hello everyone
welcome to the talk red team credentials
old with a twist
this talk is presented in defcon 29
adversary village
about me
my name is shantanu khandelwal
i am a cyber security manager at kpmg
i enjoy working in cyber security and
have been working in this industry for
almost five years now
my journey started with my master's
degree in cyber security and incident
response
i also have some certifications like
osep osce oscp etc
this is my first talk at defcon so
hopefully everything will go fine
uh so the disclaimer here uh the
opinions expressed in this presentation
and on the following slides are solely
those of the presenter that's me
and not necessarily those of kpmg
private limited
kpmg
does not guarantee the accuracy or
reliability of the information provided
here
okay so that's done in this talk we are
going
to walk through some of the basic
introduction of github
a description and a small walkthrough of
current github reconnaissance
methodologies
we will also discuss some drawbacks of
these methodologies
then i am going to introduce a tool
which i wrote named as credit stroller
we'll also do a walkthrough of it
we'll also talk about some of the future
work that can be done to improve the
tool as well
so why are we here and before we
and before we start this talk i want to
go over the reconnaissance quickly
and how it fits inside
an adversary simulation or emulation
methodology
reconnaissance is the first step in kill
chain as we know
as a red teamer we often do it before
the initial compromise phase and
everyone in infosec keeps saying
information gathering or reconnaissance
is the most critical steps
is one of the most critical steps okay
what is reconnaissance okay
so in generally we referred
reconnaissance as to find emails
subdomains ip ranges leaked passwords
etc for the target organization in this
talk we are going to focus on the
sensitive data exposure by github
so what is github as per wiki it is a
provider of internet hosting for
software development and version control
using command line tool called
git
developers use github for storage
sharing projects collaboration
data transfer etc
from an adversary's perspective github
is a gold mine
it is
mass used and its mass usage makes it a
prime target
and developers use often
[Music]
and developers often use this
often use github
and they unknowingly commit proprietary
source code or credentials to the github
repository
interesting information in repository so
we can find several critical information
inside github repositories like
usernames passwords keys email addresses
subdomains
proprietary source code even we can also
find software stack from there as well
right
in this report in this talk we are going
to
focus on the credentials part
so one of the ways which we do github
reconnaissance is manual reconnaissance
uh searching for the company and then
password will find stored passwords and
configuration file
searching for company
connection string will find database
credentials
you can also look for ssh passwords
using the keyword ssh 2 underscore auth
right
send keys is my personal favorite it can
find you automation scripts used by the
testers
who are also sometimes not security
savvy and commit passwords to the git
repositories
there are some talks which you can use
to find sensitive information as well
many researchers have blog posts on it
here is one of the list
which you can use you can find other
lists as well
so here is the first
demo
hopefully it will go well and then we
can you know move forward from there
so if i if i go to uh github and search
for um
red team dot cafe
you can see that there is 21 results and
there are several repositories like test
1
test 2
[Music]
domain fronts um etc okay so let's see
if we can use a team.cafe and then the
keyword password to look for passwords
so if i search for passwords now we have
come down from 21 results
to five results okay so we see that
you see passwords here we see some
passwords here
uh some form passwords here
we also see some send keys passwords
here in the in the automation scripts
and we also see one of these results
where the tindo cafe is here and then we
also see
a word password but of course this one
is not related to the credentials
because it does not lists any passwords
right
okay
so this is the manual searching you can
use password or api
or or any other keywords which you like
to search for
passwords or secrets right i don't see
any api keys being
exposed here so
uh
there's none here but you cannot
actually use other keywords here as well
like those dogs which we mentioned
previously
okay
i just want to bring your attention to
one to one thing which i mentioned very
briefly last time is that there are
two three repositories which are coming
up test one
[Music]
test two
[Music]
okay and then there are some other
repositories as well okay so keep in
mind these test one as says two
repositories as these have been uploaded
and designed to showcase you the real
impact
of the
credit stroller plug-in which we
discussed later
so that's the end of the first manual
reconnaissance demo
so coming back to our slides again
so in the manual reconnaissance we saw
that we can find
uh so that we can find passwords like
here
we see that there are uh send keys
passwords there are web config passwords
and then there are ftp passwords
here
okay
so uh moving forward and then so
basically
uh a question comes to my mind that
are we losing some of the data or are we
getting all of these passwords which are
leaked by our team not red team or cafe
right
so
just thinking um
how github search works is that if you
put two keywords such as company name
and password in the search bar
we are actually finding
the results in which both the keywords
the company name and passwords
are uh are inside so one part one file
will have these both keywords company
name and password okay
there were also results
which had just the word password but it
contains no passwords so just keep that
in mind okay
okay so another approach to search for
passwords is using automated approach
which is for which is using the current
tools name namely truffle hog git
secrets
git scan etc
the
uh
the disadvantage of using these tools is
that
these tools will only search for the
repositories within an organization
for a specific user
or in a specific repository
why this is the case is because
github does not currently allow you to
search
all of its repositories using api
previously it was allowed
but now it is it has been disallowed
because of the abuse
of searching passwords inside
repositories using apis okay so this api
for searching passwords or any keywords
[Music]
on github has been discontinued i think
since two years now
okay
and why these are working is because
github only provides searches inside an
organization
inside a user repositories or inside one
specific repository
okay so let's quickly do an automated
reconnaissance demo
and then we can go to our new tool which
i have developed
and uh look look at that as well so
quickly let's do an automated
reconnaissance uh demo
so here um here i have uh
him using truffle hog okay and in
truffle hog we can go
and see uh how and we can search for
credentials here so how do
truffle
is
is stressful hog
and then if i provide the keyword regex
and then i can go and take one
repository so let's say i'll take test
one
and then i can pass in the uh argument
and if i click enter
it will search
inside that
repository and find me passwords okay
so i can see that it has only found me
one password here which is also not very
visible and it only shows high entropy
etc
you can already see that in in the
manual reconnaissance
we find we found more passwords
i may be running this tool wrong uh i'm
not too sure but i can definitely tell
you that i i've used many
other tools they will never always find
you all of these results some of some of
them will miss something or the other
okay so this was a very small demo of
the current tools
uh
if truffle hog author is watching me
please uh do let me know how to use this
tool um
but moving forward
uh so
um
so we saw in automated reconnaissance
that it
it barely finds one
password but even if it find all the
passwords we have to give
all of these repositories uh line by
line
uh and then it will it will become
difficult for you to find all of these
repositories because if you're searching
for a very big organization you will
have hundreds of repositories and
providing that hundreds of repositories
and then passing it as command line will
actually be very difficult
and then finding passwords like this
which is not very highlightable as well
uh will prove
more will have more difficulty as well
okay so there's so this brings us to
credit stroller yet another github
search too
so credit stroller as i mentioned is
developed by me
it it is an automated
reconnaissance tool it's a chrome plugin
made in javascript
uh so credit stroller searches for the
company name first
and then after the search completes it
will actually go inside each of the
repositories which mentions the company
name and then it will try to search for
the password
inside that repository
credstroller also allows you to do a
reject search
the reject search is mentioned as lucky
results
so why do we need credit stroller right
so great stroller is searching for
credentials using regex github does not
allow you to search reject so this is
one of the major
advantages
it allows search inside the repositories
uh after
after matching the company name and then
you can go and search for the keywords
it has
two types of results all results and
lucky results
the lucky results are based out of
rejects which is a customizable project
it is very easy to deploy and does not
need any expertise it's a chrome plugin
so it's very easy to use as well
both blue teams and red teams can use it
blue teams can use it to monitor
credentials for their organization
while red tanks can use it to search for
the leaked credentials
inside very of inside many repositories
of this
this search is
is in depth and it will have
more passwords
than just searching for two or three
keywords
it also has a
advantage that it runs in background so
once it starts you can
actually come back at a later stage and
see all the results this is particularly
useful if the search results for your
company name which you are searching are
very
large
okay so how can solar work so uh so
think of this as a browser so once you
open your browser and use the correct
stroller the credit stroller will search
the github using the ui
and it will try to get the repositories
okay so so searching for the ui is for
the is for the company keyword okay and
once you once it gets the repositories
and now the repositories are basically
sent to the api
to search for the keywords so this
section
is all for the keywords so once we get
the repositories
these repositories are now sent to the
api to search for the keywords
so the keywords are searched and once
the keywords are searched they are all
the
search results
are stored in all results okay so till
here
no regular expression uh regex has been
applied so if the file contains a
get password method
so all
all results will have a get password
method in uh in its output okay
uh after all of all of these results are
gathered all of these results are now
filtered
using the rejects and then we get the
lucky results
so lucky results are basically
a subset of all the results
and it is uh
and it is
and it comes from
all the results after applying the
regular expressions
uh so a lot of talk already let's see
the demo
and hope it works
okay so let's go back to
github again i hope everything is
visible maybe i can increase some font
size
okay
uh so if you click on the credits roller
uh plugin which is which i've installed
here
uh there are many buttons here uh i'll
go through all of these buttons here as
well so of course submit search is for
the searching all results are as i
mentioned previously all of the results
and i am feeling lucky button is for the
lucky results
uh you have these two buttons for
clearing the results and the lucky
results
you have the save configuration and the
load configuration as
well uh these two fields are for the
tokens uh i'll share with you later uh
what these tokens are or maybe you know
github tokens and github username
these two buttons are basically default
search keywords and default rejects
uh you can modify it as per your liking
uh
today i've modified it to use uh only
two keywords
and
and i have kept the same regex
uh and i'll put red team cafe here
so
if you uh so
what
uh so this what this will do is it will
search for a theme.cafe
as a company name
in all of the github repositories
once it finds those repositories it will
go and search for all these keywords
which i have separated by comma
and then it will uh find these keywords
inside all of the files which we found
uh in the repositories
and then it will parse it with this uh
with this rejects and see if there are
any lucky results those lucky results
will be saved in the
lucky file which we can see later
so let's quickly submit the search
the search takes a bit of time so it
will
go automatically to all of the pages
uh and then once all of the searching
finishes it will stop so so the
searching from the ui has stopped but
the background mode is still working
to see how it works and background mode
working we can come back to the
credits roller plug-in
we can click on show all results so all
results are basically as i told you
previously all of the results
uh
so if there's a password word anywhere
you can see the password here
of course this is too much overwhelming
and
there are so many results here you can
keep scrolling and these are these are
being still added so there are so many
results you can uh you can find so much
data here okay
wow okay we found some
uh usernames and passwords here as well
so basically as i told you uh
all results are
definitely all of the results which cred
stroller can come up with
we are also interested in the lucky
results
so lucky results are the results which
are parsed and
and you know uh are retrieved from all
the visuals after using the regular
expressions
i think this one is still populating
so let's wait for a few minutes
and come back to it
once all of the results are populated
okay but you can see here in the medium
you can see here that it has already
populated one
one result which has uh which was not
popular or which was not shown to us
in the first manual search where we
searched for
uh retrieve.cafe and the password so
this
specific
keyword and password was not
shown there
okay uh
let's see and let's hope if this is uh
already updated
it is not updated yet
so let's wait for a few more minutes
um
now
okay so all of the results have been
populated now
and we can see that it has found a lot
of passwords
um it has also uh it has also found some
password which we were which we didn't
find the last time
like these ones okay
and it has also fine found passwords uh
which i didn't intend to find in the
first place
but okay as long as it works i'm i'm
great
okay so
uh of course you can see that there are
some false positives like these
but this actually tells me that there is
some automation scripts which i can
go and see inside this specific
repository so it is still useful i'll
now say this is completely useful but
this does gives me
an idea of what may be inside this
repository
okay
so we come back to the results here and
we can see that it has found some
passwords here
now this password was definitely not
found in the first
manual search why because this specific
file if i go to this file
you can see that there is no mention of
a theme.cafe okay so if there is no
mention of the teamwork cafe the
combined search the combined manual
search of the team no cafe space
password will definitely not find this
file because there is no mention of a
theme.cafe in this specific file
so i can say this is the
best scenario of why you should use
quest stroller because crestroller is
actually able to find these passwords
which are hidden inside configuration
files
and may not have the company name inside
those files okay
um
so coming back
to the slides
so
as you
can think
this can also be abused
for
mass credential gathering i will not
deep dive into that because that's that
is something i live up leave it up to
your imagination
um
if you provide right uh rejects then you
can do anything you want from this tool
uh for the future improvements uh
there are some
there are some uh github api
restrictions which we think we should
bypass or we should try to uh you know
which we should you know
overcome
uh so that's why we were using two keys
we can use
many keys so as men so the more keys you
use more faster is the search we are
definitely thinking to add or i am
definitely thinking to add the cron job
functionality because this will greatly
increase the usability of the tool so i
can
i can run it in the background and then
if even and and it will keep searching
after every one hour for for example and
anytime there is a
there is a credit leak i can quickly get
a notification on my tech store
uh
we can have an export to csv because
that's very
important
and because sometimes we need csv to you
know show it to the management
uh we can also think of adding more
rejects
so if community wants they can you know
add more rejects and the keywords and
then we can have multiple
uh keywords and rejects
for people to use in the future
if you have any questions uh please let
us know or please let me know using the
difficult channel
uh
so that's it um thank you um you can
contact me if you have any questions
after this talk
you can contact me on twitter
uh at shantung hyundai that's my handle
and you can also find me on my website
um
that's it thank you have a nice day
bye