>> Hey guys, welcome back
to the cyber kill chain costs on Cybrary.
This is Abdulrahman A. Alnaim and
today we're covering command and control.
We went through the cyber kill chain,
we did our constants,
we gathered as much information as possible.
We moved on to optimization where we
created our payload using MSFVenom,
and then we moved on to delivery where we created
a social engineering attack
using the social engineering toolkit.
Then we exploited the human weakness in our systems.
Every company, every entity,
every organization has the human weakness,
vulnerability so we exploited that,
and then we moved on to installation and we
installed our payload on the victim's machine.
Now that the payload is installed
>> on the victim machine,
>> we need to start communicating with that.
That's when command and control came in the picture.
What we're trying to do is we're trying to continue
our target attack and
communicate with the payload to get more information.
Now my payload is inside the victim's machine
>> or zoomed the victim machine.
>> You can imagine this as an extension
of the victim's keyboard on the attacker's side.
I can command as I like, I can scan the network,
I can scan the victim's work station,
and that's the whole purpose of command and
control continue my operations.
There's a number of ways to do that.
Remote administration tool is one of them, RAT.
There's a tool called
RAT and it's one of the most popular.
The one we're using the MS
console and interpreter is a very popular.
Another popular example however,
and a lot of companies going through
this option is extremely difficult
because they have good protection tools
and good security on their side.
So hackers have to be creative.
They came up with an idea to use IRC protocol
>> and kind of chat with their basically payload
>> or that asset inside the network.
So what they're doing is they're
using the protocol to chat with the payload and send
the commands to it for the payload to run.
However, not a lot of companies
and organizations use IRC protocols,
it's not that popular in the corporate world.
So if a company has a good security operations center,
they will easily discover something or
communication going out of
the environment using IRC protocol.
However, if there's something that
is not really detected, or even if it was detected,
a lot of people would assume it would
be a legitimate connectivity,
and that's social media.
If a machine within
an environment is communicating with Twitter,
a lot of people would not assume that it is
communicating with an adversity or an attacker,
and that's exactly what hacker did.
They created a Twitter account that would publish
or tweet commands that are
then read by the payload and run
within the victim's environment
the connectivity is through Twitter.
So even if the payload wants to return something, it
will tweet it on Twitter.
This is one of the more creative ways
of doing command and controls.
But the idea here is to show you how
creative hackers and attackers can get.
Let's go back to our example.
We have our session here opened,
and what I want to do
is I want to see the options that I have.
As I said, there's a lot of options.
I can record, I can webcam chat,
list to webcams if there's any webcam of available.
I can run a key scan and see what kind of
things the person is writing.
I can get this info and shut
down the machine, plant a shell on
the victim's side, and so on.
So there's a lot of things that I can do here.
Some of them, such as hash dump,
I can get the hash dump
of the contexts of the sum database and then
start cracking on my side hoping to
get the local admin password.
Just to ensure connectivity, let's do with this info,
so I do have a connectivity with a Windows 10 machine.
I have the good information and so on.
But let's do a screenshot to ensure that I'm
actually running an actual machine
and not just a honeypot.
So we have the screenshot now.
Let's copy it and display it.
That's a screenshot of the victim's machine.
As you sure you remember,
this was the last page that we went to.
Okay, so I can run shell and then I have
a connectivity to the machine shell-code.
So I can run command prompt
from this machine on the machine on the other side.
Okay, so we're going to get more into
this in action on objectives.
However, to make sure
that we covered command and control correctly,
Let's go through these post-assessment questions.
So what is the main purpose
of the command and control phase?
As I said, the command that control phase,
main goal or main purpose is to have
connectivity to my asset and side,
>> the victim's network.
>> This would give me the opportunity to continue
my operations and continue
the attack from my remote session.
Second question is, why do I need command and control?
Because if I don't have command and controls,
I would have to design my malware in a way
that would go through everything that I
want and send it back to education.
I won't have the capability
to explore or extend my explanation.
So I can't go and get one thing out and come back,
and that's one thing.
However, if I can get more information
as an attacker and expand my attack,
that would be a lot better
from the attacker's obviously point of view.
Finally, direct access is a must
to have a successful command and control.
As we discussed, this is not really the case.
Remember the Twitter account and the
Twitter tweeting the commands
>> from the command and control center
>> to the payload inside the network.
So connectivity between the payload
and the attacker is not necessary at all time.
Hackers are more creative than just
basically used one way of
communicating with their assets inside the environment.
Okay, so on today's episode
we covered command and control.
In the next episode,
we move on to the last phase of the cyber kill chain.
We will cover action on objectives. See you then.