Python for Cybersecurity

Introduction xvii Chapter 1 Fulfilling Pre- ATT&CK Objectives 1 Active Scanning 2 Scanning Networks with scapy 2 Implementing a SYN Scan in scapy 4 Performing a DNS Scan in scapy 5 Running the Code 5 Network Scanning for Defenders 6 Monitoring Traffic with scapy 7 Building Deceptive Responses 8 Running the Code 9 Search Open Technical Databases 9 Offensive DNS Exploration 10 Searching DNS Records 11 Performing a DNS Lookup 12 Reverse DNS Lookup 12 Running the Code 13 DNS Exploration for Defenders 13 Handling DNS Requests 15 Building a DNS Response 15 Running the Code 16 Summary 17 Suggested Exercises 17 Chapter 2 Gaining Initial Access 19 Valid Accounts 20 Discovering Default Accounts 20 Accessing a List of Default Credentials 21 Starting SSH Connections in Python 22 Performing Telnet Queries in Python 23 Running the Code 24 Account Monitoring for Defenders 24 Introduction to Windows Event Logs 25 Accessing Event Logs in Python 28 Detecting Failed Logon Attempts 28 Identifying Unauthorized Access to Default Accounts 30 Running the Code 30 Replication Through Removable Media 31 Exploiting Autorun 31 Converting Python Scripts to Windows Executables 32 Generating an Autorun File 33 Setting Up the Removable Media 34 Running the Code 34 Detecting Autorun Scripts 34 Identifying Removable Drives 35 Finding Autorun Scripts 36 Detecting Autorun Processes 36 Running the Code 36 Summary 37 Suggested Exercises 37 Chapter 3 Achieving Code Execution 39 Windows Management Instrumentation 40 Executing Code with WMI 40 Creating Processes with WMI 41 Launching Processes with PowerShell 41 Running the Code 42 WMI Event Monitoring for Defenders 42 WMI in Windows Event Logs 43 Accessing WMI Event Logs in Python 45 Processing Event Log XML Data 45 Running the Code 46 Scheduled Task/Job 47 Scheduling Malicious Tasks 47 Checking for Scheduled Tasks 48 Scheduling a Malicious Task 48 Running the Code 49 Task Scheduling for Defenders 50 Querying Scheduled Tasks 51 Identifying Suspicious Tasks 52 Running the Code 52 Summary 53 Suggested Exercises 53 Chapter 4 Maintaining Persistence 55 Boot or Logon Autostart Execution 56 Exploiting Registry Autorun 56 The Windows Registry and Autorun Keys 57 Modifying Autorun Keys with Python 60 Running the Code 61 Registry Monitoring for Defenders 62 Querying Windows Registry Keys 63 Searching the HKU Hive 64 Running the Code 64 Hijack Execution Flow 65 Modifying the Windows Path 65 Accessing the Windows Path 66 Modifying the Path 67 Running the Code 68 Path Management for Defenders 69 Detecting Path Modification via Timestamps 69 Enabling Audit Events 71 Monitoring Audit Logs 73 Running the Code 75 Summary 76 Suggested Exercises 76 Chapter 5 Performing Privilege Escalation 77 Boot or Logon Initialization Scripts 78 Creating Malicious Logon Scripts 78 Achieving Privilege Escalation with Logon Scripts 79 Creating a Logon Script 79 Running the Code 79 Searching for Logon Scripts 80 Identifying Autorun Keys 81 Running the Code 81 Hijack Execution Flow 81 Injecting Malicious Python Libraries 82 How Python Finds Libraries 82 Creating a Python Library 83 Running the Code 83 Detecting Suspicious Python Libraries 83 Identifying Imports 85 Detecting Duplicates 85 Running the Code 86 Summary 86 Suggested Exercises 87 Chapter 6 Evading Defenses 89 Impair Defenses 90 Disabling Antivirus 90 Disabling Antivirus Autorun 90 Terminating Processes 93 Creating Decoy Antivirus Processes 94 Catching Signals 95 Running the Code 95 Hide Artifacts 95 Concealing Files in Alternate Data Streams 96 Exploring Alternate Data Streams 96 Alternate Data Streams in Python 97 Running the Code 98 Detecting Alternate Data Streams 98 Walking a Directory with Python 99 Using PowerShell to Detect ADS 100 Parsing PowerShell Output 101 Running the Code 102 Summary 102 Suggested Exercises 103 Chapter 7 Accessing Credentials 105 Credentials from Password Stores 106 Dumping Credentials from Web Browsers 106 Accessing the Chrome Master Key 108 Querying the Chrome Login Data Database 108 Parsing Output and Decrypting Passwords 109 Running the Code 109 Monitoring Chrome Passwords 110 Enabling File Auditing 110 Detecting Local State Access Attempts 111 Running the Code 113 Network Sniffing 114 Sniffing Passwords with scapy 114 Port- Based Protocol Identification 116 Sniffing FTP Passwords 116 Extracting SMTP Passwords 117 Tracking Telnet Authentication State 119 Running the Code 121 Creating Deceptive Network Connections 121 Creating Decoy Connections 122 Running the Code 122 Summary 123 Suggested Exercises 123 Chapter 8 Performing Discovery 125 Account Discovery 126 Collecting User Account Data 126 Identifying Administrator Accounts 127 Collecting User Account Information 128 Accessing Windows Password Policies 128 Running the Code 129 Monitoring User Accounts 130 Monitoring Last Login Times 130 Monitoring Administrator Login Attempts 131 Running the Code 132 File and Directory Discovery 133 Identifying Valuable Files and Folders 133 Regular Expressions for Data Discovery 135 Parsing Different File Formats 135 Running the Code 136 Creating Honeypot Files and Folders 136 Monitoring Decoy Content 136 Creating the Decoy Content 137 Running the Code 138 Summary 138 Suggested Exercises 139 Chapter 9 Moving Laterally 141 Remote Services 142 Exploiting Windows Admin Shares 142 Enabling Full Access to Administrative Shares 143 Transferring Files via Administrative Shares 144 Executing Commands on Administrative Shares 144 Running the Code 144 Admin Share Management for Defenders 145 Monitoring File Operations 146 Detecting Authentication Attempts 147 Running the Code 148 Use Alternative Authentication Material 148 Collecting Web Session Cookies 149 Accessing Web Session Cookies 150 Running the Code 150 Creating Deceptive Web Session Cookies 151 Creating Decoy Cookies 151 Monitoring Decoy Cookie Usage 153 Running the Code 153 Summary 154 Suggested Exercises 155 Chapter 10 Collecting Intelligence 157 Clipboard Data 158 Collecting Data from the Clipboard 158 Accessing the Windows Clipboard 159 Replacing Clipboard Data 159 Running the Code 160 Clipboard Management for Defenders 160 Monitoring the Clipboard 161 Processing Clipboard Messages 161 Identifying the Clipboard Owner 161 Running the Code 162 Email Collection 162 Collecting Local Email Data 162 Accessing Local Email Caches 163 Running the Code 163 Protecting Against Email Collection 164 Identifying Email Caches 165 Searching Archive Files 165 Running the Code 166 Summary 166 Suggested Exercises 166 Chapter 11 Implementing Command and Control 169 Encrypted Channel 170 Command and Control Over Encrypted Channels 170 Encrypted Channel Client 171 Encrypted Channel Server 172 Running the Code 173 Detecting Encrypted C2 Channels 174 Performing Entropy Calculations 175 Detecting Encrypted Traffic 175 Running the Code 176 Protocol Tunneling 176 Command and Control via Protocol Tunneling 176 Protocol Tunneling Client 177 Protocol Tunneling Server 177 Running the Code 179 Detecting Protocol Tunneling 179 Extracting Field Data 181 Identifying Encoded Data 181 Running the Code 181 Summary 182 Suggested Exercises 182 Chapter 12 Exfiltrating Data 183 Alternative Protocols 184 Data Exfiltration Over Alternative Protocols 184 Alternative Protocol Client 185 Alternative Protocol Server 186 Running the Code 188 Detecting Alternative Protocols 189 Detecting Embedded Data 190 Running the Code 191 Non- Application Layer Protocols 191 Data Exfiltration via Non- Application Layer Protocols 192 Non- Application Layer Client 193 Non- Application Layer Server 193 Running the Code 194 Detecting Non- Application Layer Exfiltration 195 Identifying Anomalous Type and Code Values 196 Running the Code 196 Summary 197 Suggested Exercises 197 Chapter 13 Achieving Impact 199 Data Encrypted for Impact 200 Encrypting Data for Impact 200 Identifying Files to Encrypt 201 Encrypting and Decrypting Files 202 Running the Code 202 Detecting File Encryption 203 Finding Files of Interest 204 Calculating File Entropies 204 Running the Code 205 Account Access Removal 205 Removing Access to User Accounts 205 Changing Windows Passwords 207 Changing Linux Passwords 207 Running the Code 207 Detecting Account Access Removal 208 Detecting Password Changes in Windows 209 Detecting Password Changes in Linux 210 Running the Code 211 Summary 211 Suggested Exercises 212 Index 213