Downloaded 56 times
![background
× Python agent and controller
× heavily based on the PowerShell Empire project
× OS X/Linux 2.7 and 2.6 compatible/“living off the land”
× Asynchronous communications (HTTP[s])
× Diffie-Hellman based Encrypted Key Exchange
× Variety of post-exploitation modules](https://image.slidesharecdn.com/buildinganempyrewithpython-160806043224/75/Building-an-EmPyre-with-Python-13-2048.jpg)
![Questions?
@harmj0y / will [at] harmj0y.net
@424f424f / steveborosh [at] gmail.com
@killswitch_gui / a.rymdekoharvey [at] gmail.com](https://image.slidesharecdn.com/buildinganempyrewithpython-160806043224/75/Building-an-EmPyre-with-Python-52-2048.jpg)
Uploaded byWill Schroeder
Building an EmPyre with Python
The document discusses the development of Empyre, a penetration testing tool focused on macOS, addressing the lack of comprehensive post-exploitation tools compared to Windows. It highlights design goals such as modularity and strong encryption while emphasizing the unique challenges of targeting macOS environments. Additionally, the text outlines various functionalities of Empyre, including privilege escalation, host triage, lateral movement, and persistence techniques tailored for macOS systems.
More Related Content
Similar to Building an EmPyre with Python
Building an EmPyre with Python
- 1.
- 2. @harmj0y × Researcher/red teamerfor the Adaptive Threat Division × Co-founder/active developer of the Veil-Framework | PowerView | PowerUp | Empire × Microsoft CDM/PowerShell MVP and active PowerSploit developer
- 3. @424f424f × U.S. ArmyInfrantry combat veteran × Red teamer/Penetration Tester for the Adaptive Threat Division × Instructor for ATD’s “Adaptive Penetration Testing” course
- 4. @killswitch_gui × Previous USArmy Soldier × Red teamer/Penetration Tester for the Adaptive Threat Division × Developed SimplyEmail / SimplyTemplate
- 5. tl;dr × Overview/”Why BuildThis”/RATs 101 × EmPyre × Stagers × Host/network triage × Lateral movement × Persistence × The Future × Demos throughout!
- 6.
- 7. Motivations × A high-securityclient wanted a penetration test against their corporate infrastructure × which was 80% OS X … × We did our research and found very few options for ‘complete’ OS X agents × though small post-exploitation pieces did exist
- 8. Adversarial OS X ×WireLurker (Trojanized applications, Infects connected ios devices) × XcodeGhost (Infected xcode package in China) × Hacking Team (Remote Code Systems compromise platform) × OceanLotus (Flash Dropper, download Mach-O binary) × KeRanger (Ransomware, infected transmission package)
- 9. OS X Challenges ×Not nearly as many public OS X attack toolsets out there as there are for Windows × Access vectors are significantly more limited than Windows as well × Lateral spread is complicated a bit (no pth!)
- 10. RATS 101 × Wehave a number of broad design goals for our solution: × Staging flexibility × Modularity × (Reasonably) strong crypto × The “Staging problem” × Your malicious code has to SOMEHOW get to the target
- 11.
- 13. background × Python agentand controller × heavily based on the PowerShell Empire project × OS X/Linux 2.7 and 2.6 compatible/“living off the land” × Asynchronous communications (HTTP[s]) × Diffie-Hellman based Encrypted Key Exchange × Variety of post-exploitation modules
- 14. Module development × LikeEmpire, development is quick due to the modular structure and use of a scripting language × Modules == metadata containers for an embedded Python script × Things like option sets, needs admin, opsec safe, save file output, etc
- 15.
- 16. OS X MAcros ×Works on Office 2011 and below, otherwise, we’re stuck in the...
- 18. Mach-o binaries × Machobject file format for executables, object code, shared libraries, dynamically-loaded code and core dumps × We hot-patch a binary with the EmPyre stager code × Binary contains the python interpreter
- 19. Dylib Hijacking × Portedfrom @patrickwardle research × https://www.virusbulletin.com/uploads/pdf/magazin e/2015/vb201503-dylib-hijacking.pdf × Abuses search-order loading × Also a method of persistence in EmPyre
- 20.
- 21.
- 22. Demo: Phishing withEmPyre
- 23.
- 24. Privilege escalation × Usersoften run as admin × Two prompt modules for credential collection: × Mac app prompting - osascript × Screensaver alleyoop - osascript / security × Elevate using sudo_spawn to spawn a new EmPyre agent
- 25.
- 26. Chainbreaker × Keychaindump (juuso) ×Keychain exploitable prior to OS X yosemite to recover master key from memory × Decrypt keychain store using master key candidate × Keychaindump_chainbreaker (n0fate) × Allows masterkey and password input for decryption of entire keychain. × Fully ported to allow on target dumps rather offline
- 27. Hashdumping × Built inhashdump module: × Sudo required of course × Output is hashcat ready × Hash format is unique to different OS X series × 10.8 + uses Salted-SHA512-PBKDF2 × Password -> Iterations -> salt -> hash_pbkd2 × Ultimately very slow hash to crack (H/S)
- 28.
- 29. Keylogging × Uses rubyadapted code from MSF: × Captures and logs keystrokes to a file currently × Runs as a separate ruby process
- 30. screenshots × Currently supportstwo separate methods: × Native - screenshot builtin tool × Python - using Quartz API call’s × Environment can dictate the use of native tools × CGImageDestinationCreateWithUR() and screenshot only allows a output path for image
- 31. Clipboard theft × Greatway to target and collect credentials × Output to file or pipeline: × Timed collection allows continues monitoring using background jobs × Uses non-native method via AppKit API: × Native pbpaste may be signatured by Carbon Black
- 33. Demo: Host Triagewith EmPyre
- 34.
- 35. OS X ison the Domain Too! × Admins want/need to: × Enforce corporate policy via Group Policy × Manage resources × Manage users × Advertise resources such as printers × Benefit from single sign-on access to Active Directory resources through Kerberos
- 37. OS X andLDAP × ldapsearch tool × opens a connection to an LDAP server, binds, and performs a search using specified parameters × dig -t SRV _ldap._tcp.example.com
- 38. PowerView, OS XStyle × Wanted to mimic the features of PowerSploit’s PowerView to enumerate Active Directory × Using ldapsearch, we can mimic “most” features × Unfortunately, creates a log entry for every connection
- 39. Situational Awareness, ADEnumeration × get_computers × get_domaincontrollers × get_fileservers × get_groupmembers × get_groupmemberships × get_groups × get_ous × get_userinformation × get_users
- 40. PowerView, OS XStyle
- 41. Overpass-THE-HASH × Original researchby @gentilkiwi and @obscuresec and OS X research by @passingthehash × Upgrading an NT hash into a full Kerberos ticket! × Utilities × kinit - acquire initial Kerberos credentials × klist - list Kerberos credentials × kdestroy - remove Kerberos credentials
- 43. Demo: Domain Enumerationwith EmPyre
- 44.
- 45. Os x vswindows × Common Windows lateral movement methods: × WMI, PSEXEC, WinRM, Remote Desktop × OS X disappoints a bit on this front... × SSH is available but disabled by default × WinEXE installed through HomeBrew are possible × EmPyre modules: × ssh_command / ssh_launcher
- 46. Web Service Exploitation ×JBoss exploit × Pass exploit to Empire server
- 48.
- 49. Os x vswindows × Common Windows persistence methods: × Registry keys × Startup folders × WMI × DLL hijacks × Backdoor accounts × OS X is also quite fruitful: × Crontabs × Loginhooks × Daemons × Dylib Hijacking
- 50. Crontabs, Daemons, andLogin Hooks × Login Hook - User Context × Bash / Applescript / binary execution × User or any user logon executes payload × Sets com.apple.loginwindow × Crontabs - User Context × Requires Bash / Applescript / binary × Timed execution of payload × Great for continued access × Launch Daemons - Root Context × Requires sudo × Spawns determined by XML manifest (reboot) × Daemons (services) once started will restart upon agent loss
- 51. Persistence with DylibHijacking × EmPyre implements @patrickwardle research to scan for hijackable Dylibs! × rPath search, WeakLib import search × CreateHijacker module × allows for quick exploitation × ease of generating payload × patching in the path to the legitimate Dylib for proper execution
- 52. Questions? @harmj0y / will[at] harmj0y.net @424f424f / steveborosh [at] gmail.com @killswitch_gui / a.rymdekoharvey [at] gmail.com