Post Exploitation in Developer Environments

Slide 1

Slide 1 text

LLNL-PRES-761319 This work was performed under the auspices of the U.S. Department of Energy by Lawrence Livermore National Laboratory under contract DE-AC52-07NA27344. Lawrence Livermore National Security, LLC Post Exploitation in Developer Environments SANS Pen Test HackFest Summit 2018 Ian Lee @IanLee1521 2018-11-13

Slide 2

Slide 2 text

LLNL-PRES-761319 2 § Computer Engineer in Livermore Computing @ LLNL § High Performance Computing — Red Team — ISSO § Gov. Open Source Evangelist — software.llnl.gov — github.com/llnl § Many other hats... whoami

Slide 3

Slide 3 text

LLNL-PRES-761319 3

Slide 4

Slide 4 text

LLNL-PRES-761319 4

Slide 5

Slide 5 text

LLNL-PRES-761319 5 https://3.bp.blogspot.com/-w2URcR6u9uQ/VENiIYIDDsI/AAAAAAAAH_c/GC_4nywJh2M/w800-h800/female-hacker.jpg

Slide 6

Slide 6 text

LLNL-PRES-761319 6 Got a shell!

Slide 7

Slide 7 text

LLNL-PRES-761319 7

Slide 8

Slide 8 text

LLNL-PRES-761319 8

Slide 9

Slide 9 text

LLNL-PRES-761319 9 VICTORY !! https://pixabay.com/en/children-win-success-video-game-593313/

Slide 10

Slide 10 text

LLNL-PRES-761319 10 IN THE CLOUD https://commons.wikimedia.org/wiki/File:%22Don%27t_Discuss_Secrets_on_the_Telephone%22_-_NARA_-_514138.jpg

Slide 11

Slide 11 text

LLNL-PRES-761319 11

Slide 12

Slide 12 text

LLNL-PRES-761319 12

Slide 13

Slide 13 text

LLNL-PRES-761319 13

Slide 14

Slide 14 text

LLNL-PRES-761319 14

Slide 15

Slide 15 text

LLNL-PRES-761319 15

Slide 16

Slide 16 text

LLNL-PRES-761319 16 https://pixabay.com/en/history-blackboard-chalk-chalkboard-998337/

Slide 17

Slide 17 text

LLNL-PRES-761319 17

Slide 18

Slide 18 text

LLNL-PRES-761319 18

Slide 19

Slide 19 text

LLNL-PRES-761319 19 https://www.unixmen.com/prevent-ssh-disconnecting-sessions/

Slide 20

Slide 20 text

LLNL-PRES-761319 20

Slide 21

Slide 21 text

LLNL-PRES-761319 21

Slide 22

Slide 22 text

LLNL-PRES-761319 22

Slide 23

Slide 23 text

LLNL-PRES-761319 23

Slide 24

Slide 24 text

LLNL-PRES-761319 24 https://www.flickr.com/photos/christiaancolen/33904011850

Slide 25

Slide 25 text

LLNL-PRES-761319 25

Slide 26

Slide 26 text

LLNL-PRES-761319 26

Slide 27

Slide 27 text

LLNL-PRES-761319 27

Slide 28

Slide 28 text

LLNL-PRES-761319 28

Slide 29

Slide 29 text

LLNL-PRES-761319 29 Not just for attackers penetration testers http://trulyhappylife.com/wp-content/uploads/2015/02/Persistence-1024x637.jpg

Slide 30

Slide 30 text

LLNL-PRES-761319 30

Slide 31

Slide 31 text

LLNL-PRES-761319 31 CTRL + A, CTRL + D

Slide 32

Slide 32 text

LLNL-PRES-761319 32

Slide 33

Slide 33 text

LLNL-PRES-761319 33

Slide 34

Slide 34 text

LLNL-PRES-761319 34

Slide 35

Slide 35 text

LLNL-PRES-761319 35

Slide 36

Slide 36 text

LLNL-PRES-761319 36 Recap § Loot — App tokens — SSH keypairs — Developer source code (important IP) — Passive recon (other servers / services) — Built in persistence § Mitigations — Training / monitoring — Static Source Code Analysis — Version Control-aware Analysis • https://github.com/18F/git-seekret • https://github.com/awslabs/git-secrets https://cdn.pixabay.com/photo/2017/11/07/23/55/pirate-2928821_960_720.jpg

Slide 37

Slide 37 text

LLNL-PRES-761319 37

Slide 38

Slide 38 text

LLNL-PRES-761319 38

Slide 39

Slide 39 text

LLNL-PRES-761319 39

Slide 40

Slide 40 text

LLNL-PRES-761319 40

Slide 41

Slide 41 text

LLNL-PRES-761319 41 https://software.llnl.gov

Slide 42

Slide 42 text

Thank you! @IanLee1521 [email protected] This document was prepared as an account of work sponsored by an agency of the United States government. Neither the United States government nor Lawrence Livermore National Security, LLC, nor any of their employees makes any warranty, expressed or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States government or Lawrence Livermore National Security, LLC. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States government or Lawrence Livermore National Security, LLC, and shall not be used for advertising or product endorsement purposes.