1.
C I R C OCisco Implant Raspberry Controlled Operations
https://circo.cc

2.
• My name is Emilio and I’m hacker
• I like to play with packets, networks, electronics and 3D printers
• I presented security tools at various conferences (DEF CON, BlackHat
Asia, AV Tokyo HIVE, SECCON, HITB, etc)
• Sorry, I’m not a native programmer or English/Japanese speaker J
Helloこんにちは
https://circo.cc

3.
▪ Allow existing IP-Phone to co-exist with CIRCO
▪ Eliminate template files (craft all packets)
▪ Support NTP exfiltration
▪ Software encrypted via Bluetooth (prevent forensic)
▪ Self destroy and alarm switch (thanks Will)
▪ Bypass fingerprinting (NAC)
▪ Credentials integration into Faraday (thanks Fran)
https://circo.cc
What’s new? 新機能

4.
▪ Cisco DNA (Digital Network Architecture)
▪ Infoblox NetMRI
▪ Micro Focus® Network Automation (formerly HP NA)
▪ Service Now Discovery*
▪ ForeScout CounterACT (NAC)
▪ Trusted network administrators
▪ Others
* SNMP discovery only
https://circo.cc
Who we target? ターゲットは？

5.
https://circo.cc
CIRCO Evolution 進化

6.
Demo Box v1
https://circo.cc
Production Box v1.4

7.
Production Box v1.5
https://circo.cc

8.
▪ Components
□ CIRCO: Implant (hardware & software)
□ CARPA: Credentials Receiver (Internet VPS, software and domain NS)
□ JAULA: Wireless Credentials Receiver (software)
▪ Python 2
□ Mainly Scapy for packet manipulation
□ Migration into Python 3 started…
▪ Features:
□ Honeypots services to behave as a Cisco Switch or IP-Phone
□ Trick NAC systems (nmap, Phone whitelisted, Golden MAC)
□ OSfooler-NG (https://github.com/segofensiva/OSfooler-ng/)
▪ Exfiltration via cover channel protocols
□ ICMP (ping), Traceroute, NTP, HTTP, HTTPS, DNS, Proxy (DNS) and Wireless
▪ Extra: Get plain credentials if a PC is plugged into the IP-Phone
□ net-creds (https://github.com/DanMcInerney/net-creds) https://circo.cc
Software ソフトウェア

9.
▪ Cisco CDP & LLDP Advertisement
(as IP-Phone & Network Switch)
▪ Cisco SNMP Agent
▪ Cisco Telnet CLI (IOS 15.x)
▪ Cisco SSH CLI (IOS 15.x)
▪ Mimic packets format like IOS to avoid NAC/IDS/IPS
https://circo.cc
Fake Services (Honeypots)
シスコハニーポット

10.
Demo Time!
デモの時間!

11.
https://circo.cc
Lab Network Diagram

12.
https://circo.cc
Exfiltration Format
流出のフォーマット
▪ Telnet
□ t,<username>,<password>,<src_IP>
□ t,e,<enable_password>,<src_IP>
▪ SSH
□ s,<username>,<password>,<src_IP>
□ s,e,<enable_password>,<src_IP>
▪ SNMP (v1/v2)
□ p,<community>,<src_IP>
▪ net-creds* (optional)
□ n,<credentials>,<src_IP>
* Under development

13.
▪ ICMP (IP.id & ICMP.seq fields)
▪ Traceroute (IP.id field & UDP payload)
▪ HTTP and HTTPS (IP.id & TCP.window fields)
▪ NTP (NTP.stratum, NTP.poll, NTP.tx.timestamp)
▪ DNS (NS query evil.sub.domain)
▪ DNS (A query) via Proxy (DHCP Option 252, WPAD.<domain>, PAC
Guessing via DNS)
▪ Wireless* (SSID Name & Dot11.beacon, Dot11.SC and Dot11.interval)
https://circo.cc
Network Exfiltration Techniques
ネットワーク流出テクニック
* Proximity required
Credentials & IP address are encrypted with AES256 before sending

14.
https://circo.cc
ICMP Exfiltration Flow

15.
https://circo.cc
Traceroute Exfiltration Flow

16.
https://circo.cc
HTTP/HTTPS Exfiltration Flow

17.
https://circo.cc
NTP Packet “Fraction”

18.
https://circo.cc
NTP Exfiltration Flow

19.
https://circo.cc
DNS Exfiltration Flow

20.
https://circo.cc
Proxy (DHCP) Exfiltration Flow

21.
https://circo.cc
Proxy (WPAD) Exfiltration Flow

22.
Proxy (DNS Guessing) Exfiltration Flow
https://circo.cc

23.
https://circo.cc
Wireless Exfiltration Flow

24.
ありがとうございます！
Emilio
ekio_jp
https://github.com/ekiojp/circo
https://circo.cc
Thank You!