1
00:00:00,560 --> 00:00:03,199
and this is the last log for j talk

2
00:00:03,199 --> 00:00:05,279
you'll ever need

3
00:00:05,279 --> 00:00:08,960
so a bit about who i am and what do i do

4
00:00:08,960 --> 00:00:12,240
i code i teach i hack in other words i

5
00:00:12,240 --> 00:00:13,120
spend

6
00:00:13,120 --> 00:00:16,640
most of my days on work and off bashing

7
00:00:16,640 --> 00:00:18,400
my head against the keyboard and the

8
00:00:18,400 --> 00:00:22,320
absence base either to get code to work

9
00:00:22,320 --> 00:00:25,599
or to break other people's code and in

10
00:00:25,599 --> 00:00:30,080
that concussive stupor i also try to

11
00:00:30,080 --> 00:00:33,760
stand behind a podium stage whatever and

12
00:00:33,760 --> 00:00:37,120
give insights on my experiences to

13
00:00:37,120 --> 00:00:38,960
everyone else

14
00:00:38,960 --> 00:00:42,000
i do i must add the disclaimer although

15
00:00:42,000 --> 00:00:44,480
i do have an employer currently

16
00:00:44,480 --> 00:00:47,039
i do not speak for the corporate hive

17
00:00:47,039 --> 00:00:48,320
mind

18
00:00:48,320 --> 00:00:52,640
i am just one of its many cogs

19
00:00:52,879 --> 00:00:53,920
so

20
00:00:53,920 --> 00:00:56,480
moving on to what we talking about

21
00:00:56,480 --> 00:00:59,120
on your left you see one of the most

22
00:00:59,120 --> 00:01:02,719
popular logging libraries in java and on

23
00:01:02,719 --> 00:01:06,320
the right you see your ticket to shelves

24
00:01:06,320 --> 00:01:09,200
and it's all about a pocket gaining a

25
00:01:09,200 --> 00:01:10,960
pocket full of shells

26
00:01:10,960 --> 00:01:12,799
and do

27
00:01:12,799 --> 00:01:15,200
take note of the cve don't get it

28
00:01:15,200 --> 00:01:18,640
confused with any of the other ones

29
00:01:18,640 --> 00:01:22,680
like for example cv45046

30
00:01:23,040 --> 00:01:24,840
or any of the

31
00:01:24,840 --> 00:01:28,560
others they're nice they're good

32
00:01:28,560 --> 00:01:31,119
they're ex they're they're

33
00:01:31,119 --> 00:01:33,119
ways of exploiting systems but the

34
00:01:33,119 --> 00:01:34,720
problem is

35
00:01:34,720 --> 00:01:36,880
they require

36
00:01:36,880 --> 00:01:38,079
effort

37
00:01:38,079 --> 00:01:40,880
and that's not what we come here for for

38
00:01:40,880 --> 00:01:43,360
log for shell log for shell isn't about

39
00:01:43,360 --> 00:01:46,880
effort and insight it's about getting

40
00:01:46,880 --> 00:01:49,840
arbitrary remote code execution

41
00:01:49,840 --> 00:01:54,799
anywhere and everywhere and so

42
00:01:54,799 --> 00:01:57,600
if you want to see the magical payload

43
00:01:57,600 --> 00:01:58,719
of what

44
00:01:58,719 --> 00:02:01,600
it takes actually exploit log for shell

45
00:02:01,600 --> 00:02:02,960
here it is

46
00:02:02,960 --> 00:02:05,920
it is just the jndi

47
00:02:05,920 --> 00:02:07,200
ldap

48
00:02:07,200 --> 00:02:10,080
at the location via the ip and the port

49
00:02:10,080 --> 00:02:13,760
and the path to the exploit

50
00:02:13,760 --> 00:02:15,920
and let's just

51
00:02:15,920 --> 00:02:19,280
take a deep dive and look in through it

52
00:02:19,280 --> 00:02:22,879
unlike most acronyms in it

53
00:02:22,879 --> 00:02:26,080
ldap and jdi are actually useful for

54
00:02:26,080 --> 00:02:27,680
explaining

55
00:02:27,680 --> 00:02:29,280
what they are

56
00:02:29,280 --> 00:02:30,239
so

57
00:02:30,239 --> 00:02:34,000
ldap you'll see tutorials classes

58
00:02:34,000 --> 00:02:37,120
seminars everywhere about that

59
00:02:37,120 --> 00:02:39,920
the long and short of it is

60
00:02:39,920 --> 00:02:42,160
ldap a lightweight directory access

61
00:02:42,160 --> 00:02:43,280
protocol

62
00:02:43,280 --> 00:02:45,120
is just

63
00:02:45,120 --> 00:02:48,560
file operations over tcp

64
00:02:48,560 --> 00:02:51,519
that's just using

65
00:02:51,519 --> 00:02:54,239
internet web requests how do you move

66
00:02:54,239 --> 00:02:58,640
files delete files create and edit files

67
00:02:58,640 --> 00:03:01,599
so your basic file operations that you

68
00:03:01,599 --> 00:03:03,840
find in the desktop how do you do it

69
00:03:03,840 --> 00:03:06,400
online do the same thing online

70
00:03:06,400 --> 00:03:10,480
and the jdi is just the java name

71
00:03:10,480 --> 00:03:12,400
directory interface

72
00:03:12,400 --> 00:03:13,920
and so

73
00:03:13,920 --> 00:03:17,280
why why do you need to use jndi why

74
00:03:17,280 --> 00:03:19,519
would anyone use jdi in the first place

75
00:03:19,519 --> 00:03:21,440
is because

76
00:03:21,440 --> 00:03:25,519
of code reusability is the number one so

77
00:03:25,519 --> 00:03:28,080
in each new project you don't want to

78
00:03:28,080 --> 00:03:30,959
define basic things like shared

79
00:03:30,959 --> 00:03:33,840
libraries or database connections

80
00:03:33,840 --> 00:03:36,720
configurations templates or

81
00:03:36,720 --> 00:03:40,080
for example setting where which logging

82
00:03:40,080 --> 00:03:41,760
server

83
00:03:41,760 --> 00:03:43,599
which logging server

84
00:03:43,599 --> 00:03:46,239
you want to use you kind of want to have

85
00:03:46,239 --> 00:03:49,599
that code easily be reused

86
00:03:49,599 --> 00:03:52,319
throughout multiple projects and the

87
00:03:52,319 --> 00:03:55,120
combination of these two both ldap and

88
00:03:55,120 --> 00:04:00,799
jdi helps facilitate that functionality

89
00:04:00,799 --> 00:04:02,159
and so

90
00:04:02,159 --> 00:04:03,760
just uh

91
00:04:03,760 --> 00:04:06,080
dive deeper into the weeds

92
00:04:06,080 --> 00:04:11,680
ldap is the number one provider for uh

93
00:04:11,680 --> 00:04:14,799
the ngmdis

94
00:04:14,799 --> 00:04:17,279
which is just um

95
00:04:17,279 --> 00:04:18,238
it

96
00:04:18,238 --> 00:04:20,880
so you've got your java application

97
00:04:20,880 --> 00:04:23,120
globally and then

98
00:04:23,120 --> 00:04:27,360
the jndi api and the naming manager and

99
00:04:27,360 --> 00:04:30,160
one of the best ways to explain the use

100
00:04:30,160 --> 00:04:32,160
case of jndi is

101
00:04:32,160 --> 00:04:33,520
dns

102
00:04:33,520 --> 00:04:34,800
so remember

103
00:04:34,800 --> 00:04:38,800
in dns you don't memorize series

104
00:04:38,800 --> 00:04:41,120
uh series of octets

105
00:04:41,120 --> 00:04:43,199
and just route to them

106
00:04:43,199 --> 00:04:45,919
manually through your browser what you

107
00:04:45,919 --> 00:04:49,120
do instead is you use a human friendly

108
00:04:49,120 --> 00:04:51,600
identifier like a hostname so it's

109
00:04:51,600 --> 00:04:53,919
defcon.org

110
00:04:53,919 --> 00:04:56,560
google.com etc

111
00:04:56,560 --> 00:04:57,919
and then

112
00:04:57,919 --> 00:05:00,560
the pr the service of dns

113
00:05:00,560 --> 00:05:01,759
routes

114
00:05:01,759 --> 00:05:05,360
the human friendly identif human

115
00:05:05,360 --> 00:05:06,960
friendly name

116
00:05:06,960 --> 00:05:09,759
to the machine readable

117
00:05:09,759 --> 00:05:13,199
and it's the same thing with jndi

118
00:05:13,199 --> 00:05:16,639
you don't always know the exact path of

119
00:05:16,639 --> 00:05:18,880
classes and objects

120
00:05:18,880 --> 00:05:22,000
within the code base

121
00:05:22,000 --> 00:05:22,800
so

122
00:05:22,800 --> 00:05:26,080
jndi is really useful for

123
00:05:26,080 --> 00:05:27,520
designating

124
00:05:27,520 --> 00:05:30,960
designating that class path

125
00:05:30,960 --> 00:05:33,600
and if you go through

126
00:05:33,600 --> 00:05:37,120
oracle documentation for java 7 and java

127
00:05:37,120 --> 00:05:39,120
8

128
00:05:39,120 --> 00:05:42,000
the ldap is just the number one provider

129
00:05:42,000 --> 00:05:44,400
here and so

130
00:05:44,400 --> 00:05:47,280
it's one of the most basic and most

131
00:05:47,280 --> 00:05:50,000
common use cases for doing something

132
00:05:50,000 --> 00:05:52,320
like that reusing the same code and

133
00:05:52,320 --> 00:05:55,759
libraries throughout the projects

134
00:05:57,440 --> 00:06:01,120
now we go on to the kill chain so

135
00:06:01,120 --> 00:06:03,600
log for in this is for log first shell

136
00:06:03,600 --> 00:06:06,639
specifically you either spin up your own

137
00:06:06,639 --> 00:06:09,680
local ldap server or you take over

138
00:06:09,680 --> 00:06:11,120
someone else's

139
00:06:11,120 --> 00:06:13,600
then you do anything within the context

140
00:06:13,600 --> 00:06:16,240
of the app that will cause it to log

141
00:06:16,240 --> 00:06:18,639
this could include

142
00:06:18,639 --> 00:06:21,440
this can include just

143
00:06:21,440 --> 00:06:24,400
modifying the body of a post request

144
00:06:24,400 --> 00:06:26,080
but most often what you'll see in the

145
00:06:26,080 --> 00:06:29,440
wild is just modifying the header a

146
00:06:29,440 --> 00:06:32,160
header that most all that almost always

147
00:06:32,160 --> 00:06:34,479
gets logged is the user agent

148
00:06:34,479 --> 00:06:38,720
and so when log for jpa went out most

149
00:06:38,720 --> 00:06:40,639
like if you wanted

150
00:06:40,639 --> 00:06:42,479
to walk around the internet and get

151
00:06:42,479 --> 00:06:44,319
random shells everywhere

152
00:06:44,319 --> 00:06:47,039
from everywhere all you had to do was

153
00:06:47,039 --> 00:06:50,400
just change the user agent to a local

154
00:06:50,400 --> 00:06:53,520
ldap server or one hosted remotely that

155
00:06:53,520 --> 00:06:56,000
you owned and bam

156
00:06:56,000 --> 00:06:58,639
you would get arbitrary connections

157
00:06:58,639 --> 00:06:59,759
so

158
00:06:59,759 --> 00:07:02,240
the la the rest of the kill chain is

159
00:07:02,240 --> 00:07:03,840
that the app will

160
00:07:03,840 --> 00:07:06,000
that are that just by including the

161
00:07:06,000 --> 00:07:07,440
payload

162
00:07:07,440 --> 00:07:09,680
because the ldap

163
00:07:09,680 --> 00:07:12,160
because the ldap server is automatically

164
00:07:12,160 --> 00:07:13,280
trusted

165
00:07:13,280 --> 00:07:15,599
uh the app will reach out to that server

166
00:07:15,599 --> 00:07:18,400
the server will send a jndi response

167
00:07:18,400 --> 00:07:21,039
including the class and then

168
00:07:21,039 --> 00:07:22,880
within that class

169
00:07:22,880 --> 00:07:25,280
you can inject into the process and get

170
00:07:25,280 --> 00:07:28,479
remote code execution from there

171
00:07:28,479 --> 00:07:30,800
yeah kill chain

172
00:07:30,800 --> 00:07:33,120
um

173
00:07:33,520 --> 00:07:35,120
so

174
00:07:35,120 --> 00:07:37,840
to facilitate this and make this a lot

175
00:07:37,840 --> 00:07:39,520
easier

176
00:07:39,520 --> 00:07:42,639
set up a home lab in minecraft

177
00:07:42,639 --> 00:07:45,520
so it is built on vagrant

178
00:07:45,520 --> 00:07:47,199
using ubuntu

179
00:07:47,199 --> 00:07:48,160
and

180
00:07:48,160 --> 00:07:52,479
because ubuntu and of course

181
00:07:52,479 --> 00:07:54,240
uh one of the most popular java

182
00:07:54,240 --> 00:07:56,800
applications out there there is a number

183
00:07:56,800 --> 00:07:58,960
of benefits on why

184
00:07:58,960 --> 00:08:01,840
this particular architecture than others

185
00:08:01,840 --> 00:08:03,280
namely

186
00:08:03,280 --> 00:08:06,080
i don't have to code java

187
00:08:06,080 --> 00:08:09,919
getting things to com i've spent

188
00:08:09,919 --> 00:08:13,440
like days and weeks of my life trying to

189
00:08:13,440 --> 00:08:15,680
get things to compile with maven and

190
00:08:15,680 --> 00:08:18,639
gradle and i don't want to do that i

191
00:08:18,639 --> 00:08:20,720
promise you i promise you i'm a

192
00:08:20,720 --> 00:08:23,120
developer it's just for this particular

193
00:08:23,120 --> 00:08:24,720
project

194
00:08:24,720 --> 00:08:27,120
i'm just going to

195
00:08:27,120 --> 00:08:31,120
use ruby and by ruby i mean just enough

196
00:08:31,120 --> 00:08:37,039
ruby to get some bash scripts in there

197
00:08:38,958 --> 00:08:42,479
a few works cited um this all of these

198
00:08:42,479 --> 00:08:45,279
exploit kits are available at github

199
00:08:45,279 --> 00:08:46,640
so

200
00:08:46,640 --> 00:08:47,920
uh

201
00:08:47,920 --> 00:08:48,720
the

202
00:08:48,720 --> 00:08:50,880
one these exploit that kit we're going

203
00:08:50,880 --> 00:08:53,839
to use is the faehon cs

204
00:08:53,839 --> 00:08:56,800
exploit that actually was taken down by

205
00:08:56,800 --> 00:08:59,760
who knows who uh but we

206
00:08:59,760 --> 00:09:02,399
but one of the benefits of that is that

207
00:09:02,399 --> 00:09:03,760
we can

208
00:09:03,760 --> 00:09:06,880
find this sketchy exploit kit through

209
00:09:06,880 --> 00:09:09,200
the wayback machine that use it within

210
00:09:09,200 --> 00:09:10,640
our vm

211
00:09:10,640 --> 00:09:13,120
there are other exploit kits for there

212
00:09:13,120 --> 00:09:16,800
are plenty of exploit kits for

213
00:09:17,680 --> 00:09:18,399
the

214
00:09:18,399 --> 00:09:20,880
log for shell vulnerability

215
00:09:20,880 --> 00:09:23,920
most of these are just hey

216
00:09:23,920 --> 00:09:26,240
they'll automate and streamline the

217
00:09:26,240 --> 00:09:29,680
process of standing up your own

218
00:09:29,680 --> 00:09:30,920
jnd

219
00:09:30,920 --> 00:09:34,000
jndi compatible ldap server

220
00:09:34,000 --> 00:09:35,640
uh shout out to

221
00:09:35,640 --> 00:09:38,959
da667 on twitter uh

222
00:09:38,959 --> 00:09:40,399
ice

223
00:09:40,399 --> 00:09:43,040
mainly for the

224
00:09:43,040 --> 00:09:45,839
minecraft version and the java version

225
00:09:45,839 --> 00:09:48,839
which is very important

226
00:09:48,839 --> 00:09:54,160
java for this project i'm using open jdk

227
00:09:54,160 --> 00:09:57,160
1.8.0

228
00:09:58,800 --> 00:09:59,680
and

229
00:09:59,680 --> 00:10:01,600
making sure that the patch level is

230
00:10:01,600 --> 00:10:03,360
before

231
00:10:03,360 --> 00:10:08,079
121 because from then onward arbitrary

232
00:10:08,079 --> 00:10:12,399
class loading is disabled by default

233
00:10:12,399 --> 00:10:14,480
so you not only have to have a

234
00:10:14,480 --> 00:10:16,000
vulnerable version

235
00:10:16,000 --> 00:10:19,360
a vulnerable java application

236
00:10:19,360 --> 00:10:20,959
you have to have

237
00:10:20,959 --> 00:10:23,360
the vulnerable java runtime

238
00:10:23,360 --> 00:10:25,680
vulnerable log4j

239
00:10:25,680 --> 00:10:29,760
and for this particular project

240
00:10:29,760 --> 00:10:31,920
m for this particular project a

241
00:10:31,920 --> 00:10:35,360
vulnerable version of minecraft because

242
00:10:35,360 --> 00:10:39,279
as mojang has discovered these things

243
00:10:39,279 --> 00:10:40,240
it

244
00:10:40,240 --> 00:10:42,320
it's gotten to the point where

245
00:10:42,320 --> 00:10:43,839
the

246
00:10:43,839 --> 00:10:45,600
basic

247
00:10:45,600 --> 00:10:48,399
date time formatting that you normally

248
00:10:48,399 --> 00:10:51,040
were able to do in within the chat which

249
00:10:51,040 --> 00:10:53,680
is the dollar sign curly bracket

250
00:10:53,680 --> 00:10:56,560
date time it's gotten to the point where

251
00:10:56,560 --> 00:10:59,279
players are no longer to execute basic

252
00:10:59,279 --> 00:11:01,839
things like that so

253
00:11:01,839 --> 00:11:03,920
moving on of course

254
00:11:03,920 --> 00:11:06,560
with every sketchy exploit kit

255
00:11:06,560 --> 00:11:08,560
use at your own risk that's why we're

256
00:11:08,560 --> 00:11:11,839
doing it new vm

257
00:11:12,000 --> 00:11:14,320
and without and without further ado

258
00:11:14,320 --> 00:11:17,440
let's get into the demo

259
00:11:23,120 --> 00:11:25,920
all right so hopping into

260
00:11:25,920 --> 00:11:27,839
the first command

261
00:11:27,839 --> 00:11:31,120
you don't really need vagrant destroy

262
00:11:31,120 --> 00:11:34,000
attack f at the beginning really all of

263
00:11:34,000 --> 00:11:35,120
this is

264
00:11:35,120 --> 00:11:38,000
was really necessary is just the vagrant

265
00:11:38,000 --> 00:11:40,399
up and the vagrant reload

266
00:11:40,399 --> 00:11:44,000
the vagrant up is to start the vm and

267
00:11:44,000 --> 00:11:45,440
the

268
00:11:45,440 --> 00:11:47,440
provisioners and get that started the

269
00:11:47,440 --> 00:11:50,480
vagrant reload is just to

270
00:11:50,480 --> 00:11:53,839
you know reboot the vm and get

271
00:11:53,839 --> 00:11:57,839
the virtual machine working

272
00:11:57,920 --> 00:12:00,800
vagrant destroy f is only needed if you

273
00:12:00,800 --> 00:12:03,440
need to blow it up and start again as i

274
00:12:03,440 --> 00:12:04,800
had to do

275
00:12:04,800 --> 00:12:06,880
many many times

276
00:12:06,880 --> 00:12:09,279
so right now

277
00:12:09,279 --> 00:12:10,880
we've got

278
00:12:10,880 --> 00:12:12,160
the

279
00:12:12,160 --> 00:12:15,440
vagrant up just loading up the gui

280
00:12:15,440 --> 00:12:17,920
and all of this of course is

281
00:12:17,920 --> 00:12:20,240
because it's a vagrant box it's listed

282
00:12:20,240 --> 00:12:21,120
in the

283
00:12:21,120 --> 00:12:24,160
vagrant file and all the provisioners

284
00:12:24,160 --> 00:12:26,959
are included within that github repo as

285
00:12:26,959 --> 00:12:29,199
well

286
00:12:29,920 --> 00:12:31,519
the first part

287
00:12:31,519 --> 00:12:35,200
is what the headli the

288
00:12:35,200 --> 00:12:37,519
gui which is just the virtual box

289
00:12:37,519 --> 00:12:39,760
provider popping up

290
00:12:39,760 --> 00:12:43,360
the when you do it at home yourself just

291
00:12:43,360 --> 00:12:45,120
don't try to

292
00:12:45,120 --> 00:12:46,480
mess with it

293
00:12:46,480 --> 00:12:48,399
or do anything the first thing that'll

294
00:12:48,399 --> 00:12:51,440
start is the tty i wanted to make this

295
00:12:51,440 --> 00:12:56,639
demo as simple as possible so i avoided

296
00:12:56,639 --> 00:12:58,639
um purposely

297
00:12:58,639 --> 00:13:00,880
made it simple enough to have the gui

298
00:13:00,880 --> 00:13:02,240
start up

299
00:13:02,240 --> 00:13:04,320
before

300
00:13:04,320 --> 00:13:06,480
you do anything because there's no sense

301
00:13:06,480 --> 00:13:10,320
in giving you a vm to just have to

302
00:13:10,320 --> 00:13:12,079
wrestle and fight with

303
00:13:12,079 --> 00:13:14,399
i wasn't too i wasn't ultimately

304
00:13:14,399 --> 00:13:17,040
successful we'll see an error message

305
00:13:17,040 --> 00:13:21,839
um that i'm still working out at the end

306
00:15:06,000 --> 00:15:08,720
the next part of that is is just

307
00:15:08,720 --> 00:15:10,560
recording the

308
00:15:10,560 --> 00:15:13,920
well downloading the minecraft x

309
00:15:13,920 --> 00:15:16,639
assets and the exploit kit as i was

310
00:15:16,639 --> 00:15:19,920
talking about before uh the

311
00:15:19,920 --> 00:15:23,040
particular script that i was using was

312
00:15:23,040 --> 00:15:25,040
from was the fey on

313
00:15:25,040 --> 00:15:27,860
cs jndi exploit

314
00:15:27,860 --> 00:15:29,279
[Music]

315
00:15:29,279 --> 00:15:31,600
and of course a lot of there's an

316
00:15:31,600 --> 00:15:33,839
elegant solution involving you know

317
00:15:33,839 --> 00:15:36,240
cloning everything and all that

318
00:15:36,240 --> 00:15:38,160
but since the repo

319
00:15:38,160 --> 00:15:42,880
was taken down just curling the

320
00:15:43,120 --> 00:15:46,480
way back archive was the best bet here

321
00:15:46,480 --> 00:15:48,160
it does seem

322
00:15:48,160 --> 00:15:51,759
the vm does appear to just you know

323
00:15:51,759 --> 00:15:54,720
stall and do nothing for a little while

324
00:15:54,720 --> 00:15:57,440
the reason for that is

325
00:15:57,440 --> 00:15:58,639
because i just

326
00:15:58,639 --> 00:16:01,279
am tired of blowing up the terminal with

327
00:16:01,279 --> 00:16:02,959
arbitrary output

328
00:16:02,959 --> 00:16:06,720
um like the app get and installs are

329
00:16:06,720 --> 00:16:08,399
already bad enough

330
00:16:08,399 --> 00:16:09,600
so what i

331
00:16:09,600 --> 00:16:12,240
so what i did is just made this part

332
00:16:12,240 --> 00:16:14,399
quiet and silent

333
00:16:14,399 --> 00:16:16,320
if you have some networking issues of

334
00:16:16,320 --> 00:16:18,000
course this all

335
00:16:18,000 --> 00:16:22,480
crashes and fades away but um for the

336
00:16:22,480 --> 00:16:25,360
most part miss is just

337
00:16:25,360 --> 00:16:28,399
getting all of the assets installing not

338
00:16:28,399 --> 00:16:29,519
only

339
00:16:29,519 --> 00:16:31,759
the exploit kit but java making sure

340
00:16:31,759 --> 00:16:33,519
that all the environment variables are

341
00:16:33,519 --> 00:16:34,320
set

342
00:16:34,320 --> 00:16:37,440
and these things are batched into stages

343
00:16:37,440 --> 00:16:39,040
for each of the

344
00:16:39,040 --> 00:16:41,839
revisioners

345
00:16:42,000 --> 00:16:45,000
onward

346
00:18:41,039 --> 00:18:44,640
and then shortly after all of

347
00:18:44,640 --> 00:18:46,240
the

348
00:18:46,240 --> 00:18:48,400
minecraft assets and the exploit kits

349
00:18:48,400 --> 00:18:49,760
are downloaded

350
00:18:49,760 --> 00:18:52,160
what we'll do is we'll just

351
00:18:52,160 --> 00:18:55,520
wait for the rest of it to install

352
00:18:55,520 --> 00:18:56,880
then

353
00:18:56,880 --> 00:18:58,960
do a full reboot

354
00:18:58,960 --> 00:19:00,799
one of the main provisioners that will

355
00:19:00,799 --> 00:19:03,760
always run is the serve

356
00:19:03,760 --> 00:19:07,200
dot s s h bash script

357
00:19:07,200 --> 00:19:10,080
all it does is set up two screens one

358
00:19:10,080 --> 00:19:13,039
will have the malicious ldap server set

359
00:19:13,039 --> 00:19:16,000
up and the other one is going to have

360
00:19:16,000 --> 00:19:18,080
the minecraft server

361
00:19:18,080 --> 00:19:20,320
set up

362
00:19:20,320 --> 00:19:22,320
so

363
00:19:22,320 --> 00:19:26,080
there is going to be a big error and

364
00:19:26,080 --> 00:19:27,120
spent

365
00:19:27,120 --> 00:19:28,400
days

366
00:19:28,400 --> 00:19:30,000
days on this

367
00:19:30,000 --> 00:19:31,679
um

368
00:19:31,679 --> 00:19:35,039
and for some reason just

369
00:19:35,039 --> 00:19:38,240
graphics and driver's issues just would

370
00:19:38,240 --> 00:19:40,160
not would got in the way

371
00:19:40,160 --> 00:19:42,400
of this build

372
00:19:42,400 --> 00:19:44,559
but the server started up everything

373
00:19:44,559 --> 00:19:46,080
else is fine

374
00:19:46,080 --> 00:19:48,960
the eula acceptance script is pretty

375
00:19:48,960 --> 00:19:50,840
easy to get

376
00:19:50,840 --> 00:19:53,919
around and you can dive all the details

377
00:19:53,919 --> 00:19:56,720
to when you see it in the repo

378
00:19:56,720 --> 00:19:59,280
right now we're just booting up the vm

379
00:19:59,280 --> 00:20:01,760
and then now that we've got a gui just

380
00:20:01,760 --> 00:20:04,159
log in with the vagrant default

381
00:20:04,159 --> 00:20:06,080
credentials

382
00:20:06,080 --> 00:20:07,039
and

383
00:20:07,039 --> 00:20:10,440
getting started

384
00:32:20,240 --> 00:32:23,840
another part of the setup is just

385
00:32:23,840 --> 00:32:25,519
now that

386
00:32:25,519 --> 00:32:27,519
migration happens

387
00:32:27,519 --> 00:32:31,039
have to have a minecraft account it's

388
00:32:31,039 --> 00:32:34,080
explicitly set aside for this

389
00:32:34,080 --> 00:32:36,320
um

390
00:32:36,480 --> 00:32:39,600
yeah just jump cut to avoid throwing the

391
00:32:39,600 --> 00:32:41,519
password out there

392
00:32:41,519 --> 00:32:43,840
let's go

393
00:32:46,080 --> 00:32:49,360
and of course just so many so many

394
00:32:49,360 --> 00:32:52,799
loading screens the

395
00:32:52,799 --> 00:32:57,039
the java version which has not showed is

396
00:32:57,039 --> 00:33:00,799
open jdk 1.8.0

397
00:33:00,799 --> 00:33:03,200
with patch level with the patch level

398
00:33:03,200 --> 00:33:05,440
before one two one

399
00:33:05,440 --> 00:33:06,960
and for

400
00:33:06,960 --> 00:33:09,760
this particular job installation of

401
00:33:09,760 --> 00:33:13,840
minecraft i really want to target

402
00:33:14,120 --> 00:33:17,279
1.12.2 it's very popular obvious

403
00:33:17,279 --> 00:33:19,120
obviously legacy

404
00:33:19,120 --> 00:33:22,159
and one of the reasons is because of the

405
00:33:22,159 --> 00:33:25,519
modding community so

406
00:33:25,519 --> 00:33:27,600
we're just going to set play

407
00:33:27,600 --> 00:33:31,519
and agree now the one error that just

408
00:33:31,519 --> 00:33:34,080
was a complete show stopper

409
00:33:34,080 --> 00:33:36,840
i don't know why

410
00:33:36,840 --> 00:33:40,559
um because i'm thinking it's the distro

411
00:33:40,559 --> 00:33:43,600
or whatever and we can get to the other

412
00:33:43,600 --> 00:33:44,960
is just

413
00:33:44,960 --> 00:33:47,440
an array index out of bounds which i

414
00:33:47,440 --> 00:33:49,519
included in the repo

415
00:33:49,519 --> 00:33:50,640
um

416
00:33:50,640 --> 00:33:53,039
i promise you i got this working

417
00:33:53,039 --> 00:33:55,279
in a previous youtube video

418
00:33:55,279 --> 00:33:57,200
and we'll just

419
00:33:57,200 --> 00:33:59,519
pull up the screenshots for those and

420
00:33:59,519 --> 00:34:02,399
discuss that instead but

421
00:34:02,399 --> 00:34:05,440
yeah after this loads up it's just array

422
00:34:05,440 --> 00:34:07,840
index out of bounds error for some

423
00:34:07,840 --> 00:34:09,520
reason it just

424
00:34:09,520 --> 00:34:11,359
cannot

425
00:34:11,359 --> 00:34:14,879
find it cannot find the primary display

426
00:34:14,879 --> 00:34:16,079
so

427
00:34:16,079 --> 00:34:18,320
graphics issue graphics and display

428
00:34:18,320 --> 00:34:21,359
driver issues is just par for the course

429
00:34:21,359 --> 00:34:25,960
for pretty much any linux distribution

430
00:34:34,079 --> 00:34:36,560
so yeah it's just

431
00:34:36,560 --> 00:34:39,440
graphics drivers issues and i by the

432
00:34:39,440 --> 00:34:42,320
time i got this recording in i did not

433
00:34:42,320 --> 00:34:44,239
have this issue resolved

434
00:34:44,239 --> 00:34:47,359
i am hoping by the time

435
00:34:47,359 --> 00:34:49,599
present this in person that the issue is

436
00:34:49,599 --> 00:34:50,960
resolved

437
00:34:50,960 --> 00:34:52,800
um

438
00:34:52,800 --> 00:34:54,480
yeah par for

439
00:34:54,480 --> 00:34:56,639
linux driver issues

440
00:34:56,639 --> 00:34:59,280
graphics driver issues so

441
00:34:59,280 --> 00:35:03,280
um alternative solutions are probably

442
00:35:03,280 --> 00:35:06,800
run this on jammy64 instead of bionic

443
00:35:06,800 --> 00:35:09,520
which is what i did in youtube

444
00:35:09,520 --> 00:35:10,320
and

445
00:35:10,320 --> 00:35:12,960
if you hold up a second

446
00:35:12,960 --> 00:35:14,240
the

447
00:35:14,240 --> 00:35:17,680
error message should pop up

448
00:35:17,680 --> 00:35:18,800
ever so

449
00:35:18,800 --> 00:35:21,119
slightly it's no point or exception and

450
00:35:21,119 --> 00:35:22,880
for some reason it's

451
00:35:22,880 --> 00:35:24,800
um

452
00:35:24,800 --> 00:35:25,599
can

453
00:35:25,599 --> 00:35:27,920
this particular install and

454
00:35:27,920 --> 00:35:31,359
configuration can't find opengl for some

455
00:35:31,359 --> 00:35:32,560
reason

456
00:35:32,560 --> 00:35:34,560
even though like my display and

457
00:35:34,560 --> 00:35:37,200
everything works fine

458
00:35:37,200 --> 00:35:39,119
i've covered up the

459
00:35:39,119 --> 00:35:41,040
with that quick pop-up for a second was

460
00:35:41,040 --> 00:35:43,040
the null plug-in exception

461
00:35:43,040 --> 00:35:46,240
and the stat full stack trace of course

462
00:35:46,240 --> 00:35:48,320
was available in github the first

463
00:35:48,320 --> 00:35:50,000
screenshot is

464
00:35:50,000 --> 00:35:52,720
the actual payload within in the context

465
00:35:52,720 --> 00:35:54,160
of minecraft

466
00:35:54,160 --> 00:35:56,960
um this is taken obviously from

467
00:35:56,960 --> 00:35:59,280
the youtube video that i did for or the

468
00:35:59,280 --> 00:36:00,640
project

469
00:36:00,640 --> 00:36:03,040
um when i recorded in

470
00:36:03,040 --> 00:36:05,119
december

471
00:36:05,119 --> 00:36:06,240
um

472
00:36:06,240 --> 00:36:07,760
and the

473
00:36:07,760 --> 00:36:10,720
ape and the ip address is just

474
00:36:10,720 --> 00:36:13,359
you know the network configuration for

475
00:36:13,359 --> 00:36:16,079
this particular virtual machine

476
00:36:16,079 --> 00:36:19,839
the base64 encoded payload is just ls is

477
00:36:19,839 --> 00:36:21,440
the ls command

478
00:36:21,440 --> 00:36:23,680
and you see on the right is the stack

479
00:36:23,680 --> 00:36:25,680
trace within the game and

480
00:36:25,680 --> 00:36:26,640
this is

481
00:36:26,640 --> 00:36:29,040
not the stack trace the server logs and

482
00:36:29,040 --> 00:36:32,720
you see like that um class name foo

483
00:36:32,720 --> 00:36:36,640
and that that's the jndi output of

484
00:36:36,640 --> 00:36:39,119
uploading the class name you can look

485
00:36:39,119 --> 00:36:41,760
into the exploit kit and you can use it

486
00:36:41,760 --> 00:36:43,920
for reverse shell other

487
00:36:43,920 --> 00:36:45,920
commands

488
00:36:45,920 --> 00:36:49,040
base64 encoded and otherwise and that's

489
00:36:49,040 --> 00:36:52,040
it

490
00:37:26,880 --> 00:37:29,440
so let's talk about the impact here

491
00:37:29,440 --> 00:37:32,160
i mean after all minecraft is isn't

492
00:37:32,160 --> 00:37:34,160
really a good scenario for

493
00:37:34,160 --> 00:37:38,240
uh simulating the enterprise impact of

494
00:37:38,240 --> 00:37:40,640
log for shell after all it is

495
00:37:40,640 --> 00:37:43,359
uh an application based on a popular

496
00:37:43,359 --> 00:37:45,760
cross platform framework

497
00:37:45,760 --> 00:37:47,839
hosted publicly

498
00:37:47,839 --> 00:37:50,960
with legacy dependencies

499
00:37:50,960 --> 00:37:53,359
a user base of hundreds if not thousands

500
00:37:53,359 --> 00:37:55,440
of users at one time

501
00:37:55,440 --> 00:37:56,560
and

502
00:37:56,560 --> 00:37:59,680
actually is n is resistant to updates it

503
00:37:59,680 --> 00:38:02,320
changes because it has a consistent

504
00:38:02,320 --> 00:38:04,560
revenue stream

505
00:38:04,560 --> 00:38:07,760
so yeah minecraft is not an is of course

506
00:38:07,760 --> 00:38:10,000
never a good example

507
00:38:10,000 --> 00:38:10,800
uh

508
00:38:10,800 --> 00:38:13,680
so what about remediation so how about

509
00:38:13,680 --> 00:38:14,800
fixing

510
00:38:14,800 --> 00:38:16,000
this

511
00:38:16,000 --> 00:38:17,760
it's easy to say just

512
00:38:17,760 --> 00:38:20,480
patch your systems that's the number one

513
00:38:20,480 --> 00:38:22,560
key thing

514
00:38:22,560 --> 00:38:26,800
use uh better you if the logging version

515
00:38:26,800 --> 00:38:29,440
of log4j is configurable

516
00:38:29,440 --> 00:38:31,520
go into the configuration settings and

517
00:38:31,520 --> 00:38:32,880
do the patch

518
00:38:32,880 --> 00:38:35,520
otherwise

519
00:38:35,520 --> 00:38:38,240
most of the apache pro projects have

520
00:38:38,240 --> 00:38:40,560
already updated it's no longer

521
00:38:40,560 --> 00:38:43,839
considered as zero day

522
00:38:43,839 --> 00:38:45,040
however

523
00:38:45,040 --> 00:38:48,400
some arbitrary application that's built

524
00:38:48,400 --> 00:38:50,240
on

525
00:38:50,240 --> 00:38:51,520
the

526
00:38:51,520 --> 00:38:54,960
apache services may not be patched

527
00:38:54,960 --> 00:38:56,800
in which case this is one of those

528
00:38:56,800 --> 00:38:59,440
things like arbitrary remote code

529
00:38:59,440 --> 00:39:02,079
execution being exploited in the wild

530
00:39:02,079 --> 00:39:04,079
this is where you this is where as

531
00:39:04,079 --> 00:39:06,000
security practitioners professionals you

532
00:39:06,000 --> 00:39:07,680
could say

533
00:39:07,680 --> 00:39:09,280
nah just

534
00:39:09,280 --> 00:39:10,320
try

535
00:39:10,320 --> 00:39:13,839
nah just change your technology

536
00:39:13,839 --> 00:39:14,880
and

537
00:39:14,880 --> 00:39:16,160
that is

538
00:39:16,160 --> 00:39:18,640
that is the best answer the best way we

539
00:39:18,640 --> 00:39:22,000
can go forward with that

540
00:39:22,880 --> 00:39:24,320
so

541
00:39:24,320 --> 00:39:27,200
there have been other patches other ways

542
00:39:27,200 --> 00:39:29,599
of trying to remediate using

543
00:39:29,599 --> 00:39:32,160
regex and all that

544
00:39:32,160 --> 00:39:33,200
um

545
00:39:33,200 --> 00:39:36,640
just really so seriously patch to one

546
00:39:36,640 --> 00:39:38,240
dot

547
00:39:38,240 --> 00:39:41,839
later passed one dot

548
00:39:41,839 --> 00:39:43,359
two dot

549
00:39:43,359 --> 00:39:44,800
one eight

550
00:39:44,800 --> 00:39:47,520
for log for j and move on

551
00:39:47,520 --> 00:39:49,520
so

552
00:39:49,520 --> 00:39:51,200
the reason why this talk is called the

553
00:39:51,200 --> 00:39:54,160
last log for j talk you never need

554
00:39:54,160 --> 00:39:56,400
rather than the last log for shell is

555
00:39:56,400 --> 00:39:58,160
because it's really easy

556
00:39:58,160 --> 00:39:59,040
when

557
00:39:59,040 --> 00:40:00,240
a

558
00:40:00,240 --> 00:40:03,040
huge vulnerability comes from a

559
00:40:03,040 --> 00:40:06,079
particular library that the library

560
00:40:06,079 --> 00:40:08,960
itself has no functionality and utility

561
00:40:08,960 --> 00:40:11,760
it's all about the number one global

562
00:40:11,760 --> 00:40:14,079
vulnerability

563
00:40:14,079 --> 00:40:15,520
that's sort of

564
00:40:15,520 --> 00:40:18,160
part of the risk with free and open and

565
00:40:18,160 --> 00:40:20,800
free and open source software

566
00:40:20,800 --> 00:40:22,480
however

567
00:40:22,480 --> 00:40:24,960
this is just yet one of those cases

568
00:40:24,960 --> 00:40:26,000
where

569
00:40:26,000 --> 00:40:27,440
a simple

570
00:40:27,440 --> 00:40:31,200
like one simple little library

571
00:40:31,200 --> 00:40:33,280
forms the backbone of digital

572
00:40:33,280 --> 00:40:36,880
infrastructure globally and worldwide

573
00:40:36,880 --> 00:40:40,319
and you may think like as

574
00:40:40,319 --> 00:40:42,240
if you're doing penetration tests and

575
00:40:42,240 --> 00:40:44,880
offensive security you'll find things

576
00:40:44,880 --> 00:40:48,240
like lack like for example jquery and

577
00:40:48,240 --> 00:40:49,440
others

578
00:40:49,440 --> 00:40:50,319
where

579
00:40:50,319 --> 00:40:52,880
it seems like instantaneous

580
00:40:52,880 --> 00:40:54,960
it blows up and these libraries are

581
00:40:54,960 --> 00:40:57,520
vulnerable it blows up your scan logs

582
00:40:57,520 --> 00:40:59,680
and servers because there's always a

583
00:40:59,680 --> 00:41:01,520
patch coming always a security patch

584
00:41:01,520 --> 00:41:04,079
coming that's not necessarily a

585
00:41:04,079 --> 00:41:07,040
vulnerability that it is actually part

586
00:41:07,040 --> 00:41:08,319
of the feature

587
00:41:08,319 --> 00:41:10,160
and so

588
00:41:10,160 --> 00:41:11,839
part of

589
00:41:11,839 --> 00:41:13,920
is not just part of a remediation

590
00:41:13,920 --> 00:41:15,680
process part of

591
00:41:15,680 --> 00:41:17,440
what makes

592
00:41:17,440 --> 00:41:18,480
what makes

593
00:41:18,480 --> 00:41:19,680
good

594
00:41:19,680 --> 00:41:21,280
security

595
00:41:21,280 --> 00:41:23,280
work in the real world

596
00:41:23,280 --> 00:41:26,800
is just having a community

597
00:41:26,800 --> 00:41:29,520
development maintaining community

598
00:41:29,520 --> 00:41:31,440
that is in line and coupled with the

599
00:41:31,440 --> 00:41:34,079
security community so that when

600
00:41:34,079 --> 00:41:36,240
something comes up

601
00:41:36,240 --> 00:41:38,800
the patch security patches are rolled

602
00:41:38,800 --> 00:41:40,079
into

603
00:41:40,079 --> 00:41:41,440
the

604
00:41:41,440 --> 00:41:43,119
rolled into the net

605
00:41:43,119 --> 00:41:44,640
the release

606
00:41:44,640 --> 00:41:46,720
pipeline

607
00:41:46,720 --> 00:41:49,920
log and the blog for j developers

608
00:41:49,920 --> 00:41:52,480
actually did their best

609
00:41:52,480 --> 00:41:53,599
um

610
00:41:53,599 --> 00:41:56,240
before it was before it was just like

611
00:41:56,240 --> 00:41:57,680
disabling

612
00:41:57,680 --> 00:42:00,319
and all of that but

613
00:42:00,319 --> 00:42:03,599
as the entire world had scrutiny on this

614
00:42:03,599 --> 00:42:08,000
one library for a period of a few weeks

615
00:42:08,000 --> 00:42:10,720
removing the function out it eventually

616
00:42:10,720 --> 00:42:14,000
got the pushback to remove the the jndi

617
00:42:14,000 --> 00:42:16,560
arbitrary jndi lookup functionality

618
00:42:16,560 --> 00:42:19,119
altogether which is

619
00:42:19,119 --> 00:42:21,440
probably which is

620
00:42:21,440 --> 00:42:25,040
i know it seems obvious it seems insane

621
00:42:25,040 --> 00:42:26,720
why would you trust

622
00:42:26,720 --> 00:42:28,560
arbitrary lookups

623
00:42:28,560 --> 00:42:30,560
remember no one

624
00:42:30,560 --> 00:42:32,640
ever it was a feature

625
00:42:32,640 --> 00:42:35,359
of the library

626
00:42:35,359 --> 00:42:38,880
pretty much until november

627
00:42:39,680 --> 00:42:41,839
so

628
00:42:42,319 --> 00:42:45,280
part of going forward a part of the

629
00:42:45,280 --> 00:42:48,560
lessons learned is

630
00:42:48,800 --> 00:42:50,480
for every

631
00:42:50,480 --> 00:42:53,760
free and open source for every library

632
00:42:53,760 --> 00:42:56,480
package find a client

633
00:42:56,480 --> 00:42:58,640
part of it is not only just its feature

634
00:42:58,640 --> 00:43:01,680
set but also looking into the community

635
00:43:01,680 --> 00:43:04,240
does it release patches security patches

636
00:43:04,240 --> 00:43:06,720
often is it well maintained and well

637
00:43:06,720 --> 00:43:07,920
funded

638
00:43:07,920 --> 00:43:10,319
is this something that you need that you

639
00:43:10,319 --> 00:43:12,880
want to be able to integrate within your

640
00:43:12,880 --> 00:43:16,400
own technology stack

641
00:43:16,720 --> 00:43:19,760
and of course these links i'm active

642
00:43:19,760 --> 00:43:22,880
pretty much in way too many places um

643
00:43:22,880 --> 00:43:24,960
it's freo scent so

644
00:43:24,960 --> 00:43:26,880
feel free to

645
00:43:26,880 --> 00:43:31,359
harass me on any of these platforms

646
00:43:31,520 --> 00:43:34,640
and my favorite part of the talk the um

647
00:43:34,640 --> 00:43:37,119
actually portion so if you have

648
00:43:37,119 --> 00:43:39,520
questions about setup

649
00:43:39,520 --> 00:43:40,960
what i did

650
00:43:40,960 --> 00:43:43,520
and also

651
00:43:44,400 --> 00:43:48,560
mistakes that i made feel free