[THOTCON 9] DanderSpritz: How the Equation Group's 2013 tools pwn in 2018

These slides were presenting at THOTCON 9 on May 4th, 2018.

Everyone has focused on the Equation Group's "weapons grade" exploits but no one has focused on their extremely effective post exploitation capabilities. In this talk I will cover the tools, methods, and capabilities built into the DanderSpritz post exploitation framework. We will review how the Equation Group gained and maintained persistence, bypassed auditing and AV, scan, sampled, subdued, and successfully dominated an entire organization ninja-style. We'll dig into the technical details of how the framework gains persistence, performs key logging, captures traffic and screenshots, steals credentials, gathers target information, owns AV and WSUS servers, exfiltrates secrets, and causes general mayhem.

Transcript

1. DANDERSPRITZ
2. • RUN AN ARCHITECTURE TEAM AT $SECURITY_COMPANY • ARCHITECT • SECURITY ENGINEER • CONSULTANT • SECURITY ANALYST
4. • RESEARCHERS FOCUSED ON EXPLOITS • WANTED TO KNOW MORE ABOUT “APT” POST EXPLOITATION • ENCOURAGE OTHERS TO RESEARCH & REVERSE • THIS WORKED (A LITTLE)! • WANTED A TECHNICAL SIDE PROJECT
7. • QUICK HISTORY OF THE FRAMEWORK(S) • GETTING TO POST-EXPLOITATION • INTRO TO DANDERSPRITZ • INFO COLLECTED ON CONNECTION • TRADECRAFT • PERSISTENCE • RECON • LATERAL MOVEMENT • DATA EXFIL
8. Expanding Pully DanderSpritz DanderSpritz script rewrite 2001 2005 2011
13. • TARGET = ATTACKED COMPUTER(S) • LP = LISTENING POST (C&C SERVER) • COMMAND = SOMETHING RUNNING ON TARGET • PSP = PERSONAL SECURITY PRODUCT (AV) • SAFETY HANDLER = DON’T MESS IT UP
14. GETTING TO POST-EXPLOITATION Fuzzbunch Exploit DouplePulsar PeddleCheap DanderSpritz
15. • FREAKING COOL • A FULLY FUNCTIONAL POST-EXPLOITATION FRAMEWORK • WRITTEN IN JAVA L • EXTREMELY MODULAR • “PLUGINS” (FEATURES) WRITTEN IN PYTHON / CUSTOM SCRIPTING J • DESIGNED FOR STEALTH • DESIGNED TO PREVENT DUMB OPERATORS FROM MESSING IT UP
17. • REPOSITORY FOR DANDERSPRITZ SESSION DATA ACROSS ALL TARGETS • UNIQUE PRIVATE / PUBLIC KEY PAIR PER OP • DANDERSPRITZ CORRELATES DATA ACROSS TARGETS IN SAME OP • SAFETY HANDLERS CAN BE REGISTERED PER OP (MORE ON THIS LATER) • OPS CAN BE REPLAYED - TRAINING? • PROPERLY FORMATTED OPS NOTES GENERATE “TECH SUMMARIES”
19. • OPERATING SYSTEM INFO • NETWORK INFO • MOUNTED DRIVES • CURRENT PROCS • DRIVERS • INSTALLED SOFTWARE • SERVICES • PSPS • PERSISTENCE • AUDIT CONFIG • SCHEDULED TASKS • RECENTLY MODIFIED FILES • RECENT USB DEVICES • DUMPS PASSWORDS
24. • GREATERDOCTOR • CAN SCAN MEMORY & PROCESSES • CAN PARSE FILES • CAN GRAB MEMORY FOR FORENSICS LATER • CAN BE USED AGAINST DANDERSPRITZ ;) • GANGSTERTHIEF • READS RAW MFT FOR ANALYSIS
28. BYPASS AV & LOGGING LIKE A PRO
34. • PREVENT OPERATOR OR AUTOMATED SCRIPTS FROM PERFORMING CERTAIN ACTIONS • MEANT TO REDUCE POSSIBILITY OF DETECTION • LOTS OF DIFFERENT TYPES OF SAFETY HANDLERS
35. • AUDIT • REGISTRYADD & QUERY • PROCESS INJECTION • MEMORY • NETWORK TRAFFIC • PREVENT DROPPING OF EXES • PREVENT DLL LOADS • …MORE
40. OH YOU GOT LOGGING? THAT’S CUTE
45. “ ” DON’T BE AN IDIOT NATION STATE HACKING 101
46. • DON’T SLOW DOWN THE MACHINE • DON’T SEND OUT A TON OF NETWORK TRAFFIC • HAVE THINGS CHANGED SINCE YOU LAST VISITED • DID THEY GET SUSPICIOUS FOR SOME REASON? • TRY NOT TO DROP EXES • MAKE SURE THEY LOOK LEGIT • MATCH FILE TIMES WITH LEGIT EXES • ENCRYPT EVERYTHING • STAY ON A TARGET FOR AS LITTLE TIME AS POSSIBLE
54. • CAN LISTEN • AT SPECIFIC TIMES • CAN REQUIRE PORT KNOCKING (YES REALLY...) • CAN CALL BACK • AT SPECIFIC TIMES • WORKS WITH A PROXY
56. • EXTREMELY MODULAR • CAN LOAD SEVERAL DIFFERENT ”PLUGINS” • USED BY A LOT OF DIFFERENT TOOLS (DATA EXFIL, CAPTURE, ETC) • EVERYTHING ENCRYPTED WITH UNIQUE KEY PER TARGET HINT: PEOPLE SHOULD BE LOOKING HERE ;)
59. • MODIFIES VBR TO LOAD KERNEL DRIVER • USES TRUETYPE FONT FILES AS “CONTAINERS” FOR KERNEL DRIVER • DOESN’T WORK WITH BITLOCKER OR EFI
63. • BROWSER DATA (IE, FF, CHROME) • RECENTLY PLAYED MEDIA • USB DEVICES • RECENTLY RUN COMMANDS • DNS CACHE • RECENT RDP SESSIONS • RECENTLY ACCESSED FILES • PUTTY / WINSCP CREDS • PERIODIC SCREENSHOTS • SHARES • PCAPS • KEYLOGGER DATA
65. • LIST DBS • VIEW SCHEMAS • TOP 10 ROWS FROM TABLES • QUERY PLANS
69. THANKS FOR THE HELP!
75. 1. USE CREDENTIALS GATHERED FROM RECON PHASE 2. MOUNT ADMIN SHARE & PUSH CONFIGURED PEDDLECHEAP EXE 3. SCHEDULE TASK TO RUN EXE 4. PROFIT
76. 1. USE “PACKETREDIRECT” COMMAND 2. CONFIGURE FUZZBUNCH WITH IMPLANTED TARGET AS A REDIRECTOR 3. SMB / NAMEPIPED TOUCH (TELLS YOU WHICH EXPLOIT TO USE) 4. EXPLOIT 5. DOUBLEPULSAR LOADS PEDDLECHEAP 6. PROFIT
78. FRAMEWORK INCLUDES DRIVERS TO INTERACT WITH SEVERAL DATABASES LOADED REMOTELY TO TARGET MACHINE
79. • IDENTIFY INTERESTING DOCUMENTS / SHAREPOINT SITES • USE “SHAREPOINT” COMMAND TO RECURSIVELY PULL FILES
88. • Process Launches • Library Loads • Network Connections
89. Windows Defender Exploit Guard
90. • Block Office apps from creating executable content • Block Office apps from launching child process • Block Office apps from injecting into process • Block Win32 imports from macro code in Office • Block malicious JavaScript, VBScript, and PowerShell codes that have been obfuscated • Block JavaScript and VBScript from executing payload downloaded from internet
92. • INTRO TO DANDERSPRITZ & A LOOKED AT WHY IT’S SO DAMN COOL • BRIEF LOOK AT EQUATION GROUP TRADECRAFT • BRIEF LOOK AT PERSISTENCE METHODS • LOOK AT RECON CAPABILITIES • LATERAL MOVEMENT & DATA EXFIL • DEFENSE STRATEGIES
93. DANDERSPRITZ.COM @FRANCISCKRS DANDERSPRITZ_DOCS