so um first of all thank you very much
for having me here today i'm very
excited to be here at defcon in the
adversary village
and i hope you like this presentation
which is called new generation of peace
um we are going to discuss a little bit
more of this piece and why is there a
new generation
my name is carlos pollop i work as
senior security engineer at middle
i have some certifications i
play cdf analysis stuff so if you want
to stock
about me if you want to know something
else about me just check my linkedin and
you can also contact me via twitter or
even
email for the more traditional one
so in this talk we are going to talk a
little bit
about the p suite what it is why is it
useful why is there a
um a new generation then i'm going to
very briefly introduce hot trees and how
can it be useful
in combination with the b suite and then
we are going to see some demos about
limpy's mac peace and wimpy's
at the end we are going to very briefly
see what is uh both piece
the last p being added just one or two
months ago
and then i want to talk a little bit
about the to do
in order to indicate the community how
how you can help to the peace sweet
if you like it so sweet peace
this is uh the name piece comes from
privilege escalation not so much script
sheet basically
basically this suite is a combination of
scripts that will allow you to enumerate
the most common host and i'm talking
about windows linux
a unix in general and even mac
in order to find um easy ways to
escalate privilege
so before the p suite there were already
a few scripts
that perform the these sections but i
i like them but i didn't feel very
comfortable with them because there were
a lot of data that was mostly useless
and i didn't want to lose my time
reading this data and figuring out
if you can use it in any way or not
and because they didn't have enough
checks or at least they didn't have the
text i wanted to import it so that's the
reason i
started this this street so in peace you
are going to find
a very comprehensive scripts for
enumerate host and see how hard
they are and how you can escalate
privilege you are not going to find
endless data lists so you are going to
know where you need to focus
in order to find these vulnerabilities
you are looking for
they have more text that any other tool
at least
i try this and this is because i i
mostly have probably one new check
per week so that's a very very cool
way to update the scripts as i have said
before the
piece can be executed for linux macos
any mostly
any unix flavor and also windows which
is very which is great
anything is the only previous escalation
enumeration tool
that can be executed in this amount of
different operative systems
but i think the fact that most people
like love
about the piece is that the output if is
colored
this means that you are going to find
for example the color red
where something is suspicious or the
color green where something is well
configured and this is very useful in
order to know where you need to focus
or where you should focus in order to
try to find vulnerabilities
last of the characteristics is the
monitorization
we will talk about this later because
actually you cannot use
any monitorization at the moment but my
idea with this piece new generation
scripts
is that you are going to be able
to execute the piece in a host as
frequently as you want
and be able to compare different results
in order to see how good you are doing
hardening
your systems as i have said this is not
available yet but i
hope this will be soon and well the more
the community gives me the sooner this
will be prepared
but before going into depth with this i
want to show you what is hacked
because this is going to be highly
useful when using these tools
so i'm going i'm going to open this link
and you can see that hackers is
basically a book
with a lot of cool tricks of hacking but
now you want us to focus
on the privileged escalation checklist
for linux
and windows and in a few weeks i hope i
will create one
specifically for mac where you can
basically see
some checklist of things that you should
search
on each um computer in order to try to
find vulnerabilities and
well improve the security or exploitable
narratives depending if you are in a
built in or
in a red team also hack trees is pretty
useful because
when you execute these tools you are
going to see probably some links
to some parts of the book and this is
because if you don't understand the
check
that the script is performing you can
access this
url and you are going to have the theory
about the check
what what is being performed and what
you should check for and
how can you exploit a vulnerability a
vulnerability form in that section
if any you have it for linux for macus
in the future i'm just starting
and for windows and to get to give you a
very brief example
for example let's say that you find some
vulnerability which is related to access
tokens and you don't know what access
tokens
in a windows environment you can just
come here and have a
um description about what is the access
token how to enumerate them
how can they been abused and everything
basically this is pretty useful
to know um why are the bees performing
the text they are doing and you how can
you exploit them
if you find any vulnerability also you
have here the url this is free
for everyone you can just access the
book and use it as you please
so let's continue
now we are going to start with the demos
we are going first we are going to
perform our linux with limpies and then
a demon with
magpies so i have here i have a pretty
vulnerable and very
updated deviant machine that we are
going to
where we are going to execute lymphedes
just to see the vulnerabilities that it
is finding
so um i have already accessed this
machine
via issh so unlock it i'm
i am the user user
and i'm in this very outdated deviant
machine
i have also already uploaded um limpies
so we are just going to execute it first
of all take a look at the options
because rupees and wheat peas
have um several options that may be
useful
for example in limbs you can find the
dash a this means to perform
all checks and this is because um there
are some checks that are
very very slow or that are very noisy
that by default they aren't executed but
if you are playing a ctf
or you don't care about being noisy or
about the time i completely recommend
you to execute that say because
more checks are going to be executed so
you have the super function
option and you also have some options
that will allow you to perform
network return just using limbics which
is kind of cool because just
with linkage you will be able to
enumerate the machine but also to
enumerate the network
if you don't want to upload any other
tools
so let's execute limpies we are just
going to run it without passing
we we are just going to run links in a
normal version so here we can see that
olympus star with a very very very
beautiful banner
um here we can find version we can find
legend this means what
delay indicating what the color means
which is kind of awesome because here we
can see that the red yellow
indicates a 90 percent 95
percent chance of previous escalation
vector
red means that well just take a look at
it and green
basically means well configure things or
common things that you
really shouldn't care about because this
was found in other machines
we have some basic information
information about the tools that are
available
to enumerate the network and then we
start enumerating um the system
so here we can find system information
we can see just in red that the kernel
is pretty burial
the pseudo version is also a little bit
old so probably they are vulnerable
we can see a little more more
information about the systems if you
info environment you may be able
able to find some passwords here
um we enumerate also some linux
protections like
is linux enable enable this aslr
is this a virtual machine actually this
is so we have here just
some information about the container if
this was a container but
we are in inside a container so nothing
is resting here
devices available software it's good to
know if you have
a some compiler or some compiler
available to compile possible kernel
exploits
then we start taking a look to um
two processes that may be vulnerable
just calibri less
binary process permissions ground jobs
and here we can find
the first highly probable previous
collision vector that lean piece has
formed
so for example here this user is able to
write in a path that is being used in
acron
that is then been executed by root
without indicating the path so for
example if we
create a file called override dot sh
with a reversal
in this folder this is going to be
executed by root and we are going to
obtain a reversal execute by root
um here we can see the link is
enumerated
enumerating more information also
network is
always important to know where you are
in in a network
and with other networks new networks you
can access and enumerate them
here we have just a numerical local
network
and we're going even checking if we can
sniff traffic
using tcp then we are enumerating
some user information and here we can
see that there are
a bunch of ways to escalate privilege
by executing different binaries with
sudo
more information about the users
software information
this is pretty interesting and is one of
the main
things of limpis and wind peas and it's
one of the main
new topics in the new generation scripts
so we are going to talk
about them later but basically here we
are just looking for sensitive
files that for files that may be
containing sensitive informations
related to some specific software for
example some tomcat configuration files
that may have
passwords inside of it you can see that
we are looking for
for a bunch of them actually we'll talk
about this later
so we are going to continue till the
last section which is
interesting files these files
and the files that are here are here
just because they have
some interesting facts
that will make limbs to enumerate them
for example here we can find all these
uid
files some of them has been vulnerable
in the history in
the history so we have here some um
some information about in which systems
this issue id binary is album
and also this uid binaries that aren't
known but limpies are going to be well
executed in order to perform a few texts
to see
if we can abuse these files
to to execute arbitrary commands and
escalate privilege
same thing for s g id files again
if you don't know what the file these
files are you can follow this link
and you will find all the information
um checking this configurations well we
are seeing more misconfigurations we can
write a few files and folders here that
we can absolutely so this is very cool
um with availa file so basically here
you are going to see that well
in pieces looking for a lot of
information that maybe
give you or sensitive information or the
power to escalate periods
always take a look to everything because
what you can find um
something something interesting so this
is limpis
now we are going to continue with a mac
piece
demo
but this is there is something important
that you need to know first of all there
is no mac piece
script because mac peace is actually
inside of limbs if you execute limb
piece inside a mac host
macps is going to be execute and i have
created this script this way because
the code that both scripts both flavors
of the scriptures
is like 90 percent so almost every
every part of the code is served so
ideas
generate some specific parts for the
mac version in order to run these parts
in a mac
computer instead of their regular
olympics
but as you can see here just execute
link is in a macro system
and the mac piece version will be
automatically automatically executed so
this is very cool because you only need
to know
how one script works you know in order
to execute it in
in linux in microsoft cause i mean
any probably potentially any flavor of
unix
so my current host is a mac
so i i have already executed
the lean piece version in my mac
actually i haven't executed from file
but i have executed from memory
i have just downloaded from
github and pipe it into a sh shell
so this way the script is never going to
touch
the disk yeah
here we can see that i have already
executed because as my hosts have a lot
of
more files than a virtual machine this
could take instead of taking just one
minute
this could take around 5 minutes 10
minutes and i don't want to keep you
waited
so here we can see that the banner is
much more ugly i
really definitely needs to improve that
but well it's not on my priority list
again here we can see some information
some basic
information we can see some system info
and we can mostly see the same
information
from limb piece in mac piece the
difference is like underneath there are
different binaries being executed
to obtain the the same information but
it's pretty cool so
because you just need to execute one it
is going to be intelligent enough to
distinguish between mac or linux and
just the correct version
is going to be executed well as you have
said you are going to find
most of the same information as before
so we can
we can pass this output you can just
test it
in your own
okay okay so
in peace we can start also there are
other
more stealthiest way more stealthy ways
to execute limpies a bunch of them are
mentioned
in the redmi even ways to bypass
antiviruses
so um check this out because it's going
to be very cool for you
to learn how you can execute olympics
probably just using netcat and cool
on even without that using um
bus pipes so um yeah
that's all for limpies
okay so let's continue with win peace
when this is obviously the um
well the windows version of the script
okay so here i have um windows virtual
machine where we are going to execute
win piece
um obviously win pieces using a
completely different
script that olympus actually there are
two different projects for wimpies
one is the batch version and the other
one is the xc version
the batch version is less maintained
than the x version and is
mostly created for all windows machines
so um the most maintained version of one
piece is going to be the x1 and it's the
one i
recommend you to execute if you can
obviously there are some
requirements like the net version but
mostly you are going
in nowadays um windows you are going to
be able to execute it so i
definitely recommend you to execute this
this version
so here also we have a quick start
and we also have a few ways to execute
a win piece from memory or win piece
or execute win piece while doing some
kind of
uh stealthy things in order to avoid
antivirus to detect
that we are executing the binary i
recommend you to take a look a look
because it is pretty interesting win
peace
also have some interesting parameters
for example
windpiece allows you to execute links
and this is very cool because
if you find in a windows the windows
subsystem for linux
um you can execute linps because it is a
bus script so if you just
in the case to win this the url where it
can
find lymphe it is going to download and
execute it
from memory i think also you don't even
need to host your version of olympus you
can just indicate
the the url for linps inside github
oh well you have also more more help
information basic information
what are my colors when you execute win
piece without doing anything
in a new windows host you are not going
to see any color
you need to execute this first in order
to indicate the registry that hey i want
you to
interpret the colors that are going to
be displayed just
run this you don't need to be root or
anything and
the colors will magically appear well
you need to
start another another power cell
cell okay so i have already run
win piece in this host
we can see that we have another very
beautiful banner
we have some information about the
creators
and we started with limbase we start
seeing some
system information we have integrated
what's on inside um wimpies so this is
pretty cool because
it will just run with wind piece here we
can
find that we have we are numerating the
hot fixes
has been applied to the to this virtual
machine in this case
information about environment variables
um information about audi the web labs
w digest again if you don't know what
for example you don't know what is w
digest
um you can just access this url inside
hack tricks
and you will learn what is this and why
is
this important same lsa protection
credential guards
so and the main difference between
witness and limb piece apart from the
obvious one
is that you are not going to find these
red yellow colors
in wind piece that you will find them in
in the piece and this is because
maybe in wind pieces more complicated to
be sure that something is going to give
you
a previous escalation path so i haven't
implemented those yet
but i may do that in the in the future
well as you can see in wind pieces and
reading a lot of things
interesting events now we have some user
informations
in red you can find interesting things
for attackers so
here you can find a dj series
administrator
um homes inside folders something
interesting about
a win piece is that he's checking every
path that appears
so for example if this path was
reachable by our current user this will
appear on red
and we'll tell you hey you can write
this binary maybe you can escalate
privilege because
this is being executed as
you can see here obviously you cannot
escalate privilege overriding one piece
because this is a binary
of this of the user we are using but
maybe if this was being ruled
by another user which is an
administrator and you can write the
binary you may be able to escalate
privilege
same for for services information
actually here you can see an example of
what i have been talking about
and is that this service this binary of
this service is reachable by everyone so
here you have a privilege escalation
path
also win peace is checking for no quotes
and space in the beam path of death
services
so you may be able to abuse this
misconfiguration also through
scalia previous more information about
applications how to run
same you may find some places that you
can
well right on
your binary is going to be executed with
higher privilege
so that's pretty awesome
and i want to show you a few more things
network information again it's very
important to know where you are inside
an internal
network if you're inside an internal
network or any way
which other networks you can access that
you weren't able to access
before and also it's important to check
the ports i don't have well
udp the ports that i'll be that are
listening just in localhost because
maybe
these services are vulnerable and you
can
well escalate privileges i'm using those
we found some well the
ntlm has of our current user i think
user yeah
we form the unattended file this may uh
have credentials of the administrator
user
and this is pretty awesome because you
can see here this section in the file
analysis
section and we are also looking for a
lot of files
that may be storing sensitive
information
so before the piece new generation every
time i wanted to search for a file that
may be containing
sensitive information i needed to ask
add an specific
check to lean peace and then on a
specific check to win this
which was pretty awful because well
it was kind of hard and well
it took several minutes with the new new
generation scripts
we have this build list inside this
build this
folder we have this sensitive file jamal
where you can find all the sensitive
potential files that can storage
that kind of storage sensitive
information this is pretty awesome
because for example
filezilla is
is specifying to search the folder with
the name
filezilla and inside this folder to
search
the file called sitemanager.xml
and if it is found print in red
all the lines that contain some of those
regresses
so this is pretty awesome because um
lean piece
and win piece are a automatically
created
using this general so so both of them
are going to search all these files and
if they found them while executing they
are going to bring them to you
this is very awesome because now in
order to just add a new
check if i want to this if i discover a
new file that maybe contains
sensitive information i can just add it
to this
journal and this is going to and the
newly in peace and wimpies are going to
automatically be
built and are going to be searching for
the news
sensitive file so this is
very easy to maintain and also it's very
easy for
the community to help me adding new
files that may be storing
sensitive information actually you have
here
a few examples well explain it
so if you want to just contribute to
this script because you know
about this file that may be containing
credentials that aren't
included included yet just take a look
to the example
including in general create a pull
request to master
and the new versions are going to be
automatically built
so it's just awesome
um as i have said before
win peace has another flavor which is
the bats one
which is meant for all machines actually
the syntax
is a little bit more complicated because
batch is not very flexible
anyway if you need to use it at any
point you can find it here
and also take a look to this explanation
of how to understand the permissions
because you will need it in order to
find the paths to escalate privilege
because here you are not going to find
colors
well because match is not very very very
flexible
so we are in this presentation
we are going to continue with both piece
i created this
like um one or two months ago i think
this is very very a very very simple
script this is basically monitoring new
cbs and the ones
that are related to privileges
escalation are going to be
indicated in this um group of telegram
and in this group we also discuss about
hot trees peace
and latest news in cyber security so
it's free for
everyone you feel free to to join it
and also you can find bot piece in
github
you can find it um
you can find it here and actually this
this bot allows you to create your own
boat in order to monitor
your own um the cvs you're interested in
so basically you can modify this general
and set your own
um keywords and then put your
slab webhood or your telegram token
and the bot will send you um all the new
cvs that are this color that contains
the keyboard the
keywords that you have specified here
in this case we are just looking for
things related to previous collision
yeah i think it's stupid escalation or
dog air
container escape
okay
so yeah feel free to join the group if
you please
finally about the to-do
so um we have the cap we now have in
this new generation too we have the
capability
of create jsons from
the raw output and you can find the
script to generate these jsons
in the parser folder
so you can basically execute the piece
parser
give the path to the output of the one
the output of one piece script
and generate the json i'm looking
forward to someone
that from that json can generate a
beautiful
report pdf html report that will be
awesome
also i want to develop workpiece which
is going to be
the well the centralized
agent that we allowed you to
automatically
execute limb piece or win piece and
compare the results
and even add new features so i'm really
looking for
someone with experience in front-end
and or back-end so if you want to help
me developing
workpiece in order to allow to perform
this constant monitorization
just contact me and finally obviously
wimpy's and limpies are very big squids
but
can be bigger so if you know about new
checks or if you want to help
out the updating the list that they are
using
just contact me because well this is a
huge project that needs
a few help the help of everybody that
can any help that you can bring me
so i hope you have enjoyed this talk
thank you very much i hope you have you
are enjoying devcon
and now i will be in the in the discord
channel if you have any questions
thank you for your time again