ITSEC Newsletter 2024-01-11

Many hardware implants have already been created by hobbyists and commercial companies, alike. We are no different in that regard. However, we use our hardware implants in real-world Red Team operations while constantly evolving the form factor to align with the most effective solution for the mission. These are battle-tested and proven to work. Lessons are learned and changes are applied, as necessary. We thought it might be interesting to some that may be looking to up their field-kit, might not get an opportunity to perform uninhibited breaches of organizations, or simply enjoy learning by practical application. What we aim to achieve in the next couple of blog posts is to help describe our solution, detail the bill-of-materials, exemplify the build process, and finally live-fire our covert hardware implant (CHI).

Since it is possible for an administrator to create event log entries and Windows Events are accepting binary data, it could be used as a storage of beacon during red team operations. The company Improsec developed a tool called SharpEventPersist which can be used to write shellcode into the Windows Event log in order to establish persistence. The shellcode is converted to hexadecimal value and it is written in the Key Management Service. Improsec, also released a secondary binary which acts as a loader in order to retrieve and execute the shellcode from the Windows Event Log.

Six months ago, my friend and colleague Adnan Khan started researching a new class of CI/CD attacks. Adnan grasped the significance of these attacks after executing them against GitHub to gain total control of the GitHub Actions runner images. GitHub’s bug bounty program scored this vulnerability as “Critical” and paid a $20,000 reward. Following this operation, Adnan and I teamed up to scour the internet for other organizations vulnerable to similar attacks.