In our third installment (Post 1: XDR technology and how it works, Post 2: XDR: How the Evolution of Endpoint Technology is Moving Beyond the Endpoint) of our blog, we explore the Network piece of the XDR pie. Mmmmmm… pie… 

Why focus on the Network? As we work our way through a global pandemic with virtually everyone working from home and fully taking advantage of BYOD and hyper-expanded IoT-enabled everything – it’s immediately evident: businesses can’t rely on just endpoint or email detection to uncover threats anymore. We need something more sophisticated.

As more organizations opt for Digital Transformation and adopt cloud-based resources, employ encryption, and concurrently adapt to remote employees, it’s easy to see that nearly all cyber threats generate communications that are visible on the Network. Additionally, most EDR solutions are dependent on agents for monitoring, however, it may not always be possible to install the agents on all systems in an environment. NDR helps close potential EDR gaps and detect malware that attempts to circumvent EDR monitoring. This makes NDR a partner to EDR and wrapped into XDR indispensable as it provides perspective where others can’t.

Let’s take a little side trip and talk about attacker life cycles. In case you hadn’t noticed, the cybersecurity industry likes it when it can put things into a framework including the way cyber-attacks happen. Various versions of the attack lifecycle have been created to break down the structure of an attack to help determine where defenders can detect/prevent attacks. For our purposes, we will use the Cyber Attack Lifecycle from Mandiant:

Defending against each stage is a critical skill for organizations, and as you might suspect, one tool probably can’t do it all. Imagine this: exploits that can subvert EDR or malicious activity may not be reflected in logs and so are not prevented/detected in the initial compromise and establish a foothold, but, their activity is visible by network tools as soon as they interact with any system at the internal recon, move laterally and maintain presence stages – even if that system doesn’t have EDR. Need another example? A nation-state attacker has such sophisticated attacks they employ hidden HTTPS tunnels that mimic standard web traffic to launch command and control as part of their maintain presence and attempts to complete their mission. NDR ferrets out that activity and respond with alerts.

With effective AI and ML – bingo! – Network Detection and Response platforms will collect and store the “right” metadata and enrich it with security insights. The result is finding attackers in real-time and incident investigations launched in record response time.

And truly – can we afford anything less?

Now that you’ve learned a little about the XDR technology and how it works from our first blog post in this series, let’s go further down the path of cyber security. Let’s go all the way down to the end. Let’s go all the way down to the endpoint.

As it is with all business technology, cyber security has seen it’s fair share of change. Where simple anti-virus software is used to meet our safety requirements, we now see more robust and preventative capabilities in play to identify and respond to threats and attacks.

The thing now is the ‘assumption of breach’. Assumption of breach asks security teams to assume their systems are already compromised and that internal attacks are already underway from the inside. This assumption begs action to proactively protect data, and ultimately, your endpoints. 

More on the endpoint; what is it? Let’s be real about what the endpoint is, or rather who the endpoint is. Endpoints are people. Human users. Ordinary folk who access your company’s data every day, who forget to log out, lock their devices, or leave them on the bus in a moment of distraction. It happens all the time.  

What’s important to remember is that endpoints are among the most vulnerable areas for cyber attacks. More endpoints (people) mean a wider risk to your organization. Perhaps it’s useful to think of endpoints  

With more and more people working remotely and connecting through the cloud, endpoint protection just makes sense. Think about it: most remote workers connect to your company’s data through at least two devices – mobile and a laptop or perhaps more depending on their set-up outside the office, and their requirement to be in the office. 

That’s a big battlefield to manage. Increased endpoints expand your security perimeter and increase general risk. What XDR presents is a management system for cyber security.

So, let’s start at the end. Endpoint protection platform (EPP) prevents attacks by blocking (or allowing) access, providing an area to test threats, and uses AI to report suspicious activity. EPP is often cloud-based and analyses data before delivering it to security analysts and often has an Endpoint Detection and Responses (EDR) component. If a threat has already compromised your platform, EDR technology responds with action to recommend either an automated or manual response to find a resolution to the threat.

What does that really mean though?

Imagine a threat slips through your firewall. EDR technology gets your IT security team indicators of compromise in real-time. From our last blog post, you’ll remember that XDR (Extended Detection and Response) forms a security system – it creates an integrated response by leveraging the intelligence of your EDR to move from detection to response across all platforms. XDR is leveled-up protection and is widely considered to be the logical progression in cyber protection technology.

If we were to (again) borrow a comparison from the armed forces theatre, EPP is supporting to threat detection working behind the front line to support and assist. EDR supports at the front line while XDR coordinates as a super-intelligent HQ to propel the sharp end of the stick allowing protection between layers of your IT components to reach every one of those human users – the endpoints – mitigating risk and reducing time expended and cost to respond and ultimately keeping your organization and your people safe.

If you do a quick Google search for ‘Cyber Security Skills Gap’, you’ll see countless articles on the gap and the enormous need for skilled workers in Cyber Security.

The cyber threat landscape is continuously broadening. While the security tools arsenal is adapting to meet the threats, the people to build, adjust and maintain them aren’t exactly a dime a dozen.

Often there seems to be a bit of a disconnect between what an organization wants and what they need. Many want educational requirements like a Bachelors degree or Masters in Cyber Security for their teams; however, these academic achievements are difficult to find due to the relative newness of the field and academia’s “big wheels turn slowly” bureaucracy. If you find one, undoubtedly they’re committed to the field, but they can be extremely difficult to find. We suggest that what many organizations need is the right person with the proper training and a desire to keep learning.

So who’s the right person? People with the ability connect technology and your business, but also the ability to connect with the people within the organization – suddenly soft skills are the hard skills. We offer that the character of an employee in Cyber Security requires someone who is curious, good at figuring out the problems, and can conduct the detailed analysis that it entails. People who don’t give up until the puzzle is solved. You want people who even question the puzzle itself and can carry concurrent lines of thought. Are the people in your organization already that show incredible aptitude for learning new things quickly? Do they know your business and the business of the clients they’re tasked to?
You may have found your candidate.

Training is the next piece of the puzzle.

When we’re looking for those afore mentioned degrees we want, we may actually need the proficiency gathered in a candidate’s training, often buried in the educational section of their resume. Many of the requirements we seek are gathered through IT specific security training, such as (shameless plug #1) a SANS certified mentor class being offered here at rSolutions: Hacker Tools, Techniques, Exploits and Incident Handling on March 21 through April 11, 2017. Courses like these take people with working knowledge of your systems and business, and transform them into the knowledgeable Cyber Security resources required. Other training is available too through many other organizations and it’s important to note we feel continual training isn’t just a good idea, it’s fundamental. Here at rSolutions we train at a ratio of 3:1 meaning our peeps are training one hour for every three they work.

This keeps rSolutions not only current, but ahead, which is where you need to be. If you want some quick suggestions, here’s our top four training choices, and yes, rSolutions have all these and far more:

• CompTIA Security+
• GSEC: SANS GIAC Security Essentials
• CISSP: Certified Information Systems Security Professional
• CISM: Certified Information Security Manager

In your neck of the woods there may simply be few options for good hires. Your existing staff resources may be too valuable to their current teams to train elsewhere (replacing one problem with another isn’t a good idea). The training required for the resource may be out-of-reach due to time or budget restraints. Lastly, once trained, you’ve created a highly sought after resource and you might want to broker a non-compete clause. We’ve all heard about the “million unfilled InfoSec jobs”, that’s why you read the article this far, and the other side of that is retention of highly skilled resources. So why buy, when you can lease?

At rSolutions (shameless plug #2), we started our business on Cyber Security and have advanced resources that teach the classes and proctor the exams for InfoSec designations. We provide Managed Cyber Security services that have the clearances, industry referrals across every major vertical in business and the business-first focus that can help improve your security posture in the short-term and will even work with you to prepare for the long-term.

So why is outsourcing such a good idea?

Cyber Security is advancing so quickly that it’s a challenge to get a handle on the breadth of the threat landscape, the evolution of threats within that landscape and the proper tools to mitigate them. Outsourcing to a managed security model shifts some of the responsibility for your information security and puts it in the hands of qualified experts, allowing you the time to focus on the business and the day-to-day operational demands of supporting your information infrastructure.

My how time flies.

It seems like only yesterday I was fortunate to be asked by the one and only Mr. Ed Skoudis (thank you, thank you) to write a post for SANS PenTesting blog “Got Meterpreter? Pivot!“, but it has been almost five years. In our industry, the only thing constant is change so let’s revisit this topic to see what has changed.

Once again, we will start with the same scenario:

We have a Metasploit Meterpreter shell with Admin/System privileges on an in-scope target Windows box. We will call this system X and it is in the DMZ. Do the root dance, pillage the heck out of it and get ready to pivot!

There are many ways to leverage the exploited system to discover, scan, and pivot to other devices in the target network. This article will discuss some ways to leverage the Metasploit Framework (https://www.metasploit.com/) (hereafter referred to as Metasploit) to accomplish various kinds of pivots, although there will be some non-Metasploit tips scattered throughout as well. Where a technique from the previous post is still valid, it will be referenced. Our test system, X, uses a dual-homed network, one network connected to the 172.16.33.x DMZ network and one connected to the 192.168.100.x internal network. The same techniques described below can be used for VLANs or physically separate networks that have paths to route to different networks.

Let’s go.

Sniffer

Watching the network interactions between devices is still one of my favourite ways to learn who, what, when and why an exploited system communicates with others on the network.

Meterpreter still has the sniffer module discussed in the last post available. In fact it has been updated with x64 support since then. However, rather than rehash sniffer, we will use the Packet Recorder sniffer extension written by Carlos Perez.

Packet Recorder uses sniffer, but makes it even easier. Start by executing the command run packetrecorder –li in the Meterpreter session to list out the available network interfaces, then execute the command run packetrecorder –i 3. To end the capture, carefully press CTRL-C then open up the capture and look for interesting info. The example below shows the entire process.

Not using Metasploit?

For some reason when writing the post in 2012, I didn’t mention the built in netsh capability so let me correct that oversight now. The netsh trace command can be used. There are all sorts of filters that can be used but a simple method is just to use the IPv4.Address as shown below.

This capture is saved in ETL format and can be viewed using Microsoft Message Analyzer. You can also convert the ETL capture to PCAP format with a couple of PowerShell commands. See the Internet Storm Center post in the references for more details.

Route and Auxiliary scan

There are more than 250 post exploitation modules currently available in Metasploit. A lot of them are used to gather info from the exploited system and a few of these are very useful in a pivoting situation.

A couple of good ones, again compliments of Carlos Perez, which can be used to determine what other systems are on the network are post/windows/gather/arpscanner and post/multi/gather/pingsweep.

As illustrated above, these scans identified a few systems we can potentially pivot to.

Routing and Proxy

Routing is even easier then it was in 2012. From within your Meterpreter session simply type run autoroute –s subnet, then ctrl-z to go back to the Metasploit console and use the new route with some of the auxiliary TCP based scan modules and if we find something juicy, even exploit through the autoroute. The example below shows using our exploited system as route to identify listening ports from the systems discovered during the ping_sweep.

PORTFWD, SOCKS proxy and SSH Tunnelling illustrated in the previous post still works well. If you haven’t used them yet, you should. Re-read the post and setup a test lab to ensure you see it in action. You won’t regret it.

One new development since that post is the addition of PowerShell version of SSH. Personally, I have only done limited tunnelling testing with the Microsoft backed version https://github.com/PowerShell/Win32-OpenSSH. If you have had some successes or challenges using PowerShell implementations of SSH for pivoting I would love to see them in the comments below.

No MSFMAP

Unfortunately, it appears that the module MSFMap by SecureState is no longer working in the current versions of Metasploit. All is not lost, though. There have been some very handy additions to Meterpreter that we can use in its place.

PowerShell

There are many ways to get a PowerShell session with Metasploit. One of the easiest is to use an existing session to create a PowerShell session. Background the existing session and do the following run the module exploit/windows/local/payload_inject with the Windows/powershell_reverse_tcp payload as shown below.

From here you can run (almost) any PowerShell module. In the example below, a PowerShell script, Invoke-TSPingSweep, which was modified a bit to make it more display friendly, was uploaded via Meterpreter, imported and then executed.

Note that some scripts will behave differently when run in the injected session. In particular watch our for scripts that use out-host and some that do not handle network connection timeouts will return big ugly errors like this one below, but will typically continue.

Python

Another new addition is the ability to run Python directly in a Meterpreter session!!

This ability is still being developed and currently, there are some technical issues that limit some of the usefulness, for instance you can’t have the Python script run in the background (https://github.com/rapid7/metasploit-framework/issues/6369). Still, this is an great addition and one that certainly will be useful when pivoting.

Imagine being able to easily use your favourite Python code from Black Hat Python, Violent Python or the SANS Security 573 class. Wonderful!

Not using Metasploit?

As briefly shown above, PowerShell is a very powerful tool for the penetration tester and can be especially handy for post exploitation activities. All the automated penetration testing programs provide PowerShell modules and a lot of very good work is being done on utilizing PowerShell for both defense and offense. Immunity has a nice video showing off some pointy clicky PowerShell interactions here https://vimeo.com/140723133, although that guys voice drives me crazy.

PowerShell remoting may not always be enabled, but if it is, it can be a quick way to pivot around a network. From an existing PowerShell session run the command New-PSSession –ComputerName abc.fg.hi then to interact with the shell run the command Enter-PSSession X.

What’s next?

I don’t see any slowdown in the opportunities to pivot through the network anytime in the near future. Do you have a favourite I haven’t mentioned? If so, please share it in the comments.

Thank you for your time
Cliff

References

• No Wireshark? No TCPDump? No Problem!
• Invoke-TSPingSweep
• Enable and Use Remote Commands in Windows PowerShell
• PowerShell Remoting Cheatsheet
• DarkOperator.com