hi
thank you for joining me today for
tradecraft development in advisory
simulations my name is fatouzabji also
thanks advisory village and defcon for
hosting me today
today we will talk about tradecraft
development and we will have different
chapters that we will introduce how
tradecraft works as well as how the
other implementations can be used after
that we will talk about how we can
develop our own implementations
chapter 1b will introduce the
development environment to you and
chapter 2 will help you to build your
own c2 as well as implant
chapter 3 will enrich your implant using
windows apis and some other
functionalities and chapter 4 will
actually improve your implant for the
evasion perspective
so you can make your implant invisible
as much as you like
today the objective is developing an
implant from basic to advanced skills
it's up to you how you can enrich them
my name is fatio zhaoji i'm managing
security consultant in the missing link
australia
but actually i love advisor simulations
and security research therefore i had
several different tools developed for
these purposes
i have also presented those tools and my
research in black at usa europe defcon
and other sacred conferences i currently
also study master of cyber security in
university of new south wales so you
will use some of those tools today as
well
let's talk about those tools i have
developed ta-505 plus advisory
simulation pack that is a full
simulation pack that comes with some
repurposed tools new tools as well as
some additional evasions and bypasses it
has four plus hours of video to prepare
each stage for you as well as an
implementation guide
and in the end there is also a large
report that explains how this tool and
environment would work for you and it
can be
actually useful for you to build your
own exercise
i also developed a taxi to one and a
half years ago and the reason behind of
it was i needed to automate some of the
red team actions probably it is also
same for you so you need your own c2 you
need your own implant and you need to
make things automated for the blue team
exercises for this work
in addition i have also tested malware
generator
i assume that some of the attendees and
participants here are actually coming
from the blue team and sometimes even
data analytics that's why sometimes you
need friendly tools to generate this
type of traffics and test that malware
generator is a response for this one but
it can be also used for your own
tradecraft development because it comes
with laser ui web interface and
different types of protocols and
services so you can enrich them and make
them actually working with your implant
and
maybe it will be useful for you it's up
to you finally i have also weaponizing
c-sharp
training that is that is also available
in github repositories so you can just
clone it and you can start working on it
to understand how c-sharp can be
weaponized for the purple team as well
as every team exercises
i am not a developer i develop those
tools for fun as well as for simulations
so if you want to start exercises today
you need to actually clone a github
repository that is the address of the
github repository so you can use git
clone to get this repository compile the
tools and work on them it comes with
code examples also
the presentation itself
in addition it has a c2 capabilities for
example there is a text file there there
is a actually a c sharp file
executable so you can actually use these
functionalities while building your c2
implant
and you can use them as a kind of
instruction list so feel free to
participate where when necessary or you
feel comfortable
i will talk about stress and simulations
firstly
we have different levels different
colors of the advisory simulations red
team is the most uh interesting one
because we actually start with zero
information we need no collaboration and
we try to infiltrate the organization
just like a trade actor
in the purple team exercises we actually
calibrate in this case the color changes
the meaning is actually the blue team
joins us blue team can be actually trade
intelligence or security operations
center uh or uh some uh actually
interesting instant response teams or uh
some other universal engineering teams
as well
and offensive offensive teams will be
also a red team or penetration testing
or maybe more than that
there's also automated tools that can be
used for breach and attack simulations
and they are useful to actually ring
some bells on the environments to
understand that your coverage is correct
or your network is in scope or your
endpoints are in scope so different
types of colors actually come with
different abilities so it's up to you
how to colorize them based on your
purposes
this is an example trade intelligence
actually information uh extracted from
microsoft trade intelligence reports it
is about no value and how they operated
there or actually the campaign
during this campaign they compromised
solarwinds then they compromise some of
the vendors and after that some
government organizations so you can
extract this type of information from
the trade intelligence reports this is a
basic example so you can visit this link
in microsoft trade intelligence
repository and you can start working on
it this is important because
we advise actually while we are building
the adversary simulations we use this
type of information so
if you look at them in a different way
you can also reuse them for example this
one is a simple attack and c2
communication type of salary gate and
you can see that it can target the
organization if organization is in the
target list it can start
at second stage and then third stage and
fourth and fifth whatever necessary but
it actually works on different c2 types
sometimes it is uh dns sometimes it is
web sometimes social media in this
nobelium case it started with the dns
and then it also loaded a cabal strike
as well so we can see this information
in the thread intelligence report so we
can actually customize our
simulation based on this information
when we read it carefully we can also
see that there can be some additional
campaigns as well this one is another
example from nobelium but this time they
have sent an email and after this email
uh they started actually a javascript
file an html smart link feature they
actually downloaded an iso and this iso
is mounted and then
the code executed actually iso has been
uh actually decoded so simply it writes
the iso to disk so it's up to you how
you can implement this you can use the
javascript to download iso or you can
just encode base64
encode this iso file and just decode
this on the fly and you can make it an
hta file or html file or whatever you
are comfortable with so simply you need
to make it working
but the intelligence report already
gives you some information for example
the iso content or how this
lnk file link file works so you can see
the commands and parameters there
moreover the script content and some
additional information can be also used
to develop this type of tradecraft
finally you are not alone there are
other specialists actually working on
this type of stuff for example creating
um
a kind of simulation like that
it needs some steps first of all working
on a javascript making it uh to be able
to decode base64 file and start actually
building an iso file and encode this for
base64 and then embed this to the
javascript to make it running
the thing is it is slightly easier if
you work on just one single exercise but
if you try to automate this there will
be some difficulties because of the
compatibility requirements for example
jorge ortiz has provided actually
example for this exercise on atomic rate
team so feel free to visit this and it
can be useful also target is actually a
blue tumor so he also develops some of
the content the adversary simulation
initial payload part so it can be also
useful for you
finally editing chester uh
also worked on some csc sharp early
sport types and how it can be exported
it can be useful because we developed
our tradecraft today using the c sharp
and that net environment
but they are actually not unmanaged dlls
so they have no exports
so if you want to export the functions
and
actually the
content you use in the start net
assembly you need to actually make your
executable supporting them in the export
section so you need to add them one by
one to the exports you can do this
manually or you can use some additional
tools that's why this blog will help you
to understand how this process works
another one is actually ta-505 plus i
actually
will explain how this advances
simulation
environment works for you because this
is end-to-end example the previous ones
were only working on the initial payload
preparation
the initial payload is there for example
starting with an email the email content
could be html and that html file or hta
file itself will have javascript that
can get the code execution and the
javascript content will actually put the
file on the scan we can make it running
or sometimes we can use eduard means for
this initial payload as well but after
that
things get complicated we need a command
and control server we need some security
bypasses we need a uac by a password in
the dmc bypass we need sometimes run
somewhere examples as well
to do that we need to prepare an advisor
simulation pack from beginning to end
ta-505 plus is a response for this
because ta-505 was a trade actor
actually currently is a trade actor but
during those days they were also
targeting the australian financial
institutions so i worked on them and i
made it a kind of exercise but i didn't
use exactly what they had in the
campaign reports my assumption was
ta 505 could improve and upgrade their
abilities
this simply says that yes they can
upgrade and we don't know
let's make it known that's why i started
working on windows 10 up to date office
2019 up to date as well as windows
defender and mc full update system so i
decided that what if this system uh the
target will be like that how ta 505 can
improve their systems as well as the
campaigns that's why this advisory
simulation pack is coming with a plus
and this advantage simulation pack
has a full key chain that's why the kill
chain has different stages coming with
different tools for us to simulate them
accurately
as there is no actual reconnaissance
phase for this one i prepare trade
intelligence information there so the
video and the content is based on trade
intelligence but the rest of the phases
pretty much like a trade actor so you
only work on the weaponization you also
work on the delivery and when you
compromise this you actually install the
malware there for persistency you also
you're
actually you also work on your own c2
and you try to complete some of the
objectives that include also
ransomwaring
so ransomwaring is a kind of uh known
behavior of ta 505 that's why i
developed a simple tool to simulate
those features
those are the tools i developed or
repurposed for the ca 505 plus exercise
so it can be useful for you to build for
example patek dropper is the initial
payload starter when it believes that
the environment is safe for it it
actually downloads the patek mc bypass
to patch mc make it way more clean
and to work and then it downloads the
patek implant and
go on and go on attack service is the
city service and nmc patcher is the mca
actually bypass utility uh and it is
coming from daniel dargan's actually uh
example but i repurposed it to avoid
detections and also this dropper the
patek dropper can start with an excel
file because the ta505 was actively
using the excel file i used excel
anti-doughnut for it
so there are some tools and there are
some new tools in this bucket
so how they work is just like this the
excel file amp attack dropper protect
dropper yes tmc bypass a tool when
everything is clean it lost the implant
and establishes a ct communications
using the web sockets
through this one we have a real time
communication
all this patch was undirected those days
now it is elected of course the tools
techniques and the pack was uh were
public so there were some signatures
generated for it however everything is
open source so you can just repurpose
those tools to do the same thing for
example i have repurposed daniel
duggan's amc patcher mc bypass
to make it running again and there's a
video for it so that will be your
starting point and you can use another
way to actually customize this and start
using again
when the exercise starts we actually
establish a ground between the implant
and c2 however we have objectives to
work on and those objectives are not
always on the end point there are some
servers in the back there will be some
class services and we need to connect
those services those systems to actually
achieve our objectives
through this path
i need to implement some additional
features for my implant that's why
patacity comes with implant implant
linking and some additional features for
lateral movement as well
through this way i have demonstrated how
we can compromise the servers using the
lateral movement techniques as well as
implant implant linking techniques
in addition i safely executed meta
arpeggio memory and actually used metal
printer for remote exploitation in this
case and my therapeutic was also using
metasploit sc2
i haven't used cobalt's rack c2 in this
picture however it is widely used by
ta505
patak c2 while mentioning like that
is a good cto for me because i have
actually implemented some of the
essential features and it helped me to
customize them it avoided directions it
also comes with some abilities as well
normally
it should be a kind of problem more
specifically whenever you compromise the
system you try to understand who you are
what you do and you use windows commands
instead patak actually accepts the sharp
c sharp commas so direct c-sharp commas
would work it compiles in memory and
runs them for example console.writeline
the username
it writes the username and you don't
need to use who am i for example
that's why patak comes with some
additional abilities for me and today i
will talk about attack and other
features but in this time i will assist
you to develop your own c2 and your own
implant and patak is coming
in mit license so simply you can
repurpose anything and you can reuse
anything that means there are actually
gadgets for you for today and i actually
supplied them in chapter two and three
folders so you can start enriching your
implant using those abilities extracted
from attack
attack has lots of different gadgets
like that that can be used
lateral movement
or implanting past linking different
types of protocols assembly name pipe
tcp udp web sockets they are all there
what you need to do is only merging them
combining them and making yours
patak supports all of these features as
the baseline for example that is
something features or
shellcode injection features or some
essential features such as upload
download or linking another implant so
these type of things are implemented and
as mentioned this is not a product this
was a proof of concept for me and it can
be your proof of concept as well
in this case we have also some
additional requirements sometimes it is
a user interface a graphical user
interface
patek runs on command console which is
not nice this is why i also developed
asset malware a generator the asset
helps us to actually simulate some of
the malware traffic
using the protocols http http websocket
tcp udp
those are the current
capabilities and the dns icmp and some
additional features will be added soon
as well
i'm actually i mention it here for it
for another reason
probably you also need graphical user
interface for your c2 to make it shinier
and look like a kind of real a good
product
in this case you can repurpose tessa as
well it is also mit licensed and you can
actually use the blazer ui for the
interface and you can still use your.net
environment so
it comes as another free tool
these are actually a real-life deals we
generally try to simulate our exercises
on cloud or on-premise servers and
points and actually some of the remote
locations that's why we need to support
lots of different protocols and
communications if you want to simulate
them with no hostile capability tessa
will work for you
if you are looking for also some
additional hostile capabilities such as
code execution or command execution or
shar code injection yes you need to
improve your implant
these are also screenshots of how
tessart works
now we talked about some development
fundamentals as well
c-sharp is our preferred language for
this workshop
we will talk about c-sharp add.net but
also that net comes with different
versions we need to understand this
basics first because that net doesn't
have one single version that works
everywhere universally
we we use c-sharp tools to develop
custom abilities for us
this is quite helpful for the advisory
simulations because we try to avoid
detections
we actually prefer directions where they
are necessary or where we need them
if they are not needed we don't need to
actually
we don't need to be detected
that's why our tools must be subtle as
much as possible
c-sharp tools actually started
developing after powershell because
powershell got secured by microsoft
using a couple of different ways
and that's why those restrictions moved
all security researchers to c-sharp
however c-sharp comes with additional
problems for example different versions
on windows linux and actually mac
also.net framework and net core there's
no universal language also windows comes
with different versions for example the
windows 7 comes with dotnet 3.5 and
windows 10 comes with net 4.
so we need to understand these parts
moreover
uh there's a problem with uh c-sharp and
that assembly just like the power shell
and what happened to powershell
c-sharp also and
that net also gets their own
security controls
after 4.8
that net framework also has mc
integration and windows defender can
identify your malicious behaviors even
though they are not running while you
are loading the tools or certain
functionalities they can be directed so
it's not only about static analysis
evasion or some dynamic analysis evasion
it's more like someone is on your
shoulder and watching what exactly you
are doing
so this type of abilities and
limitations must be known because we can
still leverage those abilities we can
still work with implants we can still
work with tools if we are actually aware
of the um defender or mc or another edr
watching us so we can just deal with
them
that net comes with actually clr and um
we need this runtime to actually
interpret our
binaries the soundies but they are that
meta sound is not native sound is to do
that we need to understand what type of
runtime environment we have
if you are running on windows you can go
to actually see windows microsoft.net
framework and after that the version
folder
then you can see the versions whatever
they are
they may be dotnet 2 that the 3.5 or
that n4
some of the functionalities are missing
in that net 2 or that net 3.5 that's why
your implant must work on all of them
actually universally
and another problem there is it depends
on how you compile them
let's start with some basics before
making things complicated
how you can compile these operations as
well as c-sharp binaries are quite
simple actually
you need mono
and you can install mono using apt
installed monocomplete on linux
or for mac you can just download this or
use brook install mono
mono will help you to compile all these
binaries with no hassle
but there is also.net and dotnet is
available for windows linux and mac as
well and you can also download.net
dot net can
build run and work with nuggets as well
and mono can do that mono can do this
only for that net framework while that
net can do this for net core
that means our implant must be using.net
framework to work on windows 7 and 10
without any issue
and our server side could be.net core
which is cruise platform
and it comes with additional features
especially that need five
which is another type of call the newer
version latin 5 comes with additional
actually functionalities that could
really help us to automate some of the
features and implement them easily
that's why we will try to develop our
server side using that net maybe 3.1 or
latin five and decline and implement a
implementation based on that net
framework
which is probably
between 4 as well as 4.8
now this is a simple hello
we need to use our namespace we need to
use a class which is program in this
case and then we need to use a
functionality here
actually this class and the function
will turn to a type and method when we
compile them on.net assembly
so it is quite useful and it is quite
easy to customize them for example the
console.writeline is there and i can use
for example system.console.com
it is there but if i have lots of
console.writeline lines and instructions
i prefer using system in top so simply
system will help me to use console
directly with no hassle
so it is making things easier for the
namespace wise
this is another
example this is for string operations
string operationsof.net is also quite
familiar if you previously developed
some tools using a scripting language
such as python you can see some of the
string operations are quite easy to
understand adding strings to other
strings and modifying them getting
indexes getting them maybe replaced or
split they work well however if you are
dealing with the.net framework not that
net core you may have uh limitations
that's why we use actually uh system
text regular expressions
that's why we use regex dot split
and then the
string and what could be split or how we
can replace
because if we use string dot replace or
string dot split
it would not work on that net framework
because of the limitations it depends on
the version of course but most of the
time it is not implemented
that's therefore while you are
developing your implant please make sure
that it works everywhere
this is another example of if condition
if you previously coded on another
scripting language this may help you to
understand how this coding works and how
the conditioning the branching works
in this case i simply used arguments
and if there is no argument the length
is zero it will say that what you want
to do
but if there is an argument it simply
says that yes these are my arguments
these are my parameters through
it may help you to build your implant
for the console wise
but if is not the only way to create
branches switch is also quite useful
especially for the main generation
if you want to create a menu for your
console application switch will help you
to create a kind of decision tree
it is same for the implant as well just
imagine that the arguments coming are
not uh coming from the arguments they
are coming from the websocket or a web
page or a social media text
so you can see that they are coming
there so you can create your own branch
for example the instruction is right and
otherwise read so you can actually
create your own instructions there
try to keep the switch simple as well as
short
because you will need also the functions
to handle things for example
the right here is using console
writeline
but read is using the test function the
test function is important because it
gives you another opportunity to
continue in that branch
if you will implement everything under
the switch and case
this will be a problem for you and the
structure will be unmanageable
instead
all your operations should be standalone
functions
in the same class or another class
and you can refer them under the case
under
this conditioning if the condition
matches such as the text is read
that function will be called this type
of structure would help you to build
actually implant capabilities for
example write delete read run this run
that
and maybe exit as well
loops
are pretty similar to the other
languages as well and they can be
implemented using for or while or for
each
for each is useful for the objects and
it can actually get the objects
maybe the items of a array or list or a
dictionary and start working on them but
while and four they are looking for a
condition for example increase
this integer one by one
until the condition arrives or while
condition is true
do all of this in a loop
this type of loops are useful when we
are waiting or processing the objects if
there is a kind of dictionary or a list
to process we can use this type of for
each approach or for approach whatever
useful
another thing is we
also have issues
as a starter we fail and fail is a good
way to learn as well but we need to also
catch those failures
and they are called exceptions in the
programming and that's why we use try
and catch
and this is a simple try and catch
example and it may help us to understand
how we can fail or how we can proceed
now
i also mentioned that you can use mcs or
csc to compile right
but compiling them will make them
executable the pe binary
but there are other ways to run them i
will give you only the powershell
starters now but there are several
for example the powershell
can load the net assembly and can use
system reflection assembly to load it
and to run it so it can actually get the
types get emitted and even work it
it can actually focus on entry point as
well so they can be used
to actually load the implant from remote
let's collect everything together
we have an implant that can actually
accept some of the parameters the
parameters can be coming from let's say
console or a web page
and we can branch it using switch or if
when the condition arrives when the
instruction arrives we can create our
function
and we can work on it
if implant works just like that we need
a starter that's why we use powershell
and it can be called as a dropper as
well and what we do is simply
downloading the dll from remote
and
for example using system reflection to
run it or we can download the source
code the cs file and we can use add type
and require assemblies if there is
and then run it
revealing your c sharp code would not be
great
but if it is just only a dropper just
like this
if it is sacrificable to sacrifice it
and go on because it's a trade-off you
need to make it running then you can
load your actually important code when
things are safe
now it is exercise time
i will give you some hints to make it
your own exercise time as this is a
pre-recorded workshop
i will only give you the hints
but meanwhile you will work on the
exercises
so let's work on first a couple of
things
you need to set up an environment you
can use mono or dotnet installing.net is
simple download.net from microsoft web
page for your operating system and
install it or you can use apt install
monocomplete
and mono comes with actually mcs and csc
that can be used to compile that net
c shop code
compile the sample binary in your
chapter one
you can use hello as an example as well
but there are also interactive menus so
try to make an interactive menu that can
use a sample function for you
which is also given
and make your implant running on the
console first
compile it using mono or net
and run it
i will provide just a kind of starter
now this is a simple starter your
chapter 1 comes with some examples right
condition console parameters and hello
the hello is simple as i actually
previously
shown
it is simply
writing a text using a console.writeline
you can use mcs to compile this and
slash out will give you the file name
and you can just name it whatever you
want to do it will be your output and
mono can be used to run this executable
but remember one thing here
mono is necessary the executable won't
work without the runtime
in dot net it is slightly different you
can use that net to compile things as
well but you need to use that net new
and then console application and your
directory actually the application name
and now i enter the application
directory and it comes with a cs
approach file as well as program cs
program cs is similar again hello world
it's the same
but this time dot net needs cs approach
that gives that net the instructions and
the capabilities to run
so simply when you hit that net run
it lost if there is any references
necessary in the cs approach and then
runs it
now you it's your turn to enrich this
using other examples for example using
interactive menu
and the case searches
so this is the end of our first chapter
and thank you and stay tuned we will
focus on the chapter 2 chapter 3 and
chapter 4 and how we can actually start
building our c2 implant
if you have any questions i will be
available on discord channel of advisory
village
thank you for listening this chapter one
hi
welcome to the chapter dew i hope you
completed your exercises and your
environment is ready to go
now we will talk about how to develop an
implant
and a c2
so
we have microattack techniques and they
are everywhere in the trade intelligence
reports the offensive tools defensive
tools what we need to do is focusing on
what we can do with them
therefore we need to understand what
ideas and what features to be simulated
and we can add them one by one to our
implant
as integrated or
is it standalone binary or standalone
feature that can run together
so let's start with how we should design
our implant
our implant may have some various
features
and they can be used for attack
simulation and those features could be
built in or they can work from remote
sources
we have some essentials such as upload
download functionalities or maybe some
certain commas to run whatever we need
constantly
but there must be also some features
capabilities focusing on
the third party tools
they could be dotnet applications
powershell scripts shackles and some
other features as well we don't know we
will just develop our implant on demand
whenever we need some micro attack
techniques we will add those features
using different capabilities
even you can implement beacon object
file both
process as well if you want to add both
process or both interpretation you need
to add some additional layers let's
focus on these base lines and how we can
develop our implant to support a.net
assembly that needs source code maybe
powershell code and also shellcode
itself using different types of
injections moreover we need also lateral
movement
this means we need to also focus on some
of the networking facts as well
that's why lateral movement compromise
and maybe impact implant linking will be
necessary
our implant will need to get multiple
stages and instructions from web so
there are some different types of
um cto's
the first cd type is
just discovering things
it's more like non-interactive c2
and it will help you to identify the
target whether target is in scope or not
such as the solar gate exercise it may
help you to get the initial instructions
such as register yourself or this is
your situ
and they can be everywhere
for example a social media and maybe a
twitter tag as well
and nobody will
see or identify what would happen until
someone actually to be using that tag or
it can follow up a general tag and it
could seek for some certain instruction
and this has been done by tool anyway
the other type of c2 is important
because we need to now communicate not
in real time maybe but we need to push
out some data
for the implant so if that will run it
and would send some issues or maybe some
tasks or maybe loot as well
in this case it is important to
understand what implant can do
but also to understand what we want to
do through this protocol
based on those requirements we can use
http or http websocket dns or similar
protocols
and it is called tasking
and task management
another type of
cto protocol is payload servers
and they are there to deploy additional
stages if you want to deploy your second
third stage malware or some dangerous
binaries through your c2
probably you will burn your c2
therefore we use also payload servers
and the payload server
serves some additional stages for the
implants such as some dlls some shell
code or etc but they need to be also
encrypted
in some cases we see all of them
combined and some advanced uh actually
advisories we see them distributed to
different decker containers different
servers or maybe already compromised
components or companies
now if we want to build a new plant we
need to start with some gadgets
something must be there already and this
can be
actually a gadget list or pre-used code
msdn is quite helpful and i use mstn to
build we know the api code or some
simple actually instructions
but also there are really good
researchers in the wild and their
repositories are quite impressive
if they're licensed at laws and if you
show your respect to those
authors and researchers you can use
their samples in your implant to work
out and if you have improvements please
share with those researchers to improve
their work as well
for this perspective we generally focus
on the gadgets what we can use can we
make it a function can be implemented
in our implant in our malware okay
so there are several examples out there
in atomic writing repositories or
individual research repositories
registry it is one common feature we
need registry is important because we
need to add some registry keys or remove
some for different purposes persistency
is one of those but there are also
privilege escalation com hijacking
lateral movement techniques they are
there and they involve some registry
operations
to do that we need to understand how
registry works that's why registry basis
uh dictionary in this example
shows you what registry keys could be
used in hierarchy and how we can create
one or how we can work with that
and whenever we learn how to create how
to delete how to work on the registry
keys or the values
that would help us to build our implants
additional capabilities
so we need to make this a standalone
class or an integrated class or maybe a
third-party feature whenever necessary
we can load this from remote
but it is
used for several different purposes so
we implement this part
another one is also the process
it is important to understand how the
process things work because we need to
run some commands
as an implant we can simply run some
commands such as where my calcan etc or
notepad and they can be used for let's
say open book exercises to generate some
indicators of compromise but if we need
to go subtle we need to use some
additional features here such as
changing the startup parameters and
working on the process components but
this really helps us to run some commons
in this environment we can make it a
single liner or we can make it a bit
custom that helps us to give some
parameters and commands as well
one another requirement is the
encryption as our implant will retrieve
some data from the victim to our server
it is important to hide this data
in the cloud environments and insecure
networks we don't want to reveal the
data
without any intention
another problem there is we will need to
use
encryption to hide activities sorry hide
our malicious activities
some of our malicious activities will be
in the source code itself for example
hiding a kind of shell code or some of
those would be on the network such as
rct communication so encryption helps us
to harness this layer and make it none
let's say non-readable or
not easy to decode or not easy to
decorate
the problem there is
what encryption type we use
because
if we use symmetrical encryption our
implant will need a key hard coded or
during session we need to push it out
that will reveal the key and that will
be actually leading to a full compromise
and full decode of the implant
instead of this we can always use public
key private key encryption
so it is a kind of choice for you and
this is easier implementation of the
symmetrical encryption so you can use
this with the keys and keys can be
generated per session when the client
arrives when the client connects so this
will give you at least an option uh to
keep the key in memory instead of
hardcore in decline
in the implant itself
another one is also we need to retrieve
this instruction list or the content
from remote that's why we use some web
client or web socas or similar features
the problem there is
we don't know what we would retrieve
that's why we need to handle this very
carefully
we use a circuit.net features in this
case uh circuit.net will have web client
for us when we create a web client it
will give us some features such as
proxy options such as create cache
cached credentials so we can assume that
the user already had credentials before
us before we arrive and we can start
using it
that means we don't need authentication
that would make things easier but for
this simple implementation creating a
new web client will suffice
and from that moment you can just assume
that just like your interactive menu you
can use the client to get a file from
remote and use your own switch case to
create a branch
or maybe multiple branches it's up to
you
in this case webclient
may support multiple
actually multiple functions for your
multiple methods one of those is
download data and the second one is
download string
we use those two
too often because download data guess
everything in the byte array and
download string will give everything in
the string format
we use download data because because it
is uh less monitored or less understood
as it is by the array so we can get this
right array and we can process it if you
get the assembly as string and try to
parse it and also run it that will not
work instead if this is a byte data and
try to process this and then load this
assembly
of course loading assembly will require
another function for you that we will
discuss shortly
but if you want to enrich your web
client there is also an advanced feature
for it so we can always use web request
instead of web client web requests will
give you multiple options for example
communicate through the headers only
that is useful for the cloud
environments if you want to deploy your
c2 as a serverless application to the
cloud services you would prefer to use
some certain headers for example aws
other or google headers in your
communication to make it
let's say not easy to understand or not
easy to spot and you can basic foreign
code the content or maybe just encrypt
the content for this purpose
another uh type of uh requirement here
is actually to understand the flow
itself that's why sometimes you need to
use also the response and stream because
download data and download string will
give the data like this
but when you start dealing with the web
request you don't know how to deal with
the data because data will be even a
stream so you need to make it a stream
you need to handle the data properly to
not lose any content on the way
as i imagine that you can get a kind of
binary from remote but you need to run
it right that's why you use system
reflection assembly just like in the
powershell because it is also that net
feature available on powershell as well
as dotnet as well as c sharp so you can
still use system reflection glass for
this feature and you can use load
method to load an assembly from remote
or local whatever you do but i made this
function
for an easy access because whenever you
give a byte array it will load this and
run with the parameters there but you
can make the parameters uh also a
variable and you can put this in the
function there as well but this kind of
homework for you you can easily copy and
paste it there and you can look for any
parameters or any arguments given to run
because you can pass it through
it's up to you
also there is another option here
in that net core there is roslyn and in
that net framework we have
actually a c code provider for the
for
net compile features that means we can
compile c sharp code or simply.net
source code in memory
with providing no artifacts no files no
executables only in memory is a kind of
variable or a kind of data for us
roslin or a c sharp code provider will
work for us but it really depends on
what that net version you use and on
which platform
because it is not good for all platforms
and it doesn't work exactly as expected
in this case uh the provided example is
for that net framework so you can use
this on windows.net framework
environment to compile the given c sharp
in memory and make it an assembly and
load this and run it
the lines are explained in the comments
anyway so that's a good one
so
it is your exercise time i will give you
another hint here but this time it will
be extended because i don't know how you
want to go but i have different options
for you the option one is you can
download a simple text file and
understand that okay there's a content
here let's say c2 instructions given by
a server how can i run it
or you can actually
go
one step further and say that okay these
are the instructions can i load
anything else from remote any new
modules or something like that and one
more
let's make it for example download a
text file discover c2 download stages
and
start digging and run interactive in
real time implant and c2
so the problem there is how we can fit
everything in
let's say 15 minutes
that's not always possible so i will
assist you i show some code segments and
gadgets i have put in your chapter 2
folder
so let's start with that
firstly this is our environment and we
see the chapter 2 here the chapter 2
has multiple examples for us and some of
those are highly important and let's
start with the simple ones for example
the process check is a class and it has
a method there it is a function and it
is process running
so if you want to move this class to
your code you can easily access this
using process check that is process open
and explore
and it will find explorer if there is a
process like that
so it would help you to understand what
process is running another one is web
client you will need to download
something from remote right
that's your example it accepts some
arguments but arguments must be in an
order the console rightline help
actually shows you the options for
example url asm source and file asm file
source so simply you need to create a
web client if you want to deal with the
remote because the instructions and the
content will be coming from remote
and you need to also create some
variables for byte
data which would be assembly or source
code which could be string
and
you need to parse the instruction if
instruction is url that means you need
web client and get this from remote if
it matches with asm you should expect a
kind of assembly coming that's why you
have to use byte array and download data
and your function is a exec.net assembly
as i already shown you
it is there to pass this if it is
darkness source code you can use dotnet
actually uh download string
for uh web client but it can be also a
kind of battery download data and you
can convert this using encoding as well
but that's an option
file also shows you another option
and reading a file or reading your
content writing your content
so you now know that there's a kind of
class for you for the
file i o options
so simply you have these options but you
need also those functions in your code
in the same name space
so in this case compile.net source the
function i have shown you is here to
compile and run the c-sharp.net source
code
of course references will be a kind of
trouble so you need to adjust the
references and you should make it a kind
of area as well it is same for exact.net
assembly so it is up to you how to
improve those but it will work for the
simplex examples
one more thing is important because our
normal client will retrieve something
and start working on it what if we want
real-time communication that's
actually that's our reason for websocket
implant
and this website implant is quite simple
it creates a web circuit client this
time and it tries to connect a certain
service given and if the web circuit is
open it receives the instruction it
processes the instruction and after that
it actually sends the data as a result
that's actually a kind of pipe
that means the server side needs a kind
of menu to give this data implant needs
to run this and send this back so we
need a kind of communication like this
instruction process on the implant is
the function we actually use it is the
interactive menu you were looking for so
you can put actually everything there
an instruction process will help you to
do that the question is where can you
find the kind of website server that is
there actually in the same file in the
same folder website c2 folder has
program
cs as well as the websocket service for
you that means you can create a new web
socket
and create actually a kind of menu for
the user
and wait for the clients arrive if any
client arrives
and you can start actually waiting for
the input from the user whenever it
arrives just pass this to the client
the web success service class is there
for the general use
but you need to customize this for ssh
certificates and some other features as
well so it is up to you
so from this moment you have options
and you can use that so let's compile
them and see how will they work
first things first our mcs which is the
mono uh c sharp compiler will help us to
compile the web client in this case okay
and now web client will be the web
client is designed and it actually
gives us some options for example
running some additional features and
running some additional components
in this case i'm showing you the c2
commands i have put in the repository so
there is a kind of an executable
there.net binary so let's use web client
exam it simply says that url asm and
after that the exact uri
for the assembly so let's use that for
example mono that client url asm and
then that is the exact link of the
executable
i'm talking about the rolling by the way
please don't get confused there
when we get this it will load the
assembly and it will run the output is
coming from the assembly so we have
something to start right
so we can build something top of this
it's up to us
another one is also important because we
have some multiple options as mentioned
if you want to go to interactive patch
web circuit is a really good one to
implement this
and list is start using this example
let's start working on the web circuit
implant the vape circuit implant as i uh
actually demonstrated the code itself it
is quite easy to understand if you
understand the classes are coming from
that net not you developed
simply it will connect to the server but
it will require a parameter this time it
is using ws as the uri start
what http will work as well because that
is how websocket class of that networks
we need to run the server in this time
and the same folder has website c2 when
you enter it and when you use dotnet run
it will actually start
the website service
this means you can start listening to
the port is hardcoded you can change
this as well port is localhost 5001 it's
up to you
and now
we are looking for this part which is
quite easy
same uri and giving this as a parameter
and of course use mono not like me
and now they are connected to the cd
server
the thing is c2 server
will need to give commands an implant
needs to run them
the commands are not implemented on the
server side so the server says that yes
there is a client arrived so i can give
these commas on the client side we can
also debug all these features so
it is easy to understand this
communication and echo
a number it will be given by the client
and run who am i it is coming from the
client as well
it is real time communication and
whenever you hit exit the server as well
as the client they will just stop
working you can change the words and it
can be good as well it's up to you
so this is how it works
this is how it works for different
source types and different c2 and
implant types what you need to do is now
enriching the switch cases
and using branching your favor
and you need some classes there and you
need some code segments and
they are in this chapter 2 folder so you
can work on it and you can enrich it
okay i will be on the discord of
advisory village now so if you have any
questions
we can start working on it and how we
can go further is in that folder as well
as
on discord
thank you for your time and thank you
for listening to the chapter 2 of this
exercise and workshop
hi i hope you enjoyed your chapter 2
exercises and
i hope you already have a sort of
implant working
but this time chapter 3 will be a bit
different because i don't know what type
of implant you have and what type of
features you're exactly working on
that's why i will talk about
some techniques or capabilities that you
can add up of your implant
so this will be more like a kind of
instructive part but after that i will
supply some good examples to you that
you can utilize
in your implant
and some of those will be coming from
the attack implant i have mentioned in
my presentation
so now let's start with the windows api
and how we deal with that
windows api
in that net framework
we use windows api through the
platforming works
which are also known as pmox
platform inbox are available on
microsoft web page as well as the other
web pages in a different way because
microsoft web page
actually defines how platforming works
work and supplies some information but
you need
actually the platform invoke
actually the exports converted to that
net environment
simply allows us
to use
exports of the unmanaged code
but we need to understand what type of
variables what type of content they
expect what type of data is expected to
do that we need to understand actually
this as well as defining our code then
we can use those functions as our
internal functions
such as this this one is a good example
because it is using system runtime inter
op services because this is how platform
work works it is using actually user32
dll which is an internal windows tll and
it is used for windows api as well and
it is simply using message back a
message box
function
so what we see here is the first one is
the extern
simply defines
that export for us
simply we are looking for an export
called messagebox in the dll named
user.altitude data
and those are the
variables and data formats we expect
so now we can add our own and we can
make it working like that
it is easy if it is only message box
platform inbox
actually gives us more opportunities in
different platforms
for example if this could be a different
platform such as mac we will use
dynamic libraries just like the dlls
so it is not so different we can still
use private static or public static
external and we can just work on it
the problem there is though
if you start developing your tools based
on the apis you know the api or
mac or linux simply start using
unmanaged code in your environment
it will change your code as well as
programming perspective because it will
be not a part of your code
so it it may not be present in the
targeted environment in the victim
member
so you need to make sure that the apis
you need are available in the target
operating system otherwise they will be
there and they will work on mac linux
and
windows when you start referring certain
libraries things change
it is same for linux as you already see
it is this time leave c cheryl object
six so simply you try to get get peed
and
it works just like this
so things slightly
gets complicated from this moment
because we use one single dll one single
actually export
and if you want to go in different ways
for example the process injection
shellcode injection dna injection times
then we need to use multiple exposed
multiple windows apis using the right
content if we use them improperly
probably our application will crash
and worst case the process or the target
operating system will crash so we need
to be very careful from this moment
so
where can we find this information
though i mean
how we can understand what uh data types
are accepted by the targeted export
targeted unmanaged dll function
in this case pimwork.net helps us to
understand those apis and how we can use
those dlls
but we can also create all these using
their tools as well
this is another example at this time it
is going a bit complicated not so
complicated but
still
you need to follow this up first things
first this is a shellcode injection
this is a good start
let's focus on how we prepare our uh
initial part not before we actually we
need to prepare this part before using
our functions so it is important to
understand what api calls we are
planning to use
in this case virtual outlook will be
used to create a memory space for us
and we can create read only read write
or read execute
or read write execute permissions in
this memory space
create thread will allow us to create a
new thread and therefore single object
we will wait for single object will
allow us to actually wait for it
so let's start with that
if we try to use ritual outlook
using page read write execute
permissions it will create a memory
space for us and it will return the
function address
so simply
now we know that there is a memory space
created for us and we have the address
of the pointer of that
part so we can start using it
there are two options from this moment
to pass data to that memory address one
is the windows api
i didn't use this in the example but it
could be used for example write process
memory
the second one is the marshall
marshalling marginal copy that is an
internal functionality in the net
the difference between those two is
actually evasion
we will discuss this in chapter four but
this is a kind of simple evasion if the
edr or antivirus expects for example
virtual analog then write process memory
and create remote thread is a pattern
we simply break this pattern
we don't use right right process memory
in this example so this is one of the
points that we can add for evasion but
this is only for functionality and use
for here
and we use marginal copy
to push our shell code the byte array
to
the given function pointer
so simply
we define that shellcode from
the
actually zero and this function pointer
and the length of the shortcut
so simply
our data is in the memory
the problem there is we need to also
create a thread pointing that part
so the trade will start and
it will execute our given child code in
that memory space
so create thread will help us to create
a thread using
that data that's why we use the
functional address here
and then we simply create a new thread
in our own process
and we wait for it
and when it starts
that's good we have a new thread and the
shell code executed in the current
running process if the process exists
it dies if the process has been killed
it dies as well
so this is really important to
understand because it is still an inline
code execution
if we go for remote process
that will be a different case
this approach would be still called
slightly safe
because you are still in your current
process you run code in your current
process and it is a sort of normal
application behavior
when you start dealing with the remote
processes things will change and edrs
and other things will identify you
moreover whenever you start using
teamworks and apis like this the edr's
edrs will also catch you for the api
perspective
now there is another one but this time
we are using two user apc
and
as you imagined those
functions the apis also have there
actually definitions before this
function starts
let's try to explain lines here it is
important to understand the base64
content here normally most of the
researchers or sample uh
suppliers or proof of concept
researchers they put the shell code in
base64 format to the code or as a byte
array and it is really easy to spot
by the antivirus uh or maybe edr tools
but we can change this approach because
static analysis is also something and if
you have the payload that's a bad thing
simple evasion here is
just
placing a random string before the
base64 content which will break the base
base64 and then replace it in the next
line or maybe a few lines after
simply you will decode this
you will
access the real data but under certain
conditions
you can make it conditional as well
for example you can check the hostname
you can check the cloud
components you can check the device
that will help you to understand what
environment you are working in that is
also chapter four evasion techniques
when we deal with the other stuff it is
similar as well for example in this case
the process injection the trade
injection
to a remote process
works pretty much like this firstly we
use another process
but i'm not doing this to a remote
process already running we create a new
process that's the good part
and that also helps uh us uh in a couple
of a couple of different ways because we
can groom it we can just use another
process as its owner as well but that's
another example in your folders anyway
so you may
actually spoof your current pid
you can also change a couple of things
while process is suspended as well
because you created this process it is
suspended and is ready for any
manipulations so you know what state it
is
after that dealing with is handler i'm
creating a new memory space there using
visual analog
but this time using right process memory
to push the data you can still use
marginal copy but write process memory
helps here again
and get process id
and after that we have process id we
have threads we are
using open thread for the trade itself
and we recover the permissions of the
memory space using virtual protect this
time because initially we used read read
write using virtual outlook but this
time we make it read executable if we
don't do that it will fail if we use
read write execute that will be not good
for the dev perspective
so this is
more
accurate
after that we use q user apc
for this thread so simply the
application will know that there is
something waiting here
and it will process it and it starts
running
then we resume the thread and it will
work so this is how it would work in the
code perspective
so
in this case you need some of those
examples
the good part here is attack
capabilities
class is supplied in the chapter 3 4
folders so you can go to the attack
capabilities to see those
functionalities they are actually
enriched they are actually changed for
example they spoof the parent pid and
etc when you look at the code you will
see some improvements there moreover
as i mentioned some of the net features
allow us to pass the parameters while
running the assembly itself which is
good
and you can actually see that it is
implemented in that code it is same for
the
actually source code compile
the exec gives you multiple options for
the parameters so it is quite useful you
can either way get this class itself as
a part of you
or you can copy that function
but remember that you need the
previous definitions
because they are p marks
and you can copy to your own code one by
one
because patak is in the mit license so
that's the point you can use it as a
gadget
so you can actually extract whatever
functionality you need from that one
in addition uh it can run the powershell
but the powershell is running through
the system automation system management
automationdirect is deferred as well as
necessary when you compile this
and if you enabled or if you didn't
remove this powershell automation class
sorry add a function
you need to compile with the reference
of system management automation dll
which is a good example for you i put
the dll in the same directory so you can
see it
but if you target a specific framework
version it may not work so you need to
use nuggets to get the correct version
of the system management automation dll
and then
defer it
if you want to use specifically that dla
to work with your implant then you can
use actually some merging tools such as
ielt merge
so there will be one single binary with
this dll coming so simply it will be a
part of your functionality
and you don't need the system to have
this management automation data
so the exercises the exercises are
slightly simple but also complex this
time
simple because you will add one or two
functionalities i assume that you
already have an implant
and it can communicate with a web
service
using web sockets or a web page using
web client or a console application with
the user
and you already added some
functionalities there when you
looked at the chapter folders you
already found some of the
functionalities now in this exercise you
need to extract some of the
functionalities from attack and use them
as a gadget and you will understand what
is missing when you try to extract that
portion of code because the pinbox
defined
will be undefined in your code and the
compiler will fail
another thing is you can also add some
additional functionalities that are not
exactly
available in the attack gadgets but they
are available and also introduced you as
let's say encrypt and decrypt in the
previous word actually chapters
and you can make them a kind of
ransomware for yourself
for example encrypt a certain file they
keep the certain file use a key
if you remember the encryption and how
it can be used it can be dangerous as
well for the ransomware operations right
so let's start with that
first things first let's
work on our environment and
walk through our source code
sorry
yep this is our source code environment
so simply this uh chapter 3 has examples
of
encryption
as well as our capabilities
and some pin blocks the pin box are here
for you to copy and past and to be used
directly i also i also put the readme
here
in case of you need a kind of easy copy
pass for compile or to understand the
functionalities one other thing is also
the shell code here and charcoal invoke
that will help you to
actually inject a shell code to the
environment virtual outlook create
thread wait for single object these are
the example
actually
our examples previously mentioned
and this
can be actually utilized like
normal console applications or any other
example
if you remember your hello
example hello exa hello exo was actually
running as an assembly from remote right
if you understand that part you can also
use
this shellcode invoke and it may accept
the demo parameter
as you see here
it accepts parameters
and if the argument
the given parameter is demo
it runs this functionality
that means also
if we send demo
it will
run this shell code given using the exec
shellcode 64 function and the shortcode
is
the shellcode of calc
to run in your environment
this will only work on the windows of
course because process injection is not
designed for mac or
actual linux and it will require 64-bit
so this will use the function that i
will explain in a couple of minutes
so if that is the case
your implant can utilize
this dll this assembly from remote
what i suggest is
compile this
make necessary modifications upload this
to your remote location or use your
python simple http
server or something like that and serve
this data or you can use file io read as
well read all bytes in the file will
help you
if that's the case the file will be
loaded start using your own dotnet
code.net assembly run code
to run this assembly because this
assembly will require a parameter make
sure that this parameter is passed
through then you can observe
this example
will be
loaded from remote to run as would
inject the code
now let's work on the code part as you
see the base64 content
is there and it is
removed and replaced
so the static binary may have less
concerns i'm not saying zero directions
definitely
the pe executable when you compile this
we'll have already some indicators
because we use
pimokia
anyway the exec shellcode will actually
accept the byte array to run this
shortcut
there is also row demo i made actually
commas here you can uncomment this to
see the detections and the components
because it is the same source actually
same shell code same bytes but this time
it is not encoded it is the white area
itself
so you can use it
actually this will be also interesting
for you
so you can make it a kind of staged
environment
let's assume that you had already an
implant
and it was checking the c2 command text
on the github repository
so you can download
this dll
from remote
and given parameter will not be demo
given parameter will be another row dll
pointing to
the shell code
so simply you have multiple stages your
first stage is the implant itself
impact gets
the second stage which is another.net
assembly
and given by the c2 command text
and
this binary will also require the third
one which is the shell code in basics of
base64 uh encoded or byte array format
see multiple stages if you are making it
also a purple team exercise place flags
on them for example put some uh
variables change variable names and make
them a kind of flag for your blue team
to identify the levels of the structure
maybe they captured the first stager but
not the second
or maybe they have no idea about the
payload coming
you see what i mean you can add flags
and you can improve directions and you
can help your blue tumors to understand
this process and stage the approach
because if you do not ship everything in
one single monolithic file
the detections will fail
so it may help them to understand where
they fail
also this excel shellcode function is
the function i have actually shown you
so it is slightly simple
attack capabilities on the other hand
it is quite rich so you can exactly see
how it will work and what actually
variables it uses at
what pin box are already defined for
what purpose
when you scroll down you will start
seeing the functionalities each function
will have a different purpose in pataki
implant
in the repository you will understand
reasons as well as content
but in this example this simply checks
that the platform is vin or not if it is
not windows
your implant will refuse to work or say
that those functionalities are not
available on windows
please give them other functionalities
so
you can load another implant type
specifically for mac or linux this time
it's up to you
exec sharp assembly also
now accepts arguments
as well as thread support
so you can actually
give the arguments if it is not null it
will work with the parameters
and then it creates thread as well
so it will work as a new thread
it is similar for exec sharp code
and this time sharp code will be
slightly enriched but there is still
room to improve this because as you see
the references are hard coded so you can
actually create another area here or a
list
to
add more references so
if someone pushes sharp code a kind of c
sharp code to be compiled they can also
pass a list of references already
required for this compile operation
i'm scrolling down and there's also exec
here at exec as mentioned it's a kind of
process execution for us
so we can give some parameters to run
this executable
our shell automation is
there to
actually
run this powershell through the system
automation
so it will use system automation if you
give if you assign it if you referred
and exec shellcode will run the queue
user apc
shellcode injection so
the content is here
you can modify it or copy and past
whenever you deal with the windows apis
though like this
you need to make sure that you also copy
the definitions we already put before
the code
now one more thing before leaving this
fun
there is also rand soblin
and rand soblin is available here
ron swablin is a ransom variable coblin
simply i have used this in the ta 505
exercise
so it helps me
to encrypt a file and
decode it as well or decrypt it as well
and it can help you to add some
ransomware functionalities
as you already see it has a menu
that we already created normally using
switch
and if it says encrypt it encrypts if it
is decrypted it decrypts that's it but
it is using hardcoded keys so
it's up to you to give the key or change
the content so you can make it actually
a good
tool
right it is right here the key strings
now
one more thing we have
which is
our repositories that we can actually
improve things
as mentioned there are several different
types of functionalities codes and
methods here so
ga 505 plus adversity simulation pack
also have all of those it has
documentations
and it has actually resources there as
well the resources are developed for
this exercise the excel file and initial
dropper and some other contents as well
as some preparation commands shellcode
you can use them but more
important one is it comes with
the videos if you concern that where we
can find the videos in the same
repository
exercise videos
linked here and when you go
you will see lots of different videos
here
and they will help you for each stage of
this exercise design or
replicating the exercise content
weaponization phase is related to your
development
and after that delivery and lateral
movement will be related to the other
sections you are planning to run
one final thing if you want to enrich
your malware attack c2 is here it is
also mit licensed so you can easily
modify or copy code from there and go
further
now chapter 3 is done
and you can use those calls in your
chapter 3 folder to add additional
functionalities to your implant i don't
know what you want to add so
you have multiple options here feel free
to copy and paste them or add them
based on uh your own requirements
i hope this works for you and this is
end of chapter 3 in
chapter four we will discuss about
evasion tactics and some of the advanced
content but this time instead of
exercises we will try to understand how
researchers designed this n word
thank you for your time for the chapter
three and uh see you in chapter four
and i'm on discord by the way if you
have any questions feel free to jump to
this court and ask questions if i have
any mistakes with the information or if
i misinterpreted some of them please
also remind me the correct information
so everyone will fix this as well cheers
welcome back
this is chapter 4 the final version
we will talk about evasion i hope now
you have an implant working well with a
c2 or a website with some
functionalities
now it is our turn to make it evasive
and we will talk about evasion now
first things first we have simple
security measures that can be
implemented to avoid this type of
detections as well as security control
interception
that's why we talked about a couple of
basics first
staging
as i previously mentioned you can
actually split things out the first
thing is
loader the second will be stage one and
after that stage two stage three
whenever you split things up
that would help you to actually focus on
different components
moreover they will work together
it will help you to implement flags and
features for the blue tumors and finally
it will avoid detections because most of
the software as security controls
they focus on
everything in the same place
but you can actually use a loader
checking the environment if everything
is all right it can move on if it is not
it can't stop this is not my target
or you can implement another check for
example i don't want to be actually a
part of this environment can i escape or
you can add another check for example is
there any antivirus or a certain process
running if so
is it my process or is there any mc for
example if there is mc you can retrieve
the
bypass tool and it can bypass it then
you can start loading things but if
there is no mc you don't need to load
anything from remote so you won't expose
your code
so
simply staging helps you to speed
everything
to different components
and actually is easier to maintain
easier to deploy to the remote systems
also
deployment part would be a problem
if you remember the chapter 2 and
chapter 3 required you to download dlls
executables or some c-sharp source code
from a remote web service
the real life does not like this real
life has some proxy controls the content
filters as well as the network
connections
this means you need to change them
base64 encoding xrx encryption or
whatever encryption you want to add it
will help you to convert the content to
an unreadable format
you can add the garbage data before
base64 to broad break it
you can hide your content
inside an image file you can do a lot of
different things
to hide your data because on the network
they will be visible if you don't
implement any encryption or
encoding feature
this is same for the c2 communications
so you need to add also similar things
to your cto communications instead of a
direct communication channel you can
implement actually
encrypted channel
you have encrypted functions
add them to your implant
and send encrypted and decrypted data so
the network interception
will not work
even though that will be an interception
it will not work with your system either
so it's a way
another one is you may run in a
restricted environment that could be a
sandbox cloud or maybe an environment
restriction
so
that would be because of reverse
engineering or dynamic analysis or
similar things so it's a kind of
defensive security measure
what you need to do is implement some
security checks there for example check
the device ids check the device name
and try to understand that the
environment is virtual
or
real or fake
then you can move on and sometimes you
need to even
actually define the target and try to
direct the target there for example this
ip is in scope or not
this was used by also and the value in
the solar case uh sorry
solar winds
exercise
and campaign
so
bypassing
mc
will be another phase because now you
know that you escaped from the dynamic
analysis environment
you are in memory
and you can still load some objects from
remote
that's the good part for you and you're
at a good stage
however
the vmc all as well as windows defender
is on your shoulder
so what you need to do is
actually patch it
and you can work on a couple of patches
and this example is based on amc scan
buffer mccann buffer is actually
discovered by cyber arc and also a
good.net example is supplied by daniel
duggan also known as restaurants
so his code is good simply if you are
patching
that memory space
also it is necessary for us to say
simple things to mc
it is looking for the length of the
memory space we simply say that
zero look at only the beginning
not to
me
so the implementation here is actually
slightly simple we actually load the
mcdl
it is already there we try to get
actually memory space
actually the function pointer for the
mcscan quaffer
and then we simply uh create a new one
or work on the memory it depends on
what we do
mc has tampering protection so whenever
you try to deal with the memory address
directly
it stops you but if you create a new
memory space push your actually data
there and then move the pointer
that would work that's how it worked for
diane douglas case as well so move
memory address was the solution for it
however this
patch is also detected because of the
simple strings that's why the strings
are also split up to different portions
to avoid detection but it is still
detected so
i have another example in your chapter 4
repository
and it worked for me in the ta505 plus
i simply replaced the marshall copy with
the write process memory api
and i also used handle to my own process
and it's a different function so i used
some obvious skills in your
meaning and it worked so you may have a
different point of view there and you
can add more functionalities to make it
work
by passing event out tracing for windows
is also important for that net because
event tracing for windows is developed
for debugging and performance monitoring
for the applications however in that net
environment it gives a lot of
information about our.net assemblies to
agree avoid this type of stuff
we can actually take some precautions
changing some environment variables
pitching our binary and focusing on ew
content
that will really help us to change
our detections
even obviously would work for example
some of the tools check out the name of
the tool we use for example seat belt or
ghost pack tools they are identified
very fast because of their names so you
need to obfuscate them
that we will discuss shortly
silk etw from ruben
boone it's a really good proof of
concept to develop for etw and saying
that etw can be used to detect
actually.net binaries and applications
and malicious code and tradecraft
simply most of the edrs started actually
adding this feature to the their
products so it can be changed here
so whatever you do for etw
you need to somehow
evade this otherwise even proof of
conceptuals will understand you but now
it is also edr's monitoring you as well
these are the blocks coming from
different researchers they explain how
they have solved this problem
dynamic invoke is also important uh it
is again uh coming from ruben boone and
volva so simply
we have some issues with platform inbox
and this research is a solution for it
whenever we use platform invoke
we actually actually reveal our intent
and the imports of the pe binary also
includes those apis we try to add that
means even during the static analysis we
reveal our intent and it simply says
that these are the apis this pe binary
wants to use
to solve this problem we can actually
resolve them in memory
this has been a solution for the c
or assembly
unmanaged binaries
however in our c-sharp world we don't
have these type of functionalities on
the other hand reuben and de vova
have
solved this problem partially and they
focused on dynamic resolution so simply
they are uh offering that
why we are not resolving the same apis
in memory
but it comes with the cost as well of
course it focuses on delegation and the
function pointers you can read the
research try to understand this and its
background or the other option if you
don't
like to understand everything you can
use the nugget prepared by the voter to
implement this as well it is also a part
of sharpsploit which is a lot of
functionalities
packed in adl
all power exploit features as well as
newly added features are a packed sharps
floyd dll so you can use this data as a
part of your implant and you can start
invoking
all these apis using this type of
dynamic resolution
so each delay it relays on actually it
relies on the delegate pointer now
on the other hand dotnet can also run
some uh unsafe code for you that means
you can run
unmanaged code here but it will be
highly sensitive as well as fragile
so simply it can be broken and very
platform specific you simply hard code
things there so you need to be very
careful about what exactly you are doing
however that must support this if you
compile the application using the unsafe
parameter it will allow you to run this
type of stuff
but again it depends on what you want to
do
there are examples here again jake
harding and bell panty so simply you can
see how it works
for you and if you want to add more
assembly instructions there for example
dynamic uh resolving of
apeb so for this environment block and
then work on a kernel 32 of finding it
and then dynamically resolving uh the
rest using guest pros get processed at
32 and download library and move on and
move on and move on
running unmanagedcoding.net is also
possible if you actually
escape from this sandbox simply.net is a
managed environment and if you want to
go to unmanaged environment you need
pointers and delegation simply you need
to escape adam chester is a really good
researcher and he found a couple of
different ways that helps us to
actually escape from the.net managed
code to unmanaged environment it is
using actually metal disk and pointers
for the function pointers and it is very
similar to dynamic invoke and get
delegate for function pointer so simply
uh marshall get delegate for function
pointer has been used to dynamically
resolve the apis in the dmv research but
this time we simply used other
delegations intaccol and q call
to escape from the managed environment
unmatched
obfuscation is also required because
whenever we use dotnet we also know that
this is bytecode and bytecode can be
easily converted so it comes with a cost
which means there is nothing to hide
actually this is a good thing for us
because it makes things easier but it is
also a bad thing for
our activities if we are developing
advisory tradecraft for red team
operations we need to go subtle and we
should not reveal our intent
and in that case we need to also change
our point of view there are options for
us to actually convert our code to
non-readable format
but also keeping because as is so code
will work but also not easy to read
we call this as obfuscation conversation
can be implemented in different layers
for example randomizing strings or
adding some functionalities or maybe
the performance
optimizations can be rolled back simply
the compiler performs some
operations to actually simplify your
code that's why the performance
optimizations happen while compiling the
binaries
in this case you can actually
use similar functions to some
unnecessary calculations or you can make
the names as calculations as well this
will help you if you don't want to do
that manually which is understandable is
second of long and accurate process
there are some tools that help you to
obfuscate your
botnet applications confusor x or rose
for skater or similar to statistic for
powershell kimeria would help you to
add some obfuscation techniques
for example offensive pipeline would be
used to compile some opensource.net
projects the tradecraft and obfuscate
them
and then
compile and push out so it will help you
to actually automate some of your tool
and tradecraft management if you
implement this with your implant as well
as c2 that will give you more
flexibility for example the implant will
actually connect to the c2
start communicating whenever it is
necessary the c2 will compile the public
tool for example uh ghost pack tools by
spectrops and they can be supplied as a
dynamic content
so it's up to you and it's up to uh
how complex your implant
of course there are some general
suggestions here as well um because it
is a kind of adversary environment we
need to slightly simulate them right so
they need to be approximation uh or
maybe one to one emulation so it is
really up to us how we should follow
this path um getting a kind of uh
signing uh certificate uh some of those
already exposing the one says it's
stealing or reusing some of those in our
binaries making it legitimate one is a
kind of option or implementing a kind of
driver that will be another case for us
we can deliver some of the content using
the webdav and we can actually deliver
the content inside uh stages using
vmware as well and there are some sim
sharp verda implementation that you can
use if not you can still always use some
other binaries or python files that can
be compiled for windows legitimate
binaries are also important because i
can give you a lot of heads-ups there
and the actually
exercise will
get longer and longer and the workshop
would not end but elon means living off
the land binaries will help you to load
your.net applications so there are
several different ways to
sideload your.net application to
legitimate binaries that includes ms
build install util but there are also
some other.net binaries can be
actually loading your binary using only
the configs that you can add in the same
folder so it's another research for you
for as a kind of homework and other
things are also common for example
common hijacking common hijack actually
calm hijacking sorry
comb hijacking is also a kind of common
vector for the persistency and lateral
movement we discussed about this a bit
actually during the registry uh
manipulation so com hijacking will allow
you
to
influence the other processes and other
applications and their
execution style simply you can create
some registry keys
in your current user environment as they
will be available in the aka
route the applications will find the cls
id you created and it will actually run
the commands you have given those are
quite useful tactics if you want to run
your loader without a relationship to uh
the starter for example the excel files
amc is important you know the deal with
mc is mentioned you can
actually patch it or you can just unhook
it or you can dynamically resolve your
apis it's really up to you i didn't talk
about edr unlocking techniques here but
they can be still useful in that net
environment if you want to go to on
hooking the environment
so dotnet is a good environment and it
can provide some of those but not all of
course there is no kernel driver in uh
c-sharp express i know
but it can also help you to create some
other tools in this environment as well
this means
your tradecraft will be enriched
using.net but if.net is not your
favorite please use the other language
whatever you prefer uh to reach out this
type of data i supplied some examples in
your chapter 4 folder
to actually work on
all these so using this information now
you can actually make your implant
working with advanced features implement
different types of injections in your
implant and actually add some
innovations
for example your
your apis
will be dynamic results or you can get
the shellcode from remote with some
encryption you can take some sandbox you
can check your target
those are good things and if you
implement them and make them uh simple
classes that will be really good for the
environment or you can make them a small
assemblies called gadgets and you can
call it from remote and your initial
loader will not have those
functionalities
and it will try to get for example the
remote gadget of check windows or check
target assembly it's coming from remote
if sandbox doesn't have any remote
connection it will fail and you are safe
anyway dynamic uh
analysis will not work if you get this
from remote for example an online
sandbox that is also possible and you
can check windows and your cloud check
will be coming from cloud
and internet as well this has a cost
though if the client has no internet
connection your impact will not work so
it it's a kind of trade-off and you can
just work on this type of stuff
conclusion so we had a large uh set of
exercises today and you try to build
your implant you try to enrich your
capabilities you try to implement this
using a c2 and try to add some evasion
tactics here as well so
there are good things but you need also
a homework so you are looking for next
steps these are my suggested next steps
for you there are
some co2s and implants developed in c
sharp uh in the wild and they are
developed by uh really great guys and i
suggest to follow these guys on twitter
visit their github repositories and try
to use their tools and understand their
techniques
such as adam chester dale dagger and
cobb and they are there and they
generate a lot of different content
for that net as well as adversary
environments so they can be useful
and thank you for your time and joining
me in this workshop
the next phase for chapter four is your
homework so
feel uh free to take your time
understand this rewatch the exercises as
well as
all this presentation try to understand
how it works and what you missed and
after that we can just make it better as
well i will take actually questions
through the discord uh of advisory
village so simply please place your
questions through the advice privilege
channel i will be online
even though this recording will help you
serve you for online
purposes
and
thank you for your time
and thank you for joining me i will wait
for your questions