WEBVTT 00:00:01.340 --> 00:00:02.960 Let's get back to the Events view. 00:00:03.340 --> 00:00:03.910 To do this, 00:00:03.910 --> 00:00:06.990 you might need to click the back button two times just 00:00:06.990 --> 00:00:09.160 because sometimes this view can get stuck. 00:00:11.140 --> 00:00:13.740 As you can see, there's a lot of alerts here, 00:00:13.740 --> 00:00:18.430 both from Wazuh and one from Suricata about the package being installed. 00:00:18.430 --> 00:00:22.710 In summary, even though we're leveraging Merlin to execute a command, 00:00:22.810 --> 00:00:26.870 the invocation of that command on the victim's host leaks 00:00:26.880 --> 00:00:29.880 valuable information out of our C2 channel. 00:00:29.890 --> 00:00:34.170 We want to avoid installing via package managers if possible. 00:00:34.540 --> 00:00:38.050 Let's change our approach and use the Merlin upload command to 00:00:38.050 --> 00:00:41.170 maintain stealth and keep us within the C2 channel. 00:00:45.740 --> 00:00:47.750 Okay, on to the upload functionality. 00:00:48.340 --> 00:00:51.970 The first parameter is the file we want to upload to the victim's machine. 00:00:52.440 --> 00:00:53.250 As an aside, 00:00:53.350 --> 00:00:57.770 linenum is a very popular recon script. On the Merlin server, 00:00:57.780 --> 00:01:00.060 I've already placed linenum at this path, 00:01:00.940 --> 00:01:02.230 and as you might expect, 00:01:02.240 --> 00:01:05.980 the second parameter signifies the destination file path. 00:01:05.980 --> 00:01:06.890 For stealth, 00:01:06.890 --> 00:01:10.320 we'll use the systemd.conf path to make the script 00:01:10.320 --> 00:01:12.250 look like a legitimate configuration. 00:01:12.940 --> 00:01:16.150 After I run the command, I'm going to pause the video until it finishes. 00:01:21.840 --> 00:01:24.070 Nice, we see everything was successful. 00:01:24.090 --> 00:01:26.300 Okay, let's go back into Wazuh. 00:01:26.300 --> 00:01:29.360 Okay, so I'm going to scroll up to the top here and refresh. 00:01:31.440 --> 00:01:34.670 Wow, look at this, File added to the system. 00:01:35.440 --> 00:01:37.840 Let's drill into this alert and see the actual log. 00:01:37.840 --> 00:01:41.960 I'm going to click on this little triangle over here. 00:01:45.240 --> 00:01:47.960 And as we go down, we see the full_log. 00:01:48.740 --> 00:01:53.940 Oh, wow, File /etc/systemd.conf added Mode: realtime. 00:01:53.940 --> 00:01:56.480 It looks like Wazuh saw the upload. 00:01:56.480 --> 00:01:59.870 Wazuh, and many other intrusion detection systems, 00:01:59.870 --> 00:02:02.290 monitor directories with sensitive files. 00:02:02.300 --> 00:02:03.580 As you might expect, 00:02:03.590 --> 00:02:06.920 the etc directory houses some pretty sensitive configurations. 00:02:06.920 --> 00:02:08.770 To subvert this alert, 00:02:08.770 --> 00:02:12.870 think of non‑sensitive directories that contain transient files. 00:02:12.980 --> 00:02:13.770 In other words, 00:02:13.860 --> 00:02:16.330 think of directories that would create a lot of false 00:02:16.330 --> 00:02:19.060 positives for an intrusion detection system. 00:02:20.140 --> 00:02:23.850 Okay, well, hmm, where should we put our recon script then? 00:02:24.240 --> 00:02:26.770 A good example would be the tmp directory. 00:02:27.000 --> 00:02:28.050 Let's give that a shot. 00:02:31.240 --> 00:02:33.980 Okay, it appears to be a swp file for pid1. 00:02:33.980 --> 00:02:36.160 So stealthy. 00:02:36.640 --> 00:02:37.770 After I run the command, 00:02:37.780 --> 00:02:40.450 I'm going to pause the tutorial while the command finishes. 00:02:42.740 --> 00:02:45.050 Perfect, looks like everything was successful. 00:02:45.440 --> 00:02:49.160 Let's continue our recon and execute the linenum script. 00:02:55.340 --> 00:02:58.250 Now I'm going to pause the video until everything finishes. 00:02:59.640 --> 00:03:01.770 Okay, awesome, looks like the script concluded. 00:03:02.140 --> 00:03:04.960 Let's scroll up here a little bit and see if there's anything juicy. 00:03:05.740 --> 00:03:07.560 Oh, whoa, tmp/database.bak. 00:03:07.560 --> 00:03:12.560 Looks like the database backup was bound. 00:03:12.940 --> 00:03:13.750 Okay, awesome! 00:03:14.140 --> 00:03:17.860 We need to get this back onto the C2 server. So I'm 00:03:17.860 --> 00:03:20.210 going to look at our help text here. 00:03:20.220 --> 00:03:22.470 Oh, I see a download command, okay, sweet. 00:03:28.240 --> 00:03:31.450 Nice, successfully downloaded the file, and there it is. 00:03:31.840 --> 00:03:34.030 Note the path the backup was saved to. 00:03:34.080 --> 00:03:37.150 So let's just take a step back and do a little recap. 00:03:38.140 --> 00:03:41.300 We persisted our recon script in the tmp directory and did 00:03:41.310 --> 00:03:45.250 exfiltration over the HTTP version 3 C2 channel. 00:03:45.740 --> 00:03:49.290 Now, in an ideal world, we'd do our attacks in memory, 00:03:49.300 --> 00:03:51.510 and we wouldn't save the recon script to disk. 00:03:51.520 --> 00:03:52.250 However, 00:03:52.270 --> 00:03:57.150 as you might expect, in‑memory attacks aren't always feasible. Before we end the 00:03:57.150 --> 00:04:01.050 tutorial, let's see if Wazuh or Suricata saw these attacks. 00:04:03.840 --> 00:04:07.760 Okay, so I'm just going to go scroll back up here and do a refresh. 00:04:10.240 --> 00:04:12.640 So let's see if anything new came in. No, 00:04:12.650 --> 00:04:15.560 it looks like we still see the last alert. 00:04:15.570 --> 00:04:19.010 Wow, it looks like our tactics succeeded against the default 00:04:19.010 --> 00:04:22.960 rule sets for Wazuh and Suricata. To note, this isn't a 00:04:22.960 --> 00:04:25.000 negative reflection on these projects. 00:04:25.150 --> 00:04:28.060 It is assumed that blue team operators will customize 00:04:28.060 --> 00:04:29.660 these rules for their environment.