SEC670: Red Teaming Tools - Developing Windows Implants, Shellcode, Command and Control

Overview

The course begins by introducing students to Windows Internals, starting with a high-level overview, and gradually diving deeper into some of the core mechanisms that make the Operating System tick. We'll discuss key differences between offensive and defensive tools as well as the need for them. Equipped with a solid understanding of Windows programming, students can choose to create offensive or defensive tools for Windows. However, the course will only focus on creating offensive cyber capabilities using the C/C++ programming languages. Key differences between Linux and Windows are important and help to ease the transition from Linux to Windows. The C programming language has core data types, but Windows introduces its own data types, which are presented in this course section. We'll also introduce students to calling conventions and how Windows brought its own into the programming arena. At the end of the section, we will present the Windows Application Programming Interface (API) more formally by having students use key Windows APIs in a lab to bring it all together.

Full Lab Details

• Detecting Process Injection with PE-Sieve
• Exploring the Windows Boot Sequence with Process Monitor
• Building a Hello World DLL
• Identifying Calling Conventions
• Understanding and Using SALv2
• Exploring the Windows API to Create Objects

Full Topic Details

• Developing Offensive Tools
• Developing Defensive Tools
• Setting up Your Development Environment
• Similarities and Difference with *Nix Dev
• Windows Data Types
• Call Me Maybe
• SAL Annotations
• Windows API

Overview

This course section introduces students to the art of on-target reconnaissance. One of the first actions red team operators might take after gaining initial access is to conduct in-depth enumeration, or recon, against the target. This step is often overlooked, since it can take a while to perform, and it is not as glamorous as using a 0-day to exploit something. However, it is vital to know what type of environment you are in and what you can do next. Students will learn how to programmatically survey the lay of the land using a detailed approach, then prepare a final product to obtain information about the operating system version build, patches, and processes, installed applications, the filesystem, users and groups, the network, services, tasks, the registry, and more.

Full Lab Details

• Obtaining Operating System Information
• Exploring Various Methods to Enumerate Running Processes
• Implementing Directory Enumeration Methods

Full Topic Details

• Gathering Operating System Information
• Service Packs/Hotfixes/Patches
• Process Enumeration
• Installed Software
• Directory Walks
• User Information
• Services and Tasks
• Network Information
• Registry Information

Overview

This course section focuses on actions that can be taken after initial access. Red team operators typically leverage process injection to execute desired actions. Students will learn how to programmatically implement those capabilities, starting with a deep dive into the format of the Portable Executable (PE) header. Students will also learn how to parse important sections of the PE header, which is a valuable skill that will allow them to create their own version of Windows APIs such as GetProcAddress. After mastering the PE format, we will look at the internals of Threads, their structure, and how they are created. The section will also explore how Asynchronous Procedure Calls can be queued to a Thread to aid in process injection. We will cover several process injection methods, including the classic DLL injection where we force a Thread to load our malicious DLL in a target process. Another post-access action is to escalate privileges to enable an operator to be more effective on target, so students will programmatically create privilege escalation modules for their implant and test them out on their target system.

Full Lab Details

• Parsing the PE Header
• Classic DLL Injection
• Process Injection via Asynchronous Procedure Calls
• Hijacking Thread Execution
• Stealing Tokens
• Creating Services

Full Topic Details

• Understanding the PE Format
• Creating Custom Equivalents to Win32 APIs
• Exploring Thread Internals
• Exploring Process Injection Methods
• Programmatically Interacting with Remote Processes
• Creating Custom Tools for Privilege Escalation

Overview

This course section focuses exclusively on various methods to achieve persistence by surviving reboots. Gaining initial access is a great place to start, but steps must be taken to maintain that access in the event something unforeseen happens like a loss of power, unscheduled reboots, the initial access process dying, etc. Typically, operators will use persistence methods baked into existing tools or frameworks, but those tools had to have been developed at some point. During bootcamp challenges in this course section, students will programmatically implement persistence tools and then test the compiled products against their Windows 10 Test VM to see if access is maintained after a reboot.

Full Lab Details

• Using Services for Persistence
• Using Port Monitors for Persistence
• Using Image File Execution Options for Persistence

Full Topic Details

• In-memory Execution
• Dropping to Disk
• Binary Patching
• Registry Keys
• Services Revisited for Persistence
• Port Monitors
• Image File Execution Options

Overview

This course section covers more advanced techniques that tool developers must master to be successful. One great feature for implants is the ability to execute position-independent shellcode. The shellcode can come from existing tools like msfvenom, donut, or shelter, or it can be hand-crafted using the C programming language. Students will explore in detail how to execute shellcode locally in their own process as well as remotely across process address space boundaries. Since shellcode can be caught quickly unless it is obfuscated or encrypted, students will learn how to decrypt shellcode right before execution. Another implant capability is evading AV products. Evasion can be done via several methods, but this course section will focus on unhooking functions, restoring system calls, and implementing our own hooks. Executing shellcode and lowering AV detection rates are great, but they can be useless if there is no method of collecting information from the target machine. Students will explore how implants can send information back to an operator for offline analysis and accept tasking for what to do next.

Full Lab Details

• Executing Shellcode in Local and Remote Processes
• Hiding Processes from Users
• Dealing with Function Hooks
• Patching Functions to Execute Malicious Payloads

Full Topic Details

• Shellcode Generation and Execution
• Hiding Processes
• Doppelgänging
• Unhooking Hooks
• Code Caves
• AV Product Bypasses
• Calling Home
• Writing Shellcode in C

Overview

This Capture the Flag event involves solving an array of hands-on challenges that mimic real-world events. Students play the role of senior developers as part of a nation-state team creating cyber capabilities to leverage against their targets. The challenges will require students to apply everything that they learned during the week. However, that foundation of skills will be just the starting point. Since not every target will be the same, students will have to take their initial access to a target and then expand on that access using only tools that have been custom developed for that specific target.

Full Topic Details

• Target Survey and Recon
• AV Bypass
• Privilege Escalation
• Persistence
• Hooking
• Code Injection