DEF CON Singapore - Brutus A Modern Credential Testing

Demo Labs presentation showcasing Brutus, a modern multi-protocol credential testing tool written in pure Go. The demo highlights automated identification and validation of default credentials, compromised passwords, and SSH keys across enterprise environments at scale.

Transcript

1. BRUTUS Modern Multi-Protocol Credential Testing DEF CON Singapore — Demo Labs praetorian-inc/brutus P R A E T O R I A N 1
2. $ whoami Adam Crosser Staff Security Engineer Praetorian — Labs Team @UNC1739 Twitter / X UNC1739 GitHub unc1739.com Research Blog praetorian.com/author/adam-crosser Praetorian Blog F O C U S • Vulnerability research & exploit development • Offensive tooling (Brutus, TURNt, OAuthSeeker, PortBender) • Red team capabilities & malware development T A L K S & R E S E A R C H Black Hat USA 2025 / DEF CON 33 Ghost Calls • OAuthSeeker HITB Bangkok 2024 Request Smuggling → Auth Bypass + RCE CVEs: Qlik Sense (RCE chain), 3CX, MeshCentral, SonicWall, FreeBSD 2
3. BRUTUS Open-source, multi-protocol credential testing tool written in pure Go. Single binary, zero dependencies, built for modern offensive security workflows. 24 Protocols 1 Binary 0 Dependencies Full network audit in one pipeline: $ naabu ... | nerva --json \ | brutus --json S C A N T O G E T B R U T U S github.com/ praetorian-inc/brutus 3
4. THE PROBLEM Day three. 700,000 live hosts. Thousands of identified services. Now test credentials at scale. Dependency Hell libssh-dev, libmysqlclient- dev... It breaks every time. No Pipeline Integration No JSON. No naabu/nerva. Glue scripts everywhere. Unknown Admin Panels Hundreds of login pages. No idea what the vendor is. 4
5. BRUTUS CORE FEATURES Zero Dependencies 24 Protocols Pipeline Native Embedded Bad Keys Go Library AI-Powered 5
6. PIPELINE INTEGRATION naabu → nerva → brutus 6
7. EMBEDDED SSH BAD KEYS Known-bad SSH keys compiled into the binary. No external files needed. Product CVE Default User Description Vagrant — vagrant HashiCorp insecure key F5 BIG-IP CVE-2012-1493 root Static SSH host key ExaGrid CVE-2016-1561 root Backup appliance backdoor Barracuda CVE-2014-8428 cluster Load balancer VM Ceragon FibeAir CVE-2015-0936 mateidu Wireless backhaul Quantum DXi — root Dedup appliances 7
8. Full Scanning Pipeline Example Output 8
9. ET TU, DEFAULT CREDS? INTRODUCING BRUTUS Modern multi-protocol credential testing for the modern attack surface • 20+ protocols SSH, RDP, MySQL, Redis, SNMP, HTTP, and more • Single binary, zero dependencies, pure Go, cross-compiles everywhere • Pipeline-native JSON I/O with naabu and nerva • Embedded bad SSH keys and RDP sticky keys backdoor detection • LLM-powered credential testing for unknown admin panels R E A D T H E F U L L P O S T praetorian.com/blog/ et-tu-default-creds-introducing-brutus 9
10. STICKY KEYS ATTACK FLOW How T1546.008 grants unauthenticated SYSTEM access — no credentials required. 1 🖥 RDP Connect No NLA required TCP → X.224 negotiation → 2 ⌨ Shift × 5 Trigger sethc.exe from lock screen → 3 🔄 sethc → cmd.exe Replaced binary executes instead → 4 💀 SYSTEM Shell NT AUTHORITY\SYSTEM Full privileges MITRE ATT&CK T1546.008 • Accessibility Features • Pre-authentication RCE 10
11. COMMON ROOT CAUSES Why sticky keys backdoors exist in production environments. 1 Adversarial Persistence • Nation-state actors (APT29, APT41, Pioneer Kitten) • Ransomware operators for re- entry after credential reset • Low-tech, high-reliability survives full domain password rotations 2 Administrative Workarounds • "Break-glass" password recovery via WinRE • Swap sethc.exe for cmd.exe to reset local admin password • Backdoor never gets cleaned up afterward 3 Vulnerable Pre-Auth Software • VPN clients, password reset tools on the Secure Desktop • Run with SYSTEM privileges before user logon • CVE-2022-0016: GlobalProtect browser escape → SYSTEM 11
12. EXTERNAL EXPOSURE How common are sticky keys backdoors on internet-facing RDP? Z A C H G R A C E — 2 0 1 5 Hunting Sticky Keys Backdoors 1 in 1,000 RDP hosts had the backdoor 10,000 RDP hosts scanned via Shodan 11 sticky keys + utilman backdoors found C O M P A S S S E C U R I T Y — 2 0 1 8 Nicolas Heiniger — Swiss RDP Hosts 1 in 100 RDP hosts had the backdoor 9,450 Swiss RDP hosts scanned via Shodan 113 backdoored systems found ~5.1M exposed (2015) → ~2.4M today (Shodan, 2026) • At 1-in-1000: ~2,400 backdoored hosts 12
13. RDP & STICKY KEYS Pre-auth backdoor detection. No credentials needed. Connect (non-NLA) → Capture baseline → 5× Shift → Detect terminal --sticky-keys Detect backdoor --sticky-keys-exec Run commands --sticky-keys-web Interactive terminal --nla-check NLA fingerprint --sticky-keys-scan Mass scan IronRDP (Rust) → WebAssembly → wazero. Zero-CGO single binary. 13
14. EXPLOITATION WORKFLOW T H E P R O B L E M ✕ Requires X11 or Xvfb to run headless ✕ Depends on xdotool, xfreerdp, ImageMagick ✕ Bash only, no cross-platform support ✕ Can’t pipeline with existing recon tools 14 ✕ No decent libraries in Go for RDP
15. WASM ARCHITECTURE IronRDP (Rust) → WebAssembly → wazero → Go. Zero-CGO single binary. GO Network I/O • TLS • Connection lifecycle • Timeouts ↕ Feed data / Execute instructions ↕ WASM wazero runtime • Sandboxed execution • Pure Go, zero deps ↕ RUST IronRDP • X.224 • CredSSP / NLA • Bitmap decode • Input injection 15
16. NLA VS NO-NLA W I T H O U T N L A TCP Connect ↓ X.224 Negotiation ↓ Full Graphical Session ↓ Lock Screen Exposed ↓ Shift × 5 → SYSTEM Anyone can reach the lock screen. No credentials needed to trigger backdoor. W I T H N L A TCP Connect ↓ X.224 Negotiation ↓ CredSSP Authentication ↓ Credential Check ↓ Session Only If Valid Lock screen never shown to unauthenticated clients. Nessus Plugin 58453 • "Terminal Services Doesn't Use Network Level Authentication (NLA) Only" 16
17. DETECTION PIPELINE Two-layer detection: local heuristic analysis + optional AI confirmation. Connect (non-NLA) → Capture baseline → Send Shift × 5 → Capture response ↓ Compare bitmaps M e t h o d 1 — H E U R I S T I C Pixel delta analysis: • Region size threshold • Fill ratio check • Rectangular region = cmd.exe → Fast, local, no API needed M e t h o d 2 — A I V i s i o n A n a l y s i s --experimental-ai flag: • Send bitmap to Claude Vision • Identify terminal windows • Catch custom shells/configs → Higher confidence verdict 17
18. SCANNING AT SCALE Full network audit in one pipeline. Discover, fingerprint, and test for sticky keys backdoors. naabu Port Discovery Scan ranges for port 3389 (RDP) → nerva Fingerprinting Identify RDP service brutus Credential + Sticky Keys Test creds & detect backdoors → JSON Structured Output Per-host results with confidence % 18 →
19. ▶ VIDEO DEMO — RDP Sticky Keys Detection & Exploitation 19
20. RDP STICKY KEYS BACKDOOR DETECTION Automated pre-auth RCE discovery with Brutus and WebAssembly • Classic T1546.008 persistence — more common than you think • ~2.4M exposed on Shodan today • IronRDP compiled to WASM, embedded in Go with zero CGO, single binary • Two-layer detection: pixel heuristic + Claude Vision AI confirmation • Built-in browser RDP client and automated exploitation via --sticky-keys- exec R E A D T H E F U L L P O S T praetorian.com/blog/ rdp-sticky-keys-backdoor-brutus 20
21. PRIVATE KEY SPRAYING T H E S C E N A R I O Compromised Nessus scanners across a segmented network. Multiple SSH keys. Multiple network zones. Which key unlocks which hosts? W I T H B R U T U S # Per scanner — same workflow $ naabu -host 10.1.0.0/24 \ -p 22 -silent | \ nerva --json | \ brutus -u nessus \ -k /path/to/key Different key, different range, same pipeline. JSON output maps lateral movement. 21
22. 22 SPRAYING COMPROMISED KEYS
23. LLM-POWERED CREDENTIAL GUESSING Unknown admin panel? Let the LLM figure it out. HTTP Basic Auth • Analyze headers + realm • Identify device (e.g. iDRAC) • Suggest defaults (root:calvin) • Test automatically, fallback to wordlists Claude Vision + Browser • Screenshot JS-rendered login pages • Vision identifies device type • Perplexity researches defaults • Fill form, submit, detect success 23
24. ▶ VIDEO DEMO — LLM-Controlled Browser Login (iDRAC, Grafana, Tomcat, and more) 24
25. CONTRIBUTING TO BRUTUS Plugin-Based Architecture • Each protocol is a self-contained plugin • Simple Go Plugin System Get Involved • New protocol plugins welcome • Additional bad key collections • Real-world usage feedback 25
26. Q & A @UNC1739 github.com/praetorian-inc/brutus 26