Recommended
More Related Content
Similar to Aggressive Autonomous Actions - Operating with Automation
Similar to Aggressive Autonomous Actions - Operating with Automation (20)
More from CTruncer
More from CTruncer (15)
Recently uploaded
Recently uploaded (20)
Aggressive Autonomous Actions - Operating with Automation
- 2. #whoami @ChrisTruncer ▸ Sys admin turned red teamer ▸ Florida State Seminole ▸ Co-Founder and Red Team Lead of FortyNorth Security ▸ Open Source Developer ▹ Veil-Framework ▹ WMImplant ▹ EyeWitness ▹ ...and more 2
- 3. #whoami @r3dQu1nn ▸ Sys/Net Admin turned Red Teamer/Pen Tester ▸ Previous: ▹ IT in the Navy for 9 years ▹ Navy Red Team Technical Lead ▸ Current: ▹ Red Team Security Consultant for Mandiant ▹ PowerShell Reverse Engineer ▸ Glorified Script Kiddie/Noobie ▹ https://github.com/harleyQu1nn/AggressorScripts 3
- 4. What’s This Talk About? ▸ Automation ▸ Aggressor ▹ Event driven language ▸ Events that we might care about ▸ Assessment/Attack lifecycle ▸ Where can automation help? ▸ Demos ▸ Links 4
- 5. This is NOT About… ▸ Automating Red Teams ▸ Automating Pen Testing ▸ There’s something to be said about the human mind analyzing the problem ▹ What if an exploit fails once, but runs the second time? ▹ How does automation account for this? ▹ Can it always identify the root cause? ▸ This isn’t SKYNET for offensive work 5 https://ih1.redbubble.net/image.412212290.3664/flat,800x800,075,f.jpg
- 6. Automation What’s our expectation of it? 6
- 7. Automation ▸ Automation is useful for tasks ▹ Tasks that don’t require interaction ▹ Doesn’t need human processing ▸ At some level, we’re lazy ▹ Why manually do something if we can automate it? ▸ Trivial tasks are prime candidates ▹ Don’t require intensive analysis, if any ▸ How long will you have that initial access? ▹ Do you have the right permissions to install persistence? ▹ Can you install persistence fast enough before the victim user logs off? ▹ Automation can help us accomplish these much faster 7
- 8. Automation ▸ There are additional benefits beyond letting us sit and watch something do our job J ▸ Ensure a uniform process is always followed ▹ You can build out protection mechanisms that keep you from doing something ▸ Prevent user error ▹ Rather than fat fingering a parameter/command, automation can ensure you always run it correctly 8
- 9. Automation ▸ How can red teams/or pen testers use automation on their tests ▹ Talk is cheap – what’s an easy way to implement? ▸ Open Source ▹ Metasploit resource scripts are a good option ▸ How do we do it? ▹ We’re a Cobalt Strike shop ▹ Scripts and code we reference/release will use Aggressor 9 https://www.cobaltstrike.com/images/art/hacker_small.png
- 10. Aggressor What is it? 10
- 11. Aggressor – What is it? ▸ Aggressor is a scripting language built into Cobalt Strike ▹ Since version 3.0 ▸ It is based on the language Sleep ▸ Aggressor lets you automate operator actions, manipulate data, generate reports, etc. ▸ Aggressor isn’t a standard programming language ▹ It’s an event driven language 11 https://memegenerator.net/instance/52901150/buzz-lightyear-meme-fixd-scripts-scripts-everywhere
- 12. Event Driven Language ▸ This doesn’t generate a compiled binary which you run on a computer ▸ Rather than “starting” a program, your code is triggered when a specific event is encountered ▹ Think similar to WMI events that occur after X happens ▹ Remember IRC Bots? ▸ Aggressor is driven by events that happen while it is running ▹ These are clearly related to actions that occurs while compromising a system 12
- 13. Aggressor – The Core ▸ Aggressor is based on the language Sleep ▹ http://sleep.dashnine.org/manual/index.html ▸ Sleep is a “java-based scripting language heavily inspired by Perl” ▸ Aggressor is an additional set of exposed functions for extending Cobalt Strike and its associated functionality ▹ Extending can also mean creating automation for your requirements 13 https://www.amazon.com/gp/product/143822723X?ie=UTF8&tag=slejavscrlan- 20&linkCode=as2&camp=1789&creative=9325&creativeASIN=143822723X
- 14. Aggressor – The Core ▸ Aggressor has the ability to interact with Cobalt Strike, Beacons, and data such as: ▹ Running commands within a Beacon, interpreting results, and making a decision ▹ Interacting with downloaded screenshots or keylogged data ▹ Modify sites hosted by Cobalt Strike ▹ Interact with credentials stored on your team server ▹ Develop custom reports for your customers, and more… 14
- 15. Aggressor Scripting How can you interact with Aggressor? 15
- 16. Aggressor Scripting ▸ Aggressor scripting utilizes different functionality to enable its developers ▸ Events – Aggressor Events initiates and runs your code when a specific condition occurs ▸ Functions – Allow you to run “checks”, perform an action locally, or run a command within Beacon - this is the mechanism for performing an action ▸ Hooks – Can allow you to generate pop-up menus ▸ The Data Model – These are different data repositories that you can manipulate 16
- 17. Aggressor Events ▸ There are triggerable events for almost everything you could wish with Aggressor ▸ beacon_initial – This monitors for new beacons checking in to your team server ▸ event_join – This event occurs when a new user connects to your team server ▸ heartbeat_* - This event occurs every X seconds or minutes ▸ ssh_initial – As new ssh connections check in, this event will fire 17
- 18. Aggressor Events ▸ Remember how your DNS beacons first check in, but with no data? ▸ beacon_initial_empty – This event triggers when the team server receives an empty beacon ▸ One of the first things people may do is type “checkin” and/or set the “mode” ▹ Save yourself the step! 18 https://lh4.googleusercontent.com/TJdG-5- 4YzBK9MuoaiNqO5k1gaCRtBZ181KXNb1pvLZbWTj6N1Hi-T9GcHWuwOIQNpvekw0swJ0D- mTouZMb4h0mYyNe0GRFqRuF-SwfM42u7n5TPLi0cuwsENqPB4zVSa0ioprJ
- 19. Aggressor Events ▸ Events expose access to different objects depending on the event ▹ beacon_initial – This will provide a handle into the individual beacon checking in ▹ This is how you can have an individual beacon perform an action ▹ Heartbeat_* - exposes nothing, but you can use a function to iterate over all beacons ▹ This provides you access to them 19
- 20. Aggressor Events ▸ There are a large number of events that you can use to trigger your code ▸ Events are available here - https://www.cobaltstrike.com/aggressor- script/events.html ▸ You can’t create your own custom events ▹ This part isn’t user-expandable ▸ However, you can always ask if you can think of a useful trigger 20
- 21. Aggressor Functions ▸ Functions are the “code” associated with your Aggressor Script ▸ Functions dictate the actions that you will perform once your trigger is activated ▸ Your code isn’t limited to what you see listed on the Aggressor function page ▸ Aggressor is based on Sleep, right? ▸ Your code will likely be a combination of Aggressor and Sleep 21
- 22. Aggressor Functions ▸ Functions include essentially every action that you can conduct within Beacon ▹ bpowershell_import – Imports a PowerShell script within a beacon ▹ bps – Performs a process listing on the targeted beacon ▹ blogonpasswords – Runs the mimikatz logonpasswords command ▹ bls – Lists all files in a specific directory ▹ bsetenv – Sets an environmental variable on the current beacon 22
- 23. Aggressor Functions ▸ It also includes “metafunctions” with interact and provide results based on Beacon metadata ▹ -is64 – This function will return true if the Beacon is running in a x64 process ▹ -isadmin – This returns true if the Beacon is running with admin rights ▹ -isssh – This returns true if the active session is a SSH session 23
- 24. Aggressor Functions ▸ You also have the ability to interact with Cobalt Strike (rather than Beacon) and manipulate data through Aggressor ▹ gzip – Gzip a string ▹ Base64_decode – Base64 decode a string ▹ openfilebrowser – Opens the file browser interface for a beacon ▹ openScreenshotBrowser – Opens the screenshot tab ▹ str_encode – Encodes a string in the specified encoding format 24
- 25. Aggressor Sample ▸ Let’s piece some of this together in a sample scenario ▸ You’ve compromised a Windows jump-box used by admins/users ▸ You were able to escalate privileges ▸ You’re interested in capturing passwords from users regularly logging in to the system ▸ How can Aggressor help? 25
- 26. 26
- 27. 27
- 28. 28
- 29. 29
- 30. 30
- 31. 31
- 32. 32
- 33. 33
- 34. Applied Automation – A Phishing Tale What steps can leverage automation? 34
- 35. A Phishing Tale ▸ What’s likely the most prevalent method of gaining access into an environment? ▸ Phishing! ▸ This is a time intensive process ▹ Generally requires developing a scenario for your customer ▹ Writing custom malware for your customer and scenario ▹ Developing domain reputation ▹ Etc. 35 http://2.bp.blogspot.com/_3zyldbmlRcQ/SFHr8lUkWpI/AAAAAAAAACg/KOLMVHuSY- g/s320/_40998639_net_phishingcartoon203.gif
- 36. A Phishing Tale ▸ Eventually, you’ve fired your first salvo and have started phishing ▸ If you’re lucky, your first target opens your e-mail and runs your malware ▸ However, this isn’t always the case ▹ It might take a few people ▹ If you’re sending every 15-30 minutes, time adds up ▸ What if you go grab a drink, are watching a different screen, etc. ▹ Do you see your incoming Beacon? 36https://i.pinimg.com/736x/7a/23/fb/7a23fb0506b89f26b01734d6f2ca499d--cartoons.jpg
- 37. A Phishing Tale ▸ One of the worst feelings can be coming back to your system and seeing you missed a callback ▸ It’s also great to know right when your Beacon arrives ▸ Aggressor can help ▹ Let’s look into the correct trigger ▹ There’s publicly available code that sends text messages via e-mail ▹ Sleep can let us run an existing script 37https://i.pinimg.com/736x/82/dc/f8/82dcf869638e2e912822cb51aafdc3bb--stupid-stuff-nerd-stuff.jpg
- 38. 38
- 39. 39
- 40. 40
- 41. 41
- 42. 42
- 43. 43
- 44. 44
- 45. 45
- 46. 46
- 47. 47
- 48. Applied Automation – Endpoint Protection What steps can leverage automation? 48
- 49. Identifying EDR ▸ Now that we’ve been alerted to our beacon, we might want to recon it ▸ What sort of data are we interested in? ▹ Sky’s the limit ▹ Network Connections/Interfaces ▹ Mapped Drives ▹ Local Admin Rights ▹ Etc. ▸ What about end point protection software/defenses and its settings? 49
- 50. Identifying EDR ▸ Most EDR products install minifilter drivers/.sys files ▸ Installed to %SystemRoot%System32drivers or %SystemRoot%System32DriverStoreFileRepository ▹ Minifilter altitudes are allocated by Microsoft and are publicly listed ▹ https://docs.microsoft.com/en-us/windows- hardware/drivers/ifs/allocated-altitudes ▹ This document associates minifilter drivers with vendor names 50
- 51. Identifying EDR ▸ Why is this important and how can we use this? ▹ If the EDR product is not using the cloud based option we can identify the minifilter driver and match it to the company name ▹ This process can be automated using Aggressor ▹ Gives Red Teamers awareness of what they are up against before executing commands ▸ How can this be automated? ▹ Cobalt Strike's Beacon has a built-in 'ls' command we can use ▹ This built-in 'ls' command uses Win32 API's to list a directory (more stealthy than using dir or powershell) 51
- 52. Identifying EDR ▸ Does the built-in 'ls' command have documentation?? ▹ https://www.cobaltstrike.com/aggressor- script/functions.html#bls 52
- 53. Identifying EDR ▸ List out the driver directories and parse the results with conditional statements to determine what EDR is present ▹ Define a static array of .sys files ▹ Store the 'ls' command results in an array ▹ Parse the results array and do exact matching to determine the proper vendor information ▹ Profit ▸ We can also identify other AV products and Admin Tools present using the 'ps' built-in beacon command and matching on the process name 53
- 58. 58
- 59. 59
- 60. Applied Automation – Persistence What steps can leverage automation? 60
- 61. Persisting ▸ We’ve found minimal EDR software, or exclusions which we can exploit to maintain access ▸ Persistence might be the next step we want to take (depending on previous results) ▸ Automating persistence is something we hesitate on doing ▸ Let’s have this be a combination of manual analysis and Aggressor 61
- 62. Persisting ▸ There’s a couple different ways to persist depending on the level of access ▹ Registry Key ▹ Scheduled Task ▹ WMI Persistence ▸ Rather than doing this all from the command line, let’s generate a pop-up for ease of use! 62
- 63. 63
- 64. 64
- 65. 65
- 66. 66
- 67. 67
- 68. 68
- 69. 69
- 70. 70
- 76. 76
- 77. 77
- 78. Applied Automation – Generating Payloads What steps can leverage automation? 78
- 79. Generating Payloads ▸ Payload generation is another crucial step in Red Team engagements and are used for many different reasons ▹ Initial Access ▹ Lateral Movement ▹ Persistence ▹ Obfuscation/Encoding/AWL Bypass ▸ Beneficial for Blue Team as well! ▹ Signature based identifiers/IOCs ▹ Test detection capabilities ▹ Payload sizes/types 79
- 80. Generating Payloads ▸ What types of payloads can we generate? ▹ HTTP ▹ HTTPS ▹ SMB ▹ DNS ▸ How do they work and how are they generated? ▹ Staged vs Stageless (S) ▹ Based off listener information, malleable profile, architecture selection (x64/x86) ▹ Attacks -> Packages menu options 80
- 81. Generating Payloads ▸ How can we automate payload generation using Aggressor? ▹ Utilize dialog API with drow_listener ▹ artifact/artifact_stageless functions 81 https://www.cobaltstrike.com/aggressor-script/functions.html#dialog
- 82. Generating Payloads 82 https://www.cobaltstrike.com/aggressor-script/functions.html#drow_listener
- 84. 84
- 85. 85
- 86. 86
- 87. Applied Automation – Lateral Movement What steps can leverage automation? 87
- 88. Lateral Movement ▸ Lateral movement is a vital part of every engagement and can be approached in different ways ▹ What value can we add if we show successful pivoting inside a network? ▹ 9 times out of 10 we need to move laterally to accomplish our objectives ▸ Can we automate this methodology? ▹ How can we use Aggressor Scripts to enhance lateral movement? 88
- 89. Lateral Movement ▸ Built-in methods of lateral movement inside of beacon ▹ wmi ▹ psexec/psexec_psh ▹ winrm ▸ All of these methods invoke a PowerShell one-liner based on the listener selection ▹ Good for quick and easy lateral movement ▹ Bad for staying stealthy and avoiding the use of PowerShell/PsExec 89
- 90. Lateral Movement ▸ Let's use Aggressor to build out a newer technique of Lateral Movement ▸ Focus on using unmanaged powershell with msbuild ▸ Set global variables to help generate the xml file ▸ Functions that we need to utilize: ▹ alias ▹ beacon_command_register ▹ bupload_raw ▹ bpowerpick ▹ exec 90
- 92. Lateral Movement ▸ Building out our alias commands with beacon_command_register ▹ remote_msbuild_script ▹ remote_msbuild_cmd 92
- 99. Lateral Movement ▸ Let's run through the other alias command (remote_msbuild_cmd) and use similar code with minor differences 99
- 100. Lateral Movement 100
- 101. Lateral Movement 101
- 102. 102
- 103. Applied Automation – Report Generation What steps can leverage automation? 103
- 104. Reporting ▸ Reporting is part of every assessment and it should be done right ▹ What value are we if we can hack our customers but can’t convey what we did, risk remediations, etc? ▸ There are steps you can take to make reporting more efficient ▹ Develop approved finding language ▹ Develop reporting templates ▹ Automate generating commonly requested information 104
- 105. Reporting ▸ Let’s tackle that last bullet point ▹ Automate generating commonly requested information ▸ What’s something that our customers ALWAYS ask? ▹ What computers were compromised? ▹ What accounts were compromised? ▸ Let’s create a report generating function which captures this information! 105 https://vignette.wikia.nocookie.net/cryptidz/images/c/c6/Why_Not_Zoidberg.jpg/revision/latest?cb =20160219063637
- 106. 106
- 107. 107
- 108. 108
- 109. Where to get this? ▸ We just covered a lot of different code ▸ Aggregate everything within a central repo ▹ This is not all our code ▹ It’s some of the scripts we use the most in one area ▸ https://github.com/FortyNorthSecurity/Aggressor Assessor ▹ Get all of the code here! 109
- 110. ▸ Aggregate everything within a central repo ▹ This is not all our code ▹ It’s some of the scripts we use the most in one area ▸ https://github.com/FortyNorthSecurity/AggressorAsses sor ▹ Get all of the code here! @ChrisTruncer ▹ https://www.fortynorthsecurity.com @ r3dQu1nn ▹ https://github.com/harleyQu1nn/AggressorScripts 110 Thanks!