SlideShare a Scribd company logo
© 2019 Secure D Center Co.,Ltd
The CARzyPire
Another Red Team Operations
© 2019 Secure D Center Co.,Ltd
DISCLAIMER
All the information provided on this site are for educational
purposes only.
Any actions and or activities related to the material contained within
this document is solely your responsibility. The misuse of the
knowledge can result in criminal charges brought against the
persons in question. The authors will not be held responsible in the
event any criminal charges be brought against any individuals
misusing the information from this document to break the law.
© 2019 Secure D Center Co.,Ltd
Introduction
Agenda
 The CARzyPire Project
 Preparation
 Customizing Payload
 Delivery and Exploitation
Speaker
Prathan Phongthiproek
tanprathan
pprathan
prathan
cwhunderground
© 2019 Secure D Center Co.,Ltd
The CARzyPire Project
Raspberry Pi Zero W + Crazyradio PA + PowerShell Empire in the Radio-controlled car !!
External Zone
Internal Zone
© 2019 Secure D Center Co.,Ltd
Preparation
© 2019 Secure D Center Co.,Ltd
Hardware Preparation
https://re4son-kernel.com/re4son-pi-kernel
 Sticky Fingers Kali-Pi 0 – Armel edition
Raspberry Pi Zero W
© 2019 Secure D Center Co.,Ltd
Hardware Preparation
https://github.com/BastilleResearch/mousejack
 Build the firmware
 Flash over USB
Crazyradio PA
https://github.com/insecurityofthings/jackit
 Install the JackIt
https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Duckyscript
 Create Duckyscript
© 2019 Secure D Center Co.,Ltd
Radio Frequency (RF) over USB Dongle
Wireless devices (Mouse/Keyboard/Presenter remote) can be hijacked !!
Source: https://www.mousejack.com/
© 2019 Secure D Center Co.,Ltd
Command-and-Control Server Preparation
https://github.com/EmpireProject/Empire
 Setup the Empire C2 Server
PowerShell Empire
https://github.com/interference-security/empire-web
 Set up the PowerShell Empire Web
© 2019 Secure D Center Co.,Ltd
Customizing Payload
© 2019 Secure D Center Co.,Ltd
Our Enemy
Windows Defender !!
© 2019 Secure D Center Co.,Ltd
Our Enemy
Windows Defender !!
© 2019 Secure D Center Co.,Ltd
The Empire Strikes Back - Bypassing Windows Defender (Tested in July 2019)
Customizing PowerShell Empire Stager
HTTP Stager
Agent
© 2019 Secure D Center Co.,Ltd
The Empire Strikes Back - Bypassing Windows Defender (Tested in July 2019)
Customized Payload x Duckyscript
Stager (Multi/Launcher) Creation Duckyscript
© 2019 Secure D Center Co.,Ltd
Delivery and
Exploitation
© 2019 Secure D Center Co.,Ltd
Delivery through CARzyPire
Jackit AutoPWN x Empire Web
© 2019 Secure D Center Co.,Ltd
Exploitation
PowerShell Empire on the Web
© 2019 Secure D Center Co.,Ltd
Exploitation
PowerShell Empire on the Web
© 2019 Secure D Center Co.,Ltd
Thank You
Contact us: info@secure-d.tech

More Related Content

PPT
Create WiFi Hotspot on Windows 7
PPTX
Linux Foundation Live Webinar: Applying Governance to CI/CD
PDF
Building a Mobile App Pen Testing Blueprint
PPTX
Tools for building your Startup on AWS
PDF
DEF CON 27 - workshop - POLOTO - hacking the android apk
PPTX
Leveraging Splunk Enterprise Security with the MITRE’s ATT&CK Framework
PDF
顧客要望と情熱のあいだ - B2B SaaS のプロダクトマネジメント -
PPTX
Fortinet - Digital Government Cloud Security 2.pptx
Create WiFi Hotspot on Windows 7
Linux Foundation Live Webinar: Applying Governance to CI/CD
Building a Mobile App Pen Testing Blueprint
Tools for building your Startup on AWS
DEF CON 27 - workshop - POLOTO - hacking the android apk
Leveraging Splunk Enterprise Security with the MITRE’s ATT&CK Framework
顧客要望と情熱のあいだ - B2B SaaS のプロダクトマネジメント -
Fortinet - Digital Government Cloud Security 2.pptx

Similar to The CARzyPire - Another Red Team Operation (15)

PDF
OSS Tools: Creating a Reverse Engineering Plug-in for r2frida
PPTX
2019-11-09 DevOpsNG - What I've learned from DevOps
PDF
Trends in Digital Transformation by Joe Chung
PDF
The security phoenix - from the ashes of DEV-OPS Appsec California 2020
PDF
Blackhat - Do you trust your Threat Intelligence
PDF
Android Q & iOS 13 Privacy Enhancements
PDF
張楷翊(Oscar):客製打造專屬工作 App – Power Apps / Automate
PDF
{unscripted} 2020 : A Conference for Simplifying and Scaling Software Delivery
PDF
Bitcoin and cryptocurrencies fs club final - public
PDF
Shell Script 4 DBAs
PDF
Webinar: Making the Move from Legacy IAM to Modern Digital Identity – On Your...
PDF
Using chaos to bring resiliency to your applications
PPTX
Web Performance Without Sacrificing Security: Featuring Forrester Guest Speaker
PDF
2022 apidays LIVE Helsinki & North_APIs are the Last Missing Piece to Enable ...
PPTX
The Scout24 Data Platform - a technical deep dive
OSS Tools: Creating a Reverse Engineering Plug-in for r2frida
2019-11-09 DevOpsNG - What I've learned from DevOps
Trends in Digital Transformation by Joe Chung
The security phoenix - from the ashes of DEV-OPS Appsec California 2020
Blackhat - Do you trust your Threat Intelligence
Android Q & iOS 13 Privacy Enhancements
張楷翊(Oscar):客製打造專屬工作 App – Power Apps / Automate
{unscripted} 2020 : A Conference for Simplifying and Scaling Software Delivery
Bitcoin and cryptocurrencies fs club final - public
Shell Script 4 DBAs
Webinar: Making the Move from Legacy IAM to Modern Digital Identity – On Your...
Using chaos to bring resiliency to your applications
Web Performance Without Sacrificing Security: Featuring Forrester Guest Speaker
2022 apidays LIVE Helsinki & North_APIs are the Last Missing Piece to Enable ...
The Scout24 Data Platform - a technical deep dive
Ad

More from Prathan Phongthiproek (20)

PDF
Mobile Defense-in-Dev (Depth)
PDF
Cyber Kill Chain: Web Application Exploitation
PDF
Mobile App Hacking In A Nutshell
PDF
Jump-Start The MASVS
PDF
OWASP Mobile Top 10 Deep-Dive
PDF
The Hookshot: Runtime Exploitation
PDF
Understanding ransomware
PDF
OWASP Day - OWASP Day - Lets secure!
PDF
Don't Trust, And Verify - Mobile Application Attacks
PDF
Owasp Top 10 Mobile Risks
PDF
Point-Of-Sale Hacking - 2600Thailand#20
PDF
OWASP Thailand-Beyond the Penetration Testing
PDF
Mobile Application Pentest [Fast-Track]
PPTX
Hack and Slash: Secure Coding
PPTX
CDIC 2013-Mobile Application Pentest Workshop
PDF
Web Application Firewall: Suckseed or Succeed
PDF
Layer8 exploitation: Lock'n Load Target
PDF
Advanced Malware Analysis
PDF
Tisa mobile forensic
PDF
Tisa-Social Network and Mobile Security
Mobile Defense-in-Dev (Depth)
Cyber Kill Chain: Web Application Exploitation
Mobile App Hacking In A Nutshell
Jump-Start The MASVS
OWASP Mobile Top 10 Deep-Dive
The Hookshot: Runtime Exploitation
Understanding ransomware
OWASP Day - OWASP Day - Lets secure!
Don't Trust, And Verify - Mobile Application Attacks
Owasp Top 10 Mobile Risks
Point-Of-Sale Hacking - 2600Thailand#20
OWASP Thailand-Beyond the Penetration Testing
Mobile Application Pentest [Fast-Track]
Hack and Slash: Secure Coding
CDIC 2013-Mobile Application Pentest Workshop
Web Application Firewall: Suckseed or Succeed
Layer8 exploitation: Lock'n Load Target
Advanced Malware Analysis
Tisa mobile forensic
Tisa-Social Network and Mobile Security
Ad

Recently uploaded (20)

PDF
project resource management chapter-09.pdf
PPTX
cloud_computing_Infrastucture_as_cloud_p
PDF
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
PDF
Encapsulation theory and applications.pdf
PDF
Univ-Connecticut-ChatGPT-Presentaion.pdf
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
PDF
NewMind AI Weekly Chronicles - August'25-Week II
PDF
Hindi spoken digit analysis for native and non-native speakers
PPTX
A Presentation on Touch Screen Technology
PDF
Getting Started with Data Integration: FME Form 101
PPTX
TLE Review Electricity (Electricity).pptx
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
PDF
1 - Historical Antecedents, Social Consideration.pdf
PDF
WOOl fibre morphology and structure.pdf for textiles
PPTX
OMC Textile Division Presentation 2021.pptx
PDF
Zenith AI: Advanced Artificial Intelligence
PDF
Video forgery: An extensive analysis of inter-and intra-frame manipulation al...
PPTX
TechTalks-8-2019-Service-Management-ITIL-Refresh-ITIL-4-Framework-Supports-Ou...
PDF
Assigned Numbers - 2025 - Bluetooth® Document
PDF
Microsoft Solutions Partner Drive Digital Transformation with D365.pdf
project resource management chapter-09.pdf
cloud_computing_Infrastucture_as_cloud_p
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
Encapsulation theory and applications.pdf
Univ-Connecticut-ChatGPT-Presentaion.pdf
Agricultural_Statistics_at_a_Glance_2022_0.pdf
NewMind AI Weekly Chronicles - August'25-Week II
Hindi spoken digit analysis for native and non-native speakers
A Presentation on Touch Screen Technology
Getting Started with Data Integration: FME Form 101
TLE Review Electricity (Electricity).pptx
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
1 - Historical Antecedents, Social Consideration.pdf
WOOl fibre morphology and structure.pdf for textiles
OMC Textile Division Presentation 2021.pptx
Zenith AI: Advanced Artificial Intelligence
Video forgery: An extensive analysis of inter-and intra-frame manipulation al...
TechTalks-8-2019-Service-Management-ITIL-Refresh-ITIL-4-Framework-Supports-Ou...
Assigned Numbers - 2025 - Bluetooth® Document
Microsoft Solutions Partner Drive Digital Transformation with D365.pdf

The CARzyPire - Another Red Team Operation

  • 1. © 2019 Secure D Center Co.,Ltd The CARzyPire Another Red Team Operations
  • 2. © 2019 Secure D Center Co.,Ltd DISCLAIMER All the information provided on this site are for educational purposes only. Any actions and or activities related to the material contained within this document is solely your responsibility. The misuse of the knowledge can result in criminal charges brought against the persons in question. The authors will not be held responsible in the event any criminal charges be brought against any individuals misusing the information from this document to break the law.
  • 3. © 2019 Secure D Center Co.,Ltd Introduction Agenda  The CARzyPire Project  Preparation  Customizing Payload  Delivery and Exploitation Speaker Prathan Phongthiproek tanprathan pprathan prathan cwhunderground
  • 4. © 2019 Secure D Center Co.,Ltd The CARzyPire Project Raspberry Pi Zero W + Crazyradio PA + PowerShell Empire in the Radio-controlled car !! External Zone Internal Zone
  • 5. © 2019 Secure D Center Co.,Ltd Preparation
  • 6. © 2019 Secure D Center Co.,Ltd Hardware Preparation https://re4son-kernel.com/re4son-pi-kernel  Sticky Fingers Kali-Pi 0 – Armel edition Raspberry Pi Zero W
  • 7. © 2019 Secure D Center Co.,Ltd Hardware Preparation https://github.com/BastilleResearch/mousejack  Build the firmware  Flash over USB Crazyradio PA https://github.com/insecurityofthings/jackit  Install the JackIt https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Duckyscript  Create Duckyscript
  • 8. © 2019 Secure D Center Co.,Ltd Radio Frequency (RF) over USB Dongle Wireless devices (Mouse/Keyboard/Presenter remote) can be hijacked !! Source: https://www.mousejack.com/
  • 9. © 2019 Secure D Center Co.,Ltd Command-and-Control Server Preparation https://github.com/EmpireProject/Empire  Setup the Empire C2 Server PowerShell Empire https://github.com/interference-security/empire-web  Set up the PowerShell Empire Web
  • 10. © 2019 Secure D Center Co.,Ltd Customizing Payload
  • 11. © 2019 Secure D Center Co.,Ltd Our Enemy Windows Defender !!
  • 12. © 2019 Secure D Center Co.,Ltd Our Enemy Windows Defender !!
  • 13. © 2019 Secure D Center Co.,Ltd The Empire Strikes Back - Bypassing Windows Defender (Tested in July 2019) Customizing PowerShell Empire Stager HTTP Stager Agent
  • 14. © 2019 Secure D Center Co.,Ltd The Empire Strikes Back - Bypassing Windows Defender (Tested in July 2019) Customized Payload x Duckyscript Stager (Multi/Launcher) Creation Duckyscript
  • 15. © 2019 Secure D Center Co.,Ltd Delivery and Exploitation
  • 16. © 2019 Secure D Center Co.,Ltd Delivery through CARzyPire Jackit AutoPWN x Empire Web
  • 17. © 2019 Secure D Center Co.,Ltd Exploitation PowerShell Empire on the Web
  • 18. © 2019 Secure D Center Co.,Ltd Exploitation PowerShell Empire on the Web
  • 19. © 2019 Secure D Center Co.,Ltd Thank You Contact us: info@secure-d.tech