hello everybody welcome to this talk
um my name is jose garduno and the title
of the talk is c2 centipede
it's actually the name of a tool i made
to try to evade certain type
of blue team detection strategies
um a little bit about me
um okay i was born in mexico
i took a small detour um i
ended up in switzerland after 15 years
of wandering around um i'm a
senior security consultant for dream lab
technologies
and i have been in the aldi team
since uh the year 2014 so basically pen
testing
infrastructure applications
and so on i have been a speaker
previously in
other conferences i would actually
recommend you um especially the ones in
latin
america um very nice
and uh fun places to be
okay so let's start why are you here why
are you watching this
so you are a red teamer and you know
and you want to know how your tools work
so you use metasploit or empire
and a little bit of how it works
it's magic to you like how do you
get the shell what's happening behind
the scenes
also it could be that you are not an apt
but you want to
emulate more advanced scenarios
than what the default vanilla metasploit
or empire can give you
and also you want interactive shell
without getting detected by your
tools beaconing okay so this is one
reason for the red teamers
and for the blue team of course how can
you
catch the bad guys now i will talk about
some
techniques how you can do it right now
and of course uh
with the techniques presented here um
what's maybe coming next um
so you can see um what the bad guys are
planning
so the context of these um basically i
just approached the
the blue team the sub team at dream
dreamlab because i
i wanted to learn uh their techniques
basically i'm a little bit uh
maybe sometimes too focused on the
offensive
part and yeah you just
hope they don't catch you or yeah
so so so this was a little bit of
finding out
what the blue team uh is doing now uh
what techniques they use what tools i
use and
maybe how i could evade them
the talk is about this journey to try to
evade the blue team detection on the
network only so
i will not talk about antivirus evasion
or any other
host based evasion
in this tool i implemented some
techniques new techniques used by
apts um and i will briefly
go over some vulnerabilities i
discovered along the way
um okay so uh
the basic objectives as an adversary
especially
uh let's say a red team adversary is
to maintain access in the organization
and to to have this interactive command
with the hosts inside the organization
and maybe exfiltrate some data
you also you also want to have a
resilient
command and control infrastructure so
basically um
maybe the blue team will try to block
you or
um they will try to bring down your
infrastructure as well um
and then how can you do this
while staying as anonymous as possible
so we will discuss
that as well so basically uh
i just started surveying what techniques
are
ipts using using most of them are used
with botnets so like fast flux networks
where there is a domain name that
responds with
several or very many ips to to every
request they get so this is why they get
the the name fast flux
uh and basically they they both nets for
example have
um or they install like a proxy so they
can use uh
all of these um all of this uh
infected hosts to um
to proxy the uh the traffic
from the victim to the command and
control server
um also the use um especially for
for botnets as well uh the main
generation algorithms
so basically um adversaries don't have
too
hard hard code um a domain name
that maybe if they do reverse
engineering
they can maybe sinkhole it or if they
uh add some hard coded ips
they can just perform some maybe a
sandbox analysis or something like this
and get the ip and then just block it
right so this is why they use
domain generation algorithms also
a very common technique for hiding
malicious traffic is domain fronting
and yeah well i will talk about that and
how
all of this is somehow integrated in the
tool
so uh let's talk about shells so
basically a shell
allows you to execute interactive
commands in a host right that you you
have
already um owned via fishing or
an exploit or something like this
there are basically two types of shells
the bind shell which listens on the
target
or on the victim basically the malware
opens a court
on the on the victim host and then the
attacker
uh connects to the victim in that port
and uh starts executing uh commands
there
um this works when there is
not a firewall here or maybe
maybe this user is not it so the
attacker has uh difficulty reaching
the the victim inside this network
network
or through this firewall
so the alternative is a reverse shell a
reverse shell
uh is the other way around instead of
the attacker connecting
um to the victim the the roles are
inversed
so the attacker um open support in his
machine or in a server he
controls and then um the malware he
executes on the victim
makes the connection back to his
server some types of reverse shells
with a basic simple tcp connection like
i just talked about
with netcut or like this very simple
very typical vash uh reverse shell
another way is to have a http reverse
shell
so basically here the attacker hosts an
http service
and the victim connects to it asking for
commands to execute so basically the
victim connect
says uh do i have something to execute
and the
um the server says then
yes you you can execute this the victim
will
execute it and will send the result back
to the attacker
why choose uh reverse http shells
so outgoing http traffic is usually
allowed in enterprise networks
um a lot there is a lot of traffic to
blend
in um there are also different
very wide variety of content
inside this http uh traffic where
um where you can hide your command
control communications
additionally techniques like domain
fronting can help you
hide this traffic this malicious traffic
then let's look at a specific example on
how metasploit reverse shell
payload works so basically you have here
the metasploit handler and
in the other side you have a interpreter
or the metasploit
trojan when you execute it
trojan it makes a request
a get request to the server asking if
there are any commands
that it needs to execute if they are
known the
the server responds with the http
response
there is nothing you should execute the
trojan then waits
for 10 seconds and it asks
again the same thing in the meanwhile an
attacker can say
okay i want these uh trojan to actually
execute
this command so the next time the
meterpreter
goes to the http server and asks do you
got
a command for me the um
this http server will actually respond
yes i have a command that i need you to
execute
so the trojan will execute it and then
will
post with the http post request
will post the result so as you can see
there are
like this a very continuous
request this is called a beacon
how is actually the beginning
implemented in metasploit so i said 10
seconds
before it's a little bit more
complicated than that but uh
not so much so when metasploit con or
when the trojan of metaplay the
meterpreter connects
uh to the server the initial interval
between each connection is about
one tenth of a second so 100
milliseconds and
every time the trojan doesn't get any
task
to execute it adds another 100
milliseconds
so the interval starts growing
until it's 10 seconds after it's 10
seconds it just keeps
the interval at 10 seconds so it just
asks
um do you have a test for me no do you
have a test for me
no and so on uh every 10 seconds
when it actually has a task for uh for
for destroying
then the delay becomes again
milliseconds and then starts uh
increasing
the interval uh you can see how it's in
implemented actually
and in the python interpreter in the
java
interpreter and so on
so how do you detect these with very
simple statistics
so uh there is a great project called
rita
a tool um to detect this beaconing
behavior
so they use uh
basically just statistics uh with this
interval
the sizes and so on uh
it's made by active counter measures
they they have some
threat hunting labs where you can
actually
test all of this and you can install
a security onion which is a distribution
that i could say is like the kali for
blue team so if you want to
test all of these tools like rita
kivana and all of that it's a very easy
way to test it actually if you want to
learn a little bit more about
beaconing uh you should really check uh
this um these resources
so the beginning detection in rita
actually the
the source code it's in github and it's
very well documented actually you can
see here
how they are um basically scoring
the the the b cons uh
they do a scoring based on
interval of each of the connections the
number of the connections
between two hosts the data size of the
of the data in these connections the
dispersion which is like
okay you have intervals of 10 seconds
but maybe you vary by
maybe plus minus 2 seconds around this
10 second interval
so that's a dispersion er the the really
great thing is
that it's protocol independent so
you can have a trojan that connects via
dns
or one that connects via http or a
custom
[Music]
tcp or whatever protocol
and it will be still detected by
a reta because they just
uh focus on on the connections not in
the
in the content of the connections so the
thing is uh
i i saw that the that rita focuses
on ip players so basically you have
a source of the communication and then a
destination
so this is uh basically saying that
you will have your compromised
host on one side and then just one
command and control server this is the
usual case actually
so this is where the whole idea
of implementing this tool was born
actually
so what are the possible evasion
strategies
um for rita so i thought
maybe if i become less often i can
reduce the
score also if i modify
the interval and add some jitter
which is the deviation of the periodic
signal i could also
affect it you can modify the interval
of your normal uh let's say
command and control interaction if
you just uh in metasploit you just use a
command sleep
this will just stop all the connections
and then resume them
after the number of seconds that you
specify then i thought
okay so if rita is making the analysis
on
ip pairs maybe i should distribute
the the all the connections
that the infected host makes to the c2
to go
through several or many um
command control addresses you can do
this also with metasploit
transports but i wanted to make a
more generic and a little bit more
dynamic way of doing it
so where can we get multiple ip
addresses for
our command control well the first
thing i thought about was using reverse
http
and reverse tcp proxies so i started
by doing a survey of reverse http and
reverse tcp software
and services some of the services i
found was
localhost.run which is basically a ssh
service that you can do a reverse tunnel
with it
and rock which is also a very popular
service
where you can do http and tcp proxy and
page kite
local tunnel is very interesting because
they
also um
they also have the the the code in
github so you can host your own
server for local tunnel and you can also
use
their service and then frp
and venom frp and venom i found in the
mitre
attack page
so i started by searching how many frp
which is fast reverse proxy actually the
name um
i found uh 15 731
from those uh well the majority was
hosted in china actually then the united
states and hong kong
of all of those i found 810 that were
um open meaning no authentication
uh to establish a
tcp uh reverse tunnel
and 416 for establishing
uh reverse http uh connections
well this was actually fantastic news
for me uh
because i i said okay if i wanted uh
more ips to send the traffic of my
command and control
well now i have more than one thousand
ips on my on my
disposal so that this was great news
actually
then local tunnel um i found 290
and you can do reverse http proxy
through it
uh the c2 centipede features that i
implemented
is uh the modification of the beaconing
interval
uh that the type of trojan detection so
it detects
if you are using an interpreter
or if you are using an empire agent or
any
other well not any other but other
generic responses
the fox flux part is just
sending let's say many ips
to the client so it can
not directly send the request to the
commander control but through these
many ips the multi-fronting is just
the main fronting but that is not
actually
just um
using one domain so you can send
many domains that you want to uh front
through
in one cdn or two or an
amount of cdns i also
implemented the the main generation
algorithm of a flu bot
uh and uh dga
uh kind of thing for uh generating the
the the virtual hosts for the frp
reverse
proxy you don't have to configure
everything uh
before uh sending the trojan so the
trojan can
establish one connection on let's say
one uh
of all of these ways and then
it can just alter like
add more ip addresses or change the
beaconing interval
or all of this stuff dynamically
so how do we change the uh
beaconing interval we have seen for
example the metasploit case that it has
its own
um beaconing uh strategy let's say
sending a beacon every 10 seconds so uh
what we're doing in the c2 centipede is
just
uh faking the response of what
uh metasploit handler would say to say
there are no tasks for you to execute so
it connects 10 times and you can say
okay
instead of sending 10 times which is a
lot of beginning
for for my taste just fake
20 times saying that there are no tasks
and then
uh the 21st attempt that you want to
communicate with the commando control
then you actually send it
and then the rest again 20 you don't
send it and then
and so on so the beaconing gets reduced
uh a lot
the fox flux as i was saying is
basically
not using dns because i don't have a
botnet available
but uh i do want to use many ips so we
are using
the uh let's say uh reverse open reverse
proxy
approach and so there is a
kind of a dga
that is used on both the client and the
server
when the server requests um
reverse http tunnel from
frp server it converts the
ip of this server into a host so you can
you can see here news.biohub.io
is generated by this ip that is here so
uh when the c2 centipede server
tells the client okay now which you
should uh
send um your your request
through this uh frp proxy
both server and client know
how to set up the the proxy by telling
frp i want to use this host and then
the the client also has the same
algorithm so knows what host
to send in the http request
so that the the http request goes
from the from this
c to centipede client to the server
so multi-domain fronting uh basically
domain fronting abuses the routing
scheme in content delivery networks
to hide the intended destination of the
https
traffic so basically uh let's say that
the
tls out or wrapping
is saying hey i want to go to uh
amazon or whatever but inside
uh the http header is saying uh
not really i don't want to go to amazon
i want to go to evil server dot
whatever in the same cdn so the cdn
uh actually like unwraps this tls stuff
and then just uh routes um
the request to the um
specif to the server specified in the
http
host header this is very
easily um implemented in in the tool
you just need to send uh um
like this front it and then the domain
you want to
front through and then you specify
the host uh that you have assigned in
that cdn
you can use uh one two
as as you wish
then the domain generation algorithm i
already talked
a little bit about it i implemented the
flu bot
actually based a lot on this
blog post on switch dot ch uh
basically flu bot has a algorithm
that you provide the seed then you say
how many domains you want to generate
and here in the c2 centipede you specify
to what
port you want to connect on those
generated
domains
and then the dynamic configuration uh
basically you have um
every time the trojan wants to connect
to the c2 server it connects to the
actually to the
c2 centipede uh proxy first
and then the the c2 centipede uh let's
say
protocol is piggybacked on this call
um the original uh
request from the trojan it's kind of
wrapped
and then sent to the c2 centipede uh
server where it's unwrapped then uh
the the original request is passed to
the
metasploit handler or the empire handler
and then the control data for
the c2c ntp
application it's uh embedded and
wrapped and sent to the c2 centipede
client
then so this means that the operator can
add more c2 addresses
uh change the encryption key also this
uh this whole thing is encrypted
uh on top of the encryption of
metasploit if you're using metasploit
um you can change the the number of fake
answers it sends at any moment
[Music]
so so you can change it while it's
running
here we have the c2 centipede
architecture uh well
this is the the normal architecture that
you use
uh in in when when you have a normal
metabolion that connects directly to the
handler
then this connection is repeated every
10 seconds
every time to the same server
what we want to achieve uh is connect
through many uh ips
let's say and to alter the the
beaconing interval so basically the
interpreter instead of connecting
directly
to the handler it connects to this sort
of
um proxy the c2 centipede
proxy then it has like an internal
routing uh table and it decides
on the um desired uh route
route it wants to take to reach the
handler so uh the trojan
sends the request to the localhost uh
and then
uh the centipede client chooses one of
this
can be through the main fronting or
through a reverse frp reverse
tunnel and then it reaches the c2
centipede server
the c2cp server kind of uh
unwraps the original uh call
and sends it to the destination
metaexploit http handler then
it obtains the response and sends it
back to
the c2 centipede client and then from
there
to the interpreter client
we'll do the interpreter trojan
you can also have this configuration
where you have one host
um with an interpreter and
also with the c2 centipede client and
then
you can have other compromised hosts
in that same network connecting to these
one only uh host with the c2 centipede
client
so that all the traffic goes through uh
this uh host and does all this routing
for them
so this is the c2 centipede operation
basically you need
first to set up the metaexploit empire
or whatever you're using a handler so
basically this is uh
the command to uh to set up a metasploit
handler
you set the payload for uh whatever
whatever payload you want it has to be
reverse http
here i'm using a stageless http shell
then you set up the port of the handler
and then the host you want to bind to
and you run
the metasploit handler then you need to
configure
on the server as well um the c2
centipede server
you need to specify a port and then
the destination where all the
um requests that it gets will be uh
forwarded to so this will be the
metasploit or empire
handler then on the client
you need to set up the
c2 centipede client you specify the
on what interface you want to bind and
this is in the case of just having it in
one host
not anyone else connecting to it you
specify the port
that you want to run the c2 centipede
client on uh
then the list of c2 centipede servers
let's say
either domain fronted or um
or through frp proxies
or you can also give with the minus s
you can
give the individual servers
of course then you need to generate the
trojan
and then uh yeah you just need to
execute
uh the trojan in the same
host that you are executing the
c2 centipede client uh of course you you
can also
compile it for windows um
and then just run it there
uh okay so right now we will um
test um okay a shell with
c2 centipede so we will
actually fire up a windows machine
uh we will set up the c2 centipede
server
uh we will set up at the port in 1993
and then we will say that the meta
exploit handler
will be in these host and ip
in this case it's on the same machine
but you can also uh
let's say point to a metasploit handler
in another machine
so here i will um with metasploit i will
run a handler
so i will use the exploit multihandler
and then set
the payload for windows meterpreter
reverse
http this is a stageless
http um payload
and we set the port to eight eight eight
eight
then we set the host to all interfaces
and then
just run and we can start as well
the c2 centipede server
1993
okay
so we already have the multihander
listening on on that port with this
payload
we can charge the c2cp client
we need to specify um to what interface
we're binding to
and then the port
let's use port 2233 because i already
generated
a stageless interpreter pointing to
localhost
and port 2233
and then we will connect it specifying
the
c2 centipede server
it was running on port 1993
okay that should be running
we can test the connection all the way
to the handler
by issuing a crawl command to localhost
so this is the actual response from
the metasploit http handler
it actually emulates an apache server
but you can see that the connection
actually
was sent through the c2 centipede client
and to send to the c2 centipede server
as you can see here
we execute the curl again then you get
the connection again
through the same route
and here you can see the connections
okay so let's now execute
the interpreter
but what you hear is every connection
that gets to
the c2 centipede server
so you will see how much
the meta ploid or the interpreter
trojan connects to the handler
[Laughter]
every beep is a connection
an http request action
and as you can hear the interval between
each call
it's little by little growing
so if we continue we could um
see that the interval grows until
10 seconds and then it just keeps
being 10 seconds long but what happens
when we
interact with the trojan we said
that it goes back to 100 milliseconds
and then
it it it does like this growing of the
interval again
so let's interact with it
as you can see there are more
connections now
okay i will execute something again
so this is all the noise that you are
generating
every time that your
metabolic connects to your handler so
it's not
a magic it generates a lot of noise and
actually quite very nice
looking beacons all the time so this is
very easy
for the blue team to detect
with a tool like rita actually
so this is where we come and try
to do things a little bit different
this is the c2 centipede operator
interface we
say to what server we are connecting to
and then we can see the client that are
currently connected
okay
we can set up another route
right we will set up uh
or let's first fake
the the responses
okay i will just execute one more
command to
get a faster beacon
and then i will send the command
to fake for
request the responses for four weeks
as you can see here is now one
two three you don't hear anything
because nothing is going through the
network here you will also see the gap
now it sends again the the the request
so you see
this was the original beaconing and with
the c2 centipede we are now
adding this gap so adding to the
interval
we are now only faking four responses
but we can do of course more
we can go back to zero if we want more
interactivity
here you can see how many times
it has faked right so it starts again
fake one fake two
out of four fake three out of four
fake four after four and then it will go
again out
as you can see now so uh let's say
uh you want more interactivity ah of
course
i can show that you can still retain
uh
let's see it will take a little bit
longer because not all requests are
coming but now
it will execute
so you can still execute commands
so now let's add some
proxies so let's try
so we will set up some
let's try it three or four
so these are open on the internet
i will just press setup
and then it will establish the
connections
as you can see these two are not no
longer
working 59
so we can actually remove them
[Music]
okay remove that one
so let's add some other ones
and it worked
okay so let's send it to the c2
client let's see two centipede class so
i will press send
so the next time it connects because now
it's faking so when it connects it will
get the servers
added to its routing table and then it
will
actually use it to route the traffic
through them
you can see i still have command over
the trojan
and actually the frequency of the beeps
means that it's using
like each ip generates a different
frequency
so here if we see it will be using like
these
ips we added so this is going through
china
and the us
and so on okay so we can also use uh the
main fronting
as we saw previously i will just um
again using
[Music]
this tool i will send multiple servers
i will add them here with the format i
was
telling you before front it and then the
domain you want to front through
and then the host it should actually
redirect
so there it will send it
it adds the to the routing table
and then it will use them
so here it's sent through this one
there are some debugging uh things uh
going on
so at some point it uh
stops but then it continues
as you can see here the domains that is
using
to front
here okay so that's the demo
i hope you liked it and we'll continue
with the presentation okay
so um how does uh the traffic looks
for the blue team here uh
i executed uh the interpreter against
this host only only one host
using no sleeping let's say or faking
uh just direct connections as you saw
here um
there are six uh
all of this is uh one minute uh
intervals
so uh there is uh six
uh requests per minute you have here uh
this
big peak when you execute the whois
command
so you can see there are like many many
more uh
connections in a in a in a minute
and then it uses that algorithm from
metasploit and then just
reaches 10 per um
at one request every 10 seconds so six
per minute and here rita this is already
the output from rita it gives a score of
70 percent um
to that ip that we were beaconing to
here we have to to specify that this is
just like
half an hour of it running er
of course when you do this uh beaconing
detection with rita you want
much bigger uh amounts of time like the
traffic for a day or
more uh here just for the experiment
and for the proof of concept we just
have a nine
uh sorry half half an hour
period of time
so this is the normal way and then how
does it look when we do it
with the c2 centipede so we for this
test
we added 10 ips
these are 10 frp
http reverse proxies and then
we set some faking of the responses so
that it doesn't become so often
okay so the result is this
that sometimes uh you have many more
well not that many actually but um
at some point you you have some request
and then it doesn't fake for a while
and then you have periods of time
that for five minutes for example you
don't have any decon
and then you can see that at this
point of time it uses one server then
here maybe it uses the same
maybe here it uses another one and then
use the green one the blue one the green
one the pink one and so on
so uh the beaconing
is not a perfect beaconing so that
tools like rita don't uh
see these perfect beacons
okay so uh the results from rita also by
this uh
half an hour period of time is
that it doesn't see a beaconing
pattern basically because there are less
beacons and because
it is routed through several um
c c to ips so we can
conclude at least for this very small
experiment
that it is uh like mission accomplished
at this
at least for this so the conclusion is
basically that the
beaconing is of course not the only
threat hunting technique
but one that blue teams should be doing
so if you are using the default vanilla
metasploit uh empire
know that if the blue team is doing
beaconing detection it will jump
right at the blue team it's very visible
but also if you use uh thousands of
servers
uh to proxy uh to your uh command and
control
uh server of course because it's not the
only thread hunting technique this
weakening detection uh you will be
detected
because a host is connecting to this so
many
servers so you need to balance it's a
balancing act
of how often you
want to be gone and so uh
how how much interactivity you are
willing to to lose
and also how stealthy you want to be
uh if you use really many uh
servers then you will be more visible so
you have to
uh balance this uh all of these
things okay so that was
all i would like to to thank you uh
it's a shame that i of course uh
most of us could not be there in
deathcore actually i wished it was my
first time there
um but that's how it goes i wish
you are safe and that
you can maybe contact me give me
a little bit of feedback and maybe a
chat or
something like that okay thank you very
much see you later