“I really try to put myself in uncomfortable situations. Complacency is my enemy.”
— Trent Reznor
PHASE 2: RECON
Recon, reconnaissance. This phase is the most important phase. If you do it right, it will most likely end in the success of the project. A good team can ID the targets quickly, modify the plan accordingly, adapt the tools and finish the project successfully.Read More
Phase 1: OPORD
The Operations Order (OPORD), a "directive issued by the leader to his subordinate leaders in order to effect the coordinated execution of a specific operation.". The military five-paragraph format is used to organize the briefing, to ensure completeness, and to help subordinate leaders understand and follow the order.
In our case, an OPORD describes the project, the situation the team faces, the target, and what supporting objectives the team will have to achieve in order to be successful. It sounds complicated, but it's not. Essentially is a set of initial meetings where the team gets exposed to the project and supporting documentation or information is distributed around each member. Each team member begins to prepare the tools and techniques based on the information they have. The team begins to study the target and formulate the initial plan.
The way it works best is to have at least 2 initial meetings:
- A meeting for the presentation of the project and initial brainstorming
- A meeting 2 days later after each team member had had the chance to incubate ideas and have a rough plan.
Depending on the timelines set for the project, those 2 meetings (3 if possible) will bring a lot of good ideas and questions that need answer.
Generally, the format/agenda for each meeting is standard and has shown over time to lead the team and their thinking in the right direction. This, of course, is not set in stone. You have to adapt to each project, but the following format is a good start
- Situation: what is the target, where is located, who are the key players, who requested the project, why, information about their security capabilities.
- Mission: what is the project, what is the objective that needs to be achieved, who are we trying to mimic, when, where and how.
- Execution: This is the initial "plan", what it's to be expected by the team leader or the person that requested the engagement. It should include any rules of engagement (ROE).
- Admin & Logistics: What tools are needed, what we currently have and what needs to be written (software/exploits/scanning) or bought (breaching gear, recon gear, etc).
- Command and Control: who leads the project, comms, deployment of assets and standard operating procedures for everything.
- information already available on the target: perform a surface pass on OSINT just to have some data to begin.
- Ask questions that will allow for better planning and move RECON (the next phase) in the right direction. Ask: what is the history of the target, competitors (if relevant), top executives or commanders, main products or capabilities, simple atmospherics, social media and digital overall footprint (from the surface scan), initial apparent or known vulnerabilities.
This second meeting should conclude with a good idea for what needs to be done, the roles of each team member and a good estimate of the timelines. After this meeting, the team plans the recon. A third meeting will be called to, a sort of in-between-phases meeting, where the recon will be plan and set to go.
The OPORD phase should be short and very intense. Things need to be set carefully, but relatevely fast. RECON, the following phase, will take long and going into it unprepared will not work. Use Phase 1, OPORD, to set the team's mindset and energy in the right direction. Allow them to ask questions, have the senior guy in the team take over the leader for a while. Also, if there is a member of the team that has more knowlege about the particular industry, or mission, product or procedure, bring him/her up and listen. Leverage the team strengh.
Small teams work best. Practice this during this phase.
In the next post, we will see what's needed to plan RECON, why it is so important, and how to perform it.
Our friends at the Red Team Journal posted a notional job descrition for a "Strategic Red Team Director". This provides a good list of what's needed on a Red Team, an what a Red Team should be on an organization. Yes, it's not pentesting.
Go read it.
This is an excellent opportunity for an experienced, forward-looking red teamer to build a world-class red teaming capability at a prominent global organization. The successful Strategic Red Team Director will lead the enterprise’s efforts in adopting and maintaining a system-wide view of threat-driven risks, with the goal of working with senior management to control these risks.
When you stop looking at your phone while you're walking. When you lift your head and just look around, paying attention to sounds, smells, movement. When you observe the world around you.
Things change. You notice things. You realize there are lots of little details everywhere.
You don't need training for this.
Situational awareness allows for a better plan at the end. Recon your target, research online about the weather, patterns of life, terrain, streets, landmark features, history, crine. Then, if possible, go there, spend a day getting a feel for the play, how it works. Maybe talk to people.
A lot of what we do is centered around exploiting 'exotic' targets that you don't normally see during the course of an average operation. Red Star OS 3 (RSOS3) is one such intriguing target that presented itself in the digital field, so we decided to recreate our assessment in our lab and post some of our findings.Read More
"Conflict can be seen as time-competitive observation-orientation-decision-action cycles. Each party to a conflict begins by observing. He observes himself, his physical surroundings and his enemy. On the basis of his observation, he orients, that is to say, he makes a mental image or “snapshot” of his situation. On the basis of this orientation, he makes a decision. He puts the decision into effect, i.e., he acts. Then, because he assumes his action has changed the situation, he observes again, and starts the process anew.
― William S Lind, Maneuver Warfare Handbook
The idea for this assessment came from one of the IT managers at this organization. She wasn't sure people were taking her training seriously, and she wanted to see whether our team could get inside the server room and walk with a drive from one of their servers. Bonus points would be given if we could also take over at least one of the employee's laptops.
After a week of both physical and digital recon, we had solid information that allowed us to create plan. It was going to be a combination of attacks on all fronts: physical, digital and social.
We learned 3 key things on the recon: the back alley on their main building had no camera, the service door there was guarded by a single padlock, and their fire command system (as per the information online), would make the doors "fail open" when it was being reset.
The following week, in middle of most employees coming in, I walked very casually around the building, on the phone "on an important call that needed a little quiet", and reached the service entrance on the back. There, and without anyone looking, picked the lock on the padlock and went into the building. A few minutes later, another guy from the team came by the door and lock the padlock again. Nothing to see... Move along... Any roaming guard will see all as usual.
Onde inside, I put on my fake badge on my belt, and dressed with a suit and tie began walking. After checking the ground floor and going 2 floors up, I found a room filled with racks of servers, routers, and other network devices. Of course it needed badge access. OK, time for the social attack. I called another guy from the team that was waiting by a cafe a few blocks away.
In the meantime, no one challenged me. I was dressed with a suit and tie, I had laptop with me and a pad of paper where I had made some quick diagrams (that said nothing, but looked very official). A few guys said hello with a smile, and one even helped me get a coffee on the small kitchen on the floor.
When R arrived at the front desk, he was dressed on a very convincing fire department uniform. He talked to the security guard and told him that the fire command box was sending alerts to them every 30 min or so, that clearly all was good at the locaiton, but that he needed to see the fire command system. The guard walked with him to the security office, and opened the fire command box. After a few min, R dialed a number on his cellphone (I answered), he said: I think it's all good, we might need to reset the box. Let me know if you see the reset on your end.
He asked the guard to insert his key on the box, turn it and R hit the reset control. It took a few seconds for the box for go down and reboot. He talked to me on the phone: box was reset, can you see it? At that point, all the doors on the floow popped open. I walked into the servers room and said: I'm inside. Let it boot all the way.
R thanks the guard with a smile and while walking always, he commented on the football game for a few minutes. The guard was wearing a football hat and by doing this, he was making the guard feel at ease. An extra step to make sure he wasn't going to get suspicious.
Now I needed to find a drive to remove, and I needed to find a way to "own" one of the laptops. The disk was easy, some of the racks had hot-swappable drives. I searched for one that was labelled "backup" and took it.
The next thing was to find a way to get a laptop. This was done, again, by exploiting the helpful nature of humans. I walked to one of the desks in front of a closed-door office. These desks are usually occupied by assistants to execs, or directors. I found there a mid 40s lady, very well dressed and with "great hairdo". I commented, just passing by, how beautiful she looked and that it must have taken her a while to get her hair so good. She smile a big smile and told me ALL about it. We were having a good chat here. Just as I was leaving, I asked her: I'm having trouble accessing my powerpoints on my computer. I don't whether it's my computer or the thumdrive. Any chance I can check on yours one second?
She smiled and allowed me to kneel by her side, accessing her laptop. I plugged the USB drive, and opened it on her computer. I saw my powerpoint, opened it, but it was greated by a "corrupted file" error. So, I told her thank you and that I was clear my drive was bad. Meanwhile, behind the scenes I had now a backdoor to her laptop. A simple reverse shell that was trying to connect to a specific IP, disguised as an HTTP request. I walked away, smiling and waving goodbye.
Back in the office, the guys where receiving a shell.
Boom. We got them.
So, this one went smooth. Proper planning prevents piss poor performance. The recon, the fact that the company leaked so much of their digital footprint online (from vendors to what software their were using), and a good solid plan that attacked the 3 fronts at the same time, allowed us to really go in and succeed.
It's not this easy most of the times. You have things not working, you have people getting suspicious, you have security controls, and a million other things. However, sometimes... Well, it just works.