-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathREADME.html
More file actions
500 lines (499 loc) · 17.9 KB
/
README.html
File metadata and controls
500 lines (499 loc) · 17.9 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta http-equiv="Content-Style-Type" content="text/css" />
<meta name="generator" content="pandoc" />
<meta name="author" content="Jeff Beley @jbeley" />
<title>Quick incident triage with Linux from the bar, or the airplane, or …</title>
<style type="text/css">
code{white-space: pre-wrap;}
span.smallcaps{font-variant: small-caps;}
span.underline{text-decoration: underline;}
div.column{display: inline-block; vertical-align: top; width: 50%;}
</style>
<style type="text/css">
a.sourceLine { display: inline-block; line-height: 1.25; }
a.sourceLine { pointer-events: none; color: inherit; text-decoration: inherit; }
a.sourceLine:empty { height: 1.2em; }
.sourceCode { overflow: visible; }
code.sourceCode { white-space: pre; position: relative; }
div.sourceCode { margin: 1em 0; }
pre.sourceCode { margin: 0; }
@media screen {
div.sourceCode { overflow: auto; }
}
@media print {
code.sourceCode { white-space: pre-wrap; }
a.sourceLine { text-indent: -1em; padding-left: 1em; }
}
pre.numberSource a.sourceLine
{ position: relative; left: -4em; }
pre.numberSource a.sourceLine::before
{ content: attr(title);
position: relative; left: -1em; text-align: right; vertical-align: baseline;
border: none; pointer-events: all; display: inline-block;
-webkit-touch-callout: none; -webkit-user-select: none;
-khtml-user-select: none; -moz-user-select: none;
-ms-user-select: none; user-select: none;
padding: 0 4px; width: 4em;
color: #aaaaaa;
}
pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
div.sourceCode
{ }
@media screen {
a.sourceLine::before { text-decoration: underline; }
}
code span.al { color: #ff0000; font-weight: bold; } /* Alert */
code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
code span.at { color: #7d9029; } /* Attribute */
code span.bn { color: #40a070; } /* BaseN */
code span.bu { } /* BuiltIn */
code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
code span.ch { color: #4070a0; } /* Char */
code span.cn { color: #880000; } /* Constant */
code span.co { color: #60a0b0; font-style: italic; } /* Comment */
code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
code span.do { color: #ba2121; font-style: italic; } /* Documentation */
code span.dt { color: #902000; } /* DataType */
code span.dv { color: #40a070; } /* DecVal */
code span.er { color: #ff0000; font-weight: bold; } /* Error */
code span.ex { } /* Extension */
code span.fl { color: #40a070; } /* Float */
code span.fu { color: #06287e; } /* Function */
code span.im { } /* Import */
code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
code span.kw { color: #007020; font-weight: bold; } /* Keyword */
code span.op { color: #666666; } /* Operator */
code span.ot { color: #007020; } /* Other */
code span.pp { color: #bc7a00; } /* Preprocessor */
code span.sc { color: #4070a0; } /* SpecialChar */
code span.ss { color: #bb6688; } /* SpecialString */
code span.st { color: #4070a0; } /* String */
code span.va { color: #19177c; } /* Variable */
code span.vs { color: #4070a0; } /* VerbatimString */
code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
</style>
<link rel="stylesheet" type="text/css" media="screen, projection, print"
href="https://www.w3.org/Talks/Tools/Slidy2/styles/slidy.css" />
<link rel="stylesheet" type="text/css" media="screen, projection, print"
href="github.css" />
<script src="https://www.w3.org/Talks/Tools/Slidy2/scripts/slidy.js"
charset="utf-8" type="text/javascript"></script>
</head>
<body>
<div class="slide titlepage">
<h1 class="title">Quick incident triage with Linux from the bar, or the airplane, or …</h1>
<p class="author">
Jeff Beley <span class="citation">@jbeley</span>
</p>
<p class="date">01-APR-2019</p>
</div>
<div id="about-me" class="slide section level1">
<h1>About me</h1>
<ul>
<li><p>OSS Evangelist</p></li>
<li><p>The nosiest guy on your network</p></li>
<li><p>docker fanatic</p></li>
<li><p><a href="https://twitter.com/jbeley">@jbeley</a></p></li>
</ul>
</div>
<div id="badguy.net-call-from-fbi" class="slide section level1">
<h1>Badguy[.]net call from FBI</h1>
<ul>
<li>True story.</li>
</ul>
<p><img src="Smith1.png" /></p>
</div>
<div id="true-story-contd" class="slide section level1">
<h1>True Story Cont’d</h1>
<ul>
<li>Agent Smith calls $CLIENT. Stating they have a machine talking to badguy[.]net
<ul>
<li>No other information is typically given by the FBI</li>
</ul></li>
<li>$CLIENT has massive ransomware outbreak
<ul>
<li>Indicating full domain compromise</li>
</ul></li>
</ul>
<blockquote>
<p>You don’t get to execute on that many machines without credentials</p>
</blockquote>
<ul>
<li>$CLIENT calls us to unravel the puzzle</li>
</ul>
</div>
<div id="what-are-we-hunting-for-most-often" class="slide section level1">
<h1>What are we hunting for most often</h1>
<ul class="incremental">
<li><em>Tradecraft tools</em></li>
</ul>
<ul class="incremental">
<li>mimikatz</li>
</ul>
<ul class="incremental">
<li>PowerShell Empire</li>
</ul>
<ul class="incremental">
<li>Cobalt Strike</li>
</ul>
<ul class="incremental">
<li><em>Lateral movement</em></li>
</ul>
<ul class="incremental">
<li>psexec</li>
</ul>
<ul class="incremental">
<li>RDP</li>
</ul>
<ul class="incremental">
<li><em>Packaging of data in preparation for exfiltration</em></li>
</ul>
<ul class="incremental">
<li>Executition of 7-zip, rar, zip compression utlities to package data</li>
</ul>
<ul class="incremental">
<li>On disk artifacts</li>
</ul>
</div>
<div id="first-were-going-to-need-tools" class="slide section level1">
<h1>First we’re going to need tools</h1>
<p><img src="guns.gif" /></p>
<table>
<thead>
<tr class="header">
<th>Tools</th>
<th></th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>SSH Client</td>
<td>byobu ( terminal workflow enhancer )</td>
</tr>
<tr class="even">
<td>imount ( exposing images )</td>
<td>volatility ( memory analysis )</td>
</tr>
<tr class="odd">
<td>yara ( supercharged pattern matcher )</td>
<td>* scalpel ( file carving )</td>
</tr>
<tr class="even">
<td>loki (tradecraft hunting )</td>
<td>plaso (timeline for targeted artifact pulls)</td>
</tr>
<tr class="odd">
<td>other GNU tools</td>
<td></td>
</tr>
</tbody>
</table>
<blockquote>
<p>Total cost: 0$</p>
</blockquote>
<blockquote>
<p><em>No dongles required</em></p>
</blockquote>
</div>
<div id="ssh-client" class="slide section level1">
<h1>SSH Client</h1>
<ul>
<li><a href="https://juicessh.com/">JuiceSSH - SSH Client for Android</a></li>
<li><a href="https://connectbot.org/">ConnectBot - OpenSource SSH Client for Android</a></li>
<li><a href="https://www.termius.com/">Terminus - Commercial SSH Client for iOS and others</a></li>
<li><a href="https://www.chiark.greenend.org.uk/~sgtatham/putty/">Putty - SSH Client for Windows</a></li>
<li><a href="https://www.iterm2.com/">iTerm2 (not really an SSH client, but an amazing terminal emulator)</a></li>
</ul>
</div>
<div id="worfkflow-enhancers" class="slide section level1">
<h1>Worfkflow Enhancers</h1>
<ul>
<li><p>byobu</p>
<ul>
<li>keeps session alive by use of status bar</li>
<li>status bar configurable via <code>byobu-config</code></li>
<li>Can use GNU Screen bindings or tmux</li>
<li>installable via <code>apt-get</code> or <code>brew</code></li>
<li>Japanese for folding screen</li>
</ul></li>
<li><p>GNU Screen</p>
<ul>
<li>more ubiquious than byobu</li>
<li>no automated status bar</li>
<li>installable via <code>apt-get</code> or <code>brew</code></li>
</ul></li>
</ul>
</div>
<div id="worfkflow-enhancers-contd" class="slide section level1">
<h1>Worfkflow Enhancers CONT’d</h1>
<ul>
<li>A timestamped bash history file (customization of /etc/bash.bashrc)</li>
</ul>
<div class="sourceCode" id="cb1"><pre class="sourceCode bash"><code class="sourceCode bash"><a class="sourceLine" id="cb1-1" title="1"><span class="co"># set the number commands for bash to remember in the command history</span></a>
<a class="sourceLine" id="cb1-2" title="2"><span class="va">HISTFILESIZE=</span>1000000</a>
<a class="sourceLine" id="cb1-3" title="3"><span class="co"># set the maximum number of lines to store in the bash history file</span></a>
<a class="sourceLine" id="cb1-4" title="4"><span class="va">HISTSIZE=</span>1000000</a>
<a class="sourceLine" id="cb1-5" title="5"><span class="co"># set the format of the timestamps stored in the bash history file</span></a>
<a class="sourceLine" id="cb1-6" title="6"><span class="va">HISTTIMEFORMAT=</span><span class="st">'%F %T '</span></a>
<a class="sourceLine" id="cb1-7" title="7"><span class="co"># force bash to write to history file upon returning to a prompt,</span></a>
<a class="sourceLine" id="cb1-8" title="8"><span class="co"># this ensures bash logs commands even when the interactive shell session terminates</span></a>
<a class="sourceLine" id="cb1-9" title="9"><span class="va">PROMPT_COMMAND=</span><span class="st">'history -a'</span></a></code></pre></div>
</div>
<div id="exposing-images" class="slide section level1">
<h1>Exposing images</h1>
<ul>
<li>imount</li>
</ul>
<blockquote>
<p>works with E01s VMDKS RAW bitlocker LVM</p>
</blockquote>
<p>runs in foreground by default <code>^z</code> or use byobu</p>
<blockquote>
<p>NOTE: Userspace filesystems (NTFS, EWF, etc) are slow. Thus the need for targeted collections.</p>
</blockquote>
</div>
<div id="lets-start-hunting" class="slide section level1">
<h1>Let’s start hunting</h1>
<ul>
<li>badguy[.]net has historically resolved to <code>45.xxx.xxx.xxx</code> so we’ll start there</li>
</ul>
<p><img src="Robtex.png" /></p>
<ul>
<li>Robtex is free and awesome</li>
</ul>
</div>
<div id="first-indicators" class="slide section level1">
<h1>First indicators</h1>
<p><img src="1__root_linanalyst1__10_2_28_4__-_byobu__ssh_-7.png" /></p>
</div>
<div id="second-indicators" class="slide section level1">
<h1>Second Indicators</h1>
<p>If vmware snapshot, don’t forget to convert to raw format</p>
<p>strings then strings again</p>
<div class="sourceCode" id="cb2"><pre class="sourceCode bash"><code class="sourceCode bash"><a class="sourceLine" id="cb2-1" title="1"><span class="fu">strings</span> -o -el memdump.mem <span class="op">></span> memdump.txt</a>
<a class="sourceLine" id="cb2-2" title="2"><span class="fu">strings</span> -o memdump.mem <span class="op">>></span> memdump.txt</a>
<a class="sourceLine" id="cb2-3" title="3"><span class="fu">egrep</span> -iwF <span class="st">'badguy.net|45.xxx.xxx.xxx'</span> memdump.txt <span class="op">></span> badguy.txt</a>
<a class="sourceLine" id="cb2-4" title="4"><span class="fu">less</span> badguy.txt</a></code></pre></div>
<ul>
<li>Why do we have to run strings twice?</li>
</ul>
</div>
<div id="a-brief-pivot" class="slide section level1">
<h1>A brief pivot</h1>
<p>Attack graph…We’ve seen some stuff</p>
<div class="figure">
<img src="attack.svg" alt="Graph of attacker activities" />
<p class="caption">Graph of attacker activities</p>
</div>
</div>
<div id="cobalt-strike-osint-profiling" class="slide section level1">
<h1>Cobalt Strike OSINT Profiling</h1>
<ul>
<li>The shodan report for <code>45.xxx.xxx.xxx</code> is pretty interesting</li>
</ul>
<p><img src="ip_45_227_255_117_-_Shodan_Search.png" /></p>
</div>
<div id="cobalt-strike-osint-profiling-contd" class="slide section level1">
<h1>Cobalt Strike OSINT Profiling CONT’d</h1>
<ul>
<li>HTTP or HTTPS open returning error code 404
<ul>
<li>generally running nginx but sometimes Apache</li>
</ul></li>
<li>SSH on Ubuntu</li>
<li>RDP open with a hostname matching WIN-(randomish string), possible a NAT to a windows box elsewhere, or likely a VirtualBox VM running Windows</li>
<li>ngrok tunneling service</li>
<li>SMB</li>
<li>winrm</li>
</ul>
<blockquote>
<p>Shodan FTW</p>
</blockquote>
<h2 id="if-you-have-greater-visiblity">If you have greater visiblity</h2>
<ul>
<li>SSL Cert with SHA-1 hash <code>6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c</code></li>
<li>SSL Certs with no locality information</li>
</ul>
</div>
<div id="based-on-the-osint" class="slide section level1">
<h1>Based on the OSINT</h1>
<ul>
<li>Probably Cobalt Strike</li>
</ul>
</div>
<div id="volatility" class="slide section level1">
<h1>volatility</h1>
<ul>
<li>yarascan</li>
<li>cobalt strike plugin</li>
<li>strings
<ul>
<li>Make sure your strings are very targeted, this is a very expensive process</li>
</ul></li>
</ul>
</div>
<div id="cobalt-strike-yara-jpcert" class="slide section level1">
<h1>Cobalt Strike yara (JPCERT)</h1>
<p><img src="1__root_linanalyst1__10_2_28_4__-_byobu__ssh_-2.png" /></p>
<pre><code>rule CobaltStrike_JPCERT {
strings:
$v1 = { 73 70 72 6E 67 00}
$v2 = { 69 69 69 69 69 69 69 69}
condition:
$v1 and $v2
}</code></pre>
</div>
<div id="cobalt-strike-jpcert-plugin" class="slide section level1">
<h1>Cobalt Strike JPCERT Plugin</h1>
<p><img src="1__root_linanalyst1__10_2_28_4__-_byobu__ssh__and_2__jeffrey_beley_AMAC02T48THGTFM___Projects_document_word_cloud__bash_.png" /></p>
<ul>
<li>Now included in <code>docker pull jbeley/loki</code></li>
</ul>
</div>
<div id="lateral-movement" class="slide section level1">
<h1>Lateral movement</h1>
<ul>
<li>Memory</li>
<li>evtx logs</li>
<li>prefetch</li>
</ul>
</div>
<div id="plaso" class="slide section level1">
<h1>Plaso</h1>
<ul>
<li>plaso
<ul>
<li>Event logs</li>
<li>Prefetch</li>
<li>MFT/filestat</li>
<li>IIS</li>
<li>Recycle Bin</li>
</ul></li>
</ul>
<pre><code>amcache,filestat,mft,prefetch,recycle_bin_info2,winevtx,winiis</code></pre>
<p><img src="1__root_linanalyst1__10_2_28_4__-_byobu__ssh_-4.png" /></p>
</div>
<div id="tradecraft-tools" class="slide section level1">
<h1>Tradecraft tools</h1>
<ul>
<li>loki IOC scanner
<ul>
<li>Uses yara and logic to find attacker tools on disk</li>
</ul></li>
</ul>
<p><img src="1__root_linanalyst1__10_2_28_4__-_byobu__ssh_-5.png" /></p>
</div>
<div id="loki-sample-findings" class="slide section level1">
<h1>Loki Sample findings</h1>
<pre><code>○ Plain text, weakly encrypted (AES-32) . Looks like the local admin password (which was cracked in 0.068 secs) was xxxxxxx
§ FILE: /data/System Volume Information/DFSR/Private/XXXXXXXXXXXXXXXXXXXXXXXX.xml SCORE: 50 TYPE: XML SIZE: 560
FIRST_BYTES: xxxxxxxxx / <?xml version="1.0"
MD5: xxxxxxxxxxxxxxxxxxx
SHA1: xxxxxxxxxxxxxxxxxxx
SHA256: xxxxxxxxxxxxxxxxxxx CREATED: Tue Mar 15 14:43:10 2016 MODIFIED: Thu Nov 8 03:03:44 2012 ACCESSED: Wed Nov 7 20:02:55 2012
REASON_1: Yara Rule MATCH: Groups_cpassword SUBSCORE: 50
DESCRIPTION: Groups XML contains cpassword value, which is decrypted password - key is in MSDN http://goo.gl/mHrC8P REF: http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/
MATCHES: Str1: cpassword="L Str2: changeLogon= Str3: description= Str4: acctDisabled=
</code></pre>
<ul>
<li><p>Why is this bad?</p></li>
<li><p>Using gpprefdecrypt.py</p></li>
</ul>
<pre><code>time python gpprefdecrypt.py xxxxxxxx
MyVoiceIsMyPasswordVerifyMe
real 0m0.269s
user 0m0.168s
sys 0m0.040s</code></pre>
</div>
<div id="checking-for-packaging" class="slide section level1">
<h1>Checking for packaging</h1>
<ul>
<li>scalpel</li>
</ul>
<p>Targeted <code>scalpel.conf</code></p>
<pre><code> 7z y 10000000 \x37\x7a\xbc\xaf\x27\x1c
zip y 10000000 PK\x03\x04 \x3c\xac
rar y 10000000 Rar!</code></pre>
<ul>
<li>Installed by default on SIFT workstation and can be installed on OSX with <code>brew</code></li>
</ul>
<p><img src="Screenshot_4_15_19__8_21_AM.png" /></p>
<ul>
<li>We carved an 80GB image in just over 5 minutes</li>
</ul>
<ul class="incremental">
<li>Why are carved zip files more likely to be complete using this process?</li>
</ul>
</div>
<div id="cheatsheets" class="slide section level1">
<h1>Cheatsheets</h1>
<table>
<colgroup>
<col width="57%" />
<col width="42%" />
</colgroup>
<thead>
<tr class="header">
<th>Descrption</th>
<th>Command</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>zgrep for zip</td>
<td><code>unzip -p zipfile.zip |grep -F -f keywords.txt</code></td>
</tr>
<tr class="even">
<td>zgrep for 7z</td>
<td><code>7za x -so |grep -F -f keywords.txt</code></td>
</tr>
<tr class="odd">
<td>Poor man’s paralell</td>
<td><code>|xargs -P 8 command</code></td>
</tr>
<tr class="even">
<td>Find files</td>
<td><code>find /mounted/directory -iname "*PF" -ls</code></td>
</tr>
<tr class="odd">
<td>syncing files</td>
<td><code>rsync --inplace --partial --progress --stats -avz YOURUSERID@sftp.nunya.biz:/jails/CASENAME/upload/ /LOCAL/</code></td>
</tr>
<tr class="even">
<td>Listing 7z</td>
<td><code>7za l FILENAME.7z</code></td>
</tr>
<tr class="odd">
<td>Listing zip</td>
<td><code>unzip -v FILENAME.7z</code></td>
</tr>
<tr class="even">
<td>Listing rar</td>
<td><code>unrar l FILENAME.7z</code></td>
</tr>
<tr class="odd">
<td>Dumping hex</td>
<td><code>xxd FILENAME |less</code></td>
</tr>
</tbody>
</table>
</div>
<div id="links" class="slide section level1">
<h1>Links</h1>
<p><a href="https://github.com/ralphje/imagemounter">imount GitHub</a></p>
<p><a href="https://github.com/machn1k/Scalpel-2.0/blob/master/conf/scalpel.conf">scalpel.conf</a></p>
<p><a href="http://byobu.co/">byobu</a></p>
<p><a href="https://github.com/JPCERTCC/aa-tools/blob/master/cobaltstrikescan.py">cobalt strike plugin</a></p>
<p><a href="http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/">passwords in GPO files</a></p>
<p><a href="https://raw.githubusercontent.com/reider-roque/pentest-tools/master/password-cracking/gpprefdecrypt/gpprefdecrypt.py">gpprefdecrypt.py</a></p>
</div>
<div id="questions" class="slide section level1">
<h1>Questions</h1>
</div>
</body>
</html>