WEBVTT

00:00:00.840 --> 00:00:01.560
Hey, everyone.

00:00:01.560 --> 00:00:02.220
I'm Aaron Rosenmund,

00:00:02.220 --> 00:00:05.170
and thank you for joining me on Pluralsight to learn more

00:00:05.170 --> 00:00:07.800
about the post exploitation command and control platform

00:00:07.800 --> 00:00:09.660
for red teamers called Covenant.

00:00:10.140 --> 00:00:11.150
Covenant, first of all,

00:00:11.150 --> 00:00:13.960
is an open source project distributed and used under

00:00:13.960 --> 00:00:15.750
the GNU General Public License.

00:00:16.540 --> 00:00:19.280
The creator and primary contributor is Ryan Cobb,

00:00:19.280 --> 00:00:22.410
under the username cobbr with a reasonably active number two

00:00:22.410 --> 00:00:24.350
contributor with the username rasta mouse.

00:00:25.640 --> 00:00:26.320
Above all,

00:00:26.330 --> 00:00:28.730
I want to thank them for their work and contributions to the

00:00:28.730 --> 00:00:31.850
community and hope this course can help showcase their work in a

00:00:31.850 --> 00:00:33.950
way that makes others appreciate it as well.

00:00:34.340 --> 00:00:35.850
In the words of the project's wiki,

00:00:35.950 --> 00:00:40.110
the mission of this tool is to highlight the attack surface of .NET and to make

00:00:40.110 --> 00:00:44.070
the use of offensive .NET tradecraft easier to use while serving as a

00:00:44.070 --> 00:00:46.740
collaborative commanding control platform for red teamers.

00:00:47.060 --> 00:00:49.110
And that is exactly what Covenant delivers.

00:00:49.200 --> 00:00:52.310
This is a free and open source red team operations command

00:00:52.310 --> 00:00:54.740
control framework that was made from the ground up to

00:00:54.750 --> 00:00:57.150
execute .NET adversary techniques.

00:00:57.440 --> 00:00:59.450
It is available on GitHub with instructions for

00:00:59.450 --> 00:01:01.840
installation and operation on the GitHub wiki,

00:01:01.840 --> 00:01:02.270
here,

00:01:02.640 --> 00:01:05.019
and the documentation for this project is actually much

00:01:05.019 --> 00:01:07.260
better than I've seen for others, but still,

00:01:07.260 --> 00:01:10.260
I will be going over some of the gotchas for the installation shortly.

00:01:10.740 --> 00:01:12.510
If you haven't picked up on this already,

00:01:12.510 --> 00:01:15.560
Covenant is focused on exploiting the attack surface that is

00:01:15.560 --> 00:01:19.390
available via the .NET framework that is the core of the OS for

00:01:19.390 --> 00:01:21.090
Windows‑based operating systems.

00:01:21.130 --> 00:01:23.950
The key differentiator in this C2 framework from others is the use

00:01:23.950 --> 00:01:27.630
of the Roslyn API to dynamically compile the implants on the

00:01:27.630 --> 00:01:29.670
compromised systems directly in a memory.

00:01:30.040 --> 00:01:32.820
Leveraging the underlying .NET assemblies and compiling

00:01:32.820 --> 00:01:34.550
dynamically on the compromised host,

00:01:34.550 --> 00:01:37.220
avoids some of the burned techniques that are used in other

00:01:37.220 --> 00:01:39.140
C2 implants that will get you caught.

00:01:39.460 --> 00:01:40.850
And from a blue team perspective,

00:01:40.850 --> 00:01:43.660
this is the coloring book GUI point‑and‑click version of the

00:01:43.660 --> 00:01:46.670
up and coming .NET exploitation capabilities that you need

00:01:46.670 --> 00:01:48.070
to have detections ready for.

00:01:48.440 --> 00:01:51.040
Looking at where this capability lands in the cyber kill chain,

00:01:51.050 --> 00:01:52.710
like any other command and control system,

00:01:52.710 --> 00:01:56.080
once you have access to a compromised device post exploitation,

00:01:56.090 --> 00:01:59.960
you can then install an implant that calls back to your C2 server,

00:01:59.970 --> 00:02:03.050
and this is the base access for the remaining of your operation.

00:02:03.640 --> 00:02:07.790
MITRE ATT&CK coverage for any C2 framework is going to be pretty broad,

00:02:07.790 --> 00:02:08.690
and of course,

00:02:08.699 --> 00:02:11.330
you're going to find a lot of the techniques that fall

00:02:11.330 --> 00:02:12.890
under the command and control tactic.

00:02:12.900 --> 00:02:17.690
But one of covenants features that set it apart is the heavy use of .NET,

00:02:17.690 --> 00:02:19.360
not just in the C2 server,

00:02:19.370 --> 00:02:24.660
but also using .NET to compile the commands into memory of the infected machine.

00:02:25.340 --> 00:02:27.870
For the actual command and control component of Covenant,

00:02:27.870 --> 00:02:33.070
like many others in its class, it uses common application layer protocols,

00:02:33.070 --> 00:02:33.980
specifically,

00:02:33.990 --> 00:02:38.330
HTTP and HTTPS web protocols to blend in with known

00:02:38.330 --> 00:02:39.950
good web traffic at the edge.

00:02:40.340 --> 00:02:42.310
Once that foothold is established,

00:02:42.460 --> 00:02:46.430
the edge‑compromised boxes can act as an internal proxy,

00:02:46.550 --> 00:02:49.880
making decomp connections from one implant to another,

00:02:49.970 --> 00:02:53.670
to proxy commands and data, to and from the Covenant server,

00:02:53.670 --> 00:02:58.980
to many internal devices, but only leveraging the single external connection.

00:02:59.840 --> 00:03:02.100
I want to quickly go over what the operation of Covenant

00:03:02.100 --> 00:03:04.960
looks like from a generic command and control perspective and

00:03:04.960 --> 00:03:06.680
then get directly into the demo.

00:03:06.710 --> 00:03:08.390
Starting with a basic network,

00:03:08.460 --> 00:03:11.070
the operational Covenant server is going to sit somewhere

00:03:11.070 --> 00:03:12.830
external to the target environment.

00:03:12.840 --> 00:03:16.380
It could be on a cloud service, inside an adversary's enclave,

00:03:16.380 --> 00:03:18.120
or anywhere in between, but the point is,

00:03:18.120 --> 00:03:21.150
is that allows access to the red team, that's you and your friends,

00:03:21.150 --> 00:03:23.270
to operate off the same server.

00:03:23.280 --> 00:03:26.650
After exploitation of device internal to the target environment,

00:03:26.650 --> 00:03:28.890
the implant installed calls back out,

00:03:28.900 --> 00:03:31.620
establishing the internal to external connection.

00:03:31.630 --> 00:03:34.310
The direction's important because it's most likely to be

00:03:34.310 --> 00:03:36.460
allowed through ACLs and firewalls,

00:03:36.740 --> 00:03:39.240
which is also another reason to use commonly used ports.

00:03:39.240 --> 00:03:42.500
Specifically, Covenant supports SSL with valid certificates,

00:03:42.640 --> 00:03:44.980
and that allows the implant traffic to blend in with

00:03:44.980 --> 00:03:46.900
regular outbound browsing traffic.

00:03:47.140 --> 00:03:48.780
At this point, whether you're in your hoody,

00:03:48.780 --> 00:03:50.790
your trench coat, or your favorite ski mask,

00:03:50.800 --> 00:03:54.460
you have a two‑way connection to run commands on the compromised host.

00:03:55.040 --> 00:03:58.010
From here, you spread via SMB pipes to the other hosts,

00:03:58.020 --> 00:04:01.670
identifying your target, whatever it may be in accomplishing the mission.

00:04:02.140 --> 00:04:03.740
Sounds like a piece of cake, right?

00:04:03.750 --> 00:04:05.050
Well, let's see it in action.

00:04:05.060 --> 00:04:07.530
I'm going to walk you through how that's done on keyboard to

00:04:07.530 --> 00:04:09.250
get you up and running as quick as possible.