# Breaching Defenses Course Description of the this website goal ## About this website This is my personal notes about pentesting and red teaming.\ I will try to organise it like a course and hopefully help other people train their Red Teaming skills with it.\ Each part is reproducible in the [breaching-defenses Red Team home lab](https://github.com/RobinFassina-Moschini/Breaching-Defenses.com).\ All the notes will include an OPSEC section with the IOC corresponding and how to find them in the ELK (Elasticsearch, Logstash, and Kibana) included in the lab, but can be easily transposed to other Security Information and Event Management (*SIEM*) solution (Splunk for example). ### Whoami /all I'm working as a penetration tester/Red Teamer, since 5+ years, mostly in the travel and media industry. I'm focusing in Web application and hardware testing, malware and exploit development, and red/purple teaming. # What is Red Teaming ## What is Red Teaming Red Team emulates Tactics, Techniques, and Procedures (TTPs) of real adversaries to improve the people, processes, and technology in the target environment. The goal is to make the Blue Team better by training them and testing the detections, response policies, procedures, and technologies in place. ### Red Teaming vs Penetration Testing Red teaming is sometimes mistaken with penetration testing, although the two are not the same. A penetration testing is *scope* based. The purpose of it is to cover the full attack surface of an application/network/process and find all the vulnerabilities in it. The goal is not to be silent and not alert the SOC but to use all the available way to do the security assessment. A red team engagement on the other hand is *objective* based and should include not only technical controls but also non-technical controls as well. The purpose of it is to reach the goal without alerting the SOC and getting caught. Red teams put a heavy emphasis on stealth. It is often more based around social engineering people and active directory abuse. ### Why Red Teaming? Red Team Exercises and Adversary Emulations are used for a variety of reasons: #### Obtain a comprehensive picture of the organization's data Most offensive security evaluations are restricted in scope and focus on technology. “Only test this URL or these IP addresses.” While such vulnerability assessments and/or penetration tests are highly beneficial to a business, they do not give a comprehensive evaluation or perspective of the security posture of the whole firm. End-to-end adversary simulation, also known as full Cyber Kill Chain emulation, will give a comprehensive perspective of the organization's defense in depth strategy and allow it to be tested. #### Test people, process and technology Testing something is the only way to determine if it has improved. It's difficult to determine the exact times of an attacker activity to correlate with the reaction in a genuine attack or breach. The Red Team will collect timings for each activity in a red team exercise to properly measure the responsiveness of the people, process, and technology: When and what was detected and prevented? #### Test Assumptions Stakeholders in companies (especially senior management) frequently assume that something is operating in a certain way. The Red Team can test that assumption to see if it's true or not. #### Train and Improve Blue Teams One of the most important parts of Red Team Exercises and Adversary Emulations is training the Blue Team. The Blue Team might be made up of anyone in an organization (or defenders). From the Human Resources department assessing new hires before they start working for the company to the analyst who detects and reports phishing attempts, everyone is involved.\ The majority of references to the Blue Team Team imply security analysts who spend their time monitoring and defending a network: Security Operations Center (SOC). While they are the primary Blue Team, everyone in the organization should be considered a member of the Blue Team and an organization defender. ### Red Team vs Threat Emulation An Adversary Emulation is a type of Red Team Exercise where the Red Team emulates how an adversary operates, following the same tactics, techniques, and procedures (TTPs), with a specific objective (similar to those of realistic threats or adversaries) ### Red Team vs Purple Team Purple Teaming is a function or process, not an individual team, where the Red and Blue Teams work together. While many Red Team Exercises and Adversary Emulations are performed “blind” from the Blue Team perspective, Purple Team engagements are fully known and performed together with the Blue Team.\ They often follow a scenario, in order to test the detection of new TTPs or tools. # Lab This section contain how to setup the breaching-defenses Red Team home lab # Infos General informations about the Red Team home lab ## Goal of this Red Team home lab The goal of this Red Team home lab is to create an environment allowing to execute any red team technique.\ It is not intended to run on your daily driver but on a home lab system!\ I recommend to create a locale network between the two and RDP to the windows system.\ We are going to use the windows host as the attacker. # Hardware Hints about the hardware running the Red Team home lab ## Hardware requirement ![Intel nuc kit 8i5beh](/files/-Mi5I1Zjc6fkL1jschAd) The full Red Team home lab is running on an Intel nuc kit 8i5beh with 32G of RAM.\ It needed to be resource economic enough for running on an intel NUC to be small and transportable.\ I recommend to run the Host on the NVME and the VM on the SATA SSD.\ Don't worry if your system can't run it, each activity will be provided with a lightweight lab where only the needed resource will be present, so it will run on a single disk and with 16G of Ram. # Preparing the OS Installing the requirements to run the Red Team home lab ## Preparing the OS to run the Red Team home lab ### Windows We are going to use **Windows 10 pro** or a **Windows server** and Hyper-V to create the Red Team home lab. Here we are detailing step-by-step, if you want just the commands go to the [**summary**](/lab/preparing-the-os#summary) #### 1 Installing RSAT tools If we are using a **Windows 10 pro** we are going to install first the RSAT tools.\ We can list them by opening a **Powershell as an admin** and type: ``` Get-WindowsCapability -Name RSAT* -Online | Select-Object -Property DisplayName, State ``` ![List of RSAT tools](/files/-MhDDz1O25HXRQmn1Qxd) To install all the available RSAT tools at once, we run: ``` Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability –Online ``` #### 2 Enable Hyper-V We can enable Hyper-V by opening a **Powershell as an admin** and type: ``` Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All ``` And we **reboot** ![Enabling Microsoft Hyper V feature](/files/-MhDLXhohfkj_Nfw0A65) #### 3 Enable WSL The Host server will serve as the attacker machine. It will host the C2 and also we are going to leverage the Windows Subsystem for Linux to use Kali. You must first enable the WSL feature. Open **PowerShell as Administrator** and run: ``` dism.exe /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart ``` ![Enabling WSL feature](/files/-MhDN4SItSXUuJKVMVYf) #### 4 Enable Virtual Machine feature Before installing WSL 2, you must enable the Virtual Machine Platform optional feature. Open **PowerShell as Administrator** and run: ``` dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart ``` ![Enabling Virtual Machine Platform](/files/-MhDNasbN9UhWGtP8R2P) **Restart** your machine to complete the WSL install and update to WSL 2. #### 5 Download the Linux kernel update package Download the latest package by opening **PowerShell as Administrator** and run: ``` curl.exe https://wslstorestorage.blob.core.windows.net/wslblob/wsl_update_x64.msi --output C:\Windows\Temp\wsl_update_x64.msi ``` ![Downloading the Linux kernel update package](/files/-MhDQ19V0V0_HDXkA3t3) And we run it with: ``` C:\Windows\Temp\wsl_update_x64.msi ``` ![Installation of WSL](/files/-MhDQE4JJxfsWz9TKA1c) #### 6 Set WSL 2 as the default Open **PowerShell as Administrator** and run: ``` wsl --set-default-version 2 ``` #### **7 Download Kali** Open **PowerShell as Administrator** and run: ``` curl.exe -L https://aka.ms/wsl-kali-linux-new --output C:\Windows\Temp\wsl-kali-linux-new.appx ``` #### 8 Install Kali Open **PowerShell as Administrator** and run: ``` Add-AppxPackage C:\Windows\Temp\wsl-kali-linux-new.appx ``` and set it up: ``` kali ``` ![Successfully running kali](/files/-MhDqWKi8LZQG9a-eU9d) #### **9 Install git** Download the last release of git for windows and install it {% embed url="" %} ### AutomatedLab For building and running the lab we are going to use [AutomatedLab](https://github.com/AutomatedLab/AutomatedLab) > AutomatedLab (AL) enables you to setup test and lab environments on Hyper-v or Azure with multiple products or just a single VM in a very short time. There are only two requirements you need to make sure: You need the DVD ISO images and a Hyper-V host or an Azure subscription. #### 1 Download and install the last release We download **AutomatedLab.msi** from the last release on Github: {% embed url="" %} And install it ![Installation of AutomatedLab](/files/-MhDV_4iVutaosb-wM3h) ![Options for installing AutomatedLab](/files/-MhDVmcy1Jd-7NSI-a21) ![AutomatedLab is installed](/files/-MhDVs5ckyziMIAlnF7a) #### 2 SetUp Automated lab Open **PowerShell as Administrator** and run: ``` powershell -ep bypass Import-Module AutomatedLab Install-Module -Name Pester -Force -SkipPublisherCheck ``` ### Docker For managing ELK as an air gapped solution we need to host our own Elastic Package Registry. For that we need to install Docker We download the[ last stable release](https://desktop.docker.com/win/main/amd64/Docker%20Desktop%20Installer.exe) and install it Create a file as **C:\startDocker.ps1** ```powershell start-service -Name com.docker.service sleep 10 start 'C:\Program Files\Docker\Docker\Docker Desktop.exe' ``` Run in an elevated powershell cmd ```powershell powershell -ep bypass $trigger = New-ScheduledTaskTrigger -AtStartup $action = New-ScheduledTaskAction -Execute "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Argument "-ep bypass -File C:\startDocker.ps1" $settings = New-ScheduledTaskSettingsSet -Compatibility Win8 -AllowStartIfOnBatteries Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "Start Docker on Start up" -Settings $settings -User $env:UserName -RunLevel Highest # Add the user to the docker-users user-group # This is needed so that this user has access to docker services try { Add-LocalGroupMember -Group docker-users -Member $env:UserName -ErrorAction Stop } catch [Microsoft.PowerShell.Commands.MemberExistsException] { } # Run Docker right now C:\startDocker.ps1 ``` ### Summary Open **PowerShell as Administrator** and run: ``` Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability –Online Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All ``` **Reboot** ``` dism.exe /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart ``` **Reboot** ``` curl.exe https://wslstorestorage.blob.core.windows.net/wslblob/wsl_update_x64.msi --output C:\Windows\Temp\wsl_update_x64.msi C:\Windows\Temp\wsl_update_x64.msi wsl --set-default-version 2 curl.exe -L https://aka.ms/wsl-kali-linux-new --output C:\Windows\Temp\wsl-kali-linux-new.appx Add-AppxPackage C:\Windows\Temp\wsl-kali-linux-new.appx kali ``` We download and install the last git release {% embed url="" %} We download and install **AutomatedLab.msi** from the last release on Github: {% embed url="" %} ``` powershell -ep bypass Import-Module AutomatedLab Install-Module -Name Pester -Force -SkipPublisherCheck ``` We download and install the[ last stable release](https://desktop.docker.com/win/main/amd64/Docker%20Desktop%20Installer.exe) of Docker Create a file as **C:\startDocker.ps1** ```powershell start-service -Name com.docker.service sleep 10 start 'C:\Program Files\Docker\Docker\Docker Desktop.exe' ``` Run in an elevated powershell ```powershell powershell -ep bypass $trigger = New-ScheduledTaskTrigger -AtStartup $action = New-ScheduledTaskAction -Execute "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Argument "-ep bypass -File C:\startDocker.ps1" $settings = New-ScheduledTaskSettingsSet -Compatibility Win8 -AllowStartIfOnBatteries Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "Start Docker on Start up" -Settings $settings -User $env:UserName -RunLevel Highest # Add the user to the docker-users user-group # This is needed so that this user has access to docker services try { Add-LocalGroupMember -Group docker-users -Member $env:UserName -ErrorAction Stop } catch [Microsoft.PowerShell.Commands.MemberExistsException] { } # Run Docker right now C:\startDocker.ps1 ``` # Installing the Red Team home lab How to install the Red Team home lab ## Installing the Red Team home lab ### 1 Cloning the repository First we need to clone the [repository](https://github.com/RobinFassina-Moschini/Breaching-Defenses.com) of the Red Team home lab. For that we open a powershell and type: ``` cd C:\Users\$($env:USERNAME)\Desktop git clone https://github.com/RobinFassina-Moschini/Breaching-Defenses.com.git ``` ### 2 Setting up the disk config Open the [*disk\_config.ps1*](https://github.com/RobinFassina-Moschini/Breaching-Defenses.com/blob/master/disk_config.ps1) file and update your configuration ``` #-------------------------------------------------------------- # Change the variables under to adapte to your disk config #-------------------------------------------------------------- #$labSources = 'D:\LabSources' #Path to the lab sources $labSources = 'C:\LabSources' #Path to the lab sources #$vmDrive = 'D:' #Disk where to create the VMs $vmDrive = 'C:' #Disk where to create the VMs #-------------------------------------------------------------- ``` If possible try to run the VMs on a different disk than the host. # ELK ## Setting Up ELK ### Installing ELK ``` cd C:\Users\$($env:USERNAME)\Desktop\Breaching-Defenses.com docker-compose up ``` ### Enroll agent Now that we have setup elk we want to enroll our agents. Read the token from `ELK/token`/`elastictoken` and modify LabSources/CustomRoles/Elastic\_agent/HostStart.ps1 line 21 to: `C:\Tools\ELK\elastic-agent\elastic-agent.exe install --insecure -f -url=http://elk.breachdefs.com:28220 --enrollment-token=;` # Deploying Full Lab We open a **powershell as administrator** and type: ``` powershell -ep bypass Import-Module AutomatedLab cd C:\Users\$($env:USERNAME)\Desktop\Breaching-Defenses.com git pull powershell -f C:\Users\$($env:USERNAME)\Desktop\Breaching-Defenses.com\breaching-defenses_lab_full.ps1 ``` # Tools # C2 Framework What is a C2 Framework ## What is a C2 Framework? C2 is the acronym for Command and Control (C\&C can also be used). A C2 Framework is a collection of tools and tactics used by attackers(Red teamers here) to keep in touch with compromised devices after the initial exploitation. Although the different possibilities differ widely across framework, C2 typically includes of one or more covert communication channels between exploited devices (VM from the homelab) and a platform controlled by the attacker (The windows host). These channels are used to send commands to the infected devices, download further malicious payloads, pivot in the network and exfiltrate stolen data back to the attacker. ### Choice of a C2 Framework Here I'm going to use two different one: * [Cobalt Strike](https://www.cobaltstrike.com/), a commercial framework (The most often professionally use) * [Covenant](https://github.com/cobbr/Covenant), a collaborative .NET C2 framework for red teamers I still encourage you to explore the others one or even develop your own. A good reference to choose your c2 is the [C2 matrix Project](https://www.thec2matrix.com/matrix), it's goal is to point you to the best C2 framework for your needs based on your adversary emulation plan and the target environment. ### C2 Introduction First I recommend to follow up to these two resources: {% tabs %} {% tab title="Cobalt Strike" %} {% embed url="" %} Video playlist to learn Cobalt Strike basics {% endembed %} {% endtab %} {% tab title="Covenant" %} {% embed url="" %} Video to learn Covenant basics {% endembed %} {% endtab %} {% endtabs %} ### C2 Installation {% tabs %} {% tab title="Cobalt Strike" %} {% embed url="" %} {% endtab %} {% tab title="Covenant" %} {% embed url="" %} {% endtab %} {% endtabs %} # OSINT & RECON ## What is OSINT Open-source intelligence (OSINT) is a multi-factor (qualitative and quantitative) approach for gathering, evaluating, and making judgments on data available in publicly available sources for use in intelligence.\ OSINT does not require to hack into systems or use private credentials to access data. Viewing someone’s public profile on social media is OSINT, but using their login details is not. This reconnaissance phase is vital for an engagement as it provides information that will be used to exploit targets or gain access to data. > “If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself, but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.” (Art of war, Sun Tzu) ## References {% embed url="" %} # Passive Reconnaissance ## Passive Reconnaissance Passive reconnaissance gathering relies on third-party sources like Google, LinkedIn, Censys, Shodan, etc, where we aren't actively sending any packet to the target network. ### Whois The gathering of WHOIS data is a classic source of OSINT data. A registrar collects information about the registrant, such as name, phone number, address, and email address, when they register a domain name. The billing, technical, and administrative contacts for the domain may have different contact information. ```bash whois breachdefs.com ``` `Domain Name: BREACHDEFS.COM`\ `Registry Domain ID: 2634387189_DOMAIN_COM-VRSN`\ `Registrar WHOIS Server: whois.ovh.com`\ `Registrar URL: http://www.ovh.com`\ `Updated Date: 2021-08-17T12:42:22Z`\ `Creation Date: 2021-08-17T10:30:19Z`\ `Registry Expiry Date: 2022-08-17T10:30:19Z`\ `Registrar: OVH sas`\ `<--- SNIP --->`\ `Name Server: DNS100.OVH.NET`\ `Name Server: NS100.OVH.NET`\ `DNSSEC: signedDelegation`\ `DNSSEC DS Data: 16651 8 2 1C86375048C1865BCAA33D474297B00F813EDF32D188DA18F803F7AD0671D16F`\ `<--- SNIP --->`\ `Registry Registrant ID:`\ `Registrant Name: REDACTED FOR PRIVACY`\ `Registrant Organization:` \ `Registrant Street: REDACTED FOR PRIVACY`\ `Registrant City: REDACTED FOR PRIVACY`\ `Registrant State/Province:`\ `Registrant Postal Code: REDACTED FOR PRIVACY`\ `Registrant Country: FR`\ `Registrant Phone: REDACTED FOR PRIVACY`\ `Registrant Email: REDACTED FOR PRIVACY.` From it we can see that the DNS is registered on ovh.com.\ WHOIS information stopped being useful in 2016 with GDPR, by default now the whois doesn't display anymore the personal information of the registrant.\ It's why we are greated by: `Registrant Name: REDACTED FOR PRIVACY` ### DNS brute force DNS enumeration is the process of identifying all of an organization's DNS servers and their related entries. #### DNSEnum [DNSEnum](https://tools.kali.org/information-gathering/dnsenum) is a cli tool that automatically identifies basic DNS records such as domain (A), name servers (NS), mail exchange servers (MX) and also perform a basic DNS brute force on it. ``` dnsenum breachdefs.com ``` ![Result of dnsenum breachdefs.com](/files/-Mk2y9LIUq0NrwHJkAdD) #### Nmap We can also use nmap and the subdomain list from seclist to bruteforce the DNS subdomain of our target. ``` wget -O hostfile.txt https://github.com/danielmiessler/SecLists/blob/master/Discovery/DNS/subdomains-top1million-5000.txt nmap --script dns-brute --script-args dns-brute.domain=breachdefs.com,dns-brute.threads=6,dns-brute.hostlist=./hostfile.txt,newtargets -sL ``` ![Result of nmap DNS bruteforcing](/files/-Mk2s9ytzfVJRqwL97l9) We see that we discover a lot more hostname than before. It's normal since we don't rely on public available informations, but we actively brute force the DNS server # OSINT Framework After doing manually reconnaissance on our target we will see how to use framework that automatize all these techniques ## OSINT Framework ### Spiderfoot **SpiderFoot** is an open source intelligence (OSINT) automation tool. It integrates with just about every data source available and utilises a range of methods for data analysis, making that data easy to navigate. SpiderFoot has an embedded web-server for providing a clean and intuitive web-based interface but can also be used completely via the command-line. It's written in **Python 3** and **GPL-licensed**. #### Installation {% embed url="" %} ``` wget https://github.com/smicallef/spiderfoot/archive/v3.4.tar.gz tar zxvf v3.4.tar.gz cd spiderfoot-3.4 pip3 install -r requirements.txt python3 ./sf.py -l 127.0.0.1:5001 ``` #### Running a scan We run a scan against our target: breachdefs.com ![How to run a scan with SpiderFoot](/files/-Mk2cPLO7nQjnAz1-Xgt) #### Results Once finish we can visualize our results as a graph. ![Graph results of the scan](/files/-Mk2_eUIwwzyoQizPRko) From it we can see that: * there is an exchange server running on 192.168.42.11 * a webserver at * we also get an email: ### Amass The OWASP Amass Project performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques. #### Installation {% embed url="" %} ``` apt install amass ``` #### Running a scan ``` amass enum -d breachdefs.com ``` #### Results Once finish we get two subdomains: [www.breachdefs.com](http://www.breachdefs.com) and owa.breachdefs.com ![Amass results](/files/-Mk2odX44dzBzaCaL4oj)