SlideShare a Scribd company logo

Red Team Apocalypse

•Download as PPTX, PDF•
•
Beau Bullock
Beau Bullock

TABLETOP SCENARIO: Your organization regularly patches, uses application whitelisting, has NextGen-NG™ firewalls/IDS’s, and has the latest Cyber-APT-Trapping-Blinky-Box™. You were just made aware that your entire customer database was found being sold on the dark web. Go. Putting too much trust in security products alone can be the downfall of an organization. In the 2015 BSides Tampa talk “Pentest Apocalypse” Beau discussed 10 different pentesting techniques that allow attackers to easily compromise an organization. These techniques still work for many organizations but occasionally more advanced tactics and techniques are required. This talk will continue where “Pentest Apocalypse” left off and demonstrate a number of red team techniques that organizations need to be aware of in order to prevent a “Red Team Apocalypse” as described in the tabletop scenario above.

1 of 40
© Black Hills Information Security | @BHInfoSecurity Red Team Apocalypse Derek Banks (@0xderuke) Beau Bullock (@dafthack)
© Black Hills Information Security | @BHInfoSecurity About • Your organization has a vulnerability management program and regularly patches • You implemented application whitelisting and network egress controls • The latest round of pen testers didn’t find anything too concerning • You have the latest Cyber Anti APT Blinky box appliance • Your organization’s critical database is being sold on the dark web. • What happened?!
© Black Hills Information Security | @BHInfoSecurity About Us • Pentesters at Black Hills Information Security • Have a number of SANS, OffSec, and other certs… • CitySec Meetup Organizers • CigarCitySec – (Tampa, FL) • CitrusSec – (Orlando, FL • TidewaterSec – (Hampton, VA) • Tradecraft Security Weekly and Hacker Dialogues podcasts • Avid OWA enthusiasts
© Black Hills Information Security | @BHInfoSecurity Original Pentest Apocalypse • Vulnerability Management Program • Group Policy Preferences • Widespread Local Administrator Account • Weak Passwords (Password Spraying) • Over Privileged Users • Sensitive Data in File Shares • Intranet Information Disclosure • NetBios and LLMNR Poisoning • Local Workstation Privilege Escalation
© Black Hills Information Security | @BHInfoSecurity Red Team vs Pen Test • Penetration test goals tend to be find as many vulnerabilities in the allotted time • Use COTS tools automated tools like vulnerability scanners • Generally not concerned with alerting the blue team • Red teams engagements model real world adversaries and are focused on achieving a goal • May use custom written malware and tools • Generally attempt to be stealthy and not alert the blue team
© Black Hills Information Security | @BHInfoSecurity Red Team Methodology • Reconnaissance • Compromise • Persistence • Command and Control • Asset Discovery • Privilege Escalation • Lateral Movement • Actions on Objectives
© Black Hills Information Security | @BHInfoSecurity Calendar Event Injection
© Black Hills Information Security | @BHInfoSecurity Google Calendar Event Injection • Silently inject events into calendars • Creates urgency via reminders • Include a link to a fake agenda • An email isn’t necessary, simply add a Google user to an event and select checkbox to not notify them • Google will automatically add it to their calendar • This presents a unique phishing situation
© Black Hills Information Security | @BHInfoSecurity Google Calendar Event Injection • A few ideas: • Include a link to a conference call site but have it pointing to a credential collection page • Include a malicious “agenda” • Have victims navigate to a fake Google Auth page and collect creds • Gets more fun with Google API • It’s possible to make it look like they already accepted the invite! • This completely bypasses the setting in G-calendar for not auto-adding events. •
© Black Hills Information Security | @BHInfoSecurity Email Attacks
© Black Hills Information Security | @BHInfoSecurity Business Email Capture • Externally accessible email portals are a target • Even if they are 2FA • OWA I’m looking at you • Cloud services are a target too (Gmail, O365, etc.) • Pen testers may overlook email systems as a target • Threat actors (and Red Teamers) do not • Email is a huge resource for an attacker to learn more about your environment
© Black Hills Information Security | @BHInfoSecurity Business Email Capture • MailSniper • https://github.com/dafthack/MailSniper • Domain / Username enumeration • Password Spraying • GAL Download • Open Inbox delegation discovery • Email searching for terms like passwords, 2FA codes, etc… • Bypasses some 2FA products by connecting to EWS instead of OWA •
© Black Hills Information Security | @BHInfoSecurity Unicode Domain Names
© Black Hills Information Security | @BHInfoSecurity Unicode Domain Names • Use of domain names that include unicode characters such as letters with a dot (.) under them like: ṇ • Creates a really great look-alike domain for phishing • The dot gets completely hidden when hyperlinked with a line underneath • Gotta be careful with some spam filters though
© Black Hills Information Security | @BHInfoSecurity Expired Categorized Domains
© Black Hills Information Security | @BHInfoSecurity Expired Categorized Domains • Technique used to circumvent categorization web proxy blocks for C2 • Uses previous categorization for some length of time • Trivial to find • expireddomains.net • Domainhunter.py • Simulates using a compromised 3rd party website
© Black Hills Information Security | @BHInfoSecurity Domain Fronting
© Black Hills Information Security | @BHInfoSecurity Domain Fronting • Another technique used to circumvent web proxy restrictions for C2 • Hides the true endpoint of an HTTP connection • Initial target domain for the traffic redirects to secondary host • Can use a Content Delivery Network such as AWS Cloudfront •Can be difficult to detect and block
© Black Hills Information Security | @BHInfoSecurity Domain Fronting
© Black Hills Information Security | @BHInfoSecurity Hashes Just Want to Be Cracked
© Black Hills Information Security | @BHInfoSecurity Kerberoasting • Ability for any domain user to query the domain for a Service Principal Name for an account associated with running a service • A request to authenticate over Kerberos results in a service ticket where a portion is encrypted with the service account hash • Effectively any domain user can get a hash of a service account with an SPN and take the resulting ticket offline and attempt to crack it
© Black Hills Information Security | @BHInfoSecurity Evil Twin Wireless Attack • Evil Wireless AP that uses the same ESSID as the target AP • Goal is to trick a user into joining the evil AP and gather the NetNTLMv2 hash from the authentication attempt • Eaphammer from s0lst1c3 • https://github.com/s0lst1c3/eaphammer • Hostapd-wpe • https://github.com/OpenSecurityResearch/ hostapd-wpe • Aircrack suite
© Black Hills Information Security | @BHInfoSecurity Weaponized LNK File • Place shortcut file located on a commonly used public share • Icon for shortcut points back a UNC location on attacker system • SMB Listener on attacker controlled system • Can use Inveigh for the listener • https://github.com/Kevin- Robertson/Inveigh • Gather NetNTLMv2 hashes
© Black Hills Information Security | @BHInfoSecurity Onsite Attacks
© Black Hills Information Security | @BHInfoSecurity NAC Bypass • Spoof another device • Find a printer or VOIP phone; Spoof MAC and/or IP • Voiphopper to hop VLAN’s • For Wi-Fi NAC spoof MAC and User Agent of connected device • Layer 2 and 3 NAT device • Helps avoid triggering port security rules on 802.1X • Device spoofs both sides of wire • Passively learns MAC addresses
© Black Hills Information Security | @BHInfoSecurity Dropbox • Fully functional pentesting device to leave at onsite • Persistent reverse SSH tunnels • Can be controlled over WiFi • Relatively unnoticeable • ODROID-C2 build instructions here: • https://www.blackhillsinfosec.com/how-to- build-your-own-penetration-testing-drop- box/
© Black Hills Information Security | @BHInfoSecurity PXE Booting Attacks • Obtain the “Golden” image from the network • Set VM to “Boot from network”, boot VM, and get the image • Mount image & profit • Steal Admin hashes • Set local admin pass pre-boot • Overwrite Sticky keys (sethc.exe)
© Black Hills Information Security | @BHInfoSecurity Post Exploitation
© Black Hills Information Security | @BHInfoSecurity PowerUp SQL • PowerShell tool for attacking MSSQL • https://github.com/NetSPI/PowerUpSQL • SQL Server discovery • Weak configuration auditing • Privilege escalation • Data sample searches • OS command injection • All at scale across the enterprise
© Black Hills Information Security | @BHInfoSecurity Living off the Land • Using built in Windows tools to avoid dropping malware • Internal user and group recon • Remote file listing and copying data • Remote process spawning • Lateral movement
© Black Hills Information Security | @BHInfoSecurity Living of the Land • Net commands • net groups “DOMAIN ADMINS” /DOMAIN • Listing files on remote hosts • dir hostC$files • WinRM to run remote commands (port 5985) • Invoke-Command -ComputerName -ScriptBlock {Command Here}
© Black Hills Information Security | @BHInfoSecurity Stealthy Host/Domain Enumeration • More and more AV, behavioral analysis, app whitelisting, etc. products are starting to either block or alert on built-in system commands • Ex. net, ipconfig, whoami, netstat, etc. • HostRecon PowerShell instead of built- in commands • https://github.com/dafthack/HostRecon • Combine with PowerShell Without PowerShell technique for added bonus
© Black Hills Information Security | @BHInfoSecurity Detection and Prevention
© Black Hills Information Security | @BHInfoSecurity Solid Systems Administration • Systems and software inventory (yes, CSC Top 20 are useful) • Workstations should never talk to workstations - client to server communication only • Windows firewall or Private VLANS • Baseline images with GPO enforcement • All inbound and outbound network traffic go through an application proxy system • Any exceptions for direct outbound communication are by documented exception only •
© Black Hills Information Security | @BHInfoSecurity Enforce Good User Behavior • Change every inbound email subject line with a tag such as (External): • Inform your users that any email with that tag needs extra scrutiny • Minimum of 15 characters for any domain account password • If you have to compromise to sell it to the business, no complexity requirements and 6 month change interval • Consider additional credential defenses • Commercial offerings available • CredDefense Toolkit for Free • https://github.com/creddefense
© Black Hills Information Security | @BHInfoSecurity Host Log Consolidation • Consolidate key logs from endpoints, servers, and appliances to a central location • Specifically monitor PowerShell and process execution • Sysmon a powerful and free option for gaining insight into host based activity • Once the logging foundation is in place, alert on “abnormal commands” like net commands • Can be done on the cheap: • https://www.blackhillsinfosec.com/end-point-log-consolidation-windows- event-forwarder/
© Black Hills Information Security | @BHInfoSecurity Network Logging • NetFlow, Bro, or Full Packet Capture? • Depends on your budget and staff capabilities • Bro is a good balance between NetFlow 5-Tuple and Full Packet Capture mass storage requirements • Out of the box captures common protocols into text based files • Can provide an amount of visibility into SSL traffic without breaking SSL • Abnormal certificate information • SSL fingerprinting - JA3 project - https://github.com/salesforce/ja3 • Beacon detection with RITA (AIHunt) • https://www.blackhillsinfosec.com/projects/rita/
© Black Hills Information Security | @BHInfoSecurity Red Team Prepper • Don’t wait on the Red Team prepare on your own • Use @vysecurity’s Red Team Tips to find techniques to try to detect • https://github.com/vysec/RedTips • MITRE ATT&CK Framework for threat actor techniques • https://attack.mitre.org/wiki/Main_Page • Red Canary’s Atomic Red Team - portable scripts to test ATT&CK framework • https://github.com/redcanaryco/atomic-red-team
© Black Hills Information Security | @BHInfoSecurity About that Bypass Technique • Recently some products have been getting a little better… • But they still seem to be getting better at catching pen testers and common tools • And then sometimes its just stupid simple to get past a well known security product
© Black Hills Information Security | @BHInfoSecurity Summary and Conclusions • Black Hills Information Security • http://www.blackhillsinfosec.com • @BHInfoSecurity • Beau Bullock @dafthack • Derek Banks @deruke • Questions?

Recommended

Red teaming probably isn't for you
Red teaming probably isn't for youRed teaming probably isn't for you
Red teaming probably isn't for you
Toby Kohlenberg
 
Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]
RootedCON
 
The ATT&CK Philharmonic
The ATT&CK PhilharmonicThe ATT&CK Philharmonic
The ATT&CK Philharmonic
MITRE ATT&CK
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
Sunny Neo
 
Penetration testing reporting and methodology
Penetration testing reporting and methodologyPenetration testing reporting and methodology
Penetration testing reporting and methodology
Rashad Aliyev
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
Teymur Kheirkhabarov
 
Malware analysis using volatility
Malware analysis using volatilityMalware analysis using volatility
Malware analysis using volatilityYashashree Gund
 
XSS Magic tricks
XSS Magic tricksXSS Magic tricks
XSS Magic tricks
GarethHeyes
 

Recommended

Red teaming probably isn't for you
Red teaming probably isn't for youRed teaming probably isn't for you
Red teaming probably isn't for you
Toby Kohlenberg
 
Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]
RootedCON
 
The ATT&CK Philharmonic
The ATT&CK PhilharmonicThe ATT&CK Philharmonic
The ATT&CK Philharmonic
MITRE ATT&CK
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
Sunny Neo
 
Penetration testing reporting and methodology
Penetration testing reporting and methodologyPenetration testing reporting and methodology
Penetration testing reporting and methodology
Rashad Aliyev
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
Teymur Kheirkhabarov
 
Malware analysis using volatility
Malware analysis using volatilityMalware analysis using volatility
Malware analysis using volatilityYashashree Gund
 
XSS Magic tricks
XSS Magic tricksXSS Magic tricks
XSS Magic tricks
GarethHeyes
 
OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014
OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014
OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014
Leonardo Nve Egea
 
Basic Malware Analysis
Basic Malware AnalysisBasic Malware Analysis
Basic Malware Analysis
Albert Hui
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
Andrew McNicol
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
Sergey Soldatov
 
Pwning the Enterprise With PowerShell
Pwning the Enterprise With PowerShellPwning the Enterprise With PowerShell
Pwning the Enterprise With PowerShell
Beau Bullock
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)
ENOInstitute
 
Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...
Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...
Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...
Sam Bowne
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
Teymur Kheirkhabarov
 
seminar report on Sql injection
seminar report on Sql injectionseminar report on Sql injection
seminar report on Sql injection
Jawhar Ali
 
PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)
Will Schroeder
 
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
Michael Gough
 
Fidelis Endpoint® - Live Demonstration
Fidelis Endpoint® - Live Demonstration Fidelis Endpoint® - Live Demonstration
Fidelis Endpoint® - Live Demonstration
Fidelis Cybersecurity
 
Hashicorp Vault: Open Source Secrets Management at #OPEN18
Hashicorp Vault: Open Source Secrets Management at #OPEN18Hashicorp Vault: Open Source Secrets Management at #OPEN18
Hashicorp Vault: Open Source Secrets Management at #OPEN18
Kangaroot
 
I hunt sys admins 2.0
I hunt sys admins 2.0I hunt sys admins 2.0
I hunt sys admins 2.0
Will Schroeder
 
OWASP A4 XML External Entities (XXE)
OWASP A4 XML External Entities (XXE)OWASP A4 XML External Entities (XXE)
OWASP A4 XML External Entities (XXE)
Michael Furman
 
Ch 5: Bypassing Client-Side Controls
Ch 5: Bypassing Client-Side ControlsCh 5: Bypassing Client-Side Controls
Ch 5: Bypassing Client-Side Controls
Sam Bowne
 
Thick Client Penetration Testing.pdf
Thick Client Penetration Testing.pdfThick Client Penetration Testing.pdf
Thick Client Penetration Testing.pdf
SouvikRoy114738
 
Threat Hunting with Elastic at SpectorOps: Welcome to HELK
Threat Hunting with Elastic at SpectorOps: Welcome to HELKThreat Hunting with Elastic at SpectorOps: Welcome to HELK
Threat Hunting with Elastic at SpectorOps: Welcome to HELK
Elasticsearch
 
Source Code Analysis with SAST
Source Code Analysis with SASTSource Code Analysis with SAST
Source Code Analysis with SAST
Blueinfy Solutions
 
Sticky Keys to the Kingdom
Sticky Keys to the KingdomSticky Keys to the Kingdom
Sticky Keys to the Kingdom
Dennis Maldonado
 
Red Team Apocalypse (RVAsec Edition)
Red Team Apocalypse (RVAsec Edition)Red Team Apocalypse (RVAsec Edition)
Red Team Apocalypse (RVAsec Edition)
Beau Bullock
 
Covert Attack Mystery Box: A few novel techniques for exploiting Microsoft “f...
Covert Attack Mystery Box: A few novel techniques for exploiting Microsoft “f...Covert Attack Mystery Box: A few novel techniques for exploiting Microsoft “f...
Covert Attack Mystery Box: A few novel techniques for exploiting Microsoft “f...
Beau Bullock
 

More Related Content

What's hot

OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014
OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014
OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014
Leonardo Nve Egea
 
Basic Malware Analysis
Basic Malware AnalysisBasic Malware Analysis
Basic Malware Analysis
Albert Hui
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
Andrew McNicol
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
Sergey Soldatov
 
Pwning the Enterprise With PowerShell
Pwning the Enterprise With PowerShellPwning the Enterprise With PowerShell
Pwning the Enterprise With PowerShell
Beau Bullock
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)
ENOInstitute
 
Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...
Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...
Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...
Sam Bowne
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
Teymur Kheirkhabarov
 
seminar report on Sql injection
seminar report on Sql injectionseminar report on Sql injection
seminar report on Sql injection
Jawhar Ali
 
PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)
Will Schroeder
 
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
Michael Gough
 
Fidelis Endpoint® - Live Demonstration
Fidelis Endpoint® - Live Demonstration Fidelis Endpoint® - Live Demonstration
Fidelis Endpoint® - Live Demonstration
Fidelis Cybersecurity
 
Hashicorp Vault: Open Source Secrets Management at #OPEN18
Hashicorp Vault: Open Source Secrets Management at #OPEN18Hashicorp Vault: Open Source Secrets Management at #OPEN18
Hashicorp Vault: Open Source Secrets Management at #OPEN18
Kangaroot
 
I hunt sys admins 2.0
I hunt sys admins 2.0I hunt sys admins 2.0
I hunt sys admins 2.0
Will Schroeder
 
OWASP A4 XML External Entities (XXE)
OWASP A4 XML External Entities (XXE)OWASP A4 XML External Entities (XXE)
OWASP A4 XML External Entities (XXE)
Michael Furman
 
Ch 5: Bypassing Client-Side Controls
Ch 5: Bypassing Client-Side ControlsCh 5: Bypassing Client-Side Controls
Ch 5: Bypassing Client-Side Controls
Sam Bowne
 
Thick Client Penetration Testing.pdf
Thick Client Penetration Testing.pdfThick Client Penetration Testing.pdf
Thick Client Penetration Testing.pdf
SouvikRoy114738
 
Threat Hunting with Elastic at SpectorOps: Welcome to HELK
Threat Hunting with Elastic at SpectorOps: Welcome to HELKThreat Hunting with Elastic at SpectorOps: Welcome to HELK
Threat Hunting with Elastic at SpectorOps: Welcome to HELK
Elasticsearch
 
Source Code Analysis with SAST
Source Code Analysis with SASTSource Code Analysis with SAST
Source Code Analysis with SAST
Blueinfy Solutions
 
Sticky Keys to the Kingdom
Sticky Keys to the KingdomSticky Keys to the Kingdom
Sticky Keys to the Kingdom
Dennis Maldonado
 

What's hot (20)

OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014
OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014
OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014
 
Basic Malware Analysis
Basic Malware AnalysisBasic Malware Analysis
Basic Malware Analysis
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
 
Pwning the Enterprise With PowerShell
Pwning the Enterprise With PowerShellPwning the Enterprise With PowerShell
Pwning the Enterprise With PowerShell
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)
 
Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...
Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...
Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
 
seminar report on Sql injection
seminar report on Sql injectionseminar report on Sql injection
seminar report on Sql injection
 
PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)
 
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
 
Fidelis Endpoint® - Live Demonstration
Fidelis Endpoint® - Live Demonstration Fidelis Endpoint® - Live Demonstration
Fidelis Endpoint® - Live Demonstration
 
Hashicorp Vault: Open Source Secrets Management at #OPEN18
Hashicorp Vault: Open Source Secrets Management at #OPEN18Hashicorp Vault: Open Source Secrets Management at #OPEN18
Hashicorp Vault: Open Source Secrets Management at #OPEN18
 
I hunt sys admins 2.0
I hunt sys admins 2.0I hunt sys admins 2.0
I hunt sys admins 2.0
 
OWASP A4 XML External Entities (XXE)
OWASP A4 XML External Entities (XXE)OWASP A4 XML External Entities (XXE)
OWASP A4 XML External Entities (XXE)
 
Ch 5: Bypassing Client-Side Controls
Ch 5: Bypassing Client-Side ControlsCh 5: Bypassing Client-Side Controls
Ch 5: Bypassing Client-Side Controls
 
Thick Client Penetration Testing.pdf
Thick Client Penetration Testing.pdfThick Client Penetration Testing.pdf
Thick Client Penetration Testing.pdf
 
Threat Hunting with Elastic at SpectorOps: Welcome to HELK
Threat Hunting with Elastic at SpectorOps: Welcome to HELKThreat Hunting with Elastic at SpectorOps: Welcome to HELK
Threat Hunting with Elastic at SpectorOps: Welcome to HELK
 
Source Code Analysis with SAST
Source Code Analysis with SASTSource Code Analysis with SAST
Source Code Analysis with SAST
 
Sticky Keys to the Kingdom
Sticky Keys to the KingdomSticky Keys to the Kingdom
Sticky Keys to the Kingdom
 

Similar to Red Team Apocalypse

Red Team Apocalypse (RVAsec Edition)
Red Team Apocalypse (RVAsec Edition)Red Team Apocalypse (RVAsec Edition)
Red Team Apocalypse (RVAsec Edition)
Beau Bullock
 
Covert Attack Mystery Box: A few novel techniques for exploiting Microsoft “f...
Covert Attack Mystery Box: A few novel techniques for exploiting Microsoft “f...Covert Attack Mystery Box: A few novel techniques for exploiting Microsoft “f...
Covert Attack Mystery Box: A few novel techniques for exploiting Microsoft “f...
Beau Bullock
 
Implementing security for your library | PLAN Tech Day Conference
Implementing security for your library | PLAN Tech Day ConferenceImplementing security for your library | PLAN Tech Day Conference
Implementing security for your library | PLAN Tech Day Conference
Brian Pichman
 
Cloud Security Engineering - Tools and Techniques
Cloud Security Engineering - Tools and TechniquesCloud Security Engineering - Tools and Techniques
Cloud Security Engineering - Tools and Techniques
Gokul Alex
 
Red Team Tactics for Cracking the GSuite Perimeter
Red Team Tactics for Cracking the GSuite PerimeterRed Team Tactics for Cracking the GSuite Perimeter
Red Team Tactics for Cracking the GSuite Perimeter
Mike Felch
 
Tietoturvallisuuden_kevatseminaari_2013_Jarno_Niemela
Tietoturvallisuuden_kevatseminaari_2013_Jarno_NiemelaTietoturvallisuuden_kevatseminaari_2013_Jarno_Niemela
Tietoturvallisuuden_kevatseminaari_2013_Jarno_Niemela
Valtiokonttori / Statskontoret / State Treasury of Finland
 
Anatomy of a Cloud Hack
Anatomy of a Cloud HackAnatomy of a Cloud Hack
Anatomy of a Cloud Hack
NotSoSecure Global Services
 
BSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad GuysBSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad Guys
Joff Thyer
 
Expand Your Control of Access to IBM i Systems and Data
Expand Your Control of Access to IBM i Systems and DataExpand Your Control of Access to IBM i Systems and Data
Expand Your Control of Access to IBM i Systems and Data
Precisely
 
Controlling Access to IBM i Systems and Data
Controlling Access to IBM i Systems and DataControlling Access to IBM i Systems and Data
Controlling Access to IBM i Systems and Data
Precisely
 
Secure your web app presentation
Secure your web app presentationSecure your web app presentation
Secure your web app presentation
Frans Lytzen
 
OK Google, How Do I Red Team GSuite?
OK Google, How Do I Red Team GSuite?OK Google, How Do I Red Team GSuite?
OK Google, How Do I Red Team GSuite?
Beau Bullock
 
KCD Munich 2022: How to Prevent Your Kubernetes Cluster From Being Hacked
KCD Munich 2022: How to Prevent Your Kubernetes Cluster From Being HackedKCD Munich 2022: How to Prevent Your Kubernetes Cluster From Being Hacked
KCD Munich 2022: How to Prevent Your Kubernetes Cluster From Being Hacked
Nico Meisenzahl
 
How to Prevent Your Kubernetes Cluster From Being Hacked
How to Prevent Your Kubernetes Cluster From Being HackedHow to Prevent Your Kubernetes Cluster From Being Hacked
How to Prevent Your Kubernetes Cluster From Being Hacked
Nico Meisenzahl
 
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Denim Group
 
Container Days: Hijack a Kubernetes Cluster - a Walkthrough
Container Days: Hijack a Kubernetes Cluster - a WalkthroughContainer Days: Hijack a Kubernetes Cluster - a Walkthrough
Container Days: Hijack a Kubernetes Cluster - a Walkthrough
Nico Meisenzahl
 
Shiny, Let’s Be Bad Guys: Exploiting and Mitigating the Top 10 Web App Vulner...
Shiny, Let’s Be Bad Guys: Exploiting and Mitigating the Top 10 Web App Vulner...Shiny, Let’s Be Bad Guys: Exploiting and Mitigating the Top 10 Web App Vulner...
Shiny, Let’s Be Bad Guys: Exploiting and Mitigating the Top 10 Web App Vulner...Michael Pirnat
 
What Does a Full Featured Security Strategy Look Like?
What Does a Full Featured Security Strategy Look Like?What Does a Full Featured Security Strategy Look Like?
What Does a Full Featured Security Strategy Look Like?
Precisely
 
Hijack a Kubernetes Cluster - a Walkthrough
Hijack a Kubernetes Cluster - a WalkthroughHijack a Kubernetes Cluster - a Walkthrough
Hijack a Kubernetes Cluster - a Walkthrough
Nico Meisenzahl
 
Android attacks
Android attacksAndroid attacks
Android attacks
Blueinfy Solutions
 

Similar to Red Team Apocalypse (20)

Red Team Apocalypse (RVAsec Edition)
Red Team Apocalypse (RVAsec Edition)Red Team Apocalypse (RVAsec Edition)
Red Team Apocalypse (RVAsec Edition)
 
Covert Attack Mystery Box: A few novel techniques for exploiting Microsoft “f...
Covert Attack Mystery Box: A few novel techniques for exploiting Microsoft “f...Covert Attack Mystery Box: A few novel techniques for exploiting Microsoft “f...
Covert Attack Mystery Box: A few novel techniques for exploiting Microsoft “f...
 
Implementing security for your library | PLAN Tech Day Conference
Implementing security for your library | PLAN Tech Day ConferenceImplementing security for your library | PLAN Tech Day Conference
Implementing security for your library | PLAN Tech Day Conference
 
Cloud Security Engineering - Tools and Techniques
Cloud Security Engineering - Tools and TechniquesCloud Security Engineering - Tools and Techniques
Cloud Security Engineering - Tools and Techniques
 
Red Team Tactics for Cracking the GSuite Perimeter
Red Team Tactics for Cracking the GSuite PerimeterRed Team Tactics for Cracking the GSuite Perimeter
Red Team Tactics for Cracking the GSuite Perimeter
 
Tietoturvallisuuden_kevatseminaari_2013_Jarno_Niemela
Tietoturvallisuuden_kevatseminaari_2013_Jarno_NiemelaTietoturvallisuuden_kevatseminaari_2013_Jarno_Niemela
Tietoturvallisuuden_kevatseminaari_2013_Jarno_Niemela
 
Anatomy of a Cloud Hack
Anatomy of a Cloud HackAnatomy of a Cloud Hack
Anatomy of a Cloud Hack
 
BSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad GuysBSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad Guys
 
Expand Your Control of Access to IBM i Systems and Data
Expand Your Control of Access to IBM i Systems and DataExpand Your Control of Access to IBM i Systems and Data
Expand Your Control of Access to IBM i Systems and Data
 
Controlling Access to IBM i Systems and Data
Controlling Access to IBM i Systems and DataControlling Access to IBM i Systems and Data
Controlling Access to IBM i Systems and Data
 
Secure your web app presentation
Secure your web app presentationSecure your web app presentation
Secure your web app presentation
 
OK Google, How Do I Red Team GSuite?
OK Google, How Do I Red Team GSuite?OK Google, How Do I Red Team GSuite?
OK Google, How Do I Red Team GSuite?
 
KCD Munich 2022: How to Prevent Your Kubernetes Cluster From Being Hacked
KCD Munich 2022: How to Prevent Your Kubernetes Cluster From Being HackedKCD Munich 2022: How to Prevent Your Kubernetes Cluster From Being Hacked
KCD Munich 2022: How to Prevent Your Kubernetes Cluster From Being Hacked
 
How to Prevent Your Kubernetes Cluster From Being Hacked
How to Prevent Your Kubernetes Cluster From Being HackedHow to Prevent Your Kubernetes Cluster From Being Hacked
How to Prevent Your Kubernetes Cluster From Being Hacked
 
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
 
Container Days: Hijack a Kubernetes Cluster - a Walkthrough
Container Days: Hijack a Kubernetes Cluster - a WalkthroughContainer Days: Hijack a Kubernetes Cluster - a Walkthrough
Container Days: Hijack a Kubernetes Cluster - a Walkthrough
 
Shiny, Let’s Be Bad Guys: Exploiting and Mitigating the Top 10 Web App Vulner...
Shiny, Let’s Be Bad Guys: Exploiting and Mitigating the Top 10 Web App Vulner...Shiny, Let’s Be Bad Guys: Exploiting and Mitigating the Top 10 Web App Vulner...
Shiny, Let’s Be Bad Guys: Exploiting and Mitigating the Top 10 Web App Vulner...
 
What Does a Full Featured Security Strategy Look Like?
What Does a Full Featured Security Strategy Look Like?What Does a Full Featured Security Strategy Look Like?
What Does a Full Featured Security Strategy Look Like?
 
Hijack a Kubernetes Cluster - a Walkthrough
Hijack a Kubernetes Cluster - a WalkthroughHijack a Kubernetes Cluster - a Walkthrough
Hijack a Kubernetes Cluster - a Walkthrough
 
Android attacks
Android attacksAndroid attacks
Android attacks
 

More from Beau Bullock

Getting Started in Blockchain Security and Smart Contract Auditing
Getting Started in Blockchain Security and Smart Contract AuditingGetting Started in Blockchain Security and Smart Contract Auditing
Getting Started in Blockchain Security and Smart Contract Auditing
Beau Bullock
 
Getting Started in Pentesting the Cloud: Azure
Getting Started in Pentesting the Cloud: AzureGetting Started in Pentesting the Cloud: Azure
Getting Started in Pentesting the Cloud: Azure
Beau Bullock
 
Weaponizing Corporate Intel: This Time, It's Personal!
Weaponizing Corporate Intel: This Time, It's Personal!Weaponizing Corporate Intel: This Time, It's Personal!
Weaponizing Corporate Intel: This Time, It's Personal!
Beau Bullock
 
Travelocalypse: It's Dangerous Business, Hacker, Going Out Your Front Door
Travelocalypse: It's Dangerous Business, Hacker, Going Out Your Front DoorTravelocalypse: It's Dangerous Business, Hacker, Going Out Your Front Door
Travelocalypse: It's Dangerous Business, Hacker, Going Out Your Front Door
Beau Bullock
 
Red Team Apocalypse - BSides Peru (En español)
Red Team Apocalypse - BSides Peru (En español)Red Team Apocalypse - BSides Peru (En español)
Red Team Apocalypse - BSides Peru (En español)
Beau Bullock
 
A Look Into Emerging Security Issues Within Cryptocurrency Ecosystems
A Look Into Emerging Security Issues Within Cryptocurrency EcosystemsA Look Into Emerging Security Issues Within Cryptocurrency Ecosystems
A Look Into Emerging Security Issues Within Cryptocurrency Ecosystems
Beau Bullock
 
A Google Event You Won't Forget
A Google Event You Won't ForgetA Google Event You Won't Forget
A Google Event You Won't Forget
Beau Bullock
 
How to Build Your Own Physical Pentesting Go-bag
How to Build Your Own Physical Pentesting Go-bagHow to Build Your Own Physical Pentesting Go-bag
How to Build Your Own Physical Pentesting Go-bag
Beau Bullock
 
Pentest Apocalypse - SANSFIRE 2016 Edition
Pentest Apocalypse - SANSFIRE 2016 EditionPentest Apocalypse - SANSFIRE 2016 Edition
Pentest Apocalypse - SANSFIRE 2016 Edition
Beau Bullock
 
Fade from Whitehat... to Black
Fade from Whitehat... to BlackFade from Whitehat... to Black
Fade from Whitehat... to Black
Beau Bullock
 
Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...
Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...
Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...
Beau Bullock
 
Pentest Apocalypse
Pentest ApocalypsePentest Apocalypse
Pentest Apocalypse
Beau Bullock
 

More from Beau Bullock (12)

Getting Started in Blockchain Security and Smart Contract Auditing
Getting Started in Blockchain Security and Smart Contract AuditingGetting Started in Blockchain Security and Smart Contract Auditing
Getting Started in Blockchain Security and Smart Contract Auditing
 
Getting Started in Pentesting the Cloud: Azure
Getting Started in Pentesting the Cloud: AzureGetting Started in Pentesting the Cloud: Azure
Getting Started in Pentesting the Cloud: Azure
 
Weaponizing Corporate Intel: This Time, It's Personal!
Weaponizing Corporate Intel: This Time, It's Personal!Weaponizing Corporate Intel: This Time, It's Personal!
Weaponizing Corporate Intel: This Time, It's Personal!
 
Travelocalypse: It's Dangerous Business, Hacker, Going Out Your Front Door
Travelocalypse: It's Dangerous Business, Hacker, Going Out Your Front DoorTravelocalypse: It's Dangerous Business, Hacker, Going Out Your Front Door
Travelocalypse: It's Dangerous Business, Hacker, Going Out Your Front Door
 
Red Team Apocalypse - BSides Peru (En español)
Red Team Apocalypse - BSides Peru (En español)Red Team Apocalypse - BSides Peru (En español)
Red Team Apocalypse - BSides Peru (En español)
 
A Look Into Emerging Security Issues Within Cryptocurrency Ecosystems
A Look Into Emerging Security Issues Within Cryptocurrency EcosystemsA Look Into Emerging Security Issues Within Cryptocurrency Ecosystems
A Look Into Emerging Security Issues Within Cryptocurrency Ecosystems
 
A Google Event You Won't Forget
A Google Event You Won't ForgetA Google Event You Won't Forget
A Google Event You Won't Forget
 
How to Build Your Own Physical Pentesting Go-bag
How to Build Your Own Physical Pentesting Go-bagHow to Build Your Own Physical Pentesting Go-bag
How to Build Your Own Physical Pentesting Go-bag
 
Pentest Apocalypse - SANSFIRE 2016 Edition
Pentest Apocalypse - SANSFIRE 2016 EditionPentest Apocalypse - SANSFIRE 2016 Edition
Pentest Apocalypse - SANSFIRE 2016 Edition
 
Fade from Whitehat... to Black
Fade from Whitehat... to BlackFade from Whitehat... to Black
Fade from Whitehat... to Black
 
Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...
Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...
Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...
 
Pentest Apocalypse
Pentest ApocalypsePentest Apocalypse
Pentest Apocalypse
 

Recently uploaded

Elevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object CalisthenicsElevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object Calisthenics
Dorra BARTAGUIZ
 
Le nuove frontiere dell'AI nell'RPA con UiPath Autopilot™
Le nuove frontiere dell'AI nell'RPA con UiPath Autopilot™Le nuove frontiere dell'AI nell'RPA con UiPath Autopilot™
Le nuove frontiere dell'AI nell'RPA con UiPath Autopilot™
UiPathCommunity
 
Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FMEEssentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
Safe Software
 
Quantum Computing: Current Landscape and the Future Role of APIs
Quantum Computing: Current Landscape and the Future Role of APIsQuantum Computing: Current Landscape and the Future Role of APIs
Quantum Computing: Current Landscape and the Future Role of APIs
Vlad Stirbu
 
Pushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 daysPushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 days
Adtran
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance
 
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
BookNet Canada
 
PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
ControlCase
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
Guy Korland
 
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
Sri Ambati
 
zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs
zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex ProofszkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs
zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs
Alex Pruden
 
Generative AI Deep Dive: Advancing from Proof of Concept to Production
Generative AI Deep Dive: Advancing from Proof of Concept to ProductionGenerative AI Deep Dive: Advancing from Proof of Concept to Production
Generative AI Deep Dive: Advancing from Proof of Concept to Production
Aggregage
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
DanBrown980551
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
James Anderson
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance
 
SAP Sapphire 2024 - ASUG301 building better apps with SAP Fiori.pdf
SAP Sapphire 2024 - ASUG301 building better apps with SAP Fiori.pdfSAP Sapphire 2024 - ASUG301 building better apps with SAP Fiori.pdf
SAP Sapphire 2024 - ASUG301 building better apps with SAP Fiori.pdf
Peter Spielvogel
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
UiPathCommunity
 
RESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for studentsRESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for students
KAMESHS29
 
A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...
sonjaschweigert1
 
Assure Contact Center Experiences for Your Customers With ThousandEyes
Assure Contact Center Experiences for Your Customers With ThousandEyesAssure Contact Center Experiences for Your Customers With ThousandEyes
Assure Contact Center Experiences for Your Customers With ThousandEyes
ThousandEyes
 

Recently uploaded (20)

Elevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object CalisthenicsElevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object Calisthenics
 
Le nuove frontiere dell'AI nell'RPA con UiPath Autopilot™
Le nuove frontiere dell'AI nell'RPA con UiPath Autopilot™Le nuove frontiere dell'AI nell'RPA con UiPath Autopilot™
Le nuove frontiere dell'AI nell'RPA con UiPath Autopilot™
 
Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FMEEssentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
 
Quantum Computing: Current Landscape and the Future Role of APIs
Quantum Computing: Current Landscape and the Future Role of APIsQuantum Computing: Current Landscape and the Future Role of APIs
Quantum Computing: Current Landscape and the Future Role of APIs
 
Pushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 daysPushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 days
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
 
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
 
PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
 
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
 
zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs
zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex ProofszkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs
zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs
 
Generative AI Deep Dive: Advancing from Proof of Concept to Production
Generative AI Deep Dive: Advancing from Proof of Concept to ProductionGenerative AI Deep Dive: Advancing from Proof of Concept to Production
Generative AI Deep Dive: Advancing from Proof of Concept to Production
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
 
SAP Sapphire 2024 - ASUG301 building better apps with SAP Fiori.pdf
SAP Sapphire 2024 - ASUG301 building better apps with SAP Fiori.pdfSAP Sapphire 2024 - ASUG301 building better apps with SAP Fiori.pdf
SAP Sapphire 2024 - ASUG301 building better apps with SAP Fiori.pdf
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
 
RESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for studentsRESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for students
 
A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...
 
Assure Contact Center Experiences for Your Customers With ThousandEyes
Assure Contact Center Experiences for Your Customers With ThousandEyesAssure Contact Center Experiences for Your Customers With ThousandEyes
Assure Contact Center Experiences for Your Customers With ThousandEyes
 

Red Team Apocalypse

  • 1. © Black Hills Information Security | @BHInfoSecurity Red Team Apocalypse Derek Banks (@0xderuke) Beau Bullock (@dafthack)
  • 2. © Black Hills Information Security | @BHInfoSecurity About • Your organization has a vulnerability management program and regularly patches • You implemented application whitelisting and network egress controls • The latest round of pen testers didn’t find anything too concerning • You have the latest Cyber Anti APT Blinky box appliance • Your organization’s critical database is being sold on the dark web. • What happened?!
  • 3. © Black Hills Information Security | @BHInfoSecurity About Us • Pentesters at Black Hills Information Security • Have a number of SANS, OffSec, and other certs… • CitySec Meetup Organizers • CigarCitySec – (Tampa, FL) • CitrusSec – (Orlando, FL • TidewaterSec – (Hampton, VA) • Tradecraft Security Weekly and Hacker Dialogues podcasts • Avid OWA enthusiasts
  • 4. © Black Hills Information Security | @BHInfoSecurity Original Pentest Apocalypse • Vulnerability Management Program • Group Policy Preferences • Widespread Local Administrator Account • Weak Passwords (Password Spraying) • Over Privileged Users • Sensitive Data in File Shares • Intranet Information Disclosure • NetBios and LLMNR Poisoning • Local Workstation Privilege Escalation
  • 5. © Black Hills Information Security | @BHInfoSecurity Red Team vs Pen Test • Penetration test goals tend to be find as many vulnerabilities in the allotted time • Use COTS tools automated tools like vulnerability scanners • Generally not concerned with alerting the blue team • Red teams engagements model real world adversaries and are focused on achieving a goal • May use custom written malware and tools • Generally attempt to be stealthy and not alert the blue team
  • 6. © Black Hills Information Security | @BHInfoSecurity Red Team Methodology • Reconnaissance • Compromise • Persistence • Command and Control • Asset Discovery • Privilege Escalation • Lateral Movement • Actions on Objectives
  • 7. © Black Hills Information Security | @BHInfoSecurity Calendar Event Injection
  • 8. © Black Hills Information Security | @BHInfoSecurity Google Calendar Event Injection • Silently inject events into calendars • Creates urgency via reminders • Include a link to a fake agenda • An email isn’t necessary, simply add a Google user to an event and select checkbox to not notify them • Google will automatically add it to their calendar • This presents a unique phishing situation
  • 9. © Black Hills Information Security | @BHInfoSecurity Google Calendar Event Injection • A few ideas: • Include a link to a conference call site but have it pointing to a credential collection page • Include a malicious “agenda” • Have victims navigate to a fake Google Auth page and collect creds • Gets more fun with Google API • It’s possible to make it look like they already accepted the invite! • This completely bypasses the setting in G-calendar for not auto-adding events. •
  • 10. © Black Hills Information Security | @BHInfoSecurity Email Attacks
  • 11. © Black Hills Information Security | @BHInfoSecurity Business Email Capture • Externally accessible email portals are a target • Even if they are 2FA • OWA I’m looking at you • Cloud services are a target too (Gmail, O365, etc.) • Pen testers may overlook email systems as a target • Threat actors (and Red Teamers) do not • Email is a huge resource for an attacker to learn more about your environment
  • 12. © Black Hills Information Security | @BHInfoSecurity Business Email Capture • MailSniper • https://github.com/dafthack/MailSniper • Domain / Username enumeration • Password Spraying • GAL Download • Open Inbox delegation discovery • Email searching for terms like passwords, 2FA codes, etc… • Bypasses some 2FA products by connecting to EWS instead of OWA •
  • 13. © Black Hills Information Security | @BHInfoSecurity Unicode Domain Names
  • 14. © Black Hills Information Security | @BHInfoSecurity Unicode Domain Names • Use of domain names that include unicode characters such as letters with a dot (.) under them like: ṇ • Creates a really great look-alike domain for phishing • The dot gets completely hidden when hyperlinked with a line underneath • Gotta be careful with some spam filters though
  • 15. © Black Hills Information Security | @BHInfoSecurity Expired Categorized Domains
  • 16. © Black Hills Information Security | @BHInfoSecurity Expired Categorized Domains • Technique used to circumvent categorization web proxy blocks for C2 • Uses previous categorization for some length of time • Trivial to find • expireddomains.net • Domainhunter.py • Simulates using a compromised 3rd party website
  • 17. © Black Hills Information Security | @BHInfoSecurity Domain Fronting
  • 18. © Black Hills Information Security | @BHInfoSecurity Domain Fronting • Another technique used to circumvent web proxy restrictions for C2 • Hides the true endpoint of an HTTP connection • Initial target domain for the traffic redirects to secondary host • Can use a Content Delivery Network such as AWS Cloudfront •Can be difficult to detect and block
  • 19. © Black Hills Information Security | @BHInfoSecurity Domain Fronting
  • 20. © Black Hills Information Security | @BHInfoSecurity Hashes Just Want to Be Cracked
  • 21. © Black Hills Information Security | @BHInfoSecurity Kerberoasting • Ability for any domain user to query the domain for a Service Principal Name for an account associated with running a service • A request to authenticate over Kerberos results in a service ticket where a portion is encrypted with the service account hash • Effectively any domain user can get a hash of a service account with an SPN and take the resulting ticket offline and attempt to crack it
  • 22. © Black Hills Information Security | @BHInfoSecurity Evil Twin Wireless Attack • Evil Wireless AP that uses the same ESSID as the target AP • Goal is to trick a user into joining the evil AP and gather the NetNTLMv2 hash from the authentication attempt • Eaphammer from s0lst1c3 • https://github.com/s0lst1c3/eaphammer • Hostapd-wpe • https://github.com/OpenSecurityResearch/ hostapd-wpe • Aircrack suite
  • 23. © Black Hills Information Security | @BHInfoSecurity Weaponized LNK File • Place shortcut file located on a commonly used public share • Icon for shortcut points back a UNC location on attacker system • SMB Listener on attacker controlled system • Can use Inveigh for the listener • https://github.com/Kevin- Robertson/Inveigh • Gather NetNTLMv2 hashes
  • 24. © Black Hills Information Security | @BHInfoSecurity Onsite Attacks
  • 25. © Black Hills Information Security | @BHInfoSecurity NAC Bypass • Spoof another device • Find a printer or VOIP phone; Spoof MAC and/or IP • Voiphopper to hop VLAN’s • For Wi-Fi NAC spoof MAC and User Agent of connected device • Layer 2 and 3 NAT device • Helps avoid triggering port security rules on 802.1X • Device spoofs both sides of wire • Passively learns MAC addresses
  • 26. © Black Hills Information Security | @BHInfoSecurity Dropbox • Fully functional pentesting device to leave at onsite • Persistent reverse SSH tunnels • Can be controlled over WiFi • Relatively unnoticeable • ODROID-C2 build instructions here: • https://www.blackhillsinfosec.com/how-to- build-your-own-penetration-testing-drop- box/
  • 27. © Black Hills Information Security | @BHInfoSecurity PXE Booting Attacks • Obtain the “Golden” image from the network • Set VM to “Boot from network”, boot VM, and get the image • Mount image & profit • Steal Admin hashes • Set local admin pass pre-boot • Overwrite Sticky keys (sethc.exe)
  • 28. © Black Hills Information Security | @BHInfoSecurity Post Exploitation
  • 29. © Black Hills Information Security | @BHInfoSecurity PowerUp SQL • PowerShell tool for attacking MSSQL • https://github.com/NetSPI/PowerUpSQL • SQL Server discovery • Weak configuration auditing • Privilege escalation • Data sample searches • OS command injection • All at scale across the enterprise
  • 30. © Black Hills Information Security | @BHInfoSecurity Living off the Land • Using built in Windows tools to avoid dropping malware • Internal user and group recon • Remote file listing and copying data • Remote process spawning • Lateral movement
  • 31. © Black Hills Information Security | @BHInfoSecurity Living of the Land • Net commands • net groups “DOMAIN ADMINS” /DOMAIN • Listing files on remote hosts • dir hostC$files • WinRM to run remote commands (port 5985) • Invoke-Command -ComputerName -ScriptBlock {Command Here}
  • 32. © Black Hills Information Security | @BHInfoSecurity Stealthy Host/Domain Enumeration • More and more AV, behavioral analysis, app whitelisting, etc. products are starting to either block or alert on built-in system commands • Ex. net, ipconfig, whoami, netstat, etc. • HostRecon PowerShell instead of built- in commands • https://github.com/dafthack/HostRecon • Combine with PowerShell Without PowerShell technique for added bonus
  • 33. © Black Hills Information Security | @BHInfoSecurity Detection and Prevention
  • 34. © Black Hills Information Security | @BHInfoSecurity Solid Systems Administration • Systems and software inventory (yes, CSC Top 20 are useful) • Workstations should never talk to workstations - client to server communication only • Windows firewall or Private VLANS • Baseline images with GPO enforcement • All inbound and outbound network traffic go through an application proxy system • Any exceptions for direct outbound communication are by documented exception only •
  • 35. © Black Hills Information Security | @BHInfoSecurity Enforce Good User Behavior • Change every inbound email subject line with a tag such as (External): • Inform your users that any email with that tag needs extra scrutiny • Minimum of 15 characters for any domain account password • If you have to compromise to sell it to the business, no complexity requirements and 6 month change interval • Consider additional credential defenses • Commercial offerings available • CredDefense Toolkit for Free • https://github.com/creddefense
  • 36. © Black Hills Information Security | @BHInfoSecurity Host Log Consolidation • Consolidate key logs from endpoints, servers, and appliances to a central location • Specifically monitor PowerShell and process execution • Sysmon a powerful and free option for gaining insight into host based activity • Once the logging foundation is in place, alert on “abnormal commands” like net commands • Can be done on the cheap: • https://www.blackhillsinfosec.com/end-point-log-consolidation-windows- event-forwarder/
  • 37. © Black Hills Information Security | @BHInfoSecurity Network Logging • NetFlow, Bro, or Full Packet Capture? • Depends on your budget and staff capabilities • Bro is a good balance between NetFlow 5-Tuple and Full Packet Capture mass storage requirements • Out of the box captures common protocols into text based files • Can provide an amount of visibility into SSL traffic without breaking SSL • Abnormal certificate information • SSL fingerprinting - JA3 project - https://github.com/salesforce/ja3 • Beacon detection with RITA (AIHunt) • https://www.blackhillsinfosec.com/projects/rita/
  • 38. © Black Hills Information Security | @BHInfoSecurity Red Team Prepper • Don’t wait on the Red Team prepare on your own • Use @vysecurity’s Red Team Tips to find techniques to try to detect • https://github.com/vysec/RedTips • MITRE ATT&CK Framework for threat actor techniques • https://attack.mitre.org/wiki/Main_Page • Red Canary’s Atomic Red Team - portable scripts to test ATT&CK framework • https://github.com/redcanaryco/atomic-red-team
  • 39. © Black Hills Information Security | @BHInfoSecurity About that Bypass Technique • Recently some products have been getting a little better… • But they still seem to be getting better at catching pen testers and common tools • And then sometimes its just stupid simple to get past a well known security product
  • 40. © Black Hills Information Security | @BHInfoSecurity Summary and Conclusions • Black Hills Information Security • http://www.blackhillsinfosec.com • @BHInfoSecurity • Beau Bullock @dafthack • Derek Banks @deruke • Questions?