Welcome, I welcome you all in this lecture in the course Sandhi in Panayan Grammar. In this lecture, we continue studying Ach Sandhi or the Vawal Sandhi, we stated that Ach Sandhi means Sandhi that takes place of a Vawal and Ach this Sandhi could be a Consonant as well as another Vawal depending on the environment. You said that there are two types of Ach Sandhi, on the screen you see the second type, Dhristhanika Ekadesha, the first one is Ekasthanika Ekadesha, one Sthani and one Substitute, one Substituent and one Substitute, one Sthani and one Adesha. We studied that there are two instances of Ekasthanika Ekadesha, they are Yen Sandhi and Ayavaya Sandhi, Yen Sandhi is stated by the Sutra Ekoyanachi and Ayavaya Sandhi is stated by Echo Yavayavaha and then there are some more Sutras also stating this particular Sandhi. We studied the meaning of these Sutras, we also studied the Udesh Vedaya Bhava and the number of Substituents then delineated because of this Udesh Vedaya Bhava. We also studied the criterion for selection of the Substitute. We also studied the template examples and then we studied the specific examples which fill into these templates, thus we exhaustively studied the first type of Ach Sandhi. We applied the same procedure to the second type namely Dhristhanika Ekadesha, where we have Dvi Sthani and Ekadesha, two Substituents and one Substitute. Stated by the Adhikara Sutra Ekapurva Parayoha 6184 where Ek represents one Substitute, Purva Parayoha stands for In Place of Previous and Later Sound, Purva Par is the Pratipadika and Purva Parayoha is the 6 slash 2 of Purva Par, Purva is Previous, Par is Later. So in all this Sutra means one Substitute takes place of two sounds namely the previous one and the latter one. This is also shown in this particular diagram where we have A plus B in close proximity in the Samhita mode also stated like this, A comes immediately before B and B comes immediately after a, both in their turn bracketing each other and specifying each other as environment. So in this environment of A plus B appearing in the Samhita mode what we have is one of the rules stated in this section that begins with 6184 applies and generates the output in the form of C. So A plus B are the two Sthanis, C is the one Adhikara, two Substituents, one Substitute, A plus B is the input, one of the rules in this particular section applies and generates the output in the form of just C. In case of Ekasthanika Ekadesha we observed that we have A plus B as the input and the output is C plus B. This is the primary difference between Ekasthanika Ekadesha and Dvisthanika Ekadesha. There are five instances of Dvisthanika Ekadesha. The first one is Gunasandhi stated by Adhgunahan 6187. The second one is Vrindhisandhi stated by the Sutra Vrindhirachi 6188. The third one is Pararupa Sandhi stated by the Sutra Engi Pararupam and some other Sutras Engi Pararupam is 6194. Fourthly Akasavarnedirgaha is the Sutra stating the Savarnadirgha Sandhi. Savarnadirgha Sandhi is the fourth instance stated by the Sutra Akasavarnedirgaha 6111. And finally Purvarupa Sandhi stated by the Sutra Amipurvaha 6111 onwards. This is what we are going to study in this particular lecture. It is important for us to remember these fundamentals about Aj Sandhi, the two basic types and the instances of each type. They are repeated only for the sake of convenience and the repetition should bring in more clarity. Only that is the purpose. Let us now concentrate on Purvarupa Sandhi, the fifth one of the second type. This Purvarupa Sandhi is stated by the following four Sutras that we shall be dealing with. The first one is Amipurvaha 6107. The second one is Samprasaranaccha 61108. The third one is Engaha Padantatati 6109.  These are the four Sutras that we shall be studying in detail in today's lecture. First let us study Amipurvaha 6117. There are two words in the Sutra Amipurvaha. Ami is 7 slash 1 of Am. This is the 2 slash 1 suffix. Am is the 2 slash 1 suffix. That is what is mentioned over here. And Ami is 7 slash 1 of Am. So Ami means immediately before Am. Purvaha is 1 slash 1 of Purva. That is previous sound. This is the substitute Purvaha. Rupa continues from Engi Pararupam. And so gets connected with Purvaha and then Purvarupam is what is the interpretation that is generated. The other words continued in this particular Sutra are Akaha 5 slash 1 of Ak. Ak means a iu, ru and lu. So Ak captures the first two Pratyaharas stated in the Pratyahara Sutras and the sound stated therein. These five vowels. So Akaha means immediately after these five vowels. Achi is 7 slash 1 of Ach meaning a vowel. That is immediately before a vowel. And of course we have Ekapurva Parayoh. So one substitute in place of 2 earlier and latter substitute events. For ru and lu which is also part of Ak. There are other specific rules stated in Panini's grammar which cancel 6, 1, 1, 0, 7. For example, Rutongi Sarvanamasthanayoh. So this Sutra states the gunas substitute in place of ru and also lu when Am follows. So this Sutra will cancel 6, 1, 1, 0, 7. All put together let us look at the meaning of Amipurvaha. Amipurvaha means immediately before Am. That is the 2 slash 1 suffix Ritya Ekavachana Pratyayah. Immediately before Am and immediately after Ak in place of both is placed one substitute. That is the previous one. That is in this case the Ak. It is important to remember here that the environment for this Purvarupa Sandhi is just this Am suffix. So the environment is very, very restricted. This Sutra functions only in case of Am suffix. In this case this is 2 slash 1. Now let us look at the examples. So for example we have Rama plus Am. Rama plus Am. This is the Ritya Ekavachana Pratyayah and the final form that we are deriving is Ramam the Ritya Ekavachana form of the Pratyapadika Rama. So when you have Rama plus Am there is this R and this R, R in Rama comes at the end of it, R in Am comes at the beginning of it. Since this is one padha prakriti and pratyayah, so Samhita is obligatory and so in place of both of them this Sutra 6107 applies and generates the output in the form Ram, R and M, that is Ramam. In this case obviously R is followed by another R, so this is the scope of application of Akasavaranei Dirgaha as well generating long R as the output. But because both these Akaras are within a padha we also have the Pararupa Sandhi that can apply over here. Ato gunai, a padhanta dakara gunai parataha pararupam ekadeshasyaat. So Pararupa Sandhi is also possible. All these possibilities they are cancelled by Amipurvaha because of the specific mention of the suffix Am. In case of Am no Pararupam, no Savarna Dirgaha, just the Purva Rupam. So we have Ram, R and M that is Ramam. In case of Hari plus Am, obviously there is Ekoyanaji which has got its scope of application but it is cancelled by this Sutra Amipurvaha which operates in a very restricted domain of the Pratyayah Am. So we have Hari having E at the end, R at the beginning of Am and because this is one padha, Samhita is obligatory and so in place of both these vowels, 6107 applies and generates the output in the form of Har Ima Harim. Then we have Gauri plus Am. Now this is a long vowel, E followed by a once again Ekoyanaji has got the scope of application. But because this Sutra, 6107 has got a very limited scope of application, so in this limited scope of application, 6107 cancels Ekoyanaji and so in place of both these vowels is substituted the Purva that is this long E. So we have Gauri, E and M that is Gauri. Here is the case with Bhanu and Chamu. So we have Bhanu plus Am, the scope of application for Ekoyanaji but it is cancelled by this particular Sutra because of the limited domain of application. And so in Bhanu plus Am, U coming at the end of this padha or coming at the beginning of this padha because this is within a padha. So Samhita is obligatory, 6107 applies and generates the output Bhanu, M that is Bhanum. Similarly Chamu plus Am where we have long U followed by a and 6107 applies and generates the output Chamu and M that is Chamu. This is how Amipurvaha operates in a very, very restricted domain. Let us now proceed to the next Sutra, Samprasaranaccha, 6108. Here there are two words, two padhas in the Sutra, Samprasaranath and Chha, Samprasaranath is 5 slash 1 of Samprasaranath, which means immediately after Samprasaranath, Chha means end, Achi is continued, Achi is 7 slash 1 of Ach, that is immediately before a vowel. Purvaha is continued from Amipurvaha, previous sound as substitute and Ekappurvaparyoh is also continued, meaning one substitute in place of two substituents, Arrear and Later, Purvaha and Parah. So the meaning of this Sutra is immediately after a Samprasaranath, immediately after a Samprasaranath and immediately before a vowel in place of both is substituted the previous sound, that is the Samprasaranath. So what is a Samprasaranath is the next question and Samprasaranath is a technical term defined by Panini by this particular Sutra, Igyanas Samprasaranam 1145, Ek as we know is a Pratyahara and it captures the sounds I Uru and Lu and Ek is in one slash one, so Ek is the substitute. Yanaha is 6 slash 1 of Yen, Yen is another Pratyahara, meaning Yavarra and Le, so Yanaha means in place of Yen. So the Sutra means Ek that is stated as a substitute of Yen by the Sutra is termed Samprasaranath. Repeat 6, repeat Ek that is stated as a substitute of Yen is termed Samprasaranath, stated by the Sutra 6 115 as well as 16. So if Yen is the input, if Yen is the input and in its place 6 115 or 16 as stated an Ek, this Ek is called Samprasaranath, this Ek is called Samprasaranath. Let us take the example, there are two examples on this particular slide, let us take the left hand side example where you have Vachh plus Th, this is the past passive participle of the verbal root Vachh to speak and we add the suffix Th to it by the Sutra 32102 Nishtha. Now in this case because this suffix is Kith, so 6114 applies and substitutes this Vh consonant by Yen in this case by Ek in this case U. So we have U replacing the Vh consonant, R remaining as it is and Ch. So we have U achh plus Th. Now here is the case where you have U as Samprasaranath, immediately after this U comes a vowel, so Samprasaranath and achi and now in place of both of them substitute the poor, that is this Samprasaranath. So the next step is by the application of 6108 we get Uchh plus Th. Then we apply A230 and substitute this Ch by K and so we get Uchh plus Th, Uchh Th, something that is said, that is what is Uchh Th. This is an example of Samprasaranath. Let us take one more example of Samprasaranath. This is the verbal form, so we take the verbal root Graha to take or to cognize and add the suffix Lut to it to indicate the present tense by 32123. This Lut gets substituted by Th by 3478. Now this verbal root Graha and this suffix Th have one more suffix in between namely Na added by 3181. So now we have Graha plus Na plus Th. Now because of this Na, now something happens in this Graha. So this vowel, so this consonant R now is substituted by Samprasaranath. So now this R gets substituted by vowel Ruh. So we have Gruh, this R remains as it is and we have Aha, so Gruh, Aha, Na and Th and now we have Samprasaranath followed by a vowel. So in case of, in place of both of them, 6108 applies and says, do the Purva Rupa Sandhi. That means substitute this Samprasaranath. So by doing that we have Gruh, Aha, Na, Th and then Grin, Ha, Th which means he or she takes, he or she cognizes. So these are the Samprasaranaths and this is the Samprasaranaths substitute coming in place of 2 vowels and the Purva Rupa Sandhi takes place. Now let us study the third sutra, Engah, Padantat, Ati. In this sutra there are 3 padas, Engaha, Padantat and Ati. This is 6109. Engaha is 5 slash 1 of Aing, Aing means A and O, Engaha means immediately after Aing, that is immediately after A or O. Padantat is 5 slash 1 of Padant, Padant means final part of a padha. So Padantat means immediately after something that comes at the end of a padha. This 5 slash 1 and Engaha which is also 5 slash 1 are related. So Padantat becomes the qualifier of Engaha. So what both these mean is if an Aing coming at the end of a padha. So if Aing occupies the final position of a padha then immediately after that, that is the meaning of Engaha and Padantat. Then we have Ati, 7 slash 1 of At, At meaning short a. So Ati means immediately before short a. So immediately after Aing that comes at the end of a padha and immediately before short a, what happens is Purva Rupa. So previous sound is the one substitute. Of course Ekapurva Parayohu continues. So the meaning of the sutra is immediately after Aing that is A and O that comes at the end of a padha and immediately before short a in place of both is substituted the previous sound that is Aing that is A and O. I repeat immediately after Aing Engaha that is A and O. So immediately after A or and O that comes at the end of a padha Padantat and immediately before short a, Ati in place of both Purva Parayohu is substituted the previous sound that is Purva Rupa. In this case it is Aing which is A or O. So here is an example Hare plus Ava. These two are separate padhas and so they are in the close proximity because the speaker intends to utter them in close proximity. So we have Hare having A at the end at the end of the padha and a short a coming at the beginning of the second padha. Now in this case 6109 applies and generates the output in place of A and a A is the substitute. So you have Hare A and A and then you join them together and you get Hare Ava as the output. Similarly you have Vishnu plus Ava where you have O at the end followed by A at the beginning of the next word they are in the Samhita mode. So 6109 applies and substitutes both O and A by the previous sound in this case it is O. So we have Vishnu, O and V and so Vishnu, V that is the output generated. Both these outputs they are also written as this. There is a sign of Avagraha, this is called Avagraha that is inserted in between something that resembles the English S Hareva and Vishnuva because there is this long vowel and there is this Sandhi. So this is indicated by this sign insertion. This is how Enga padhantaati works. If you look at these examples once again you will observe that when you have Hare plus Ava A followed by A actually this is an instance of H O Yava Yavaha. Similar is the case with O plus Ava but H O Yava Yavaha applies generally at the end of the padha as well as at the in the middle of the padha anywhere but and also the right hand environment could be any vowel but in this case it has to be only a right hand side environment and this A has to be at the end of a padha that is all. Once again very restricted very very limited environment in this particular sutra applies. Now the final sutra in these four the sutra is Gnasingasoscha, Gnasingasoho is 7 slash 2 of Gnasi and Gnas, Gnasingas, Gnasingas are two suffixes 5 slash 1 and 6 slash 1. So 5 slash 1 and 6 slash 1 are Gnasingas, Gnasingasoho means immediately before Gnasingas. Sucher means and words continued are Engaha and Ati, Engaha is 5 slash 1 of Eng, A O which means then immediately after Eng that is immediately after A and O. Ati is 7 slash 1 of At that is short a. So Ati means immediately before short a, Purvaha that is previous sound as substitute and Ekapurvaparyoho one substitute in place of 2 namely the earlier and the latter substituents. The meaning of the sutra after having put all these things together is the following. Immediately before Gnasingas that is suffixes of 5 slash 1 and 6 slash 1 and immediately after Eng that is A or O in place of both is placed one substitute which is the previous sound Purvarooper that is Eng that is A or O. I repeat immediately before Gnasingas, Gnasingasoho which are suffixes of 5 slash 1 and 6 slash 1 and immediately after Eng, Engaha in place of both Purvaparyoho is placed one substitute Ekaha which is Purvaha or Purvaroopa which in this case is Eng. Once again this rule as we observe applies in a very very restricted domain of it is a cases 5 slash 1 and 6 slash 1 a very very restricted domain. So in this case it also cancels which would have otherwise applied. Here are the two examples. The first one is the 5 slash 1 of Hari and the second one is the 6 slash 1 of Bhanu. So Hari plus Gnasi, Gnasi is added by 412 then we have Hari plus us. So the markers are removed. Now in this case ecoenergy has the scope of application but that is cancelled by 73111 which substitutes guna in place of this. So we have Hari plus us and now at this stage Gnasingasoho comes into play and says that in place of this A and this don't do H-O-Y-Y-Y-Y-Y but substitute 1a in place of both of them. So we have Hari plus us as the input 61110 applies and the output is Har-e-sir that is Har-e-s and Hari which means from Hari. Similar will be the derivation of 6 slash 1 as well. Now let us go to the 6 slash 1 of Bhanu where we have Bhanu plus Gnas and here we have 412 applying then the ith saudhna and lopa happens. So we have Bhanu plus us. Now once again here Nithi applies 73111 and this U is substituted by O. So we have Bhanu plus us. Now at this stage H-O-Y-Y-Y-Y has the scope of application but that is cancelled and 61110 applies and substitutes both these O and O by one substitute that is Purva that is in this case O. So we have Bhanu, Sir, Bhanu and Bhanu. Similarly the 5 slash 1 of Bhanu can also be derived. To summarize we studied the Purva Rupa Sandhi along with the study of the 4 sutras. This Sandhi applies as we have seen in a very restricted domain and so it cancels the by default rules like 6178 etc. We also noted that 61107108 and 110 Amipurvaha Samprasaranaccha and Nasing Asoscha apply only within a padha whereas 61109 Enga Padantadati applies only in between two padhas. This distinction is very very important. So now we come to the close of the treatment of Atch Sandhi. The fifth instance namely Purva Rupa Sandhi is also dealt with now. So we will take a look at the study of Atch Sandhi that we carried out in this particular course. This we shall do in the next lecture. Thank you for your patience.


Hello, everybody. Welcome to this talk. My name is Jose Carduño, and the title of the talk is C2 Centipede. It's actually the name of a tool I made to try to evade certain type of blue team detection strategies. A little bit about me. Okay, I was born in Mexico. I took a small detour. I ended up in Switzerland after 15 years of wandering around. I'm a senior security consultant for dream lab technologies. And I have been in the Audi team since the year 2014. So basically pen testing, infrastructure applications, and so on. I've been a speaker previously in other conferences. I would actually recommend you, especially the ones in Latin America. Very nice and fun places to be. Okay, so let's start. Why are you here? Why are you watching this?  You want to know how you can exploit or empire. And a little bit of how it works. It's magic to you. Like how do you get the shell? What's happening behind the scenes? Also, it could be that you are not an APT, but you want to emulate more advanced scenarios than what the default vanilla metasploit or empire can give you. Interactive shell without getting detected by your tools beaconing. Okay, so this is one reason for the red teamers. And for the blue team, of course, how can you catch the bad guys now? I will talk about some techniques, how you can do it right now. And of course, with the techniques presented here, what's maybe coming next. So you can see what the bad guys are planning. So the context of these, basically, I just approached the blue team, the sock team at Dream Lab because I wanted to learn their techniques. Basically, I'm a little bit maybe sometimes too focused on the offensive part and just hope they don't catch you. So this was a little bit of finding out what the blue team is doing now, what techniques they use, what tools they use, and maybe how I could evade them. The talk is about this journey to try to evade the blue team detection on the network only. So I will not talk about antivirus evasion or any other host-based evasion. In this tool, I implemented some techniques used by APTs. And I will briefly go over some vulnerabilities I discovered along the way. Okay, so the basic objectives as an adversary, especially, let's say a red team adversary, is to maintain access in the organization and to have this interactive command with the host inside the organization and maybe exfiltrate some data. You also want to have a resilient command and control infrastructure. So basically, maybe the blue team will try to block you or they will try to bring down your infrastructure as well. And then how can you do this while staying as anonymous as possible? So we will discuss that as well. So basically, I just started surveying what techniques are APTs using. Most of them are used with botnets, so fast flux networks where there is a domain name that responds with several or very many IPs to every request they get. So this is why they get the name fast flux. And basically, botnets, for example, have or they install a proxy. So they can use all of these infected hosts to proxy the traffic from the victim to the command and control server. Also they use, especially for botnets as well, domain generation algorithms. So basically, adversaries don't have to hard code at the main name that maybe if they do reverse engineering, they can maybe sync hold it, or if they add some hard coded IPs, they can just perform some maybe a sandbox analysis or something like this and get the IP and then just block it, right? So this is why they use domain generation algorithms. Also, a very common technique for hiding malicious traffic is domain fronting. And I will talk about that and how all of this is somehow integrated in the tool. So let's talk about shells. So basically, a shell allows you to execute interactive commands in a host, right? That you have already owned via phishing or exploit or something like this. There are basically two types of shells, the bind shell, which listens on the target or on the victim. Basically, the malware opens a port on the victim host and then the attacker connects to the victim in that port and starts executing commands there. This works when there is not a firewall here or maybe this user is knotted. So the attacker has difficulty reaching the victim inside this knotted network or through this firewall. So the alternative is a reverse shell. A reverse shell is the other way around. Instead of the attacker connecting to the victim, the roles are reversed. So the attacker opens a port in his machine or in a server he controls and then the malware he executes on the victim makes the connection back to his server. Some types of reverse shells, a basic simple TCP connection like I just talked about with NetCut or this very simple, very typical bash reverse shell. Another way is to have HTTP reverse shell. So basically here the attacker hosts an HTTP service and the victim connects to it asking for commands to execute. So basically the victim connects, says, do I have something to execute? The server says then, yes, you can execute this. The victim will execute it and will send the result back to the attacker. Why choose reverse HTTP shells? So outgoing HTTP traffic is usually allowed in enterprise networks. There is a lot of traffic to blend in. There are also different very wide variety of content inside this HTTP traffic where you can hide your command and control communications. Additionally, techniques like domain fronting can help you hide this malicious traffic. Then let's look at a specific example on how Metasploit reverse shell payload works. So basically you have here the Metasploit handler and in the other side you have a meterpreter or the Metasploit Trojan. When you execute the Trojan it makes a request, a GET request to the server asking if there are any commands that it needs to execute. If they are not the server response with the HTTP response, there is nothing you should execute. The Trojan then waits for 10 seconds and it asks again the same thing. In the meanwhile an attacker can say, okay, I want this Trojan to actually execute this command. So the next time the meterpreter goes to the HTTP server and asks, do you got a command for me, this HTTP server will actually respond, yes, I have a command that I need you to execute. So the Trojan will execute it and then will post with the HTTP post request, will post the result. So as you can see there are like this very continuous request. This is called a beacon. How is actually the beacon implemented in Metasploit? So I said 10 seconds before, it's a little bit more complicated than that, but not so much. So when the Trojan of Metasploit, the meterpreter connects to the server, the initial interval between each connection is about one-tenth of a second. So 100 milliseconds and every time the Trojan doesn't get any task to execute, it adds another 100 milliseconds. So the interval starts growing until it's 10 seconds. After it's 10 seconds, it just keeps the interval at 10 seconds. So it just asks, do you have a task for me? No, do you have a test for me? No, and so on every 10 seconds. When it actually has a task for this Trojan, then the delay becomes again 100 milliseconds and then starts increasing the interval. You can see how it's implemented actually in the Python meterpreter, in the Java meterpreter and so on. So how do you detect these with very simple statistics? There is a great project called RITA, a tool to detect this beaconing behavior. So they use basically just statistics with this interval, the sizes and so on. It's made by Active Countermeasures. They have some threat hunting labs where you can actually test all of this. You can install SecurityOnion, which is a distribution that, I could say it's like the Kali for Blue Team. So if you want to test all of these tools like RITA, Kivana and all of that, it's a very easy way to test it actually. If you want to learn a little bit more about beaconing, you should really check these resources. So the beaconing detection in RITA, actually the source code, it's in GitHub and it's very well documented actually. You can see here how they are basically scoring the beacons. They do a scoring based on interval of each of the connections, the number of the connections between two hosts, the data size of the data in these connections, the dispersion which is like, okay, you have intervals of 10 seconds, but maybe you vary by maybe plus minus two seconds around this 10 second interval. So that's the dispersion. The really great thing is that it's protocol independent. So you can have a Trojan that connects via DNS or one that connects via HTTP or a custom TCP or whatever protocol and it will be still detected by RITA because they just focus on the connections, not in the content of the connections. So the thing is I saw that RITA focuses on IP pairs. So basically you have a source of the communication and then a destination. So this is basically saying that you will have your compromised host on one side and then just one command and control server. This is the usual case actually. So this is where the whole idea of implementing this tool was born actually. So what are the possible evasion strategies for RITA? So I thought maybe if I become less of them, I can reduce the score. Also, if I modify the interval and add some jitter, which is the deviation of the periodic signal, I could also affect it. You can modify the interval of your normal, let's say, command and control interaction. If you just, in Metasploit, you just use a command sleep. This will just stop all the connections and then resume them after the number of seconds that you specify. Then I thought, okay, so if RITA is making the analysis on IP pairs, maybe I should distribute all the connections that the infected host makes to the C2 to go through several or many command and control addresses. You can do this also with Metasploit transports, but I wanted to make a more generic and a little bit more dynamic way of doing it. So where can we get multiple IP addresses for our command and control? Well, the first thing I thought about was using reverse HTTP and reverse TCP proxies. So I started by doing a survey of reverse HTTP and reverse TCP software and services. Some of the services I found was localhost.run, which is basically a SSH service that you can do a reverse tunnel with it. NROC, which is also a very popular service where you can do HTTP and TCP proxies and pagekite. LocalTunnel is very interesting because they also have the code in GitHub, so you can host your own server for localTunnel and you can also use their service. And then FRP and Venom. FRP and Venom I found in the Mitre attack page. So I started by searching how many FRP, which is fast reverse proxy, actually the name. I found 15,731. From those, well, the majority was hosted in China, actually, then the United States and Hong Kong. Of all of those, I found 810 that were open, meaning no authentication to establish a TCP reverse tunnel, and 416 for establishing reverse HTTP connections. Well, this was actually a fantastic news for me because I said, okay, if I wanted more IPs to send the traffic of my command and control, well, now I have more than 1000 IPs on my disposal. So this was great news, actually. Then localTunnel, I found 290. You can do reverse HTTP proxying through it. The C2 centipede features that I implemented is the modification of the beacon interval, the type of charge and detection. So it detects if you are using an interpreter or if you are using an empire agent or any other, well, not any other, but other generic responses. The Foxflux part is just sending, let's say, many IPs to the client, so it can not directly send the request to the command and control, but through these many IPs. The multi-fronting is just a domain fronting, but that is not actually just using one domain. So you can send many domains that you want to front through in one CDN or two or an amount of CDNs. I also implemented the domain generation algorithm of Flubot and DGA kind of thing for generating the virtual hosts for the FRP reverse proxying. You don't have to configure everything before sending the Trojan. So the Trojan can establish one connection on, let's say, one of all of these ways, and then it can just add more IP addresses or change the beacon interval or all of this stuff dynamically. So how do we change the beacon interval? We have seen, for example, the Metasploit case that it has its own beaconing strategy, let's say sending a beacon every 10 seconds. So what we're doing in the C2 centipede is just faking the response of what Metasploit handler would say to say there are no tasks for you to execute. So it connects 10 times and you can say, okay, instead of sending 10 times, which is a lot of beaconing for my taste, just fake 20 times saying that there are no tasks and then the 21st attempt that you want to communicate with the command and control, then you actually send it. And then the rest, again, 20, you don't send it and then and so on. So the beaconing gets reduced a lot. The FoxFlox, as I was saying, is basically not using DNS because I don't have a botnet available. But I do want to use many IPs. So we are using the, let's say, open reverse proxy approach. And so there is a kind of a DGA that is used on both the client and the server. When the server requests reverse HTTP tunnel from an FRP server, it converts the IP of this server into a host. So you can see here news.biohub.io is generated by this IP that is here. So when the C2 centipede server tells the client, okay, now which you should send your request through this FRP proxy, both server and client know how to set up the proxy by telling FRP, I want to use this host. And then the client also has the same algorithm. So knows what host to send in the HTTP request. So that the HTTP request goes from the C2 centipede server client to the server. So multi-domain fronting basically, domain fronting abuses the routing scheme in content delivery networks to hide the intended destination of the HTTPS traffic. So basically, let's say that the TLS outer wrapping is saying, hey, I want to go to Amazon or whatever. But inside the HTTP header is saying, not really. I don't want to go to Amazon. I want to go to evilserver.in the same CDN. So the CDN actually like unwraps this TLS stuff and then just routes the request to the server specified in the HTTP host header. This is very easily implemented in the tool.  You cannot use one, two CDNs as you wish. Then the domain generation algorithm. I already talked a little bit about it. I implemented the flubot actually based a lot on this blog post on switch.ch Basically, flubot has an algorithm that you provide a seed. Then you say how many domains you want to generate. And here in the C2 centipede, you specify to what port you want to connect on those generated domains. And then the dynamic configuration. Basically, you have every time the Trojan wants to connect to the C2 server, it connects actually to the C2 centipede proxy first. And then the C2 centipede protocol is piggybacked on this call. The original request from the Trojan, it's kind of wrapped and then sent to the C2 centipede server where it's unwrapped. Then the original request is passed to the Metasploit handler or the Empire handler. And then the control data for the C2 centipede application, it's embedded and wrapped and sent to the C2 centipede client. So this means that the operator can add more C2 addresses, change the encryption key, also this whole thing is encrypted on top of the encryption of Metasploit if you're using Metasploit. You can change the number of fake answers it sends at any moment. So you can change it while it's running. Here we have the C2 centipede architecture. Well, this is the normal architecture that you use when you have a normal Metasploit that connects directly to the handler. Then this connection is repeated every 10 seconds, every time to the same server. What we want to achieve is connect through many IPs, let's say, and to alter the beginning interval. So basically the Meta operator instead of connecting directly to the handler, it connects to this sort of proxy. The C2 centipede proxy then has an internal routing table and it decides on the desired route it wants to take to reach the handler. So the Trojan sends the request to the local host and then the C2 centipede client chooses one of these, can be through the main fronting or through a FRP reverse tunnel, and then it reaches the C2 centipede server. The C2 centipede server kind of unwraps the original call and sends it to the destination Metasploit HTTP handler. Then it obtains the response and sends it back to the C2 centipede client and then from there to the Meta operator client to the Meta operator Trojan. You can also have this configuration where you have one host with a Meta operator and also with the C2 centipede client. And then you can have other compromised hosts in that same network connecting to this one only host with the C2 centipede client so that all the traffic goes through this host and does all this routing for them. So this is the C2 centipede operation. Basically, you need first to set up the Metasploit empire or whatever you're using handler. So basically this is the command to set up a Metasploit handler. You set the payload for whatever payload you want. It has to be reverse HTTP. Here I'm using a stateless HTTP shell. Then you set up the port of the handler and then the host you want to bind to and you run the Metasploit handler. Then you need to configure on the server as well the C2 centipede server. You need to specify a port and then the destination where all the requests that it gets will be forwarded to. So this will be the Metasploit or empire handler. Then on the client you need to set up the C2 centipede client. You specify on what interface you want to bind. This is in the case of just having it in one host not anyone else connecting to it. You specify the port that you want to run the C2 centipede client on. Then the list of C2 centipede servers is either domain-fronted or through FRP proxies. Or you can also give with the minus S you can give the individual servers. Of course then you need to generate the Trojan and then you just need to execute the Trojan in the same host that you are executing the C2 centipede client. Of course you can also compile it for Windows and then just run it there. Right now we will test a shell with C2 centipede.  We will set up the C2 centipede server. We will set up the port in 1993 and then we will say that the Metasploit handler will be in this host and IP. In this case it's on the same machine but you can also let's say point to Metasploit handler in another machine. So here I will with Metasploit I will run a handler so I will use the exploit multi handler and then set the payload for Windows Metasploit Reversed HTTP. This is a stateless HTTP payload and we set the port to 8888 then we set the host to all interfaces and then just run. And we can start as well the C2 centipede server on port 1993. Okay, so we already have the multi handler listening on that port with this payload. We can start the C2 centipede client. We need to specify the web interface we are binding to and then the port. Let's use port 2233 because I already generated a stateless meterpreter pointing to localhost and port 2233. And then we will connect it specifying the C2 centipede server. It was running on port 1993. That should be running. We can test the connection all the way to the handler by issuing a crawl command to localhost. So this is the actual response from the Metasploit HTTP handler. It actually emulates an Apache server but you can see that the connection actually was sent through the C2 centipede client and to send to the C2 centipede server as you can see here. We execute the crawl again. You get the connection again through the same route. And here you can see the connections. Okay, so let's now execute the meterpreter. What you hear is every connection that gets to the C2 centipede server. So you will see how much the Metasploit or the meterpreter Trojan connects to the handler is a connection, an HTTP request action. And as you can hear, the interval between each call is little by little growing. So if we continue, we could see that the interval grows until 10 seconds and then it just keeps being 10 seconds long. But what happens when we interact with the Trojan? We said that it goes back to 100 milliseconds and then it does this growing of the interval again. Let's interact with it. As you can see, there are more connections now. Let's execute something again. So this is all the noise that you are generating every time that your meterpreter connects to your handler. So it's not magic, it generates a lot of noise and actually quite very nice looking beacons all the time. So this is very easy for the blue team to detect with a tool like Rita. So this is where we come and try to do things a little bit different. This is the C2 Centipede operator interface. We say to what server we are connecting to and then we can see the client that are currently connected. We can set up another route. Let's first fake the responses. I will just execute one more command to get a faster beacon.  The responses for four requests. As you can see here, it's now one, two, three. You don't hear anything because nothing is going through the network. Here you will also see the gap. Now it's sent again the request. So you see this was the original beacon and with the C2 Centipede we are now adding this gap. So adding to the interval. We are now only faking four responses. What we can do, of course, more. We can go back to zero if we want more interactivity. Here you can see how many times it has faked. So it starts again. Fake one, fake two, out of four. Fake three, out of four. Fake four, out of four. And then it will go again out as you can see now. So let's say you want more interactivity. Of course, I can show that you can still retain. Let's see. It will take a little bit longer because not all requests are coming, but now it will execute. So you can still execute commands. So now let's add some proxies. Let's try. So we will set up some... Let's try three or four. So these are open on the internet. I will just press set up and then it will establish the connections. As you can see, these two are no longer working. So we can actually remove them. So let's add some other ones. So let's send it to the C2. Bye. Let's see to send a bit clearer. So I will press send. So the next time it connects because now it's faking. So when it connects, it will get the servers, add it to its routing table, and then it will actually use it to route the traffic through them. You can see I still have command over the Trojan. And actually the frequency of the beeps means that it's using... Like each IP generates a different frequency. So here, if we see it, it will be using like these IPs we added. So this is going through China, the US, and so on. Okay, so we can also use the main fronting. As we saw previously, I will just, again, using this tool, I will send multiple servers at them here with the format I was telling you before, front it, and then the domain you want to front through. And then the host, it should actually redirect. So there it will send it. It adds to the routing table. And then it will use them. So here it sent through this one. There are some debugging things going on. So at some point it stops, but then it continues. As you can see here, the domains that it's using to front here. Okay, so that's the demo. I hope you liked it. And we'll continue with the presentation. Okay, so how does the traffic looks for the blue team? Here, I executed the interpreter against these hosts only. Only one host using no sleeping, let's say, or faking, just direct connections. As you saw here, there are six, all of this is one minute intervals. So there is six requests per minute. You have here this big peak when you execute the who is command. So you can see there are like many, many more connections in a minute. And then it uses that algorithm from Metasploit and then just reaches 10 per one request every 10 seconds. So six per minute. And here Rita, this is already the output from Rita. It gives a score of 70% to that IP that we were beginning to. Here, we have to specify that this is just like half an hour of it running. Of course, when you do this beginning detection with Rita, you want much bigger amounts of time like the traffic for a day or more. Here, just for the experiment and for the proof of concept, we just have nine, sorry, half an hour period of time. So this is the normal way. And then how does it look when we do it with the C2 centipede? So we, for this test, we added 10 IPs. These are 10 FRP HTTP reverse proxies. And then we set some faking of the responses so that it doesn't become so often. Okay. So the result is this, that sometimes you have many more, well, not that many actually, but at some point, you have some request and then it doesn't fake for a while. And then you have periods of time that for five minutes, for example, you don't have any beacon. And then you can see that at this point of time, it uses one server, then here, maybe it uses the same. Maybe here it uses another one. And then it uses the green one, the blue one, the green one, the pink one, and so on. So the beacon is not a perfect beacon. So that tools like Rita don't see these perfect beacons. Okay. So the results from Rita also by this half an hour period of time. Is that it doesn't see a beaconing pattern basically because there are less beacons and because it is routed through several C2 IPs. So we can conclude at least for this very small experiment that it is like mission accomplished at least for this. So the conclusion is basically that the beaconing is, of course, not the only threat hunting technique, but one that blue teams should be doing. So if you are using the default vanilla metasploit empire, know that if the blue team is doing beacon detection, it will jump right at the blue team. It's very visible. Also, if you use 1000 of servers to proxy to your command and control server, of course, because it's not the only threat hunting technique, this beaconing detection, you will be detected because the host is connecting to this so many servers. So you need to balance. It's a balancing act of how often you want to beacon.  If you use really many servers, then you will be more visible. So you have to balance this, all of these things. Okay, so that was all I would like to thank you. It's a shame that I, of course, most of us could not be there in DevCon. Actually, I wished it was my first time there. But that's how it goes. I wish you are safe and that you can maybe contact me, give me a little bit of feedback and maybe chat or something like that. Okay, thank you very much. See you later.


Thank you for your interest in our 2021 Toyota Venza here at Oxford Toyota now to help you all With your research.   This color is in the Blizzard pearl Now when I said it is a hybrid I mean that's really important right now especially with gas prices Continuing to rise so with this one you'll get 40 miles per gallon in the city 37 highway 39 combined so you can drive just over 560 miles before you have to stop to get gas. That's really really great So it's definitely something to keep in mind out with this vehicle with it being a hybrid Now for your wheels, you're gonna have 19 inch chrome alloy wheels beautiful against You know that color the black on the bottom right there. She's a really stylish vehicle Now why don't we hop on in? Now you have a nice contrast from the white so in the interior you have that Brown kind of soft text in the middle you have the black soft text seating Really soft throughout this vehicle kind of really luxury feels you have this beautiful gray kind of wood like now Let's look kind of in the middle console where the The screen is so right here.    There is Apple CarPlay in Android Auto as well And then you'll have your drive modes different drive modes up here If you click that you'll have your normal you have sport and then ego All right, so in the second row you have really good spacing I mean, I'm one of my five seven ish and I mean I have really good leg room I mean you have a lot of space for your head really comfortable back here There's gonna be a 6040 split you are going to have all-weather floor liners throughout the vehicle So we have mech here in the front and then I'll go ahead and show you the trunk space Okay, so back here by the trunk. This is a hands-free lift gate. So Just touch there's a little teeny tiny button right there All right.  So that's great as Kentucky's number one Toyota dealer We really appreciate your inquiry on the 2021 Toyota Venza Now if you have any questions or if you would like to take a test drive All you have to do is reply to this message. We look forward to seeing you guys soon Thank you. Bye