1
00:00:00,630 --> 00:00:04,230
- Okay, so hi everyone.

2
00:00:04,230 --> 00:00:06,690
So you can probably judge from the title,

3
00:00:06,690 --> 00:00:08,490
but what we're gonna do today

4
00:00:08,490 --> 00:00:12,780
is we're gonna show how you
can use windows executables,

5
00:00:12,780 --> 00:00:15,660
service accounts, and cloud services

6
00:00:15,660 --> 00:00:18,093
to basically power you
own malware operation.

7
00:00:20,220 --> 00:00:21,570
Shortly about me,

8
00:00:21,570 --> 00:00:25,200
I've been on cyber security
for a long time now.

9
00:00:25,200 --> 00:00:29,233
Spent some time, sorry. (laughs)

10
00:00:30,402 --> 00:00:35,010
(audience cheering and clapping)

11
00:00:35,010 --> 00:00:36,360
Thank you for that.

12
00:00:36,360 --> 00:00:41,360
So I spent a bunch of time at
Microsoft on APIs, IOT, cloud.

13
00:00:42,180 --> 00:00:44,340
I've been doing low-code no-code security

14
00:00:44,340 --> 00:00:46,050
for like three years now, which is weird

15
00:00:46,050 --> 00:00:48,450
because not many people are into it,

16
00:00:48,450 --> 00:00:51,243
but you will soon be, so that's cool.

17
00:00:52,260 --> 00:00:56,730
I started a company around
18 months ago called Zenity

18
00:00:56,730 --> 00:00:58,110
with folks that are sitting right here.

19
00:00:58,110 --> 00:01:00,870
We were focused on
low-code no-code security,

20
00:01:00,870 --> 00:01:02,940
and again, first time at DefCon,

21
00:01:02,940 --> 00:01:05,880
very excited to be here
as you can probably hear.

22
00:01:05,880 --> 00:01:07,080
So thank you for coming.

23
00:01:07,950 --> 00:01:09,870
By the way, this talk is
gonna feature research

24
00:01:09,870 --> 00:01:12,300
from (indistinct) who's
sitting right here,

25
00:01:12,300 --> 00:01:14,823
one of our researcher,
so give him some love.

26
00:01:17,009 --> 00:01:20,009
(audience clapping)

27
00:01:22,470 --> 00:01:24,390
This one is important.

28
00:01:24,390 --> 00:01:26,790
Low-code no-code is a cool thing.

29
00:01:26,790 --> 00:01:29,880
We are very much pull the movement

30
00:01:29,880 --> 00:01:31,920
and this talk, I will try to give you

31
00:01:31,920 --> 00:01:33,570
an attackers perspective on that.

32
00:01:33,570 --> 00:01:36,300
The reason of course is to make sure

33
00:01:36,300 --> 00:01:38,760
that is in a responsible way.

34
00:01:38,760 --> 00:01:41,700
So what you're gonna learn today,

35
00:01:41,700 --> 00:01:43,920
use it to educate people around you

36
00:01:43,920 --> 00:01:47,640
and let's see where it takes us.

37
00:01:47,640 --> 00:01:52,380
Okay, so I'm gonna start right now.

38
00:01:52,380 --> 00:01:56,100
When I say creating or running
your old malware operation,

39
00:01:56,100 --> 00:01:57,450
there are a bunch of things I could mean.

40
00:01:57,450 --> 00:02:00,390
So let's figure out what exactly I mean,

41
00:02:00,390 --> 00:02:01,770
that we're gonna do today.

42
00:02:01,770 --> 00:02:06,060
So you have an initial access
to some victim machine.

43
00:02:06,060 --> 00:02:08,270
There's a lot of other things
that you need to do around it

44
00:02:08,270 --> 00:02:11,760
in order to really call
it a malware operation.

45
00:02:11,760 --> 00:02:15,360
You need to be able to, okay.

46
00:02:15,360 --> 00:02:18,210
So you need to be able
to go through a firewall.

47
00:02:18,210 --> 00:02:20,550
You need to be able to
actually run malware

48
00:02:20,550 --> 00:02:24,180
on that machine and be able to bypass DDR.

49
00:02:24,180 --> 00:02:27,090
You need to be able to
create command and control

50
00:02:27,090 --> 00:02:28,170
across that firewall

51
00:02:28,170 --> 00:02:32,697
and extract the data back
to your outside of the org.

52
00:02:34,110 --> 00:02:39,110
You need to avoid detection
by a bunch of enterprise tools

53
00:02:39,360 --> 00:02:41,370
that are out there in order to catch you

54
00:02:41,370 --> 00:02:43,320
and you need to remain persistent

55
00:02:43,320 --> 00:02:46,200
on the actual victim machine

56
00:02:46,200 --> 00:02:48,783
when they're obviously
trying to kick you out.

57
00:02:50,100 --> 00:02:54,120
All of those things are
a bunch of grant work.

58
00:02:54,120 --> 00:02:58,290
So what we are trying do
today is we're gonna show how,

59
00:02:58,290 --> 00:03:00,990
instead of having to do
all of that yourself,

60
00:03:00,990 --> 00:03:03,360
you can just focus on the initial access

61
00:03:03,360 --> 00:03:05,880
and on the last part,
which is kind of having fun

62
00:03:05,880 --> 00:03:07,580
and we're gonna try and figure out

63
00:03:08,454 --> 00:03:10,980
how we can use existing services

64
00:03:10,980 --> 00:03:13,893
to take care of all of that ops for us.

65
00:03:18,630 --> 00:03:21,540
So, here's this service
that we're going to use.

66
00:03:21,540 --> 00:03:23,790
I'm not sure if you've heard about RPA.

67
00:03:23,790 --> 00:03:25,830
This is basically a technology

68
00:03:25,830 --> 00:03:29,105
that is out there in every
major enterprise today.

69
00:03:29,105 --> 00:03:31,560
It's really every world

70
00:03:31,560 --> 00:03:33,630
and the idea behind RPA

71
00:03:33,630 --> 00:03:36,000
is basically to take mundane processes

72
00:03:36,000 --> 00:03:37,590
that business users are doing

73
00:03:37,590 --> 00:03:40,920
so copying and pasting
through different softwares

74
00:03:40,920 --> 00:03:44,400
that they have on their machine
and basically automating it,

75
00:03:44,400 --> 00:03:46,290
and the way that it gets automated

76
00:03:46,290 --> 00:03:49,860
is that the users actually emulated.

77
00:03:49,860 --> 00:03:51,870
So the user gets impersonated.

78
00:03:51,870 --> 00:03:56,460
They are copying the kind of
keyboard and the mouse clicks

79
00:03:56,460 --> 00:03:57,960
and then reiterating them,

80
00:03:57,960 --> 00:03:59,610
and that's the way that they're using

81
00:03:59,610 --> 00:04:01,290
the user's own identity,

82
00:04:01,290 --> 00:04:04,620
and it's used to basically
facilitate integration

83
00:04:04,620 --> 00:04:08,763
with old software that has no
APIs, which makes it easier.

84
00:04:09,630 --> 00:04:12,090
So RPA is built of three main components.

85
00:04:12,090 --> 00:04:13,200
The first one is an agent,

86
00:04:13,200 --> 00:04:15,150
it sits on somebody's laptop

87
00:04:15,150 --> 00:04:18,210
and it emulates the user
as I just mentioned.

88
00:04:18,210 --> 00:04:20,310
The second part is the controller,

89
00:04:20,310 --> 00:04:24,000
which is able to reach out to the machine,

90
00:04:24,000 --> 00:04:26,670
send some payload, the
payload gets executed

91
00:04:26,670 --> 00:04:30,030
and then the output gets routed back

92
00:04:30,030 --> 00:04:31,080
and there's a management portal,

93
00:04:31,080 --> 00:04:33,870
which allows you to basically
say, okay, here are my agents,

94
00:04:33,870 --> 00:04:36,870
here's the payload I'm gonna
send to each one of them.

95
00:04:36,870 --> 00:04:38,910
The key thing about this technology

96
00:04:38,910 --> 00:04:41,730
is that every part here is trusted

97
00:04:41,730 --> 00:04:42,900
and what do I mean by trusted?

98
00:04:42,900 --> 00:04:45,630
I mean, trusted by the EDL,
trusted by network security,

99
00:04:45,630 --> 00:04:47,040
trusted by the SOC team.

100
00:04:47,040 --> 00:04:49,830
So on the agent side,
there are executables

101
00:04:49,830 --> 00:04:52,440
that are signed by the vendors themselves,

102
00:04:52,440 --> 00:04:53,940
we'll see that in a moment.

103
00:04:53,940 --> 00:04:56,850
The communications, so
all of the end points,

104
00:04:56,850 --> 00:04:59,943
all of the protocols and the
cloud services themselves,

105
00:05:01,500 --> 00:05:02,910
and there are a bunch of vendors

106
00:05:02,910 --> 00:05:07,140
that are providing these RPA solutions

107
00:05:07,140 --> 00:05:10,920
that as I mentioned are
everywhere in the enterprise.

108
00:05:10,920 --> 00:05:15,000
Today, as you've kind of
realized from the talk's title,

109
00:05:15,000 --> 00:05:16,050
we're gonna focus on Microsoft

110
00:05:16,050 --> 00:05:18,090
and you you'll find out why in a moment.

111
00:05:18,090 --> 00:05:20,610
But actually everything that
I'm gonna show you today

112
00:05:20,610 --> 00:05:21,989
is not specific to Microsoft.

113
00:05:21,989 --> 00:05:26,989
Its actually inherent in
the way that RPA works.

114
00:05:30,810 --> 00:05:35,810
So, RPA can take care of
all of the malware ops

115
00:05:36,570 --> 00:05:39,210
that I just talked about for us.

116
00:05:39,210 --> 00:05:40,830
So command and control,

117
00:05:40,830 --> 00:05:44,700
exfiltrating data outside of the org,

118
00:05:44,700 --> 00:05:48,150
avoiding defense, persistency, cleanup,

119
00:05:48,150 --> 00:05:50,970
but it also will be able
to give us much more.

120
00:05:50,970 --> 00:05:52,560
So handling error,

121
00:05:52,560 --> 00:05:55,740
everything that's related
to kind of engineering,

122
00:05:55,740 --> 00:05:57,030
updating those agents,

123
00:05:57,030 --> 00:06:00,630
being able to support
any type of platform.

124
00:06:00,630 --> 00:06:05,010
Those are all things that the
RPA vendors will do for us.

125
00:06:05,010 --> 00:06:06,540
So this is the leaving of the land attack,

126
00:06:06,540 --> 00:06:08,700
and we're gonna leave of the land of RPA

127
00:06:08,700 --> 00:06:12,093
and specifically Microsoft
RPA to do what we wanna do.

128
00:06:13,500 --> 00:06:15,060
Here's our agenda for today.

129
00:06:15,060 --> 00:06:16,950
So we cover the motivation,

130
00:06:16,950 --> 00:06:19,200
next up, we're gonna drill down a bit more

131
00:06:19,200 --> 00:06:20,823
into what RPA is all about.

132
00:06:21,806 --> 00:06:25,050
We'll do a deep dive and
understand how it works.

133
00:06:25,050 --> 00:06:29,430
Then I will shift gears
and show you specifically,

134
00:06:29,430 --> 00:06:30,600
how do you take RPA

135
00:06:30,600 --> 00:06:33,330
and leverage it to your
own mode of operation,

136
00:06:33,330 --> 00:06:36,900
and introduce a tool that will
allow you to do that quickly,

137
00:06:36,900 --> 00:06:38,340
and don't worry, we'll also send you home

138
00:06:38,340 --> 00:06:39,840
with kind of a few things you can do

139
00:06:39,840 --> 00:06:43,323
to remain protected or
protect your organization.

140
00:06:45,900 --> 00:06:48,690
So in order to understand what RPA is,

141
00:06:48,690 --> 00:06:51,277
let's start off with a story.

142
00:06:51,277 --> 00:06:54,240
When I was a teenager,

143
00:06:54,240 --> 00:06:57,153
my friends and I used to
play in a game called Tibia,

144
00:06:58,050 --> 00:07:00,573
who knows what Tibia is, raise your hand.

145
00:07:02,250 --> 00:07:03,083
Okay.

146
00:07:04,290 --> 00:07:09,240
That's a weird game, weird
MMORPG from a long time ago.

147
00:07:09,240 --> 00:07:11,880
Well, basically you
level up your character,

148
00:07:11,880 --> 00:07:15,390
you play with other players
and you collaborate.

149
00:07:15,390 --> 00:07:18,450
But a lot of the actual time that you get

150
00:07:18,450 --> 00:07:20,530
that you spend on that game

151
00:07:21,570 --> 00:07:24,090
is actually doing things like fishing.

152
00:07:24,090 --> 00:07:26,010
So you need to improve your fishing skills

153
00:07:26,010 --> 00:07:27,616
in order to do that,

154
00:07:27,616 --> 00:07:31,650
you basically go to a pond
and then you need to click.

155
00:07:31,650 --> 00:07:33,750
So you click and you get some fish

156
00:07:33,750 --> 00:07:36,570
and you click and you get
more fish and more fish

157
00:07:36,570 --> 00:07:40,350
and this is basically transforming clicks

158
00:07:40,350 --> 00:07:43,500
and virtual worms into virtual fish.

159
00:07:43,500 --> 00:07:47,100
This is important for the game,
but it is extremely boring.

160
00:07:47,100 --> 00:07:50,190
So of course, as a teenager,

161
00:07:50,190 --> 00:07:53,370
I wanted to take advantage of this.

162
00:07:53,370 --> 00:07:55,740
I want to basically be
better than my friends

163
00:07:55,740 --> 00:07:56,610
and impress them.

164
00:07:56,610 --> 00:07:59,200
So I try to find a creative solution

165
00:08:00,600 --> 00:08:03,450
for this to work better.

166
00:08:03,450 --> 00:08:05,280
I started off with physical automation.

167
00:08:05,280 --> 00:08:09,060
I actually looked for a picture of this.

168
00:08:09,060 --> 00:08:10,380
I couldn't find any picture.

169
00:08:10,380 --> 00:08:12,360
I'm not sure why somebody in my family

170
00:08:12,360 --> 00:08:14,730
didn't take the picture.

171
00:08:14,730 --> 00:08:17,820
As you can imagine, this
didn't work. (laughs)

172
00:08:17,820 --> 00:08:19,710
So the book would fall over.

173
00:08:19,710 --> 00:08:21,630
I would wake up in the morning

174
00:08:21,630 --> 00:08:25,650
and things were not as I expected.

175
00:08:25,650 --> 00:08:27,543
So I had to find a better solution,

176
00:08:29,160 --> 00:08:32,220
and I actually went with automation,

177
00:08:32,220 --> 00:08:35,880
which was basically, there
was software that allowed me

178
00:08:35,880 --> 00:08:39,000
to basically record my
keyboard and my mouse

179
00:08:39,000 --> 00:08:40,320
and then replay them.

180
00:08:40,320 --> 00:08:43,860
So I had this setup where
I walk around the pond

181
00:08:43,860 --> 00:08:45,480
and I click on a bunch of fish,

182
00:08:45,480 --> 00:08:49,350
and when I wake up in the
morning, I'm leveled up.

183
00:08:49,350 --> 00:08:51,300
So this is what it looks like

184
00:08:51,300 --> 00:08:53,340
and I think you're seeing it,

185
00:08:53,340 --> 00:08:55,830
and basically this made
me the hero of my friend.

186
00:08:55,830 --> 00:08:57,900
So this was my first kind of,

187
00:08:57,900 --> 00:09:01,875
the first moment I got some love,

188
00:09:01,875 --> 00:09:04,563
kind of became a bit popular,

189
00:09:06,660 --> 00:09:09,780
and this is funny because this
is actually the basis of RPA.

190
00:09:09,780 --> 00:09:11,950
So the same technology
that I used as a kid

191
00:09:12,810 --> 00:09:14,460
like 20 years ago

192
00:09:14,460 --> 00:09:16,560
is being used in the enterprise today

193
00:09:16,560 --> 00:09:18,753
to do very serious things.

194
00:09:20,040 --> 00:09:23,040
So RPA, as a quick recap.

195
00:09:23,040 --> 00:09:25,950
It's about replacing, copy
and paste integration,

196
00:09:25,950 --> 00:09:28,700
it's a drag and drop builder,
you'll see it in a moment

197
00:09:33,140 --> 00:09:35,610
and the people that are
building these RPA bots,

198
00:09:35,610 --> 00:09:38,880
they can be in IT, but they
can also be business users.

199
00:09:38,880 --> 00:09:40,920
It emulates the user's own actions.

200
00:09:40,920 --> 00:09:43,890
So it operates as the user
with their own identity,

201
00:09:43,890 --> 00:09:46,350
there's no way to
distinguish those clearly,

202
00:09:46,350 --> 00:09:48,630
and it runs on the user's machines

203
00:09:48,630 --> 00:09:50,250
and on the use cases side,

204
00:09:50,250 --> 00:09:52,650
enterprises are really
using it for serious things.

205
00:09:52,650 --> 00:09:57,480
So customer services, financial services,

206
00:09:57,480 --> 00:09:59,490
onboarding and off boarding HR.

207
00:09:59,490 --> 00:10:02,580
So this is touching
business sensitive data.

208
00:10:02,580 --> 00:10:06,270
Now that we understand what RPA is,

209
00:10:06,270 --> 00:10:09,930
let's drill down technically
into how it works

210
00:10:09,930 --> 00:10:12,990
and how that would also
kind of lead us in the way

211
00:10:12,990 --> 00:10:15,340
that we're looking forward
with our malware op.

212
00:10:16,530 --> 00:10:21,120
So we want to use RPA for
the malware operation,

213
00:10:21,120 --> 00:10:24,450
and this is where we're gonna
actually focus on Microsoft

214
00:10:24,450 --> 00:10:25,283
and this is why.

215
00:10:25,283 --> 00:10:27,960
So Microsoft has released an RPA agent

216
00:10:27,960 --> 00:10:29,520
called power automate desktop,

217
00:10:29,520 --> 00:10:32,880
and it is now baked into
every windows 11 machine

218
00:10:32,880 --> 00:10:33,713
and by baked in,

219
00:10:33,713 --> 00:10:36,390
I mean that if you take
a fresh windows machine,

220
00:10:36,390 --> 00:10:39,120
you'll search for power
automate, it'll be there.

221
00:10:39,120 --> 00:10:40,527
It's also trusted by the DDR

222
00:10:40,527 --> 00:10:42,600
and trusted by other DDR as well.

223
00:10:42,600 --> 00:10:46,653
So that's why we're going
to focus on Microsoft today.

224
00:10:47,850 --> 00:10:50,430
Let's start from the users perspective.

225
00:10:50,430 --> 00:10:54,660
So this is a fresh windows
machine, windows 11 machine

226
00:10:54,660 --> 00:10:55,950
searching for power automate,

227
00:10:55,950 --> 00:10:58,863
I immediately find this executable.

228
00:11:00,480 --> 00:11:02,523
Let's see if this works.

229
00:11:08,160 --> 00:11:08,993
Okay.

230
00:11:15,930 --> 00:11:16,770
Okay, it works.

231
00:11:16,770 --> 00:11:19,680
So what I'm showing you
here is a quick video

232
00:11:19,680 --> 00:11:24,430
that is me setting up my
connection with the RPA service.

233
00:11:25,410 --> 00:11:27,990
The third thing that I'm doing

234
00:11:27,990 --> 00:11:30,120
is actually plugging in my office account

235
00:11:30,120 --> 00:11:31,560
and the crucial thing here

236
00:11:31,560 --> 00:11:33,870
is that I could plug
in any office account.

237
00:11:33,870 --> 00:11:36,270
So in this example,

238
00:11:36,270 --> 00:11:37,890
I created a new organization,

239
00:11:37,890 --> 00:11:39,210
you'll see that in a moment

240
00:11:39,210 --> 00:11:41,940
and I'm plugging in my credentials
with that organization.

241
00:11:41,940 --> 00:11:43,410
Once I plug in those credentials,

242
00:11:43,410 --> 00:11:45,540
I get to this drag and drop builder

243
00:11:45,540 --> 00:11:48,150
with a bunch of operations
that are available for me

244
00:11:48,150 --> 00:11:48,990
and then I'm gonna click

245
00:11:48,990 --> 00:11:52,170
and I'm going to create
a low word application

246
00:11:52,170 --> 00:11:54,620
that basically writes a
little to a file on desk.

247
00:11:55,530 --> 00:11:58,800
The crucial thing here is
that this thing is synced

248
00:11:58,800 --> 00:12:02,160
to office cloud and
it's synced to my cloud

249
00:12:02,160 --> 00:12:04,110
because I just logged in with my account,

250
00:12:04,110 --> 00:12:05,790
and so you'll see in a moment

251
00:12:05,790 --> 00:12:08,400
when I kind of finish off
with the demonstration here,

252
00:12:08,400 --> 00:12:09,660
that there's a bunch.

253
00:12:09,660 --> 00:12:13,020
So we're seeing it now
there's bunch of execute,

254
00:12:13,020 --> 00:12:17,640
basically bots or processes
that are available for me

255
00:12:17,640 --> 00:12:19,320
to pick and choose from.

256
00:12:19,320 --> 00:12:23,190
Those are all things
that I set up previously

257
00:12:23,190 --> 00:12:24,363
in my office account.

258
00:12:27,750 --> 00:12:29,460
So this is what you just saw.

259
00:12:29,460 --> 00:12:32,868
When you plug in your credentials,
your office credentials

260
00:12:32,868 --> 00:12:36,150
to this windows executable,

261
00:12:36,150 --> 00:12:39,870
you get all of the
different payloads processes

262
00:12:39,870 --> 00:12:42,420
that you have created in an office.

263
00:12:42,420 --> 00:12:43,893
This is how it looks like.

264
00:12:45,270 --> 00:12:47,760
This is how it looks like from
an architecture perspective.

265
00:12:47,760 --> 00:12:51,000
So on one side you have a
power automate, the RPA agent

266
00:12:51,000 --> 00:12:53,010
and the other side you have office,

267
00:12:53,010 --> 00:12:55,090
once it's in (indistinct)
and another in cloud.

268
00:12:55,090 --> 00:12:56,940
The reason that I'm focusing on that

269
00:12:56,940 --> 00:12:57,990
is that Microsoft of course,

270
00:12:57,990 --> 00:13:00,330
has to be deployed everywhere
in large organizations

271
00:13:00,330 --> 00:13:03,840
so they need to figure out,
I mean how is this working?

272
00:13:03,840 --> 00:13:06,420
They haven't asked for
permission from anybody, right?

273
00:13:06,420 --> 00:13:07,830
It's already there.

274
00:13:07,830 --> 00:13:10,800
So what we're going to figure
out right now, technically

275
00:13:10,800 --> 00:13:12,393
is how is this communicating?

276
00:13:13,650 --> 00:13:16,140
So we'll focus first on the left side,

277
00:13:16,140 --> 00:13:17,760
which is actually the local side.

278
00:13:17,760 --> 00:13:19,440
Power automate is not one executable,

279
00:13:19,440 --> 00:13:21,463
there are a bunch of those.

280
00:13:21,463 --> 00:13:23,790
There's one service that's
called power automate

281
00:13:23,790 --> 00:13:26,760
runs on the user's own account,

282
00:13:26,760 --> 00:13:29,700
and there's another service
account that's being created

283
00:13:29,700 --> 00:13:30,870
that you can see here

284
00:13:30,870 --> 00:13:34,320
that runs with an executable
that's called machine run time,

285
00:13:34,320 --> 00:13:35,190
and that will be the one

286
00:13:35,190 --> 00:13:37,170
that's actually in charge of communicating

287
00:13:37,170 --> 00:13:39,470
with office cloud, we'll
see that in a moment.

288
00:13:40,530 --> 00:13:42,270
There's also power automate,

289
00:13:42,270 --> 00:13:44,310
also allows you to automate the browser.

290
00:13:44,310 --> 00:13:48,240
So you can sow an extension
on all popular browsers,

291
00:13:48,240 --> 00:13:50,670
you can change what users
are viewing on the browsers,

292
00:13:50,670 --> 00:13:52,470
and you can also kind of
fetch all of the information

293
00:13:52,470 --> 00:13:53,730
that they have there.

294
00:13:53,730 --> 00:13:57,120
So we'll add that to our
architecture as well.

295
00:13:57,120 --> 00:13:59,820
As you can see, there are
kind of these extensions

296
00:13:59,820 --> 00:14:02,373
across all of the different browsers.

297
00:14:05,190 --> 00:14:07,920
So what you are saying
here is actually that,

298
00:14:07,920 --> 00:14:09,870
I've only talked about three executables

299
00:14:09,870 --> 00:14:14,870
out of about 20 that are
built in to windows 11.

300
00:14:14,970 --> 00:14:17,610
Again, and you're saying
that this is in a trusted,

301
00:14:17,610 --> 00:14:20,670
this is kind of in a trusted location.

302
00:14:20,670 --> 00:14:25,260
So there's plenty of opportunity
to do more research here.

303
00:14:25,260 --> 00:14:27,480
So if you are looking for a challenge,

304
00:14:27,480 --> 00:14:29,103
I recommend checking this out.

305
00:14:31,260 --> 00:14:33,990
So let's switch to another direction

306
00:14:33,990 --> 00:14:35,340
and talk about the communication.

307
00:14:35,340 --> 00:14:39,090
So of course, network
boundaries have been, I mean,

308
00:14:39,090 --> 00:14:42,420
people have been trying to
maintain them for a long time,

309
00:14:42,420 --> 00:14:44,040
and there's a really serious question

310
00:14:44,040 --> 00:14:45,540
we should ask ourselves here,

311
00:14:45,540 --> 00:14:47,430
which is how is Microsoft
able to communicate

312
00:14:47,430 --> 00:14:48,390
with office services

313
00:14:48,390 --> 00:14:52,203
without having some IT admin
open up a port somewhere?

314
00:14:53,040 --> 00:14:54,827
The way that this is done

315
00:14:55,860 --> 00:14:59,940
is with a neat service
called Azure Service Bus.

316
00:14:59,940 --> 00:15:01,350
It used to be Azure Relay.

317
00:15:01,350 --> 00:15:06,350
Basically both sides are creating
a outbound communication,

318
00:15:06,570 --> 00:15:09,030
and so this is how the
channel gets created.

319
00:15:09,030 --> 00:15:12,720
So the agent will reach
out to Azure Service Bus

320
00:15:12,720 --> 00:15:14,629
every couple of minutes

321
00:15:14,629 --> 00:15:17,229
and ask for new task that
it should pick up and use.

322
00:15:19,751 --> 00:15:20,790
Okay.

323
00:15:20,790 --> 00:15:21,990
So we are connected.

324
00:15:21,990 --> 00:15:23,820
We understand how this thing operate.

325
00:15:23,820 --> 00:15:28,740
We understand that it has
components that run as the user

326
00:15:28,740 --> 00:15:31,773
and components that run
as a service account.

327
00:15:32,610 --> 00:15:35,160
The crucial thing to note right here,

328
00:15:35,160 --> 00:15:37,050
because it's the last
time I'm gonna say it

329
00:15:37,050 --> 00:15:39,600
is that all of these things are trusted.

330
00:15:39,600 --> 00:15:41,310
The executables are trusted,

331
00:15:41,310 --> 00:15:42,660
the service accounts are trusted,

332
00:15:42,660 --> 00:15:44,490
the cloud doc accounts are trusted.

333
00:15:44,490 --> 00:15:49,490
They're all in the allow
list that you get by default.

334
00:15:49,680 --> 00:15:50,940
Once you plug in your machine,

335
00:15:50,940 --> 00:15:53,130
this is what you are seeing
from the office side.

336
00:15:53,130 --> 00:15:55,920
So office provides you
with kind of a nice way

337
00:15:55,920 --> 00:15:58,170
to view all of the
machines that are connected

338
00:15:58,170 --> 00:15:59,430
to your cloud.

339
00:15:59,430 --> 00:16:04,170
You can also run things on
the laptop from the cloud.

340
00:16:04,170 --> 00:16:06,150
So you trigger,

341
00:16:06,150 --> 00:16:09,780
you create some sort of a payload

342
00:16:09,780 --> 00:16:12,840
and you can execute it from
the cloud on some machine

343
00:16:12,840 --> 00:16:14,730
and then you get status.

344
00:16:14,730 --> 00:16:17,280
You can look at history,
you can debug things.

345
00:16:17,280 --> 00:16:19,530
So all of the, kind of, convenience layers

346
00:16:19,530 --> 00:16:20,730
that you need around it.

347
00:16:21,750 --> 00:16:24,900
The last thing that I wanna
cover in terms of architecture

348
00:16:24,900 --> 00:16:26,610
is how it's trust being established.

349
00:16:26,610 --> 00:16:31,140
So it's not only about connection
to the Azure Service Bus,

350
00:16:31,140 --> 00:16:32,670
actually they'll need to be

351
00:16:32,670 --> 00:16:35,880
kind of a trusted
communication between the two.

352
00:16:35,880 --> 00:16:39,630
So when you register your
machine with power automate

353
00:16:39,630 --> 00:16:41,790
that you saw me do a few minutes ago,

354
00:16:41,790 --> 00:16:43,290
there's a private key that's being created

355
00:16:43,290 --> 00:16:46,260
on your local machine and there
publicly on the cloud side,

356
00:16:46,260 --> 00:16:49,920
and it's being used to
basically encrypt a message

357
00:16:49,920 --> 00:16:52,380
that sends two things to the machines

358
00:16:52,380 --> 00:16:53,880
through Azure Service Bus.

359
00:16:53,880 --> 00:16:55,800
The first thing is local credentials.

360
00:16:55,800 --> 00:16:57,690
So you can run those payloads,

361
00:16:57,690 --> 00:17:02,370
with whichever local credentials
you'd like on the machine.

362
00:17:02,370 --> 00:17:03,960
And the second thing is an RPA task,

363
00:17:03,960 --> 00:17:07,140
which is the process that
you would like to run.

364
00:17:07,140 --> 00:17:11,703
So again, in a summary, in a nutshell,

365
00:17:13,650 --> 00:17:18,270
this executes with the
user's own credentials

366
00:17:18,270 --> 00:17:21,690
and it constantly goes out to office

367
00:17:21,690 --> 00:17:24,690
and asking whether there's
something it needs to be running.

368
00:17:27,030 --> 00:17:30,183
So what we're gonna do right
now is we're gonna switch gear.

369
00:17:31,846 --> 00:17:34,170
Up until now, it was
kind of a theoretical.

370
00:17:34,170 --> 00:17:38,670
We're gonna go to specifics
of how you can use this setup

371
00:17:38,670 --> 00:17:42,360
to run your malware operation
with power automate,

372
00:17:42,360 --> 00:17:43,443
Microsoft's RPA.

373
00:17:44,400 --> 00:17:47,160
So let's remember our wishlist.

374
00:17:47,160 --> 00:17:50,010
This were the things that
we wanted to accomplish

375
00:17:50,010 --> 00:17:53,040
when we started this conversation.

376
00:17:53,040 --> 00:17:56,220
So all of the things
here that are around ops,

377
00:17:56,220 --> 00:17:59,020
we'll go through each one and
show how they can be done.

378
00:18:00,120 --> 00:18:01,983
First up, we need a bit of setup.

379
00:18:03,810 --> 00:18:07,140
So what you need in order to
use this is basically create.

380
00:18:07,140 --> 00:18:09,330
What I'm doing here is
creating a new tenant

381
00:18:09,330 --> 00:18:11,550
within Microsoft, it's
kind of a trial version,

382
00:18:11,550 --> 00:18:13,950
you don't need to plug
in your credit cards.

383
00:18:13,950 --> 00:18:15,570
It won't cost you anything.

384
00:18:15,570 --> 00:18:16,950
I'm creating a new organization

385
00:18:16,950 --> 00:18:20,401
and you can see that once it is created,

386
00:18:20,401 --> 00:18:23,910
there's a guide here which point me to

387
00:18:23,910 --> 00:18:27,210
how do I create, how do I
onboard new machines here?

388
00:18:27,210 --> 00:18:30,060
So we need to onboard victim machines

389
00:18:30,060 --> 00:18:34,500
into my malicious Microsoft account.

390
00:18:34,500 --> 00:18:37,530
You've seen me do this
already in the demo,

391
00:18:37,530 --> 00:18:39,360
but this was done through UI,

392
00:18:39,360 --> 00:18:44,280
which is kind of not what
we're after as hackers.

393
00:18:44,280 --> 00:18:47,370
So the question is whether
we can do it programmatically

394
00:18:47,370 --> 00:18:48,483
with some script.

395
00:18:49,710 --> 00:18:52,170
Fortunately, Microsoft has
provided a script for us,

396
00:18:52,170 --> 00:18:55,830
again, signed already in
your windows machines.

397
00:18:55,830 --> 00:19:00,830
So you run this silent registration script

398
00:19:01,170 --> 00:19:04,470
and you provide it with
your organization ID,

399
00:19:04,470 --> 00:19:06,840
and again, the crucial piece here,

400
00:19:06,840 --> 00:19:09,990
if you're thinking of detections as well,

401
00:19:09,990 --> 00:19:12,240
is that you can plug
in any tenant ID here.

402
00:19:12,240 --> 00:19:16,920
So of course, I'm just saying,
okay, this is my account,

403
00:19:16,920 --> 00:19:21,393
and I'm pointing this agent
to my malicious office tenant.

404
00:19:22,980 --> 00:19:25,260
Once I run this script,

405
00:19:25,260 --> 00:19:27,480
I go back to the list of machines

406
00:19:27,480 --> 00:19:28,530
and the machine is already there

407
00:19:28,530 --> 00:19:31,830
and you can see that I have
the status of the machine,

408
00:19:31,830 --> 00:19:34,080
the version of the agent
that's sitting here.

409
00:19:35,040 --> 00:19:36,930
So that's kind of cool.

410
00:19:36,930 --> 00:19:41,758
That's basically our way
to onboard our victims

411
00:19:41,758 --> 00:19:43,443
to our malware operation.

412
00:19:44,400 --> 00:19:48,630
One thing that was problematic
about what I just showed you

413
00:19:48,630 --> 00:19:51,900
is that this requires an admin
privilege on the local side

414
00:19:51,900 --> 00:19:53,280
to do this on boarding,

415
00:19:53,280 --> 00:19:55,530
which makes this kind of boring, right?

416
00:19:55,530 --> 00:19:57,840
Fortunately, that's not really the case.

417
00:19:57,840 --> 00:20:02,730
So we didn't do anything
special here, we just tried.

418
00:20:02,730 --> 00:20:05,640
It worked, so well, why not?

419
00:20:05,640 --> 00:20:06,750
So you can just run this

420
00:20:06,750 --> 00:20:11,750
and it will connect the
victim's machine to your cloud.

421
00:20:13,140 --> 00:20:16,290
Once the victim machine is registered,

422
00:20:16,290 --> 00:20:18,900
here's what you need to do
in order to run a payload

423
00:20:18,900 --> 00:20:20,733
form the cloud to the machine.

424
00:20:22,800 --> 00:20:27,480
So you create this automation
from the cloud side,

425
00:20:27,480 --> 00:20:29,010
you create a connection.

426
00:20:29,010 --> 00:20:32,340
Basically, you choose which
machine you're going to run on.

427
00:20:32,340 --> 00:20:33,960
You choose the local credentials.

428
00:20:33,960 --> 00:20:36,240
We saw that this is part
of the payload earlier,

429
00:20:36,240 --> 00:20:38,520
and you choose a specific
payload that you'd like to run.

430
00:20:38,520 --> 00:20:40,939
Of course you can create new payloads

431
00:20:40,939 --> 00:20:45,060
on your own machine and
upload them to windows.

432
00:20:45,060 --> 00:20:46,830
One thing that we need to figure out,

433
00:20:46,830 --> 00:20:51,390
because we need to provide
a user account here.

434
00:20:51,390 --> 00:20:52,650
We need to figure out what happens

435
00:20:52,650 --> 00:20:56,160
if that user is already logged
in to the local account,

436
00:20:56,160 --> 00:20:58,143
what would it do to the usual session?

437
00:20:59,010 --> 00:21:03,330
So again, people have already
fixed this problem for us.

438
00:21:03,330 --> 00:21:06,300
RPA has two versions, attended RPA,

439
00:21:06,300 --> 00:21:09,480
which basically runs in
parallel to a logged in user.

440
00:21:09,480 --> 00:21:12,090
This also means I can
take charge of everything

441
00:21:12,090 --> 00:21:13,320
that the user is doing.

442
00:21:13,320 --> 00:21:15,660
I can open the browser
and take the cookies,

443
00:21:15,660 --> 00:21:17,447
I can do everything
that the user is doing,

444
00:21:17,447 --> 00:21:20,190
and on the other side, as unattended RPA,

445
00:21:20,190 --> 00:21:22,080
which basically creates a new session,

446
00:21:22,080 --> 00:21:25,110
runs the payload and
discards of the session.

447
00:21:25,110 --> 00:21:27,783
So we've seen a bunch of things.

448
00:21:29,024 --> 00:21:34,024
From our list of malware
operation that we wanted to create

449
00:21:34,290 --> 00:21:36,240
we know that we can deploy malware.

450
00:21:36,240 --> 00:21:37,740
We saw this with the register

451
00:21:37,740 --> 00:21:40,710
with basically a silent registration.

452
00:21:40,710 --> 00:21:42,480
We know that this avoids defense,

453
00:21:42,480 --> 00:21:45,180
while this was the premise,
everything here is trusted,

454
00:21:45,180 --> 00:21:46,920
and we know that you
can maintain consistency

455
00:21:46,920 --> 00:21:50,160
because I didn't install
anything on the laptop, right.

456
00:21:50,160 --> 00:21:53,970
I only used Microsoft's on executables.

457
00:21:53,970 --> 00:21:55,500
What we're gonna show next

458
00:21:55,500 --> 00:21:59,243
is how we'll accomplish all of the things

459
00:22:00,690 --> 00:22:01,740
that are left over.

460
00:22:01,740 --> 00:22:05,190
Now, we've already kind of
seen commanding control,

461
00:22:05,190 --> 00:22:07,860
but we only saw specific payload.

462
00:22:07,860 --> 00:22:11,013
So let's reel down into it some more.

463
00:22:13,122 --> 00:22:17,289
Okay, now we're just gonna
show what you can build

464
00:22:19,620 --> 00:22:20,490
with this RPA.

465
00:22:20,490 --> 00:22:23,520
What can you actually
do on the users machine?

466
00:22:23,520 --> 00:22:28,057
So here's a very quick data exfil for you.

467
00:22:28,057 --> 00:22:30,660
This is a RPA flow that
does the following.

468
00:22:30,660 --> 00:22:34,530
It gets as an input, a file
passed on the hard disk,

469
00:22:34,530 --> 00:22:36,510
and basically it reads the file

470
00:22:36,510 --> 00:22:40,800
and it sends the file content
as an output of that flow.

471
00:22:40,800 --> 00:22:43,930
Again, this runs with
Microsoft's executable

472
00:22:45,992 --> 00:22:47,970
and the key thing that
we need to think about is

473
00:22:47,970 --> 00:22:49,773
where is the output actually going?

474
00:22:50,670 --> 00:22:52,320
So it's going to Microsoft cloud.

475
00:22:52,320 --> 00:22:53,670
I'm triggering it from office.

476
00:22:53,670 --> 00:22:56,400
I'm logging into office
with my malicious account.

477
00:22:56,400 --> 00:22:59,130
I'm sending out this payload
and I get in response

478
00:22:59,130 --> 00:23:02,400
the content of the file.

479
00:23:02,400 --> 00:23:06,450
So recalling the architecture
that we saw earlier,

480
00:23:06,450 --> 00:23:08,640
let's figure out where does the data move

481
00:23:08,640 --> 00:23:12,750
to make sure that we don't
get caught along the way?

482
00:23:12,750 --> 00:23:15,720
So this is the architecture that we saw,

483
00:23:15,720 --> 00:23:18,180
and these are the three steps
that are actually happening.

484
00:23:18,180 --> 00:23:20,730
I'm building those
instructions on my side,

485
00:23:20,730 --> 00:23:22,440
on a malicious machine somewhere,

486
00:23:22,440 --> 00:23:25,590
and I'm uploading the
instructions to office cloud,

487
00:23:25,590 --> 00:23:27,660
then I'm sending the
payload to the machines,

488
00:23:27,660 --> 00:23:30,780
through the Microsoft trusted
communication channel,

489
00:23:30,780 --> 00:23:33,510
and the output goes
through that same channel.

490
00:23:33,510 --> 00:23:35,643
So again, completely undetected.

491
00:23:37,590 --> 00:23:41,193
So here's another example.

492
00:23:43,170 --> 00:23:45,780
So this example goes
through code execution.

493
00:23:45,780 --> 00:23:50,400
So we saw that you can
run specific payloads,

494
00:23:50,400 --> 00:23:52,920
but actually I would like
to be able to run everything

495
00:23:52,920 --> 00:23:55,800
that I want on that laptop.

496
00:23:55,800 --> 00:23:57,630
So again, fortunately,

497
00:23:57,630 --> 00:24:01,110
the RPA agent provides
you with the operations

498
00:24:01,110 --> 00:24:04,230
that allow you to execute actual code.

499
00:24:04,230 --> 00:24:08,790
So command lines, PowerShell,
Python, JavaScript.

500
00:24:08,790 --> 00:24:12,120
So here's a quick automation.

501
00:24:12,120 --> 00:24:14,850
I'm basically sending out a script

502
00:24:14,850 --> 00:24:16,290
telling them which kind of script,

503
00:24:16,290 --> 00:24:18,930
how will it be executed?

504
00:24:18,930 --> 00:24:22,803
And then I'm exfiltrating
outside the STD out and SDL.

505
00:24:24,660 --> 00:24:28,050
Actually the problem that when I run this

506
00:24:28,050 --> 00:24:31,470
is it gets flagged by Microsoft EDL.

507
00:24:31,470 --> 00:24:33,453
Now, why does it get flagged?

508
00:24:34,710 --> 00:24:37,830
I mean, it gets flagged
because I ran a command line.

509
00:24:37,830 --> 00:24:40,860
It doesn't really matter who
created that command line.

510
00:24:40,860 --> 00:24:44,912
The EDL is very focused on
looking on those command lines

511
00:24:44,912 --> 00:24:47,160
that are actually running.

512
00:24:47,160 --> 00:24:50,370
So you can see that I basically went out

513
00:24:50,370 --> 00:24:51,360
of the trusted part.

514
00:24:51,360 --> 00:24:53,580
So there's the trusted
part, the RPA agent,

515
00:24:53,580 --> 00:24:55,710
which is able to run some sort of code

516
00:24:55,710 --> 00:24:57,180
like, here's a piece of code

517
00:24:57,180 --> 00:25:00,240
run it with this executable
or that executable,

518
00:25:00,240 --> 00:25:01,770
and there's the untrusted part,

519
00:25:01,770 --> 00:25:03,000
which is the command line.

520
00:25:03,000 --> 00:25:04,830
So the question becomes,

521
00:25:04,830 --> 00:25:08,310
what can we do only with this
drag and drop primitives.

522
00:25:08,310 --> 00:25:11,973
So what kind of malware we
can build only with no code,

523
00:25:13,500 --> 00:25:15,600
actually we can do a
whole bunch of things.

524
00:25:15,600 --> 00:25:19,500
So these are all things that
are provided by the RPA agent.

525
00:25:19,500 --> 00:25:21,210
Let me name some of them.

526
00:25:21,210 --> 00:25:23,670
You can use the builtin
encryption function

527
00:25:23,670 --> 00:25:25,020
to encrypt files.

528
00:25:25,020 --> 00:25:26,370
You can trigger HTTP codes.

529
00:25:26,370 --> 00:25:27,990
You can communicate with active director

530
00:25:27,990 --> 00:25:30,060
in windows services and processes.

531
00:25:30,060 --> 00:25:31,500
You can look at files and folders.

532
00:25:31,500 --> 00:25:33,090
You can automate the browser.

533
00:25:33,090 --> 00:25:34,140
You can take screenshots,

534
00:25:34,140 --> 00:25:36,510
you can automate the
mouse in the keyboard.

535
00:25:36,510 --> 00:25:39,360
You can copy the clipboard,
you get it, right?

536
00:25:39,360 --> 00:25:40,960
You can do basically everything.

537
00:25:41,820 --> 00:25:45,360
So let's do a couple of things.

538
00:25:45,360 --> 00:25:47,913
Here's no code ransomware for you.

539
00:25:48,780 --> 00:25:50,700
This one is again, very simple.

540
00:25:50,700 --> 00:25:55,700
I'm iterating through the
drive, through the local drive,

541
00:25:58,230 --> 00:26:00,600
reading the file, encrypting that file

542
00:26:00,600 --> 00:26:03,510
with the provided encryption function

543
00:26:03,510 --> 00:26:08,510
and then stamping that file,
replacing it from the original.

544
00:26:10,380 --> 00:26:13,083
Here's how this gets
triggered from the cloud side.

545
00:26:18,540 --> 00:26:19,800
So again, very simple,

546
00:26:19,800 --> 00:26:22,710
I'm saying here's the
director I'd like to encrypt.

547
00:26:22,710 --> 00:26:24,090
Here's the private key

548
00:26:24,090 --> 00:26:26,700
and it'll just go to the machine,

549
00:26:26,700 --> 00:26:29,940
send the payload and encrypt
the file and that's it.

550
00:26:29,940 --> 00:26:31,560
and I'm getting flashes here

551
00:26:31,560 --> 00:26:32,730
that I don't have a lot of time,

552
00:26:32,730 --> 00:26:36,510
so I'm gonna skip kind of through it.

553
00:26:36,510 --> 00:26:37,740
But as you can see,

554
00:26:37,740 --> 00:26:40,140
this is being triggered
from the cloud side

555
00:26:40,140 --> 00:26:41,940
and when the task gets finished

556
00:26:41,940 --> 00:26:45,510
and you saw that this already
happened, I basically see it.

557
00:26:45,510 --> 00:26:47,550
I get the results on the cloud

558
00:26:47,550 --> 00:26:48,870
and from the machine side,

559
00:26:48,870 --> 00:26:50,670
of course the files are encrypted.

560
00:26:50,670 --> 00:26:52,440
DDR didn't catch it.

561
00:26:52,440 --> 00:26:55,563
This is all being done by
the Microsoft executable.

562
00:26:57,270 --> 00:26:58,103
Okay.

563
00:26:59,790 --> 00:27:01,350
Here's another one for you.

564
00:27:01,350 --> 00:27:04,170
So we know that this agent

565
00:27:04,170 --> 00:27:06,450
is actually creating
a whole bunch of logs.

566
00:27:06,450 --> 00:27:08,190
The agent that we are actually using,

567
00:27:08,190 --> 00:27:11,220
because every time that it gets called,

568
00:27:11,220 --> 00:27:14,520
it writes what did it call?

569
00:27:14,520 --> 00:27:16,290
What exactly did it do?

570
00:27:16,290 --> 00:27:19,530
But again, looking at
Microsoft, the documentation,

571
00:27:19,530 --> 00:27:23,250
we can figure out where these
logs are being maintained,

572
00:27:23,250 --> 00:27:24,990
and we can just go ahead and delete them.

573
00:27:24,990 --> 00:27:26,523
So here's the flow to do that.

574
00:27:28,890 --> 00:27:31,770
I'll finish off with one more.

575
00:27:31,770 --> 00:27:34,050
We talked about the browser.

576
00:27:34,050 --> 00:27:37,560
So here's a quick thing that we can do.

577
00:27:37,560 --> 00:27:38,940
We can open the browser.

578
00:27:38,940 --> 00:27:41,550
We can go to some endpoint

579
00:27:41,550 --> 00:27:43,920
that we'd like to steal
the users token from

580
00:27:43,920 --> 00:27:48,750
and we just plug in a JavaScript shell

581
00:27:48,750 --> 00:27:53,313
inside of that browser to
basically take home the cookie.

582
00:27:54,330 --> 00:27:56,230
So there's a quick demo for that here.

583
00:27:57,570 --> 00:28:01,503
Not sure I have that time, but
basically it's really simple.

584
00:28:03,030 --> 00:28:05,490
What this does is it opens up the browser.

585
00:28:05,490 --> 00:28:07,080
It goes to that location

586
00:28:07,080 --> 00:28:12,030
and it just runs the JavaScript
script that I've mentioned,

587
00:28:12,030 --> 00:28:16,000
and fortunately, there's
a nice property here,

588
00:28:16,000 --> 00:28:18,780
where can open the browser
in a minimized version.

589
00:28:18,780 --> 00:28:20,403
So the user wouldn't notice.

590
00:28:23,550 --> 00:28:24,383
Okay.

591
00:28:26,700 --> 00:28:31,700
So a quick recap on everything
we did up until now.

592
00:28:31,710 --> 00:28:34,530
We saw how you can deploy malware,

593
00:28:34,530 --> 00:28:37,230
you can avoid detection,
you can remain persistent.

594
00:28:37,230 --> 00:28:39,490
We saw how you can create
command and control

595
00:28:40,871 --> 00:28:42,240
through the office cloud.

596
00:28:42,240 --> 00:28:43,950
We saw exfiltration and cleanup.

597
00:28:43,950 --> 00:28:45,870
We actually wanted to show
a bunch of other things

598
00:28:45,870 --> 00:28:47,490
like kilogil and other things,

599
00:28:47,490 --> 00:28:49,290
but you can just play around with it

600
00:28:49,290 --> 00:28:51,183
and I'm sure you'll find it nice.

601
00:28:52,429 --> 00:28:55,860
The one thing that I have left for you

602
00:28:55,860 --> 00:28:57,750
is how do you do all of that

603
00:28:57,750 --> 00:28:59,640
as part of your existing (indistinct)?

604
00:28:59,640 --> 00:29:01,980
So you don't wanna be
playing with UI for office

605
00:29:01,980 --> 00:29:03,150
and those things.

606
00:29:03,150 --> 00:29:06,777
So we've introduced this new tool for you.

607
00:29:06,777 --> 00:29:09,450
You can go ahead and use it right now.

608
00:29:09,450 --> 00:29:11,820
You'll have an address in a moment.

609
00:29:11,820 --> 00:29:14,880
Basically, we've covered
a bunch of things for you

610
00:29:14,880 --> 00:29:17,430
so we are handling errors.

611
00:29:17,430 --> 00:29:19,892
We are creating HTTP
endpoint on the office,

612
00:29:19,892 --> 00:29:23,280
on the malicious office
side, which you can just call

613
00:29:23,280 --> 00:29:25,860
and then you do something
like you post, okay,

614
00:29:25,860 --> 00:29:29,496
here's the machine I'd like
to run this payload on.

615
00:29:29,496 --> 00:29:31,196
Here's the payload I'd like to run,

616
00:29:31,196 --> 00:29:32,190
here are some parameters

617
00:29:32,190 --> 00:29:37,190
and you get back all of
the outputs of that process

618
00:29:39,180 --> 00:29:42,000
and all of the things that
you saw here in the talk

619
00:29:42,000 --> 00:29:46,890
and other payloads as well are
available through that tool.

620
00:29:46,890 --> 00:29:49,230
So this is available right now.

621
00:29:49,230 --> 00:29:51,450
There's a convenience
layer around it in Python.

622
00:29:51,450 --> 00:29:54,660
Let me quickly describe how it works.

623
00:29:54,660 --> 00:29:58,825
You create your Microsoft tenant.

624
00:29:58,825 --> 00:30:00,990
There are instructions on how to do that.

625
00:30:00,990 --> 00:30:04,020
Again, no credit card, free of charge.

626
00:30:04,020 --> 00:30:08,310
You run a quick script that
I'm setting up for that tenant.

627
00:30:08,310 --> 00:30:10,920
You register with your machines
with Microsoft executables,

628
00:30:10,920 --> 00:30:11,910
not mine,

629
00:30:11,910 --> 00:30:14,850
and then you use this nice
Python script to do things

630
00:30:14,850 --> 00:30:18,060
like run ransomware,
run specific commands,

631
00:30:18,060 --> 00:30:22,080
and please feel free to
send out pull request

632
00:30:22,080 --> 00:30:23,133
with new payloads.

633
00:30:24,570 --> 00:30:28,080
So we're about done.

634
00:30:28,080 --> 00:30:29,230
Let's do a quick recap.

635
00:30:30,503 --> 00:30:32,640
We saw what RPA is.

636
00:30:32,640 --> 00:30:35,510
We saw that it's available
on every major enterprise.

637
00:30:35,510 --> 00:30:36,690
Check it out back home.

638
00:30:36,690 --> 00:30:38,310
You'll see it's already there.

639
00:30:38,310 --> 00:30:39,390
We saw how it works

640
00:30:39,390 --> 00:30:41,130
and we saw how it can be used

641
00:30:41,130 --> 00:30:43,200
to power the malware operation.

642
00:30:43,200 --> 00:30:45,780
We saw that you can use it
with low-code primitives

643
00:30:45,780 --> 00:30:48,330
that basically allow you
to do whatever you want.

644
00:30:48,330 --> 00:30:49,650
We saw Power Pwn,

645
00:30:49,650 --> 00:30:52,050
which is a new tool that
you can use right now

646
00:30:52,050 --> 00:30:54,663
to play around with it
and to see how it works.

647
00:30:55,740 --> 00:30:57,270
The last thing I'm gonna do,

648
00:30:57,270 --> 00:30:59,220
and I'll do it very quickly

649
00:30:59,220 --> 00:31:01,380
is leave you off with a few things

650
00:31:01,380 --> 00:31:02,550
you can do to protect yourself,

651
00:31:02,550 --> 00:31:04,000
to protect your organization.

652
00:31:05,490 --> 00:31:08,760
So here's one very, very obvious thing,

653
00:31:08,760 --> 00:31:10,920
monitor these executables. (chuckles)

654
00:31:10,920 --> 00:31:13,320
So as you can see,

655
00:31:13,320 --> 00:31:14,340
you need to make sure

656
00:31:14,340 --> 00:31:18,630
that basically the number one
thing you need to make sure

657
00:31:18,630 --> 00:31:22,140
is that people are not registering
those agents to a tenant

658
00:31:22,140 --> 00:31:23,910
that is not your own.

659
00:31:23,910 --> 00:31:24,910
You can also review.

660
00:31:27,300 --> 00:31:32,190
This entire talk was focused
on using the existing tools

661
00:31:32,190 --> 00:31:33,180
without talking about

662
00:31:33,180 --> 00:31:35,370
whether the organization
itself is going to use it.

663
00:31:35,370 --> 00:31:38,760
So your users might actually
have been using this,

664
00:31:38,760 --> 00:31:39,630
and if they're using this,

665
00:31:39,630 --> 00:31:41,940
there are bunch of issues that can occur.

666
00:31:41,940 --> 00:31:43,320
If that's interesting for you,

667
00:31:43,320 --> 00:31:47,400
I have another talk here
at 4:00 PM, same room.

668
00:31:47,400 --> 00:31:50,610
So if you're not tired
of me yet, see you again,

669
00:31:50,610 --> 00:31:53,310
and there are a bunch of
information that you can use here

670
00:31:53,310 --> 00:31:55,590
to learn more Microsoft documentation.

671
00:31:55,590 --> 00:31:58,800
There's an OS group that
is focused on this area

672
00:31:58,800 --> 00:32:00,783
and a bunch of blogs and content.

673
00:32:02,400 --> 00:32:04,154
Thank you very much.

674
00:32:04,154 --> 00:32:07,154
(audience clapping)