Hey, everyone.
I'm Aaron Rosenmund,
and thank you for joining me on Pluralsight to learn more
about the post exploitation command and control platform
for red teamers called Covenant.
Covenant, first of all,
is an open source project distributed and used under
the GNU General Public License.
The creator and primary contributor is Ryan Cobb,
under the username cobbr with a reasonably active number two
contributor with the username rasta mouse.
Above all,
I want to thank them for their work and contributions to the
community and hope this course can help showcase their work in a
way that makes others appreciate it as well.
In the words of the project's wiki,
the mission of this tool is to highlight the attack surface of .NET and to make
the use of offensive .NET tradecraft easier to use while serving as a
collaborative commanding control platform for red teamers.
And that is exactly what Covenant delivers.
This is a free and open source red team operations command
control framework that was made from the ground up to
execute .NET adversary techniques.
It is available on GitHub with instructions for
installation and operation on the GitHub wiki,
here,
and the documentation for this project is actually much
better than I've seen for others, but still,
I will be going over some of the gotchas for the installation shortly.
If you haven't picked up on this already,
Covenant is focused on exploiting the attack surface that is
available via the .NET framework that is the core of the OS for
Windows‑based operating systems.
The key differentiator in this C2 framework from others is the use
of the Roslyn API to dynamically compile the implants on the
compromised systems directly in a memory.
Leveraging the underlying .NET assemblies and compiling
dynamically on the compromised host,
avoids some of the burned techniques that are used in other
C2 implants that will get you caught.
And from a blue team perspective,
this is the coloring book GUI point‑and‑click version of the
up and coming .NET exploitation capabilities that you need
to have detections ready for.
Looking at where this capability lands in the cyber kill chain,
like any other command and control system,
once you have access to a compromised device post exploitation,
you can then install an implant that calls back to your C2 server,
and this is the base access for the remaining of your operation.
MITRE ATT&CK coverage for any C2 framework is going to be pretty broad,
and of course,
you're going to find a lot of the techniques that fall
under the command and control tactic.
But one of covenants features that set it apart is the heavy use of .NET,
not just in the C2 server,
but also using .NET to compile the commands into memory of the infected machine.
For the actual command and control component of Covenant,
like many others in its class, it uses common application layer protocols,
specifically,
HTTP and HTTPS web protocols to blend in with known
good web traffic at the edge.
Once that foothold is established,
the edge‑compromised boxes can act as an internal proxy,
making decomp connections from one implant to another,
to proxy commands and data, to and from the Covenant server,
to many internal devices, but only leveraging the single external connection.
I want to quickly go over what the operation of Covenant
looks like from a generic command and control perspective and
then get directly into the demo.
Starting with a basic network,
the operational Covenant server is going to sit somewhere
external to the target environment.
It could be on a cloud service, inside an adversary's enclave,
or anywhere in between, but the point is,
is that allows access to the red team, that's you and your friends,
to operate off the same server.
After exploitation of device internal to the target environment,
the implant installed calls back out,
establishing the internal to external connection.
The direction's important because it's most likely to be
allowed through ACLs and firewalls,
which is also another reason to use commonly used ports.
Specifically, Covenant supports SSL with valid certificates,
and that allows the implant traffic to blend in with
regular outbound browsing traffic.
At this point, whether you're in your hoody,
your trench coat, or your favorite ski mask,
you have a two‑way connection to run commands on the compromised host.
From here, you spread via SMB pipes to the other hosts,
identifying your target, whatever it may be in accomplishing the mission.
Sounds like a piece of cake, right?
Well, let's see it in action.
I'm going to walk you through how that's done on keyboard to
get you up and running as quick as possible.