Welcome to the course,
Discovery with Seatbelt. In here, you'll learn how to gather
information about your targets using the Seatbelt tool.
So, imagine you're working on a red team engagement.
Your client has a few user laptops,
a domain controller, and a few databases, and let's say you're
able to compromise one of the user laptops and from there you
get access to one of the databases.
That's pretty cool, right? But what should we do next?
Well, you could try to move laterally,
you could try to escalate your privileges or even
start to do some data exfiltration.
But to do all those things, you need first to understand the
environment. You need to enumerate things like the local users,
the domain users, group permissions, operating system information,
browsing history, antivirus information, and much more.
This information will help you to plan your next steps and
ensure that you have a good plan to move laterally and execute
any objectives you might have in mind.
And although you could do all that discovery mentally, it would take a lot of
time. For this reason, we have the Seatbelt tool. Seatbelt is a tool
developed a Will Schroeder and Lee Christensen. You might recognize them by
their handles, @harmJ0y and @tifkin_. They're really famous in the
cybersecurity community and they have a lot of interesting red team tools, so
I definitely recommend you checking out some of their work. Seatbelt is a C#
tool that performs a number of security queries in a system and returns data
that is relevant for both offensive and defensive teams. As you'll see in the
demos of this course, with just one tool we can perform a lot of discovery
queries, and this will allow you to better understand your target and plan
the next steps in your red team engagement.
What I love about Seatbelt is that it's an open source
software, meaning that you can download it from GitHub and
modify the code as much as you want.
As I mentioned,
Seatbelt automates several discovery tasks that can be
interesting for a red team engagement.
Actually, just so you have an idea, the Seatbelt tool has over 100
discovery modules, including local and domain user enumeration,
privilege mapping, antivirus detection,
operational system reconnaissance, browser history enumeration, and much more.
If you're familiar with the kill chain methodology, we can use Seatbelt from
after the exploitation phase all the way to the action phase,
meaning that after exploiting your machine, we can use the Seatbelt tool to
discover information that will help us in privilege escalation,
lateral movement, defensive evasion, and much more.
Also, if you're familiar with the MITRE ATT&CK framework, we can map this
course to the discovery phase of this framework. Inside of discovery,
we'll be focusing on three main techniques.
The first one is the T1518:001, which is security software discovery,
and this means that we use Seatbelt to find out if the machine has any
kind of antivirus or any other defense tool.
The second technique that we'll cover is the T1082,
which is system information discovery,
meaning that we'll use Seatbelt to find information about the operational
system running on the machine. And last, but also really important, we will
cover the technique T1087, which is account discovery. In there, we'll use
Seatbelt to discover both local accounts and domain accounts. And although
those are the three main techniques for this course, as you'll see in our
demos, you can use Seatbelt to execute over 10 different MITRE techniques, and
that's why I love this tool.
So before going to our demo, let's take a minute to
understand what we'll be doing in there.
You are in a red team engagement and you just got access to a machine in
the domain. As you need to expand your footprint, you need to discover
information about the environment so you can plan your next attacks. With
access to this machine, we'll use Seatbelt to gather tons of information
about the machine and the domain, including local and domain users, group
permissions, operational system information,
browsing history, and even enumerating the antivirus
that is installed in the machine.
Also, if you want to follow this demo on your own environment, you
just need one machine, which is your victim machine. In here, I'm
using a Windows 2016 Server, but it could be any Windows machine
you want. And that's it.
That's all we need for this demo.
So, enough of theory. Let's go to our lab environment and see
how this technique is done in real life.