Cyber Attack

Students analyze a suspicious binary file from a laptop confiscated from a cyber-crime scene. They learn how to use basic reverse engineering to crack a password-protected binary so they can run the program and gain access to a cybercrime group’s Internet Relay Chat (IRC) channel. They then eavesdrop on online conversations, and start compiling intelligence on the crime group’s actors and connections.

OBJECTIVE: Perform static analysis of unknown executable files using IDA Pro
OBJECTIVE: Create a “hacker persona”
OBJECTIVE: Conduct open source intelligence gathering by accessing and eavesdropping on IRC conversations

Students now reverse engineer a more complex binary confiscated from a ransomware attacker’s computer. This time, they must crack an encrypted password to gain access to another protected IRC channel, which yields login credentials for the crime group’s FTP server. 

OBJECTIVE: Perform static analysis of unknown executable files using IDA Pro and Relyze
OBJECTIVE: Create a “hacker persona”
OBJECTIVE: Conduct open source intelligence gathering by accessing and eavesdropping on IRC conversations

Students must now reverse engineer a binary and crack a doubly-encrypted password in order to access a file that identifies the website of a small defense contractor that is vulnerable to a local file inclusion exploit and was also infected with malware by the crime group or another actor.

OBJECTIVE: Perform static analysis of unknown executable files using IDA Pro and Relyze
OBJECTIVE: Perform dynamic analysis of unknown executable files using IDA Pro

Students infiltrate a Russian cyber crime network by logging into an eastern European social media site using stolen credentials. They mask themselves as a member of the Russian crime group and gather intelligence about the group members and their connections from the posts on the social media site (which is a facsimile of the Russian “Facebook” site VK.ru filled with authentic posts in Russian). Students also develop a realistic persona which they will use while undercover within the group.

OBJECTIVE: Conduct open source intelligence gathering via social media
OBJECTIVE: Analyze foreign language material using Google Translate
OBJECTIVE: Map the power and status relationships within an organization

The student goes undercover to infiltrate the cyber crime group. The crime group’s leader asks students to execute a remote buffer overflow exploit on a vulnerable server to prove their worth to the crime group they are infiltrating. The student’s government boss permits them to perform this exploit in order to strengthen the relationship with the crime group so they can continue gathering important intel about them. The student’s attack provides the crime group a persistent foothold on the targeted computer.

OBJECTIVE: Conduct simple and complex buffer overflow exploits
OBJECTIVE: Use OllyDbg and Immunity Debugger for exploit development
OBJECTIVE: Control data execution prevention and structured exception handler overwrite protection on a Windows host
OBJECTIVE: “Fuzz” a server
OBJECTIVE: Generate and deploy a reverse_TCP shell using a buffer overflow exploit (Metasploit/MSFVenom/Meterpreter)
OBJECTIVE: Use MSFConsole to interact with an active exploit

The crime group now asks the students to strengthen their last exploit because a recompilation of the server’s code has apparently turned on data execution prevention (DEP). They need to re-implement the exploit using return-oriented programming (ROP) so it works well in the altered environment.

OBJECTIVE: Troubleshoot a deployed exploit that stops working
OBJECTIVE: Use return-oriented programming to exploit an application compiled with data execution prevention
OBJECTIVE: Generate and deploy a reverse_TCP shell using return-oriented programming
OBJECTIVE: Use MSFConsole to interact with an active exploit

The student’s boss explains that “off-the-shelf “Metasploit payloads (which students have been using until now) are typically recognized by most antivirus software. He asks the students to experiment with a variety of ways to obscure such payloads to evade detection.

OBJECTIVE: Generate malicious payloads that will evade antivirus detection using Metasploit-based and other techniques
OBJECTIVE: Test malicious payloads using online services without exposing the payloads to scrutiny by the information security community

The Russian hacker group asks the students to design a custom payload for them. Students must deliver working shellcode that deletes Windows security logs.

OBJECTIVE: Write a custom exploit
OBJECTIVE: Generate a shellcode payload
OBJECTIVE: Deploy a custom shellcode payload via a buffer overflow exploit

1. The crime group asks the students, working undercover, to gain access into a defense contractor’s network through a spearphishing attack on an HR person’s machine. Posing as a job applicant, students create a fake persona and resume, which is infected with a custom payload, reply to the job posting, infect the HR person’s machine, and gain a persistent foothold in the company’s network.
   
   OBJECTIVE: Craft a realistic fake persona
   OBJECTIVE: Generate an infected document
   OBJECTIVE: Configure an email client
   OBJECTIVE: Execute a spearphishing attack
   OBJECTIVE: Establish persistence on a target machine

Working undercover in the crime group and using the persistent foothold gained on an HR person’s machine, students access the company’s personnel database using SQL injection and exfiltrate data (which is scrubbed before passing it on to the crime group).

OBJECTIVE: Test a database for common (OWASP) vulnerabilities
OBJECTIVE: Exploit a database using SQL Injection
OBJECTIVE: Exfiltrate data

Human intelligence determines that the cyber crime group is connected to a Russian security agency. On behalf of the US government, students spearphish the leader of the crime group, use a keylogger to obtain his login credentials, and then surreptitiously log into his computer. Using access provided by the crime boss’s computer, they then gain a foothold on a Russian intelligence officer’s machine. Students exploit a vulnerability in a Python framework to gain access to a C2 database of classified information from which they exfiltrate a key document.

OBJECTIVE: Plan a complex attack
OBJECTIVE: Execute a spearphishing attack
OBJECTIVE: Establish persistence on a target machine
OBJECTIVE: Conduct reconnaissance on an exploited target machine
OBJECTIVE: Fingerprint a server to determine vulnerabilities
OBJECTIVE: Exfiltrate data