Welcome to Initial Access with the Bash Bunny.
My name is FC, and I'll be your instructor on this course.
In this course,
I hope to teach you how to use the Bash Bunny in your red team engagements,
how to modify its payloads, how to load additional tools onto it,
and even what to do with all the data you manage to exfiltrate.
Join me as we explore how to gain initial access using the Bash Bunny.
The Bash Bunny is a hardware device attack platform.
This device was created by Hak5 and is designed to be an all‑in‑one package.
It is designed to be easy to use for covert offensive operations against
multiple target environments at the flick of a switch.
It allows you to easily load, create,
and deliver payloads specific to your target.
It does this by emulating multiple safe devices such as keyboards,
flash storage, serial, and even network adaptors.
So what is the Bash Bunny?
It's an advanced USB‑based attack platform.
It supports multiple operating systems for both loading and delivery.
And whilst I'll be using a Mac laptop throughout this course,
the overall use is the same on any platform.
The hardware switch on the side of the Bash Bunny allows you to
select the payload of your choice before the attack,
depending on your chosen target and the action required.
For example,
you may want to attack two different operating systems or maybe
run one exploit before delivering a second.
It's easy to use.
Once set up, anyone can plug the device in,
watch for the green LED to tell you it's completing an attack,
and at the flick of a switch,
it turns even the newest member of your team into a capable resource.
In these course, we're going to cover the following,
the initial setup of the Bash Bunny, as well as an overview of its file system,
loading your first payload into the Bash Bunny,
how to Use the Bash Bunny as part of a scenario,
loading additional tools via serial connections,
modifying existing payloads, and finally,
how to investigate the loot that you collect from your attacks.
Let's first take a look at where the Bash Bunny fits
in relation to the kill chain.
You will see that it tends to fall right near the start,
just after the initial recall.
While some of these payloads can perform other actions such as lateral movement,
exploitation, and even evasion,
they rely on the initial access given by the Bash Bunny.
The Bash Bunny can be utilized alongside other tools,
such as Empire,
in order to create persistence and greater
infiltration of the target environment.
Let's now take a look at the MITRE ATT&CK framework and
see where our tool fits into that.
The MITRE ATT&CK framework lays out the tactics and
techniques used by attackers, and red teamers to perform their attacks.
It's important to understand where your tool fits within this framework
so that you can ensure that your clients are getting the best value for
money whilst ensuring that all aspects of the kill train have been
attempted. For the Bash Bunny,
it falls under initial access, or technique T1200, hardware editions.
A common attack vector uses the Bash Bunny to exfiltrate data,
so it also falls under exfiltration, or technique.
T1052, exfiltration over physical medium with a subtechnique of T1052.001
exfiltration over USB. Depending on the payloads created or utilized by
the Bash Bunny, we can almost touch every single section of the MITRE
framework. But for this course, we'll focus on just the initial access and
the exfiltration of data.
A great way to understand the usage of the Bash Bunny is to show it in
action as part of a scenario that may already be a familiar sight to
some of you or a simple example for the rest.
The scenario we will use in this course is one of attacking
a small corporate office environment.
So let's go into this scenario a bit more detail so you
can understand the role that the Bash Bunny plays in part
of your red team assessment.
Here, we see a typical office network that's reflective of a small to medium
enterprise company that has requested your red team services.
We have an internet connection with the normal firewalls and routers in place.
We have multiple departments such as sales, HR,
the executives, finance, and even software engineering.
Additionally, all of their data is stored within the on‑site data center.
Here, we have the types of files and folders that an
attacker would consider valuable.
Your red team has to discover a way into the company
network and exfiltrate that data.
This course is going to focus on gaining the initial access onto the network
devices and exfiltrating information that we can use to gain further
information and compromise more of the network. In a normal red team
engagement, initial access may be attempted via the internet.
This requires a large range of tools and techniques in order to pull off,
as well as bypassing protection mechanisms in place to protect
the perimeter. With all red team engagements,
the first step is always recon.
In this scenario,
the red team has identified several members that work
in the HR and finance department.
One of these employees often works at a local coffee shop and leaves their
laptop unattended whilst collecting their lunch from the counter.
The red team has also discovered that with some social engineering,
they're able to get an interview with HR manager for a potential job.
The team member will have limited time to access the
HR laptop during the interview,
and either of these devices can be easily breached
with the use of the Bash Bunny.
Once the team member has been able to gain access to the target's laptop,
it's simply a case of plugging in the preloaded Bash Bunny,
and it will run its attacks.
It can either obtain credentials, or install a persistent backdoor, or even a
reverse shell. Once the machine has been compromised, the Bash Bunny visually
indicates that the attack that was completed and can be safely removed.
Depending on the payload used by the red team member, they'll be able to move
laterally across the network or obtain legitimate access to the files and
folders held within the data center.
This style of attack was used by a European threat group called
DarkVishnya against several banks in order to gain access into
their networks and to extract out money.
These attacks takes seconds, but can have long lasting effects.
Before we begin with the demonstrations, let's have a quick
overview of the hardware we're using.
The Bash Bunny is a slightly wider than average USB device.
On the top is an RGB LED,
which can be programmed to give visual indications as to what is happening.
There is a three position selector switch on the side.
The nearest position to the USB connector is position three, and it is used to
turn the Bash Bunny into a mass storage device, to load payloads onto the
device, and to collect any loot that your attacks have gathered. Positions 1
and 2 allow you to select which payload you wish to run when you insert the
device into your target. By default,
the LED status lights are as follows, green blinking is
booting up, blue blinking is arming mode,
red blinking recovery mode or firmware flashing mode for version 1,
red, or blue, or alternating LED is the recovery mode or firmware
flashing mode for version 1.1 and above.
You should never unplug during the recovery or firmware
upgrades whilst the LED is flashing.