1 00:00:08,030 --> 00:00:11,110 All right, so my name is Ken Pyle. 2 00:00:11,130 --> 00:00:15,190 I am a partner and exploit developer at a firm named Cyber. 3 00:00:15,330 --> 00:00:20,510 I do exploit development, offensive work. 4 00:00:20,710 --> 00:00:24,630 I'm a really prolific zero-day hunter. 5 00:00:25,270 --> 00:00:30,690 So this is, we do managed services, we do managed services, data security, breach response, digital forensics. 6 00:00:30,810 --> 00:00:34,990 I'm primarily, as I tell people, I live on the very red side of purple. 7 00:00:35,190 --> 00:00:36,750 Like, very red side of purple. 8 00:00:36,750 --> 00:00:38,630 I get called in and it's like, has anybody ever seen this? 9 00:00:38,630 --> 00:00:41,130 Have you ever given your view on it? 10 00:00:41,610 --> 00:00:45,150 I'm also a graduate professor of cyber security at Chestnut Hill College. 11 00:00:45,150 --> 00:00:51,730 I teach applied cryptography, advanced exploit development, cyber warfare stuff, refinement of exploits, what have you. 12 00:00:51,910 --> 00:00:53,750 I have to give you the plug because I'm here, whatever. 13 00:00:53,910 --> 00:00:55,730 But I'm going to be very clear about this. 14 00:00:56,010 --> 00:01:00,890 None of the opinions I'm expressing in this presentation are representative of either of those institutions. 15 00:01:01,330 --> 00:01:03,110 So you know where this is going. 16 00:01:03,150 --> 00:01:08,130 All right, this is actually my academic research I've been working on for a really, really long time. 17 00:01:08,570 --> 00:01:16,450 And I'm going to, as I put this presentation together, it looks very small, but I'm building up from the bottom to something really big. 18 00:01:16,450 --> 00:01:18,750 And it all starts with some very basic concepts. 19 00:01:18,750 --> 00:01:27,110 One of the things I try to tell people is, I am a really, really prolific exploiter of critical infrastructure. 20 00:01:27,430 --> 00:01:32,250 If you don't know who I am, I'm the person, if anybody heard about the emergency alert system getting hacked last year, that was me. 21 00:01:33,370 --> 00:01:39,210 The ruckus Andoriu botnet that got started earlier this year caused a big problem on the KEV, that's me. 22 00:01:40,150 --> 00:01:41,490 Some other stuff. 23 00:01:41,490 --> 00:01:47,650 And I always tell people this, I love my job, I am super passionate, I love this, I've been doing this since I was six years old. 24 00:01:47,650 --> 00:01:49,970 I was on a 2400 baud modem doing this. 25 00:01:50,350 --> 00:01:56,890 I do some really serious work, we all do some really serious work, but it is really important to not take yourself too seriously. 26 00:01:57,430 --> 00:02:05,470 So when I popped the emergency alert system, and my picture was getting broadcast all over the world, I made sure to troll goth fans with my favorite New Order CD. 27 00:02:05,590 --> 00:02:10,790 The keys to set off emergency system alerts across the United States are actually hidden behind that CD. 28 00:02:11,670 --> 00:02:21,530 But the whole point of it is, we do really serious work, and we get really tied up into it, and there's this problem we have in the industry of everybody aiming guns at each other. 29 00:02:21,550 --> 00:02:26,590 I'm an exploiter, I'm a hacker, and I have to talk to appsec people constantly. 30 00:02:26,590 --> 00:02:28,510 And it's always adversarial. 31 00:02:28,510 --> 00:02:30,330 And it doesn't need to be. 32 00:02:30,850 --> 00:02:32,690 It's also not very difficult. 33 00:02:32,690 --> 00:02:40,230 All the things I'm going to show you here are literally basic concept things that I'm sure you read in the first five pages of anything you ever read. 34 00:02:41,170 --> 00:02:55,450 So if you ask yourself a couple questions of how do I know some of these things, or how did I figure some of this out, my full confession is this, I used to be an MSP engineer, I used to be a security and network engineer, and I know because I'm sitting in a room of appsec people, 35 00:02:55,450 --> 00:02:58,590 I will tell you flat out, it's not always the network. 36 00:02:59,270 --> 00:03:01,490 But this time it kind of is. 37 00:03:02,450 --> 00:03:09,230 But it's your fundamental lack of understanding of how the network works that makes what I'm going to show you happen. 38 00:03:09,610 --> 00:03:12,810 And I want the light bulbs to start going off. 39 00:03:12,990 --> 00:03:15,670 So people ask me this, how do you find zero days? 40 00:03:16,970 --> 00:03:18,690 Break out the crayons. 41 00:03:19,170 --> 00:03:21,890 On the engineering side, we hate doing this. 42 00:03:22,090 --> 00:03:24,790 I hate having to explain myself to people. 43 00:03:25,190 --> 00:03:26,410 You have to. 44 00:03:27,090 --> 00:03:33,150 You guys got to be a little bit more cool with us on our side, and we'll be a little bit better on your side, but that's causing these problems. 45 00:03:33,250 --> 00:03:34,710 How do you find zero days? 46 00:03:34,710 --> 00:03:36,850 It's as simple as reading the effing manual. 47 00:03:37,050 --> 00:03:39,450 I tell people this all the time. 48 00:03:40,250 --> 00:03:42,610 Understand what you are actually working at. 49 00:03:42,610 --> 00:03:48,370 If you're an appsec person, your application is transmitted in some way over a network, correct? 50 00:03:48,730 --> 00:03:56,870 You should probably learn how that road works, and all the off-ramps and ways to hijack it through application security. 51 00:03:57,430 --> 00:04:00,570 I always tell people to be eternally cynical, skeptical. 52 00:04:02,350 --> 00:04:06,350 If somebody tells you they did something, double-check anyway. 53 00:04:06,670 --> 00:04:15,310 The big problem we have with supply chain management software, stuff like this, is we're all depending on the person behind us or next to us to have done their job and actually read the manual. 54 00:04:15,850 --> 00:04:17,990 Turns out, it's the complete opposite. 55 00:04:18,510 --> 00:04:19,490 Don't give up. 56 00:04:19,490 --> 00:04:31,430 If you find something new, and I'm going to show you something that's brand new, a new type of HTTP exploit I came up with, and I knew what I had, but I had to protect it because people were trying to actively not let me talk about it. 57 00:04:31,850 --> 00:04:34,490 Not just this situation, it's a bunch of... 58 00:04:34,490 --> 00:04:42,110 And sometimes you just have to, as an engineer, lower yourself to the pity of explaining the network to plebs who don't know anything. 59 00:04:42,110 --> 00:04:43,570 That's BS, man. 60 00:04:44,270 --> 00:04:51,370 As a very good friend of mine, an amazing hacker, John Vandiver, said, great hacking is just great system administration. 61 00:04:51,890 --> 00:04:53,790 That's living off the land, right? 62 00:04:53,990 --> 00:04:59,190 Living off the land is taking what the defense gives you to accomplish something you want to do. 63 00:04:59,710 --> 00:05:00,990 So I did it. 64 00:05:01,410 --> 00:05:03,110 So I'm going to break out the crayons a little bit. 65 00:05:03,110 --> 00:05:06,070 Like I said, I'm going to explain through this, and it's going to look weirdly weird. 66 00:05:06,070 --> 00:05:08,690 I'm going to snap something else on, and it's all going to click together. 67 00:05:09,510 --> 00:05:16,090 Breaking out the crayons, living off the land, finding new exploits, is all about one thing. 68 00:05:16,450 --> 00:05:24,070 What is the difference between the way you intended this application to be working and how it's actually designed? 69 00:05:24,750 --> 00:05:25,610 Right? 70 00:05:25,610 --> 00:05:30,170 I intended for this application to provide a login. 71 00:05:30,390 --> 00:05:35,210 As designed, it allows you to inject things into the login page and obtain access, right? 72 00:05:35,210 --> 00:05:36,790 That's how it works. 73 00:05:37,770 --> 00:05:51,530 Going back to that, sanitization of input, if I can tell one other thing to application developers, is that sanitization of input needs to happen on both sides, and any time information comes in and leaves. 74 00:05:51,850 --> 00:05:57,230 And there is more implication from that other than an API call or an HTTP request. 75 00:05:58,090 --> 00:06:02,910 And now this is what I'm saying, it's kind of about the network, but it's a fundamental lack of understanding. 76 00:06:03,030 --> 00:06:05,870 The lack of understanding of the OSI model. 77 00:06:06,770 --> 00:06:14,670 And trust me, there is no greater abuse in technology than the first hundred pages of every book you've ever read that explains the OSI model for the 900th time. 78 00:06:14,850 --> 00:06:15,530 Right? 79 00:06:15,630 --> 00:06:20,450 But it's actually important, and you should actually learn it, because I'm old. 80 00:06:20,450 --> 00:06:24,590 I feel like I'm coming back from the future to warn everybody about something that happened. 81 00:06:24,950 --> 00:06:30,410 I'm old, and some of the tricks I'm using are things that I've been using for 30 years. 82 00:06:31,450 --> 00:06:32,730 Because what happened? 83 00:06:32,730 --> 00:06:42,790 They were known about, nobody fixed them, it's like the last person standing in the room and everybody forgot that old knowledge, and when I wonder why that, it's just forgotten, it goes into the ether. 84 00:06:43,310 --> 00:06:48,270 And the last thing I tell people is sometimes you actually need to write the manual to explain it to people. 85 00:06:49,230 --> 00:06:51,410 So, here's the story. 86 00:06:51,410 --> 00:06:54,390 I'll give you the background story, how it got to this, and how it snaps together. 87 00:06:54,790 --> 00:07:01,130 So, ConnectWise Control and their applications are set for MSPs and large organizations to do endpoint management. 88 00:07:01,790 --> 00:07:02,190 Right ? 89 00:07:02,330 --> 00:07:10,190 You've had some version, Kaseya, ConnectWise, there's all these different things that allow MSPs or large corporations to manage all their endpoints, jump in, yada, yada, yada. 90 00:07:10,670 --> 00:07:14,610 I began disclosing my work in October 22 to them. 91 00:07:15,850 --> 00:07:22,350 After disclosing it and being responsible, they started saying it was minimally impactful, but they still patched it. 92 00:07:23,850 --> 00:07:30,510 In addition to that, several IR firms, because a lot of people in that side of the world know me and came out to me and said, I heard you're on some hot stuff, can you tell me? 93 00:07:30,890 --> 00:07:38,750 I shared it and I always said, like, as I always say, I'll share what I know, just do me a favor, don't share it with anybody, keep it quiet until I talk about it. 94 00:07:38,770 --> 00:07:42,430 Because it's not a fame thing, this is actually a pretty big deal. 95 00:07:43,530 --> 00:07:52,930 After attempting this and being called overblown, ridiculous, whatever else, it's not a big deal, and after all the patching, I finally just said, I'm done with this. 96 00:07:53,150 --> 00:07:56,310 I'm going to MITRE and I'm just gonna ask for the CVEs. 97 00:07:56,490 --> 00:08:02,430 So after being called overblown, this wasn't a big deal, my CVEs were classified as a 9.8. 98 00:08:04,250 --> 00:08:22,750 Not only that, on December 1st, Krebs posted an article about it, how I publish a blog post around my findings, and coincidentally, ConnectWise released an advisory warning about phishing campaigns, client-side exploitation, and all these other things that bear a lot of similarities to what I did. 99 00:08:25,450 --> 00:08:32,070 I'm not here to talk about that, but I'll say this, all you really needed to do all of this is sitting there on the right-hand corner, I just never explained it to anybody. 100 00:08:32,550 --> 00:08:37,730 Because it was like, if this is the game that's gonna get played, I'm just gonna go talk about it and that's the end of it. 101 00:08:38,310 --> 00:08:47,110 Going a little further, a third-party company who did some analysis of this, posted a public analysis and comment on my work stating it wasn't a big deal. 102 00:08:47,150 --> 00:08:54,110 And I'm not here to talk about them, it's not the story about them, but I will say, there are a number of potential emissions and issues in this analysis. 103 00:08:54,770 --> 00:08:58,450 So instead of going in a fight with them, I checked their homework. 104 00:08:59,710 --> 00:09:02,190 So, there's your CVEs. 105 00:09:02,190 --> 00:09:07,330 One of the things I'll tell you is that analysis does not ever mention that those things are actually a little ridiculous. 106 00:09:07,330 --> 00:09:09,630 But, let's talk with it. 107 00:09:09,630 --> 00:09:11,730 How does living off the land start? 108 00:09:11,810 --> 00:09:14,070 It starts with understanding how things work. 109 00:09:14,590 --> 00:09:23,450 In the top left corner is basically your average, hey, this is a switching network with a router and firewall, bottom's the OSI model, the top right, I'm gonna explain it to you in a minute. 110 00:09:24,650 --> 00:09:28,150 But, living off the land is basically this. 111 00:09:28,470 --> 00:09:29,390 And you can read it. 112 00:09:29,390 --> 00:09:43,930 Taking advantage of things like, abusing PowerShell, Visual Basic, WMI, PS Exec, Mimikatz, all of these things that are allowed, exploits the functionality of a system to hijack it for nefarious purposes. 113 00:09:44,310 --> 00:09:46,130 That's living off the land. 114 00:09:46,610 --> 00:09:48,910 Abusing something you're given to do it. 115 00:09:49,570 --> 00:09:55,830 It may include tactics like DLL hijacking, hiding payloads, process dumping, downloading files, all these other things. 116 00:09:55,830 --> 00:09:58,470 Code execution, persistence, log evasion. 117 00:09:59,530 --> 00:10:04,410 These are all hallmarks of mega super APT groups, right? 118 00:10:04,750 --> 00:10:07,350 Like, oh, they do live off the land, they're gonna be detected. 119 00:10:07,350 --> 00:10:08,950 No, it's just knowing how a computer works. 120 00:10:08,950 --> 00:10:13,590 Nobody on my side of the house wants to tell you it's really as simple as knowing how to launch a command shell. 121 00:10:14,550 --> 00:10:30,390 So, after all of this and everything else, my work was repeatedly acknowledged as defeating controls, internally reproducible, sharing traits with APT groups, I directly disclosed it prior to any public notification by them, and it's being actively exploited. 122 00:10:31,890 --> 00:10:33,270 Keep that in mind. 123 00:10:33,750 --> 00:10:39,670 So why don't you ask yourself this, if I'm gonna build a botnet, what are the things that I really want? 124 00:10:40,270 --> 00:10:52,450 So, on the left-hand side, I want a port scanner, C2 beaconing, tunneling, arbitrary request handler, amazing hosting that doesn't go down, code signing, trusted execution, exfiltration, implantation, client-side exploitation. 125 00:10:52,610 --> 00:10:56,230 For me, that's a fully functioning botnet with all the tooling I need. 126 00:10:56,710 --> 00:10:58,750 On the right-hand side, what would I love to have? 127 00:10:58,750 --> 00:11:03,870 I'd love to be able to bypass everybody's firewall rules, something has no monitoring, poor user habits. 128 00:11:03,870 --> 00:11:09,770 I would love to get access to somebody else's trusted SSL and code signing certificates to sign my malware with. 129 00:11:10,390 --> 00:11:16,310 I want to drop catch domains, so I can catch people when their instances expire and I can phish them. 130 00:11:16,550 --> 00:11:25,850 I want to be able to send my phishing emails to a trusted SMTP source, like their hosted cloud instance that enables you to do all of that through a hosted solution. 131 00:11:26,950 --> 00:11:31,290 And this is the thing to think about, HTTP API protocol fuzzing. 132 00:11:31,470 --> 00:11:36,670 I'll show you how that works, but think about this in the context of your applications. 133 00:11:37,450 --> 00:11:44,890 With abusing a little trick with server-side request forgery, I have a really amazing little thing to show you. 134 00:11:44,890 --> 00:11:46,690 I want to bypass eight controls. 135 00:11:46,690 --> 00:11:49,470 This bypasses AV and EDR controls. 136 00:11:49,470 --> 00:11:50,670 I know it does. 137 00:11:51,390 --> 00:12:01,390 Even better, if all of this can be free to you, instead of spending thousands of dollars on hosting, and I really am after is getting code past everything. 138 00:12:01,390 --> 00:12:04,290 There's all those controls in place that make things stop happening. 139 00:12:04,510 --> 00:12:06,810 Now, what's perfect for that? 140 00:12:06,950 --> 00:12:08,250 RMM software. 141 00:12:08,670 --> 00:12:15,010 And I'm not picking on ConnectWise, because you can go look at my critical CVEs on all kinds of MSP software. 142 00:12:15,190 --> 00:12:17,170 Because say it happened in 2020, right? 143 00:12:17,590 --> 00:12:21,970 2019, I alerted them to a very similar kind of issue and said, you've got to fix this. 144 00:12:22,150 --> 00:12:22,750 Why? 145 00:12:22,750 --> 00:12:24,710 Why do I go after this piece of software? 146 00:12:24,710 --> 00:12:26,050 It's poorly managed. 147 00:12:26,330 --> 00:12:29,270 People disable controls to make this work. 148 00:12:29,270 --> 00:12:32,430 And I'm going to show you a specific example for every one of these points. 149 00:12:32,570 --> 00:12:35,110 It provides system access in Windows. 150 00:12:35,550 --> 00:12:36,810 So I'm the colonel, right? 151 00:12:36,890 --> 00:12:37,790 Normal looking. 152 00:12:37,790 --> 00:12:46,050 So if I want to phish people, and I figure out who your MSP is, or your company is, I can just make it look like it came from them. 153 00:12:46,430 --> 00:12:47,510 Gives me access to everything. 154 00:12:47,510 --> 00:12:48,850 And here's the important part. 155 00:12:49,010 --> 00:12:56,250 I can either maintain persistence, or I can make it temporary and leave very few, if any, forensic IOCs. 156 00:12:56,490 --> 00:12:57,730 That's what I go after. 157 00:12:57,730 --> 00:12:59,250 I want to be not detected. 158 00:12:59,250 --> 00:13:02,730 And again, all of this is free. 159 00:13:03,330 --> 00:13:08,070 You don't need a dollar to your name to set all of this up. 160 00:13:09,750 --> 00:13:12,470 Now, let's talk about this. 161 00:13:13,550 --> 00:13:14,510 Many people... 162 00:13:14,510 --> 00:13:15,770 and this is... 163 00:13:15,770 --> 00:13:16,550 I'm talking about specific... 164 00:13:16,550 --> 00:13:19,670 but you've got to think about this in the context of your application, how you're designing things. 165 00:13:19,810 --> 00:13:27,650 People disable security controls because software is either over-designed, or there's deployment complexities. 166 00:13:27,650 --> 00:13:33,490 And what people try to do, which we all do, is design so it works absolutely everywhere, no matter the infrastructure. 167 00:13:33,970 --> 00:13:37,930 What you're looking at here is on the left-hand side, and I'll read it so you can't see it. 168 00:13:37,930 --> 00:13:42,090 It's a posting from a Zscaler forum, the support forum. 169 00:13:42,830 --> 00:13:46,250 I'm having problem with connectwise connecting to a direct IP. 170 00:13:46,250 --> 00:13:51,690 At the bottom there it says, oh, the way we fixed this was on our SSL inspection. 171 00:13:51,970 --> 00:13:59,530 We accepted and allowed asterisk.screenconnect.com but we should have used screenconnect.com. 172 00:14:00,070 --> 00:14:02,890 So, think about it this way. 173 00:14:02,890 --> 00:14:22,130 If you asterisk the domain name for disabling security controls, as long as I have a subdomain existing in there and resolving what has just happened, you have disabled all inspection of SSL for anything coming from there. 174 00:14:22,590 --> 00:14:24,190 That's really important. 175 00:14:24,330 --> 00:14:31,650 On the right-hand side, you have another one where it says, I'm having an oddball issue with screenconnect where the agent can't connect back to screenconnect so it just keeps retrying. 176 00:14:31,870 --> 00:14:35,550 If I disable, decrypt, and scan, it'll just work fine. 177 00:14:35,670 --> 00:14:39,390 I've whitelisted screenconnect.com including all domain names. 178 00:14:39,570 --> 00:14:43,830 And the bottom one is a moderator saying, please show a picture of the edit of this configuration. 179 00:14:46,720 --> 00:14:48,180 Starting to get it now? 180 00:14:49,060 --> 00:14:57,940 So, even further, there is really poor management of their cloud instances of registering FQDNs. 181 00:14:57,940 --> 00:15:09,160 What you're looking at is some company that I dug out of security trails that has a screenconnect.com subdomain for their old instance except it was retired for a year. 182 00:15:10,020 --> 00:15:19,340 I did some OSINT, I went out, I registered their domain to me, started a connectwise instance, and I now own their FQDN for it. 183 00:15:19,340 --> 00:15:29,340 So if you didn't go back and disable all of those changes that you made to your security controls for any of this, what have I just done? 184 00:15:30,440 --> 00:15:31,600 Right through. 185 00:15:32,140 --> 00:15:33,600 And I prove it. 186 00:15:33,900 --> 00:15:46,380 Further complicating this fact is that every single cloud instance, even trials, that you get, issues the same wildcard SSL certificate to absolutely every instance. 187 00:15:47,500 --> 00:15:49,800 Anybody do cryptography like me? 188 00:15:50,300 --> 00:15:53,440 What is the first rule of public-key cryptography? 189 00:15:53,700 --> 00:15:57,420 Control of the key and registration and knowing it. 190 00:15:57,420 --> 00:15:59,220 So this is a really good cert. 191 00:15:59,220 --> 00:16:00,800 It's a high-grade cert. 192 00:16:01,000 --> 00:16:11,360 So anybody, whether you're a corporate customer paying millions of dollars or whatever , or some idiot like me with some free time in a basement, I can go get the same SSL certificate for you. 193 00:16:11,360 --> 00:16:13,900 And remember, everybody's keying on the wildcard. 194 00:16:15,880 --> 00:16:18,540 And they don't inspect SSL either, do they? 195 00:16:19,060 --> 00:16:20,340 Awesome. 196 00:16:20,740 --> 00:16:24,500 So, there's another certificate that exists in all of this. 197 00:16:24,500 --> 00:16:26,000 A code-signing certificate. 198 00:16:26,000 --> 00:16:31,580 When you download their agent for installing these things, it's signed. 199 00:16:31,720 --> 00:16:33,960 But it's a click -once installer. 200 00:16:34,000 --> 00:16:41,440 And there is a small little space in here in which the code-signing certificate doesn't apply. 201 00:16:41,440 --> 00:16:46,700 It's an unregulated space in a signed executable. 202 00:16:46,700 --> 00:16:48,040 You're all AppSec people. 203 00:16:48,040 --> 00:16:50,180 Is that something you're supposed to do? 204 00:16:50,900 --> 00:16:53,820 How much is that cert now worth? 205 00:16:53,960 --> 00:16:55,520 Zero dollars. 206 00:16:56,300 --> 00:16:57,300 It's worth it. 207 00:16:57,300 --> 00:16:58,660 It doesn't do anything. 208 00:16:58,720 --> 00:17:03,660 I can go in there and edit that space and it won't break the certificate. 209 00:17:03,660 --> 00:17:06,740 So how are the two ways that EDR and AV work? 210 00:17:07,560 --> 00:17:10,680 Hash-banning and code-signing. 211 00:17:10,680 --> 00:17:15,700 By changing this space and injecting whatever I want in here, it changes the hash of the file. 212 00:17:15,700 --> 00:17:18,180 And that changes every time you start a session. 213 00:17:18,180 --> 00:17:20,080 So you can't hash-ban it. 214 00:17:20,080 --> 00:17:28,540 The only other trust control you can anchor this on, other than watching behavior, is a code -signing certificate that doesn't actually do anything. 215 00:17:29,760 --> 00:17:32,760 See how this is all starting to snowball a little bit? 216 00:17:33,940 --> 00:17:49,100 To make matters worse, the download of that signed executable that gives you system access, all these other things, or whatever, is transmitted via HTTP, which is plain text. 217 00:17:49,480 --> 00:18:04,460 So, by transmitting a weakly -signed, can't-hash-ban it executable over a network via plain text, I can essentially , without any social engineering or interaction, back door that thing when people are downloading. 218 00:18:08,190 --> 00:18:15,810 Not only that , you can man-in-the-middle-it, proxy it, or just directly edit the file and download it from anybody's public instance. 219 00:18:16,110 --> 00:18:17,610 Top right, left corner. 220 00:18:17,610 --> 00:18:28,310 This thing executed that malformed HTTP request to that IP address via that signed client that I manually edited and man-in-the-middle-ed and it worked. 221 00:18:28,450 --> 00:18:37,290 It executed an arbitrary HTTP request to a host of my designation inside of a signed executable. 222 00:18:37,910 --> 00:18:38,970 Checkmate, right? 223 00:18:40,070 --> 00:18:42,430 That's the first 10 seconds of this. 224 00:18:42,970 --> 00:18:45,690 Because all of these things violate the CIA triad. 225 00:18:46,290 --> 00:18:47,530 There's no integrity. 226 00:18:47,870 --> 00:18:49,830 You can use this to do some availability problems. 227 00:18:49,830 --> 00:18:53,130 It's in the CV, and it's definitely not maintaining cryptographic controls. 228 00:18:53,130 --> 00:18:57,610 So, I'm going to rewind a little bit and go back to third-party analysis. 229 00:18:58,090 --> 00:18:59,490 And I want to read this to you. 230 00:18:59,870 --> 00:19:05,770 Third-party companies are giving out some pretty flawed advice, and I don't think maybe they understand exactly how the AppSec or product works. 231 00:19:05,770 --> 00:19:11,730 I'm going to read you an analysis they had on another case to you, and I want you to put this together in your head. 232 00:19:12,050 --> 00:19:20,210 This simply means that hackers could register for trials of control and potentially serve malicious JavaScript from an asterisk.screenconnect.com domain. 233 00:19:20,550 --> 00:19:25,910 Theoretically, this could be a building block for other attack chains, but it's not worth losing sleep over. 234 00:19:27,410 --> 00:19:44,910 Because this happens, and they're wild-carding, control of any server in their cloud domain FQDN DNS zone, whether inflected or injected, will allow you to perform client-side exploitation and bypass browser controls. 235 00:19:44,910 --> 00:19:45,810 Why? 236 00:19:45,810 --> 00:19:52,090 We are allowing script access from asterisk.screenconnect.com. 237 00:19:52,090 --> 00:19:53,430 Right? 238 00:19:53,610 --> 00:19:55,210 It's not a theory. 239 00:19:55,210 --> 00:19:58,850 In fact, I'm giving you only one weaponized example of this. 240 00:19:58,850 --> 00:20:03,850 As long as you can figure out how to get something on that, it goes nuclear. 241 00:20:04,110 --> 00:20:06,290 Now, think about this in an AppSec perspective. 242 00:20:06,290 --> 00:20:13,230 I'm downloading an executable file, an agent, that doesn't have any effective framing mitigations. 243 00:20:13,450 --> 00:20:15,350 Does anybody know what that does? 244 00:20:15,470 --> 00:20:20,070 Download a file via a frame, and it's a no-click downloader. 245 00:20:20,070 --> 00:20:23,710 It will just download it because it's injected in a frame. 246 00:20:23,730 --> 00:20:39,050 So, if I can come up with a malicious agent, put it in another instance, and find a web page that I can inject content into, I can now install without a click an agent on anybody's computer. 247 00:20:39,930 --> 00:20:42,690 Which gives you access to everything. 248 00:20:44,070 --> 00:20:47,610 Now that you have this, you're probably asking yourself, how do I weaponize this? 249 00:20:47,610 --> 00:20:48,950 How do you live off the land? 250 00:20:49,370 --> 00:20:52,330 Well, living off the land is understanding how things work, right? 251 00:20:52,690 --> 00:20:57,950 So, why not just make it an unauthenticated, signed exploit factory and delivery method? 252 00:20:57,950 --> 00:21:09,250 It's a signed Windows executable that you can't hashband, that's always excluded, but not only that, it works across multiple operating systems, signed or unsigned. 253 00:21:09,250 --> 00:21:14,230 It executes arbitrary requests and other things that I'm not talking about to targeted endpoints. 254 00:21:14,890 --> 00:21:23,030 Because it's a network thing that goes back to a DNS name or an IP address, it resolves it and creates requests from it. 255 00:21:23,210 --> 00:21:32,350 It's an arbitrary HTTP or command executing application that's signed with somebody's legitimate sign, sir. 256 00:21:32,350 --> 00:21:34,630 Now, here's where it gets crazy. 257 00:21:34,890 --> 00:21:37,970 You already know about this, but look at the top right corner. 258 00:21:37,970 --> 00:21:47,350 As long as I have a cloud instance, an on -premise instance, I can sign executables with their code signing certificate. 259 00:21:47,450 --> 00:21:53,930 Even an unlicensed on -premise version of it that has a trial that was never licensed. 260 00:21:53,930 --> 00:21:55,490 Hint, hint. 261 00:21:56,950 --> 00:21:58,210 It works. 262 00:21:58,610 --> 00:22:00,530 So here's a signed exploit factory. 263 00:22:00,530 --> 00:22:02,690 I'm the guy who came up with the Endorubot one. 264 00:22:02,710 --> 00:22:05,270 I'm the one who came up with the Cisco Dell one that became a big problem. 265 00:22:05,550 --> 00:22:10,710 Why do I make every one of my exploits that are web-based, I try to get them to get requests. 266 00:22:10,850 --> 00:22:13,050 Because they're client deliverable. 267 00:22:13,170 --> 00:22:14,450 They're not posts. 268 00:22:14,450 --> 00:22:17,090 I just have to craft a good URL. 269 00:22:17,910 --> 00:22:36,050 So what you can do is embed my exploits, which give you remote code execution, complete control of network infrastructure, by bouncing it out of an executable, somebody downloads it, and because they're inside somebody's firewall, it will execute that to wherever I want. 270 00:22:36,050 --> 00:22:38,130 That's how you bypass a firewall. 271 00:22:38,790 --> 00:22:45,590 If you don't believe me and you want to test this out for yourselves, and that you can actually inject this, here's the exploit. 272 00:22:45,650 --> 00:22:54,690 This will compromise Cisco, Dell, Netgear, D-Link, Linksys, there's a whole slew of switches that have this. 273 00:22:54,930 --> 00:23:05,110 And it really is as simple as pointing to the right IP address, feeding it about 1,200 characters, and then putting a certain character in there, and it reboots the switch. 274 00:23:05,810 --> 00:23:08,510 Which stops all of your applications from working. 275 00:23:08,870 --> 00:23:12,850 But why would I give you that exploit as part of that? 276 00:23:13,210 --> 00:23:16,270 Because remember how I said you can man in the middle of the download? 277 00:23:16,330 --> 00:23:17,990 What do you need to do that? 278 00:23:17,990 --> 00:23:21,650 To roomful AppSec people, and they don't know this, this is important. 279 00:23:21,650 --> 00:23:24,490 What happens in the first 15 seconds you reboot a switch? 280 00:23:25,910 --> 00:23:27,710 ARP table flushes. 281 00:23:28,350 --> 00:23:30,530 What do you need to do man in the middle? 282 00:23:30,590 --> 00:23:32,430 Control of ARP and Mac. 283 00:23:32,750 --> 00:23:42,850 So if you want to test out man in the middle in the download, get a switch, send it that exploit, and do this, and you can completely recreate my work in about 10 seconds. 284 00:23:43,110 --> 00:23:44,010 Don't believe me? 285 00:23:44,010 --> 00:23:46,490 That's the default IP address for those switches. 286 00:23:46,490 --> 00:23:54,410 So what I do is I control external domains with internally resolvable IP addresses, like the default IP addresses for everybody's switch, or most of them. 287 00:23:54,730 --> 00:23:57,970 Spray them out, and eventually you're going to get a hit. 288 00:23:59,510 --> 00:24:03,330 Even more to the point, I'm not just talking about Windows executables, and this is important. 289 00:24:03,330 --> 00:24:05,370 I did a lot of work on this, nobody read it. 290 00:24:05,450 --> 00:24:09,250 I'm one of the leading exploiters of a format called JNLP, Java Network Launch Protocol. 291 00:24:09,490 --> 00:24:13,710 It actually launches Java and works across any operating system that has Java in it. 292 00:24:13,810 --> 00:24:18,210 So this injection problem doesn't just exist in the Windows executable. 293 00:24:18,270 --> 00:24:31,030 Every kind of agent, EXE, DBN, Windows, Linux, they all suffer from this problem where you can inject into space like this to get it to do these things. 294 00:24:31,030 --> 00:24:33,930 All this is, is a downloader. 295 00:24:34,010 --> 00:24:35,670 Like a click once installer. 296 00:24:35,670 --> 00:24:41,090 It just goes out and retrieves something, but I have control of what it retrieves. 297 00:24:41,450 --> 00:24:47,030 So, now that you have all that, how do you actually exploit this in a meaningful way? 298 00:24:48,370 --> 00:24:53,990 What if I did have a way to theoretically inject things into ScreenConnect.com's domain without them ever knowing? 299 00:24:56,150 --> 00:24:58,750 So put that aside for a second and look at this. 300 00:24:59,270 --> 00:25:02,770 You have this malicious code factory, how do I start delivering it? 301 00:25:02,770 --> 00:25:04,710 And remember all those tools I told you I built out? 302 00:25:04,710 --> 00:25:05,790 How do I do it? 303 00:25:05,970 --> 00:25:07,330 So here's my moment. 304 00:25:08,070 --> 00:25:16,490 For the past year, I have been routing, abusing, using the ConnectWise cloud service under their noses. 305 00:25:16,910 --> 00:25:35,270 After informing them of this, and I've been collecting POC for C2 beaconing, bypassing firewall rules, tunneling malicious files, creating a giant DDOS cannon, botnet creation, client-side exploitation, port scanning and API access to external and internal hosts at ConnectWise. 306 00:25:36,070 --> 00:25:42,350 Arbitrary HTTP requests on arbitrary ports and exfiltration and implantation of malicious code. 307 00:25:42,530 --> 00:25:43,790 How did I do it? 308 00:25:44,030 --> 00:25:48,490 Because of one web page and how that software works. 309 00:25:48,570 --> 00:25:49,370 Why? 310 00:25:49,570 --> 00:25:53,010 Because software developers don't know how a network works. 311 00:25:53,310 --> 00:25:58,070 I'm going to explain it, it's going to look all complex but I did it a really simple way here. 312 00:25:58,130 --> 00:26:01,470 All you really need are three GET requests. 313 00:26:01,930 --> 00:26:08,870 If you look at this, the top one is how I made it into a port scanner and an arbitrary HTTP and API fuzzer. 314 00:26:08,870 --> 00:26:14,850 The second one is a content brooder you can use like Durabuster to scan people's things. 315 00:26:14,970 --> 00:26:20,370 And the last one is a client-side exploitation method of something I'm going to show you that I've never showed anybody before. 316 00:26:20,890 --> 00:26:25,910 Or you can just go to my GitHub and I'll give you the Python scripts. 317 00:26:26,110 --> 00:26:30,090 As you'll see, none of this requires anything other than a knowledge of the things on the left-hand side. 318 00:26:30,090 --> 00:26:31,990 Doesn't require a credit card. 319 00:26:31,990 --> 00:26:35,510 Actually, I host all of my stuff in ScreenConnect's own cloud. 320 00:26:35,510 --> 00:26:41,970 I registered for a trial instance anonymously and I've been hosting it for a long time. 321 00:26:43,090 --> 00:26:46,750 I'm hosting everything out of Amazon EC2 for free. 322 00:26:47,550 --> 00:26:49,270 And I'm going to give you the free Python scripts. 323 00:26:49,270 --> 00:26:51,330 In fact, if you take pictures, I have them all up here for you. 324 00:26:51,690 --> 00:26:53,430 So it starts with this web page. 325 00:26:55,430 --> 00:26:56,090 Oh. 326 00:26:58,470 --> 00:26:59,870 My battery's getting cut out. 327 00:26:59,870 --> 00:27:00,570 Hold on. 328 00:27:07,560 --> 00:27:08,320 Ah, there we go. 329 00:27:08,320 --> 00:27:09,200 Okay, sorry. 330 00:27:09,200 --> 00:27:10,760 My battery was going out. 331 00:27:10,960 --> 00:27:12,420 This page. 332 00:27:12,680 --> 00:27:14,960 How do you live off the land with ScreenConnect? 333 00:27:15,060 --> 00:27:19,760 If you go to that web page right now, I'm pretty sure it's still up. 334 00:27:20,980 --> 00:27:22,080 What is this page? 335 00:27:22,080 --> 00:27:25,840 Remember the difference between intended and as designed? 336 00:27:26,420 --> 00:27:27,480 So this is the intended design. 337 00:27:27,480 --> 00:27:31,500 Use our port test tool to determine the external accessibility of your ScreenConnect instance. 338 00:27:31,500 --> 00:27:36,720 If you have changed ports or are hosting at a different IP or host name, you'll need to change those values accordingly. 339 00:27:36,720 --> 00:27:39,080 So ask yourself this. 340 00:27:39,280 --> 00:27:41,860 What happens when I submit this post request? 341 00:27:42,320 --> 00:27:45,360 I control the DNS record, I control the port. 342 00:27:45,880 --> 00:27:47,700 The answer is this. 343 00:27:47,800 --> 00:27:56,560 I can control the port the request goes to, the host it goes to, and it's not coming from my IP address. 344 00:27:57,040 --> 00:27:59,460 It's a server-side request forgery. 345 00:27:59,460 --> 00:28:02,820 If you look it up, it's coming from their IP address. 346 00:28:03,680 --> 00:28:07,440 And I'm doing this over an anonymous VPN. 347 00:28:07,600 --> 00:28:09,520 So think about what's happening. 348 00:28:09,900 --> 00:28:15,760 When I submit this request, the server receives this request from me, get or post. 349 00:28:15,760 --> 00:28:23,540 The server at 52.202.11.141 processes that record and performs three to five DNS requests. 350 00:28:24,400 --> 00:28:33,460 It then creates a new HTTP request to the user control port and it's coming from the targeted IP address. 351 00:28:33,460 --> 00:28:42,840 So if you have a firewall that says asterisk.screenconnect.com you have whitelisted everything coming out of this. 352 00:28:43,780 --> 00:28:44,860 Make sense? 353 00:28:44,860 --> 00:28:45,720 Follow me so far? 354 00:28:45,720 --> 00:28:46,420 Alright. 355 00:28:46,800 --> 00:28:49,080 The page then returns a status of this. 356 00:28:49,080 --> 00:28:51,200 So the web server one, it just says succeeded. 357 00:28:51,640 --> 00:28:54,800 So if it connected, it got a 200 code it says succeeded. 358 00:28:55,100 --> 00:28:57,180 It's a blind SSRF, right? 359 00:28:58,620 --> 00:28:59,420 Okay. 360 00:29:00,000 --> 00:29:06,020 As intended, this is designed to let users of the software test ports and HTTP access no matter where they are. 361 00:29:06,020 --> 00:29:07,420 It's a diagnostic tool. 362 00:29:07,600 --> 00:29:12,560 Because people change ports in DNS or they use dynamic DNS for this, they change it. 363 00:29:12,560 --> 00:29:15,340 So the diagnostic tool has to be able to do that. 364 00:29:15,700 --> 00:29:21,740 It's unauthenticated and totally public because an MSP or a large corporate customer might need to test this. 365 00:29:22,080 --> 00:29:23,860 Now put this together in your head. 366 00:29:23,860 --> 00:29:27,220 What do you think the egress firewall rules on that host are? 367 00:29:27,980 --> 00:29:35,160 If you can scan on any port going out, what are the firewall rules going out? 368 00:29:36,120 --> 00:29:37,180 Okay. 369 00:29:37,660 --> 00:29:39,480 All ports are open. 370 00:29:39,720 --> 00:29:40,420 Got it? 371 00:29:40,420 --> 00:29:44,680 So what's happening is it's creating a DNS request. 372 00:29:44,740 --> 00:29:51,860 Going deep into this, I don't want to go too deep into it, but just understand it's three to five DNS requests and then the HTTP request. 373 00:29:52,280 --> 00:29:55,940 It's also effectively operating as a proxy for me. 374 00:29:55,940 --> 00:29:59,100 Every server side request forgery is a proxy. 375 00:29:59,120 --> 00:30:03,820 It's a limited proxy, but it is indeed proxying traffic. 376 00:30:05,000 --> 00:30:15,280 So working as designed, this is a port scanner, a proxy, a firewall bypass, backdoor access to people's HTTP and API. 377 00:30:15,760 --> 00:30:21,040 Remember how it's generating five to seven requests every time and it doesn't do any sort of rate limiting? 378 00:30:21,220 --> 00:30:22,840 That's a DDoS attack. 379 00:30:22,840 --> 00:30:24,140 Just flood it. 380 00:30:24,180 --> 00:30:25,260 Trust me. 381 00:30:25,260 --> 00:30:27,160 You can do C2 beaconing. 382 00:30:27,160 --> 00:30:28,700 You can enumerate content. 383 00:30:28,840 --> 00:30:30,220 You can fish from it. 384 00:30:30,220 --> 00:30:33,160 It bypasses AV because everybody's disabling this stuff. 385 00:30:33,440 --> 00:30:39,360 I have the malicious code signing thing and I now have access to ConnectWise's internal network. 386 00:30:40,660 --> 00:30:42,580 Who wants to call me on that one? 387 00:30:43,620 --> 00:30:47,060 I will explain why in a minute, but look on the bottom right hand corner. 388 00:30:47,100 --> 00:30:50,260 That's a port scan script I wrote, abusing that function. 389 00:30:50,780 --> 00:30:53,220 Do you see that lb.corp.xyz? 390 00:30:53,220 --> 00:30:55,760 Here's one of my nefarious things that I never tell developers. 391 00:30:55,880 --> 00:31:02,660 None of you actually likes to go look at DNS requests, especially externally injected ones, so I maintain a bunch of really funny zones. 392 00:31:02,900 --> 00:31:13,260 Corp.xyz is one that a lot of corporations used to use, but if you query lb.corp.xyz it resolves to 127.0.0.1. 393 00:31:15,460 --> 00:31:16,920 Making sense now? 394 00:31:17,480 --> 00:31:18,860 But I'm not going to get there yet. 395 00:31:18,860 --> 00:31:20,300 What I want to get there is this. 396 00:31:20,300 --> 00:31:25,860 Two one-way communication channels equal one two-way communication channel. 397 00:31:26,500 --> 00:31:31,840 I got this way, this way, all I'm really doing is three lights make a left turn. 398 00:31:32,420 --> 00:31:44,100 I turned this into an effective C2 exfiltration DNS and HTTP beacon, similar to HTTP exfiltration like staging, or Iodine C2, which is DNS based. 399 00:31:44,620 --> 00:31:46,400 How did I do it? 400 00:31:46,400 --> 00:31:54,660 I just encoded in that HTTP request that gets generated, I added a base64 payload to the end of it. 401 00:31:54,940 --> 00:32:02,600 Sent it to an external host and if you decrypt it, it says cyber POC. 402 00:32:02,660 --> 00:32:11,760 That's a message encoded over base64, exfiltrated through a trusted host and signaling something to me in a way they've never found. 403 00:32:12,380 --> 00:32:13,940 Instant win. 404 00:32:14,020 --> 00:32:16,580 What happens when you're requesting that? 405 00:32:16,580 --> 00:32:20,740 It sends that request via user control port as their IP address. 406 00:32:20,740 --> 00:32:22,340 This is going to get very important. 407 00:32:22,400 --> 00:32:24,420 Not my IP address. 408 00:32:24,580 --> 00:32:26,940 Good luck doing forensics on that. 409 00:32:26,940 --> 00:32:29,240 Good luck doing IR on that. 410 00:32:29,480 --> 00:32:50,860 How I'm creating an arbitrary HTTP generator is, at the end of that web server box, you can actually put slashes and restful stuff, but as long as you put the anchor tag at the end of it, it snips off all the other stuff at the end that they add on, making it a completely arbitrary HTTP request generator. 411 00:32:51,540 --> 00:32:52,980 Why the anchor tag? 412 00:32:53,360 --> 00:32:54,860 What does it do in a browser? 413 00:32:54,860 --> 00:32:57,300 You guys disregard it because it's an anchor tag for the browser. 414 00:32:57,300 --> 00:32:58,200 Not for that. 415 00:32:58,200 --> 00:32:59,640 They're snipping it off. 416 00:32:59,680 --> 00:33:09,540 So all you need to do is put in that web server host, the FQDN, whatever the URL is, and put an anchor tag at the end, and it's going to forward out that exact thing. 417 00:33:10,040 --> 00:33:20,880 I told them about this in December of 2022, and as of July 15th, the day I got the acceptance from the CFP, I immediately generated this to prove it was still possible. 418 00:33:22,100 --> 00:33:28,920 AppSecVillage, a-v-s-v-d-c-31, and if you decrypt the base64 value in there, it has a funny little message for you. 419 00:33:29,280 --> 00:33:30,440 Proof of concept. 420 00:33:30,440 --> 00:33:31,580 I get the F out. 421 00:33:31,840 --> 00:33:32,620 There it is. 422 00:33:32,620 --> 00:33:33,540 I'm not even done. 423 00:33:33,540 --> 00:33:34,520 This is the beginning. 424 00:33:34,780 --> 00:33:36,820 If you see this right here, it says succeeded, right? 425 00:33:36,820 --> 00:33:37,740 It's giving me a message. 426 00:33:37,740 --> 00:33:39,200 It definitely connected, right? 427 00:33:39,780 --> 00:33:43,200 So what happens if I start feeding that form malicious input? 428 00:33:44,980 --> 00:33:47,260 Like the loopback interface. 429 00:33:48,280 --> 00:33:54,920 This is an external and internal port scanner because it's coming from that host. 430 00:33:54,960 --> 00:34:08,460 All you need to do, and there's the Python script for doing it, is to basically iterate through every port for your target host, parse the return message it gives you in that page, and that's a port scanner. 431 00:34:09,200 --> 00:34:20,700 If you have gone out to your firewall and disabled controls or allowed firewall rules from asterisk.screenconnect.com, what have you done? 432 00:34:20,700 --> 00:34:26,540 You've given me backdoor access because it's coming from somebody else's IP. 433 00:34:26,760 --> 00:34:29,760 Don't believe I'm scanning the inside of their network? 434 00:34:29,820 --> 00:34:30,600 Here you go. 435 00:34:30,600 --> 00:34:31,980 Here's the URL. 436 00:34:31,980 --> 00:34:40,600 If you use lb.corp.xyz on the relay one, put in the port box 3389 and click test. 437 00:34:40,640 --> 00:34:44,580 Whatever you put in that teleprompter, Ron Burgundy is going to read. 438 00:34:44,660 --> 00:34:52,540 It resolves to 127.0.0.1 and it performs a TCP connection to 3389. 439 00:34:53,880 --> 00:34:56,020 Is that externally accessible? 440 00:34:56,020 --> 00:34:57,520 No, it is not. 441 00:34:57,780 --> 00:34:59,320 I win. 442 00:35:00,500 --> 00:35:05,540 And it all comes because nobody understands the OSI model. 443 00:35:05,840 --> 00:35:10,400 This is an application using the network, but nobody really thinks of what the network's doing. 444 00:35:10,520 --> 00:35:13,180 Web applications are layer 7. 445 00:35:13,580 --> 00:35:17,860 Network security and that kind of stuff is layer 2 and 3. 446 00:35:18,540 --> 00:35:23,440 All of the things that I'm bypassing are not anything web application developers tend to think about. 447 00:35:23,760 --> 00:35:25,360 So, how did I do this? 448 00:35:25,360 --> 00:35:29,280 How am I scanning behind people's firewalls, beyond VLANs? 449 00:35:29,480 --> 00:35:42,280 The only connectivity between those two, their internal network, me, other ones, is a layer 7 traffic crafter that is available on multiple subnets. 450 00:35:43,300 --> 00:35:44,040 Right? 451 00:35:44,620 --> 00:36:03,360 It's weakly controlled and because I can inject external IP addresses in, or internal IP addresses to external DNS, if I feed it one of their internal IP addresses for their cloud instance, I am now tunneling HTTP traffic or regular traffic to stuff inside their firewall. 452 00:36:04,220 --> 00:36:05,600 Does that make sense? 453 00:36:05,600 --> 00:36:07,100 Not difficult, right? 454 00:36:07,200 --> 00:36:08,440 Am I overblown? 455 00:36:08,440 --> 00:36:10,200 I don't think so, right? 456 00:36:10,380 --> 00:36:14,120 I should not be able to do this under any circumstances. 457 00:36:14,440 --> 00:36:15,320 Ever. 458 00:36:15,380 --> 00:36:16,180 Period. 459 00:36:17,800 --> 00:36:22,220 So, there's your Python script for doing it and that's how I scanned their internal network with it. 460 00:36:22,960 --> 00:36:25,720 So, you're probably at this point, great, you got a couple tools, what's the big deal? 461 00:36:26,180 --> 00:36:28,820 This is a blind server side request forgery, right? 462 00:36:28,820 --> 00:36:30,340 Incorrect. 463 00:36:30,340 --> 00:36:33,280 Everything is a proxy if you try hard enough. 464 00:36:33,440 --> 00:36:34,580 Exactly. 465 00:36:34,680 --> 00:36:35,740 Okay. 466 00:36:35,980 --> 00:36:46,320 Well, when the content on the other side isn't available, it actually returns the HTTP status code to you of what just happened. 467 00:36:46,500 --> 00:36:55,800 So, my arbitrary HTTP request is now getting back HTTP status codes telling me what happened. 468 00:36:55,800 --> 00:36:57,340 Isn't that Durabuster? 469 00:36:57,980 --> 00:37:00,300 Isn't that a brute force content enumerator? 470 00:37:01,060 --> 00:37:06,260 So, if you want to enumerate the content of anything, there's my Python script. 471 00:37:06,260 --> 00:37:15,520 If you look at the bottom, you just need a file with all your directory names called content.txt and it'll go through and you'll get reliable return codes out of all that. 472 00:37:15,520 --> 00:37:17,440 So, it's not so blind anymore, is it? 473 00:37:18,760 --> 00:37:20,980 Okay, here's the new thing that I invented. 474 00:37:20,980 --> 00:37:22,380 I'm pretty sure I invented it. 475 00:37:22,380 --> 00:37:23,080 Nobody knows. 476 00:37:23,080 --> 00:37:24,740 I've looked around about it. 477 00:37:24,740 --> 00:37:30,900 Here's the crazy part, and this is one of the things I know from 1980-something or 90-something, sorry, more accurate. 478 00:37:31,500 --> 00:37:36,820 Nobody actually cares about the content of HTTP status codes. 479 00:37:37,220 --> 00:37:37,820 Right? 480 00:37:37,820 --> 00:37:43,200 How many of you are actually saving anything other than the three-digit numerical? 481 00:37:44,100 --> 00:37:45,060 Right? 482 00:37:46,140 --> 00:37:47,660 That's IIS. 483 00:37:47,660 --> 00:37:49,100 That's Apache. 484 00:37:49,100 --> 00:37:53,120 All they ever keep are the three-digit status codes. 485 00:37:53,200 --> 00:37:55,140 Now, here's the secret. 486 00:37:56,240 --> 00:38:00,240 They are entirely attacker controllable. 487 00:38:01,560 --> 00:38:02,720 I saw you look. 488 00:38:02,720 --> 00:38:03,500 I'm going to prove it. 489 00:38:03,500 --> 00:38:04,440 Hold on. 490 00:38:04,980 --> 00:38:13,920 Those status codes, the text 200, okay, 400, all those, the text that appears after it is not saved. 491 00:38:13,920 --> 00:38:15,060 Nobody looks at it. 492 00:38:15,060 --> 00:38:16,640 Nobody wants to keep it. 493 00:38:16,680 --> 00:38:30,980 So, what you can actually do is inject payloads into that message, and if something returns the text of that message to you via server-side request forgery, what have I just done? 494 00:38:30,980 --> 00:38:39,460 I am now directly injecting into their web pages my content hosted somewhere else. 495 00:38:40,120 --> 00:38:41,460 Remember that agent download? 496 00:38:41,460 --> 00:38:42,620 Going to become important. 497 00:38:43,360 --> 00:38:48,280 It leaves very few IOCs because nobody actually has that, but think about it this way. 498 00:38:48,280 --> 00:38:54,380 The IOCs that could tell you where that is are on a third-party server, and it... 499 00:38:54,380 --> 00:38:55,920 I'm not going to speak... 500 00:38:55,920 --> 00:39:02,300 It doesn't appear that they're monitoring this because I've been doing it for a year, and I've never been stopped. 501 00:39:03,560 --> 00:39:04,700 That code, right? 502 00:39:04,700 --> 00:39:09,140 So, I invented my own HTTP status code called 666. 503 00:39:13,040 --> 00:39:24,480 HTTP status code 666 did not exist before this moment, but I am injecting into, as part of that code, my malicious page, or my malicious content. 504 00:39:24,600 --> 00:39:29,740 All the controls that are supposed to keep you from cross-site scripting and all those other things immediately disappear. 505 00:39:29,740 --> 00:39:30,420 What? 506 00:39:30,420 --> 00:39:34,520 Because this is directly integrated into that web page's content. 507 00:39:34,900 --> 00:39:35,600 It's not... 508 00:39:35,960 --> 00:39:38,400 It's proxying it, but it's not like sending it directly through. 509 00:39:38,400 --> 00:39:44,000 It's taking it, integrating it into that page as its own web page code and going. 510 00:39:45,200 --> 00:39:46,000 Right? 511 00:39:46,640 --> 00:39:48,000 Now, look at the thing at the bottom. 512 00:39:48,000 --> 00:39:52,440 We used asterisk.screenconnect.com, but we should have used screenconnect.com. 513 00:39:52,700 --> 00:39:58,880 So, all of this is hosted, or you can inject it through www.screenconnect.com. 514 00:39:59,680 --> 00:40:04,080 So, is it a theory that I have a way of injecting malicious code into anything on their pages? 515 00:40:04,680 --> 00:40:05,880 Absolutely not. 516 00:40:06,080 --> 00:40:15,260 So, all you really need to do is serve 666 as your error code, put in a cross-site scripting payload, and that is the world's simplest XSS. 517 00:40:15,500 --> 00:40:18,820 What you need is the Python listener to do this. 518 00:40:19,180 --> 00:40:20,360 And it's on the left-hand side. 519 00:40:20,360 --> 00:40:21,440 That's the code. 520 00:40:21,820 --> 00:40:33,020 So, all I did, because their post requests can also be submitted as GET requests, I now have a client-deliverable single URL that will trigger all of this reliably. 521 00:40:33,960 --> 00:40:35,880 Oh, wow, Ken, you popped a one. 522 00:40:36,400 --> 00:40:37,880 Get a lot more than that. 523 00:40:38,860 --> 00:40:42,420 You can do all of this just by doing that. 524 00:40:42,420 --> 00:40:43,720 And that's the web page code. 525 00:40:43,720 --> 00:40:53,720 I'm returning 666 via that code, but if you see here in the input field at the bottom where I highlighted it, it's directly integrated into the web page code. 526 00:40:54,840 --> 00:40:59,640 Your browser thinks this is legitimate content coming from a trusted source. 527 00:41:01,240 --> 00:41:02,520 So, how do you enumerate this? 528 00:41:02,520 --> 00:41:05,180 How do you find this cool new way of doing it? 529 00:41:06,220 --> 00:41:14,120 I'm a big proponent of none of our information or knowledge should be secret or esoteric and this isn't all that hard to do all this stuff, it's a matter of logic. 530 00:41:14,300 --> 00:41:18,320 So, I like using free tools instead of telling you to pay $15,000 for something. 531 00:41:18,320 --> 00:41:19,260 It's very simple. 532 00:41:19,320 --> 00:41:23,640 There is a diagnostic web page on the internet called httpstat.us. 533 00:41:23,780 --> 00:41:28,160 Whatever you put in the URL, it will return the error code for whatever you put in there. 534 00:41:28,160 --> 00:41:32,300 So, if you put 418 at the end of that, it'll return a 418 code. 535 00:41:32,300 --> 00:41:34,200 How many people know what a 418 code is? 536 00:41:34,200 --> 00:41:36,920 How many people have actually ever used that in the real world? 537 00:41:36,920 --> 00:41:41,480 Okay, you're like the three people I've ever met that have ever actually used this for anything. 538 00:41:41,820 --> 00:41:43,460 You're not a teapot. 539 00:41:43,460 --> 00:41:44,780 You're a proxy. 540 00:41:45,620 --> 00:41:52,580 Because if your blind server-side request forgery returns 418, that's not something anybody uses. 541 00:41:52,580 --> 00:41:55,660 That immediately tells you they're not sanitizing. 542 00:41:56,400 --> 00:42:00,240 So, if you've got a blind server-side request forgery like I do, that's how I do it in Burp. 543 00:42:00,240 --> 00:42:01,960 That's exactly how I do this. 544 00:42:01,960 --> 00:42:11,760 Run every status code from 1 to 699 and if you get any sort of code that means anything, it's any kind of HTTP status code, you're in. 545 00:42:12,160 --> 00:42:14,240 Now, here's where it gets silly. 546 00:42:15,140 --> 00:42:17,360 You have to understand what this is happening. 547 00:42:17,360 --> 00:42:19,200 I call it sanitization depth. 548 00:42:19,280 --> 00:42:21,720 On the right-hand side, you just have my custom error. 549 00:42:21,720 --> 00:42:30,500 But, the application completely fails to actually sanitize any of the data that I'm injecting via that status code. 550 00:42:31,000 --> 00:42:33,020 Character markup, anything. 551 00:42:33,020 --> 00:42:38,900 So, if you remember my talk from last year, I talked about how I figured out a way to do DNS and HTTP exfiltration via this. 552 00:42:39,660 --> 00:42:51,260 Malicious payloads that I want to transmit over this, because it's a proxy, I have all these characters available, so now I can use Base64 and you can encode anything as a Base64 payload. 553 00:42:52,280 --> 00:42:54,760 So, what do you do? 554 00:42:55,100 --> 00:43:08,780 Well, if you want to tunnel live HTTP traffic to bypass a content filter, or you just want to traffic files through connectwise port test, aka proxy chains, two one-way communication channels equal one communicate, right? 555 00:43:08,780 --> 00:43:22,400 So, all I'm doing, this Python script, I inject an arbitrary URL in the web server thing, and then what I'm actually putting at the end is a Base64 encoded URL. 556 00:43:22,720 --> 00:43:39,420 My proxy hosted in Amazon parses that, goes out and retrieves the web page I asked for, and then returns it inside that status code, and I wrote a shim on the other side that picks it up and parses it all. 557 00:43:40,460 --> 00:43:43,120 In 23 lines of Python code. 558 00:43:44,300 --> 00:43:46,920 It's really that easy. 559 00:43:46,940 --> 00:43:48,300 Now, think about this. 560 00:43:48,300 --> 00:43:50,780 I am inheriting all the firewall rules. 561 00:43:50,820 --> 00:43:55,680 How do I prove that at the only place on Earth this could have come from was their server? 562 00:43:56,640 --> 00:44:05,300 Well, you can add to your Amazon EC2 rules that the only IP address on the entire world that can connect to that server that I'm serving is their IP address. 563 00:44:05,520 --> 00:44:07,020 Why did I do that? 564 00:44:07,040 --> 00:44:16,980 Because if you've got third-party IR companies trying to sniff around your stuff and you don't want them finding it, putting up firewall rules that prevent them from ever looking at what your payloads look like is a pretty good idea. 565 00:44:19,360 --> 00:44:23,700 So, again, I've whitelisted ScreenConnect.com including domain names. 566 00:44:24,200 --> 00:44:27,920 So now it's basically an open network tunnel. 567 00:44:28,800 --> 00:44:34,520 So if you want to build a content filter bypass or just run a proxy, you can do the same exact thing. 568 00:44:34,540 --> 00:44:38,280 Now, here's why it's important to inherit all these firewall rules. 569 00:44:38,280 --> 00:44:48,480 If you're in a highly secure critical infrastructure environment, many times the only IP address or network traffic you are allowed to pass outside the house is to the remote management software. 570 00:44:49,520 --> 00:44:50,540 Anything else gets dropped. 571 00:44:50,540 --> 00:44:51,700 Anybody else run their stuff like that? 572 00:44:51,700 --> 00:44:54,360 A lot of people run that, especially in high availability environments. 573 00:44:54,840 --> 00:45:01,660 So now that I have this available, I can now tunnel out to the internet and hence the world via that status code. 574 00:45:02,440 --> 00:45:08,600 It's the only IP it can go, so I put something up in my Amazon instance that picks up the request and does all the HTTP stuff. 575 00:45:09,460 --> 00:45:10,080 Right? 576 00:45:10,560 --> 00:45:14,360 Not a bit of social engineering so far, which was their big concern. 577 00:45:14,360 --> 00:45:16,500 Oh, you need social engineering for all of this. 578 00:45:16,500 --> 00:45:17,160 No. 579 00:45:17,580 --> 00:45:20,400 So all you really need to do is start a free EC2 server. 580 00:45:20,400 --> 00:45:26,280 I prefer elastic ones because they are anywhere and you can sign up anonymously and don't cost you a dollar. 581 00:45:26,280 --> 00:45:35,240 You just host this scripting out there, make a firewall rule that says the only thing it can attach via HTTP on port 80 is this. 582 00:45:35,240 --> 00:45:38,020 Serve that code and you win. 583 00:45:39,280 --> 00:45:45,360 So I've been serving malicious POC and assigned executables to their cloud instance since January 2023. 584 00:45:45,760 --> 00:45:47,760 My warning to you is this. 585 00:45:47,760 --> 00:45:50,500 Whatever you do, and I seriously mean this because I'm not that guy. 586 00:45:50,500 --> 00:45:52,760 I'm an ethical go-by-the-books person. 587 00:45:52,920 --> 00:46:01,520 Do not click that URL or put it in while you put the Xs in because if you do, it will install without clicking a remote install agent on your computer. 588 00:46:02,220 --> 00:46:03,320 And it's a frame, right? 589 00:46:03,320 --> 00:46:06,040 I can inject that via frame without ever downloading, right? 590 00:46:06,600 --> 00:46:08,160 So let's talk about social engineering. 591 00:46:08,160 --> 00:46:09,380 What is social engineering? 592 00:46:09,460 --> 00:46:19,840 Tactic of manipulating, influencing, deceiving a victim in order to gain control, steal personal financial information, it uses psychological manipulation to trick users into making security mistakes, right? 593 00:46:20,340 --> 00:46:33,520 So if I can register your old domain, send somebody that cross-site scripting payload, and load it off of what used to be your FQDN, that's barely social engineering. 594 00:46:33,960 --> 00:46:36,680 The agent doesn't have any framing invitations, right? 595 00:46:36,680 --> 00:46:40,520 So why not start injecting a frame instead? 596 00:46:41,200 --> 00:46:46,200 So my payload is actually serving an iframe. 597 00:46:46,900 --> 00:46:50,220 But I use the hidden tag, right? 598 00:46:50,600 --> 00:46:55,380 You inject the frame, it automatically downloads, all of that gets bypassed. 599 00:46:55,380 --> 00:46:56,620 That's literally how you do it. 600 00:46:56,620 --> 00:46:59,060 It's barely social engineering at this point, right? 601 00:46:59,580 --> 00:47:03,440 So what if you have some company sniffing around your work and you don't want them finding it? 602 00:47:03,440 --> 00:47:07,100 Well, the simple elaboration for Tradecraft is just to use the hidden tag. 603 00:47:07,100 --> 00:47:09,920 So if anybody actually finds that page, they won't actually see it. 604 00:47:09,920 --> 00:47:12,620 And the psychological trick of all of this is what? 605 00:47:12,660 --> 00:47:16,080 I have total control of the HTML content in there. 606 00:47:16,080 --> 00:47:19,320 It doesn't check CSRF any of that to get requests. 607 00:47:19,320 --> 00:47:22,020 So I simply just started rewriting the web page. 608 00:47:23,140 --> 00:47:28,760 At the bottom of that it says, please wait while the PortConnect client is downloaded to your computer. 609 00:47:28,880 --> 00:47:33,620 So my trick is I send it to a port test page and say it's an installable port testing module. 610 00:47:33,920 --> 00:47:38,840 They download the agent and it loads on my machine, gives me full system access to the endpoint. 611 00:47:40,020 --> 00:47:41,280 Don't believe me? 612 00:47:43,700 --> 00:47:45,580 Give this video a watch. 613 00:47:46,800 --> 00:47:55,880 So this is me grabbing the URL as if I would send it to somebody, putting it in here and literally it's the same thing you're seeing. 614 00:47:56,120 --> 00:47:57,280 See how it says 666? 615 00:47:57,280 --> 00:47:58,740 I'm just showing you what the URL is. 616 00:47:58,740 --> 00:47:59,920 There's no tricks up my sleeve. 617 00:47:59,920 --> 00:48:01,460 I'm not playing any games. 618 00:48:02,120 --> 00:48:03,100 Hit enter. 619 00:48:06,000 --> 00:48:07,660 And I'm showing you this. 620 00:48:07,660 --> 00:48:10,540 All of the antivirus is turned on on this computer. 621 00:48:10,640 --> 00:48:12,680 All of the controls are there. 622 00:48:14,060 --> 00:48:15,660 It just downloaded. 623 00:48:17,180 --> 00:48:18,460 Open it up. 624 00:48:18,700 --> 00:48:22,060 I'll refresh it here just to show you that's how it downloads. 625 00:48:22,460 --> 00:48:23,660 Open it up. 626 00:48:23,900 --> 00:48:26,400 That's the HTTP request executing. 627 00:48:27,060 --> 00:48:30,940 I'm going to show you the details and you're going to see that's all the content I put in there. 628 00:48:30,940 --> 00:48:32,560 I injected from my server. 629 00:48:33,520 --> 00:48:34,880 Watch it one more time. 630 00:48:34,880 --> 00:48:36,400 Here's the important part. 631 00:48:36,780 --> 00:48:38,600 See this right here? 632 00:48:38,600 --> 00:48:39,860 You'll see it in a second. 633 00:48:42,590 --> 00:48:45,330 I need to hurry up about six months ago on this. 634 00:48:45,330 --> 00:48:48,450 That's signed by their controlled thing. 635 00:48:48,490 --> 00:48:51,090 Running that it looks fine. 636 00:48:51,270 --> 00:48:52,830 And now what am I doing? 637 00:48:53,450 --> 00:48:56,950 I'm waiting for my attacker to connect to the machine. 638 00:48:57,070 --> 00:49:05,070 Because it's calling back to my rogue connect wise instance in their cloud that I signed up for anonymously and it's loading up stuff on their computer. 639 00:49:05,470 --> 00:49:07,150 As system. 640 00:49:09,770 --> 00:49:10,950 That's how it's done. 641 00:49:11,250 --> 00:49:13,850 Like I said, thank you. 642 00:49:15,410 --> 00:49:16,450 There it is. 643 00:49:16,450 --> 00:49:18,590 And literally from this you now have access to everything. 644 00:49:18,590 --> 00:49:23,930 You load everything up and if you go back and read the Iranian APTs this is exactly their trampoline and everything else. 645 00:49:24,330 --> 00:49:27,810 It will either stay once or if on my end I just click persist. 646 00:49:27,910 --> 00:49:28,850 Maintain a shell. 647 00:49:28,850 --> 00:49:29,810 It will do it. 648 00:49:31,210 --> 00:49:31,710 Cool. 649 00:49:31,710 --> 00:49:32,610 Thank you for the applause. 650 00:49:32,610 --> 00:49:37,130 That was a moment for me because I worked really hard on this and it was a really rough time. 651 00:49:37,770 --> 00:49:39,830 I successfully exploited it. 652 00:49:39,830 --> 00:49:41,330 But there's more. 653 00:49:42,230 --> 00:49:43,950 I'm not telling everything. 654 00:49:43,950 --> 00:49:45,970 I'm just going to show you some stuff. 655 00:49:47,510 --> 00:49:54,630 Connect wise applications even beyond this use a client application that is really just a wrapped web browser. 656 00:49:56,610 --> 00:50:01,650 You can figure this out by looking at their web page and they parse what the user agent tags are. 657 00:50:03,310 --> 00:50:21,970 That client is absolutely exploitable because it's an old browser but nobody realizes it's a browser so there are tons of ways of going through connect wise, not this, the other parts of the system to deliver client side exploits without user interaction. 658 00:50:23,090 --> 00:50:23,990 That's one thing. 659 00:50:23,990 --> 00:50:27,890 I'm not sharing that yet because it's cool and it's another cool thing that nobody's ever done before. 660 00:50:28,090 --> 00:50:32,870 Now I want you to think, and this is the important part, I want you to think about this as application developers. 661 00:50:36,430 --> 00:50:40,130 Who leaves debugging symbols on when you compile code? 662 00:50:42,530 --> 00:50:58,370 So the click once installer that they provided if you carve through the metadata software bill of materials, software supply chain attacks, all that stuff I do what they've left in here was the absolute drive path including username for the profile source, 663 00:50:58,370 --> 00:51:03,310 stream connect work misc, bootstrapper, release, click once runner. 664 00:51:04,270 --> 00:51:07,050 The source is where the source code is stored. 665 00:51:07,050 --> 00:51:07,950 Right? 666 00:51:08,450 --> 00:51:14,050 I have a username of somebody who can actually get to that and compiles it. 667 00:51:14,290 --> 00:51:20,210 I know what they're doing and I'm going to mic drop after the next slide on this. 668 00:51:20,530 --> 00:51:28,370 There is a lot of metadata embedded in their software and applications that will allow you to map their internal network. 669 00:51:32,270 --> 00:51:39,630 This is the thing I'll come out is I love attacking developers and I love exploiting developer weaknesses because you all have something like this. 670 00:51:40,290 --> 00:51:41,970 So, wrapping up. 671 00:51:42,650 --> 00:51:52,370 Should companies, and this is where it comes down to, this is all cool, this is new stuff, whatever it's like, one, should companies be responsible, and that's the question I get, responsible for their own disclosure analysis of vulnerabilities? 672 00:51:52,750 --> 00:51:53,630 I don't know. 673 00:51:54,430 --> 00:51:59,450 I can tell you that I shouldn't have been the person that registered the CVEs and it certainly wasn't overblown in my eyes. 674 00:51:59,730 --> 00:52:01,290 So here's my trick I'm going to tell you. 675 00:52:01,290 --> 00:52:03,710 Learn how the CVE system reporting works. 676 00:52:04,210 --> 00:52:14,190 So if a company is a CNA and they won't give you your CVE, what you can do is go to MITRE, who's a CNA of last resort, and they'll issue it to you if you're correct. 677 00:52:14,190 --> 00:52:15,970 Which is why I went to MITRE. 678 00:52:16,450 --> 00:52:23,370 So if you're a bug hunter or somebody who's doing this and the program won't give it to you, you can just go to MITRE and say rectify this for me. 679 00:52:25,630 --> 00:52:27,590 Yes, you were just certified , yes. 680 00:52:28,130 --> 00:52:28,890 Follow that. 681 00:52:28,890 --> 00:52:33,110 A magic bullet of this isn't a big deal won't fix anything. 682 00:52:33,750 --> 00:52:37,350 All of you need to start thinking holistically how the system gets put together. 683 00:52:37,350 --> 00:52:42,690 Because like I said, it's an application problem, it's the network problem, but it's really a lack of understanding. 684 00:52:43,270 --> 00:52:45,490 Two last things, I'll get off, give me two seconds. 685 00:52:45,950 --> 00:52:53,030 Bug bounty programs and responsible disclosure are totally killing employment in the industry because why would anybody hire you full time when they can get the milk for free? 686 00:52:53,170 --> 00:52:55,330 Or for a t-shirt and 500 bucks? 687 00:52:55,590 --> 00:52:59,430 If you want more jobs in this industry, stop taking the quick payday. 688 00:52:59,430 --> 00:53:05,270 Put your CVEs that you register on your resume and that is money that will pay off on your salary for the rest of your life. 689 00:53:05,930 --> 00:53:08,210 Trust me, I've got hundreds. 690 00:53:08,470 --> 00:53:15,310 Last thing, I'll say this, ask yourself this, I'm not a bad person, I don't turn bad, but think about it this way as all of you. 691 00:53:15,470 --> 00:53:24,350 If I have to stare these people down, fly out to Las Vegas, do a press whatever, just for a few words of acknowledgement on a website, why would I ever help them again? 692 00:53:25,270 --> 00:53:27,470 Think about that as an application designer. 693 00:53:28,070 --> 00:53:29,030 Be more open. 694 00:53:29,210 --> 00:53:31,430 Thank you very much guys, that puts everybody else at risk. 695 00:53:31,430 --> 00:53:32,590 Thank you very much, I appreciate it.