Hi, everyone. So you can probably judge from the title, but what we're going to do today is
we're going to show how you can use Windows executables, service accounts, and cloud
services to basically power your own malware operation. Shortly about me, I've been around
cyber security for a long time now. Spent some time at, ah, sorry. .
Thank you for that. So I spent a bunch of time at Microsoft on API's, IOT, cloud. I've been doing
local no code security for like three years now, which is weird because not many people are
into it, but you will soon be, so that's cool. I started a company called IOT and I started
a company around 18 months ago called Zenity with folks that are sitting right here. We're
focused on local no code security. Um, and again, first time at DEF CON, very excited to be
here as you can probably hear. Um, so thank you for coming. By the way, this talk is going to
feature research from Maria Zilberberg, who's sitting right here, one of our researcher. Uh,
so give him some love. . This is one of the most interesting
things I've ever heard. Uh, local no code is, is, is a cool thing. We are very much pro, uh, the
movement. And this talk, I will try to give you an attacker's perspective on that. The reason, of
course, is to, uh, make sure that this is done in a, in a responsible way. So, uh, what you're
going to learn today, use it to educate people around you and, uh, let's, let's see, let's see
where it takes us. Okay. So, uh, I'm going to start right now. When I say, uh, I'm going to
create a, a, or running your own malware operation, there are a bunch of things that I could
mean, so let's figure out what exactly I'm, I'm meaning that, that we're going to do today. So you
have initial access to, uh, some victim machine. Uh, there's a lot of other things that you need
to do around it in order to really call it a malware operation. You need to be able to, um,
okay. So you need to be able to go through, uh, a firewall. You need to be able to actually run
malware on that machine and and and be able to bypass DDR. You need to be able to uh to create
command and control across that firewall and to exfiltrate data back uh back to your uh
back uh uh backwards outside of the org. You need to uh avoid uh detection by a bunch of
other enterprise tools that are out there in order to catch you. And you need to remain
persistent on the actual victim machine uh when they are obviously trying to kick you out.
All of those things are a bunch of grunt work. So what we're gonna do today is we're gonna show
how uh instead of having to do all of that yourself you can just focus on the initial access
and on the last part which is kind of having fun. And we're gonna try and figure out whether we
can uh how how we can use existing services to take care of all of that ops for us. So what um
so here's the
service that we're going to use. I'm not sure if you've heard about RPA. This is basically a
technology that is out there in every major enterprise today. It's it's really every word.
And the idea behind RPA is basically to take uh mundane processes that business users are doing.
So copying and pasting through different softwares that they have on their machine. And
basically automating it. And the way that it gets it gets automated is that the users are
actually are actually uh emulated. So this is uh this is uh this is uh this is uh this is uh this
is RPA. So the user gets impersonated. They are uh copying the uh kind of the uh keyboard and
the mouse mouse clicks and then reiterating them. And that's the way that they're they're using
the user's own identity. And it's used uh to basically facilitate integration with uh old
software that has no APIs uh which makes it easier. Uh so RPA is built of three main
components. The first one is an agent. It sits on somebody's laptop. And it emulates the user
that as I've just just mentioned. The second part is the control unit. So the control unit is a
controller which is able to go reach out to the uh to the machine. Send some payload. The
payload gets executed. And then the uh the output gets routed back. And there's a management
portal which allows you to basically say okay here are all my agents. Here's the payload I'm
gonna send to each one of them. The key thing about this technology is that every part here is
trusted. And what do I mean by trusted? I mean trusted by the EDR, trusted by network security,
trusted by the SOC team. So on the agent side there are executables that are used to run the
RPAs. They are signed by by the vendors themselves. We'll see that in a moment. Uh the
communication. So all of the endpoints uh all of the protocols and the cloud services
themselves. And there are a bunch of vendors that are send that are uh uh providing these RPAs
solutions that as I mentioned are everywhere in the enterprise. Uh today as you as you've uh
kind of realized from the talk's title we're gonna focus on Microsoft and you'll you'll find
out why in a moment. But actually everything that I'm gonna show you today is uh is a
that's not specific to Microsoft. It's actually uh it's actually a problem uh uh it's actually
uh inherent in the way that RPA works. So RPA can take care of all of the malware ops that I've
just talked about for us. So command and control, exfiltrating data uh uh uh outside of the org,
uh avoid in defense. Uh persistency, cleanup. But it also will be able to give us more
much more. So handling everything that's related to kind of engineering, updating those agents,
being able to support any type of platform, those are all things that the RPA vendors will do
for us. So this is a living off the land attack and we're going to live off the land of RPA and
specifically Microsoft RPA to do what we want to do. Here's our agenda for today. So we
covered the motivation. Next up, we're going to drill down a bit more into what RPA is all about.
We'll focus on, we'll do a deep dive and understand how it works. Then I will shift gears and show
you specifically how do you take RPA and leverage it to your own malware operation and we'll
introduce a tool that will allow you to do that quickly. And don't worry, we'll also send you home
with kind of a few things you can do to remain protected or protect your organization. Okay.
Okay.
Okay. So in order to understand what RPA is, let's start off with a story. When I was a
young, when I was a teenager, my friends and I used to play in a game called Tibia. Who knows
what Tibia is? Raise your hand. Okay. That's a weird game, a weird MMORPG from a long time ago
where basically you level up your character, you play with other players and you collaborate.
But a lot of the actual time that you get, that you spend on that game, is actually doing things
like fishing. So you to improve your fishing skills. In order to do that, you're basically, you
basically go to a pond, and then you need to click. So you click and you get some fish, and
you click and you get more fish and more fish and this is basically transforming clicks and
virtual worms into virtual fish. This is important for the game. But it is a bit different than
but it is extremely boring.
So of course, as a teenager,
I wanted to take advantage of this.
I wanted to basically be better than my friends
and impress them.
So I tried to find a creative solution
for this to work better.
I started off with physical automation.
I actually looked for a picture of this.
I couldn't find any picture.
I'm not sure why somebody in my family
didn't take the picture.
As you can imagine, this didn't work.
So the book would fall over.
I would wake up in the morning
and things were not as I expected.
So I had to find a better solution.
And I actually went with automation,
which was basically, there was software
that allowed me to basically record my keyboard
and my mouse and then replay them.
So I had this set up where I walk around the pond
and I click on a bunch
of fish and when I wake up in the morning,
I'm leveled up.
So this is what it looks like.
I think you're seeing it.
So, and basically, this made me the hero of my friends.
So this was my first kind of,
the first moment I got some love,
kind of across, kind of became a bit popular.
And this is funny because this is actually
the basis of RPA.
So the same technology that I used as a kid like 20 years ago,
is the same technology that I used as a kid like 20 years ago,
is the same technology that I used as a kid like 20 years ago,
is being used in the enterprise today
to do very serious things.
So RPA, as a quick recap,
it's about replacing copy and paste integration.
It's a drag and drop builder, you'll see it in a moment.
And the people, and it's used,
it's used, the people that are building these RPA bots,
they can be in IT, but they can also be business users.
It emulates the user's own actions,
so it operates as the user with their own identity.
There's no way to distinguish those clearly.
And it runs on the user's machines.
And on the use cases side,
enterprises are really using it for serious things.
So customer services, financial services,
onboarding and offboarding HR,
so this is touching business sensitive data.
Now we understand what,
now that we understand what RPA is,
let's drill down technically into how it works
and how and that would also kind of lead us in the way that,
that we're looking for with our malware op. So we want to use RPA for the malware operation.
And this is where we're going to actually focus on Microsoft and this is why. So Microsoft has
released an RPA agent called Power Automate Desktop and it is now baked into every Windows
11 machine. And by baked in I mean that if you take a fresh Windows machine, you'll search for
Power Automate, it'll be there. It's also trusted by DDR and trusted by other DDRs as well.
So that's why we're going to focus on that on Microsoft today. Let's start from the user's
perspective. So this is a fresh Windows machine, Windows 11 machine. Searching for Power Automate,
I immediately find this executable. Let's see if this works. Okay.
Okay, it works. So what I'm showing you here is a quick video that is me setting up my
connection with the RPA, with that RPA service. The third thing that I'm doing is actually
plugging in my office account and the crucial thing here is that I could plug in any office
account. So I, in this example, I created a new organization, you'll see that in a moment, and
I'm plugging in my credentials with that organization.
So once I plug in those credentials, I get to this drag and drop builder with a bunch of
operations that are available for me. And then I'm going to click and I'm going to create a
lower world application that basically writes a lower world to a file on disk. The crucial thing
here is that this thing is synced to office cloud. And it's synced to my cloud because I just
logged in with my account. And so you'll see in a moment when I kind of finish off with the
demonstration here that there's a bunch, so you're seeing it now, there's a bunch of, a bunch of, a
bunch of, basically bots or processes that are available for me to pick and choose from. Those
are all things that I set up previously in my office account. So this is what you just saw. When
you plug in your credentials, your office credentials, to this Windows, to this Windows
executable, you get all of the different payloads that you, or processes that you have created in an
application. This is how it looks like, this is how it looks like from an architecture
perspective. So on one side you have Power Automate, the RPA agent, and the other side you have
office. One sits in on-prem and another in cloud. And the reason that I'm focusing on that is
that Microsoft, of course, has to be deployed everywhere in large organizations. So they need to
figure out how, I mean, how is this working? They haven't asked for permission from anybody,
right? It's already there. So what we're going to figure out right now, technically, is how is
this communicating.
So we'll focus first on the left side, which is actually the local side. Power Automate is not one
executable. There are a bunch of those. There's one service that's called Power Automate, runs on
the user's own account. And there's another service account that's being created that you can see
here that runs with an executable that's called Machine Runtime. And that will be the one that's
actually in charge of communicating with Office Cloud. We'll see that in a moment. There's also
a browser that allows you to automate the browser. So you can basically, through an extension on all
popular browsers, you can change what users are viewing on the browsers and you can also kind of
fetch all of the information that they have there. So we'll add that to our architecture as
well. As you can see, there are these extensions across all of the different browsers. This is
the, so what you're seeing here is actually that I've only talked about three executables out of
five that are built into Windows 11. Again, and you're seeing that this is in a trusted, this is
kind of in a trusted location. So there are, there's plenty of opportunity to do more research
here. So if you're looking for a challenge, I recommend checking this out. So let's switch to
another direction and talk about the communication. So of course, network boundaries have
been, I mean people have been trying to maintain them for a long time. So let's talk about the
communication of an office manager. So a lot of people is kind of wanting to gain a little bit
information on how to do that. And there's a really serious question we should ask ourselves here,
which is how is Microsoft able to communicate with office services without having some IT admin
open up a port somewhere. The way that this is done is with a neat service at called Azure,
Azure service bus. It's used to be Azure Relay. Basically both sides are, are, are, are creating
outbound communication and so this is how the channel gets, gets created. So the agent will reach
out to Azure service buses and then both sides will reach out with their services and so all of the
us every couple of minutes and ask for new tasks that it should pick up and use. Okay.
So we're connected. We understand how this thing operates. We understand that it has
components that run as the user and components that run as a service account. The crucial
thing to note right here, because it's the last time I'm going to say it, is that all
of these things are trusted. The executables are trusted. The service accounts are trusted.
The cloud accounts are trusted. They are all in the allow list that you get by default. Once
you plug in your machine, this is what you're seeing from the office side. So office provides
you with kind of a nice way to view all of the machines that are connected to your cloud. You
can also run things on the laptop from the cloud. So you trigger, you create some sort of
payload and you can execute it from the cloud on some machine. And then you get status. You can
look at history. You can debug things. So all of the kind of convenience layers that you need
around it. The last thing that I want to cover in terms of architecture is how is trust being
established. So it's not only about connection to the Azure service bus. Actually, there needs
to be kind of a trusted communication between the two. So when you register your machine to the
cloud, with Power Automate that you saw me do a few minutes ago, there's a private key that's
being created on your local machine and a public key on the cloud side. And it's being used to
basically encrypt a message that sends two things to the machine through Azure service bus. The
first thing is local credentials. So you can run those payloads with whichever local credentials
you'd like on the machine. And the second thing is an RPA task, which is the kind of the process
that you would like to run.
Again, in a summary, in a nutshell, this runs on the, this executes on the user's own, with the
user's own credentials, and it constantly goes out to office and asking whether there's
something it needs to be running. So what we're going to do right now is we're going to switch
gears up until now. It was kind of theoretical. We're going to go to specifics of how you can use
this setup.
To run your model operation with Power Automate, Microsoft's RPA. So let's remember our wishlist.
This was the, these were the things that we wanted to accomplish when we started, when we started
this conversation. So all of the things here that are, that are around ops, we'll go through each
one and show how they can be done. First up, we need a bit of setup. So what you need in order to
use this is basically create, what I'm doing here is create a, I'm going to show you how to do this.
I'm creating a new tenant within Microsoft. It's kind of a trial version. You don't need to plug in
your credit cards. It won't cost you anything. I'm creating a new organization and you can see
that once it is created, there's a, there's a guide here that, which points me to how do I
create, how do I onboard new machines here? So we need to onboard Victor machines into my
malicious Microsoft account. You've seen me do this already in the demo, but this was done in a
different way. So we need to run through UI, which is kind of not what we're, what we're, what
we're after, right, as, as hackers. So the question is whether we can do it programmatically with
some script. Fortunately, Microsoft has provided this script for us. Again, signed already in
your Windows machines. So you run this silent regist, silent registration script and you provide
it with your organization ID and again, the crucial piece here, if you have a, kind of, if you have a
problem, if you're thinking of detections as well, is that you can plug in any tenant ID here.
So, of course, I'm just sending, I'm just saying, okay, this is my, this is my account and I'm
pointing, pointing this agent to my malicious office tenant. Once I run this script, I can, I go
back to the list of machines and the machine is already there and you can see that I, I have the
status of the machine, the version of the agent that's sitting here. So that's kind of cool.
That we, that, that, that's how, that's basically how we're going to run this script. So let's, let's, let's, let's
play our way to onboard our victims to our malware operation. One thing that was problematic about
what I just showed you is that this requires an admin privilege on the, on the local site to do
this onboarding, which makes these kind of boring writes. Fortunately, that's not really theW
We just tried to worked. So why not? So you can just run this and it will connect you to our
connect the victim's machine to your cloud. Once the victim machine is registered, here's what
you need to do in order to run a payload from the cloud to the machine. So you create this
automation from the cloud side. You create a connection. Basically you choose which machine
you're going to run on. You choose the local credentials. We saw that this is part of the
payload earlier. And you choose a specific payload that you'd like to run. Of course you can
create new payloads on your own machine and upload them to Windows. One thing that we need to
figure out, because we need to provide a user account here, we need to figure out what
happens if that user is already logged in to the local account, right? What would it do to the
user session? So again, people have already fixed this problem for us. RPA has two versions.
Attended RPA, which basically runs in parallel to a logged in user. This also means I can take
charge of everything that the user is doing. I can open the browser and take their cookies. I can
do everything that the user is doing. And on the other side is unattended RPA, which basically
creates a new session, runs the payload, and discards of the session. So we've seen a bunch of
things. From our list of the malware operations that we wanted to create, we know that the
we can deploy malware. We saw this with the basically silent registration. We know that this
avoids defense. Well, this was the premise. Everything here is trusted. And we know that you
can maintain persistency because I didn't install anything on the laptop, right? I only used
Microsoft's own executables. What we're going to show next is how we'll accomplish all of the
things that are left over. Now we've only already kind of seen command and control. We're
going to show specific payloads. So let's drill down into it some more. Okay. Now we're going to
just going to show what you can build with this RPA. What can you actually do on the user's
machine? So here's a very quick data for you. This is an RPA flow that does the
following. It gets an input file, a pass on the hard disk, and basically it's always doing
it reads the file and it sends the file content as an output of that flow. Again, this runs with
Microsoft's executable. And the key thing that we need to think about is where is the output
actually going? So it's going to Microsoft Cloud. I'm triggering it from Office. I'm logging
into Office with my malicious account. I'm sending out this payload and I get in response the
actual, the content of the file. So recalling the architecture that we saw earlier, let's figure
out where does the data move to make sure that we don't get caught along the way. So this is the
architecture that we saw and these are the three steps that are actually happening. I'm building
those instructions on my side on a malicious machine somewhere and I'm uploading the
instructions to Office Cloud. Then I'm sending the payload to the machine through the
Microsoft trust.
The communication channel and the output goes through that same channel. So again, completely
undetected. So here's another example. We're going to so this example goes through code
execution. So we saw that you can run specific payloads but actually I would like to be able to
run everything that I want on that laptop. So again, fortunately, the RPA agent provides you
with operations that allow you to execute actual code. So command lines, Python JavaScript. So
here's a quick automation. I'm basically sending out a script telling them which kind of script,
how will it be executed? And then I'm exfiltrating outside the SDD out and SDD out. Actually, the
the problem is when I run this, it gets flagged by Microsoft EDR. Now why does it get flagged?
I mean it gets flagged because I ran a command line. It doesn't really matter who created
that command line. The EDR is very focused on looking on those command lines that are
actually running. So you can see that I basically went out of the trusted part. So the trusted
part, the RPA agent which is able to run some sort of code like here's a piece of code run it
with this executable or that executable and there's the untrusted part which is the command
line. So the question becomes what can we do only with this drag and drop primitive. So what
kind of malware we can build only with no code. Actually we can do a whole bunch of things. So
these are all things that are provided by the RPA agent. Let me name some of them. You can use
the built in encryption function to encrypt files. You can trigger HTTP calls. You can
communicate with active directory and Windows services and processes. You can look at files and
folders. You can automate the browser. You can take screenshots. You can automate the mouse and
the keyboard. You can copy the clipboard. You get it. Right? You can do basically everything.
So let's do a couple of things. Here's a no code ransomware for you. This one is again very
simple. I'm iterating.
Through the drive. Through the local drive. I'm reading a file, encrypting that file with the
provided encryption function and then stamping that file with replacing it from the original.
Here's how this gets triggered from the cloud side. So again very simple. I'm saying here's the
directory I'd like to encrypt.
Here's the private key. And it will just go to the machine, send the payload, encrypt the file, and
that's it. And I'm getting flashes here that I don't have a lot of time. So I'm going to skip kind
of through it. But as you can see, this is being triggered from the cloud side. And when the task
gets finished and you saw that this already happened, I basically see it. I get the results on
the cloud. And from the machine side, of course, the files are encrypted. The EDR didn't catch it. We're
seeing that this is all being done by the Microsoft executable. Okay. Here's another one for
you. So we know that this agent is actually creating a whole bunch of logs, the agent that we're
actually using. Because every time that it gets called, it writes what did it call, what exactly
did it do. But again, looking at Microsoft documentation, we can figure out where these logs are
being maintained and we can just go ahead and delete them. So here's a flow to do that. I'll
finish off with one more. We talked about the browser. So here's a quick thing that we can do.
We can open the browser. We can go to some endpoint that we'd like to steal the user's
token from and we just plug in a JavaScript shell inside of that browser to basically take home
the cookie. So there's a quick demo for that here. I'm not sure I have the time, but basically
it's really simple. What this does is it opens up the browser, it goes to that location, and it
just runs the JavaScript script that I've mentioned. And fortunately,
there's a nice property here where you can open the browser in a minimized version. So the
user won't notice. Okay. So a quick recap on anything we did, everything we did up until now.
We saw how you can deploy malware, you can avoid detection, you can remain persistent. We saw
you can create command and control through the office cloud. We saw exfiltration. We saw
configuration and clean up. We actually wanted to show a bunch of other things like keyloger and
other things, but you can just play around with it and I'm sure you'll find it nice. The one thing
that I'm going to do, one thing that I have left for you is how do you do all of that as part of
your existing arsenal. So you don't want to be playing with UI for Office and those things. So
we've introduced this new tool for you. You can go ahead and use it right now. You'll have an
address in a moment. Basically, this is a pretty simple tool. It's basically a tool that you can use to
we've covered a bunch of things for you so we are handling errors, we are creating an HDP
endpoint on the malicious office side which you can just call and then you do something like
you post okay here's the machine I'd like to run this payload on, here's the payload I'd like to
run, here are some parameters and you get back all of the outputs of that process and all of the
things that you saw here in the talk and other payloads as well are available through that
through that tool. So this is available right now. There's a convenience layer around it in
Python. Let me quickly describe how it works. You create your Microsoft tenant. There are
instructions on how to do that. Again no credit card free of charge. You run a quick script
that I'm for setting up the tenant. You register with your machines with Microsoft
executables, not mine. And then you use this nice Python script to do things like run ransomware,
run specific commands and please feel free to send out pull requests with new payloads. So we're
about done. Let's do a quick recap. We saw what RPA is. We saw it's available on every major
enterprise. Check it out back home. You'll see it's already there. We saw how it works and we saw
how it works. We saw how it works. We saw how it works. We saw how it works. We saw how it works.
We saw how it works. We saw how it works. We saw how it works. We saw how it can be used to power a
malware operation. We saw that you can use it with local primitives that basically allow you to
do whatever you want. We saw PowerPoint which is a new tool that you can use right now to play
around with it and to see how it works. The last thing I'm going to do and I'll do it very
quickly is leave you off with a few things you can do to protect yourself, to protect your
organization. So here's one very, very obvious thing. Monitor these executables. This is a
very important tool. So as you can see, you need to make sure that basically the number one
thing you need to make sure is that people are not registering those agents to a tenant that is
not your own. You can also review this entire talk was focused on using the existing tools
without talking about whether the organization itself is going to use it. So your users might
actually be using this. And if they're using this, there are a bunch of people who are going to
use it. There are a bunch of issues that can occur. If that's interesting for you, I have another
talk here at 4 p.m., same room. So if you're not tired of me yet, see you again. And there are a
bunch of information that you can use here to learn more, Microsoft documentation. There's an
OWASP group that is focused on this area and a bunch of blogs and content. Thank you very much.
Thank you.