OK, welcome everybody to master class today, December 15th,
2022. We're coming close to the end of things here.
We have another one next week on the 22nd.
No, we don't. Or do we do we?
No, we don't.
Oh my gosh, what do we have? Do we have one for the 22nd?
At least so I put down for it. I don't.
OK, good. Alright.
But I need to change my 15 minutes to 30 minutes.
So OK, so.
We do have one on the 22nd.
As it goes, uh, because we are still doing meetings next week,
but because we typically go by the schedule that the school
goes by so and the schedule for them of course is you are off
starting the 24th.
Umm. So on the 22nd we will still have master class.
And then it won't start again until.
January 5th and I know that for sure.
This evening we have 4 speakers, 15 minutes each. We've Shaun
Phillips, Markus Clay, Koko Gorvego and Mauricio Ramirez.
Sean, Are you ready to start?
I don't know that we're gonna get through it in 15 minutes,
but as far as we can get.
Can hear me testing.
Yes, I hear you.
I just take over and share.
So as I stated, I'm going to start the walkthrough of the
precious hack the box machine.
To conserve time, I have already connected to my VPN, started the
machine and preloaded a lot of the scripts. The main outcome of
this is trying to explain my thought process and how I like
to keep forward motion, forward thought and everything that I do
while going through the process and with any hack the box
machine.
The very first thing you generally always wanted to start
doing is a scam. For me, this is my Kali Linux instance that I
created at the beginning of the class.
And loaded it with the tools. Kali does come preloaded like
most distros.
With the tools you need to do the things you need to do. One
of the tools that I like first scanning is legion. It's based
off immap like Zenmap, and the reason I like it is because it
has a lot of additional features. Also like this lovely
little scan bar, especially the word polite for the scan.
You can bump it up to the hard module, which gives you a lot of
other features that you would get through IMAP as well.
But some of the features that gives you shows you the status
of the scan, how it's going as it finds services, it'll pop
them up here live as you'll start to see it found an open
port.
Here and it took a screenshot of the site.
Uh, that it found ohh. Doesn't look like it found much. Looks
like we have a DNS issue. It also will pull up scripts that
it can find for the sites as well as any information related
to the open ports and CVS related to the vulnerabilities
that the site might have issues with.
You know, so just kind of a one stop shop for all these tools.
For what you need and all of this information in my process
is you generally want to document everything. So here we
have a.
Open message on ad band server. We can see the version number.
We can see some CVE that we might want to research for some
vulnerabilities that we might be able to exploit. We have in
genics on web server and its version. Another feature that I
like about Cali is it has a built in.
Exploit tool called search sploit or you'd be able to check
to see if there's any known exploits for what you found.
Here you can see we're on version 1.18 and it looks like
there might be a denial of service stack which doesn't do
us any good because we're not looking to take the site down.
We could also do a search exploit for.
Open SSH to see if there's anything there, and
unfortunately for 8.4 P one, it looks like they've kept the
system fairly updated, so there's not really much we can
do.
There, that's positive. But you know, we still have all of a
sudden information here that we can look at to see if there's
anything there and we still have this website that looks like we
need to fix the DNS issue with first.
Umm.
So the way to fix that is to go to your host file.
Actually I have to enter a password there that helps.
And this is gonna allow my Kelly instance to resolve that
website.
So that only bring it up.
We should see what it is.
And it looks like a very basic website that will convert any
web page we want to PDF, and if there's anything playing around
with hack the boxes taught us it's that whenever we see.
Uh entry field like this one of the first things we want to try
to do is to see if it's possibly susceptible to a script
injection.
So you know, I'm preloaded on this lovely little Hello World
script alert. Hopefully it'll pop up something.
But it doesn't look like it does.
But you know, I still at this point haven't ran out of things
to try. You know, it's saying that it'll convert a web page to
a PDF and you know the any developer here will say, well,
the only way you can do that is through an API or an app or a
plug in or something like those. That and those generally have
their own exploits that you can take care of. So.
First, we need to find out what that is and the best way to do
that would be to get a PDF from it, so we can try converting
Google.
See if it will work.
Him. Apparently it doesn't work and can try Yahoo.
And I notice that doesn't work either, but you know, one of the
big things about this website I notice is it's not secure. So
maybe when it was designed, they didn't take that HTTPS
redirection into mind. So one of the best things we could do is
create our own website.
That way it's using HTTP instead of HTTPS.
And then try that and see if it'll convert that. Yeah. Again,
I have it preloaded.
And we can see that it's converted it to a PDF and we're
just going to open it another tool we can use is built in to
Cali.
Is the XY tool, which will show U.S. data about the PDF file,
but for me you know it's all about the graphic interface
because I hate remembering commands if I can avoid it.
And here I noticed that it was created in some tool that I've
never heard of before. So from here I did some research. You
know, at this point too goes into a research phase.
And one of the first things in my research I found on sneak IO
was that PDF kit was denied, designed by Ruby and that any
version below 8.7 was susceptible to packet injection.
Well, we're using according to the website, it's using 8.7 and
it even gives you the parameters that you could pass to test it
so.
One of the things we did.
We find it over here in my CHEAT SHEET.
Is.
To test that sleep command to see if we can get the website
and if you recall, when we hit the submit last time it was
pretty instant on popping up that PDF file. So now by doing
this it should theoretically sleep for five seconds before
converting thing and it did. So we now know that.
This.
Process is susceptible to injection, which means we have
our endpoint. The next thing we can do is create our listener
which I have done over here.
And get back over here using.
That same.
Script loading it with a bash command.
That will execute a bash shell to my listener. We should
successfully.
Get.
Access to their website and from here we can do an LS. See what
we are. We can do a. Who am I?
To see who we are more.
User Ruby and we have a basic.
Outline of the website here. No, but if anything try hack me.
Starting points of task that's not really where they keep user
data. They generally keep it.
In the root directory.
So heading over there should be our first spot.
And running a list, but we don't have anything so we might need
to run an advanced list, so we'll list out the directory.
And let's do a search for any, you know hidden files.
And here we got. Let's see, we got some bash history. We got
some bash log out.
We got to dot bundle dot cash dot profile, so normally we
would just go through these files one by one, but since I'm
running short on time, I'm just gonna skip ahead to bundle.
Because in here. Ohh sorry. Change directory to dot bundle.
And then list this directory out and then here we can see we have
a config file and the command to get that config file.
Is cat.
And it shows us that we have a username.
As well as a password.
No, that doesn't help us anything from here. But if we go
back and recall that there was an open.
SSH port.
You know, what are the chances that this was like a normal
human being who uses the same password for everything and was
therefore lazy and use that same password for that?
There.
Entering in the password.
We find we have access now to the SMTPD bank server and
listing that out. We have user dot text and from here we know
that going into that user dot text is most likely going to
give us our flag, which I'm not going to show you all because
that would give you guys the box a little too easily. But the key
here is that I always.
Document everything that I get. You know everything could be
useful if that didn't give me any headway or I got stuck. Any
point along the way, I would have started looking through
these to see if I had any information or hindsight here.
Legion gives you a brute force tool where I could have started
brute forcing the root password or the admin password when I
initially did this box, I actually used Metasploit.
It's because there's multiple tools and ways to do everything.
I actually use motorsport and found around 15 other accounts
that were active and viable. I just haven't found the passwords
for them yet, including root admin, Sally, Tom, and then I
did find Henry, but I couldn't find his password because that
was a fairly complicated complex password. So it's all about data
collection and information and processing it. But.
In the end, if you keep that forward progress, forward
momentum going and don't stall out, you should.
Capture those flags.
And that's all I have.
Big over.
Not too bad.
Awesome, great job.
Structure.
That was quite a run, man.
Well, you know a lot about that, that's for sure.
Yeah.
That's for sure.
And we get back to my window here.
I was.
Uh, we will have questions. Uh, later on.
I'm sure.
On my list, here we go.
All right next.
Uh Markus Clay, Are you ready?
Yes, ma'am.
Alright, go ahead.
Right.
Sticky.
You.
Named by. See that alright.
I do.
Alright.
Yes.
Alright, thanks. I wanna first thank everybody for joining this
master class presentation. Ohh, I'll be presenting about
wireless.
Most people use Wi-Fi and their daily lives, but don't know what
it is or how it really works. So by the end of this presentation,
I hope to leave you guys with some insight on it.
Aren't the first thing we got are some key terms that I would
like this year. There are several terms acronyms that I
can literally just go on the whole 15 minutes about, but
these are some.
Most important ones we have annotation with the signal loss
implications, signal gain or absorption signal reduction.
That and annotation really goes hand in hand like flip flop
depends on the context of how you're going. We got reflection.
Which is the seasonal valve soft scattering which is sick and was
on separates refraction which the signal bends as it passed
through object and diffraction.
And then I got a little diagram down here to show how each of it
does.
And then.
This is annotations like how much signal loss you lose per
material.
Alright, there are two types of physical channels that we use
when passing using passing data bounded and unbounded is what
commit what we used to what path are data takes, whether it's
sound, radio or whatever boundaries. The simple one. So
I'm gonna start there and the bounded medium. All signals are
contained within the medium itself and they are not allowed
to exit except for like small liquid leakage across tops.
There are several types of bounding media, such as wires,
coax cables, wave guides and optical fiber cables.
Unbounded media is which day of the travel travel through the
air, which most people just call wireless. So when you send data
from A to B, it doesn't go in a straight line point to point it
go, it's scatters. So it has to fight with everything else in
the air that's broadcasting.
Wireless also works and half duplex, which means it can't
receive and send it the same time.
Some examples of bounded media are microwaves, radio waves,
infrared ray satellites.
Wireless technology offers many advantages compared to
traditional wired networks. One of the main advantages of
wireless is the ability to provide anywhere, anytime
connectivity. Wireless technology is fairly easy and
it's inexpensive to install. The cost of home and business
wireless devices continue to decrease, yet the the despite
this decrease in cost, the data rate and capacity of these
devices have increased allowing much faster reliable wireless
connection.
Wireless technologies. They have networked to easily expand
without limitations of cable connections, new MV new and
visiting users can join the network quickly and easily.
Now we gonna talk about frequency and wavelengths.
Frequency is something that happens over a period of time,
for example, driving down road 70 mph or heartbeat of 120 and
Wi-Fi. We're talking about this 360 degree wave that starts at
0.
And ends at 360.
The most you could take any shape as long as it starts at 0
and ends at 360.
Uh way. I like to memorize it. For example, we have a like a
local radio station here 983.
That means it's frequency is 98.3 million times per second.
And Wi-Fi, we use frequency of 2.4 gigahertz and five
gigahertz, which six gigahertz is on the rise. Those cycles are
2.45 and 6 billion times per second.
Some other key things to take note is amplitude and
wavelength, which is the height.
Of the way the peak is known as the Christ, the higher the
amplitude, the more energy is being used and the wavelength is
comparison between those crests.
We have next year to talk about the phase and Wi-Fi. A phase is
the position of the way it a point in time of the cycle. It
provides a measurement of exactly where the wave is
position.
A complete wave cycles 360 degrees of a phase and my first
example here.
The two signals are completely In Sync. We call this being in
phase and what this will do is actually amplify the signals, so
you're able to hear your computer's able to hear more.
And my second example here is one is called 180 out of phase.
Both ways reached the rest points.
At the same time, but they're actually opposite of each other.
Was actually happening here is. It's not that the signal is
flipped, but the bottom one is actually just delayed slightly,
giving it that shape.
Next ways the.
Ohm antennas are ways to strengthen.
Wi-Fi RF signals the three main types of antennas are
omnidirectional. Semi directional, highly directional
omnidirectional antennas radiate radio frequencies in all
directions. These antennas have, like a donut shape, radiation
pattern, or ideal for connecting devices that are on the same
plane and can either go either way.
A good way to think about this, the sun how it just shines down
on all of us.
Semi directional antennas are antennas that focus energy in
One Direction is main purchase for short, medium range, remote
wireless bridge networks to connect different net buildings
or campuses. Think about like a desk lamp. It doesn't light up
the whole room, but that focus area is pretty lit and then
there's some you just leeway.
And highly directional antennas are used for long distance point
to point communication. They are used to bridge networks between
two buildings that are far apart or like quarries. This is like a
laser point or a spotlight.
And there's all always math one.
Alright, so when we come into management RL, there's the rules
of 10s and threes.
If if you lose 3 decimals, you're powers is half. If you
gain 3 decibels, your powers double. If you lose 10 decibels,
your power is the 10th. If you gain 10 decibels, your powers 10
times.
The reasons why we use decibels instead of milliwatts, it's
because milliwatt is an absolute value, and we really can't.
Use the absolute value when describing Paul gain and losses.
To help so say this is my AP.
There withdrawal but.
And my IP's connected to my antenna here.
Let's say my AP is giving off. I gotta set to 100 milliwatts and
that and when it hits the antenna, only 50 milliwatts is
gone.
I can't say that this cable here.
Is A50 milliwatt lost cable? Because what if I increase the
power of the AP?
It becomes 1500.
But what what I can say is this cable is A3 decibel loss.
Cable because no matter what this value is here.
We know that it's gonna be half coming out the other end.
Aren't we got radio band 2.4 versus 5 gigahertz? You might be
thinking to yourself, what difference does it make?
Which radio band did we use? I'm gonna pay the picture for you.
Think about sitting in the park and you're driving at a park and
a car drives by and it's listening to his blasting his
music. I'm.
What? What do you hear? Most likely you hear that deep bass
boom, even when the car is out of sight, you still can hear.
That's because lower frequencies can travel farther.
So now you're probably thinking, why don't we just use low
frequencies? The upside to higher frequencies is is
supports more bandwidth, which means more traffic can pass
through the 2.4 was designed for dot devices that are taken from
room to room are from far away from the router because it's
range is much longer and its ability to penetrate, it's much
easier.
Downside to 2.4 is it gets easily congested, which we'll
talk about here when we talk about channels.
In Wi-Fi, interference caused by wireless devices transmitted at
the same frequency, the same frequency range may be used by
cordless phones, wireless networks, baby monitors, and
anything else in the IT world, Wi-Fi performance may be slowed
down, and the network connection may be broken by these devices
caused by CM, CSM, ACA, or the carrier sense. Multiple access
with collision avoidance, which is a device and wireless
technologies.
That reserves the channel and prevents collisions.
At 2.4 we only have 11 channels, but it's best practice we only
use 316 and 11 so that every other one don't.
Overlap exists unlike 2.4 gigahertz channels, all 25
channels of the five gigahertz channels are non overlapping at
20 megahertz wide. So we could even combine those channels to
make them larger if needed. There are a few that are best
practice to avoid due to DFS dynamic frequency selection. So
if those devices are listening on those channels, they and they
pick up something on.
And it's a radar.
So it's like a military satellite or weather radar. It
has to disconnect.
For three hours and he can't go on back to that Channel. This
caused disruption to many users and as well as others.
Too far.
Art we got SSID will use the SSID to identify specific
wireless network is essentially the name of the network.
Wireless routers usually broadcast. They're configured
SSID by default. The SSID broadcast allow other devices
and wireless clients to automatically discover the name
of the wireless network. A lot of people like to disable the
our hide their SSID.
As we'll talk to you on the next slide about security.
Bad actors can use open or unsecured wireless network to
conduct illegal activities, monitor web traffic, still
information and more. And cybersecurity terms, war driving
is used to describe individual who drive, walk, or slowly walk
around through the dance populated areas with wireless
equipped laptops or smartphones searching for.
One skill secure wireless networks to connect to.
You can use Mac address filtering. This is enable you to
specify.
Identity, who is allowed to connect to your network? This
made the wireless network more secure, but also reduces the
flexibility when it comes to joining new devices. You can
also use a VPN to encrypt your user Internet connection. It
also can conceal your user IP address by using a virtual IP
address that is signs.
A future a Wi-Fi.
Next.
Wi-Fi Six is the.
Is slowly being adopted now.
And it's much better than it's previous generation, which is 5
gigahertz.
It maxes out throughput is 9.6 gigabytes per second, whereas
Wi-Fi 5 offers only 3.5 megabits. And then we also have
a I that's joining and.
Which is part of Juniper unique AI driven supported model.
Marvis is a essential virtual member of your IT team that
provides unsuppressed insight and automation. The tool
constantly learns and its ingress more data using is
growing knowledge based on proactivity, correction issues
and real time.
Uh, and then if I have time, I would actually like to show
y'all Marvis give me one second.
Alright, we currently.
Umm.
Do you do you? Did you?
Art. So this is Marvis here.
And what Marvin's does is he actually he scans our system and
tell us if there's any issues I can even go and ask them a
question.
Like any issues.
The marvelous scanning he was like, ohh. And he found
something. AP Health and then I can tell him to investigate it.
And then he was, like, giving me some more options. I could say
location.
This he will bring up a map and he will show us all our AP's and
he'll highlight which one.
And give me much more details on it.
Because so has this where we go in our service level.
We used to do to do to do and what I really like about it is
it gives us horse historical data because people always come
up to me around.
End of the day and say they had issues with something.
But they never tell me. Ohh. It happened early in the day.
Target actually tell me if I'm having DHCP authorization and
actually breaks down.
What it is, and it actually gives me recommendations and
time frames, how many users?
And that is it for this presentation.
Wow, thank you.
This more information we did not know. I didn't know all that
about wireless really.
That's pretty crazy.
You stop sharing.
Did you do well?
That is something. Thank you so much for that information.
Where you just must stop sharing but.
Stop sharing.
There you go, alright.
So next we have Coco, and she's going to help us out with Mac OS
versus Windows.
Which I'm looking forward to that too.
It's hard to follow those two presentations because mine is
not technical at all. So I do have to apologize.
It's OK. It's gonna help because there's always a problem with
Mac, right?
Well, yeah, let me do my screen share here.
Poor mag.
Wait, I don't know what I just did.
See you guys see anything?
Yeah, we can see your slides.
I.
Ohh, OK OK good.
Yep.
All right. Good evening, everybody. Tonight I am going to
talk briefly about some differences between Mac OS and
Windows.
So a little history. Mac was developed by Apple in 2001 and
Windows was developed by Microsoft in 1985.
So there are several reports out about a percentage of Mac users
versus Windows users, and this graph shows like the green or
Windows users about 87% and mad comes in at 9%.
And we have Linux which is about 1%. Again, there are several
reports out there.
So it's hard to tell exactly how many Mac users.
I that I how many people are using Mac versus Windows I can
say just from my classes. Usually it's just me or one
other person that has a Mac book so I can tell that there's not a
lot of people who go with Apple. A lot of people prefer using
Windows.
There is another report that says there are 100 million
active Mac users, whereas Windows comes.
About 1.4 billion. So that's just a huge difference.
So installation to install Mac you can use system preferences
but Apple store or downloading a disk image.
Windows has a voice installation and I think they have a the
Hello feature and also face login.
Alright, so install apps on the Mac. You will typically see the
picture of Pierre that makes you drag the image into the
application folder which is not ready to party. Frankly I have
gotten lots of errors. I've had to restart several times when
trying to install apps, whereas Windows is pretty.
Easy and straightforward, and windows also supports third
party apps.
So another thing to consider when deciding which operating
system to use is security, of course. As a major part of what
we do.
Cool.
And.
Windows is lacking in this department.
Umm, there are a lot of malware with Windows spyware viruses.
On Windows, however, offers the window defender firewall to
help.
Umm, with these vulnerabilities, Mac has a pretty good record as
far as being.
Safer, but a good antivirus system is recommended.
Our door mag seems to be less vulnerable. I will say it's
probably because there's not a whole lot of Maggie users that
could be another reason why, because if you have more people
using Windows, there are more vulnerabilities, there are more.
Windows machines to target, so it's hard to say.
When US is.
Less safer than might because there's just not a whole lot of
users with Mac.
I hope I'm making sense.
OK. And when Mag has a another security feature called a
gatekeeper.
This is but Apple and it's a prompt, so you if you try to
download an app you will usually get a prompt like this. This is
just.
Saying that, apple cannot verify that a fire is free from
malware. So if you download it, you are doing it at your own
risk. And this is there's usually makes me stop to think,
OK, so already, you know, download this file is just
something I can get from the Apple Store to make sure that at
least there's some type of guarantee that, you know it
doesn't have malware. So that's just another feature.
A Mac offers.
OK, another cool thing that I found. I was accessibility both
operating systems.
Support users with disabilities for Microsoft has been
consistent and has made it top priority, for example, of blind
person is able to set up Windows using their voice, and Windows
also has adaptive accessories for alternate imports. Also what
I found interesting was that the American Sign Language is a big
supporter.
Of Microsoft.
So which operating system is better? I think there's depends
on.
Your ecosystem, your smart watches, your tablet, your
business needs. What are you using it for every single day?
If you are a gamer, windows is better for people who do a lot
of gaming, but if you are create, if you are on the
creative side, it's recommended that you use Mac.
So I am a Mac user. I am not a gamer. I am not creative at all,
but I just like how all of my Apple products are connected to
each other. It helps me stay on track.
I'm able to organize my life a little easier that way, but Mag
can be annoying and that's something that I discovered my
time here at Purdue.
A lot of my classes, a lot of the labs.
Where the instructions were all for Windows users. So I found
myself doing more research.
Trying to figure out how to convert certain.
Comments for examples that are made that are window user my
years I have to convert that into a Mac user so reading a lot
of documentations help Google. What's my friend? YouTube was my
friend but it got frustrating at times. Just getting through some
of those courses because I had to put in extra work to research
that part so I think.
I I I think the school should look into providing maybe app
options like if you if I'm sorry the school should.
Give instructions for both Mac users and Windows users, because
by the time I got into my classes that require me having a
Windows computer, I didn't have money to go out and buy on your
computer. But if I if I knew I need that this before enrolling,
I would have probably go ahead and purchase a Windows computer
over a Mac because it's just easier to me to use Windows for
school.
So another thing that helped me was Fredrick Box.
Umm, I use. I downloaded oops, that's slide just.
But on.
I use regionalization a lot.
U M3 my time. Yeah, I Purdue and VM Ware fusion parallel desktop
and Fredrick Box where the three that I found helpful.
VM Ware Fusion though there is a you have to pay and I couldn't
get a free version. It couldn't. It just wasn't working on my on
my Mac. Parallel Desktop was a hassle as well so I ended up
growing with VirtualBox.
Which if you see, I just took a screenshot of my VM. I do have
Caddy. I have made a splittable too and I also have Windows 10
which I use throughout my time year at Purdue. So I am actually
going to.
Start up my VM and show you guys how I.
Access windows.
On my Mac here seem Fredrick Box, so go ahead and click that.
And just hit start.
And she'll be loading up another thing that I notice is that the
VirtualBox is a bit slower. I don't know if that's just my Mac
or if anybody else experience that, but it is a little slower
to load and log in.
But eventually it will get there.
Uh, there's just loads up.
And it's like a typical windows.
Uh logging screen. I'm putting my.
Password.
We.
Taking I apologize, it's a it's a bit slow.
Yes. So it looks like that.
I'll try to make the screen bigger, yeah.
And there you have it. So I will go in here from the Start menu.
So I have like a typical start.
Manual for Windows I can access the Internet using Microsoft
Edge over here.
And as you can see, his law and every time I run this, my
computer gets ready hot. So I'm like, I don't know. I feel like
one day is going to just.
Explore or something because I don't know why it always gets so
hot, but yeah, this is the Internet and I can browse. I can
do a lot of things that I would normally do or Windows computer.
So to conclude, do I like Mac? Yes, I do, because it makes my
life easier to organize. But for education purposes I would have
gone with a windows because it just.
Easier to get you a lot of my labs that way.
And that is all I have.
All right. Thanks Coco. I'm taking over from Marjorie. She
had a class to get to.
OK.
Umm yeah, thanks, that was interesting.
I I know that a lot of the times when I'm doing tutorials, coding
tutorials.
They use a Mac and I'm like, why?
You're the opposite.
Yeah, yeah.
Alright, Mauricio, Are you ready?
Uh, yeah.
Alright, take it away.
OK.
Ohh.
OK. Can you guys see my screen?
Yep.
OK, perfect.
Umm so from my master class I'm doing it on reverse engineering
or software reverse engineering.
I have a bit of impostor syndrome. I'm doing this class
because, as my disclaimer says, I have actually mastered
nothing, but I really wanted to challenge myself with this and
kind of just kind of get out of my comfort zone and see, like,
hey, you know what, what can I really accomplish, you know? Can
I really learn something that I may find really useful later on
or just in my career?
Kind of going forward.
But really, where my level is is probably right around here.
I really got got my **** kicked, researching this and and but I
did, you know, manage to learn a lot and I'm hoping to kind of
convey some of the things I learned to you guys.
So what we have today is kind of what you know, what is it?
And I think I actually deleted one of my slides, but we'll
keep, we'll keep on.
At its base level, it's understanding the functionality
and capabilities of a piece of a program or a bit of code. And
that's really kind of simplified way to put it. But.
It's just one of those things that like at the base level,
that's that's really all you want to know is, you know, kind
of how this thing works.
Some of the key points that we're going to be going on are
UM, malware. Reverse engineering typically follows malware triage
and you don't necessarily jump into.
Malware reverse engineering right away. You kind of wanna
get some some initial information up front and then
you want to conduct it in a controlled environment. You
know, you can use just the regular VM if you need to. It's
kind of what I have running, but if you kind of set up something
like a sandbox, it's kind of like when hackers use Kali.
You're reverse engineering in a sandbox, just gives you a lot
more tools already in place that you don't necessarily have to
install or just set up. It's just kind of there for you.
And.
You know, it just it just makes things a lot easier for you. As
you know, a malware analyst or worse engineer.
One of the big things that you really are hoping to accomplish
is kind of create ICS for a particular exploit or malware
program. You really want to just kind of help either your local
defenders that are kind of combating this or the
cybersecurity environment as a whole.
And just kind of, you know, maybe kind of influence the
authors of that malware to kind of rethink, you know what
they're doing or kind of come up with something new?
Umm. And then that's that's kind of the one of the biggest things
for us as defenders is not a whole lot of ways that we can
kind of target malware authors, but exploiting their tools is
kind of the big thing that we can do.
One of the one of the biggest reasons why this is so costly
for malware authors is it's something called the Pyramid of
pain. If you kind of go into DoD security, you're gonna get talk
to you about this a lot. So if you expose like hash values,
just something like that, malware authors can very easily
change those IP addresses, you know, especially with things
like, you know, cloud instances and different things like that
you can set up a little droplets and.
UM or, you know AWS instances and just kind of roll through
different IP's. Uh domain names. Again you can kind of change
network and host artifacts or a little bit more annoying. Maybe
you have a C2 server that everything kind of talks back to
and then you have the tools. So this is what you spend a lot of
time kind of.
You know you you spend dev cycles on this. You know you
have to test this, you have to run it against different
environments. You know, you have cycles of programming and
troubleshooting and different things like that. So if you
expose these tools, you create this kind of huge gap where
malware, analysts and authors have to kind of come back to the
bench and spend more and more cycles on it to try and evade
the defenses that you've exposed.
And this really helps with identifying the TTPS of certain
malware authors go and, you know, leverage a specific DLL or
you know protocol like SMB and you kind of expose those in the
ways that you.
Umm, you know, reverse engineer how their tool works and if
those tools kind of are fluctuated together with other
tools that they've used, you just end up.
Really kind of forcing them to change the way that they behave
and that takes time.
And cybersecurity, there are very few legal ways that you can
impose cost. You know, the NSA has attackers, the military has
attackers. But in the civilian world, there isn't really a
whole lot besides just, you know, reverse engineering their
tools or putting their IP user hashes or artifacts out there so
that the community as a whole can kind of expose those a
little bit more.
Whoa.
Some of the useful prerequisites that I really wish I would have
kind of delved a little bit more into before I started hitting on
this topic or more programming experience. I have some Python,
but CC and golang would have really helped a little bit more
assembly, assembly assembly, a lot of the things that you kind
of run into when you're doing reverse malware engineering is
that this you don't have access to the source code so it gets
compiled and you have to run it through a disassembler and that
disassembler outputs it in assembly.
And so I literally had to start, you know, line by line, Googling
every single thing. And so having some more politically on,
you know, assembly and, you know what it was and, you know, just
being more kind of knowledgeable on it would have really helped
that.
Understanding assembly concepts.
Assembly isn't like a one stop shop. There are different
assembly architectures you know for, you know, Intel or one or
different different areas. Umm API. Understanding a lot of
malware starts leveraging APIs so it might not necessarily be
in the source code, but once it starts running it'll kind of
query an API and have that get something for it and it could be
just a method to defeat debugging or understand if it's
in a virtual environment and so definitely more understanding on
how this works and how those can kind of be leveraged is going to
be big.
Macro understanding, kind of following the same as API
understanding and then the CPU architecture that will kind of
go back and help you with when you're looking at the assembly.
What are the different codes that those CPUs kind of use?
Setting the scene. This is really you want to have the
right environment before you begin the analysis because.
It you are kind of detonating this on your system, so make
sure that you have you know, a sandbox. There's some of the
industry standard sandboxes and or you know at the very least a
virtual machine you definitely don't want to start deploying
this on your domain unless you have a specific machine that you
have.
A honeypot on or something like that that sits outside, but you
know even that comes with its cons.
The initial phases are are going to be some of the biggest things
that kind of help you later on in, in your kind of malware
analysis this this triage it it just kind of gives you starting
points. So that when you get into the assembly you kind of
know a little bit of more of what you're getting into and in
many cases you get this by some of the tools that are already
running in your sandbox strings is really helpful. You can see
on that top dynamic.
This program cannot be run into Dawson mode. That lets you know
that you have an executable and then further down in that
program you can actually see that it is leveraging the kernel
32 DLL, the MSVC t.dll, and then some of the processes that it's
going to go after. And I'm sorry if I'm talking a little bit
quickly, but I'm trying to get through on time.
Tools of the trade. This is gonna be one of the biggest
things that I kind of I I was just unaware of, but some of the
biggest disassemblers that the community uses are out of pro.
This is a paid for product. So there is either free but this is
one of the biggest tools that when you see kind of reverse
malware engineering videos are different things like that a lot
of the top pros are using add Pro or ginjiro. Now Gidra is
actually an NSA developed tool that has now become open source.
This is something that has a big community.
And it is getting more and more advanced every day.
Debuggers, debuggers are very big because it allows you to
step through the code without running it all at once, so you
can kind of figure out OK if it makes the network connection and
it goes out to this. You can see what the domain it tried to get
to or if it kind of fails at a certain port, like why did it
fail instead of having to go back and try and redo the whole
thing.
A hex editors and monitors for different things. They the data
that you're gonna get is gonna need to be manipulated in some
way. And so whether you have process monitors or auto runs in
place, there is going to be something that you need to have
so that you can churn that malware and something that would
be effective for your local defenders.
Umm some of the add-ons that you use that like how to pro or like
some of the sandboxes will come with are burp suite. Yara is a
big for signatures and then Zeke is kind of a network monitor
that is really really big and it is also open source too. But if
you do have you know core light you can you could leverage that.
There are a ton more tools that could spend just hours on all
the tools and you know different things that you can kind of use
but those are some of the biggest ones that we have.
This is essentially what you end up looking at. Now we're authors
will develop something in source code. It then goes through a
compiler, gets transferred to the machine and binary they
can't get away from this.
Umm, this is the machine readable language, so they have
to be able to talk to the machine. So this is what you
kind of leverage as an analyst is getting this in a decompiler
from it will decompile the binaries and kind of put it out
into assembly. And so that's what you have on the right to
read and a lot of cases. So if you're not familiar with the
assembly, it becomes really just.
Trying to go through those different binaries or DLS or
executables and step through it if you're if you're not familiar
with that, so I would really highly recommend you know if you
want to jump into this, getting more familiar with assembly.
There are different paths that you can kind of pick. Static
network analysis is a little bit less complex. Dynamic malware
analysis is really where you get into the media things. The
static malware analysis, a lot of you have probably at least
done the basics of it. You look at the binary without executing
it. It's efficiency is largely based on automations and these
can be something like virus, total automations or Yara rules
that you leverage against this environment.
Umm, it does not find artifacts that are created as a result of
executing. So if you're buying an executes and it you know does
a DNS request to, you know whatever domain and it waits for
something and it never gets that inside of a sandbox or inside of
a virtual machine, it just won't go to the next task. And you're
kind of stuck.
But the biggest pro to this it's a little safer. You know, you
you you're not actually running the malware, you just kind of
seeing you know what what is inside of it that you can see
during using different automations or different things
like that.
Uh dynamic malware analysis this is this is the sexy, in my
opinion, the analysis of the malware as it runs. So you're
actually dead donating this malware, allowing it to run as
its intended and then kind of verifying what you can.
You know what information you can glean from it?
This can also be used in tandem with static malware analysis. A
lot of times you may start with that and then kind of move on to
dynamic and then verify what you find. Because sometimes in
static malware analysis you can actually generate false
positives so.
It does come with the risk of infecting the environment
though. If you haven't properly set it up.
Uh static analysis can be very effective against Neuer. That's
been previously identified. A lot of people that you know just
run something in virus total. That is in essence of form of
static analysis because you are looking for their signature.
But.
You, you know, this is kind of low level stuff. If something
that I did say sexy. Yeah. Thank you, George.
Umm but.
This this is something that you're just gonna you're gonna
be able to do quick turnarounds on something like this if you're
if you're a malware engineer, you get different rules and
different things like that. But you can review different
portable executables. You can see if the malware is packed.
You can try to break obfuscation using some of those tools like
SSD. One of the things that are really found interesting about
something like that because I didn't realize that some tools
that did this.
St actually chunks the files into different sections and then
hashes those different sections, so and then checks those against
a library. You do have to pay for it, but it it does have that
opportunity. So just because somebody salts something or just
because somebody alters that, you still may be able to get
some signatures from different types of tools like that.
This is kind of something that I already talked about, so I'm
gonna just keep going in for the sake of time dynamic analysis.
This is essentially what it looks like, and this is kind of
what I got my **** kicked in, but on the left there you have
kind of an itemized how the code runs and how it's written. You
kind of start seeing how it kind of jumps back and forth based on
different obfuscation techniques.
However, on the right this is a little bit cleaner for something
that if you're not all the way used to this, this is actually
kind of breaks the different functions apart in what they
call specifically. So it gives you kind of a graphical overview
of how the malware runs.
Dynamic analysis is gonna be hard because the enemy gets a
vote. So if you start running this thing and they have any
checks. So if it does, you know, a DNS check against.
It's the two server and it notices that it's not
necessarily. Maybe if you're doing this as a profession and
that has, you know, base 64 encoded cookie that was for a
particular customer and you are not that customer based on you
know a public IP domain space, they don't necessarily have to
do anything for you. So creating a copy is really big peer. Some
of this more upscale or APT style malware because a lot of
these things end up having either self-destruct sequences
or they just won't run anymore.
As soon as it doesn't get the the first parameter that it's
kind of requiring.
So you really wanna create a copy, so you can either try it
again or you know if it does have something that self
destructs you don't wanna keep asking for a file because it may
not be there anymore.
Dynamic analysis is big when you leverage it with other tools. So
when you're looking for specific artifacts, like I said, if it
runs a DNS query or something like that, you can use architect
Z, find that query that across your network and see if there
are any other machines that have queried that same domain or you
know, are going to the same C2 servers and then use a tool like
volatility to scrape the memory off of those endpoints so that
you can get whatever the artifacts that are living in
memory that may go away if the machine gets turned off or would
never kind of arise in your sandbox since it never goes past
a certain point.
Sorry, I feel like I talked really fast there, but I was
trying to kind of gauge for time. These are some of the
references that I've used. So I you know, I can either put these
on the separate wiki or you know just kind of post a presentation
and then some more training.
Am I kind of wanna ask you, Angela? I had a a little bit
more of a practical piece, but I know I'm over time.
Oh, it it doesn't matter. I mean, we got you if you if you
wanna.
Umm. Continue. That's fine.
OK, let me see if I can get my VM up.
Yeah. Can you guys see that?
Yes, we can.
Awesome. OK, so UM.
For the second time, I'm gonna go ahead and and kind of figure
out somebody has let me know that they have found some
malicious pizza software program and they've kind of.
Given that over to me, so one of the things that you can kind of
run inside of your virtual machine that has some of these.
Umm.
Tools already loaded is you can kind of see what.
That file is so just running the file command, UM. It may not say
it's an executable, but there you can kind of see that it is
an XL file which is a Linux space to executable. What the
beat bit sequences and then the actual Intel then that will help
you with the architecture. So when you run it into something
like a disassembler, you already kind of know that you should
have this parameters already set.
So.
This is that NSA two I was talking about. UM, it's
something that has a lot of videos in a big open source
community on, so it's kind of the one that I prefer, but the
installation guide actually have in the references. So if you
guys are wanting to see a little bit more about that, you can
just kind of check that out. But we're just going to take this
run the file.
And it'll already kind of sort that out for you. It'll kind of
detect, you know, what it is. You know what the language
that's gonna be using and and just kinda set that up for you.
It'll give you a little bit of kind of a summary of what it
thinks it is. You can kind of use this for, you know,
troubleshooting or validating. You know, maybe some static
analysis that you did.
And kind of know what you're getting into.
Hopefully this loads it crashed last time.
Awesome. So it'll do some initial analysis for you as soon
as it opens the file. I don't necessarily have enough time,
but if you just want to run the defaults, that's normally pretty
good.
Umm. For what? You're gonna be, you know, you know, especially
if you're first starting out. And this is essentially what it
ends up looking like. So when you're viewing your DLL, you're
elf or, you know, whatever the binary that you have, you can
kind of go over here and figure out what what this thing does. I
normally like going into functions to see, you know,
what, what this thing actually is going to be doing. And then I
normally end up going to if I find this like, the main portion
of what that file is.
It'll give you some of the variables that it runs, and in
this case we ran strings against it.
Previously, and this is what we ended up seeing. So this is what
I ended up searching for to get to this point is give me code to
run. This is actually part of a CTF that I have in the
references. So if you kind of want to get more of the
walkthrough you can go there. What I like about it is if you
kind of highlight something it'll put.
Uh put you where that disassembler or where that code
kind of comes out on, and then you can, you know, from their
pivot to where you might find something more valuable for your
analysis. In this case, we're going to go to execute because I
want to know where the file is executing something.
And in this case you have the call and these are registers
values for the architecture of the CPU and these are kind of
where.
The this is this is kind of where I got my **** kicked, but
for the sake of.
Kind of continue on you take those loops. So what I wanna do?
You take those registers and you put them into a kind of a Python
file or something that I had kind of already created, and you
run that.
Against the Pico CTF and this is actually like the Carnegie
Mellon gain CTF and you can see that it will actually give you
the the program as it runs on like their C2 server.
Essentially this is probably this is actually as far as I was
able to get. So I'm sorry I wanted to kind of give you more
about this but.
Initially these register values are were what that CPU
architecture likes to deploy and and kind of give you where they.
Where the malware kind of is is putting its parameters. I'm not
explaining that really well, but essentially you end up.
What's?
Well, if I could type.
Let's see if I can get to actually aware.
But put that.
So these essentially are different registry values that I
was able to find in guardroom. I'm not gonna. I can't really
explain in this short of time how you end up going about
carving all these out and I didn't end up doing it all
successfully. I was only able to get to the prompt for the C2
server, but not necessarily through to the flag.
Umm, but this is kind of how you step through this environment or
you know whatever program that you want to do, you can do it
on, you know, ELF files. You can do it on DLS, you can actually
run this through Microsoft files and just kind of make sure what
they're doing is what it says it's doing and kind of validate
them in that way.
And that's probably all I have. I'm sorry that was less exciting
than I wanted it to be.
Oh wait, it was pretty exciting. That was very interesting. Thank
you. I I like to see it.
You know on screen rather than just text I I'm a hands on
person so.
Oh, thanks for that.
Do does anybody have any questions for any of our
presenters tonight?
No. Alright, in that case, I just like to thank all of our
presenters for tonight. Sean Marcus, Coco and Mauricio.
Thank you guys for your awesome presentations. We learned a lot
as usual and thank you for those who were who attended.
And there was a lot of interactions that was nice to
see.
And next week.
We do have a master class and we have Jane Tijuan, George and
Frederick. So be sure to join if you can. And I just wanna say
thanks again. And you all have a good night.