WEBVTT 00:00:07.000 --> 00:00:10.970 So this is the Infection Monkey AMI in the AWS Marketplace, 00:00:10.970 --> 00:00:13.960 and I wanted to show this to you guys because in my opinion, 00:00:13.960 --> 00:00:18.150 hosting it out of AWS is, if you have access to an AWS account, 00:00:18.350 --> 00:00:22.800 is really the fastest way to get the Monkey Island server up and going 00:00:23.310 --> 00:00:28.010 without having to download it yourself and try to install it. 00:00:28.150 --> 00:00:32.100 I find that when I try to install it on my local platform, 00:00:32.100 --> 00:00:36.220 whether it be Windows or Linux based, there are usually dependencies missing, 00:00:36.220 --> 00:00:38.540 and it makes the agent malfunction. 00:00:38.760 --> 00:00:41.560 So this is the most seamless solution that I have found. 00:00:41.730 --> 00:00:44.010 It is free‑tier eligible, 00:00:44.010 --> 00:00:47.010 you do only need to have it spun up when you're actively using it; otherwise, 00:00:47.010 --> 00:00:51.660 you can power down, so your data operations charges will go down. 00:00:52.180 --> 00:00:54.140 However, it is Linux/Unix based, 00:00:54.140 --> 00:00:57.850 so you do have to host it on a Linux instance inside AWS. 00:00:58.540 --> 00:01:02.400 But it's really easy to configure, you can launch it with just a few clicks. 00:01:02.400 --> 00:01:04.000 You just click Continue twice, 00:01:04.640 --> 00:01:08.140 and then if you're going to host in a region that's not North Virginia, 00:01:08.350 --> 00:01:12.260 you do need to specify that here because the AMI ID 00:01:12.260 --> 00:01:16.060 will change in that case; however, I host mine out of North Virginia, 00:01:16.060 --> 00:01:17.620 so this is the same for me. 00:01:17.750 --> 00:01:20.290 And then all you would do is click Continue to Launch, 00:01:20.940 --> 00:01:24.930 and it will launch the server automatically in an EC2 00:01:24.930 --> 00:01:26.750 instance running in your environment. 00:01:27.190 --> 00:01:31.240 Now the two things take to note of here are the IPv4 00:01:31.240 --> 00:01:35.470 Oublic IP address and the Instance ID. 00:01:35.480 --> 00:01:39.150 You will need both of these things to access the GUI aspect of 00:01:39.150 --> 00:01:42.280 Infection Monkey if you're hosting it in AWS. 00:01:42.440 --> 00:01:46.530 So all you would do to get to the GUI client is navigate to 00:01:46.530 --> 00:01:50.250 your public IPv4 address on port 5000. 00:01:50.640 --> 00:02:03.150 So for that, we're just going to go to 52.7.229.62 on port 5000. 00:02:04.640 --> 00:02:07.130 It will give you this error, it'll say your collection is not private. 00:02:07.130 --> 00:02:11.350 You're going to want to click advanced and proceed anyway. 00:02:11.910 --> 00:02:15.250 You're hosting the server yourself, so you know it's safe. 00:02:15.250 --> 00:02:20.550 Once it loads, you do have to log in in order to access the GUI. 00:02:20.850 --> 00:02:25.150 So the username is always going to be Monkey, 00:02:26.040 --> 00:02:31.450 and then your password is going to be that instance ID from the EC2 instance. 00:02:32.140 --> 00:02:33.980 So I'm just going to come down here and copy mine, 00:02:36.390 --> 00:02:39.520 and we're going to plug that in, and voila, 00:02:39.530 --> 00:02:42.350 we are inside our Monkey Island server. 00:02:42.740 --> 00:02:44.400 From here, this is the home page. 00:02:44.400 --> 00:02:45.910 There's not really a lot to this page, 00:02:45.910 --> 00:02:47.990 but what you're going to want to do is immediately come to 00:02:47.990 --> 00:02:51.070 the Run Monkey tab because that's where you're either going 00:02:51.070 --> 00:02:54.450 to get the payload to run it, or you can configure it. 00:02:54.940 --> 00:02:55.410 Now, 00:02:55.420 --> 00:02:58.500 depending on whether or not you're going to be running it on the same 00:02:58.500 --> 00:03:00.760 machine where you're hosting your island server, 00:03:00.760 --> 00:03:03.470 so if that's your local, if you're hosting it on your local machine, 00:03:03.480 --> 00:03:05.870 and that's also the machine you want to start the Monkey on, 00:03:06.150 --> 00:03:07.610 you can just click that button. 00:03:07.620 --> 00:03:11.270 There's no copying and pasting, no interacting with the command shell at all, 00:03:11.270 --> 00:03:16.380 and it'll run automatically, or if you're going to run it on an AWS EC2 instance, 00:03:16.740 --> 00:03:17.670 it's a different payload, 00:03:17.670 --> 00:03:20.850 so you would need to click that button in order to get that payload. 00:03:21.240 --> 00:03:22.250 However, 00:03:22.640 --> 00:03:26.640 we're going to be using the Run on a machine of your choice option because 00:03:26.640 --> 00:03:29.970 we're going to set it loose on two VMs that I'm hosting, 00:03:29.970 --> 00:03:32.240 but if you're going to configure the Monkey, 00:03:32.240 --> 00:03:34.800 you need to do it here before it's run, 00:03:34.800 --> 00:03:38.450 or the configuration changes won't save to the active agent. 00:03:40.140 --> 00:03:45.980 Here on the ATT&CK tab, we have the MITRE ATT&CK‑aligned techniques identified, 00:03:46.110 --> 00:03:49.010 and the dark‑green ones are mandatory in order for 00:03:49.010 --> 00:03:51.630 the payload to propagate properly, 00:03:51.630 --> 00:03:56.030 but the light‑green ones you do have the option to include or exclude, 00:03:56.030 --> 00:04:00.130 depending on whether or not you're trying to retest for a specific 00:04:00.130 --> 00:04:03.800 tactic to see if a remediation control is working or not, 00:04:04.110 --> 00:04:05.970 and to do that, you would simply select it. 00:04:05.980 --> 00:04:09.550 Now, certain modules are dependent on certain other modules; however, 00:04:09.550 --> 00:04:11.800 if you're not testing for credential dumping, 00:04:12.020 --> 00:04:13.440 you can de‑select those. 00:04:13.500 --> 00:04:16.050 So you have a number of configuration options with ATT&CK. 00:04:16.110 --> 00:04:19.360 I'm going to remove the things that I know we're not interested in, 00:04:19.370 --> 00:04:23.410 and fortunately for us, all of the tactics that were concerned with, 00:04:23.420 --> 00:04:26.980 even though the matrix has updated and moved one of 00:04:26.980 --> 00:04:30.460 them over to Discovery for the Monkey, because of the version it's on, 00:04:30.460 --> 00:04:32.620 are still all under lateral movement here, 00:04:32.870 --> 00:04:37.510 so we can go ahead and de‑select anything that we are not going to use, 00:04:37.510 --> 00:04:39.400 we're not going to be using private keys. 00:04:39.400 --> 00:04:42.520 We do want to brute force, we do want to dump credentials if we can. 00:04:42.870 --> 00:04:46.770 We are not going to be using execution through API, 00:04:47.240 --> 00:04:52.350 and I believe the rest are dependencies that we will need to keep. 00:04:53.840 --> 00:04:54.480 Next, 00:04:54.480 --> 00:04:58.690 the Basic Exploits tab is where you'd include user 00:04:58.690 --> 00:05:01.560 credentials to help the Monkey propagate deeper. 00:05:01.570 --> 00:05:06.910 We aren't going to do that this time because I want to demonstrate the 00:05:06.920 --> 00:05:12.290 Monkey's ability to brute force on its own; however, 00:05:12.300 --> 00:05:15.050 these were the three that I originally included, 00:05:15.440 --> 00:05:22.480 and the WINUSER02 and WINUSER01 admin share usernames right there, 00:05:22.480 --> 00:05:25.040 those were discovered in a different scan, 00:05:25.040 --> 00:05:27.180 and so once a username is discovered, 00:05:27.440 --> 00:05:30.730 the Monkey actually saves them for you to your active 00:05:30.730 --> 00:05:33.010 configuration for you to use in the future. 00:05:33.110 --> 00:05:36.680 So we're going to just delete all of these, 00:05:37.510 --> 00:05:44.750 and just go with Administrator, root, and user. 00:05:46.590 --> 00:05:48.650 Make sure you click Submit to save your changes. 00:05:53.440 --> 00:05:58.730 The Basic Network tab is where you can decide how many hops 00:05:58.730 --> 00:06:01.110 away from the island the Monkey can penetrate. 00:06:01.370 --> 00:06:04.060 So I am going to change this because it's at 2 right now, 00:06:04.060 --> 00:06:08.170 and I don't have very many hops available on my virtual network, 00:06:08.170 --> 00:06:11.950 but I do want to up it to 5, just in case it's able to discover anything else. 00:06:13.780 --> 00:06:18.390 So from here, we're going to run on a machine of our choice. 00:06:18.400 --> 00:06:23.680 I'm running both Windows and Linux instances in my environment, 00:06:23.680 --> 00:06:25.950 so I'm going to show you how both of those look. 00:06:26.540 --> 00:06:29.490 I'm going to pick the Window 64 bit because that's what I run. 00:06:29.540 --> 00:06:32.330 So something I want to point out to you is that currently the payload 00:06:32.330 --> 00:06:36.420 reflects the internal IP address for the EC2 instance, 00:06:36.420 --> 00:06:39.030 and I don't know if this works differently if you are 00:06:39.030 --> 00:06:43.920 self hosting the island server, but because I'm hosting it out of AWS, 00:06:43.920 --> 00:06:49.210 you need to change this IP address to call out to the public‑facing IP address. 00:06:49.420 --> 00:06:52.130 So I will show you how to do that in the command prompt 00:06:52.130 --> 00:06:54.240 when we're actually going to deploy it. 00:06:54.240 --> 00:06:56.950 So I'm going to come on over to my Windows box. 00:06:57.900 --> 00:06:59.190 We're going to open up the command shell, 00:06:59.190 --> 00:07:02.620 use the command shell and not PowerShell shell because 00:07:03.540 --> 00:07:05.660 the word PowerShell is in the script, 00:07:05.660 --> 00:07:09.450 and it's going to mess with itself if you try and execute it in PowerShell. 00:07:11.080 --> 00:07:13.000 So before we execute this bad boy, 00:07:13.000 --> 00:07:18.090 let's change the IP address everywhere that it appears incorrectly. 00:07:23.340 --> 00:07:24.800 Okay, now we should be ready to roll. 00:07:24.800 --> 00:07:26.320 So we're pretty much going to hit Enter, 00:07:30.880 --> 00:07:33.840 give it a minute, and this is a good sign. 00:07:33.840 --> 00:07:36.380 If this second window does not pop up and start running, 00:07:36.380 --> 00:07:38.990 then your Monkey has not executed successfully, 00:07:40.180 --> 00:07:42.100 and you will need to go back and troubleshoot it, 00:07:42.100 --> 00:07:43.480 and try again. 00:07:43.480 --> 00:07:48.350 So now let's pop back over to our GUI client, 00:07:48.350 --> 00:07:49.830 and take a look at our infection map. 00:07:49.830 --> 00:07:53.650 You will see that my island host is there, 00:07:53.660 --> 00:07:57.460 as well as the first host that I have just given it. 00:07:57.470 --> 00:08:02.560 So that's it's jumping‑off point, is my VM on my 21. 00:08:02.560 --> 00:08:03.450 subnet. 00:08:05.840 --> 00:08:10.480 So the Monkey has started, it's identifying that no tunnel is being used, 00:08:10.490 --> 00:08:16.120 it's collecting system information, it's going to identify the operating system, 00:08:16.120 --> 00:08:18.430 the running services, open ports, 00:08:18.530 --> 00:08:22.750 and then start trying to authenticate its way in. 00:08:25.340 --> 00:08:29.900 So the other thing we're going to do just for fun is to 00:08:29.900 --> 00:08:32.450 set it loose on a Linux instance. 00:08:33.490 --> 00:08:38.150 So I've already puttied myself into my Linux instance and made myself root, 00:08:38.539 --> 00:08:40.549 which is something you will need to do. 00:08:42.340 --> 00:08:45.950 Now I'm running CentOS on mine, so actually, 00:08:46.920 --> 00:08:48.840 I'm going to need to install Wget, 00:08:48.850 --> 00:08:54.210 and you will need to install Wget if you're running a CentOS‑based Linux image. 00:08:54.720 --> 00:08:57.850 Trying to use Yum is not going to work out well for you. 00:08:58.240 --> 00:09:03.690 So I would just always install Wget. 00:09:03.690 --> 00:09:09.500 It takes 2 seconds, it's very easy to do, and then everything works flawlessly. 00:09:11.640 --> 00:09:12.280 Perfect. 00:09:13.340 --> 00:09:16.040 So now we will go ahead and paste in our payload, 00:09:16.040 --> 00:09:16.570 and again, 00:09:16.570 --> 00:09:21.800 we're going to change that IP address to the externally‑facing IP address, 00:09:22.920 --> 00:09:25.450 or the agent is going to fail. 00:09:30.240 --> 00:09:32.190 Alright, it's looking good, so we're going to hit Ente, 00:09:34.740 --> 00:09:36.480 and the Monkey is running successfully. 00:09:37.240 --> 00:09:39.450 So we're going to get rid of that. 00:09:40.040 --> 00:09:41.850 Come back over to our infection map, 00:09:42.740 --> 00:09:46.550 where we can see that it's now identified my CentOS machine. 00:09:50.000 --> 00:09:53.640 And we're basically going to let it run here. 00:09:53.650 --> 00:09:59.210 It can run for up to, it's never taken mine longer than 45 minutes, 00:09:59.210 --> 00:10:00.350 but it does run for a while, 00:10:00.350 --> 00:10:02.440 so we're going to pause it here and come back when we've 00:10:02.450 --> 00:10:05.500 got some snazzy results to check out. 00:10:05.590 --> 00:10:07.450 Alright, welcome, welcome back. 00:10:07.940 --> 00:10:09.820 Our monkeys are done propagating. 00:10:09.900 --> 00:10:13.540 I did receive a notification about 20 minutes in that I 00:10:13.540 --> 00:10:16.110 had results in my security report, 00:10:16.260 --> 00:10:18.350 but I decided to let it run longer than that 00:10:18.360 --> 00:10:20.360 because the longer you do let it run, 00:10:20.650 --> 00:10:24.360 the more information will populate in the report. 00:10:24.360 --> 00:10:26.530 So the longer it goes, the more information you get. 00:10:26.530 --> 00:10:28.080 The report is living, it's still going. 00:10:28.080 --> 00:10:31.160 As long as the monkeys are still going, the report is still building. 00:10:31.540 --> 00:10:35.390 So I'm not going to spend too much time on what we see here because 00:10:35.390 --> 00:10:37.250 I'm going to go over that more in the second demo. 00:10:37.500 --> 00:10:41.540 Really the two things I want to show you are our infection map, 00:10:41.540 --> 00:10:45.390 so that got pretty extensive pretty quickly, 00:10:45.390 --> 00:10:48.340 and really what we want to know is whether or not we 00:10:48.340 --> 00:10:53.060 were able to exploit over SSH and SMB, and it looks like we were, 00:10:53.320 --> 00:10:56.950 also post‑breach actions were accomplished. 00:10:57.340 --> 00:10:59.090 And if we want to take this a step further, 00:10:59.090 --> 00:11:01.450 we can come over here to the ATT&CK tab, 00:11:01.450 --> 00:11:03.500 and again the table doesn't display correctly, 00:11:03.500 --> 00:11:06.460 I'm not sure why, but you can just go ahead and click List all techniques. 00:11:06.590 --> 00:11:11.390 And you can come on down to the Lateral movement section, where you 00:11:11.390 --> 00:11:16.930 will see that SSH, SMB ,abnormal protocol over TCP port, and HTTP 00:11:16.930 --> 00:11:18.970 were all successful in being exploited. 00:11:19.300 --> 00:11:20.360 Additionally, 00:11:21.140 --> 00:11:24.980 remote file copy, the Monkey was able to copy itself onto all 00:11:24.980 --> 00:11:28.600 of these systems, and last but not least, 00:11:28.600 --> 00:11:30.000 remote services. 00:11:30.010 --> 00:11:37.670 We have SSH, SMB, MSSQL, WMI was used, and it was used on quite a few hosts. 00:11:37.670 --> 00:11:40.910 So, you could always drill down into this, see which hosts were compromised, 00:11:40.910 --> 00:11:42.960 how it was done, when it was done, from which other 00:11:42.960 --> 00:11:45.050 host it was done, and as you can see, 00:11:45.050 --> 00:11:47.850 the Monkey has several other pretty cool capabilities that 00:11:47.850 --> 00:11:51.840 we're not going to cover, such a C2, data exfil, discovery, 00:11:51.840 --> 00:11:53.890 credential access, execution. 00:11:54.000 --> 00:11:55.150 As you can see, 00:11:55.160 --> 00:11:57.530 the Infection Monkey does apply to several tactic 00:11:57.530 --> 00:12:00.100 categories within the MITRE matrix; however, 00:12:00.100 --> 00:12:02.540 this one's just focused on the lateral movement functions. 00:12:02.750 --> 00:12:05.270 The last thing I'm going to show you is the Zero Trust Report. 00:12:05.270 --> 00:12:06.920 We're not going to spend a lot of time on this because 00:12:06.920 --> 00:12:08.640 this is not a Zero Trust course, 00:12:08.870 --> 00:12:12.670 but if you are familiar with Zero Trust, and you wanted to come 00:12:12.670 --> 00:12:15.370 over here, and see your results, and drill down into which 00:12:15.370 --> 00:12:18.810 principles and tests were run against those principles to validate 00:12:18.810 --> 00:12:22.220 them, and go through your findings, you have that option as well. 00:12:22.360 --> 00:12:26.350 So that is the Monkey, I hope you enjoyed, and I will see you in the next demo.