Full transcript
0:00So at work, one of the Slack channels
0:02for my team is basically a big dumping
0:04ground for a lot of our security
0:06operations center analysts, detection
0:08engineers, threat hunters, and security
0:09researchers to just drop resources into.
0:12And one of the cool ones that came
0:13through the other day was a new LOL
0:16Globs project, a catalog of
0:18wildcardbased command obfuscation
0:20techniques for Linux, Mac OS, Windows,
0:23CMD, and PowerShell from Hex V1N or Hex
0:27Vin. I'm not sure. But Josh comes in and
0:30says, "Hey, this is kind of cool. It
0:31looks a lot like uh Weeds's project for
0:33Argfuscator. This resource is all about
0:35obfuscating or manipulating, tweaking,
0:37and sort of changing what a command
0:39looks like when it's ran on the command
0:41line or like a processor program that
0:43executes on your computer. So when
0:45hackers start to manipulate how certain
0:48syntax looks, they might be able to
0:50adjust and break some sort of detection.
0:53in case it's looking for a literal
0:54string with any parts and pieces for the
0:57exact representation, but some things
0:59might get in the way or change a
1:00representation. And we've showcased
1:02Arfuscator with the video on this
1:04channel before, but that focuses mainly
1:06on command line arguments. And when I
1:08say arguments, I mean like the slashs or
1:11-ash i or parameters and configurations
1:14or values that are passed after the
1:16command or program itself. There's a big
1:18list of all of the built-in native and
1:21natural Windows binaries that kind of
1:23allow for this capability. Oh, and being
1:25able to tweak and adjust how it's
1:27executed with other command line
1:29references. And that focus on native
1:31natural like built-in applications,
1:34programs, or binaries kind of all come
1:36from a living off the land idea where
1:39you're naturally just using tools that
1:41are already available on the operating
1:43system that a hacker could be targeting.
1:45This living off the land resource,
1:47LOLASS or LOL as that acronym for living
1:50off the land, has kind of caught on and
1:52it's been awesome for the cyber security
1:54industry. I'm sure you're familiar.
1:56You've seen GTFO bins, something more on
1:58the Linux side of the house. Tons of
2:00these projects started to pop up like
2:02living off the land remote monitoring
2:04and management or RMM tools. There's
2:06living off trusted sites. There's living
2:08off the land drivers for like kernel
2:10drivers that could be exploited. I'm
2:12wearing their shirt right now. So many
2:14of these awesome projects have come to
2:16life that there's now been a new
2:17resource living off the living off the
2:19land like lol.farm
2:22where you could see each of these in
2:24their awesome capability for really just
2:27documenting known techniques. So hex v1n
2:31I believe a detection engineer over at
2:33Reliquest really leaned in on command
2:36line obfuscation amongst a lot of the
2:39recent attacks that the industry has
2:41seen here. Defense evasion techniques
2:43remain fragmented, a little bit all over
2:45the place, but command obuscation does
2:48always emerge as the top technique. So
2:51this is their project LOL globs process
2:54execution through wildcard pattern
2:56evasion. Because while you could just as
2:58easily run the command copy item, get
3:01content invoke command or ooh invoke
3:04expression, that on its own might get
3:06detected by EDR or security solutions
3:09that are in place in an environment. So,
3:11what if you did some weird wild
3:14shenanigans and globbed? Use a wild card
3:16like a star or an asterisk or use
3:19question marks to act as a placeholder
3:21for a specific single character. I just
3:24think it's cool to have all of this
3:26documented and cataloged and archived
3:29and listed in an awesome way that sure,
3:31you as a human can search through, or
3:32you could even use an API and just dump
3:35all of the data. I'm a huge proponent of
3:38living off the land projects and
3:40resources like this because they really
3:41do centralize the information for the
3:43most high signal understanding. And some
3:46of you probably know I am uh getting a
3:48little bit more on board with the old AI
3:51bandwagon, but like look back at the
3:53API. Imagine this that you could just
3:55give oh give and let your LLM run with
3:58humans might be overwhelmed with the
4:00weird strange syntax but a machine doing
4:02that pattern matching and having now in
4:04context what is known bad or known
4:07trickery that could be really cool. I'll
4:09be honest I think there is some really
4:10cool opportunity for AI in the security
4:13operation center. So with that in mind
4:14let me tell you about something awesome
4:15from the sponsor of today's video
4:17exforce. A security operation center
4:20demands an always on and always active
4:23effort to protect your business. Exforce
4:26provides an agentic AI solution to
4:28empower the entire sock life cycle
4:30across detection, triage, investigation
4:33and response offered as both software as
4:36a service or manage detection and
4:38response platform. They handle the
4:40complete security workflow and they
4:42connect and correlate context across
4:44alerts, logs, configuration data, code,
4:47and identities across your environment
4:50to understand the big picture of an
4:52incident. The secret sauce is a
4:54multimodel architecture, not just some
4:56off-the-shelf LLM. They leverage three
4:59specialized models together for
5:01semantic, behavioral, and knowledgebased
5:03insight. That means deterministic and
5:06explainable outcomes. These systems
5:08manage entity relationships, detect
5:10anomalies, and improve automated
5:12reasoning with past historical decisions
5:15and configured business rules, all
5:17visible to you without the blackbox
5:20uncertainty of a vanilla LLM. Exforce is
5:23built for lean security teams, the
5:25startups and midsize organizations that
5:27need enterprise security monitoring
5:29without hiring a full team. Their
5:31Exabots work as your autonomous analysts
5:3424/7. And out of the box, you get
5:37coverage for external applications
5:39already in your stack. They include
5:41pre-built integrations for GitHub,
5:43Slack, Octa, and more. All the corners
5:45and crevices that some traditional
5:47security tools overlook. Exforce is
5:50tracking the modern attack surface,
5:52where breaches begin. Exo Force scales
5:54from where your organization starts to
5:56wherever it goes next. Whether you need
5:58your first security operation center or
6:01you're augmenting an existing security
6:03program, the solution adapts to your
6:05business maturity level and grows with
6:07your needs. Check out why Exo Force is
6:09trusted by security operation centers
6:11from next-gen startups to global
6:14enterprises and transform your own with
6:16the Gentic AI. You can see Exa Force in
6:19action with my link below in the video
6:21description, jh.live/exafforce.
6:24Huge thanks to Exo Force for sponsoring
6:26this video.
6:28Alrighty. So, after I saw this low globs
6:31project shared in Slack at work, I saw
6:33it on Twitter that evening. So, this is
6:36Vin Gabe or Gabriel, I believe, uh,
6:39dropping new Linen Lobbass inspired
6:41project called LOL Globs. And I thought,
6:44man, this is just cool. This is just
6:46sleek. I think this is helpful. And I
6:48wanted to help spotlight it, showcase
6:50it, show it to y'all. So, I thought,
6:52hey, this is just so cool. I want to
6:54ask, of course, for permission. Can I
6:55showcase this in a video? pretty please.
6:57And he says yes. So, I did want to be
6:59sure to give Vin or Gabe or Gabriel uh
7:02some support and love. So, hey, I'll of
7:04course leave a link in the video
7:05description for his GitHub, his Twitter,
7:08his LinkedIn, his blog, all the awesome
7:10stuff that they are up to out on the
7:12interwebs and internet airwaves. But I
7:14thought we could have some more fun
7:16trying this out, trying to see how it
7:17might work, trying to see what we could
7:19do to mask and hide some process
7:22execution. Now again I think the benefit
7:24here is that okay this is tracking how
7:26you run a program or run a command. Now
7:29there are a handful of these entries and
7:31listings for PowerShell. You can see
7:33there are even some for Linux and I
7:35think they even have Mac as well and you
7:37could of course contribute right open
7:38source project. They have the GitHub
7:39link and anyone could add to it but they
7:41use some of the square braces to try to
7:43match specific characters. you might be
7:45able to have a little bit more runway
7:47with, but at the very least, again, that
7:48will break a literal string pattern
7:50matching that, hey, very likely some
7:53security solutions might do. There are a
7:56lot here, but there certainly could be
7:58more. I think again, community effort,
7:59anyone could contribute, but I thought,
8:01man, it would be fun to play with some
8:03of these. My team was pointing out the
8:05red server 32 one because that is an
8:08oldie but a goodie and that you can do a
8:10whole lot with it. And they reference
8:11the lolbass or lol bins resource down
8:13below. But I noticed something
8:15interesting for a lot of the cmd.exe or
8:18like regular Windows command prompt
8:20execution. They're actually kind of
8:22proxying the command from where being
8:26the command prompt rendition. Let me
8:28open up cmd.exe of like you might be
8:31used to on Linux. The witch command does
8:34not exist over in the Windows world, but
8:36for strictly cmd.exe exe where will tell
8:40you where a program or binary is and get
8:43the absolute path. So if I were to where
8:45calc it'll say look that's in system 32.
8:48So same thing as which on Linux but when
8:51you run something like that from within
8:52PowerShell it's going to take in the
8:54alias of like a wear object filter not
8:57the strict wear.exe exe, you know what I
9:00mean? Anyway, I thought that was
9:01peculiar because they use that to like
9:04resolve in some command substitution
9:06with the for loop syntax to then get the
9:08full path of the binary. So where.exe is
9:12the process that's executed and then it
9:14ends up using that via the for command.
9:17So the literal command if you are only
9:20getting like oh script logging of the
9:22transcription of what's entered in some
9:24specific command line session then
9:26you'll see this and that might break on
9:29reg server but for process execution
9:31like process create events I believe
9:33you'll still see it run on its own like
9:36go to search for the four binary I guess
9:39for files might be the one for files is
9:42an actual.exe command but the batch or
9:45cmd.exe exe shell scripting language for
9:49the syntax for for like a for loop is
9:52going to end up using that percent i
9:54variable to take the place of okay the
9:56command you want to run anyway just an
9:58interesting nuance I thought was
9:59peculiar and I'm curious and I I'd love
10:01to get your opinion in the comments if
10:03you're listening if you got to this part
10:05yeah wouldn't that still end up having
10:06the binary once it's resolved given its
10:09name kind of transplanted into the
10:11syntax for what a process creation event
10:13end up firing anyway so I was curious
10:15about the Windows CMD ones, but I was
10:17more interested in the PowerShell ones
10:19because normally, you know, we like to
10:21see a little bit of a PowerShell stager
10:23where we use IWR or IRM invoke web
10:26request or invoke rest method to then
10:28pull down a payload and execute it with
10:30invoke expression. Now, invoke web
10:32request uh has had a little bit of love
10:34lately, I think, from dead overflow or
10:37underflow or whatever the individuals
10:39that were kind of looking and seeing
10:40like, oh, PowerShell does some weird
10:42stuff when it's working with the like
10:45Trident MHTML engine, I think,
10:47processing and will actually
10:48automatically run some JavaScript. So,
10:50they patched that and did something
10:51weird for script logging capability. So,
10:54I'll show you right the usual alias IWR
10:57for the default PowerShell alias for
10:58invoke web request. They're masking it
11:01and hiding it in some better, more
11:02interesting ways here that I really
11:04like. But back on the command prompt,
11:06like if I were to actually get into
11:07PowerShell, let me do just regular IWR
11:10example.com here, you can see it
11:13automatically has a prompt for a
11:14security warning, the script execution
11:16risk that Microsoft added, unless you
11:18add in the use basic parsing switch,
11:20which we could, but it adds more to the
11:24like indicator like more to the command
11:25in the command line. We could accomplish
11:27the same thing to download something
11:29from an external site. Rather than using
11:31IWR invoke web request, we can use the
11:34invoke rest method option. And since we
11:36can use LOL globs now to get a fancy
11:39funny looking invocation without ever
11:41having the literal invoke rest method or
11:44even the IRM alias in here, we could use
11:46some of these other stagers. Now, we
11:48could potentially like pull down a
11:49payload, right? Get me example.com.
11:52Yeah. And then it returns the actual
11:54response. So, the next thing I was
11:55thinking about to actually give you a
11:57demo, have some fireworks for the video,
11:59was to just host a payload. And I was
12:01thinking, you know what? We could do it
12:02on like stupid Dumbo Pace bin. Everyone
12:04knows that. Then I thought, you know
12:05what? We can get a little bit more
12:06creative. Maybe we use some of the cool
12:08new tricks that I heard about with Poly
12:10Uploader. I learned this from that uh
12:12sweet webinar time with Sublime Security
12:14and Brian Baskin. He showed me this
12:16utility that will like mass spread out
12:19or slap up your file that you want on as
12:23many different like hosting sites as it
12:25supports over 133 different sites. And
12:28they're the like weird random ones that
12:30you've never heard of. Of course, like
12:32Go File is in there, but they actually
12:34have a cool legend and mapping of which
12:36of these services allow for a totally
12:38anonymous upload like no account
12:40required or even let you delete files or
12:44give you flexibility with an API. So,
12:46really cool resource here. And look at
12:48this list. I'm going to scroll out here
12:50so this is a little bit more readable.
12:51But the amount of hosts here in this
12:53table with that legend to be able to see
12:55how much you could upload, where and
12:57how, and if you need an account is wild.
13:00Like I like the living off trusted sites
13:02resource. I'll bring that up super quick
13:04just so folks are aware. Like things
13:06like GitHub or One Drive or Google Docs
13:08or Mega like the things that you could
13:10just oh upload a file to, but everyone
13:12knows about those. These are the lesserk
13:14known esoteric obscure stuff that ooh
13:18maybe some actor could stage some
13:20payload or part of an attack chain
13:23there. We saw Catbox Mo and tons of
13:27others. Anyway, Poly Uploader, sweet
13:29utility for you. And if anything, the
13:31GitHub repository is a neat reference.
13:33Anyway, just wanted to cram in that
13:35resource here for you. But anyway, let's
13:37get a super small, simple, silly, stupid
13:40little Notepad.exe
13:42payload that we'll just host up on paste
13:45bin. Keeping it easy. Create new paste.
13:48Oh, thank you. This better be a real
13:50turn style and not clickfix malware.
13:51Cool. So, we've got a raw link here now,
13:54right? And that'll give us the paste bin
13:57raw URL. Now, I think that on its own is
14:00a little ugly indicator. So, I like to
14:01use some of the like URL shortening
14:03services. And this one I really really
14:05like is.gg because it looks tiny and
14:08doesn't make any sense. But we could go
14:09ahead and shorten that URL and we'll
14:11have a super tiny is.ggd
14:14random number string after the fact. But
14:17now we could use the staged and prepared
14:20invoke rest method PowerShell command
14:23lit using the LOL globs project to just
14:26tuck that away with the star asterisk or
14:29wildcard. So it could then fill in what
14:31might be the rest of the command lit
14:33there. And this on its own will pull
14:35down notepad.exe, right? What we just
14:37staged in past. And if we really wanted
14:40to get super crafty and stupid, we could
14:42mix in and pour in our own little teeny
14:43weeny obuscation because this is
14:45PowerShell backicks can just be strewn
14:49about randomly. Is that a word? Is that
14:51the right word? Is strewn about? Strewn
14:53about is anyway. We can then pipe that
14:55to invoke expression or ex using the
14:59alias. But of course, we could now use
15:02low globs to mask and tuck that away
15:04too. Now, I think it's worth pointing
15:06out, right? I've been using these
15:07PowerShell commandletits and
15:08instructions for the actual execution of
15:11like a process or a command lit, right?
15:13Argfuscator doesn't do that. Arguscator
15:16is focused on obfuscation of arguments.
15:18While we could obuscate again in
15:20whatever PowerShell way we might like,
15:22we could still get kind of parts and
15:23pieces and even use those two projects
15:25in harmony. So, I am actually just not
15:28going to add uh back ticks in every
15:31spot. Like, we don't need for the back
15:33slashn, but you could probably track
15:35down and play with some other
15:37opportunity to get that return back. You
15:40can get clever and creative with your
15:41command line obuscation. Now, let's pipe
15:43in thatex equivalent. And with that,
15:46we'll fire Notepad. [laughter]
15:48Obviously, tiny cutesy trinket little
15:51showcase. But look at our command line,
15:53right? There is no clear invoke
15:55expression, invoke rest method, invoke
15:57web request, a URL that makes no sense.
16:00Like that is some cool little clever
16:02tricks. So, uh maybe something worth
16:05adding to your arsenal. Big thanks to
16:07Gabriel Hex V1N and the LOL Globs
16:10project. Big thanks to Exo Force for
16:12sponsoring this video and their support
16:14of the channel. Link below in the video
16:15description for that and everything
16:17else. And thank you for watching. and
16:19I'll see you in the next video.