SEC-T - 0x0Compute

September 19-20, 2019 – Stockholm, Sweden

Dark side ops 2: Adversary simulation training

Dark Side Ops 2: Adversary Simulation is the combination of sophisticated, red team trade craft and cutting-edge, offensive development to simulate real-world adversary activities. Challenge yourself to move beyond reliance on the typical “low-hanging exploitable fruit” from 1999 and start thinking, persisting, pivoting, and operating like a sophisticated adversary. Application whitelisting got you down? No problem. Can’t catch that callback? Been there. No touching disk? No worries. Dark Side Ops 2: Adversary Simulation helps participants up their offensive game by sharing the latest in initial access and post-exploitation, defensive countermeasure bypasses, and unique malware code execution techniques.

Dark Side Ops 2: Adversary Simulation builds on Silent Break Security’s Dark Side Ops: Custom Penetration Testing training by furthering participants’ abilities to think, operate, and develop tools just like sophisticated, real-world attackers. If you want to

  1. build confidence in your offensive approach and capabilities,
  2. learn about and implement the techniques of stealthy malware and backdoors, and
  3. achieve the operational results of a sophisticated adversary, then Dark Side Ops 2: Adversary Simulation is for you.

Dark Side Ops 2: Adversary Simulation provides participants with hands-on labs over an intense, two-day course.

Network forensics training

The two-day Network Forensics class consists of a mix of theory and hands-on labs, where students will learn to analyze Full Packet Capture (FPC) files. The scenarios in the labs are primarily focused at network forensics for incident response, but are also relevant for law enforcement/internal security etc. where the network traffic of a suspect or insider is being monitored.

Day 1 – Theory and Practice using Open Source Tools

Day 2 – Advanced Network Forensics using Netresec Tools

The Scenario

The scenario used in the class involves a new progressive Bank, which provides exchange services for Bitcoin and Litecoin. We’ve set up clients and a server for this bank using REAL physical machines and a REAL internet connection. All traffic on the network is captured to PCAP files by a SecurityOnion sensor. In the scenario this bank gets into lots of trouble with hackers and malware, such as:

Class attendees will learn to analyze captured network traffic from these events in order to:

NetworkMiner CapLoader Professional software included FREE of charge

Each attendee will be provided with a free personal single user license of NetworkMiner Professional and CapLoader. These licenses will be valid for six months from the first training day.

Target Audience

Q: Who should attend?
A: Anyone who want to improve their skills at finding evil stuff in full content packet captures.

Q: Who should NOT attend?
A: Those who are afraid of using Linux command line tools.

Training Preparations

Laptop Required
Attendees will need to bring a laptop that fits the following specs:

A VirtualBox VM will be provided on USB flash drives at the beginning of the training. Please note that having a 64-bit CPU and a 64-bit OS is not always enough to support 64-bit virtualization. You might need to enable features such as ”AMD-V”, ”VT-x” or ”Hyper-V” in BIOS in order to run virtual machines in 64-bit mode. You might also need to turn off “Intel Trusted Execution” in BIOS. One way to verify that your laptop supports 64-bit virtualization is to download the SecurityOnion ISO and see if it boots up in VirtualBox.

Basics of binary exploitation training

Overview

Binary exploitation is the topic concerning the finding and exploitation of vulnerabilities in low-level code, particularly machine level code. It is usually considered one of the more complex areas of IT security and some of the exploits produced sometimes chain together dozens of moving parts in mind-boggling ways to cause programs to behave in a completely unintended manner. The field is the basis of high-severity exploits such as OS privilege escalation, jailbreaks and browser exploits.

Learning goals and expected outcomes

This two-day training aims to give the participant a deeper understanding of how programs execute and interact with the rest of the system, an understanding of the basic building blocks, terminology and anatomy of binary exploitation as well as hands on experience and creating some basics exploits of their own. It will also cover various protection mechanisms, how they work and how to deal with them. Throughout the course, techniques for finding vulnerabilities, analyzing and turning them into exploits will be covered and practiced in the form of hands on exercises.

After completing the training the student will have a solid foundation from which they can continue exploring the field of binary exploitation and allowing them to start learning advanced topics such as kernel exploitation, different architectures and exploiting real-world software such as browsers and phones. The student will also have a basic understanding of some of the various techniques used for working with analysis and exploitation of programs.

Course contents

The course will cover the following topics will be covered in the course. Topics marked with “*” will be covered as part of the introduction/background without accompanying exercises. Topics marked with “**” are advanced topics covered as part of an introduction into how to proceed after the training.

Outline

Below is a rough outline of the planned schedule for the training. This is preliminary and subject to change. A more definitive schedule will be posted prior to the training.

Tools used

We will be using mostly free and open source tools throughout the training. Programs will be debugged with gdb with the pwndbg addon. The exercises can be solved with a programming language of your choice but examples will be presented in Python with the pwntools framework.

The only commercial tool we will use is Binary Ninja which is a reverse engineering platform. A personal non-commercial license for Binary Ninja is included in the price of the training which you get to keep and can, if desired be upgraded to a commercial license. All tools and exercises will be available as a pre-packaged VM/container. Instructions on how to obtain and get it set up on your computer will be provided to all participants ahead of the training.

Prerequisites

The student is expected to have basic understanding of computers, programs and operating systems. Some basic programming skills are also required, particularly some basic Python knowledge is very helpful. Finally it is expected that the student can read simple C code and understand very basic concepts of assembler.

The instructor

Carl Svensson is a security professional and hobbyist currently working as the head of security at Swedish healthcare startup, KRY. He is a frequent CTF player for the Swedish top team HackingForSoju and an active member of the Swedish and international security community with a great fondness for a broad range of topics, reverse engineering being one of his favorites. If you have questions about the contents of this training, feel free to get in touch at [email protected]

Call for Speakers and Teachers!

Click here if you are you interested in speaking at SEC-T 2019

Click here if you are interested in teaching a two day training program at SEC-T2ion 2019

Dark Side Ops: Custom Penetration Testing Workshop

Hackers penetrate enterprise networks in the flash of an eye, ravage endpoints for sensitive data, and
silently exfiltrate the keys to your kingdom without ever popping an alert. Dark Side Ops: Custom
Penetration Testing enables participants to “break through” to the next level by removing their
dependence on 3rd-party penetration testing tools, allowing for outside-the-box thinking and custom
tool development designed specifically for the target environment. Participants are provided with
hands-on experience into the black hat techniques currently used by hackers to bypass network-based
enterprise intrusion detection and prevention systems (IDS/IPS), layer 7 web proxies, and data loss
prevention (DLP) solutions. The custom approach doesn’t stop there. Participants learn advanced
evasion techniques of corporate host-based countermeasures including antivirus and application
whitelisting solutions by developing, compiling, and deploying custom backdoors, payloads, and
persistence deep into protected enterprise networks.

At the end of this course students will be able to:
• Build custom payload droppers, beaconing backdoors, and interactive shells.
• Conduct highly targeted and sophisticated custom client-side and social engineering attacks.
• Escalate workstation and network privileges without an exploit.
• Bypass defensive host and network countermeasures such as anti-virus applications, firewalls,
IDS, IPS, SIEMs, and strict egress filtering.
• Establish custom, stealthy persistence in a target network.
• Exfiltrate data from a target networks using custom applications and network monitoring
evasion techniques.
• Compile and deploy an advanced, custom HTTP beaconing payload developed internally by the
trainers and used regularly on engagements to effectively infiltrate company networks.

Participants will receive source code to a variety of offensive tools, including custom shells, backdoors,
C2 listening posts, and social engineering exploitation techniques. To reinforce the knowledge provided
through instruction, participants will have realistic lab projects throughout the day, where the coding
skills, custom payload delivery, and advanced pivoting techniques from course instruction will all be
necessary.

Day 1
Lab 0 Introduction Review course topics
Lab 1 Throwback Learn about stage 1 malware Build and deploy Throwback
Lab 2 Client Side Exploitation Client-side exploitation techniques Build custom payloads
Lab 3 Windows API Windows API abuse and bypasses Build and inject a reflective DLL
Lab 4 Slingshot (RAT) Learn about reflective DLL injection Build Slingshot and convert to a reflective DLL
Lab 5 Post-exploitation hashdump module Learn about post-exploitation techniques Add hashdump module to Slingshot
Lab 6 Post-exploitation Mimikatz module Learn about post-exploitation techniques Add Mimikatz module to Slingshot
Day 2
Lab 7 Covert operations Learn about covert infrastructure and operational security Configure SOHO IP tables as redirector
Lab 8 Evading antivirus Learn how to evade antivirus Build dynamic APIs and in-memory PE loader
Lab 9 Windows persistence Learn about persistence stealthy techniques Identify a DLL hijacking vulnerability for persistence
Lab 10 In-memory Powershell Learn about Powershell execution techniques Run Powershell completely in-memory
Lab 11 Advanced Windows pivoting Learn about named pipes and other pivoting techniques Compile and execute SlingshotSMB
Lab 12 In-memory keylogger Learn Windows API keylogging techniques Implement a keylogger into Slingshot
Lab 13 Privilege escalation Learn about privilege escalation techniques Escalate privileges using DllHijacker
Bonus module Screen-grabber Learn addition post-exploitation tools Take a screenshot through Slingshot

Network Forensics Workshop

The two-day Network Forensics class consists of a mix of theory and hands-on labs, where students will learn to analyze Full Packet Capture (FPC) files. The scenarios in the labs are primarily focused at network forensics for incident response, but are also relevant for law enforcement/internal security etc. where the network traffic of a suspect or insider is being monitored.

Day 1 – Theory and Practice using Open Source Tools
* Theory: Ethernet signaling
* Hardware: Network TAPs and Monitor ports / SPAN ports
* Sniffers: Recommendations for high-performance packet interception
* PCAP analysis: Extracting evidence and indicators of compromise using open source tools
* Defeating Big Data: Techniques for working with large data sets
* Whitelists: Learn how to detect 0-day exploit attacks without using IDS signatures
* Challenge Day 1: Find the needle in our haystack and win a honorable prize!

Day 2 – Advanced Network Forensics using Netresec Tools
* NetworkMiner Professional: Learning to leverage the features available in the Pro version
** Port Independent Protocol Identification (PIPI)
** DNS Whitelisting
* NetworkMinerCLI: Automating content extraction with our command line tool
* CapLoader: Searching, sorting and drilling through large PCAP data sets
** Super fast flow transcript (aka Follow TCP/UDP stream)
** Filter PCAP files and export frames to other tools
** Keyword search
* Challenge Day 2

The Scenario
The scenario used in the class involves a new progressive Bank, which provides exchange services for Bitcoin and Litecoin. We’ve set up clients and a server for this bank using REAL physical machines and a REAL internet connection. All traffic on the network is captured to PCAP files by a SecurityOnion sensor. In the scenario this bank gets into lots of trouble with hackers and malware, such as:
* Defacement of the Bank’s web server (see zone-h mirror)
* Man-on-the-Side (MOTS) attack (much like NSA/GCHQ’s QUANTUM INSERT)
* Backdoor infection through trojanized software
* Spear phishing
* Use of a popular RAT (njRAT) to access the victims machine and exfiltrate the wallet.dat files for Bitcoin and Litecoin
* Infection with real malware (Nemucod, Miuref / Boaxxe and more

Class attendees will learn to analyze captured network traffic from these events in order to:
* Investigate web server compromises and defacements
* Detect Man-on-the-Side attacks
* Identify covert backdoors
* Reassemble incoming emails and attachments
* Detect and decode RAT/backdoor traffic
* Detect malicious traffic without having to rely on blacklists, AV or third-party detection services

NetworkMiner CapLoader Professional software included FREE of charge
Each attendee will be provided with a free personal single user license of NetworkMiner Professional and CapLoader. These licenses will be valid for six months from the first training day.

Target Audience
Q: Who should attend?
A: Anyone who want to improve their skills at finding evil stuff in full content packet captures.

Q: Who should NOT attend?
A: Those who are afraid of using Linux command line tools.

Training Preparations
Laptop Required
Attendees will need to bring a laptop that fits the following specs:
* A PC running any 64 bit Windows OS (can be a Virtual Machine)
* At least 4GB RAM
* At least 40 GB free disk space
* VirtualBox (64 bit) installed
(VMWare will not be supported in the training)

A VirtualBox VM will be provided on USB flash drives at the beginning of the training.
Please note that having a 64-bit CPU and a 64-bit OS is not always enough to support 64-bit virtualization. You might need to enable features such as ”AMD-V”, ”VT-x” or ”Hyper-V” in BIOS in order to run virtual machines in 64-bit mode. You might also need to turn off “Intel Trusted Execution” in BIOS. One way to verify that your laptop supports 64-bit virtualization is to download the SecurityOnion ISO and see if it boots up in VirtualBox.

Hands-on SAP Hacking and Defense Workshop

SAP is a core part of the business-critical infrastructure of 95% of the biggest companies in the world, these companies rely on SAP to perform their most sensitive daily operations such as processing employees payroll and benefits, managing logistics, managing suppliers / customers, material management, releasing payments to providers, credit cards processing, business intelligence, etc.

This training provides the latest information on SAP specific attacks and remediation / protection activities.

This training starts with an introduction to SAP (No previous SAP knowledge is required), you will learn through several hands-on exercises and demos, how to perform your own vulnerability assessments, audits and penetration tests on your SAP platform,  you will be very well equipped to understand the critical risks your SAP platform may be facing, how to assess them and more importantly, you will know which are the best-practices to effectively mitigate them, pro-actively protecting your business-critical platform.

We take proud in creating the most comprehensive SAP security agenda:

Day 1

Day 2

Spring Pub 2018

It might be difficult to imagine now with the snowy landscape and biting cold but we are predicting this situation will eventually change. To nudge the process along we have decided it’s time to announce this years SEC-T Spring Pub Event, without which, as we know, spring cannot arrive.

This year we are again trying a new venue in the hope of eventually find the perfect place to host this lovely annual event. This year we have decided to host the spring pub at Hilma on Torsgatan 10 by Norra Bantorget.

[SCHEDULE] 

Thursday April 19:th 

17.00  Doors open

18.00 Welcome and general information from SEC-T

18.30 A lightning talk

19.15 Another lightning talk

20.00 A third lightning talk

If you are interested in giving a lightning talk or have other ideas you would like to share please send us an email to [email protected] and we will sort it out.

This event is free and requires no pre-registration.

Sincerely,

The SEC-T Organizers

0x0Anniversary Information

Welcome to the 10:th annual SEC-T conference. We are very happy to be back at Nalen again, and even thought it feels like we just left last years con it is already time for the next. This is basically how it has been feeling for the past 10 years for us. We come off one year having a thousand new ideas only to realize we could make a few of them reality when it’s all of a sudden time for SEC-T again. Of course when we look back we see the vast difference between what we are currently doing and how it all started back in 2008.

I know we said last year was “the big squeeze” and we managed to fit nearly 400 people into this room. Well this year there are 440 seats and that’s the amount of tickets circulating.

We have 9 sponsors this year instead of 8, so you’ll have one more sponsor to thank for making this event happen. But most importantly, we have 15 speakers this year. Now you will already have met 5 of them if you attended Community Night last night or if you attended our premiere SEC-T2ion (pronounced “dissection”) Training, and some of them are also doing a talk during the conference. Never before did we get so many high quality submissions, maybe it’s a sign that SEC-T is becoming known, or maybe it’s just because we are paying our speakers. 😉

This year more than ever the schedule is tightly packed, and since you are too I hope you will keep being an awesome audience and help us keep the schedule running.

When we started streaming SEC-T we were a bit worried that maybe people would not come to the venue, maybe it would be just as fun to stay in the office and watch YouTube all day. But obviously this does not impact the participation in the least. Which makes us happy, because there are undoubtedly people sitting out there that want and need this information but does not have an employer that will pay for them. It also hit us that since we can take questions for our speakers from the audience via email, audience participation from the internet isn’t really a problem. We have the IRC channel #SEC-T on EFNET and we have the [email protected] email. So if anyone is running a hackspace or organize an event in their office or living room anywhere that place, that space, could be just as much part of SEC-T as this main hall is. To try this out we have an extra room this year, downstairs, or more correctly, around the corner, is the entrance to Stacken. In Stacken you will find the stream running, you’ll find some cinema seating like in this room, some tables to sit by if you’re playing CTF or need a place to put your laptop, a lounge area, an Ice Cream machine, our gadget sales. Lunch will also be served down there to make it less tight, there is a bar and… there is also a SEC-T Anniversary T-shirt waiting for you if you bring your ticket QR-code. We have a T-shirt for everyone so take it at your leisure.

I mentioned the CTF, the CTF has actually been up and running since yesterday afternoon, the scoreboard should be visible, so register to play now at http://sec-t.ctf.rocks and may the people with the most time on their hands win. 😛

There is also something else about the stream this year that might be interesting. We have säkerhetspodcasten here in the audience, and they have promised to try to interview every speaker after their presentation, on video, and deliver the video to the streaming guys in the back so that people watching the stream can see them while you guys are on a coffee or lunch break. The interviews will of course be available on YouTube later when you’re back in the office on Monday.

Our tradition at SEC-T is that I come on stage after every talk and try to come up with smart sounding questions for the speakers, I have never written any questions in advance so far and sometimes it’s a bit of a challenge, but I think it’s a good tradition and something we will continue doing. However, when I’m on stage I will not be reading the IRC channel, and we do not have enough goons to do this so I would appreciate if anyone could keep an eye on the channel an proxy the questions to our speaker (please only do this with SFW questions). And if you are shy, email the question to [email protected] BEFORE the QnA and I can ask the question for you. But as you can see there is a stack of presents on stage, and those presents are for our speakers to hand out to those asking questions. We used to have books for the speaker to choose from, and we still do. The presents are books, mostly, but to add some surprise to the game Hanna was kind enough to play Christmas and wrap them all. So it’s worth being brave, first audience question for each talk gets a present.

This is also the first year we have a decent voting system for the speakers. As you know we are paying our speakers to perform, but the speaker that has performed the best according to you, the audience, will also be paid double. The webpage you got your ticket on has a voting system where you can vote on each speaker. You can’t vote in advance, but please remember to vote and the best way is if you do it directly after each talk.

I think there are still some Lightning Talk slots available this afternoon and we have been hoping for lightning talks to become something more spontaneous. So please, if you have something you want to share, let me or any organizer know and we’ll fit you into the schedule.

We hope you will have two awesome days!

Time for the first talk.

Birthday coming soon

As most of you might have seen we are sold out earlier than previous years. To be sure we have mixed feelings about this, we are very happy that so many see the value in what we are doing. But at the same time we are getting flooded with emails and tweets asking how to get a ticket. Currently if you visit our ticket system there is only the option to buy Training tickets (which includes a conference ticket), but we are going through our system to find if there are in fact more spaces to fill this year. Should there be any tickets left we will announce this.

The ticketing system wasn’t really designed with training in mind so that’s why it can look slightly confusing. We are sorry for the inconvenience this causes. We feel your pain.

It is also currently two weeks to the event this year and we got overwhelmed by the number of quality submissions we received this year. Many of which said they would be willing to speak at the Community Night (Wednesday the 13:th). Therefore we decided to expand the Community Night event to have 5 talks. As always the Community Night is a free event with no registration required so we hope to see those missing a ticket there. And we would suggest being on time (17.00) as the room might get full.

The video stream will be up sometime during the Community Night as well and run through the entire event for those who want to follow us on YouTube.

When you arrive on Thursday morning be sure to bring your ticket, you should have gotten a link to where you can download your ticket containing a QR code that we must scan for you to get access to the event. We have currently expanded the event as much as we believe it is possible at this venue and we hope for your help making it run as smooth as possible.

We will release more information in the days to come.

Sincerely,

The SEC-T Organizers