WEBVTT 00:00:01.440 --> 00:00:02.420 Welcome to the course, 00:00:02.430 --> 00:00:06.900 Discovery with Seatbelt. In here, you'll learn how to gather 00:00:06.900 --> 00:00:09.950 information about your targets using the Seatbelt tool. 00:00:11.140 --> 00:00:13.750 So, imagine you're working on a red team engagement. 00:00:14.440 --> 00:00:16.740 Your client has a few user laptops, 00:00:16.750 --> 00:00:20.500 a domain controller, and a few databases, and let's say you're 00:00:20.500 --> 00:00:24.250 able to compromise one of the user laptops and from there you 00:00:24.250 --> 00:00:26.060 get access to one of the databases. 00:00:26.940 --> 00:00:29.760 That's pretty cool, right? But what should we do next? 00:00:30.340 --> 00:00:32.180 Well, you could try to move laterally, 00:00:32.189 --> 00:00:34.280 you could try to escalate your privileges or even 00:00:34.280 --> 00:00:36.060 start to do some data exfiltration. 00:00:36.840 --> 00:00:39.890 But to do all those things, you need first to understand the 00:00:39.890 --> 00:00:44.070 environment. You need to enumerate things like the local users, 00:00:44.080 --> 00:00:48.420 the domain users, group permissions, operating system information, 00:00:48.430 --> 00:00:52.260 browsing history, antivirus information, and much more. 00:00:53.040 --> 00:00:56.450 This information will help you to plan your next steps and 00:00:56.450 --> 00:00:59.680 ensure that you have a good plan to move laterally and execute 00:00:59.690 --> 00:01:01.350 any objectives you might have in mind. 00:01:02.440 --> 00:01:05.560 And although you could do all that discovery mentally, it would take a lot of 00:01:05.560 --> 00:01:11.270 time. For this reason, we have the Seatbelt tool. Seatbelt is a tool 00:01:11.280 --> 00:01:15.820 developed a Will Schroeder and Lee Christensen. You might recognize them by 00:01:15.820 --> 00:01:20.160 their handles, @harmJ0y and @tifkin_. They're really famous in the 00:01:20.160 --> 00:01:24.350 cybersecurity community and they have a lot of interesting red team tools, so 00:01:24.360 --> 00:01:29.240 I definitely recommend you checking out some of their work. Seatbelt is a C# 00:01:29.250 --> 00:01:33.400 tool that performs a number of security queries in a system and returns data 00:01:33.410 --> 00:01:37.870 that is relevant for both offensive and defensive teams. As you'll see in the 00:01:37.870 --> 00:01:41.890 demos of this course, with just one tool we can perform a lot of discovery 00:01:41.890 --> 00:01:46.760 queries, and this will allow you to better understand your target and plan 00:01:46.760 --> 00:01:48.850 the next steps in your red team engagement. 00:01:50.540 --> 00:01:53.080 What I love about Seatbelt is that it's an open source 00:01:53.080 --> 00:01:55.900 software, meaning that you can download it from GitHub and 00:01:55.900 --> 00:01:57.760 modify the code as much as you want. 00:01:58.440 --> 00:01:59.290 As I mentioned, 00:01:59.360 --> 00:02:02.300 Seatbelt automates several discovery tasks that can be 00:02:02.310 --> 00:02:03.960 interesting for a red team engagement. 00:02:04.940 --> 00:02:08.880 Actually, just so you have an idea, the Seatbelt tool has over 100 00:02:08.880 --> 00:02:12.850 discovery modules, including local and domain user enumeration, 00:02:13.240 --> 00:02:15.810 privilege mapping, antivirus detection, 00:02:15.820 --> 00:02:20.260 operational system reconnaissance, browser history enumeration, and much more. 00:02:21.940 --> 00:02:25.510 If you're familiar with the kill chain methodology, we can use Seatbelt from 00:02:25.520 --> 00:02:28.750 after the exploitation phase all the way to the action phase, 00:02:29.440 --> 00:02:33.040 meaning that after exploiting your machine, we can use the Seatbelt tool to 00:02:33.040 --> 00:02:35.990 discover information that will help us in privilege escalation, 00:02:36.010 --> 00:02:38.950 lateral movement, defensive evasion, and much more. 00:02:40.340 --> 00:02:44.130 Also, if you're familiar with the MITRE ATT&CK framework, we can map this 00:02:44.130 --> 00:02:48.450 course to the discovery phase of this framework. Inside of discovery, 00:02:48.450 --> 00:02:50.850 we'll be focusing on three main techniques. 00:02:51.540 --> 00:02:57.560 The first one is the T1518:001, which is security software discovery, 00:02:58.340 --> 00:03:02.090 and this means that we use Seatbelt to find out if the machine has any 00:03:02.090 --> 00:03:04.760 kind of antivirus or any other defense tool. 00:03:06.240 --> 00:03:09.840 The second technique that we'll cover is the T1082, 00:03:09.850 --> 00:03:11.880 which is system information discovery, 00:03:11.890 --> 00:03:14.990 meaning that we'll use Seatbelt to find information about the operational 00:03:14.990 --> 00:03:19.590 system running on the machine. And last, but also really important, we will 00:03:19.590 --> 00:03:25.840 cover the technique T1087, which is account discovery. In there, we'll use 00:03:25.840 --> 00:03:30.820 Seatbelt to discover both local accounts and domain accounts. And although 00:03:30.820 --> 00:03:34.000 those are the three main techniques for this course, as you'll see in our 00:03:34.000 --> 00:03:38.490 demos, you can use Seatbelt to execute over 10 different MITRE techniques, and 00:03:38.490 --> 00:03:39.550 that's why I love this tool. 00:03:41.340 --> 00:03:43.650 So before going to our demo, let's take a minute to 00:03:43.650 --> 00:03:45.150 understand what we'll be doing in there. 00:03:45.840 --> 00:03:49.350 You are in a red team engagement and you just got access to a machine in 00:03:49.350 --> 00:03:53.510 the domain. As you need to expand your footprint, you need to discover 00:03:53.510 --> 00:03:57.720 information about the environment so you can plan your next attacks. With 00:03:57.730 --> 00:04:01.110 access to this machine, we'll use Seatbelt to gather tons of information 00:04:01.110 --> 00:04:05.230 about the machine and the domain, including local and domain users, group 00:04:05.230 --> 00:04:07.700 permissions, operational system information, 00:04:07.730 --> 00:04:10.770 browsing history, and even enumerating the antivirus 00:04:10.770 --> 00:04:11.860 that is installed in the machine. 00:04:13.340 --> 00:04:16.510 Also, if you want to follow this demo on your own environment, you 00:04:16.510 --> 00:04:21.500 just need one machine, which is your victim machine. In here, I'm 00:04:21.500 --> 00:04:25.320 using a Windows 2016 Server, but it could be any Windows machine 00:04:25.320 --> 00:04:27.550 you want. And that's it. 00:04:27.560 --> 00:04:29.060 That's all we need for this demo. 00:04:29.540 --> 00:04:32.640 So, enough of theory. Let's go to our lab environment and see 00:04:32.640 --> 00:04:34.360 how this technique is done in real life.