hi everybody i'm david hunt today i'm
going to be giving a tool
demonstration about prelude operator the
command and control center
that allows you to quickly run security
assessments on your network
on your servers or even on user behavior
of people within your network
by way of introduction i'm the cto here
at prelude research where i lead the
team building the operator platform
before prelude i spent a couple of years
at mitre corporation here in washington
dc
maybe familiar with some of the work
that i did where i built
and designed the calvera framework which
is an autonomous adversary emulation
platform
to fully open source and available on
github
before mitre i spent a couple of years
at places like fireeye
john deere rockwell collins variety of
other defense contractors places within
the ic
as well as the consulting and the
research spaces
most of my career has been been spent on
the offensive security side
although i've kind of interwoven some
system administration
some software engineering and a little
bit of defensive security depending on
the role
and the scenario that i was in all right
let's dive right into the prelude
operator
and uh get to know this tool all right
to get started we're going to go to the
prelude.org website
and head directly to the download page
from here we can go ahead and download
the operator platform for whichever
operating system that i want to use
at this point you're able to install
operator
the same way you would any other desktop
application
when you open operator up for the first
time you'll be greeted with a login page
that asks for your email
go ahead and enter that in
that will fire off an access token to
your email so you can prove that you are
in fact the owner of that address i'll
go ahead and grab that now
your authentication token will only be
valid for 10 minutes
so make sure you use that pretty quickly
once you log in you'll be greeted with
the dashboard
from here you can get familiar with the
different components that make up your
command and control center
so before we dive into those components
let's take a quick second and describe
exactly what this platform is intended
to do
so operator is a c2 which is
a command and control center which
allows you to run
anywhere from fully autonomous to fully
manual
red team operations or penetration tests
what this allows you to do beyond just
the offensive security testing
buzzword it allows you to test whether
your defenses
are appropriately configured it allows
you to test your
users behavior the employees within your
network are they behaving correctly on
their computers
as their users are traditionally one of
the biggest vulnerabilities within an
organization
it also allows you to test the networks
the servers
the privileges the configuration
the implementation of the different
defenses is your antivirus working is
your edr configured appropriately and so
on
and so forth operator is not
a vulnerability scanner this is not an
anti-virus
it is a tool for offensive security
minded people
to run security assessments
okay to get started let's go ahead and
minimize this top pane
so give me a little bit more screen real
estate the
first thing that you'll notice is a
blinking green dot down here this is
meant to dry your eye in
and when i click it it will show me a
training flag that i should capture
in order to get to know the system
better so you'll notice
as you kind of navigate through the
different sections of operator
that there are training flags in the
bottom right that
are not yet captured these are
introduction
flags that will teach you how to get the
most out of operator
so the green one is the one you should
start with this will
kind of encourage me and teach me how to
run my first operation
so it'll start by introducing the
terminology understanding things like
what is attp
what is an adversary which is a
collection of ttps
what is an agent or a remote access
trojan
and then finally what is an operation
essentially the process of taking an
adversary
and sending it to a collection of your
agents to execute
test your security so this will teach
you that it will give you a variety of
resource links that you can use for
supplemental information
i'll close this for now capture that
later and you can see that there's a
variety of other 25s down here that i
have yet to capture
i'm going to start by looking up here at
the select an adversary
i can do one of two things i can take
one of our existing
off-the-shelf adversaries that will have
a chain of ttps that work together
that i can just build and deploy
immediately so i'll click this
and this will build a two ability
adversary
that according to the name will capture
screenshots on the target
alternatively i can click this plus
button up here in the
dock which will create a blank canvas
a new adversary that i can fill in
i will call this one hacker one
this has no procedure so this one is
prompting me to add procedures
i'll come back to that off to the left
hand side i can see that i
have currently selected my home
computers this is
my range this will show all of the
computers that i have
access to that i have compromised on
target
so operator ships with a single agent
inside of
your home range which is named after
your
your host name of your computer so i can
see that here that there are zero
executing ttps
with nothing queued up and i can see the
last time it checked in
was that 1620 just a few minutes ago
and it is using a pretty default
encryption key in order to communicate
between operator and itself
so if i click into the agent i can see
essentially the log
of what occurred during this agent with
a variety of options up here in the top
right
on the dock which i'm able to do against
that agent
whenever i deploy an agent sorry
whenever i deploy an adversary
the adversary will be sent to any of the
agents that i currently have selected in
my left hand column here
which is currently home all right i
think we have enough information for us
to get started and see what kind of
power
operator has behind it so let's go back
to our hacker one adversary
and ttps to it
see that we have zero ttps currently
attached
to this adversary but what view that
we're in now
is essentially a library for procedures
that we can use in order to
add or remove any attacks that are built
into the system to this specific
adversary profile
i can search for them up here i can
select
based off of procedure tags which are
essentially categories of attacks
or i can show a change log of the new
ones that have been pushed into operator
over various time periods there's about
400
procedures that are currently built and
baked into operator
so you can use these across the whole
spectrum of miter attack
tactics and techniques and so forth
we're going to go ahead and select the
tag to limit the 400 or so procedures
currently
in my view we're going to look at the
crown jewel procedures
so crown jewels are going to be the
important things
on a computer network or server
essentially the important things that an
organization has or has access to that
they do not want attackers to find
so by selecting this tag we're able to
see a variety of procedures
that are connected or allow us to locate
find steel
exfiltrate the crown jewels off of a
computer
or network so as i scroll down
note that every ttp is stored inside of
one of these boxes
so this here represents a procedure
every procedure is classified according
to the miter attack
matrix has optionally tags
and then is going to show you aside from
a name and description it's going to
show you every operating system we call
these platforms
that the procedure will work on and then
every executor essentially the program
on the target computer that the agent is
running that will
execute the command so for example
this darwin which is a synonym for mac
os
is going to run a shell command which is
this
tar similarly this works on windows and
powershell and linux and shell
so you can mix and match these different
platforms and executors
let's go ahead and add this procedure to
hacker one
scrolling down let's go ahead and add a
few more we'll add finding files on
removable media
we'll add staging collected files which
is the process
of copying a file from one location on a
computer to another location
let's go ahead and add admin shares
locating those
all right let's go ahead and add this
multiple windows as multiple executors
on this windows
command let's go ahead and add creating
a new directory
now let's say that i am unsure about
what one of these does
as far as a procedure what do i expect
why would i want to do this
and go ahead and select the training
manual
and what this is going to do is it's
going to pop open a
verification a flag for me to capture
that
may be easy maybe hard but it's going to
show me all the different variations
of this given procedure it's going to
show me a hacker's perspective
which is why they care about doing this
in the first place
basic variations that a hacker may
attempt to do
what they expect to get out of this with
the links to additional procedures
how you could change this powerful how
you could chain this given procedure to
others within the system and then how a
defender may prevent and detect this
so i'll go ahead and say i understand
this procedure capturing that right now
now this is content that is developed
in-house
we spend a significant amount of time
between us here at prelude and people
within the open source community
that are constantly adding in new
training flags
and new material from our point of view
on what
uh what procedures do and why we
actually execute them from the offensive
side
let's go ahead and additionally add
finding of recent files
this is a handy procedure that will
locate every
file that has been modified in the last
24 hours and just collect it
and finally let's go ahead and add a
procedure for exfil trading
anything we find off of the target
systems
now one thing i'll highlight in this
procedure is the concept of variables
so you'll see this syntax here it's a
hashtag and curly braces
with a variable name inside
of each one so this command uses
multiple
variables now generally you don't have
to worry about these unless you're doing
some advanced work with an operator to
form your own
chained attacks but what's actually
occurring here is as
operator executes commands essentially
adversaries
it is learning information and changing
the output of
some ttps to the input of other ttps
so it creates an autonomous chain that
allows you to essentially take a whole
bunch of procedures
toss them into a bucket and then
operator will take care of how does it
order them
how does it chain them how does it
figure out intelligently what to do and
when
and so operator will take that process
on itself
you can jump in manually and add your
own variables
and add your own essentially manual
control but that is an optional thing
if you feel comfortable doing so
all right let's go ahead and take hacker
one for a test drive
so we can see we have seven abilities
and we have currently selected our home
computers
so let's go ahead and deploy hacker one
all right we can see that this agent is
currently
most of the way through the operation
has nothing queued up and it is
currently executing a single ttp
there went it finished it skipped a
handful of the procedures
over here so i can see those here
otherwise everything that executed is
going to show up here in my dashboard
there are 33 procedures we gave it seven
ttps but it did execute 33 things there
over the course of yeah 30 seconds or so
up here we can search for anything that
we want to
look for inside of the results maybe
we're looking for certain usernames
email addresses
ioc's whatever as i scroll down i'm
gonna start at the bottom actually so
i'll use the scroll bar
to the bottom this is time based so the
first thing that executed will be at the
bottom
i'm going to get started by creating a
new directory we'll click here
so starting at the top you can see the
ttp command that ran
you can see the output as if you had
just opened up the terminal
on this given macbook and you know using
shell
executed this command you would have
gotten this output now we use our
autonomous
parsing and chaining commands together
in order to pull out these
indicators of compromise i can see here
it tried to identify
this given output as a directory and a
file
i know this is a directory using my
human eyes so i'm going to
x out the file removing that learned
information i'm overriding it
and i can still see the fact that i
learned this one piece of information
actually unlocked my ability to run a
number of other procedures that are
loaded into my instance of operator
that i could run anytime i want
closing this i'll look at the second
thing that ran
which is finding recent files all right
here we go i can
find a variety of files including video
cuts that i've been taking this
afternoon
that it has located and deemed that
these are important enough to
show me scrolling down i can see that it
parsed
out all of the files as learned
indicators of compromise
storing them as files that were found
by running a t-1005 procedure
now i can see that all of these files
could be used
to link me to staging collected files or
even encrypting the files if i was
running maybe a ransomware test
moving up i can see that there are a
number of stage collected files commands
that executed likely one for every found
file i can see that the last two steps
were successful one was compressing the
stage directory
and then the last one was collecting or
stealing
the compressed stage directory from the
target and sending it back to me on my
command and control center here at
operator
so i can open this up and i can see the
curl statement that because i'm running
everything localhost
the ip address is localhost but i sent
it over my http server that's built into
operator
and it forwarded over uploading the file
so this is now in my control all right
let's say it's time
to run a network test off of my computer
i want to run it on an external computer
something else within my network but not
on my local host an actual security
assessment
to do that i'm going to head over into
operator's plugin section
and this is where we allow you to write
your own extensions to operator we ship
with about a dozen plug-ins
that do things from like importing
atomic red team attack files to
popping the attack navigator the miter
attack navigator right here on screen
to things like um a toolbox that tracks
all of your
github projects there's a bunch of
different plugins here that add a
significant amount of value but we are
going to
kind of skip right over into the agent
library
and see what we have accessible so the
agent library is going to show me
all of the agents that i can use
associated to operator
you can write your own agents this is an
open framework you can write an agent in
any computer language you want
and attach it over the interface over a
number of different protocols http
tcp udp ftp grpc and variety of
additional
protocols that we're working on third
eye is the default agent this is the
name of the default agent
for the built-in agent that's in
everybody's operator
this is the one that we ran our just
last test on
numa is our default open source agent
you can go to github search for pneuma
on our repositories you'll find the
gohan code up there
you can compile it yourself read the
code change the code you see this one
will work over four different protocols
and we give you pre-compiled binaries
right here that you can download
or you can download the source code if
you don't want to head to github
i'll go ahead and download darwin
all right have that downloaded these
file hashes for the downloads by the way
are pre-compiled but they re-compile
every 30 minutes
in order for them to get a different
file hash so your signature detection
on the defensive side may struggle to
catch them because they're constantly
changing themselves
to avoid detection alright since i
downloaded numa
i'm going to open a shell head to my
download directory
and i will mark numa as executable first
and then i will start it now when i
start numa
i can give it an optional parameter in
this case i'll just call it
david and i can give it an optional
range
which i will call mine
all right i received a new agent beacon
right up here you can see that came in
going back to operator
i can see that i have a new mine range
now inside of the mine range i can see
david is checking in
currently green connected over tcp which
is the default protocol
that numa uses if you use nothing else
it will choose tcp
now i can go ahead and execute and
deploy an adversary against this
agent and i can deploy this anywhere in
my network as long as i have
connectivity back to operator
i can put it wherever i want now i can
also open a reverse shell to my tcp
based agents
just that quickly this gives me a
full-fledged reverse shell that allows
me to drop to root allows me to open up
them
i can do all sorts of cool things from
this perspective
i can also open up the settings cool
thing here though is i can change the
contact point for the agent
so tcp is the default that i connected
to i can
switch that over to say udp and update
and this will actually hot swap the
protocol being used
that by the agent so now i can see over
here i'm using a udp connection protocol
so the next thing i'm going to do is i'm
going to go into the editor section
which is our database of procedures
so you saw some of these procedures
before within the operate section when i
was deploying hacker one
if i want to get my hands dirty and
start modifying procedures creating my
own
learning about how to write payloads and
attach them to procedures
you're going to head here into the
editor section from here i can search
for anything that i want
so we'll say maybe find maybe i can
locate those
find recent files that i ran before
and i can view all the different
variations of this given procedure
from here i can edit anything that i
want i can see all the different
dependencies
and things that i could learn from
running this given procedure add
executors
regardless at any point i can take any
of these procedures
that would work on my operating system
and i can deploy it
it's a quick way to test so i can select
my range
in this case i'll choose my numa agent
on my mine range
and i'll deploy it there we go i can see
a pretty similar result
is when i ran the hacker one average
is some of these procedures have
payloads these are optional
in this case a payload is a python file
if i click on it it'll show me a generic
path
if you remember from before this is a
variable it'll get filled in
automatically
now a payload is any arbitrary file of
any extension of any size that you want
to write any kind of malware that you
may want to test
in a security environment and you can
attach it to the procedure now when the
procedure runs
before it executes whatever command it
has it will download the payload
associated to the ttp and expect it to
be on disk
before it runs the ttp all right this is
quite the report
so this is going to show me the
range of agents that i want to look at
it's going to show me start and end
times to filter my report
and that's going to give me a
visualization of every adversary that i
ran
and all of the procedures and kind of
how they fit together
in almost kind of a linear way as far as
how the procedures
were run so i can see here all this is
clickable you can open up all sorts of
i can see all of the operations which
are essentially adversary deployments
that ran in this case i have brand one
hacker one
clicking this it will show me all of the
procedures that ran
in order within the operation their
status and so forth
i can see the ability to export the
report into a word
document into json or csv if i want to
do something programmatic with
my data this is a fun area this is a
continuous
training lab if you want to think of it
that way there's a number of free and
open source training programs that are
available here
and you can kind of pick and choose what
you want to learn and how you want to
approach
the process the very first thing that i
point people to
is the introduction training program
this program will teach you how to use
operator so this will take you through
about two dozen
capture the flag style learning modules
that will look kind of like this you'll
get a challenge in this case deploy any
adversary against any range
you'll get context as to why this may be
important a gauge as far as how people
view the difficulty of this
supplemental resource information and
then a place to enter your challenge
answer and see if you are getting it
right and if you capture the flag
another popular program is the pink
badge program
i'll click into this one i can view the
history
of my flags by clicking the green now
the pink badge program
is geared toward infosec geared toward
people with little to
no security knowledge or experience but
may be interested
and in parallel technical areas such as
i.t
or infosec now pink badge will take you
through a three-week course for the
final project
and it will aim to append red team or
offensive skills
to somebody that works in the technical
field
so we go through all the different
things what is an antivirus what's edr
these come with a lot of video or sorry
audio recordings
you can listen to they come with again
challenges that you need to do every
week sometimes multiple times a week
these usually run a couple hours a week
to accomplish everything that you need
to to stay on track with pink badge
but this is a self-paced program that
allows you to essentially beef up your
skills if you don't have them
go into the cloud plugin which i haven't
installed yet so let me go ahead and do
that
done all right and this is going to
prompt me to enter in either my aws
or tcp credentials all right we're ready
i'll go ahead and save those
now back to the main cloud plugin
dashboard
i have a variety of options here with
the gateway selected first
so a redirector is actually a really
powerful micro linux server deployed in
aws inside your aws using your
credentials
and what it will do is it will create a
connection between your operator
instance
on your desktop and that linux server
that it will provision for you
via in a reverse ssh tunnel and it will
tunnel the connection
as agents hit the redirector it'll
tunnel that connection back into your
operator instance for you
kind of like socad if you use to that or
netcat which you could use for this
purpose
but it will take care of all of that for
you and it will create a very simple way
for you to accept
internet beacons let's go ahead and
start with gateway
and let's go ahead and deploy
all right success my redirector is ready
now in order to actually use it i need
to head back to the operate section
and i need to go to the tunnel icon
now i can see here that i have in orange
meaning it's in the process of
connecting
i can see that i have a host that has an
ec2 address
makes sense that's where i deployed my
redirector
and i am just waiting for it to go green
in order for me to connect to
all right there we go i was able to
click on it connect it
now i have a tunnel open that is my
reverse ssh channel between operator
and this address and head back to my
local computer
where i have pneumo running
and redeploy numa and this time i'm
going to do it with i'll say the name of
ec2
server and the address will be
what i copied and port 2323 which is the
default tcp port
all right receive my new agent so let's
say
we want to connect another external
computer with an agent on it back to my
operator so not a local to local test
i'll stop my agent
i will head back to cloud plugin
where i will select a linux server to
spin up
i will choose to drop a new agent on it
pre-compromise it
and then i will select the default
redirector which is the one that i
currently have active let's go ahead and
do that all right
i have a new server being provisioned
inside of ec2 right now
i can head over to the operate section
i can select my red computers
this is my old one let me go ahead and
clean this one up for now
i gotta archive it i'm gonna go ahead
and delete it i don't plan on using it
again
and so what i'm doing now is i'm waiting
for a beacon to come in for my newly
provisioned linux server
so let's give that just a minute all
right there we go we just got our beacon
coming from an ip address
in our ec2 space so let's go ahead and
check our ranges
i can see we have a new range called
cloud computers
and it looks like we have a green agent
clicking on the agent
i can go ahead and open a reverse shell
i can look around see where i am
and treat it as if it were a compromise
machine
i can go ahead and i can deploy an
adversary against it
i can view all of my results kind of
curious what did it find for recent
files on a newly provisioned ect
machine authorized keys that makes sense
finally i'm going to highlight the
operator support
repository on github which is our active
spot for support as an open source
project
and it is our active spot for feature
requests bug reports or issues
um a variety of tools that are open
source that we make available
plugins that are open source you can
import into your operator instance
even something called translators which
we made open source which is the ability
to extend the protocols
that your operator instance will accept
so if you wanted to add dns c2 or you
wanted to add dns over https
anything you want to add here maybe ssh
you can go ahead and create your own
translator use ours as examples
we even have example agents that go
along with these
and we have readmes and guides and so
forth that will kind of walk you through
things that i showed today but also some
things i didn't show you today
i hope you enjoyed today's tool
demonstration of prelude operator
i encourage you to reach out to me
anytime you want via twitter
it's an easy way to get me at
privateducky or also via the operator
support github repository
we're very active in communicating with
everybody in the open source
as we try to make a lot of what we do
here available to you via open source
and free tooling
reach out anytime