WEBVTT 00:00:02.440 --> 00:00:05.010 So we'll start really slow with some basic concepts, 00:00:05.010 --> 00:00:07.290 like to use Covenant, you need to install Covenant. 00:00:07.650 --> 00:00:09.030 So unlike some other projects, 00:00:09.030 --> 00:00:11.340 the installation of Covenant is pretty well documented. 00:00:11.630 --> 00:00:14.190 Browsing to the GitHub for the project located here, 00:00:14.350 --> 00:00:15.900 there is a wiki for the installation. 00:00:16.640 --> 00:00:19.070 The wiki covers two different options for installation. 00:00:19.170 --> 00:00:22.480 One benefit of using .NET Core is that this collaborative server 00:00:22.480 --> 00:00:24.650 can run on any platform that you need it to, 00:00:24.650 --> 00:00:29.330 and the instructions for building the .NET project are included under Option 1. 00:00:29.330 --> 00:00:33.390 Option 2, and arguably the easier of the two options to spin up quickly, 00:00:33.580 --> 00:00:35.540 is to build and use a Docker container, 00:00:35.540 --> 00:00:38.150 and that's exactly what I'm going to walk you through in this demo. 00:00:38.790 --> 00:00:40.990 I'm going to show you the installation of Kali Linux here, 00:00:41.100 --> 00:00:43.340 and this is kind of a standard for red team'rs, 00:00:43.570 --> 00:00:45.510 though I'm not specifically tied to it. 00:00:45.620 --> 00:00:49.420 I'm more of a fan of creating your own builds once you know what tools you like, 00:00:49.420 --> 00:00:53.270 but Kali Linux is pretty ubiquitous in this space and kind of the go‑to for 00:00:53.270 --> 00:00:55.390 something where I want you to be able to follow along with me. 00:00:55.840 --> 00:00:58.690 It is a Debian‑based Linux and settings you use on Kali 00:00:58.690 --> 00:01:00.880 Linux will apply across other Debian builds, 00:01:00.880 --> 00:01:02.070 like Ubuntu, as well. 00:01:02.290 --> 00:01:02.550 Of course, 00:01:02.550 --> 00:01:05.140 the first step for this is to make sure that you have Docker installed. 00:01:05.269 --> 00:01:09.760 If not, the name of the project is actually docker.io within the repositories, 00:01:09.990 --> 00:01:13.650 and it can be installed with apt‑get install docker.io. 00:01:13.790 --> 00:01:16.900 And if you don't use the io, it will install a completely different service, 00:01:16.900 --> 00:01:18.050 which can get confusing. 00:01:18.500 --> 00:01:21.110 Following the instructions for installation at the terminal, 00:01:21.190 --> 00:01:24.740 run the git command, including the settings for the recursive modules. 00:01:24.840 --> 00:01:28.230 This is going to download and initialize the sub‑modules required for 00:01:28.230 --> 00:01:30.310 the operation of the project into the data folder. 00:01:30.740 --> 00:01:33.100 Change directories into the inner Covenant folder, 00:01:33.200 --> 00:01:35.570 or the second level of the Covenant, if you will. 00:01:35.580 --> 00:01:38.220 It's two directories deep and the contents look like this. 00:01:38.520 --> 00:01:41.030 More importantly, you can see the Dockerfile is here, 00:01:41.040 --> 00:01:43.550 and that is what you will be using to build the Docker image. 00:01:44.140 --> 00:01:44.960 Once there, 00:01:44.970 --> 00:01:48.260 run the docker build command using ‑t for the name, and if the 00:01:48.260 --> 00:01:51.250 working directory you're in is in fact the same directory that has 00:01:51.250 --> 00:01:54.610 the Dockerfile in it, just use the period character here to 00:01:54.620 --> 00:01:56.450 indicate the path to the Dockerfile. 00:01:56.840 --> 00:01:59.700 Don't forget to use sudo and go ahead and execute the build of the image. 00:01:59.940 --> 00:02:02.750 This build process wraps up the Covenant project code and 00:02:02.750 --> 00:02:05.010 all the required libraries and environment setup for the 00:02:05.010 --> 00:02:07.240 .NET project all into one image. 00:02:07.370 --> 00:02:10.850 And once it's complete, you are ready to run a container based on this image. 00:02:11.240 --> 00:02:13.240 The command in the documentation works great, 00:02:13.310 --> 00:02:15.850 but first make sure that you understand the flags that are being 00:02:15.850 --> 00:02:18.700 used so you can modify it to work best in your environment, or 00:02:18.700 --> 00:02:20.350 later for different types of listeners, 00:02:20.980 --> 00:02:25.400 The ‑p flag is used to tie ports on the localhost to ports exposed in the 00:02:25.400 --> 00:02:28.450 Docker container that is running the Covenant application. 00:02:29.140 --> 00:02:31.900 Port 7443 is required because it's the access to the 00:02:31.910 --> 00:02:33.250 admin portal for the Covenant. 00:02:33.640 --> 00:02:34.020 However, 00:02:34.020 --> 00:02:38.780 80 and 443 are just the default for callbacks from implants, called grunts in 00:02:38.780 --> 00:02:41.480 this context. If you want to call back to a different port, 00:02:41.590 --> 00:02:44.840 maybe 53 to simulate DNS or 22 for SSH, 00:02:44.990 --> 00:02:50.080 you need to expose those ports with a separate ‑p flag. The ‑v command 00:02:50.080 --> 00:02:53.510 will bind the files and folders inside the container to the files and 00:02:53.510 --> 00:02:57.320 folders on the host. For the Covenant container to run properly, you have 00:02:57.320 --> 00:03:00.780 to share the data folder located on the host with the internal app/Data 00:03:00.780 --> 00:03:02.150 folder for the application. 00:03:02.300 --> 00:03:04.560 If you have an error that mentions the sub‑modules, 00:03:04.610 --> 00:03:06.660 either this folder is not referenced correctly, 00:03:06.740 --> 00:03:09.330 and I recommend using the full path here, or the 00:03:09.330 --> 00:03:11.350 modules that were indeed not initialized. 00:03:12.040 --> 00:03:14.830 With proper execution of the container in interactive mode, 00:03:15.020 --> 00:03:18.520 it will show you the application is listening on port 7443 00:03:18.670 --> 00:03:20.250 that was exposed in the run command. 00:03:20.800 --> 00:03:22.490 And that's that for the installation. 00:03:22.810 --> 00:03:25.900 Now, open up a browser and browse to that portal at 00:03:25.900 --> 00:03:27.490 that address for the first time. 00:03:27.490 --> 00:03:30.070 Remember, it is going to be hosted on HTTPS, 00:03:30.230 --> 00:03:32.620 so type accordingly and you'll reach the screen asking 00:03:32.620 --> 00:03:34.350 for the registration of the first user. 00:03:35.040 --> 00:03:37.540 Enter a username and password, keeping in mind that this is only 00:03:37.540 --> 00:03:39.920 going to happen for the first user. After this, 00:03:39.920 --> 00:03:42.100 the users will need to be created by an existing 00:03:42.100 --> 00:03:44.490 administrator. If you check out the dashboard, 00:03:44.610 --> 00:03:46.610 you'll see that it's empty and you have a lot of work 00:03:46.610 --> 00:03:48.090 to do to get some connections going. 00:03:48.430 --> 00:03:51.970 Grunts will be displayed here after the appropriate code is executed on the 00:03:51.970 --> 00:03:55.150 exploited machines and calls back to an active listener. 00:03:55.610 --> 00:03:58.380 There are currently no listeners, so even if you had grunts calling back, 00:03:58.500 --> 00:03:59.250 it wouldn't matter. 00:03:59.640 --> 00:04:01.420 Tasks, as the name implies, 00:04:01.420 --> 00:04:04.450 shows any current taskings out to the grunts. To quickly 00:04:04.450 --> 00:04:06.710 go over the panel to the left, the whole process starts 00:04:06.710 --> 00:04:08.150 with having listeners set up. 00:04:08.870 --> 00:04:11.730 Then you need launchers to execute on the exploited devices 00:04:11.730 --> 00:04:14.850 that create the implant called grunts that call back and 00:04:14.850 --> 00:04:16.610 connect in through the listeners. 00:04:16.860 --> 00:04:19.320 If you are familiar with other C2 frameworks like PoshC2, 00:04:19.320 --> 00:04:21.170 PowerShell Empire or Cobalt Strike, 00:04:21.329 --> 00:04:23.910 these concepts with this workflow are essentially the same. 00:04:24.340 --> 00:04:27.440 Templates provide a baseline for implants that can be used with 00:04:27.440 --> 00:04:30.210 different types of listeners and provide you the capability to 00:04:30.210 --> 00:04:33.410 create your own, as well as view and edit the code that's used for 00:04:33.410 --> 00:04:35.020 each one of the included templates. 00:04:35.350 --> 00:04:36.730 When grunts are connected, 00:04:36.790 --> 00:04:39.140 you can execute different tasks through that connection. 00:04:39.440 --> 00:04:42.380 The Tasks panel provides a transparent look at exactly what 00:04:42.390 --> 00:04:45.850 each one of those tasks does and how, and it allows you to modify them. 00:04:46.240 --> 00:04:49.370 This level of customization allows you to change your footprint to 00:04:49.370 --> 00:04:51.710 evade detections, or in the case of emulation, 00:04:51.710 --> 00:04:55.700 simulate a specific group's tactics. The Taskings show currently queued 00:04:55.700 --> 00:04:58.310 tasks, and Graph shows the connections between the listeners, 00:04:58.320 --> 00:05:02.670 HTTP connections, and subsequent pivots through SMB. And the Data view will 00:05:02.670 --> 00:05:05.250 populate as you collect data from compromised systems. 00:05:05.320 --> 00:05:08.500 So that's enough of an overview for me. And you can't see two systems 00:05:08.500 --> 00:05:12.020 with sweet APT tactics unless you first compromise a system and gain 00:05:12.020 --> 00:05:14.150 the ability to remotely execute code. 00:05:14.540 --> 00:05:16.800 So, I'll give you a few moments to knock that out. 00:05:17.240 --> 00:05:18.520 And if this is your own network, 00:05:18.680 --> 00:05:21.650 then you can simply just execute the command with a legitimate login. 00:05:22.340 --> 00:05:23.560 Okay, time's up. 00:05:23.560 --> 00:05:26.510 I'm sure that was plenty of time to gather vulnerability information, develop 00:05:26.510 --> 00:05:29.290 an exploit, and successfully gain a shell into a system that you're working 00:05:29.290 --> 00:05:33.380 on as a red team, or you simply wrote an email and you're going to use one of 00:05:33.380 --> 00:05:34.950 those launchers as an attachment. 00:05:35.260 --> 00:05:36.340 And that's fine, too. 00:05:36.350 --> 00:05:38.770 We all know that no one can resist the early access 00:05:38.770 --> 00:05:40.110 to Baby Yoda plush doll link. 00:05:40.390 --> 00:05:42.450 Well played you cyber phishing mastermind. 00:05:42.940 --> 00:05:44.280 But before you click send, 00:05:44.410 --> 00:05:48.470 you need to set up a listener. In the Listeners pane, notice the Profiles tab. 00:05:48.700 --> 00:05:50.380 All listeners will use profiles, 00:05:50.700 --> 00:05:54.710 and if you have used or heard of Malleable C2, this is the same idea, 00:05:54.720 --> 00:05:57.610 and each profile can be customized or you can create your 00:05:57.610 --> 00:06:00.350 own. Covenant supports two bridge types. 00:06:00.740 --> 00:06:04.330 The first is the native, currently supported HTTP Bridge, 00:06:04.330 --> 00:06:06.410 which also supports SSL connections. 00:06:06.790 --> 00:06:10.550 And the second bridge listener is a custom encrypted TCP connection. 00:06:10.940 --> 00:06:13.010 These are the connections from the grunts inside the 00:06:13.010 --> 00:06:15.060 network back out to the Covenant server, 00:06:15.310 --> 00:06:18.350 and it does not apply to the SMB connections between grunts. 00:06:18.740 --> 00:06:22.700 A quick look at the HTTP custom profile, and you can see that you can change 00:06:22.700 --> 00:06:25.490 nearly every behavior that could be used for detection. 00:06:25.870 --> 00:06:29.740 The URLs, the way it transforms messages for transmission, the user agents, 00:06:29.740 --> 00:06:32.570 response headers, and post and get responses as well. 00:06:32.900 --> 00:06:35.420 The TCP bridges are just as customizable, 00:06:35.430 --> 00:06:38.620 but simply with less variables to change in the first place because it's just 00:06:38.620 --> 00:06:42.790 a simple TCP connection. To create a listener, click the Create button and 00:06:42.790 --> 00:06:44.590 choose the listener type that you want to use. 00:06:44.810 --> 00:06:48.680 I'm using the HTTP listener for this course, but I highly recommend using a 00:06:48.680 --> 00:06:54.060 valid SSL certificate to turn this into an HTTPS connection and ensuring 00:06:54.060 --> 00:06:57.290 that you have a registered domain that's not going to be on any sort of 00:06:57.290 --> 00:06:59.410 block list for production operations. 00:06:59.740 --> 00:07:01.660 The other options that you may have identified some 00:07:01.660 --> 00:07:04.840 specific custom traffic that you can blend in with and use 00:07:04.840 --> 00:07:06.590 the TCP bridge for that purpose. 00:07:06.970 --> 00:07:08.000 There's two things to remember. 00:07:08.000 --> 00:07:10.820 The first is that unless you can change the message transformation, 00:07:11.040 --> 00:07:13.840 the messages between the server and the grunt will be Base64 00:07:13.840 --> 00:07:16.290 encoded and easily decoded by defenders. 00:07:16.610 --> 00:07:19.180 Second is that when you are setting the bind ports 00:07:19.180 --> 00:07:20.850 while using the Covenant within Docker, 00:07:20.940 --> 00:07:23.750 you have to make sure that you added these ports within the docker 00:07:23.750 --> 00:07:27.370 run command when you originally ran the container. The bind address 00:07:27.420 --> 00:07:31.100 in the port is used to reference the specific interface in the port 00:07:31.100 --> 00:07:32.750 the C2 bridge will connect to. 00:07:33.140 --> 00:07:36.420 The connect address and port is the location that the grunts will 00:07:36.420 --> 00:07:39.960 call back to when they are launched on an exploited system. Because 00:07:39.960 --> 00:07:44.040 I ran the Docker container with binds to port 80, I'm using the 80 00:07:44.040 --> 00:07:45.590 port as the connect port, 00:07:45.610 --> 00:07:49.380 and I will be changing the connect address to the address of the host and 00:07:49.380 --> 00:07:53.440 sticking with the default HTTP bridge profile. For production, instead of 00:07:53.440 --> 00:07:57.760 using the IP, you would change this to the domain name URL as long as it 00:07:57.760 --> 00:08:00.050 resolves through DNS within the environment. 00:08:00.440 --> 00:08:00.910 Next, 00:08:00.920 --> 00:08:04.240 we need to create a grunt launcher that is tied to the listener. In 00:08:04.240 --> 00:08:06.210 the Launchers pane, you have various options. 00:08:06.450 --> 00:08:10.140 Note that the binary option is the only option that does not require the use 00:08:10.140 --> 00:08:12.850 of system binaries available on the compromised system. 00:08:13.440 --> 00:08:15.110 You can generate various types of scripts, 00:08:15.110 --> 00:08:16.640 including VBA and JScript, 00:08:16.640 --> 00:08:19.770 to embed in the documents, use PowerShell and WMIC or 00:08:19.770 --> 00:08:23.260 various built‑in Microsoft binaries. All great, known ways 00:08:23.260 --> 00:08:24.960 to get around endpoint protections. 00:08:25.270 --> 00:08:27.340 I'm simply going to use the binary file here, 00:08:27.350 --> 00:08:30.600 but highly recommend looking through each of the other options for ways to evade 00:08:30.600 --> 00:08:34.780 protections. Like anything from an offensive perspective, you want to avoid 00:08:34.780 --> 00:08:38.630 signature detection, and the best way to do that is to customize these launchers 00:08:38.630 --> 00:08:42.700 yourself. Inside the Binary Launcher menu, I'm going to choose the listener that 00:08:42.700 --> 00:08:43.940 I'm creating the launcher for, 00:08:44.039 --> 00:08:47.000 and each listener is going to require a different grunt to be created. 00:08:47.440 --> 00:08:50.460 Now, you have a weaponized payload that will reach back out to 00:08:50.460 --> 00:08:53.130 your Covenant C2 server. All you have to do is get some 00:08:53.130 --> 00:08:54.700 schmuck user to click it, and boom, 00:08:54.830 --> 00:08:58.190 you get your first grunt callback. And this is generally where you're going to 00:08:58.190 --> 00:09:01.580 spend most of your time, interacting and managing each grunt, 00:09:01.580 --> 00:09:05.210 spreading your creep, and pulling down creds in data. Diving into 00:09:05.210 --> 00:09:08.220 the context of your first HTTP grunt callback. 00:09:08.420 --> 00:09:11.790 You get all the info from the device it is running on that you would expect, 00:09:12.140 --> 00:09:15.470 and most importantly, the username and context under which it's running. 00:09:15.750 --> 00:09:18.380 You can interact directly with the grunt to send commands like 00:09:18.380 --> 00:09:22.230 who am I that will execute a task and provide the output back to 00:09:22.230 --> 00:09:25.700 you, like so. Or you can just choose a task from many in the 00:09:25.700 --> 00:09:27.350 drop‑down to get information, 00:09:27.480 --> 00:09:30.400 execute Kerberos‑based attacks on authentication or 00:09:30.400 --> 00:09:32.440 attempt to execute grunts on other devices. 00:09:32.730 --> 00:09:33.520 The list is long, 00:09:33.520 --> 00:09:35.580 so you're going to have to explore all of that yourself, but 00:09:35.580 --> 00:09:38.420 many of the SharpSploit and other tools that have been ported 00:09:38.420 --> 00:09:40.250 to .NET execution are included. 00:09:40.640 --> 00:09:44.160 No reason to start leaving PowerShell traces everywhere now. This is where 00:09:44.160 --> 00:09:46.630 you really get to show off your OpSec chops and restraint. 00:09:46.980 --> 00:09:49.830 Every action here has a consequence that could get you caught 00:09:49.830 --> 00:09:52.250 depending on your environment, so task responsibly. 00:09:52.680 --> 00:09:53.450 So what now? 00:09:53.840 --> 00:09:54.400 Well, for me, 00:09:54.400 --> 00:09:58.590 I always like to draw things out to get a graphical idea of where I am in the 00:09:58.590 --> 00:10:03.530 space and what I want to do next, and the Graph view does just that. The 00:10:03.530 --> 00:10:06.490 listeners are red and you have one HTTP grunt connected. 00:10:06.640 --> 00:10:12.430 The common practice would be to use one or two HTTP, DNS or HTTPS connectors to 00:10:12.430 --> 00:10:16.550 connect out to your C2 server and then pivot to other devices internally through 00:10:16.550 --> 00:10:21.160 those HTTP connected machines using SMB pipes, and that's exactly what you're 00:10:21.160 --> 00:10:25.930 going to do here. Back in Launchers, you create an SMB launcher in any form that 00:10:25.930 --> 00:10:26.950 will work for the environment. 00:10:27.440 --> 00:10:30.420 Then, you can use one of the various remoting capabilities through the 00:10:30.420 --> 00:10:35.590 HTTP listener to execute the SMB grunt payload. Once that's complete, 00:10:35.600 --> 00:10:40.440 within the desired HTTP pivot grunt, select the Connect task. Here, you're 00:10:40.440 --> 00:10:44.540 going to supply the IP of the machine on which the SMB grunt launcher was 00:10:44.550 --> 00:10:48.370 executed and use the name pipe that was specified in the creation of the 00:10:48.370 --> 00:10:49.750 launcher to connect. 00:10:50.240 --> 00:10:51.510 Once this is executed, 00:10:51.610 --> 00:10:54.610 you can move back to the Grunt pane and watch the new grunt 00:10:54.610 --> 00:10:56.990 connect back and progress through the stages, 00:10:57.440 --> 00:10:59.260 finalizing in an active C#, 00:10:59.260 --> 00:11:02.730 dynamically compiled grunt, in memory of the system with all 00:11:02.730 --> 00:11:05.240 the same capabilities as the HTTP listener. 00:11:05.590 --> 00:11:06.910 From an emulation perspective, 00:11:06.910 --> 00:11:09.220 this is the activity that you're going to want to generate throughout your 00:11:09.220 --> 00:11:12.250 environment and then test the internal detection capability. 00:11:12.740 --> 00:11:15.310 And you can see the connections and the way that you spread 00:11:15.310 --> 00:11:17.110 through a network back in the Graph view. 00:11:17.470 --> 00:11:19.970 Now it wouldn't be a proper red team engagement if you didn't at 00:11:19.970 --> 00:11:22.320 least run some version of Mimikatz on the system. 00:11:22.590 --> 00:11:23.080 And yes, 00:11:23.080 --> 00:11:27.630 that is one of the tasks. In the SMB grunt, you can assign the Mimikatz task, 00:11:27.790 --> 00:11:30.610 then check in the Taskings pane for the output of the command. 00:11:30.840 --> 00:11:31.590 And sure enough, 00:11:31.590 --> 00:11:34.850 you get the familiar LSA dump that we've all seen. A little 00:11:34.850 --> 00:11:37.750 sparse on creds, but a few floating around in there. But to see 00:11:37.750 --> 00:11:41.480 the loot in a more organized way, you can now look through the Data pane. 00:11:42.040 --> 00:11:44.560 Here, you're going to find stolen credentials organized by type, 00:11:44.570 --> 00:11:48.870 including the NTLM hash of my Microsoft demo account, which no, 00:11:48.890 --> 00:11:50.030 you don't get to see that. 00:11:50.200 --> 00:11:51.000 Wouldn't that be great? 00:11:51.000 --> 00:11:54.550 The security guy was giving you the NTLM hash of the Microsoft login account. 00:11:54.940 --> 00:11:56.500 Well, not today you evildoers. 00:11:56.780 --> 00:11:59.440 I thwarted you using an excellent technique called fuzzy 00:11:59.440 --> 00:12:01.700 pixelation. With all that moving around, 00:12:01.700 --> 00:12:04.530 you certainly have some tracks defined on the systems and in the network 00:12:04.530 --> 00:12:08.190 traffic, and the Indicators tab keeps track of those indicators, 00:12:08.190 --> 00:12:09.570 including computer names, 00:12:09.670 --> 00:12:13.350 network addresses used, and files ran as part of the red team operation, 00:12:13.740 --> 00:12:16.470 which is perfect for training a blue team or testing a detection 00:12:16.470 --> 00:12:19.910 capability, as well as just having an understanding of your footprint as 00:12:19.910 --> 00:12:23.980 the Red Team Operator. The dashboard that was once empty is now completely 00:12:23.980 --> 00:12:26.190 full and gives you the heads up information, 00:12:26.190 --> 00:12:28.630 including the active grunts, listeners, and tasks. 00:12:28.800 --> 00:12:33.000 The real power in a collaborative platform like this is the collaboration, so 00:12:33.000 --> 00:12:35.990 you can imagine how helpful all this information and data collection 00:12:35.990 --> 00:12:39.460 capability is when you have more than one operator all working off the same 00:12:39.460 --> 00:12:42.050 platform with the same information in real time.