welcome to world talk everything is a
situ if you are brave enough bye luis
angel ramirez mendoza and mauro eltich
from dc5411
okay before we start i would like to
make a brief introduction about
ourselves the speakers and about the
topic of this talk which is a
rather crazy one also i would like to
take this chance to
say that we are really happy to be here
at the adversary village
and i really hope that you enjoyed this
talk as much as we have enjoyed making
it
this was a really crazy thing for
us i'm mauro elrich i'm from argentina
i am the founder of dca and dc5411
the defcon group that comprehends
argentina and uruguay
i spoke at different conferences before
including defcon a couple of times
and other conferences around the world
including
russia brazil colombia iran spain
india pakistan panama peru and there are
more to come
my code speaker today is recently
ramirez mendoza and he's going to
introduce himself now
thank you mauro hello everyone my name
is luisa ramirez mendoza
angorki under harvard security
engineering and wilmingham cyber art
and member group pc5411
the speaker and different company
included escom
visa newcastle yaskon
thanks luis so the topic of this talk
as i said before is a rather crazy one
we are going to try to demonstrate the
most
crazy unexpected and you might call it
interesting two
ways of setting up a situ server we're
going to use different platforms
different online profiles
certain streaming platforms gaming
platforms and even video games
to try to build a situ server
so let me explain this
we try to make this talk as friendly as
possible
to every public so we will explain from
scratch
on this topic the construction and how
to use a basic situ server
and we are going to mutate
this server to use different
applications
that are common to almost everyone here
so the point is that we will
we will part from a really basic c2
server and we'll try to expand it to use
different platforms for this we have
created a
fake a toy ransomware which will try to
call home
to leak some information to coordinate
an attack this is a an encryption
operation
which we will see in a few that is not
as dangerous as it seems and
it will try to use the most crazy and
unexpected ways
to carry out these sections to
communicate these actions
just as a disclaimer both the ransomware
and the situ samples here are unable to
deal
any kind of damage to their targets they
have been built for
educational proposals only and they
can deal any damage at all not even
accidentally these artifacts
are not to be considered real water
samples
they are merely illustrative so some
features that
may be present on large skull or real
world
tools or samples will be missing here
they won't be something implemented
we haven't been involved in any kind of
illegal activity
and it will be really hard to do so with
the samples
so let's start with the introduction
let's take a
first glance at a basic situ we had
built
and from now on if you have never seen
or you if you have no idea of how a situ
works you will have the real
the really basic knowledge to know what
we are talking about and then this talk
will go
on more bizarre ways and we'll
we'll start seeing some crazy things
from now on
so the obvious question here is what is
a c2 server
c2 stands for command and control server
it's a server controlled by a bad actor
an attacker which is used mostly to
coordinate and distribute orders to
infected systems
these orders can carry out information
leak
lateral movement encryption operations
and
almost anything that you can picture in
your head
this traffic which is sent
from an infected system to the common
uncontrolled server
tends to be hidden tends to
tries to blend itself among normal
applications or among
other kind of traffic to disguise itself
because
otherwise it will be really easy to
identify it to tag it
and to block it now there are different
connection models which
won't be discussed here because we are
trying to build something really basic
just
to give an example but there's not
a single way on how the situ servers
behave
so for our example we set up as i said
before
a really basic situ server and client
which should be able to do the following
to register a new victim this is to
identify
correctly a new victim to generate and
share an
encryption key in order to encrypt
the this victim actually this key
won't be a real encryption key it will
be
a public ssh key which
with the help of openssl you can use to
encrypt files and different things
but if this is out of scope we are not
going to encrypt anything
actually it will then try to leak
information from the target
and then encrypt the target file system
which is the final
objective of this malware
but actually we are not going to encrypt
anything as i said before
we will only leave a ransom note on the
desktop asking for
a payment and something that we are not
going to do yet
is to disguise the traffic of this situ
server using
another well-known application or
service
or platform not yet as i said before
so it's trying time and to make things
funnier and
to try to stick more to the real world
we'll impersonate a new ransomware gang
we are going to be the capybara gang
dedicated to stealing capybara coins
from unsuspecting victims
around ransom notes will ask for payment
in capybara coins exclusively
capivaras artis friendly and nice
looking lads that you can see in this
picture
and are common to brazil uruguay and
argentina
so uh a curious
piece of information is that the capital
coins are something real and actually
fiat currencies that are
our official currency in uruguay and
they they feature one of these lovely
lads
uh obviously that's enough and a valid
reason to want
all of them so
back to the technical field our server
will use ruby and sinatra for
establishing an api
something that i must clarify here is
that interpreted languages are
not something common and i risk to say
that
i don't think they are used at all
on on this kind of software on this kind
of malware
but it will be way more understandable
to use these than
any other language for this talk believe
me
we prefer to use ruby because it may
it may help us in building something
minimal a minimal artifact
and the language is quite understandable
for almost anybody
so we decided to stick to this rather
than
sticking to c or or to any other
language
so let me explain the code really quick
we require common libraries like sinatra
and colorize in order to
being able to output colored output
and the rest net http and uri
are part of the ruby core
so we define a password for our situ
server
because we don't want anybody snooping
around and stealing our
complexity server
we define some real basic endpoints
addressing the previously tailored needs
how to reserve and assign an id to
expecting how to generate a key pair for
each of them
um asking to leak specific information
from the host in this case it will only
leak
an ip address and a port like sort of a
connection string in order to get back
from the server to the client
and actually we are going to
to give up an encrypt endpoint
in order to notify that we are going to
start
encryption operations on a given client
again this is not going to encrypt
anything
and we have a last endpoint which will
allow us to connect remotely
to the compromise at host obviously
using the information liquid before the
connection string that i mentioned it
we are going to query the telemetry
endpoint and issue a houston comma in
this case we only have the encrypt
command
nothing else and obviously this will
require
a password because we don't want anybody
stealing our pressure circuit server
the client it's pretty simple again it
will query the server endpoints in order
to do
everything that we had mentioned before
to register itself
to get a victim id to get a victim key
encryption key also leaking the
compromises host
ip address and port in order to create
this connection string that the server
needs
and then after running all this routine
it will place a ransom node once the
server
issues the encryption command
now let's see how things turn out and
then
once you have this base and that you
have you have a good understanding of
what
we are going to achieve here we are
going to move to the
wacky or not so orthodox methods
so let's start with the demo
okay as you can see here we have three
different terminals
the one on the upper left is the situ
server it's going to run the
capibata server this
other terminal will send the crypt
command once that we have everything set
and ready to go
and the lower one is a docker container
which
as it says here it's the victim so we
will basically run the server
run the client on the victim sites
the claim will register itself and then
when everything seems
nice and smooth we are going to send the
crypt command from this terminal
let's make it roll
so it started on the 4567 port
we are going to launch the client on the
victim
wait oh okay now it should connect
the exchange should happen real fast
here well as you can see
it already happened and it's already
waiting
as you can see for some input
the victim was generated
we have generated the key pair
we have looked at the connection string
the hostname and the connection string
in this case it's a docker container as
i said before
it will start running a listener on the
on this port
13337
which is established here in the
connection string and it will wait
for the input now we are going to send
the crypt command
versus going to make a c url we are
going to make a post
order encryption and password adversary
as it says there
this should be enough to start
encryption operation
okay it's done send an encrypt order to
all
attempting to encrypt this victim
fetching
the endpoint and now if we go to the
desktop we should have a
creepy ransom note
if everything went smooth
yeah it's there now what are these
crooks up to
what do they want from us
ah i knew it from the start they were
not capybara coins
okay that's how the basic c2 interaction
works
now that you have seen how it behaves we
are going to
move on to the not so orthodox methods
remember this is a basic diagram once
again of what we have done so far
we have the client which is the victim
the server
and the remote activator that can reside
inside the server itself if you want to
so let's move on to the fun part now the
walkie clients
how to hide situ traffic in the most
unexpected way
wacky crazy ways that you can
ever picture
so what's next so far our c2 is able to
do
a couple of things register a new victim
that's done
check share an encryption key check the
information from the target
check encrypt quoted
the target's file system check and now
we have something pending
we have to disguise our traffic using
some
well-known applications platforms or
service
so let's start doing that
thank you moro you too clean
have you ever seen to wear youtube
channel
fail with nothing video of about
5 seconds so of the art cal
calibration or testing video channel
under fuel via dimensions tool
and sample with right torso and
favorable
semi-circle this was the original
inspiration for this tall
why not rely eonin or the naming
calibration
task for orchestrating or attack
using youtube free apa we design
to create fit video name as the minion
city of command
a secure star get kicked
lead info crit sqn
be contained not in both descent
frozen frame for hull and mini
we online car for the title
nothing else no decretion except for
get kicked for reason
the claim would look to the video which
were
proplaid order and execute other
when the title mass and a specific
pander
existing video can be rebooted a new
video
included is selling via youtube apa
this can be do in antique with minutes
minimal a favor and for free
so let's see how things turn out here
and obviously if you like this video
don't forget to like
and subscribe to our channel give me a
second
okay as you can see we have here this is
another darker container the one below
this is our channel which is crowded
with subscribers and a lot of people
who are interested in our things
that's why we have so much visits on our
videos
and i apologize for the interface being
in spanish
so let's start we will show that the
root
and desktop folders are empty that's our
channel
id which is what we query via the api
we have the different videos that mean
different orders
they are in reverse order here we are
going to send the client
it found the channel it found the videos
it already has access to read the titles
that's all it needs it doesn't need to
watch the videos it doesn't need to do
anything else
it only asks for each one of these
videos titled
and the description only when it needs
the ssh key here which is on the get key
video
that's right there it is it will take
this
this description field and use it as
a real encryption key
now let's see what these crooks are up
to
and they have once again
hacked us okay so
that's it for the youtube client this is
a summary of how it works it's quite
simple
remember that all of these samples will
be available at github
after the talk so don't worry about it
if you want to test them
the only thing is that you will have to
issue your own api keys but that's not a
problem
it's pretty easy to do so
now let's move on to another client the
spotify client
i think almost all of us know spotify
and we have been using their platform
free api to craft a special playlist
that you can see here
the official capybaragang playlist the
title of this playlist
is quite fishy quite suspicious but this
hasn't been valid so far so we're going
to leave it as is
it's composed of four different sections
the first one is the wake word
hits the second one is a
dash dash separated ip address
for the situ server and the third and
fourth
are pieces of the encryption key you may
ask
why are you storing them there well
the description box contains the rest of
the key
but it is splitted due to the
limitations that it has that the field
has
so we have to resort to
this creative way of doing things which
in turn seems to be a little bit messy
but it works
the playlist is made up of different
songs obviously
but the important thing about these
songs is their title
their titles verbally represent one of
the comments to be executed
here we have added a couple of new
comments because this is a
new work lion that had been a little bit
further developed
so so alive from love and rockets is the
sequence start
fix from the sisters of mercy is the
common to fix the key
to start exchanging the keys and to
reassemble the key
date and switch from km fdm is leak
information
thank from jogo canon on the seatbelts
is start encryption
or start the attack adios from km fdm
it's
sequence end then
we have added this as a special case
i started something that i could finish
from the smiths
actually means that we have interrupted
jobs and a sleep from the smiths once
again
is weight these comments were briefly
implemented for having mind
special needs from other users
so this is how the playlist will look
take a look at this
so alright will be reflected here so you
can start
i started something i can't finish we'll
say warning some previous jobs who are
interrupted
fix we try to recover the key
thank will start the encryption cycle
and adios
which means goodbye in spanish will
be the sequence end so let's move on to
the demo
in order to see this in action because
it may seem a little bit crazy now but
it's quite simple
ah before i forget
as with the youtube client these songs
can be
added and removed really easy using the
platform's api
this costs minimal ford it's really fast
and free
so let's see now how things turn out and
if you like
our musical taste join the official
copywhat again playlist
okay again
we have the container you know the
docker container which is going to be
the eternal victim
we have this playlist with these eight
songs
and let's see how they behave
it has already found our user and
everything went really fast and smooth
we have found the tainted playlist we
are started reading the commands so
we're live
the c2 is recovered from the playlist
title
the key is recovered from the title
ii there are some unfinished jobs here
some interrupted jobs
fix have already recovered the key and
it looks to be good
remember that it's splitted on three
parts
okay this is from the description field
now don't have information to leak
remember this is a dummy command
we started the encryption cycle which
will only leave
this note two shadows is another comment
that has been dropped
from jean-love's jessica which will try
to delete shadow copies
as nib will wait anna dios will send
obviously a sequence end
now what happens if i delete two shadows
as a leap and i started something
from motorcycle
this is to show that this happens in
real time
the client will read the comments in
real time as you can see now there are
no interrupted jobs
nobody is waiting for anything and also
we don't have uh the shadow
delete command the two shadow song
now oh no we have this strange file here
and somebody's asking for
capybara coins oh man
okay i think it's time to move on to
another client
so this is the final summary as you can
see different songs mean different
comments
so it's worth to give it a try now let's
move to the next one
wikipedia client you can use
wikimedia's free api to query
any article on wikipedia or being real
here
any other wikimedia instance
after you register your user it is
possible to read its profile page and
add
almost anything that you can imagine
and once generated this is a special
entry which is considered to be an
article and can be
queried via api it will have the form of
user and your username
so as we don't want to disturb a project
like wikipedia
we have only edited my own profile
and we have only done one api query to
read it once
so there won't be a live demonstration
of this client
also we try to discourage any user to
start using wikipedia to make testings
as you can see that's my own page you
have sequence start let me tell you a
secret
what's up do it and sequence end
then we have a special client which will
connect to the wikipedia api
will fetch a specific tainted user which
in
which in this case is mine it will try
to recover the comments from the page
and parse them we have sequence start we
have received the key
there's no information to leak from our
site start an encryption cycle
and receive it sequence hand that's it
again this page has been reverted as
it's my own profile on wikipedia
and we try to encourage if you want to
test this to
raise your own wikimedia server it's
quite easy to
be a docker or via virtual instance or
whatever you want but it's worth to give
it a try on a private instance
so the next one uh here is when we start
doing
some way crazier things we say why not
try
world of warcraft or any other role game
and we say okay why not give it a try
we are using trinity core which is an
awesome project
an awesome project which is a private
world of warcraft server emulator
which you can use to easily create your
own future instance
now you may say wait how are you going
to use this game
maliciously and as you can see on the
picture on the right it's something that
you can ask but
you know the answer we we have done it
after creating a character the player
can
build any custom macros and also run
minified lua scripts
but bear in mind that the banded lua
version of
world of warcraft does not provide
access to same time
core functions like operating system
operations
or networking operations so you will be
more or less caged inside the game so
this may be something that we can still
use in our favor
as you can see now
these macros and scripts can rust almost
anything that you can do with your
keyboard and mouse
almost i can say for sure if it can run
everything
but so far it's it was able to do
everything we needed
so we could easily automate the flow of
our situ
routine in a very friendly and a very
easy way so we have created
the capybara macro that you can see on
the right
with that cute pow but
it will only click certain buttons we
can make it click
on an action bar an action button
but this is the question what do we want
to do with those patterns
so we started figuring out how we could
start building
short functions because as you can see
on the lower part of the screenshot to
the right
we have used 126 characters
out of 255
which is pretty short pretty sure to
build something
on a comfortable way so we have to rely
on a lot of creativity here
in order to do minimalistic things which
will
be tied together
so after a little research and a lot of
tampering
we have been able to create our level 14
hacker which is ready to claim back
waters and gold
or take part in a ride as you can see
this is the
hackers toolbar the hacker's skills
and now you may say okay but how are you
going to distribute these commands or
these
skills luckily
and this is some old information but we
have discovered it just
a few days ago trinity core
provides a way of logging
all of our chat inside the server all
the chat that goes
on on the server during each server
session
so using the chat function seemed like a
nice idea and the right way to do things
now we say okay we have the chats
we have them recorded on a file but
now we need to distribute them we need
to filter them
we don't want any player saying okay
send this command theirs and this
command here
so we need to have a way to filter all
of this and publish all of this
as you can see in this screenshot we
were able to pipe our chats
to a file and we were tailing that file
inside unix
so far so good but this isn't going
anywhere still
yet we are not going anywhere with this
so we have the chat i was able to parse
them
i was able to filter them only by
drake my player which is in no way a
reference to francis direct the pilot
and we say okay now we have to pipe that
very same file
that log file somewhere we have to
publish them over the network
so the next point is to distribute the
chat messages
with sinatra that's it 8 lines of code
and we can do it in
way less i think but we wanted to keep
the code
as friendly as possible we are only
going to read
the last 10 entries from the chat log
every time somebody requests an
endpoint i know this is
not the best way to do things we can
also stream the file but
things will do for now so now let's
start the demo and let's
participate in a ride this will be a
little bit longer than the other videos
give me a second okay
now let me pause here we are on
somewhere around westfall here
we have three terminals here we have the
first one which is
situ i have made a little bit smaller
because this is really a really crowded
window
we have the chat lock monitor here which
will
be tailing the chat log file and
obviously the eternal victim this poor
docker container which will receive
again all the hits we have
our macros here and action bar
let's roll
okay we'll start by turning on
the capivada server okay awaiting
connections
now we're going to tail the file
constantly
so everything will be streamed here
okay these are the dots that i sent to
the file before
and the victim will wait for a couple
seconds now
this is the capibara
ramson c2 which will click sequentially
on all of these
little macros or lua scripts that are
laying around here
we have the encrypt getkey
lickinfo reroll key reroll server if
available
sequence n sequence start and set key
so now this will happen real quick take
a look at the chat window
once i click here the window will be
crowded automatically
okay
now this is already piper there the
client will look only for things
that drake said
now the client will connect
to the server the server will stream the
file
or actually takes a couple of lines and
boom
this already happened as we were talking
the docker container connected
the hose won't be enrolled that's
something that we have clarified before
this is just a dummy function and
your files are encrypted ransom node is
once again present
i think we should consider a cyber
insurance company right now
okay that's enough and wait
i shouldn't go so fast
yeah that should do so
let's move on the same client this is by
far
the trickiest one we
weren't really able to do a lot of
things with steam's api
which turned out to be really
restrictive
almost to the point on thinking that we
should leave
that behind and use another thing but
luckily we find we found a workaround
we decided on using the player profile
page as a starting point
because the api wasn't leading us
anywhere
so once we jumped into using this
profile page
we found that we don't have a lot of
fields
a lot of space to store things like a
key or a situ address
so we started once again
thinking on a possible workaround for
this
we found that the optional field real
name
could be handy on this case
as you can see here this is quite a
strange real name
i can tell you for sure that in
argentina we don't use so
so complicated names so
you are okay if you think that this is
something fishy
as i say pretty strange name right so
the content of this fill
actually represents two different pastes
on base bin
the first contains the situ address and
the second one contains the key
now by reading the player profile via
api
we have enough information to start but
how do we issue comments we are out of
space we don't have a lot of things to
modify here
and using commands here will will be
something pretty hard to implement
so we decided to support
two different modes on this client
games and friends by using the games
mode
the c2 administrator can map a list of
games owned by that
account by the account we are using when
the profile we're using
we can map those games to a list of c2
commands
each game can represent a command and
can be listed and deleted from the
profile at will
but this is not an easy process let me
tell you
by using the friends mode the the situ
administrator can
map this list of friends to a list of
commands
now each friend becomes a possible c2
command
again friends can be removed and added
at will
but again we discourage the use of this
one specifically since
both modes are not easily maintainable
and my encoding bands
seems pretty restrictive with bands at
least on us
so creating multiple accounts or using
this for experimenting can turn your
account into something usable
so take care
as you can see we have here a list of my
friends which are not quite a lot
actually
so i mapped each one of them you can see
this in line 41 which is commented
each one is mapped to a command
we start reading things and you can see
that it says okay i found a pastebin
clue
this one and searching for the
encryption key there
and i found it now i have found
another page with clue i'm searching for
the c2ip there
i found it and then it's try to start
the routine
let's see how the games mode work
warhammer seems to be the sequence start
lego set key kingdom rash league info
dark extension script start and another
warhammer is sequence end
this will be exactly the same behavior
it will start to look for
the ip address and encryption key on
placement
but we'll use the games as uh
as as a list of commands
now the problem is that certain games
are paid so it now supports free games
too
but again steam apis is
a little bit restrictive so you have to
explicitly ask for
listing free games so as you may see
this is the most
wacky one so far let's see a demo
about it give me a second once again
okay this is my profile the base bins
as you can see one contains the key the
other one contains the plain ip address
which are listed as my real name don't
judge me by the games i play please
now we're going to start using the
method friends
we'll start reading the commands
again this is the placement this is the
other placement
and it will have placed already the
ransom note
let me check
yeah it did
oh man not these guys again
so this was the last client we had the
show today
and sadly it's time to go
we are really happy to be here today at
the adversary village
and we have really enjoyed doing this
talk creating this all the research in
these crazy topics
and we really hope that you have enjoyed
it too
so let's jump to the conclusions on the
q a
our conclusions are simple these
examples
do not pose a real world danger but they
can
easily be used to be able to do so
with a little bit of tweaking when
talking about traffic never assume what
might seem to be
normal traffic to encyclopedias or
streaming services could be hiding
something else
sometimes on plain sight sometimes a
little bit more
complex like more cryptic way
like the spotify client i showed you and
if you want to build a nice hacker in
world of warcraft use raw clues
engineering
which are pretty nice choices if you are
brave enough
anything can be a situ don't be afraid
to reach out on twitter on github
we're always working on crazy things
mostly on hardware hacking projects but
sometimes we jump to software like we
did today
so get in touch don't be afraid to
approach we are going to publish this on
github so feel free to clone
the only thing you need to do yourself
is to get your api keys
because we are not going to obviously
upload hours
so we really hope you enjoyed this and
we want to thank all the adversary
village team for inviting us today
if you have any questions we are happy
to discuss them at the discord server
thank you