Speaker 1: Welcome back to the deep dive. Ready to dive into
Speaker 1: some ethical hacking today.
Speaker 2: Always ready, we're.
Speaker 1: Going to be looking specifically at red teaming. We've got
Speaker 1: a great guide for this one, the Hacker Playbook three
Speaker 1: by Peter Kim.
Speaker 2: Oh yeah, great book. It's like kind of flipping this script, right,
Speaker 2: learning to think like the bad guys exactly.
Speaker 1: So how would you explain red teaming for someone who
Speaker 1: might not be, you know, super familiar with it.
Speaker 2: It's kind of like, well, it's more than just you know,
Speaker 2: checking for vulnerabilities. It's more about like simulating a real.
Speaker 1: Attack, so like more than just a vulnerability scan.
Speaker 2: Right, It's like, okay, traditional pen testing that's like checking
Speaker 2: the locks on your doors, but red teaming that's like
Speaker 2: hiring someone to actually try and break into your house.
Speaker 1: Ethically of course, well, of course ethically. Yeah, that's a
Speaker 1: great analogy. So, like, how would that kind of approach
Speaker 1: actually benefit an organization?
Speaker 2: I think it just gives them a much better understanding of,
Speaker 2: you know, where their weaknesses are, like how an attacker
Speaker 2: would actually exploit those vulnerability.
Speaker 1: So it helps them prioritize right totally instead of just
Speaker 1: being like, oh, we have this vulnerability.
Speaker 2: It's like, okay, but how could someone actually.
Speaker 1: Exploit that makes sense? So what kind of tools would
Speaker 1: a red team or actually use in one of these
Speaker 1: simulated attacks.
Speaker 2: Oh, there's a ton of specialized tools this book talks about,
Speaker 2: like metasploit for example. Yeah, metasploit that's a framework for
Speaker 2: like developing and testing exploits. And then you got things
Speaker 2: like cobalt strike, which is like what they'd use after
Speaker 2: they've already gotten in to really move around.
Speaker 1: So Metasploit's kind of like the battering ram, and then
Speaker 1: cobalt strike is what they use once they're inside.
Speaker 2: Yeah, kind of like that. There's also Responder. It's a
Speaker 2: cool one. It takes advantage of how Windows networks talk
Speaker 2: to each other to like capture sensitive information.
Speaker 1: So like usernames and passwords.
Speaker 2: Yeah, exactly. Basically they're eavesdropping on the network.
Speaker 1: So just by being on a network, someone could like
Speaker 1: potentially snag my log in credentials potentially.
Speaker 2: Yeah, there are ways to mitigate that risk though.
Speaker 1: Okay, that's good to know. I'm already feeling a little
Speaker 1: vulnerable here, and we can't forget about passwords, right, those
Speaker 1: are still a huge target.
Speaker 2: Totally This book goes into like all the different ways
Speaker 2: attackers can crack passwords, route force attacks, dictionary attacks. It's
Speaker 2: pretty crazy.
Speaker 1: So a strong unique password is still like the best offense.
Speaker 2: It's one of the most important for sure. Like having
Speaker 2: a really good lock on your front door makes sense.
Speaker 1: So let's say our red teamer they've got their tools
Speaker 1: ready to go. What's the first step in one of
Speaker 1: these attacks.
Speaker 2: Reconnaissance. You's got to start with recon recon Yeah, reconnaissance
Speaker 2: gathering information about their target, like as much as possible.
Speaker 1: So they're basically spying on their target, but in a
Speaker 1: good way.
Speaker 2: Right, Like it's like a detective gathering evidence before they
Speaker 2: go make an arrest.
Speaker 1: That makes sense. So what kind of techniques do they
Speaker 1: use for that?
Speaker 2: Well, the book talks about things like n map. It's
Speaker 2: a tool that can scan networks see what ports and
Speaker 2: services are open.
Speaker 1: Okay, en map. What else?
Speaker 2: Oh, there's eyewitness That one takes screenshots of websites to
Speaker 2: get info about you know, how they're structured.
Speaker 1: So end map is like locking on the doors, seeing
Speaker 1: who answers, and then eyewitnesses like peeking through the windows exactly,
Speaker 1: pretty sneaky. What about cloud environments, Like, how do they
Speaker 1: factor into all of this?
Speaker 2: Cloud scanning is a big deal these days. There are
Speaker 2: tools that can find misconfigurations or like exposed data in
Speaker 2: the cloud.
Speaker 1: Makes sense since everything's moving to the cloud these days.
Speaker 2: Yeah, for sure. And then there's you know, subdomain discovery
Speaker 2: trying to find all those hidden parts of a website
Speaker 2: that might be vulnerable.
Speaker 1: So they're leaving no stone unturned. They're looking for weaknesses everywhere.
Speaker 2: Yep. That's the whole point of red teaming, simulating a
Speaker 2: real attack, which means finding any weakness they can.
Speaker 1: So I'm curious, is it all like technical vulnerabilities they're
Speaker 1: looking for or do they also use you know, social engineering?
Speaker 2: Oh, social engineer is huge. The book even gives an
Speaker 2: example of how they might use a like a phishing emails.
Speaker 1: Right, the classic try to trick you into clicking on a.
Speaker 2: Bad link yep, exactly, praying on people's you know, natural
Speaker 2: tendency to trust to be helpful.
Speaker 1: So even if someone's like pretty savvy with technology, they
Speaker 1: can still fall victim to these social engineering attacks.
Speaker 2: Totally, it's all about psychology, So it's not just about
Speaker 2: having you know, good tech defenses. It's also about educating people.
Speaker 1: Making sure everyone's aware of the risks.
Speaker 2: Exactly because the human element that's often the weakest link.
Speaker 1: Makes sense. So let's say hypothetically someone does fall victim
Speaker 1: to one of these phishing attacks.
Speaker 2: What happens next, Well, the attacker would want to you know,
Speaker 2: gain a foothold in the network and then start moving laterally,
Speaker 2: moving laterally, yeah, like spreading to other systems. They might
Speaker 2: use a tool like you know, Responder, which we talked
Speaker 2: about earlier, to grab credentials and get access to other accounts.
Speaker 1: So it's like a domino effect kind of.
Speaker 2: Yeah, one compromise system leads to another, and so on
Speaker 2: until they reach their final objective.
Speaker 1: Which could be anything I guess stealing sensitive data, disrupting operations.
Speaker 2: It depends on the attackers goals, but yeah, it could
Speaker 2: be pretty scary stuff. And they might even try to
Speaker 2: escalate their privileges. Yeah, you know, get admin access.
Speaker 1: So they can have even more control. Wow, it's a
Speaker 1: whole like a chess match, isn't it? Trying to stay
Speaker 1: one step ahead?
Speaker 2: It really is. It's a fascinating field.
Speaker 1: Well, we're definitely just scratching the surface here. We haven't
Speaker 1: even gotten into like NTLM hashes or you know all
Speaker 1: those other technical details.
Speaker 2: We'll save those for next time.
Speaker 1: Sounds good, Stay tuned for part two of our deep
Speaker 1: dive into red teaming. We'll be getting into even more
Speaker 1: of the the nitty gritty details.
Speaker 2: Can't wait back for more red teaming fun.
Speaker 1: Oh yeah, I'm hooked.
Speaker 2: Good. Good because we left off with our attacker getting
Speaker 2: a foothold.
Speaker 1: Remember, yeah, like sneaking through a window or something.
Speaker 2: Right now, they need to deploy some malware.
Speaker 1: And the Hacker playbook it mentioned something about custom droppers.
Speaker 2: Oh yeah, droppers. There's sneaky little things.
Speaker 1: I'm guessing it's more than just dropping a five.
Speaker 2: Somewhere way more. It's like, think of it like a trojan.
Speaker 1: Horse, ah, hiding the bad stuff inside something that looks
Speaker 1: harmless exactly.
Speaker 2: The Hacker Playbook actually walks through like building one from scratch.
Speaker 1: Wow, that's pretty hardcore. What's the what kind of malware
Speaker 1: are they hiding in there?
Speaker 2: Well, the example of the book, it's a payload that
Speaker 2: can either like execute shell code or load a DLL.
Speaker 1: Shell code DLLs I know I've heard those terms before.
Speaker 2: Right, So shell code that's basically a small program, but
Speaker 2: it can do some serious damage, okay. And a DLL
Speaker 2: DL stands for Dynamic Link Library. It's like a collection
Speaker 2: of code that other programs.
Speaker 1: Can use, So the attacker could like hijack a legitimate
Speaker 1: program using that DLL yep, or.
Speaker 2: Add malicious functionality to a program that's already there.
Speaker 1: Sneaky. I bet this stuff can get past antivirus pretty easily.
Speaker 2: Oh yeah, Antivirus evasion is a whole other game, and
Speaker 2: this book it dives deep into that too.
Speaker 1: Oh man, sounds complicated.
Speaker 2: It can be, but think of it like a like
Speaker 2: a cat mouse. You know, attackers are always coming up
Speaker 2: with new tricks and the antivirus guys are trying to
Speaker 2: stay one step ahead.
Speaker 1: So what are some of those tricks? How do they
Speaker 1: actually get around antivirus?
Speaker 2: Well, one common technique is obfuscation, like scrambling the code
Speaker 2: so the anti virus can't really understand what it's looking at.
Speaker 1: So it's like writing a secret message that only the
Speaker 1: attacker can read.
Speaker 2: Pretty much. The book also talks about code packing, which
Speaker 2: is like compressing and encrypting.
Speaker 1: The code, making it even harder to analyze yep.
Speaker 2: And then there's just straight up encryption too.
Speaker 1: So even if the anti virus does detect it, it
Speaker 1: can't really do anything unless it can decrypt it.
Speaker 2: Exactly. It's a constant arms rice.
Speaker 1: What if a company has like a really strict application
Speaker 1: white listing policy, can attackers get around that? Oh?
Speaker 2: Yeah they can. The hacker playbook actually shows how to
Speaker 2: do it, like using built in Windows programs to execute
Speaker 2: malicious code.
Speaker 1: Whoa, so they're taking a legitimate tool and twisting it
Speaker 1: to do something bad.
Speaker 2: Exactly. There's this one example with MS build dot ex.
Speaker 2: It's supposed to be for building software, but they can
Speaker 2: use it to run malicious code disguised as a project file.
Speaker 1: That's crazy. Are there other examples like that?
Speaker 2: Oh yeah, they're a bunch like REGSVR thirty two dot
Speaker 2: ex run to L thirty two dot ex. These are
Speaker 2: all programs that are already on Windows systems, so they
Speaker 2: often fly under the radar.
Speaker 1: So it's all about finding those loopholes huh yep.
Speaker 2: And once an attacker is in, they'll want to make
Speaker 2: sure they can stay in even if their initial access
Speaker 2: gets shut down.
Speaker 1: Ah So back doors exactly.
Speaker 2: Back doors ways to sneak back in if the front
Speaker 2: door is locked and.
Speaker 1: The hacker playbook. I'm guessing it has some tips on
Speaker 1: those two Oh.
Speaker 2: Yeah, tons of them, modifying system files, installing rootkits.
Speaker 1: Rootkits those are like the ultimate back door, right, They're
Speaker 1: pretty nasty.
Speaker 2: Basically, they're designed to like completely hide themselves.
Speaker 1: On the system, so the anti virus wouldn't even see them.
Speaker 2: Right, It's like they blend in perfectly.
Speaker 1: This is starting to feel like a spy movie a
Speaker 1: little bit.
Speaker 2: The book also talks about hijacking legitimate processes. So the
Speaker 2: malicious code is running, but it's hit and inside something
Speaker 2: that looks totally normal.
Speaker 1: This crazy stuff. How do they even come up with this?
Speaker 2: Well, they have to be creative, right, and they're always
Speaker 2: looking for new ways to, you know, to stay hidden.
Speaker 2: Like the book even mentions backdoors that communicate over DNS traffic.
Speaker 1: DNS traffic isn't that like just for looking up websites?
Speaker 2: Yeah, but it's also a way to like send commands
Speaker 2: and receive data, and security tools don't always pay close
Speaker 2: attention to it.
Speaker 1: Wow, So they're using like the Internet's plumbing system to
Speaker 1: sneak data.
Speaker 2: Out something like that.
Speaker 1: This is making my head spin. And you know what
Speaker 1: else I noticed in the Hacker Playbook. They seem to
Speaker 1: really love PowerShell.
Speaker 2: Oh yeah, PowerShell is like a favorite tool for both
Speaker 2: sissedminds and attackers. How come, Well, it's built into Windows,
Speaker 2: so it's already there on most systems. Yeah, and it's
Speaker 2: really powerful. You can do a lot with it.
Speaker 1: It sounds dangerous, it can be.
Speaker 2: Attackers can use it for everything from like automating tasks
Speaker 2: to downloading and running malicious code.
Speaker 1: And I bet it's good at evading those security tools huh.
Speaker 2: Oh yeah. The book has a whole section on PowerShell
Speaker 2: attack and evasion techniques, like, well, there's obfuscation, just like
Speaker 2: we talked about with regular code, but there's also encoding,
Speaker 2: which uses like different character sets and encryption.
Speaker 1: Making it even harder to understand.
Speaker 2: Yep. And they're always coming up the new ways to
Speaker 2: do it, you.
Speaker 1: Know, so even if someone knows to look out for PowerShell,
Speaker 1: it might not be that easy to spot exactly.
Speaker 2: Yeah. And the book even talks about how to run
Speaker 2: PowerShell code without actually using like the PowerShell program.
Speaker 1: Wait, what, how is that even possible?
Speaker 2: There are a few tricks. They can embed the code
Speaker 2: in other files like office documents or PDFs.
Speaker 1: So when you open the document, it just like runs
Speaker 1: in the background.
Speaker 2: Yep. And there are ways to use other programs like
Speaker 2: WMI to execute the code indirectly.
Speaker 1: So they're basically hiding it in plain sight.
Speaker 2: You got it.
Speaker 1: Okay, I'm starting to see how this PowerShell thing can
Speaker 1: be so dangerous. But let's go back to that two
Speaker 1: minute drill scenario for a second. Remember they got in
Speaker 1: with the fish attack.
Speaker 2: Oh yeah, I'm curious what happens next.
Speaker 1: Me too. So they're in the network, now what.
Speaker 2: Well, the next step involves a tool called Bloodhound.
Speaker 1: Bloodhound sounds intense.
Speaker 2: It is. It's designed to map out active directory.
Speaker 1: Active directory that's how Windows networks manage users and computers.
Speaker 2: Right, yep. And Bloodhound basically shows the attacker like all
Speaker 2: the relationships and permissions. It's like a roadmap of the network.
Speaker 1: Whoa, So they can see exactly how everything's connected pretty much.
Speaker 2: Yeah, and that helps them figure out the best way
Speaker 2: to move around to get to their target.
Speaker 1: That's kind of scary, actually can be.
Speaker 2: So in the book The Attacker, they compromise a system
Speaker 2: belonging to an employee named buzz Aldron.
Speaker 1: Buzz Aldron, like the astronaut yep.
Speaker 2: I guess the author has a sense of humor. So
Speaker 2: what happens with Buzz, Well, they find out that Buzz's
Speaker 2: system has access to some sensitive data on another system
Speaker 2: called CSK lab, but they don't have admin rights on
Speaker 2: that system.
Speaker 1: Yet another roadblock yep.
Speaker 2: The is this PowerShell script called power up to find
Speaker 2: misconfigurations on the system.
Speaker 1: So they're looking for those little new poles again.
Speaker 2: Yep, always looking for loopholes, and in this case, they
Speaker 2: find a vulnerability that lets them like basically write their
Speaker 2: own code to a specific location and then a system
Speaker 2: service will execute.
Speaker 1: It, so they get full control over the system pretty much.
Speaker 2: They call it system level access.
Speaker 1: Wow, impressive, but what about like staying in control? What
Speaker 1: if they lose their initial access?
Speaker 2: Redundancy is key in the book. They establish a second
Speaker 2: connection using Cobalt Strike.
Speaker 1: Always got to have a backup plan always.
Speaker 2: Cobalt Strike can tunnel traffic through these things called named pipes,
Speaker 2: which are like hidden communication channels within the.
Speaker 1: Network, so even if one connection goes down, they still
Speaker 1: have another way in exactly, this attacker is pretty persistent.
Speaker 1: I was reading ahead a bit, and they actually find
Speaker 1: the eternal Blue vulnerability. The one that want to Cry use.
Speaker 2: Oh yeah, Eternal Blue. That was a big one, a
Speaker 2: really bad vulnerability window.
Speaker 1: I remember hearing about want to Cry. It was all
Speaker 1: over the news. Caused a ton of damage.
Speaker 2: Yep, ransomware spreading like wildfire. And in the Hacker playbook,
Speaker 2: the attacker uses Eternal Blue to get into a semi
Speaker 2: isolated network.
Speaker 1: So even though it was years ago, that vulnerability is
Speaker 1: still out there.
Speaker 2: Yep. Sometimes systems don't get patched and attackers can take
Speaker 2: advantage of that.
Speaker 1: Crazy So back to our two minute drill. They've got
Speaker 1: Eternal Blue. Now they're in deeper, getting closer to those
Speaker 1: rocket secrets. What happens next?
Speaker 2: To find a connection to a database server. It's got
Speaker 2: even more sensitive data, but of.
Speaker 1: Course it's encrypted.
Speaker 2: Of course, there's always another hurdle.
Speaker 1: And does the book tell us how they crack the encryption.
Speaker 2: It actually leaves that part as a challenge for the reader.
Speaker 2: But based on everything we've learned so.
Speaker 1: Far, I bet we can guess.
Speaker 2: Oh yeah, there are a few possibilities they could try
Speaker 2: to find, like a backdoor in the database software itself,
Speaker 2: you know, some kind of vulnerability, or.
Speaker 1: Maybe try to steal the encryption key could.
Speaker 2: Be maybe by by compromising another system that has access
Speaker 2: to the key.
Speaker 1: Lots of possibilities, and I guess there's always route forcing,
Speaker 1: but that could take forever.
Speaker 2: It could. Yeah, it all depends on how strong the
Speaker 2: encryption is.
Speaker 1: Man, this is intense. I feel like I'm right there
Speaker 1: with the attacker trying to figure out the next move.
Speaker 2: That's the whole point of this book, you know, to
Speaker 2: get you thinking like an attacker so you can understand
Speaker 2: how they operate and how to defend against them.
Speaker 1: It's working. I'm definitely thinking differently about security now.
Speaker 2: Good, that's what we want.
Speaker 1: Well, we've covered a lot of ground malware, back doors, PowerShell,
Speaker 1: eternal glue.
Speaker 2: My head is spinning and we're not done yet. We
Speaker 2: still to talk about password cracking, how attackers break those
Speaker 2: digital locks and get access to sensitive information. That's coming
Speaker 2: up in part three.
Speaker 1: Can't wait. This has been a wild ride so far.
Speaker 1: All right, back for the final.
Speaker 2: Round, Round three. Ready to rumble.
Speaker 1: So we've made it to the part I've been kind
Speaker 1: of dreading password cracking.
Speaker 2: Yeah, this is where it gets real.
Speaker 1: I mean, we've already talked about how attackers use those
Speaker 1: huge password lists and powerful cracking rigs.
Speaker 2: Mind boggling, right totally.
Speaker 1: I mean, where do those lists even come from? Are
Speaker 1: we talking about like every password ever used?
Speaker 2: Pretty much? Think about all the data breaches that happen,
Speaker 2: all those stolen passwords, they end up online and attackers
Speaker 2: collect them.
Speaker 1: So it's like they're learning from all our bad password
Speaker 1: habit exactly.
Speaker 2: The Hacker playbook talks about this one list. It's got
Speaker 2: over one point four billion username and password combinations. One
Speaker 2: point four billion.
Speaker 1: That's insane. But even with a list that big, they
Speaker 1: still need some serious horsepower to actually crack them, right.
Speaker 2: Oh yeah, we're not talking about your average laptop here.
Speaker 2: These are dedicated cracking rigs with multiple GPUs.
Speaker 1: Like the kind of stuff gamers use, similar.
Speaker 2: But way more powerful. They're basically building supercomputers just for this.
Speaker 1: Wow. So brute force is obviously a big part of it.
Speaker 1: But is that all they do.
Speaker 2: Nope, They've got other tricks up their sleeves too, like
Speaker 2: dictionary attacks.
Speaker 1: Dictionary attack.
Speaker 2: Yeah, they use a list of like common words and
Speaker 2: frey is that people use in their passwords, so.
Speaker 1: They're not just randomly guessing letters, they're actually trying real
Speaker 1: words yep.
Speaker 2: And then there are rule based attacks where they take
Speaker 2: those dictionary words and modify them, like replacing an A
Speaker 2: with an AD symbol.
Speaker 1: So it's a mix of brute force and strategy exactly.
Speaker 2: The more they understand about the target system and how
Speaker 2: it hashes passwords, the more effective their attacks can be.
Speaker 1: Makes sense. So let's bring it back to that two
Speaker 1: minute drill scenario. Our attacker is facing down that encrypted database.
Speaker 1: How do they crack it?
Speaker 2: Well, the book doesn't actually spell it out. It leaves
Speaker 2: it as a challenge.
Speaker 1: Ooh, a cliffhanger, but we can speculate. Okay, let's put
Speaker 1: on our hacker hats for a minute. What are some possibilities.
Speaker 2: One option would be to look for vulnerabilities in the
Speaker 2: database software.
Speaker 1: Itself, like a back door that lets them bypass the
Speaker 1: encryption altogether exactly.
Speaker 2: Or maybe a way to like extract the encryption key
Speaker 2: from somewhere.
Speaker 1: Ah, that would be a nice shortcut. But how would
Speaker 1: they do that?
Speaker 2: Could be a lot of ways. Maybe they compse a
Speaker 2: system that has access to the key, or use a
Speaker 2: key logger to capture it when someone types it in.
Speaker 1: Wow, sneaky. It's all about finding the weakest link, huh.
Speaker 2: Yep. And of course they can always just try brute
Speaker 2: forcing the encryption key itself.
Speaker 1: With the supercomputers the very same.
Speaker 2: It might take a while, though, depending on how strong
Speaker 2: the encryption is.
Speaker 1: Okay, so even encryption isn't a silver bullet, it's more
Speaker 1: like buying time.
Speaker 2: Yeah, it makes the attackers job harder, but it doesn't
Speaker 2: make them impossible.
Speaker 1: Well, this has been an eye opening journey, to say
Speaker 1: the least.
Speaker 2: I agree. We've covered a lot of ground, haven't we.
Speaker 1: From creating malware to exploiting vulnerabilities to cracking passwords. It's
Speaker 1: amazing how creative and determined these attackers can be.
Speaker 2: That's why it's so important for us to understand their
Speaker 2: methods so we can defend against them totally.
Speaker 1: The Hacker Playbook three is a great resource for that,
Speaker 1: even if it's a little scary at times.
Speaker 2: Yeah, it definitely makes you think twice about your own
Speaker 2: security for sure.
Speaker 1: Well, thanks for guiding us through this deep dive. It's
Speaker 1: been fascinating, if a little unsettling, My pleasure.
Speaker 2: Remember, folks, stay vigilant, keep learning, and always choose strong passwords.
Speaker 1: Words to live by. We'll see you next time on
Speaker 1: the deep dive