --> 42:48.070 Some people don't know what CloudTrail is. 42:48.070 --> 42:49.250 It's great. 42:50.130 --> 42:52.030 Yes, the box is fucked. 42:52.030 --> 42:53.730 It is a technical term. 42:54.410 --> 42:59.420 That's always, always DNS's problem. 43:00.020 --> 43:02.380 Yes, we stole all your passwords. 43:04.400 --> 43:07.340 They Google weird shit all the time. 43:07.340 --> 43:11.080 One team decided to go this kind of advanced format for their passwords. 43:13.220 --> 43:15.740 They didn't know what echo is. 43:16.340 --> 43:17.600 We find that a lot. 43:17.600 --> 43:20.400 A lot of kids don't know what is going on. 43:20.400 --> 43:22.800 We'll send the messages to their Splunk. 43:25.000 --> 43:28.300 We'll actually interject bad Google results. 43:28.300 --> 43:35.000 We've actually had it where Google would redirect to Bing and it would be the third page of Bing and that's all they could access. 43:37.020 --> 43:42.040 This is beacons coming in from Splunk as they started to manage their system for them. 43:47.170 --> 43:51.750 Somebody trying to do some art because they were bored and they didn't have anything to do. 43:53.330 --> 43:58.310 We decided, I did at least, that I was going to make a little bit of fun. 43:58.370 --> 44:04.310 I printed out this stupid piece of paper that said, hey, you're trying to get into SSH. 44:04.310 --> 44:06.050 Would you like to try Telnet instead? 44:06.110 --> 44:07.750 Slipped it under everybody's door. 44:07.750 --> 44:10.150 We actually got them back, a couple of them. 44:10.150 --> 44:11.490 There's the search warrant. 44:11.530 --> 44:12.550 That was fun. 44:12.550 --> 44:13.490 There's Clippy. 44:14.130 --> 44:16.010 We got them back from a couple of teams. 44:16.790 --> 44:19.050 This is us ransomware-ing their team. 44:21.770 --> 44:24.130 Yes, that happens a lot now. 44:24.570 --> 44:26.690 This is great. 44:27.850 --> 44:30.670 We made them take this photo for us. 44:30.670 --> 44:39.590 And we made them apologize for trying to steal our firewall, which was their firewall, but it was really our firewall now. 44:40.070 --> 44:46.490 We gave them back their firewall eventually, but no, no guarantees there. 44:49.910 --> 44:52.750 Then we just start deleting stuff from them. 44:52.750 --> 44:55.230 It's the same stick every year, practically. 44:56.970 --> 45:01.690 I know running Docker, we'll have beacons inside of Docker and they'll never see them in there. 45:01.690 --> 45:04.510 We're starting to get beacons timing out now. 45:04.670 --> 45:11.730 Me DDing you random the TTY for shits, and that's always super fun when it goes beepy hell. 45:17.520 --> 45:18.100 Yep. 45:18.100 --> 45:20.700 And we're starting to delete sys32 now. 45:22.620 --> 45:28.400 Teams start usually playing music at this point because there's not a whole lot they can do because we're just starting to pop boxes now. 45:30.540 --> 45:37.780 Disable their internet, anything that we can do to destroy the box at this point. 45:37.780 --> 45:39.080 So you get the general idea. 45:42.920 --> 45:47.660 We start deleting all their AWS instances, which are scored, which has a bunch of stuff in it. 45:48.060 --> 45:51.440 Making sure to delete all the snapshots, all the beacons are dead. 45:52.100 --> 45:54.860 This is the write-up where they had to do the search and seizure. 45:56.020 --> 45:58.920 We'll actually kind of go back to that a little bit 46:02.400 --> 46:02.760 . 46:03.320 --> 46:05.320 This is us deleting sys32. 46:07.560 --> 46:08.900 And as such. 46:08.980 --> 46:14.560 So as you can see, we're up to all kinds of shenanigans. 46:18.020 --> 46:21.000 Obviously, we've had some disruptions this morning in numerous ways. 46:21.000 --> 46:25.640 Under my standing as law enforcement officer in the room, we collected some device or devices. 46:25.760 --> 46:31.800 This is obviously concerning to the executive staff as we need to talk and make sure we understand all the facts we know. 46:33.480 --> 46:35.300 This is the search and seizure. 46:35.320 --> 46:36.380 That was pretty good. 46:36.380 --> 46:37.740 We don't have any video of it, though. 46:37.740 --> 46:40.620 It wasn't recorded, because they just kind of surprised us on it. 46:41.200 --> 46:43.420 They even raided red team room at one point. 46:44.860 --> 46:52.410 So as you can see, we generally have our standard reams. 46:52.410 --> 46:54.190 This is just the northeast corridor, right? 46:54.930 --> 46:56.790 There's teams for every corridor. 46:58.110 --> 47:02.500 And yeah. 47:02.500 --> 47:04.560 So there's teams for every corridor. 47:04.560 --> 47:09.460 And then they go to nationals, and they fight there, and they have some real red teamers there, right? 47:09.460 --> 47:11.440 They'll actually bring out some stops. 47:11.440 --> 47:13.860 They have some amazing tools up there. 47:13.860 --> 47:18.280 A lot of them they don't release, and it's for good reason, because they're very dangerous, actually. 47:18.760 --> 47:21.500 And they're meant for only use in competitions. 47:21.520 --> 47:23.520 But you can find it, right? 47:23.520 --> 47:30.420 Now that you know this terminology, CCDC, start trying to find some of the red teamer tools out there. 47:30.420 --> 47:32.520 There's some amazing stuff out there. 47:32.520 --> 47:36.320 And we generally do tag it for CCDC. 47:37.640 --> 47:40.000 If you take a look here, I got some URLs for you. 47:40.000 --> 47:49.220 If you want to check some stuff out for the northeastern corridor, you could do NECCDL.org. 47:49.240 --> 47:57.240 If you want to check out the national competitions, you know, maybe even become a red teamer there, check out nationalCCDC.org. 47:58.660 --> 48:00.780 But overall, check your local colleges. 48:00.780 --> 48:05.320 You never know, they may want to participate in this, and they haven't had anybody to actually start a program there, right? 48:05.320 --> 48:09.320 Volunteer some time to start a program, get with a professor, something along those lines. 48:10.080 --> 48:11.680 See if they already participate. 48:12.300 --> 48:21.280 You can help them with training, become a red teamer for them, set up a scenario for them, let them attack you, attack them, that type of thing. 48:21.340 --> 48:28.480 It's good fun, and it allows you to kind of stretch your muscles as a red teamer without having to really worry about scope, right? 48:28.480 --> 48:31.500 Like, if you blow up a box, who cares, right? 48:31.500 --> 48:38.800 But as, like, normal red team, you know, if you're trying to do pen testing, you really can't just, like, destroy a box, right? 48:38.800 --> 48:48.080 You can't really simulate being a hacker, because you're really not going to, you know, delete the domain controller, you would. 48:50.780 --> 48:53.520 It's the best two days you could have, right? 48:53.520 --> 48:54.820 Just outright. 48:55.000 --> 48:57.360 It's the best two days you could possibly have. 48:57.520 --> 49:02.420 It allows you to test new tools and tactics in a controlled, wild environment. 49:02.420 --> 49:05.120 You can just let it loose and go to town. 49:05.120 --> 49:08.380 As long as it doesn't leave the network, they don't really care what it does. 49:08.500 --> 49:13.160 As long as it doesn't, like, make the box catch fire, like, literally catch fire. 49:13.160 --> 49:14.680 I think we had that one year. 49:16.800 --> 49:21.580 But, well, I've had my 50 minutes. 49:21.860 --> 49:23.980 Omar, you want to come on back?