WEBVTT 00:00:03.190 --> 00:00:04.480 Okay, here we are. 00:00:04.480 --> 00:00:07.880 We are back, and we are ready to test for network segmentation. 00:00:08.189 --> 00:00:11.160 So to do that, you're just going to come back to your Run Monkey tab, 00:00:11.170 --> 00:00:14.610 Configure the Monkey, it's going to be under Basic Network, 00:00:14.620 --> 00:00:17.000 and you scroll down to Network Analysis, 00:00:17.000 --> 00:00:18.900 Network segmentation testing. 00:00:19.640 --> 00:00:22.580 So here is where we're going to add the subnets that we 00:00:22.580 --> 00:00:24.790 want not to be able to talk to each other. 00:00:25.030 --> 00:00:33.780 So I'm going to do my 172.20 subnet and I'm going to do my 172.24. 00:00:37.280 --> 00:00:39.750 We're going to submit that, that was saved successfully. 00:00:40.640 --> 00:00:46.150 We're going to run the Monkey now on a machine of our choice again. 00:00:46.390 --> 00:00:47.760 Both of them, in this case, 00:00:47.770 --> 00:00:54.270 are Windows so I've got my RDP connections open already. 00:00:55.910 --> 00:00:57.530 So we're just going to open these up in command 00:00:57.530 --> 00:01:00.650 prompt, run as administrator, Yes, 00:01:01.340 --> 00:01:03.390 go ahead and paste in our payload, we're going to have to 00:01:03.390 --> 00:01:10.860 change that IP address one more time to the public‑facing 00:01:10.860 --> 00:01:13.500 IP so that the payload works. 00:01:16.580 --> 00:01:23.260 Set that one loose, then we're going to come on over to our second RDP session, 00:01:24.900 --> 00:01:26.410 do the same thing. 00:01:30.940 --> 00:01:31.400 Alright, 00:01:31.400 --> 00:01:33.540 so we've got both of our initial hosts on their different 00:01:33.540 --> 00:01:37.460 subnets identified so we're going to let it run and then see 00:01:37.460 --> 00:01:39.570 what it comes up with in the results. 00:01:40.540 --> 00:01:41.610 Okay, we're back. 00:01:41.610 --> 00:01:47.110 We've got the results from our network segmentation test, and as you can see, 00:01:47.110 --> 00:01:48.610 the Monkey got pretty busy. 00:01:48.620 --> 00:01:55.060 We had a lot of interhost exploiting going on. Again, the orange 00:01:55.070 --> 00:02:00.210 arrows are where initial host scans were completed, but red arrows 00:02:00.220 --> 00:02:02.120 are where exploits were successful. 00:02:02.320 --> 00:02:06.020 So here in the log, we've got the most recent failed exploits, however, 00:02:06.020 --> 00:02:08.090 there are quite a few up here where the Monkey was 00:02:08.090 --> 00:02:12.220 definitely successful using SMB exploiter, 00:02:12.470 --> 00:02:14.150 SambaCry, etc. 00:02:14.360 --> 00:02:19.570 So again, if you want the full log for everything your monkey did during its run, 00:02:19.580 --> 00:02:21.660 you can go ahead and check that out on the left‑hand 00:02:21.660 --> 00:02:23.010 side and download the whole thing. 00:02:24.540 --> 00:02:26.050 It definitely is pretty exciting. 00:02:26.060 --> 00:02:29.990 You can see that even though we only gave the MonkeyIsland one 00:02:30.010 --> 00:02:34.150 connection, which was the Windows box running on the subnet, 00:02:34.640 --> 00:02:37.510 it went ahead and discovered everything and from different host 00:02:37.510 --> 00:02:41.740 was able to discover and exploit other host, it exploited this 00:02:41.740 --> 00:02:43.770 host from four different other hosts, 00:02:43.850 --> 00:02:48.850 and it got team server communication directly back to three other hosts. 00:02:49.300 --> 00:02:49.860 In fact, 00:02:49.860 --> 00:02:53.590 we know the segmentation portion of our test was a failure, but what 00:02:53.600 --> 00:02:57.230 further speaks to that is the fact that multiple hosts, 00:02:57.230 --> 00:02:59.600 besides the initial jump off point, were able to 00:02:59.600 --> 00:03:02.400 communicate directly back with the team server, 00:03:02.480 --> 00:03:06.960 which is obviously a remote host not originally included on its subnet. 00:03:10.940 --> 00:03:12.150 So that's pretty cool. 00:03:12.630 --> 00:03:14.980 So let's go ahead and come on over to our Security Report now. 00:03:15.740 --> 00:03:18.820 Critical issues were detected. So I did leave my monkey 00:03:18.820 --> 00:03:21.950 running a lot longer than the typical time, again, it'll 00:03:21.950 --> 00:03:23.260 give you your initial results, 00:03:23.270 --> 00:03:26.990 which is indicated by those yellow checkmarks over on the left‑hand side. 00:03:26.990 --> 00:03:28.960 If there is a checkmark next to security report, 00:03:28.970 --> 00:03:30.840 it's got results to show you, but again, 00:03:30.840 --> 00:03:34.850 your monkeys are still running, they have not stopped until you kill them. 00:03:35.120 --> 00:03:39.000 So I decided to leave mine running a lot longer and the map actually 00:03:39.000 --> 00:03:41.750 grew and the exploits grew and the results changed. 00:03:41.940 --> 00:03:43.390 So the longer you can give it to run, 00:03:43.390 --> 00:03:45.490 you can even let it run overnight, that's really what I 00:03:45.490 --> 00:03:48.330 recommend, and it's got some pretty cool results. 00:03:48.350 --> 00:03:53.930 Now what I want to call your attention to is the finding of weak segmentation. 00:03:53.930 --> 00:03:58.740 So in this second scenario we were testing network segmentation and it 00:03:58.740 --> 00:04:02.620 does confirm for us that machines on different segments of the network 00:04:02.630 --> 00:04:04.670 were able to communicate with each other, 00:04:04.680 --> 00:04:06.350 which is not what we want. 00:04:06.840 --> 00:04:10.850 So our network segmentation test was a fail. 00:04:11.840 --> 00:04:15.810 It's got each host that it compromised, the username it compromised it 00:04:15.810 --> 00:04:19.250 with. Of the 12 machines, it discovered it was able to successfully 00:04:19.250 --> 00:04:22.600 breach 6 of them, so that's a 50% breach rate. 00:04:22.980 --> 00:04:25.990 For those of you reporting this to senior management, 00:04:25.990 --> 00:04:27.400 they love figures like that. 00:04:27.630 --> 00:04:30.750 It does give you a copy of your infection map. 00:04:31.150 --> 00:04:33.890 It did go ahead and find my domain controller. 00:04:33.890 --> 00:04:35.840 It found my interfaces. 00:04:36.240 --> 00:04:39.400 It found my data center evaluation. 00:04:39.400 --> 00:04:41.570 So the Monkey got pretty far. 00:04:41.570 --> 00:04:42.680 I'm pretty proud of it. 00:04:43.410 --> 00:04:44.690 If you scroll down a bit farther, 00:04:44.690 --> 00:04:48.950 it does tell you on the breach servers exactly which exploiter was successful. 00:04:49.070 --> 00:04:56.590 Here, we see a lot of SSH on my Linux machines and SMB on my windows DCs and my 00:04:56.590 --> 00:05:02.340 Windows endpoints. So it goes over the post breach actions, 00:05:02.340 --> 00:05:05.220 which means not only was it successful in a proof of concept breach, 00:05:05.220 --> 00:05:08.880 it conducted some kind of post breach actions such as a file 00:05:08.880 --> 00:05:11.550 deletion or a privilege permissions change, 00:05:11.940 --> 00:05:15.900 which is pretty cool, it gives you a list of the running services it detected, 00:05:16.020 --> 00:05:21.160 and it's got a lot more that it would like to show you, it'll even show 00:05:21.160 --> 00:05:25.350 you the credentials that were successful right here. 00:05:26.380 --> 00:05:29.050 So pretty good stuff. 00:05:29.640 --> 00:05:33.780 That's your basic vulnerability and security report. If we come on over 00:05:34.340 --> 00:05:39.950 to the Attack tab, and I apologize for the adjusted resolution in this 00:05:39.950 --> 00:05:44.380 layout of the table, but that's just a visual. 00:05:44.380 --> 00:05:45.680 Honestly, if you scroll down, 00:05:45.680 --> 00:05:48.620 it'll give you a list of all the techniques and what was successful down here, 00:05:48.620 --> 00:05:52.140 too. So we can see it was successful across quite a few 00:05:52.140 --> 00:05:54.710 techniques in several different tactic categories. 00:05:55.940 --> 00:05:56.310 Mainly, 00:05:56.310 --> 00:06:00.550 what we're concerned with is everything in discovery and lateral movement, 00:06:01.340 --> 00:06:03.310 which is really what the Monkey is meant for. 00:06:04.040 --> 00:06:09.010 So we have remote system discovery, it was detecting other hosts 00:06:09.010 --> 00:06:12.520 from initial hosts. Exploitation of remote services, it was able 00:06:12.520 --> 00:06:20.350 to exploit SSH, HTTP, and SMB, and also an unknown uncommon 00:06:20.350 --> 00:06:21.850 protocol over TCP port. 00:06:22.340 --> 00:06:26.750 So you've got that proof in the pudding right there. 00:06:28.140 --> 00:06:33.210 Remote file copy, it was definitely running and executing itself on 00:06:33.210 --> 00:06:37.900 multiple machines multiple times. And last, but not least, 00:06:40.310 --> 00:06:44.750 the remote services that were successfully executed over MSSQL, 00:06:44.760 --> 00:06:49.090 SMB, and SSH, it also was successful using WMI, 00:06:49.740 --> 00:06:50.650 which is pretty unique. 00:06:53.240 --> 00:06:58.110 So feel free to launch and execute your own monkeys and 00:06:58.110 --> 00:06:59.900 see what kind of neat results you get. 00:07:00.160 --> 00:07:00.720 As you can see, 00:07:00.720 --> 00:07:02.990 the Monkey does have a number of other capabilities we didn't 00:07:02.990 --> 00:07:08.060 cover such as C2 exfiltration and credential access like brute 00:07:08.060 --> 00:07:09.350 force and credential dumping. 00:07:09.840 --> 00:07:13.040 We didn't cover these. It also is capable of pass the hash. 00:07:13.640 --> 00:07:16.120 My virtual environment wasn't configured for that, 00:07:16.480 --> 00:07:18.850 but it will give you the plain text passwords, and 00:07:18.850 --> 00:07:21.650 if it is able to recover hashes, you will see those here as well. 00:07:22.540 --> 00:07:23.910 So I hope you enjoyed.