The talk explores the use of esoteric internal command and control channels for lateral movement and breaking out of heavily segregated environments. The speaker demonstrates novel techniques for C2 using VMs through vCenter and Guest Additions, arbitrary network printers and print jobs, Remote Desktop mapped drives and file shares, and LDAP attributes. The talk is aimed at both red and blue teamers, with the former learning how to identify and exploit these channels and the latter being challenged to reconsider their assumptions about network boundaries and the technologies that may offer a means for actors to progress unimpeded into sensitive network zones.
- Esoteric internal command and control channels can be weaponized for lateral movement and breaking out of heavily segregated environments
- Novel techniques for C2 include using VMs through vCenter and Guest Additions, arbitrary network printers and print jobs, Remote Desktop mapped drives and file shares, and LDAP attributes
- Red teamers can learn how to identify and exploit these channels, while blue teamers are challenged to reconsider their assumptions about network boundaries and the technologies that may offer a means for actors to progress unimpeded into sensitive network zones
The speaker introduces a lab environment with two workstations within a single domain, virtualized assets on an ESXi server managed by vCenter, and a C3 command control framework. The lab environment is used to demonstrate the techniques for breaking network segregation using esoteric command and control channels. The speaker explains how the channels can be used for command and control if one can read, write, and delete to an arbitrary service. The speaker also highlights the limitations of the techniques, such as the need for valid credentials and guest operations privileges within vCenter to interact with the guest OS, and the need for the target VM to have VMware tools installed.