- Well, we have a fun talk this afternoon.
I don't know about you all but I love a good rickroll.
And our next speaker rickrolled his entire high school,
which is pretty awesome.
So please welcome Minh Duong
for his first time up here at DEF CON Speaking,
telling us about how he rickrolled his whole high school.
(audience applauding and cheering)
- Hi everyone.
Thanks for coming to my talk.
My name is Minh, I'm 19 years old
and I'm starting my second year as an undergraduate
at the University of Illinois at Urbana-Champaign next week.
This is my first time at DEF CON
and my second time ever attending a security conference.
So it's extremely humbling to be up here on stage
as a newbie.
Before we proceed, first on disclaimers.
If you came to this talk expecting anything
other than a script kiddie story
then you didn't read the abstract carefully.
This presentation is for educational purposes only.
I do not condone hijacking
and rickrolling other high schools.
Also, please don't hack my own high school district,
they're very cool people and they don't deserve that.
So let's start from the beginning.
Here's a picture of my high school
which has about 2000 students
and is part of a larger school district in suburban Chicago
which has six high schools in total.
My school offered some IT classes.
They essentially had a career pathway
that you can follow from freshman to senior year.
Obviously I was running to computers,
so of course I signed up in my freshman year.
Those classes were held in this room.
It's pretty amazing.
It's where I developed my cyber security skills,
thanks to my awesome teacher, Mr. Drenth.
It's got computer lab
and has shelves full of computer parts, cables, monitors,
switches, everything a high school hacker
could ever dream of.
Now, one of the coolest things about this room
was this closet.
Inside this closet were two desktop PCs
that were each running Windows 7.
I inherited this space from the upperclassman
and it was here that I really started developing
my script kiddie case.
I never owned my own computer before,
so this was the next best thing
since I basically had both these computers to myself
and like any hacker wannabe,
I started running scans against my school network.
I was quite ambitious
and decided to scan the entire 10 dot subnet.
I had some help from my upperclassmen friends
and we took turns running every IP scanner
and we had to split the scans into parts
because if we tried to open one big scan
it would crash Notepad.
We learned quite a bit from the scans.
The first being that our school district
has its own metropolitan area network,
so all the high schools are connected to the same network
and each have their own subnets.
We also found a ton of different things,
printers, voiceover IP phones, switches.
One of the coolest things we found was the security cameras.
(audience chuckling)
- The top left is me when I first found them
and the bottom right is my friend
giving me the middle finger after I showed him.
Now, one of the most important things
we found in the network
that forms the basis for this entire talk
is the IPTV system.
The system is manufactured by Exterity
and consists of three main products.
The first is the AvediaPlayer
which are receivers attached to projectors.
They send serial commands to the projector
to control its current state,
and also what content is displayed.
Here's the web interface for the AvediaPlayer.
You can change the input source and volume
and you can also change the current channel
to a specific RTP or UDP stream.
Next up is the AvediaStream
which is attached to a device that displays video output.
The encoder then takes that video output
and broadcast it as a network stream
which receivers can connect to and display.
Here is an example of the carousel live stream
at my former high school
which is displayed on all the hallway TVs.
The stream is broadcasted by the encoder
to the AvediaPlayers.
It's just a slideshow showing special events at the time
weather, et cetera
but it was also used to show morning announcements.
And finally, we have the AvediaServer,
which provides an easy to use interface
to manage all the devices at once.
Here is the projector control from the AvediaServer
where we can drag and drop receivers
onto the control buttons at the top, like power on and HDMI.
Now each of the six schools has its own AvediaServer
which controls Exterity devices in their respective subnet.
And in this case,
I'm viewing the projectors from my specific high school.
So that was pretty much the bulk of my freshman year.
I was just getting the district network,
finding random devices to screw around with
and figuring out how things worked.
All right, we're going to skip a few years to my senior year
and the time skip is because nothing notable happened
in my sophomore year,
and my junior year is when the COVID-19 pandemic hit.
And the first semester of my senior year
was hybrid learning, so not much happened either.
Then the district decided in March of my senior year
that everyone would be required to come back in person
in April.
It's at this point that I remember,
oh, Hey I still have access to all those devices
from freshman year,
and I should probably tell the district about it.
And then I think, oh, Hey, I need to do a senior prank.
And finally I conclude,
oh, Hey I should rickroll my high school district.
So I asked a few friends for help.
(audience applauding)
- So I asked a few friends for help
and we officially began working on operation Big Rick.
(audience laughing)
- One of the first things we needed to do
was establish access to the district network from home.
Now I already had a working solution for this
because I installed Chrome RDP on every PC
in the classroom that I mentioned earlier.
On the screen right now is a list of all those PCs.
They're grayed out because they reformat the machines
every year so I can't access them anymore.
Now, while we did have network access through those PCs
it's not going to be very hard for district tech
to pinpoint me if any scan or exploitation traffic
is coming from those machines.
So we need a way to pivot to different machines
that are not associated with us so we don't get found out.
So now I introduce LanSchool.
Who here knows what LanSchool is?
Okay, not a lot.
For those who don't know,
LanSchool is a program that gives teacher control
over devices in their classroom.
There are two applications,
one is LanSchool Student,
which is installed as a background process
on all student devices.
And the other application is LanSchool Teacher,
which a teacher uses on their computer
to control all the student devices.
So what can you do with LanSchool Teacher?
You can freeze a student computer to make it unusable.
This is the one every student hates.
You can remotely view and control a student.
You can upload arbitrary files.
You can execute arbitrary files,
and you can view keystroke history,
which I think is absolutely insane
because it opens up a massive door for abuse.
Imagine what would happen if a threat actor
got access to all this control?
It turns out it's pretty easy to obtain a copy
of LanSchool Teacher if you know where to look.
And if you're an IT guy
provisioning hundreds of student computers,
well, you're not exactly going to prioritize
adding passwords to the classrooms.
And here I'm doing a student's keystroke history.
It looks like they're doing some 3D modeling
based on their search history.
Now, it also turns out LanSchool Student
was not only installed on the student computers
but also on some staff computers as well.
(audience laughing softly)
- Here's a desktop of one of the security guards.
So using our district network access and LanSchool Teacher
we were able to pivot to a different high school.
So that way, when we'd run our scans from there
the district wouldn't be able to track us.
I now had a better knowledge of what to scan for,
so we found a few new things.
It turns out all Exterity devices run SSH,
and they let you open a shell,
like direct user access to the system.
This makes things way easier though,
because instead of sending a bunch of web requests
to control each of the receivers,
we can create a payload
that runs its serial commands locally on device.
Now this payload is really just a batch script that I made
that makes request to a web interface locally
but it's pretty simple and it boils down to this logic.
The first thing we do is set the receiver
to play the rickroll stream.
So it's at address 225.25.25.25.5000.
The next thing we do is set the input to HDMI,
since this is the input where the AvediaStream is playing.
Then we disable infrared capabilities.
(audience applauding)
- This way the teacher cannot use their remote
to turn off the receiver.
Although they still can technically power off the projector
off manually by pressing the power button
but we'll get onto how to fix that later.
(audience laughing)
- And a final step in our initial process
is to actually turn it on.
Then we enter a first loop for three minutes.
It's during this loop that the countdown is displayed
not the actual rickroll yet.
The loop basically sets the volume to the max,
and then it sends a power on command every 10 seconds.
And this fixes the issue I mentioned earlier,
where the teacher could just manually turn out the projector
but that doesn't work because it just turns on again.
Close to the end of the countdown,
we switch the input back to HDMI
to make sure that the projector
is still showing the rickroll.
Then we run the main loop a second time
but this time for nine minutes
and this covers the entire rickroll stream
and also allows people to read the final message
that's displayed after the rickroll.
Finally, we restored a channel
that the receiver was broadcasting previously
using a backup we made,
and then re-enabled the infrared remote.
So everything goes back to normal.
At all times, we maintained a pivot
of at least three AvediaPlayers
before connecting to the AvediaServer.
This way, the district would not be able to trace us back
even through the LanSchool computers
without significant effort.
And then our plan was to slowly distribute the script
from the AvediaServer to all of the AvediaPlayers
that we identified.
In my research, I also found a privilege escalation
in AvediaPlayer and AvediaStream.
Here's a show where I'm logging as root.
The way that the exploit works
is that you can export a backup of the device configuration
to an FTP server, which will be the attacker machine.
The backup also includes the shadow file,
so you can just change the root hash to something you know,
import that backup back onto the device
and then log as root VSSH.
The AvediaServer had an even easier privilege escalation,
pseudo access was just given to the system control binary,
which is a classic get the fuck out binary.
So you can just create a service file
that executes a command and says root
and call system control on it.
Those are the root hashes by the way
in case anyone's interested in cracking them.
I haven't tried anything beyond rocking that text at all,
so don't shame me if you do manage to get it.
All right, it's go time now.
We picked a date April 30th,
because that was a Friday before AP exam started.
We've had plenty of times to test and get things working,
we're ready.
But at the last minute we found something new.
First, let me introduce to you the EPIC system.
EPIC stands for Education Paging
and Intercoms Communications.
(audience laughing)
- It's exactly what it sounds like.
It consists of speakers,
which can be installed on the ceilings of hallways
and classrooms.
(audience applauding)
- Similar to the IPDV system,
these speakers also have a central server
called the EPIC server.
Here's an example of one of the projectors
I mentioned earlier.
You use the EPIC server to control various alarms
and you can create and manage bell schedules
for when class starts and when class is dismissed.
And more importantly, you can upload custom audio for bells.
(audience laughing and applauding)
- So April 27th,
it's exactly three days before the big rick
when we discovered the IP ranges for the network speakers.
The reason we didn't find them in my freshman year
is because the EPIC system was installed in my junior year.
This looks exciting for us.
If we can get access
then we can change the bells use at rickroll.
Unfortunately, the default passwords don't work.
Two days pass, it's 1:00 past midnight on the April 29th.
One of my partners, Shapes, is sad
because he was the one trying to push us
into getting the EPIC system.
Five minutes later, he finds the password.
(audience laughing)
- So it turns out the district
did change the default password
but they used the example password from the manual.
(audience laughing and applauding)
- When we checked the settings,
we found the IP address of the server that it was bound to
which brought us to this login page where we connected.
We found out that this was a login page for the EPIC server.
So we quickly found a default credential list in the manual,
which weren't changed,
and boom, we now have control of the bell system
for one of the schools.
However, there's a slight problem.
The EPIC system at the other schools
had their default passwords changed.
We can't log in,
but all hope is not lost.
In the settings, I found an SMB server
that was configured for backups
with the same default credentials.
And then I thought one of the backup servers
for the other school still have default credentials.
I was right.
(audience laughing)
- Here are the extracted contents
of one of the backup archives for another EPIC server
which we did not have initial access to.
And in each archive is a SQL dump
of the entire configuration, including user entries.
Now, most of these entries
were just teacher accounts connected to LDAP.
So no password hashes there,
but there are a few local manufacturer created accounts
which you can see in this top left corner.
So it makes sense that we would try to crack the password
for one of these accounts, right?
The problem is that the hashes for these accounts
were different across each school.
And unfortunately, rocky didn't work for any of them.
However, I discovered something strange.
It was a local account with the username district.
And what stood out was that this account
is at the bottom of the table.
It was also created in 2017,
which matches the date of the other local accounts,
which means that this is an account
created by the manufacturer
not one installed by the district.
I couldn't find any information online about this account
and it doesn't show up in the users list
on the actual web interface.
So I concluded it's a backdoor account.
And even better, the password was password.
(audience laughing and applauding)
- So now using the backdoor control account
we control the bell systems
for all the schools in the district.
And that's how we EPICLY pawned all the EPIC servers.
All done in less than a day and a day before the big rick.
And now we upload the rickroll audio file as a bell.
Can you guess which one is a rickroll?
(audience murmuring indistinctly)
- I'll give you a hint,
one of the lowercase Ls in musical scale is a capital I.
Also, there's one that's three minutes long.
Then the final step is to modify the schedule
to replace the bell with our newly added bell,
and we're done.
The final task is to set up our stream
with the countdown timer here,
and when it hits zero, the rickroll begins.
It was a massive success,
and both the IPTV systems and bell system rickrolls worked.
Here's some gifs across the district showing the result.
(audience applauding)
- This is one of my favorite ones.
It's a student experiencing a rickroll from a Zoom meeting
and the teacher is showing it to them.
(audience laughing)
- And this is the final message that's displayed
when the rickroll was finished.
I was very tame and careful about the wording
because I did not want to provoke teachers
more than I already did.
So you might be wondering what happened afterwards.
Well, we compiled all the things we did
into a 26 penetration test report,
26-page, sorry.
And then we sent that to all the technical supervisors
in the district after the rickrolls were done.
And of course we did this anonymously.
A few days later, we got a response.
It was from the director of technology for the district.
And because of our documentation in ethics,
he said that the administration
would not be pursuing discipline
and actually asked us to hold a debrief.
(audience laughing)
- So you can imagine our reaction.
It was a pretty big relief for all of us.
I'm sure many of you have heard stories
where students report vulnerabilities to the school
and it does not end well for them.
So we were extremely fortunate
that the district was standing with us,
and in fact, listening to our advice.
Here's the screenshot from the debrief we had over Zoom.
I was the only one who revealed my full identity
since my other peers thought it was a sting operation.
(audience laughing)
- It clearly wasn't, or we wouldn't be here.
In our debrief presentation,
we referenced each other as a color.
So we thought it would be funny to identify as crew mates
from the hit game, "Among Us".
(audience laughing)
- Overall, the meeting went extremely well
and we managed to resolve the issues in the district.
So lessons I learned from a big rick,
always maintain a pivot,
since doing that throughout district tech
and they could not figure out who did the big rick
until I came forward.
Check your scans carefully
or you might miss a server that controls all the speakers
and waste two out of three days
before the deadline for an attack.
Try to keep things as tame as possible
so you don't end up in too much trouble.
I could have been a horrible person
and displayed anything else
that would've not been school appropriate.
Document everything to protect yourself,
at least if what you're doing is ethical.
It really helped me in this case, at least.
I'd like to thank my accomplices, Shapes, Jimmy and Green
because I wouldn't have been able to do this
without you guys.
I also wanna give a shout out to Mr. Drenth
for being the best IT teacher ever.
I'd also like to thank SIGpwny and friends
for encouraging and helping me prepare for this talk.
(audience cheering and applauding)
- And finally, I wanna thank my school district
for letting me graduate and not pressing charges.
(audience applauding)
- Here's my website,
follow me on Twitter,
and thank you for coming to my talk.
(audience cheering and applauding)