Malware for Red Team
Download as PPTX, PDF0 likes198 views
The document discusses methodologies for designing malware focused on red-teaming practices, emphasizing the need for deep system knowledge and penetration skills. It outlines the importance of command and control infrastructure, modular design, and various communication methods for maintaining presence and executing commands within target networks. Various commands and dynamic configurations to enhance malware functionality and operational security standards are also detailed.
![THANK YOU
Satria Ady Pradana
satria.pradana [at] mii.co.id
@xathrya (telegram)
2021 PyCon ID (Security) 35](https://image.slidesharecdn.com/presentation-211205014558/85/Malware-for-Red-Team-35-320.jpg)
Malware for Red Team
- 2. WHO? Satria Ady Pradana • Cyber Security Consultant at Mitra Integrasi Informatika • Director of Curriculum at Archonlabs SSD • Penetration Tester, Red Team • Community Leader of Reversing.ID 20XX Pitch Deck 2 @xathrya xathrya xathrya_
- 4. RED TEAMING • Originate from military practices. • Evaluate security posture by playing as aggressor. • Full-scope, multi-layered attack simulation designed to measure how well organization’s security controls can withstand attack from real-life adversaries.
- 5. REQUIREMENT 2021 PyCon ID (Security) 5 • Deep knowledge of systems (computer system, protocols, libraries, etc). • Ability to think outside the box. • Software development skills. • Penetration testing skills • Social engineering.
- 6. WHEN DOING RED TEAMING 2021 PyCon ID (Security) 6 • Long time engagement (1 – 3 months at minimum). • Penetrate as deep as possible, maintain persistence, pivoting, exfiltrate critical information. • It means you need a way to keep your presence in the network!
- 7. THE CYBER KILL CHAIN 2021 PyCon ID (Security) 7
- 8. WHY PYTHON? 2021 PyCon ID (Security) 8 • Simple and clean structure • Designed for rapid prototyping • Extensive library
- 10. DESIGNING IMPLANT 2021 PyCon ID (Security) 10 • What is the purpose of the implant? • What success look like? • Which feature or capabilities we need?
- 11. DESIGNING IMPLANT 2021 PyCon ID (Security) 11 • Lightweight: can be dropped through macro-enabled office document. • Evasive: evade most common products without much adaptation • Functional: collect information about target environment to aid in further operations.
- 12. TERMS 20XX Pitch Deck 12 • Command and Control attacker-controlled infrastructure which maintain control over all agents or implants by send command and retrieve the result. Alternative name: C&C, C2 server • Implant agent, small program which executed on target. Alternative name: RAT, backdoor, beacon. • Loader specific code or executable which purpose is to load the payload (implant) or other loader.
- 13. TERMS 20XX Pitch Deck 13 • Redirectors Node or system which proxies all traffic from target network (implant) to C2 server, hiding the true location of the C2 server.
- 14. ROBUST INFRASTRUCTURE 2021 PyCon ID (Security) 14 Interactive (Tier 3) • General command, enumeration, scanning, data exfiltration, etc. • Has most interaction and at greatest risk of exposure. • Ready to abandon at any time. Multiple tiers
- 15. ROBUST INFRASTRUCTURE 2021 PyCon ID (Security) 15 Short Haul (Tier 2) • As a backup to reestablish interactive session. • Use covert communications that blend with target. • Slow callback times, i.e. 1 – 24 hours. Multiple tiers
- 16. ROBUST INFRASTRUCTURE 2021 PyCon ID (Security) 16 Long Haul (Tier 1) • Maintain long-term access into target’s network. • Same as short haul, but slower. Multiple tiers
- 17. 2021 PyCon ID (Security) 17
- 18. MINIMUM REQUIREMENT 2021 PyCon ID (Security) 18 • Communication Channel • Modular Design • Dynamic Reconfigurable
- 20. MITRE ATT&CK 2021 PyCon ID (Security) 20 https://attack.mitre.org/
- 21. 2021 PyCon ID (Security) 21 https://attack.mitre.org/groups/G0016/
- 22. 2021 PyCon ID (Security) 22
- 24. COMMUNICATION CHANNEL 2021 PyCon ID (Security) 24 • HTTP/HTTPS: masquerade as legitimate HTTP connections • DNS: • Hybrid: DNS for telemetry or callback, HTTP for data channel. • Pure DNS • SMB: chaining beacons • TCP: with proprietary protocols
- 25. CASE: HTTP 2021 PyCon ID (Security) 25 import requests url = GenerateURL() headers = GenerateHeaders() body = GenerateBody() res = requests.post(url, data=body, headers=headers) ProcessResponse(res) Message Type: • Callback • Command • Result • Dynamic URL and endpoint? • Unique ID • Payload, where? • Interval and jitter • Telemetry, health check
- 26. MODULAR DESIGN 2021 PyCon ID (Security) 26 • Adding new features/capabilities should not changes the core program. • Framework? • Implement feature as addon or plugins • Use builtin or Windows API? • Stages? Stageless?
- 27. CASE: COMMANDS 2021 PyCon ID (Security) 27 • GET • PUT • LIST • EXECUTE • LOAD • Module: credential harvesting, • CONFIGURE: key, channel, IP, port, host, endpoint
- 28. CASE: WMI COMMAND 2021 PyCon ID (Security) 28 • Windows Management Interface • Query system state (process, services, installed apps, bios, etc) • WQL (WMI Query Language) • Module: wmi • pip install wmi • Extending implant with WMI command
- 29. COMMAND: EXECUTE SHELLCODE 2021 PyCon ID (Security) 29 • Raw shellcode as payload • Why shellcode? • Run as separate thread • Allocate space on host process • Decrypt/decompress/decode shellcode to allocated space • Create new thread and start execution from allocated space • Clean up
- 30. COMMAND: DROP & EXECUTE BINARY 2021 PyCon ID (Security) 30 • Fetch executable from C2 server • Mostly tools: Rubeus, mimikatz, message relay • Store the executable temporary • What about DLL?
- 31. COMMAND: SHELL COMMAND 2021 PyCon ID (Security) 31 • Execute shell command • Atomic or session? Variations • os.command() • subprocess.run() • subprocess.Popen()
- 32. DYNAMIC RECONFIGURABLE 2021 PyCon ID (Security) 32 • Change settings/configurations at runtime. • IP address + endpoint • Message type • Profile • Should match with C2 server
- 33. PROTECTION 2021 PyCon ID (Security) 33 • Any tool deployed in target environment needs to adhere to the highest standard of operational security (opsec)
- 34. 2021 PyCon ID (Security) 34
- 35. THANK YOU Satria Ady Pradana satria.pradana [at] mii.co.id @xathrya (telegram) 2021 PyCon ID (Security) 35