---
description: >-
  This is just a showcase of the network design and tools used for my
  cybersecurity capstone, if you're interested in reading my paper and seeing
  the attacks, feel free to click on the link below :)
---

# Cybersecurity Capstone: Red Team Analysis of Man in the Middle Attack's Evasion Against SOC Tools

{% embed url="https://github.com/oza51413/Cybersecurity-Capstone" %}
Link to the Capstone files
{% endembed %}

* pdf of capstone
* powerpoint slides
* screenshots and python scripts

## Note:

I know it's titled "Analysis of Man-In-The-Middle Dropbox Attacks evasion and effectiveness against SOC Tools" but i figured it should really be titled "Red Team Analysis of Man in the Middle Attack's Evasion Against SOC Tools", because that is what was really measured in this paper:

* The attack's capability of evading SOC tool detection
* The dropbox's capability of evading SOC tool detection

## Background

Red team engagements are common for assessing an organization’s security posture as these engagements simulate a real world cyber attack, serving as a proactive approach to identifying vulnerabilities and weaknesses within an organization’s network.&#x20;

Red teams also challenge an organization’s defenses in order to reveal potential areas of improvement. This is accomplished using a range of tactics, techniques, and procedures(TTPs) that replicate real world adversaries. Engagements of this nature often include Man in the Middle attack scenarios in an Active Directory environment.

In doing so, this serves as a measure of an organizations defense capabilities of their SOC and provide organizations and SOC teams with actionable insights into their network’s security weaknesses.

What inspired the idea for this cybersecurity capstone was _**Episode 40: No Parking**_ of the podcast _**Darknet Diaries**_ hosted by Jack Rhysider.

{% embed url="https://darknetdiaries.com/episode/40/" %}

## Tools:

* Lenovo Thinkpad X250 with Kali Linux
  * Attack box attacking from an entirely different network
* M1 MacBook Pro
  * where i would manage the Elastic Cloud alerts as attacks go on
* VMware Player
  * Where the AD environment was running
* Hak5's LAN Turtle
  * Drop box 1
  * calls back to VPS/C2

<figure><img src="https://45576918-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqZDDUBNtVGkzgc382QTT%2Fuploads%2Fy1R0cIe1XF6lqEK36Bna%2FIMG_6076.jpg?alt=media&#x26;token=f6c73480-098f-4fa8-a7fa-987dcaa7c42e" alt=""><figcaption></figcaption></figure>

* Raspberry Pi 4 Model B
  * Drop box 2
  * calls back to VPS/C2
  * I know...its a bit clunky, could have used a smaller battery pack, leave out the wifi adapter etc, smaller case maybe

<figure><img src="https://45576918-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqZDDUBNtVGkzgc382QTT%2Fuploads%2FT1eFVhetoAwhf0JTgMRG%2Fraspi.jpg?alt=media&#x26;token=663d74f0-4af0-4d01-92e5-bfcc974c30d9" alt=""><figcaption></figcaption></figure>

* Elastic Cloud
  * Where i would manage the SIEM and SOC tool integrations
    * Elastic Defend
    * Sysmon
    * OPNsense
    * Snort
* Akamai Ubuntu VPS
  * C2 where i would ssh into from the attack box to gain access to the dropboxes



<figure><img src="https://45576918-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqZDDUBNtVGkzgc382QTT%2Fuploads%2Fg4wohFUOmJHttIT86xpo%2FScreenshot%202024-04-12%20at%2010.55.04%E2%80%AFAM.png?alt=media&#x26;token=926bd6c8-be2b-4b68-8989-e1c8676e9a42" alt=""><figcaption><p>-Anakin Skywalker</p></figcaption></figure>

## Network Design

*   &#x20;Two dropbox devices are configured to Autossh to a Virtual Private Server(VPS) once connected to an ethernet port or switch on the internal network, mapping port 22 on the dropbox to port 2222 on the VPS, this allows an attacker or red team operator to SSH into their VPS from a attack device

    on a different network.
* Assumption 1: Someone got physical access
* Assumption 2: the network in question doesn't have the following:
  * 802.1x
  * NAC solution
  * (I will try to implement these in future projects to see how they can be bypassed!)

<figure><img src="https://45576918-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqZDDUBNtVGkzgc382QTT%2Fuploads%2FKxVdBofJ1kOPy8tJRwsn%2FScreenshot%202024-04-12%20at%2010.53.42%E2%80%AFAM.png?alt=media&#x26;token=542badc4-43e6-4723-9c45-2904049bf059" alt=""><figcaption></figcaption></figure>

### /etc/proxychains.conf

* this is necessary for option 2, where the attacker wants to route the traffic from his attack machine directly through the VPS and to the dropbox in the internal network

<figure><img src="https://45576918-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqZDDUBNtVGkzgc382QTT%2Fuploads%2FYBDdGUz2gY1Db6ttflSF%2FScreenshot%202024-04-12%20at%2011.11.34%E2%80%AFAM.png?alt=media&#x26;token=e2cdd1f9-8713-472f-899d-dbdeaa11fb65" alt=""><figcaption></figcaption></figure>

### Option 1: Double SSH

* option 1 consists of a double ssh to reach the dropbox in the internal network

1. SSH from the attack machine to the VPS

```
root@kali:~# export VPS=<IP>
root@kali:~# ssh root@$VPS
```

2. SSH from the VPS to the LAN Turtle

* note: the same could be done with the Raspberry Pi 4
  * which is even better because the raspberry pi is loaded with tools that can be used
  * the interface on the lan turtle is limited to its built in modules

```
root@kali:~# ssh root@localhost -p2222
```

3. Internal network CIDR

<figure><img src="https://45576918-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqZDDUBNtVGkzgc382QTT%2Fuploads%2F8ryWWXU8GUc1zOPnKGBa%2FScreenshot%202024-04-12%20at%2011.25.19%E2%80%AFAM.png?alt=media&#x26;token=1034dcc0-84c5-4d05-8413-ba80f6e29076" alt=""><figcaption></figcaption></figure>

### Option 2: Routing attack machine traffic through VPS to the dropbox

* The alternative to using SSH twice on the attack machine is that the attacker or red team operator can route their attack machine traffic using a dynamic application-level port forwarding proxy such as SOCKS(Socket Secure) on the local machine and tunnel traffic through the:
  * &#x20;first SSH connection, which is from the attacker machine to the VPS.
  * Then the second SSH connection, which is from the VPS to the dropbox device.

<figure><img src="https://45576918-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqZDDUBNtVGkzgc382QTT%2Fuploads%2FrJxc9UNuBGWlRA4gBMyK%2FScreenshot%202024-04-12%20at%2011.27.29%E2%80%AFAM.png?alt=media&#x26;token=e6c776a9-8208-4816-9465-00bd73a0039e" alt=""><figcaption></figcaption></figure>

### Proof of Concept: Nmap Scan from external attack machine through the VPS to the dropbox&#x20;

<figure><img src="https://45576918-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqZDDUBNtVGkzgc382QTT%2Fuploads%2F1NEW42V8EnFDZpC9hhA6%2FScreenshot%202024-04-12%20at%2011.29.25%E2%80%AFAM.png?alt=media&#x26;token=4b529e02-048e-4b8b-816a-502c6076b91d" alt=""><figcaption></figcaption></figure>

* Once the dropbox is in the internal network we can being our enumeration and scanning (either using option 1 or 2)
* Note: There are some limitations when using option 2 as to what type of traffic can go through due to the SOCKS proxy(it's also slow)



* Methodology
  * Find live hosts
  * Port Scan
  * Execute AD man in the middle attacks
  * Check if they were detected in Elastic Cloud
    * Compare attack detection coming from LAN turtle vs Raspberry Pi 4



* Check out the paper on my Github repo for more!

## Future Recommendations

* Hak5's Cloud C2 usage
* .1x and NAC implementation
* Larger AD environment(much like Game of Active Directory GOAD)
* Cellular module on LAN Turtle and Raspberry Pi, removes need to traverse out of the internal network, avoid detection altogether?
