WEBVTT 00:00:02.640 --> 00:00:05.020 Welcome to Initial Access with Luckystrike. 00:00:05.110 --> 00:00:08.370 My name is Dr Josh Stroschein, and I'll be your instructor for this course. 00:00:09.240 --> 00:00:12.150 Luckystrike brings all your pain in one macro. 00:00:12.810 --> 00:00:16.700 This is a tool created by Jason Lang, also known as Curious Jack, 00:00:16.710 --> 00:00:19.750 and is designed to be an all‑in‑one solution for 00:00:19.760 --> 00:00:21.650 managing your malicious Office documents. 00:00:22.140 --> 00:00:24.040 It will allow you to use templates, 00:00:24.350 --> 00:00:27.090 add and manage different payloads, and includes 00:00:27.090 --> 00:00:29.350 features to help with antivirus evasion. 00:00:30.080 --> 00:00:31.350 So, what is Luckystrike? 00:00:31.840 --> 00:00:33.350 Well, it's a PowerShell framework, 00:00:33.360 --> 00:00:36.160 so we're going to need a host that allows you to run PowerShell. 00:00:36.600 --> 00:00:39.900 I'll primarily be using a Windows 10 virtual machine for this course. 00:00:40.640 --> 00:00:43.560 The source code is available on GitHub, as well as the 00:00:43.560 --> 00:00:45.550 documentation and an issue tracker. 00:00:46.090 --> 00:00:47.630 So if you run into any issues, 00:00:47.630 --> 00:00:50.710 a good place to start will be to look at the documentation and 00:00:50.710 --> 00:00:53.320 then to review any issues to see if anyone's already submitted 00:00:53.320 --> 00:00:54.380 the issue that you're seeing. 00:00:54.880 --> 00:00:55.270 Of course, 00:00:55.270 --> 00:00:58.910 you can also submit your own issue and look for help that way. The main 00:00:58.910 --> 00:01:02.340 purpose of this tool is to generate malicious Office documents, and you'll 00:01:02.340 --> 00:01:06.610 see as we get into the tool itself, that it is primarily up to you to decide 00:01:06.610 --> 00:01:10.580 how to add the payloads that will be the functionality that the malicious 00:01:10.580 --> 00:01:12.550 Office document actually entails. 00:01:13.340 --> 00:01:16.240 I'll demonstrate a couple of popular frameworks to help with this. 00:01:16.940 --> 00:01:18.940 We'll also discuss how you can use templates. 00:01:18.950 --> 00:01:19.840 So, for example, 00:01:19.840 --> 00:01:22.590 you can create a malicious Office document that uses one of your favorite 00:01:22.590 --> 00:01:26.710 social engineering images or images that may be tied to a certain campaign, 00:01:26.710 --> 00:01:30.280 add those to the system, and then reuse those templates so that you don't 00:01:30.280 --> 00:01:32.250 have to add the image manually every time. 00:01:33.040 --> 00:01:35.970 As I mentioned, how effective you are utilising Luckystrike 00:01:35.970 --> 00:01:38.090 will come in your ability to add payloads, 00:01:38.100 --> 00:01:39.970 and we'll get into the details throughout the course. 00:01:41.040 --> 00:01:41.410 Finally, 00:01:41.410 --> 00:01:44.740 there are some antivirus evasion techniques. Generating 00:01:44.740 --> 00:01:47.330 malicious Office documents and testing that they're able to 00:01:47.330 --> 00:01:49.300 not only bypass any security tools, 00:01:49.300 --> 00:01:52.940 but also the techniques that they are leveraging will become very important, 00:01:53.060 --> 00:01:56.100 and how successful your malicious Office documents will really boil down 00:01:56.100 --> 00:01:59.180 to how effective they are bypassing the security tools. 00:01:59.940 --> 00:02:02.870 If we look at malicious Office documents in relation to the kill chain, 00:02:02.990 --> 00:02:06.650 you'll see that they typically fall somewhere between exploit and escalate as 00:02:06.650 --> 00:02:10.500 part of the C2. While some malicious Office documents can in fact use and 00:02:10.500 --> 00:02:14.800 exploit in order to achieve code execution, oftentimes they're relying on the 00:02:14.800 --> 00:02:17.110 host and its already inherent capabilities, 00:02:17.320 --> 00:02:20.670 such as the use of PowerShell or simply straight macros, in order to 00:02:20.670 --> 00:02:24.170 execute code and callback to a command and control node to receive the 00:02:24.170 --> 00:02:26.650 next stage payload and further instructions. 00:02:27.140 --> 00:02:29.480 It's at this point that the attacker has the initial 00:02:29.480 --> 00:02:30.810 foothold into the environment, 00:02:31.440 --> 00:02:33.940 and it's now up to the rest of your red team tools and 00:02:33.940 --> 00:02:36.510 frameworks in order to escalate, move laterally, 00:02:36.520 --> 00:02:40.460 evade detection, and perform any desired actions in the target environment. 00:02:42.020 --> 00:02:44.990 Let's now take a look at MITRE ATT&CK and see where our tool 00:02:44.990 --> 00:02:47.670 fits in. For malicious Office documents, 00:02:47.670 --> 00:02:52.690 they fall under initial access or technique T1566 Phishing, 00:02:52.890 --> 00:02:57.550 sub‑technique T1566.001 Spearphishing Attachment. 00:02:58.390 --> 00:03:01.720 A common use case scenario with malicious Office documents is to send them 00:03:01.720 --> 00:03:04.450 as an attachment to an email against an organization, 00:03:04.840 --> 00:03:08.560 whether that's very broadly or very targeted against specific users. 00:03:09.620 --> 00:03:12.540 The goal is to get that malicious Office document in front of the user 00:03:12.680 --> 00:03:17.130 and to have them enable the content to execute the macros, or in the 00:03:17.130 --> 00:03:20.720 case that it contains an exploit, to open the document so that the 00:03:20.720 --> 00:03:21.990 exploit could be utilized. 00:03:24.290 --> 00:03:27.550 So let's go through this scenario in a little bit more detail. If we 00:03:27.550 --> 00:03:30.240 begin with our malicious Office document being sent to a target 00:03:30.240 --> 00:03:34.610 organization, if that Office document is able to bypass any security 00:03:34.610 --> 00:03:36.900 tools or initial email filtering, 00:03:37.440 --> 00:03:39.950 then it makes it into the in box of our unsuspecting user. 00:03:41.340 --> 00:03:43.610 If our malicious Office document has made it this far, 00:03:43.820 --> 00:03:47.970 we may have some additional security to consider, oftentimes the 00:03:47.970 --> 00:03:50.160 endpoint security running on the host itself. 00:03:50.470 --> 00:03:53.300 If the malicious Office document has been crafted in a way that it 00:03:53.300 --> 00:03:55.750 can avoid detection from the endpoint security, 00:03:55.980 --> 00:03:58.450 then our user has the ability to interact with it. 00:03:58.930 --> 00:04:02.270 If that user opens the document and enables the content, now 00:04:02.270 --> 00:04:05.610 they've provided that initial foothold, the entry point for the 00:04:05.610 --> 00:04:07.550 attacker, into that environment. 00:04:08.190 --> 00:04:10.730 The malicious Office document will drop its initial payload, 00:04:10.730 --> 00:04:14.920 which will connect back to the adversary C2, and now the adversary has 00:04:14.920 --> 00:04:17.470 the ability to start performing its next stage goals, 00:04:17.769 --> 00:04:20.470 such as privilege escalation, moving laterally, 00:04:20.600 --> 00:04:24.250 establishing persistence, and setting up for the next phase of the attack. 00:04:24.900 --> 00:04:27.370 In this course, I'll be using two virtual machines. 00:04:27.600 --> 00:04:30.530 The first will be a Windows 10, which will be my primary 00:04:30.530 --> 00:04:32.550 for installing and utilizing Luckystrike. 00:04:33.080 --> 00:04:34.480 The second will be Kali Linux, 00:04:35.640 --> 00:04:38.570 and we'll use that later in the course to help generate some payloads 00:04:38.570 --> 00:04:40.650 that we can use within the Luckystrike framework. 00:04:41.580 --> 00:04:43.600 Now that you have a high‑level understanding of what 00:04:43.600 --> 00:04:46.550 Luckystrike is as a framework and the capabilities that can 00:04:46.550 --> 00:04:48.340 provide you as a penetration tester, 00:04:48.710 --> 00:04:52.100 let's get hands‑on with several demos that will gain you proficiency in 00:04:52.100 --> 00:04:55.570 utilizing Luckystrike to generate your malicious Office documents.