Hello everyone. First of all, that's a lot of people. So the whiskey was needed. Welcome to my talk, the art of compromising C2 servers, a web application vulnerabilities perspective.
Although, as we might see later, there is a better title for this talk. First of all, this talk and this research is dedicated to a close friend and the father figure for me that passed away three years ago.
My friend Leonidas, who was one of the very few people together with my wife.
That enforced me and helped me to switch from becoming a developer to becoming whatever the hell I am right now.
So, thanks for that. I'm Vangelis Tsikas. I'm currently the CTO of the trust and safety startup named Tremo and an independent security researcher.
My research interests are mainly related to security.
I work mainly with APIs for IOT devices and web application security.
And I had the great idea that in my forties I should also pursue a PhD on offensive web application security.
You can follow me on Twitter or X or whatever the hell it's called right now on Evie's stickers and this is my personal website where I usually post my latest research.
The past year or so.
I have been working on an AI LLM that will generate some content aware AI attacks.
It will target logic flows and typical developer cut corners that we see throughout the years.
And it was used in this talk, as you will see it was not that necessary though.
So, the question is why go after C2s and why go after malware?
Around a year ago I was doom scrolling on Twitter when I saw Tatiana Siskova's Twitter
about Harley, a malware, an Android malware that we are going to see really deeply later
in this talk.
And I was introduced to malware as a service.
And the wonderful threat that tries to take them down.
The malware market is booming.
Malware vendors, as with anything in late capitalism this year, have switched to as
a service model.
So it means that most of them need a monthly subscription which varies from 100 to a couple
of thousand per year, per month.
And some old ones still.
On the malware development market, there is a pyramid.
On the very top, there are the developers, they are the people who develop malware and
its functionality.
They are C2.
And they can either be lone wolves or some market, some smaller companies that have switched
bad.
On composers are the ones who take most of the profits and don't advertise them on marketplaces
aggressively and reach out to new customers so that they can purchase their malware and
by is the final cut.
They are the ones who try to install the malware to the victims so that they can make profits
for them.
그러� enriched of them.
C2 d.
Q8 Q11.
market is booming right now it's not ransomware size but it's close to 2.2
billion dollars for its profits as you are going to see all the malware have
strict restrictions to never run in the Commonwealth of Independent States for
whoever don't know what it is this is Russia and vendors are part of criminal
rigs that enjoy immunity and that gets me to the actual title of my talk which
is will I get one today a little intro on malware it's it can be run on Android
Windows and Mac it can deliver via a variety of methods it tries to achieve
resistance through a number of ways it's usually heavily obfuscated and difficult
to reserve
to reverse and it connects to a C2 server for further instructions
periodically this is the part that we are going to take a deeper look into
some malware lingo that will be used in this talk first of all Stealer an
application that will try to steal all information and send it to the
command-and-control server a dropper is the typical basic program that is used
to drop other malware to the victims a subscriber is an app that subscribes the
victims phone to a number of premium services and if you don't know what the button it is
you're probably in the wrong conference or looking out the wrong video so the
typical matter when analysis what the smart reversers doing is highly
technical usually they do static analysis they are doing dynamic analysis
in sandboxes that are reversing and jumping through a lot of ships they focus on the reverse of the victims family railway and a number of premium services and if You don't know what the bot As you don't know what the bot t ne t is you're probably in the wrong conference or looking at the wrong Video, it's an application called modernise with the 41 servers to некalmar and Fürsler's, there are two images. one honest the morning analysis is what the Smart reversers doing is highly technical usually they do static analysis they are doing dynamic analysis inside boxes and there are different options to give you other properties dijacking away outside the two.
example,
raising the bar by a lot and if you are here for reversing tips I just have one
slide it's this slide I don't really understand all of those things so the
potential obstacles that the people who reverse and are really smart won't
surprise is under debugging techniques obfuscation techniques runtime function
decryption states downloads and the plethora of stuff that I don't really
understand and I don't want to understand so that's why I will
introduce you to the Toyota Corolla of penetration testing which is called web
application testing it's neither sexy nor nice but it will take you from place
a to place B and it will probably also get you a couple of million
bots in the process so malware command and control analysis it's definitely
not that technical I'm going to treat the C2 as a black box web application
test if black box fails I'm gonna cheat and use some of the communication from
the sandbox that was running the malware if all fails mail if all else
fails I will run it on my victim devices and
just
proxy through burp and last I will apply some art to it and this is all the
art that is needed to really own most of the C2s it's just a typical
dear search yeah I'm old I'm not using FFUF I'm not using their buster and
that's the typical dear search with the typical vocabulary there are a couple of
すarz � jsem
downfalls for their c2 analysis the most difficult part is that it is highly
opportunistic because they have a really small life which means that you
have only up to a couple of days to attack and find any vulnerabilities so
it needs to be automated and integrated with threatened and tools to maximize
the small window that I have and you also have to surprise that if you in the
If you are using VPSs, the bad people will also blacklist your IP addresses, so you have
to continue changing VPSs.
The thread intel that I was using is mostly Twitter thread intel.
Unfortunately this is no longer working due to mask wanting to monetize over everyone.
I am also using triage, and a really nice GitHub from a Twitter user called g7worm.
The finished product was a Python script in a loop that updated the database of all targets.
It scanned all targets for potential issues, or if it knew there was an issue, it immediately
exploited for a known vulnerability.
As I said, it's a really small time window, and if a new panel appeared, it would send
a push notification on my phone.
Spoiler alert, don't do that if you are married or put limitations on your push notifications
in the evening.
The tools that I used, as I said, my trustworthy dirsearch, burp-sweep, Zadek's decompilers
so that I could try...
I am not that good, as I said.
APK lab and Teniran as the sandboxes.
Several droplets on this so I can avoid blacklisting.
I also can find more of the panels.
And if all else fails, my cancerous Android phone that at some point was running 10 different
malware.
Going up to the methodology, it's as simple as it seems.
I acquire the C2 URL and run automated tools.
If the automated tools doesn't find anything, I run it in a sandbox and review the communication
logs.
I rerun the automated tools with added knowledge.
And if that also doesn't find anything, I fire up Burp and treat it as a penetration
test.
And, last but not least, obviously not profit, but submit a DEF CON talk so that I can talk
in front of you.
What are the goals of my research?
First, get admin access to the panel, which means I want to be the admin in the panel.
Get remote command execution on the server.
Acquire the source code of the panel and potentially the malware.
And the main thing, don't end up in a black van.
How did it go?
Seven panels I got admin access.
I got three remote command executions on servers.
I acquired the source code of five different panels.
And I still haven't ended up in a black van.
I added a slide for the not horrible mention.
First of all, it's Cloudflare.
Okay.
Cloudflare, they never took down anything.
They just enabled bad people to do bad things.
And they never respect researchers, at least to my knowledge.
Second, it's Hedgner, which never took down anyone.
They took down my VPSs because they thought that I was doing something malicious.
And all the bulletproof hosting providers for, obviously.
Okay.
For those reasons.
So enough with the fluffy words.
Anything from here on is a zero day or a taken down botnet.
So let's go.
First, it's the Harley malware, as we saw on Tatiana's tweet.
It was found by Kaspersky.
The first report was on 22nd of September of 2022.
Which means they have a birthday coming up.
They are extensively researched from Tatiana Siskova.
I'm also going to introduce you with my matter.
On the very left, it's great.
So I'm secure.
On the very left, it's vant.
So I'm not really that secure.
For Harley, I think I'm not so okay.
But I can live with that.
So Harley is a Trojan subscriber to paid services.
And I'm going to talk a little bit about that.
Two hundred apps were found in 2022 and 2023.
The realistic estimation is that over a thousand apps to this day have been developed.
And they're affecting 12 million users.
They are based on an encrypted SDK in Go and Rust.
I'm going to spoil it to you.
In a couple of slides, this is not going to be so encrypted.
Harley had an administration interface.
It's based on ZooSpring application.
I hope we don't have any Java developers in here.
If we do, I'm feeling sorry for you.
I just checked on JavaScript and saw that there was no actual backend verification.
There was only frontend verification on the login.
And once the code was 200, it was adding it was set item on season storage.
The user name.
So all I had to do was do a season storage.setitem for an admin.
And I saw the admin interface, which first of all, I hope the dog is a default one and
not someone's dog.
But this means that I don't know.
First of all, I'm the admin.
First goal met.
But as I said, we have other goals, too.
I don't know if anyone has worked with actuators, but the research found actuators.
If you haven't worked with actuators, you're going to know they're leaky bastards.
I want to introduce you to Jolokia.
Jolokia is the playground for remote command execution.
Unfortunately, the people who were behind this didn't pay for Jolokia.
So all the commercial features.
features were not enabled, which meant I had to find another way to remote command execution.
I found a way to dump the diagnostics, the virtual machine system properties, which you
see a wall of text in here. Let me get it a little bit formatted. You can see that I
acquired the secret access key and the access key for AWS and for Alibaba Cloud. Unfortunately,
this was not root access key, but it was an access key that was giving me access to
S3 buckets. And as you can see in here, this was a legitimate web application company that
was doing web applications. You can see the bucket that is really interesting in there.
It's called Jenkins, and it has a master key and credentials in there.
So I just wanted to show you that.
I just went to GitHub, found Jenkins Credential Decrypter. I decrypted all the credentials
and then I used it on that company's server that we're going to meet in a little bit.
And yeah, all the repos of the company were dumped. All malicious code was dumped. All
the command and control server code was dumped. It will be shared at the end of this talk.
I want to talk about the company behind it. It's called Star Pavilion. They're based in China,
and their main product is a payment gateway, which is also providing paid SMS services,
like the one that Harley is using. Second is Clipper, not so private messaging.
I'm going to say that this is one of the benign, probably the most benign of
applications in this talk, so I'm safe. They were reviewed by Asset. They were reversed by
the legend that is Lucas Stefanko and Petter Stricek. They're delivered as a Trojanized
WhatsApp and Telegram Messenger, and their sole purpose is to switch wallet addresses
from the one that the victim is having to the one that the attacker is controlling.
Again,
research. You can see that it found a lot of files. I don't know if anyone has worked with
Laravel. I had the privilege of being a Laravel developer for enough years, so I know a Laravel
when I see it. It's Laravel-based. The environment files are juicy files, and they are using these
files on every installation, which means that, as you can see in here, I had the app key.
App key encrypts cookies, which means that I can rebuild the cookie and login as any user.
By any user, I mean, again, I'm the admin.
But goal one. It also found a readme.md. As you can see, in readme.md, there is an integrate with your tools and the GitLab
repository in there. I checked five minutes ago. This user is still online. You can go
there and check his repositories. That repository for the C2 is unfortunately now deleted. Everything
is public. But I have it and it's going to be released in a bit. Those are all the people
that have interacted with any of the repositories. I dumped all the malware related repositories.
Unfortunately, the Android application was already compiled. It's going to be shared
on my GitHub. I'm not going to pursue any more information for them as we have bigger
fish to fry.
Okay. Let's go on the big guns. This is Amadei. If anyone knows what malware is, they know
what Amadei is. They are typically 15% of all the malware C2s on 2023. They serve a
test on October of 2018. It's a typical stealer. They're sold in Russian forums for between
$400 and $800. They're usually used as a dropper for other malware. Its source was leaked five
years ago. And today. And they have known connections to log bit TA505, TA5406, TA511.
And, like, I don't know.
I'm not exaggerating. I have just named four different APTs, so we're well within the
Vant region. I hope you understand.
What did I find? My trusted research found a stray files.zip, which was unfortunately
password protected. It was cracked in less than a day by my good friend that is sitting
there, Felipe Solferini.
I was able to find the cracking password. And unfortunately, I saw that they have a static
login and password. So I started reading the code. I found a lot of SQL injections.
And I mean a lot. But unfortunately, as you can see, the login is checking on your configuration.
And it's not...
Okay.
It's vulnerable to SQL injections.
But then again, you can see that there is really nice function which is called parse
underscore credentials. And it file put contents on a user controlled file name and user controlled
content.
Which I had to check.
There was some limitations.
The file name needs to be exactly 12 characters, including the extension. And there was a delimiter
that I couldn't have guessed. But I have the source, so I didn't need to guess.
I then tried this really nifty postman with the really interesting ID of 12345678.php.
Exactly 12 characters.
And this really nice command.
Which is echoing a word.
And then I went to credentials slash 12whatever.php.
And I saw this nice world.
So server, somebody's fucked.
That's not me.
What did I do from there on?
I developed a reverse shell.
I found an automated way of extracting everything.
Everything in less than 30 seconds from the report of all the intelligence to fully owning
the website.
I added this really sneaky cron job to corrupt the percentage of the files so that the people
wouldn't know.
Unfortunately, as of late June 2023, this is fixed.
We're going to find something though afterwards.
From December of 2022.
More than 1000 instances.
Were found and exploited.
More than 7 million devices were compromised and reported.
This is really not that nice graph, but you can see that per month how many instances
I got access to.
And how many victims I got access to.
And we're getting to the really huge guns in here.
Smoke loader.
Is.
20 to 22% of all the C2s that are being run this year.
The first record was in 2014.
They mainly target Windows.
They use it as a generic dropper for other malware.
The price for full packets is more or less $1,500.
They have no connections to Lockbit, TA-505, TA-406, TA-I don't know what.
Not ever.
All the APTs have worked at some point with smoke loader.
So yeah.
I'm not feeling that good.
But.
Dear search to the rescue again, I found a stray zip with credentials.
The really sad part is that the admin username is millionaire.
And knowing how many bots he has, he probably is a millionaire.
By exploiting those.
Sorry about that.
But after using the credentials, again, sounds really boring.
But that's it.
Really a scary picture, if you ask me.
This is 25,000 pictures.
25,000 pages of 20 PCs.
With all the information that you could have.
You can see that they have admin access on most of those PCs.
This is one of the C2s.
You can see the old bot in there.
That's half a million.
The online is 250,000.
And you can send whatever you want and run it whatever you want as an admin.
There's also the little bots and the cancel bots deletion in there.
I did not press it.
I'm going to explain later why.
I unfortunately did not manage to get RC.
The source code is available.
Minus the credentials, of course, as most of them are still active.
All the shared malware will be downloadable from Git.
What could I do with the knowledge that I had in there?
I knew the default.
I knew the zip name of the source code.
So when I upped my loop to use every minute, I could find new references in ThreadModel.
That means that one out of five of the new C2s were vulnerable once I was quick enough.
I was able to pwn 60 different instances.
Two of them had over half a million bots.
A realistic estimation is that over 10 million users.
The unique devices were compromised.
This is still open.
The vulnerability is still a zero day.
And you can see a nice graphic of how the victims went from February till now.
This is why the next one is why DEF CON hates me.
It wasn't supposed to be in here.
Because it was reported on late July, but I convinced DEF CON to accept it.
It was revealed.
It's named ManipulatedGayman.
It's revealed in heavily reversed and researched via Perception Point, which are those three
nice people on Twitter, OX Toxin, and two people that I cannot pronounce.
Sorry.
It targets mostly Mexican victims.
It's active for at least two years.
And the potential revenue is over 55 million.
I don't know.
I'm not really scared of them.
After Smoke Loader, everything seems easy to me.
The thing that Perception Point already found was that they have a Junko API that was open.
So we could dump all the info from all the victims.
That's how the 55 million were calculated.
I was mostly interested in a spamming interface that was found there, which is called C6.
And this is what you see exactly, which means they have no authentication.
So I don't know.
I didn't really need to have an admin.
Everybody's an admin just by browsing there.
But we also have other goals.
Well, the other goal was rather easy.
I have Git.
Already in there.
Deer Search found it.
I was able to download all the files.
This is where it was the at Bitbucket.
Unfortunately, it was not public, but I was able to replicate the Git from the files that
were in the Git repository on the server.
And I also found out that it was running a really huge Mexican, mostly Mexican targeted
spam list.
This is already shared with Troy Hunt on Have I Been Pwned?
And as you can see, it's a tad less than 34 million email addresses.
Due to time limitations, I was not able to get remote command execution.
The source code will be available, minus the list, obviously, because I don't want
to enable any spammers.
Next, is Nexus Panel.
Their first appearance was in 2022.
They act as an Android stealer.
They have a really sophisticated way of bypassing MFA.
They target a lot of banking applications.
They're mostly active in Turkey.
And they're inactive for the past two and a half months.
So I say I'm safe, but you never know.
Easy.
They have an SQL injection on how they submitted the files.
So it means I'm the admin.
They have a really sophisticated panel.
You could see all the info for all the users.
The SQL injection could dump the full database.
They had clear text passwords.
Unfortunately, as I said, while I was researching, they went off.
So I wasn't able to get any code or RCE.
And unfortunately, there is no panels available.
So I have to say that I didn't manage it.
That's all it goes, unfortunately.
And then it's the one that got away, Aurora.
I had a really big speech on what Aurora was and what it was supposed to be doing.
But the day before yesterday, Titan Stealer, which is basically Aurora 2, got its code
dumped.
So good for them, I guess.
Their first appearance is early 2022.
They're a Windows Stealer.
They are right in Golang.
They are capable of stealing a lot of crypto wallets.
And the panel was written in Golang.
They are off.
So I'm great.
I'm not afraid of them.
The story is that the dear search found a stray image loading advertisements.
I followed the lead.
I found the base building server handling all builds and licensing.
You could add the user.
You could create stealers.
You could do whatever you want, because they had no authentication at all.
The only thing that you needed to find was the actual URL and port that it was running.
And then this happened.
Aurora and their admins went silent.
They deleted everything.
So again, I wasn't able to finish what I wanted to.
And there comes the ethical side.
Ethical slash legal dilemmas.
I vastly dislike the word ethical hacker.
I'm an ethical person, but that has nothing to do with hacking.
I deliberately, in this research, didn't touch any machine that was not owned by criminals.
And that's the line that I wasn't happy to go over.
So all my research.
All my research took down only people who were criminals.
Criminals will get better.
The C2s will get some focus, too.
I hope some of you here, you can see how easy it is to own command and control servers.
It has nothing to do with the really, really difficult part that is reversing applications.
The bar will be raised.
And I'm expecting all this work.
I'm expecting zero days that are reported today to be fixed in the next week or so.
And this could interfere with active police investigation, but all of them were reported
six months ago, so I cannot really do anything else.
What's the next steps for me?
I will continue monitoring for new panels.
I will try to find more zero days on all the panels.
I will try to collaborate with a lot of researchers to identify and take down criminals.
And my main goal is to continue my 40 years of don't get banned strike.
I was really not expecting for so much traffic in DEF CON.
So the GitHub is live.
My blog post is going to be live later.
Okay.
Later this week when I'm hopefully back in Greece and have some time to finish it up.
So I will keep you posted.
But you can go to github.com slash tix slash DEF CON 31 and acquire all the C2 and the
malware source code that is available right now.
Thank you for attending the talk.
I think we have time for questions if anyone feels like it.
Yeah?
.
No.
I have reported to you.
I have reported to Europol, but they didn't even answer.
I also have to say that I reported to the company that was doing Harley, but they didn't
answer either.
Any other questions?
Thanks, guys.