Archive for the ‘Armitage’ Category

h1

Cobalt Strike and Armitage Updates

October 16, 2012

Updates to Cobalt Strike and Armitage are available now. I spent the past two weeks testing these programs through unit tests, a class QA focus group, and multiple penetration tests of my local lab from Amazon’s EC2.

This update fixes several bugs in both programs and I was even able to contribute a few fixes to the Metasploit Framework.

As usual, the trial version of Cobalt Strike is available at:

http://www.advancedpentest.com (changelog)

Use msfupdate to get your hands on the updated Armitage release, or go to:

http://www.fastandeasyhacking.com (changelog)

For either application, I recommend that you update the Metasploit Framework to get revision 15972. A CPU resource starvation condition was mitigated last night. This bug would cause a Ruby thread to take over the CPU for up to 10 minutes at a time, making Armitage and Cobalt Strike barely usable. I have a blog post coming on this particular bug.

P.S. Strategic Cyber (*cough*me*cough*) is at the Maryland Cyber Challenge and Conference today and tomorrow. Stop by our table to get one of the nifty penetration testing lab DVDs with exercises and target VMs paired to our online course.

h1

Dirty Red Team Tricks II at Derbycon 2.0

October 4, 2012

Last year, I spoke on Dirty Red Team Tricks at Derbycon. This talk was a chance to share what I had used at the Collegiate Cyber Defense Competition events to go after student networks. During this talk, I emphasized red team collaboration and our use of scripts to automatically own Windows and UNIX systems. I also released the auto hack scripts at the event.

This year, I had a chance to update this talk and show what is different about this year. At this talk, I emphasized the use of bots and how they helped us play the game. I also talked about the use of asynchronous command and control to better hide our presence on student systems. I released Raven, the asynchronous C2 agent I developed for this year’s CCDC event. Raven is the prototype of Cobalt Strike’s Beacon feature. I also released a few other Cortana scripts discussed in the talk. This talk also covers a neat Windows persistence trick using DLL hijacking against explorer.exe.

Thanks to Adrian “irongeek” Crenshaw‘s amazing speed, I’m able to share both videos with you today. It’s best to watch both videos in order.

Let me know what I should cover in next year’s Dirty Red Team Tricks III.

h1

Cortana: Rise of the Automated Red Team (DEFCON 20 Video)

August 29, 2012

At DEFCON 20, I released Cortana, a scripting technology for Armitage and Cobalt Strike. This is the talk I gave after losing my voice.

Here’s the actual DEFCON talk:

If you’d like to get started with Cortana, Jason Frank has a great blog post showing how to load and use scripts.

A public collection of scripts is available on Github. To download the latest version of these scripts, type:

git clone https://github.com/rsmudge/cortana-scripts.git

If you’d like to write your own scripts, consult the tutorial to get started.

h1

Cortana: real-time collaborative hacking… with bots

August 3, 2012

At BSides Las Vegas, I talked about Force Multipliers for Red Team Operations. In this talk, I shared several stories about how my evil bots stole passwords, instantly installed back doors, and generally wreaked havoc on college students defending (sometimes) unpatched systems. Today, I’d like to introduce you to the technology behind this havoc: Cortana.

You may know Armitage: a red team collaboration tool built on the Metasploit Framework. Cobalt Strike is Armitage’s commercial big brother. Both packages include a team server. Through this team server, multiple hackers may control compromised hosts and launch attacks through one instance of the Metasploit Framework.

Inspired by my days on IRC in the 1990s, I wondered what would happen if I added bots to this collaborative hacking setup. This wondering (and a DARPA contract) led to Cortana, a scripting language for Armitage and Cobalt Strike.

Cortana Architecture

What can I do?

Using Cortana, you may develop stand-alone bots that join your red team. Cortana bots scan hosts, launch exploits, and work on compromised hosts without stepping on each other or getting in the way of their human teammates. Think of this system as Google Wave Apache Wave for hacking.

Cortana scripts may also extend the Armitage and Cobalt Strike clients with new features. Cortana scripts can expose hidden Metasploit features, integrate third-party tools and agents, or control other Cortana bots.

Start Here…

If you’ve ever written scripts for an IRC client such as mIRC, irssi, BitchX, or even jIRCii–you’ll find yourself right at home with Cortana. The best place to start is the Cortana Tutorial. This document is a 55-page tutorial, reference, and collection of examples.

If you’d like to get involved writing Cortana scripts, head over to the Cortana Scripts Github repository. Fork the repository and start hacking away. Several example scripts are available, right now, for your copying and pasting pleasure.

Developer Support

If you have questions, join the Cortana Hackers Mailing list. Send a blank message to cortana@librelist.com and you will be subscribed. You may send a message to cortana-unsubscribe@librelist.com to unsubscribe from the list.

If you’d like to connect on IRC with other Cortana hackers, join #armitage on irc.freenode.net.

Get It

Cortana is now available in Armitage 08.02.12 shipped in the Metasploit Framework. Type msfupdate and you have it. I hope I didn’t freak anyone out with my mega-large pull request.

The latest trial of Cobalt Strike has it too.

Cortana is BSD-licensed and is co-developed with Armitage. This work was made possible by a DARPA Cyber Fast Track contract.

I first announced Cortana at DEFCON 20. The slides from this presentation are available as well.

h1

Use Armitage and Cobalt Strike on Amazon’s EC2

July 10, 2012

James Webb has an interesting blog post on how to use Armitage to manage a pen test through Amazon’s Elastic Computing Cloud.

He does a good job articulating the benefits which include using Amazon’s EC2 to test your security from an outside in perspective or using it as a central point for a distributed red team to work from.

He also explains how to obtain authorization for penetration testing activities from Amazon. They do have a process for this and they’re very good about responding to these requests.

You can use Cobalt Strike or Armitage to work with Amazon’s EC2. If you use Cobalt Strike, I recommend using the quick-msf-setup script included with Cobalt Strike to quickly setup your environment. This process is described in the Cobalt Strike Linux Installation Instructions.

Also, when you run the teamserver, make sure you specify the external IP address of the EC2 node and not the private address bound to the network interface on the system. By specifying an external IP address, you’re telling the Metasploit Framework where it should send reverse connections to by default. It’s really important that this IP address is something your target systems can talk to.

Link