Pen Testing Development
- 2. uid=0(@ChrisTruncer) β Christopher Truncer (@ChrisTruncer) β Open Source Software Developer, Veil Framework Developer, Florida State Seminole β Red Teamer, Pen Tester, and Security Researcher for Mandiant
- 3. Whatβs this talk about? β How I got started β Security through Offense β EyeWitness β #avlol β Own the Exfil β Misconfigurations β What (I think) makes successful hackers β Your drive β Scripting/Programming β Tempt the demo gods throughout
- 4. How I Started β College β College computer security class β Hack my roommate β βWow, hacking is realβ β Tech background before Security β Windows Admin β Linux Admin - to learn β Started the plunge into security β No development experience
- 5. First Steps with Development β Start small β Veil wasnβt built in day :) β Fix problems/tasks you always see β Google and Stack Overflow β Just try it... β Nearly all upcoming case studies involve writing some code
- 9. My Development Philosophy β Develop a POC that does what you want β Clean up your code, and add comments! β Make it usable by everyone, not just you β Contribute back and make it public β Maintain your project
- 10. Version Control β Use anything youβre comfortable with, but use it β git - my choice (look at Github, itβs free) β svn β cvs β etcβ¦ β You will mess your code up β You will delete your tools/scripts β You will be thankful for checking in your code
- 11. EyeWitness
- 12. EyeWitness β Problem: When dropped in large network segments, we can see hundreds, if not thousands of web applications. How do we know which to attack?
- 13. EyeWitness β Solution: Automate everything I would manually have to do β Mandatory: β Screenshot web applications β Check for default credentials β Generate a usable report β Optional: β Make report βsectionsβ β Grab server headers
- 14. Google!
- 15. StackOverflow
- 16. Proof of Concept
- 17. Make it Usable β File Input β File, NMap, Nessus β Web Timeouts β Default Credential Checks β Report Generation β Create Sections β High Value Targets β Error Section β etc.
- 19. EyeWitness Stats β Originally: 409 Lines β Now: 3402 Lines β Reasons: β Login Signatures β Multi-Threading β Guess for the real reason?
- 21. #avlol
- 22. The Veil-Framework β Problem: Antivirus canβt catch malware, but it catches pentesters β Goal: Bypass antivirus as easily as professional malware developers β Solution: A python-based framework for generating shellcode and meterpreter injectors
- 23. As Always, Ask the Google
- 24. Have a POCβ¦ Next? β Research obfuscation methods β Look at existing malware β Try encryption routines β Generate random files from a template β Framework might help β Automate as much as possible β I probably should make a framework...
- 25. Veil 1.0 - Released β Small, single file script β Limited payloads β It workedβ¦ better than it really should
- 26. Next Steps... β Donβt use a single script β Maintenance can be a pain β Not easily extensible β A framework would be nice... β Find a mentor β Ability to ask questions is invaluable β Learning & Collaboration opportunities
- 27. Teamed Up β Teamed up with Will Schroeder (@harmj0y) and Mike Wright (@themightyshiv) β We had separate tools, so we combined code bases β @Harmj0y didnβt sleep and combined the code β Took this as an opportunity to learn framework development
- 28. Veil 2.0
- 29. Veil 2.0 β Fully modular framework β Drag and drop payloads β βLanguage agnosticβ β implement additional languages β Easily Extensible β common libraries/methods available β Huge UI focus β Tab completion, command line flags, etc.
- 30. The Veil-Framework β We continued to come up with additional tools which resulted in The Veil-Framework β βA toolset aiming to bridge the gap between pen testing and red team toolsets.β β Veil renamed to Veil-Evasion β Veil-Catapult - Initial payload delivery tool β Veil-Pillage - Post-Exploitation and payload delivery
- 31. State of The Veil-Framework β Still an actively maintained project β V-Day β Victory over antivirus :) β Since 9/15/2013 weβve released at least one new payload on the 15th of every month β Hoping for community involvement β hint hintβ¦ :)
- 33. Egress-Assess
- 34. Attackers donβt just target this... http://2we26u4fam7n16rz3a44uhbe1bq2.wpengine.netdna-cdn.com/wp- content/uploads/041514_1356_MurderingDe30.png
- 35. Whatβs the point? β End Goal - Money/Data β Data - grab it, get it out β !disrupt β !deny β !degrade, β !destroy (maybe deceive) β Not just shells anymore
- 38. Tradecraft Evolution β Pen Tests traditionally exploit vulnerabilities β Find and exploit vulnerabilities β Assess the security as a point in time β Why not add in some exfiltration testing as well? β Attackers DO this, why not help prep our customers? β Letβs emulate our threats
- 39. Our Solution
- 41. What does it do? β Standard client/server model β Simulates data exfiltration β Faux social security numbers or credit cards β And now real files :) β Exfil data over multiple protocols
- 42. Project Goals β Fast to set up for use β Minimal (if any) configurations required to work β Lightweight and no excessive dependencies β Exfiltrate data over different protocols β Modular framework that allows easy expansion of capabilities
- 43. Project Goals β Store all data/files transferred for proof of transfer β Stored in a specific directory β Time and date stamped for correlation with blue team logs β Demonstrate different options for data exfiltration and educate the blue team
- 45. Supported Tunneling Protocols β Protocols merged into Egress-Assess β ICMP β SMB β DNS β DNS_Resolved β HTTP β HTTPS β FTP β SFTP
- 46. FTP and SFTP β Generates faux data and writes it to disk, or transfers a file specified by user β Creates FTP or SFTP connection to server and transfers the file to the server β If faux data is used, it deletes the file
- 47. FTP Transfer
- 48. ICMP β Takes advantage of ICMP type 8 (echo) β Protocol allows you to specify the data used in the echo request β Splits data in 1100 byte chunks β Base64 encodes data β Uses encoded data for the echo
- 49. ICMP Transfer
- 50. DNS (Direct) β Uses DNS TXT records β Max 255 bytes β Split data into chunks, base64 encode each chunk, send packets directly to Egress-Assess server β Multiple limitations when working with DNS β Size restrictions, UDP, etc. β Weβd say a joke, but you might not get it :)
- 52. DNS Info β Other protocol modules work well, but fail when a proxy is used β Other tools have shown that DNS can be used as a communications channel β Cobalt Strikeβs Beacon, dns tunnelling projects (dnscat), etc. β Began researching different methods to exfil data via DNS
- 53. Why Use DNS β βBut we donβt allow port 53 out!β β Locked down environments can have proxies β How many people inspect DNS? β How many people only resolve certain domains? β Can you block protocol compliant C2 comms or data exfiltration attempts? β Customerβs own DNS server FTW!
- 54. DNS (Resolved) β Resolves local systemβs nameserver β Send request to system/network nameserver β <base64encodeddata>.subdomain.domain.com β Server listens for incoming DNS A record request β Grabs record being requested, decodes it, and writes data to disk
- 55. http://blog.cobaltstrike.com/2013/06/20/thatll-never-work-we-dont-allow-port-53-out/
- 56. DNS Resolved Setup β Create DNS A record for your final destination β Create NS Record for subdomain, point to A record https://www.christophertruncer.com/exfiltrate-data-via-dns-with-egress- assess/
- 58. More DNS Woes
- 62. DNS Woes β Leads to problems when transferring files β Faux data, donβt need to preserve order, or 100% integrity β Binary files, this is a problem β Currently working on essentially TCP over UDP DNS transfers
- 63. Powershell all the things β Same client modules as python client β Simulate attackers from Windows systems β Domain proxy support β Deployable through Beacon, Meterpreter, etc..
- 64. Get-Help
- 67. What I Wish I Knew
- 68. What I wish I knew β Programming/Scripting β Start doing this β You can literally control a computer, and make it do exactly what you want
- 69. What I wish I knew β Programming β Get the theme? :) β Mentor β Youβre always one step in front and one step behind someone β Build a lab and play with it β You canβt break anything that costs money!
- 70. What I wish I knew β Be prepared to be uncomfortable at times β Always in a new environment with new βstuffβ and youβre expected to break it β Perk of the job too :) β Build your process β Learn how you best approach networks, web apps, etc. β Use this to face what you donβt know
- 71. The difference between a new and experienced hacker is the experienced hacker can count on their problem solving ability to navigate an unknown environment.
- 72. ? β Chris Truncer β @ChrisTruncer β CTruncer@christophertruncer.com β https://www.christophertruncer.com β https://github.com/ChrisTruncer