Trick or XFLTReaT a.k.a. Tunnel all the things Balazs Bucsay / - - PowerPoint PPT Presentation

▶
trick or xfltreat a k a tunnel all the things
SMART_READER_LITE
LIVE PREVIEW

Trick or XFLTReaT a.k.a. Tunnel all the things Balazs Bucsay / - - PowerPoint PPT Presentation

Dec 12, 2022 274 likes •742 views

Trick or XFLTReaT a.k.a. Tunnel all the things Balazs Bucsay / @xoreipeip Senior Security Consultant @ NCC Group Bio / Balazs Bucsay Hungarian hacker Senior Security Consultant @ NCC Group Strictly technical certificates: OSCE,

slide-1
SLIDE 1

Trick or XFLTReaT a.k.a. Tunnel all the things

Balazs Bucsay / @xoreipeip Senior Security Consultant @ NCC Group

slide-2
SLIDE 2

Bio / Balazs Bucsay

  • Hungarian hacker
  • Senior Security Consultant @ NCC Group
  • Strictly technical certificates: OSCE, OSCP, OSWP, GIAC GPEN, CREST CCT/2
  • Lots of experience in offensive security
  • Started with ring0 debuggers and disassemblers in 2000 (13 years old)
  • Major projects:
  • GI John (2009) – Hacktivity
  • Chw00t (2015) – PHDays, DeepSec, Hacktivity
  • XFLTReaT (2017) – RuxCon, BruCON, HITB GSEC, Shakacon
  • Twitter: @xoreipeip
  • Linkedin: https://www.linkedin.com/in/bucsayb
slide-3
SLIDE 3

Presentations

  • Talks around the world:
  • Ghent (BE) / BruCON
  • Singapore (SG) / Hack in the Box GSEC
  • Honolulu (HI) / Shakacon
  • Atlanta (GA) / Hacker Halted
  • Moscow (RU) / PHDays
  • Oslo (NO) / HackCon
  • Vienna (AT) / DeepSec
  • Budapest (HU) / Hacktivity
  • London (UK) / Inf. Gov. & eDiscovery Summit
  • There is some more space here…

@xoreipeip

slide-4
SLIDE 4

Tunnels

slide-5
SLIDE 5

Without a tunnel

@xoreipeip

slide-6
SLIDE 6

With a tunnel

@xoreipeip

slide-7
SLIDE 7

Why would one use tunnels?

  • Work VPN – to access the corporate internal network
  • Hide real IP address
  • Whistle-blowers/Journalists to communicate anonymously
  • Torrent
  • ISPs filtering some ports (secure IMAP, SMTPS, NetBIOS, …)
  • Bypass corporate proxy policy
  • Bypass captive portals!?
  • What about you?

@xoreipeip

slide-8
SLIDE 8

Have you done … tunnelling?

Protocol Tool TCP

@xoreipeip

slide-9
SLIDE 9

Have you done … tunnelling?

Protocol Tool TCP OpenVPN Cisco AnyConnect UDP

@xoreipeip

slide-10
SLIDE 10

Have you done … tunnelling?

Protocol Tool TCP OpenVPN Cisco AnyConnect UDP OpenVPN ICMP

@xoreipeip

slide-11
SLIDE 11

Have you done … tunnelling?

Protocol Tool TCP OpenVPN Cisco AnyConnect UDP OpenVPN ICMP Hans Ping Tunnel ICMPTx DNS

@xoreipeip

slide-12
SLIDE 12

Have you done … tunnelling?

Protocol Tool TCP OpenVPN Cisco AnyConnect UDP OpenVPN ICMP Hans Ping Tunnel ICMPTx DNS iodine DNSCat* Ozymandns HTTP CONNECT Proxifier OpenVPN Pure HTTP ? TLS v1.2 ? TLS v1.2 with Kerberos auth ?

@xoreipeip

slide-13
SLIDE 13

Oh no! I forgot to set up my OpenVPN on port 443

(Port TCP/443 unfiltered)

Two days on a ferry

slide-14
SLIDE 14

10 hour flight to Japan

(ICMP unfiltered)

slide-15
SLIDE 15

At the airport

(DNS unfiltered)

slide-16
SLIDE 16

What did I see?

Get tired of:

  • As many protocols as many solutions
  • Hard to modify the existing ones
  • No modularity
  • Portability issues
  • Configuration issues
  • Unsupported/EoL tools
  • No automation at all
  • It is just hard, but it does not have to be!

@xoreipeip

slide-17
SLIDE 17

XFLTReaT

The beast was born!

slide-18
SLIDE 18

Tunnelling theory 101 / MTU

@xoreipeip

slide-19
SLIDE 19

What is XFLTReaT?

XFLTReaT (say exfil-treat or exfiltrate)

  • Tunnelling framework
  • Open-source
  • Python based
  • OOP
  • Modular
  • Multi client
  • Plug and Play (at least as easy as it can be)
  • Check functionality

@xoreipeip

slide-20
SLIDE 20

Easy, modular, plug & play

  • Install:
  • git clone & pip install
  • edit config
  • run
  • Tunnels, encryption, authentication etc. are modular
  • Plug and play:
  • Copy new module into modules/, support files to support/
  • edit config
  • run

@xoreipeip

slide-21
SLIDE 21

Framework, as it is

You do not have to:

  • Set up the routing
  • Handle multiple users
  • Create and set up an interface or interfaces
  • Care about encryption, authentication or encoding

You only have to:

  • Encapsulate your packets into your protocol
  • Implement protocol related things

@xoreipeip

slide-22
SLIDE 22

Check functionality

  • Easy way to figure out, which protocol is not filtered on the network
  • Automated approach: No deep knowledge is needed
  • Client sends a challenge over the selected (or all) modules to the server
  • If the server responses with the solution:
  • We know that the server is up and running
  • The specific module/protocol is working over the network
  • Connection can be made

@xoreipeip

slide-23
SLIDE 23

One interface to rule them all

@xoreipeip

slide-24
SLIDE 24

Channels

  • There are two channels in every tunnel
  • Data: data transmission
  • Control: control messages
  • Check message/response
  • Authentication related messages
  • Logoff message
  • Dummy message for keep-alive and query request
  • Auto-tune messages
  • etc.

@xoreipeip

slide-25
SLIDE 25

Ease of development

slide-26
SLIDE 26

Module tree

@xoreipeip

slide-27
SLIDE 27

Ease of use/development

  • Only web traffic allowed?

@xoreipeip

slide-28
SLIDE 28

Ease of use/development

  • Only web traffic allowed? Set your server on port TCP/80
  • Only ICMP type 0 allowed?

@xoreipeip

slide-29
SLIDE 29

Ease of use/development

  • Only web traffic allowed? Set your server on port TCP/80
  • Only ICMP type 0 allowed? Copy ICMP module, change type 8 to 0
  • HTTP should work, but only with special header?

@xoreipeip

slide-30
SLIDE 30

Ease of use/development

  • Only web traffic allowed? Set your server on port TCP/80
  • Only ICMP type 0 allowed? Copy ICMP module, change type 8 to 0
  • HTTP should work, but only with special header? Set the header in source
  • HTTPS allowed but only with TLS v1.2?

@xoreipeip

slide-31
SLIDE 31

Ease of use/development

  • Only web traffic allowed? Set your server on port TCP/80
  • Only ICMP type 0 allowed? Copy ICMP module, change type 8 to 0
  • HTTP should work, but only with special header? Set the header in source
  • HTTPS allowed but only with TLS v1.2? Copy TLS module, set it to 1.2 only
  • Special authentication over HTTP proxy?

@xoreipeip

slide-32
SLIDE 32

Ease of use/development

  • Only web traffic allowed? Set your server on port TCP/80
  • Only ICMP type 0 allowed? Copy ICMP module, change type 8 to 0
  • HTTP should work, but only with special header? Set the header in source
  • HTTPS allowed but only with TLS v1.2? Copy TLS module, set it to 1.2 only
  • Special authentication over HTTP proxy? Implement the auth, change the config
  • Want to send data over text/SMS?

@xoreipeip

slide-33
SLIDE 33

Ease of use/development

  • Only web traffic allowed? Set your server on port TCP/80
  • Only ICMP type 0 allowed? Copy ICMP module, change type 8 to 0
  • HTTP should work, but only with special header? Set the header in source
  • HTTPS allowed but only with TLS v1.2? Copy TLS module, set it to 1.2 only
  • Special authentication over HTTP proxy? Implement the auth, change the config
  • Want to send data over text/SMS? Handle connection with your phone from a module
  • PROTIP: just use the source!

@xoreipeip

slide-34
SLIDE 34

SCTP + WebSocket

  • SCTP module created and submitted by @info_dox
  • Best example of how easy to create a standard tunnel
  • Please use the next-version branch for developing
  • Create issues
  • WebSocket module added
  • Created a new tunnel in 3-4 hours
  • Ideal for proxies if WebSocket is supported
  • What is your next module?

@xoreipeip

slide-35
SLIDE 35

DEMO

slide-36
SLIDE 36

A few technical details

  • TCP is pretty easy
  • New connection/new thread for all users
  • UDP introduced new challenges
  • Stateless - One socket for all users
  • Sender address needs to be checked
  • ICMP
  • Just like UDP it is stateless as well
  • Identifier and sequence tracking (for NAT/Firewalls)
  • As many request as many answers

@xoreipeip

slide-37
SLIDE 37

DNS module

@xoreipeip

  • The DNS module is not 100% yet
  • Zonefile support included
  • Supports A/CNAME, PRIVATE and NULL records (easily extendable)
  • Tested with Bind9
  • Auto tune functionality checks:
  • Which is the best encoding and length for upstream
  • Which is the best encoding, length and record type down downstream
  • Example: NULL record with no encoding with 300bytes downstream
slide-38
SLIDE 38

Why tunnelling can’t be done over A record

@xoreipeip

  • Question of all time!
  • A request with CNAME answer is possible
  • A request with A answer is not (really?)
  • A / AAAA records can have 4/16 bytes long payload
  • Simple TCP ACK packet is 66 bytes
  • This means 17 DNS packets / ACK
  • 338 packets for a full size TCP packet (with MTU set 1350)
slide-39
SLIDE 39

Offense

  • Bypass basic obstacles
  • Specific ports are unfiltered (TCP / UDP)
  • DNS allowed
  • ICMP allowed
  • Bypass not that basic obstacles
  • Specific protocol allowed (IPS or any other active device in place)
  • Special authentication required
  • Exfiltrate information from internal networks
  • Get unfiltered internet access

@xoreipeip

slide-40
SLIDE 40

Defense for companies

Check your network settings

  • Check functionality
  • Try to exfiltrate data – check whether your active network device can catch it

Captive portals

  • Drop all packets that are addressed to external until not authenticated
  • All DNS query should have the same response (the portal)

@xoreipeip

slide-41
SLIDE 41

Defense for companies

No solution is 100% secure

  • Do not route your network to the internet
  • Disable all traffic between the internet and internal network
  • Use HTTP Proxy and enforce it
  • Whitelist ports (80 and 443, would you need anything else?)
  • Blacklist websites (does not really help on XFLTReaT)
  • DNS
  • Filter external DNS queries if possible (let HTTP proxy do the resolving)

@xoreipeip

slide-42
SLIDE 42

Defense for companies

No solution is 100% secure

  • Do you have an inventory? (IP, owner, purpose, location)
  • Do baselining (Use Netflow or Bro)
  • Check relation between IPs
  • What are the top talker source IPs (bytes, packets, flows)?
  • What are the top destination IPs (bytes, packets, flows)?
  • Any unusual activity should generate an alert/be blocked when you are done

@xoreipeip

slide-43
SLIDE 43

Already released

@xoreipeip

http://xfltreat.info https://github.com/earthquake/XFLTReaT

slide-44
SLIDE 44

TODO

@xoreipeip

  • Commenting
  • Bug fixes
  • Authentication + encryption modules
  • Multi OS support
  • New modules
  • You can help if you would like! (use next-version branch)
slide-45
SLIDE 45

Q&A - Thank you for your attention

Balazs Bucsay / @xoreipeip

slide-46
SLIDE 46

Office Locations

Europe

Manchester - Head Office Amsterdam Basingstoke Cambridge Copenhagen Cheltenham Delft Edinburgh Glasgow The Hague Leatherhead Leeds London Madrid Malmö Milton Keynes Munich Vilnius Zurich

North America

Atlanta, GA Austin, TX Boston, MA Campbell, CA Chicago, IL Kitchener, ON New York, NY San Francisco, CA Seattle, WA Sunnyvale, CA Toronto, ON

Asia-Pacific

Singapore Sydney

Middle East

Dubai