3) Intrusion Tests Red Team approach Emmanuel Benoist Spring Term - - PowerPoint PPT Presentation

3) Intrusion Tests Red Team approach

Emmanuel Benoist

Spring Term 2016

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 1

Table of Contents

• Presentation
• Example of a Red Team Mission
• Attack the Desktop Computer

Search for information

• Example: Open a Back Door
• Social Engineering
• Limitations
• Reserve

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 2

Presentation

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 3

Red Team

Definition1

A red team is an independent group that challenges an

• rganization to improve its effectiveness.

Simulate a real attack

Use all possible means to test the system The “Blue Team” is protecting the system and challanged by the red team. See which assets of the enterprise may be compromised by a “real” attack (by motivated attackers).

Goal: Show the management that security is not a funny game

When reading a classical penetration testing report : “XSS on an error page, this is just a theoretical attack, nobody could use it” After a red team attack accessed the laptop of the CEO and the history of his browser: “YOU MUST FIX IT NOW!!!”.

1source: Wikipedia Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 4

Example: a Red Team Mission

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 5

Goal of the Red Team Mission

Goal: show what a determined attacker could access

In a Bank: access to money (transfer for instance), see one’s account In a eHealth environment: access to medical information . . .

Show which of the strategic items can be accessed, and what can be achieved with them

Active Directory, ERP, Data bases, File storage systems, R&D data,

Without being detected

A “Blue team” is hiding you, They may know a test is running, or not Better if they do not know.

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 6

What is a “Red Team Mission”?

Includes: Penetration tests on the IP addresses of the firm

Penetration testing is a crucial part of the mission First determine the scope of the attack

But also: Physical penetration

A firm must protect its infrastructure On-Line, but also Off-line. Once in the premises: Hide a small device like: PwnPlug, Fonera, Raspberry Pi Having a 3G access, you can use it as a bridge to enter the system

And: Social engineering

The most impressive part Less technical, but very efficient Phone calls, emails with trojan, phishing emails, . . .

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 7

First step: Nmap of all the Internets

First determine the scope

What are the IP-Ranges used by the firm? Normally included in the scope written in the contract.

Scan the ports

Impossible to scan exhaustively all ports of all machines Search for easy exploitable services FTP Servers File Sharing SNMP services Rlogin and other antiques You can not enter the system with this, but the information will be useful later

Scan the classical targets for penetration testing

Web servers, Web services, VPN access point, admin interfaces. Goal : get a Webshell access to a DMZ machine Upload flows, Admin interface of servers (Tomcat, Jboss, Websphere) Content Management Systems (including plugins) and their well known vulnerabilities

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 8

Attack the Desktop Computer

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 9

Spear Phishing to compromise a client

Spear Phishing

Send a mail, to install malware on a client Goal is to install a back-door

Mean of action

Send a mail containing a hyperlink

• r an attachement

Executed malware

Will be executed on the victim’s computer Will allow the attacker to control the machine Installs a back-door

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 10

Search for information

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 11

Search for Information

Search for the email addresses of the employees

Access some addresses, Understand the construct of the address: firstname.name@target.com, fname@target.com, firstname-name@target.com, name@target.com, . . . Source of information: LinkedIn, Viadeo or Xing

Automatically harvest the addresses in Web sites

Theharvester (a python program) search for emails in Google, Bing, LinkedIn, Twiter or even Shodan

Build your own crawler

Find email, phone numbers or names of employees Use Scrapy in Python for visiting web sites

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 12

The Harvester

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 13

Manually

See information directly

Find employees that are very enthousisatic (and not secure) Find phone numbers of specific persons Office numbers, location in the premises

Visit manually the web sites

You may find useful information

Use Google Dorks

site:linkedin.com inurl:pub -inurl:dir "at firm-name’’ "Current"

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 14

Phishing

We have a good list of possible targets

We need to know who are the targets (role, rank in the

• rganisation)

Interesting subjects in a phishing email

“Your bank account was just missused if you want to save your money, connect now” “If you want the new iPhone for CHF 100, open this document” This CV is very interesting, you need to activate the Macros to see it

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 15

How to send eMails

Using a public SMTP server

Gmail / GMX / . . . Easy to do You inherit the reputation of Google in spam filters Problem 1: The domain name is not very serious Problem 2: Attacking a third party using Google poses confidentiality questions.

Using a private SMTP server

You can chose the domain name you want You need to be sure not to be treated as a spam server Increase your server reputation: Deactivate the open relay function of the SMTP server Give the DNS MX entry of the domain Configure the DKIM signature . . .

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 16

The Payload

We want to maximize the efficiency of the attack

No need to a special exploit for the version X of Accrobat Reader on Windows 7.2 Ask kindly to your victim to execute macros.

Microsoft Office Macros

A macro to see the photo of a CV A macro to see the content of the invoice sent A macro to get data in a presentation . . .

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 17

Browser Extensions

Give a link to an extension in Firefox

Can access to the whole machine: the browser Cookies, history But also the disk And execute a shell

You need to install it inside the addons.mozilla.org server Ask kindly to the victim to install it

You will be rewarded / you can only access this site with / . . . (depends highly on the profile of your victim). Installation genuine, just click twice

Extension for Internet Explorer

Browser Helper Objects (BHO) Much more complex to install : will not be done

Chrome

You must install your application on the Chrome Web Store.

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 18

Exploits

Very “cool” to exploit a vulnerability

Execute code in “Ninja mode” Nobody sees it

Applications are always more complex to exploit

Started in sandbox Protections are higher and higher Must develop an exploit for each version (32- / 64-bit, Windows 7, 8 or 10, . . . )

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 19

Phishings

Mails containing XSS

We will see it in detail later A mail containing a link to the valid server (https://www.target.com for instance) can lead to a manipulated page Can contain links to download software

Mails or SMS to Smartphones

One of the most efficient way to infect a person

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 20

Protections against such attacks

Sensibilisation

You must teach all your users Not just a course Serious training with testing of the users

Hardening of the configurations

For less experienced users Restrict any possibilities to install anything VERY difficult: How can I work without Macros?

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 21

Example: Open a Back Door

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 22

Intrusion Vector

Send an email to the chosen Victim

Write an email, that will motivate the victim to open your link Can be the result of a social engineering action (phones, mails, . . . ) “I send you the command for 1000 items”

Different executable codes

A file with an exotic suffix (for instance .scr) Executable file hidden in a Zip file PDF exploiting Adobe Reader Chosen Method: MS Office Macros

Development / reuse of existing software

Buy an existing back-door : Too dangerous to execute an unknown program on a client’s computer Isn’t a back door in the back door? Solution develop one’s own back-door Advantage: control of the functionalities and the dangerousness

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 23

Development of the Back Door

Chose a communication protocol

Synchron Protocols : Can execute any program at any time But requires an open connection: will be monitored by firewall

• r proxy.

Asynchron Protocols : Back door controls if new commands are sent regularly Much more difficult to be discovered

Which transfer protocol

IRC or XMPP are used by Botnets: too easy to be found by a firewall Better: HTTP; Can not be prohibited by a firewall Will use the standard proxy to exit the LAN (to overgo the firewall).

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 24

How to communicate

Asynchrone communication

Is more complex to implement (For synchrone communication, you just need one socket)

The client must initiate the communication with the Command and Control server (CC)

Send a request regularly, asking for orders Send the result of the order to another program

query.php The client connects to this resource on a regular basis First time: get a unique identifier (session ID) Next time: check if the CC has a new command response.php When a command is executed, the result is sent back to this address

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 25

Persistance of the Attack

Persistance is not always important (depend on the client)

Sometime, just showing the existing risk is sufficient Persistance : restart even after the end of the session

If the user does not have priviledges

Add your executable in the following directory %APTDATA%\Microsoft\Windows\Start Menu\Programs\Startup Add a register key in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Create a scheduled task using the command schtasks

If the user is an administrator

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup Add a register key in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Create a scheduled task using the commands at and schtasks

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 26

Useful commands

Extract information about the machine

Name of the machine, username, Active Directory domain, network card configuration

Screenshots

Very impressive to see your wife’s picture

Commands execution

Real backdoor allows to execute shell commands Problem: sometime hard to transfer the results using HTTP POST

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 27

Difference with malwares

Hide the process is not necessary

One can make the process easy to find, So that it can be removed easily

Self destruction

The CC must have a command for all the victims bots to self-destruct All bots must self destruct after the date of the mendate expires

Risk

A bot remains on a computer and someone else may take control on the machine.

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 28

Nice to have features

Communications must be encrypted

First solution: rely on the SSL encryption of HTTPS (need to verify the certificat) Nice to have: Encrypt the communication using a shared key (not so sure). Even Better: Use a public key

Search for passwords

In Browser In the Mail client Solution 1) Get files, send files to the CC, use Mimikatz or Meterpreter to decrypt the passwords Solution 2) Implement an extractor from the disk by yourself Better: find the passwords direct in memory

Keylogger

Can access password Exploitation is quite difficult (data are huge)

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 29

Social Engineering

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 30

Social Engineering: 3 steps

Planification

What do we want to test

Reconnaissance

Very important Goal: have an overview of the enterprise to find the most vulnerable targets Build realistic scenarios to attack the targets

Attack and Exploitation

Use all the collected information Goal: Extract information, enter the premises, install malware, . . .

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 31

Passive reconnaissance

Collect information without doing anything visible Web Site Public registers

Whois, certificate, moneyhouse, public contracts, reports, Swiss army officiers lists . . .

Exposed services

mail, web server, CMS, ERP, admin pages : can be useful for exploiting

Social Networks

LinkedIn, Xing, Facebook, Google+

Homepages

Blogs, Forums, homepages

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 32

Active Reconnaissance

Visit the trash bins

Can collect banking information, ID’s, Hollydays planning,

Observe the employees from outside

Follow them in public transportation See who arrives when, and how (car/public transportation/line/. . . ) See the dress code (do not come in jeans in a Swiss bank) Listen to conversations between colleges (at the restaurant for instance)

Visit the premises

To monitor the inside of the enterprise (physical security, IT-Infrastructure, . . . ) Forge a CV to be invited to an interview for a job offer Pretend to be a client Pretend to be a provider Or only come inside with all other employees (one in a big group) You could also pick a lock to enter an office

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 33

Elicitation 2

In order to access information, you should discuss with employees

They will provide a lot of information

Give something

A cigaret if the group is smocking outside,

• pen a door

The victim will want to give you something in return

Find a common interest

During the break, talk about the last TV show on the Internet You will learn about filter policy of the firm

Pretend something you know false to learn more about this

You will be corrected by your victim, that will explain much more than what you already know.

Use the same language than the group

If you can provide the insider’s vocabulary, (security by

• bscurity) you will be “trusted”.

2Source: www.westroane.com/content/documents/DHS/

• cso-elicitation-brochure.pdf

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 34

Pretexting

If you play a role, you need to practice

If the scenario you built is not serious, you will be discovered: end of the mission for you

The scenario must be adapted to the target

If you know the person like a country (from Facebook),

• rganize your scenario around this country

You need to know your story by heart

It needs to be very consistant, since you will have to discuss a long time to learn interesting information

Accessories

Do not bring too many accessories, chose 3 important details A geek T-shirt, if you pretend to be from the support A helm, a box and a sheet of paper: you are the delivery man

Phone call

Work on the special effects (what should be the surrounding environment)

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 35

How to increase your influence

Reciprocity

If you help someone, the person will help you back Example: Hold the door to enter, the person will unlock the next door for you.

Authority

Pretend that you work directly for the director: “John told me to do it” (you show your familiarity with the director) If you know the director is on a business trip and unavailable

Rarity

This offer is only valid for 10 days Reserved to the 40 first persons Only today

Sympathy

You need to be friendly to increase your chances

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 36

Toolbox for Social Engineering

The letter of the direction

In order not to go in jail, you need to have with you the authorization the direction gave you.

For intelligence

Tool for visiting the trashes (thanks to recycling, this much easier) Maltego to agglomerate all the information known about one person.

For the pretext

A web site, LinkedIn pages, papers with logo, Clothes with logo (depending on the role), you may even create some wikipedia pages

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 37

Exploitation tools

Social Engineering Toolkit (SET)

Functionalities for automatizing phishing Uses metasploit functionalities for Social Engineering For instance: generate a PDF containing an exploit with the logo of the firm, and send it to a list of employees.

Browser Exploitation Framework (BeFF)

Generates a hook in javascript (hook.js) Need to be executed by the victim (using a XSS for instance)

USB HID

Let you emulate a keyboard an mouse (less visible than using the keyboard an mouse of the victim)

Mana Toolkit

To simulate Wifi access point Duplication of SSID : play the man in the middle attack

Kali NetHunter

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 38

Physical Tools

A tool to hook a door

For instance the visit card of Kevin Mitnick

A RFID Kit

To clone a RFID card

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 39

Limitations

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 40

Protection?

Teach the users

Do not accept any USB stick Do not install any software . . . But you need to train an test it also after the teaching

Harden your infrastructure

Grant only the minimal authorization to users Can not install software What about Bring your own device policy? What about MS Office Macros?

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 41

Conclusion

Red Team approche will increase the awareness

You see your desktop in the powerpoint of the red team All your secrets can be found

It is not exhaustiv, just show one way to enter

There is not a list of vulnerabilities Can not be seen as a list of things to fix.

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 42

References

MISC Hors-s´ erie 12,Tests d’intrusion; le guide pour comprendre et utiliser les techniques d’attaques les plus r´ ecentes!, Editions Diamond, 2015 The Harvester : https://github.com/laramies/theHarvester Scrapy : http://scrapy.org

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 43

Reserve

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 44

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 45

Berner Fachhochschule | Haute cole spcialise bernoise | Berne University of Applied Sciences 46