My tool is, uh, Adam and Eve.
The name came after the tool, actually, so there's no religious backdrop or anything.
It just, it was cool.
At first, it was just going to be Adam.
And then, you know, somebody told me, uh, a friend of mine was like, who is Adam?
And why do we care?
You add the Eve.
And then everybody's like, what?
So here we go.
I literally had to make up the exchange piece of it.
That was part of Adam.
I'm like, shit, how do I make Eve work?
I guess a lot.
So just be ready, young people, children in the back.
All right.
So I said, it was just some guy with questions and, uh, clearly not a PowerPoint, uh, degree.
So it was just some guy with questions.
And I wanted to know, so everybody's coming down with all these C2s, right?
And like, you see them everywhere you go.
I don't care if you do OSCP or, you know, you do like, like red team stuff.
Like it comes up over and over again.
And it's like, okay, so we get it.
It's a C2.
You're going to get some weird data that comes across some port to me as a, as a blue teamer, that's just going to stick out.
I'm like, why are you even touching port 57, 300?
Give me a number.
52,004.
Right.
Like what's we have no services that are sitting on that.
Right.
And then like, you're constantly giving data back and forth.
Right.
So my thing was like, okay, so working on working and doing what I do, what I wanted to do was like, try to figure out a way to make native traffic be more, more interesting.
Right.
We all know how to pop a fishing.
Some, some person is going to sit at some company.
They've been there for so long, they're complacent and they're going to click a link.
They're going to do whatever.
We already know that almost everything that we talk about, we already assume that like the breach has happened.
Right.
And so we start from here.
So to me, I'm not trying to recreate something.
I want to use what we already know that people's natural behavior is going to be.
So if I'm in a Microsoft environment, which is 90% of all environments, right.
I know, Hey, you're probably using that directory.
You're probably gonna be in the cloud.
You're probably gonna do this.
So why would I do something that's going to pop all of your alerts, all of your EDRs, whatever we're having this room PowerShell.
So let's go PowerShell, even from a, even from a Python centric framework, we send it as a string, execute that as an expression.
And, and here we are.
All right.
So my name is Daryl.
I work for Trimark.
I'm a security consultant.
Our people are in the back.
We're doing our thing.
We are the best at what we do.
And that's just what it is.
Look us up.
All right.
Trimark, I'm kind of purple team-esque.
I don't really make hacker tools, but sometimes my tools are useful for the other side.
Let's go.
So why, why did I even like create this tool?
Right.
I was bored.
I was researching some stuff, wanted to really understand why the C2 framework still comes up.
I mean, there are so many of them that come up, you know, and like people talk about Metasploit and all this other, that's cool, whatever.
But generally speaking, at least in the junior levels, when you're, you're first starting off and you're trying to get into this red thing, it's like, yeah, the C2, you got to figure out, yeah, get them to pop that thing.
Did you get the calc, what?
Yeah.
But I mean, cool, whatever.
My thing is more of like, what, what services do you allow to run in your environment?
That's cool.
This is a Microsoft environment.
Okay, cool, cool, cool, cool, cool, cool.
What's the execution level that you allow things to run natively?
So I'm not trying to break something.
I just want to use what you already have and you're leveraging in a way that you might not have thought about.
So that's, that's why I created this tool.
What is it?
Again, it's just, it's literally just a socket server.
A lot of times when I see, at least in the training world and some people that do other things, but like, at least in the training world and stuff like that, right?
You have your server that sits somewhere, you send out your client, your agent, your whatever, right?
You send your malicious code out somewhere and you wait for it to pop and you have to sit there on your server or wait for your server to get that, that receive to do something and then you can move on.
But realistically, right?
So again, this is a Microsoft world and I'm just trying to blend in.
Hey man, I'm wearing a blue shirt.
It's got little, little circles and stuff on it.
It's Chrome right now.
Hey, I work for Microsoft.
So that is not necessarily going to be the easiest way for me to execute some code in your environment.
Why would I try to reinvent what Microsoft has already leveraged down to the system level?
Because by the way, you can call DLLs, you can call C code, you can call anything on a PowerShell.
So from a PowerShell centric standpoint, it's all about like what the execution level is, right?
So absolutely, you can make sure that you can't just like run native code or it has to be signed or whatever else like that.
But if you don't know that that's even an option, in most environments that I see, I mean, you just PowerShell script and all you get is the little, the UAC of like, are you sure?
I'm like, yeah, I'm definitely sure.
I can run that script.
Yeah, thank you.
So that's what we do.
So the way that this thing works is based on Flask.
I don't know if you guys are familiar with Flask.
It's just a web API, Python based.
So if you hit a certain URL, you can get specific types of code to run, right?
So my idea was awesome.
I don't want to sit at a Linux machine or even if I go to somebody else's company and I'm doing a pen test or something like that, like I don't, what are the odds that they just have a Kali box and they go log into your Kali box?
Like that's not a thing, right?
So I'm like, how do I get around that?
So the thing is you can have any box that you want anywhere that does anything that runs Python and you can throw up this Flask server and now you hit any API on the Flask server, it will take
a string of objects.
I don't really know the best way to say it, but it will take text, right?
So you can have a whole code, page, like a PowerShell script, a Python script, a C program, it doesn't matter.
It'll take it, mention down to one liner, send it as a string via Python to the agent that is then running the native PowerShell thing, because it's just like a Windows machine at work or whatever.
And with the PowerShell thing, what we do is we invoke expression.
And with that, you can take that whole string code, doesn't matter what it was natively in, right?
We take away those exterior quotation marks.
And then next thing you know is we've sent an entire script that sits in memory, never was written to disk to do stuff.
All right, let's get to the breakdown.
Sorry, guys, I'll be honest with you.
For the last few days, I've been struggling with the Wi-Fi here.
I don't know if you guys have dealt with it.
It is ridiculous.
And so I had a live thing that was going to do stuff, kind of going off of some like old recorded stuff, but we'll talk about it and we can do it.
This is all on GitHub.
And it's kind of fantastic.
So this all started, right?
So it started with just a multi-threaded socket server.
Are you guys hackers?
Who hacks here?
Okay, cool.
Not those guys.
The ones that didn't raise their hands, that's what I'm looking at.
No.
All right, go.
So socket server, right?
This is just simple Python stuff.
We define the socket server.
Cool.
It can be anything.
And actually in the, look at that, I can't, I'm moving around too much.
In the actual source code now, that's V2.
So if you go to GitHub and you grab it down now, that's something that pops up, right?
So in the server, you get to define what the server is in the port.
Also in the client, you could predefine it or you could ask it, right?
So it's, this is like normal stuff.
For the Python people, this is probably boring, but if you're not a Python person, let's get into it for a second, right?
So we define it.
This is going to be my function.
This is my socket server object right here.
AFINet.
That's just IB4.
That's what it is.
And then we're going to send it to a stream.
So we then bind, and I say I want an IB address, I want a port, and that's cool.
So what's cool about this, what makes it multi-threaded is the fact that here, on this socket listen, versus any other way that like you were to define any kind of C2 Python this way, this number here, right, that goes into this method, okay, you can give the parameter of any number that you want.
And that's how many multi-threaded connections it can have at once.
And you don't have to handle those connections, right?
So if I sent this email out to 50 people and they all click the same link, that's cool.
This code will handle all that as long as I have at least 50 that's in here, all right?
So I just did one.
It is what it is.
It tells me it's listening.
Cool.
And then it accepts every single one.
Okay.
So the reason why I actually pull this up is because the programmers in the room are like, how are you handling something that's like multi-function that's here and something that's defined in a singular function, if that makes sense, right?
And the reason why it's here in this accept, it's because I have a separate function that's also a handler and it's, this will pass that to the socket listener.
And so I have another function that's just there and it goes for anything that comes and hits that socket listener.
Cool.
We'll just do it.
We'll give it some arbitrary identifier and we'll keep on running.
That's essentially what happens here in the threading thread target handle client.
It's all variables.
I don't need to know what they are.
I don't care.
The program takes care of it and we're good.
But if you're doing anything in Python, very useful.
The threading that thread method is a very powerful method.
All right.
Now we have our client handler.
All right, cool.
So they have a client.
It's an agent because we're all blue teamers here, but don't do anything nefarious.
Essentially all it does, it's just, it's sitting there.
This is all going to be interacting with a PowerShell agent that's on the backside, right?
So it's in here.
It's waiting for a queue.
I am using PowerShell queues because using a multi-thread handler, I don't know how many connections are happening necessarily, or I don't really care, right?
They don't necessarily care, right?
But if I have a queue here, I can send 50 commands all at once and they will execute sequentially.
Or if I hit 50 end users, right?
And they come back and they tell me, this is what we received back from what you requested, right?
That's cool.
But I want to see them sequentially, one by one by one by one, because I'm a human.
I can't see them all at the same time.
So I decided to go with queues.
Also too, queues have an embedded weight.
So let's say I'm cloning, I'm cloning this place here.
Okay.
And my wifi sucks here, whether it's my wifi, their wifi, like whatever, but I've already sent it down the chain.
It's just, it just sits in that queue until it goes.
All right.
And like where most of us are probably aware of like FIFO and all that stuff, like first in first out.
So this is not that it's actually the opposite.
So like with a queue, it's like it's first and last out and that's, that's what happens.
So I can send, I can have a whole bunch of commands that I send out and then they will one by one by one be sent to every single client that's sitting here talking to the server.
I can also receive every command back from all of those servers.
Doesn't matter.
Right.
And I put in a nice, you know, a sequential manner of like this one came in and this one came in and this one came in and this one came in.
So that's what we did.
All right.
So from my, my issue again, like I said, was I didn't want to sit at a Linux machine or a Kali machine or anything like that, because unless, unless you're a red teamer or whatever, like what are the odds that when somebody gets up and, you know, by the way,
I do different types of villages and stuff like that.
And it's always realistic, but what are the odds that you're going to sit down and like, Oh man, he has Kali Linux and he's domain joined and he's like, that's come on, man.
That's not what's up.
Right.
That's not going to happen, but I can set up, especially if I already know something about the environment, right?
Like I can set something up anywhere, run that server, that I'm going to sit down anywhere.
And from that, using Flask, I can use endpoints and based on the endpoints that I hit, I'm able to run specific code, right.
And it'll run against that, that pwned, I'm sorry, where it, that the agent is installed.
So cool.
The second thing that I did was so that, so that's cool.
I'm using HTTP awesome to interact with another server anywhere else in the world, but it's still a C2 server.
So what happens if that port gets killed, right?
Like I use a port like 1, 3, 3, 7, like that's stupid.
And they kill that port off.
Right.
You could actually just go to a website.
So can you browse the internet?
That's cool.
Yeah.
Based on the types of methods that you've sent to, to this website, right.
So I've got this slash pwned.
So whatever your, your URL is like, whatever your IP address is slash pwned, you can send any command as a and it doesn't need to, at this point be a one line string.
And if anybody wants to help me with some of that, all right, but it doesn't need to be one line string.
You can have that in the body of your, of your get request, or I'm sorry, of your post request, right?
And you can just post it to pwn.
And guess what?
It sits there in the command queue.
And now everything else that's pwned is waiting for that command to also come down.
So you don't ever have to be sitting at your Linux box, your Italia box, your any other box.
You can just, oh, I know the IP address of this arbitrary server that I set up and I hit it here.
And that's cool.
It does stuff.
That's basically that page.
I'll tell you that.
So I am not a front end guy and you're going to see in a minute, like I am not a front end guy.
So I don't make stuff the most pretty, but everything that, that happens, you do get in real time, you get feedback back from a command that you send, but we have a log file that's created and then the log file, it's beautiful.
You open log file, you cap that thing.
It's, it's amazing.
Just that.
And that's all this Microsoft, just like object handling shit.
Right.
It's very cool.
Again, I apologize for the children in the back.
That was another cuss word.
Man, I'll put it in my jar.
Thank you, Rochelle.
I'll put it in my jar.
Cool.
Sending commands.
They're important.
So the way that it kind of works is, for instance, that's just PowerShell, right?
This line on here, all red, that's just, just normal PowerShell command.
Let's, let's get some information about some object that exists somewhere.
So what we do is we throw that, we throw that into the, the, uh, the queue and it sits there, right?
We get a feedback.
Sure.
It's sitting in the queue.
We don't really care.
That doesn't give us anything.
Okay.
That's fine.
But that's when the normal C2 stuff happens because the C2 was sitting there with a listener, always waiting to see if the variable is null or not.
And if not null, send it.
So that's what we do.
I got too excited.
I'm sorry.
I feel like my voice is big enough for this room.
I'm just letting you know, but we'll do it.
Can you hear me now?
Cool.
So that's, that's what we do.
We just, we just send it, dog.
Um, and that's exactly what we do.
So like, this is an example of how you can read from a file, both locally and in remotely.
That's it.
Cool.
Let's get into some code.
Uh, so this is our agent and this is just a, an example of what you could use with a server because my tool is the server.
My tool is not the agent.
How you want to send data back and everything else like that.
And if you go to my GitHub, it's fine.
There's, it's parameterized and you can throw in, you can, you can test around, right?
But I'm not just going to put something out there.
That's like, let's do it.
Okay.
Um, but here let's forget about all this.
This is a client.
The client is this pops it.
This is some code.
This is native PowerShell code.
So unless you have like a, an EDR or something else that's like looking for specific types of parameters inside of PowerShell, like this is not going to pop.
It's not malicious.
It's not malware.
This is just native PowerShell code interacting with the internet, the way that computers do.
So, um, what we've done, we create a new object.
It's a stream in the stream.
We're able to take stuff in.
We read the lines from the stream, right?
We break it after it's done.
Um, assuming that we get an exit command, exit command comes in, the entire connection is done.
Everything is out of there.
So from the, from the client and from the server, you can make sure that that's gone.
And here, this is the, the golden ticket.
Sorry, I did touch your screen, but this is the golden ticket, right?
The invoke expression, right?
We all know the IEX that is that that's pretty hot stuff that's happening right now.
So IEX will take a string, any string doesn't matter how long.
I do think there's a character limit, but generally speaking, it doesn't matter how long it will take that string.
It'll write it out into a terminal shell.
Okay.
And then I'll run it as is.
So all of your, all of your like, like one ticks, your double ticks, your apostrophes, your semi-colons, whatever, doesn't matter.
It took it as a string first.
And then now it's reading us all in memory.
Nothing gets written down to disk or anything else like that.
So if you have EDR or, you know, you, you have some system that's, that's looking for stuff.
This is something that runs in memory, because again, this is not malicious.
The agent is not malicious at all.
Oh, look at that.
I have graphics.
I don't even know, man.
Wait, does it do the thing?
Let's do it again.
Oh, it does it again.
Let's go.
Cool.
All right.
So what's next?
So the, too many, too many.
All right.
So what's next?
All right.
So what we're doing, man, you guys have been deadwood for three days.
Come on, relax.
I drank with you last night.
I'm pretty sure, man.
So, so what's next?
So I actually do have an HTTP cradle that's there.
Right.
So let's say your C2 ports get knocked out.
You can't do that.
Or it's in an environment where like ports are very, very much locked down, but like 80 or 80, 80, they're usually good.
443 is a pretty good.
So you can absolutely come into this exact same framework and you can, you can post things into, into a URI, URI endpoint, and it'll take the command.
It'll send it down, add it to the queue.
Same thing is everything that comes out, every response that comes out, you can go to URI and you can also get that information.
You never need to touch that original like Linux box or Kali box or whatever.
You can be in your phone, your, I don't know, ATMs, calculators, everything's smart nowadays.
Right.
So what I want to do now, and like the biggest piece, and if anybody's here that has ideas or whatever, I am super open, is I'll say like HTTP with HTTPS, right?
Like we're going to encrypt this and go through.
Technically you can do this all the way through like CloudFlare now.
You don't have to like, you can add HTTPS without adding HTTPS.
So that's cool.
But really what I want to do, it's, it's, it's this Azure, this, this open AI.
I want to be able to leverage, leverage the open AI API.
And what I mean by that is so, so far, sorry for Trimark, we have the Trimark checks.
I don't know if you guys know about us, but want to know how your AD environment works?
Run this PowerShell script.
It's going to give you somewhat of an idea, and then you come to us and we make it better for you, right?
So what I've done here is I have just created a nice, so this is using, um, Ling Chains, which is amazing.
And it just, it's chat-gbt, it's leveraging that LLM and it's over Microsoft servers, all that stuff.
But what's, what's cool about it is, uh, you can take a single PowerShell script.
Doesn't matter if it's three lines or 50 lines or whatever.
I have not yet been able to, to handle, um, modules.
So if you have to import modules, I haven't done that yet, but here you can just copy and paste any PowerShell script.
It'll one line it, right?
It'll take out and, and, and do all, all of the things that are needed for the, for the strings in Python, like to send it as a Python string down to your PowerShell client and run that as an invoked expression.
All right.
And this, this is the point where normally I'm like, Hey, let's go answer the internet.
Let me show you what's happening in my house.
All right.
Uh, you guys have been deadwood for the last few days.
Internet sucks.
So I am going to give you like a little, a little taste of something that, that I've shown a while back.
All right.
So here's what we're looking at.
So this is, this is the file server that's running here.
I apologize for, for how it looks now, but I'm dealing with technology.
Um, and this, this is just a, this is the client server.
So if you were to come out here, what, what I'm showing is that I have a parameterized, um, URL.
So after you go to CMD and you have a you can type in any arbitrary, like power, PowerShell command, any CMD command, and it will run.
All right.
And it does pop up here to give you a nice little glance of like, what came back?
Did I even work?
Do I even care?
Whatever.
But every single thing that you do now, right.
From the time that we had the connection is it's all locked and it's beautiful.
It's JSONified for those that know JSONify.
But it is, it is, it's a beautiful thing.
Right.
So here we are like, who am I?
I'm just hitting, just, just, I'm throwing out random ass commands.
And it's just to show that like anything that you could run natively within the context of the user that you're in the session that you're in.
Yeah.
You can throw that up in PowerShell.
So here we go.
Right.
We're going to name some, some administrators.
Okay.
Like I can be in China right now and just hit in.
I do have to refresh some mods.
That's a flask issue, but cool.
So now I get all the admins.
So in that like Azure directory environment, right.
Or a name like admin.
Okay.
And so every, every single command that we send out, you're like, you're able to modify it and things like that.
So here I've gone through the log file and you can see every single thing that's here.
Bruce Wayne, cause I'm Batman.
It's all there.
And like I said, when you go to log file itself, it's beautiful.
So this is help me help you help us.
All right.
So this is, this is the cool shit.
All right.
So what I'm trying to do now, and it works semi in that you can take a PowerShell script, a run PowerShell script, no modules that need to be imported or anything else like that.
Right.
And you can copy and paste your PowerShell script into this.
It will try its best.
And this is based on OpenAI.
And I have a preset prompt for it.
It'll try to one line it, flatten it down, send it across as a, well, it'll one line it, flatten it down, look at it as a string.
Python will then escape out all the characters that need to be escaped out.
And then it is sent down that C2 server.
So like, you don't have to know like, Oh, I want to use powerup.
I want to try my checks because you do.
Right.
And then you copy and paste and it works.
So that that's really what it is.
It's an ongoing project.
And that's, that is what I, what I have worked on, what I'm building now is like, you can be anywhere else in the world, across the internet, anything HTTP, you have a browser and you can interact with a Microsoft environment.
Okay.
So one of the things that I have as well, and I wish I was able to show it to you now is the fact that we're, we're integrating with a bloodhound and Azure hound and all those things.
So like you can literally throw anything that's in here and it will, it will just like 85% depends.
It depends on how people write, write code.
Right.
But that is, that's what I've got going on guys is Adam and Eve.
And I am so open for anybody that has any kind of like contribution to how to make it better or cooler, but I want to figure out how I could see to this specifically a Microsoft environment, because that's what we do.
See to a Microsoft environment without being in the environment.
And I can be anywhere in the world.
And this runs as if I was sitting at a computer hardline and into like the DC.
So you said you're integrated with bloodhound, but it's kind of as if it might, correct me if I'm wrong, but are they doing the same thing as bloodhound?
All right.
So that's a great question, man.
So it's not bloodhound.
It's not doing any of the work.
It is facilitating the communication.
So bloodhound, Rohan, good dude.
I eat lunch with him every January.
That's what we do.
All right.
So he came through TriMark, humble brag, right?
He came to TriMark and he actually went through our training before he created bloodhound.
So we know bloodhound very, very well.
So what you would do is you would run bloodhound natively in an iPhone environment, and then you would send your commands and then you would receive your sharp, your sharp hound stuff essentially back through the C2.
Okay.
Right.
And your, your database is running wherever you want your database and run, but like the commands back and forth, sharp hound, again, that's a PowerShell script.
Send it.