Kraken, a modular multi-language webshell for defense evasion - Raul Caro

[number6]

Kraken, a modular multi-language webshell for defense evasion

Saturday August 12, 12:00 – 13:55, Society Boardroom, Forum

Raul Caro

Kraken is a modular multi-language webshell focused on web post-exploitation and defense evasion. It supports three technologies (PHP, JSP and ASPX) and its core is developed in Python. Kraken follows the principle of "avoiding command execution" by re-implementing it through the functionalities of the programming language in use. Kraken seeks to provide usability, scalability and improve the OPSEC of ongoing operations.

Raul Caro Teixido (OSCP, CRTE) is an Offensive Security Engineer at Telefonica Tech. He is the co-author of Mistica (your friendly data smuggler) presented in BlackHat Arsenal USA 2020, and the creator of Kraken (a modular multi-language webshell).

Audience - offensive (red team) and defensive (blue team and threat hunting) profiles

[secu77]

Hi everyone!

I am very excited to present Kraken (a project I have been working on for almost 2 years) in Defcon31 DemoLabs. It is my first time at Defcon and I hope to do the best!

Well, let me tell you a little bit about Kraken: Kraken is a project which allows to do web post-exploitation with a focus on: evasion, versatility, usability and scalability. It does not pretend to replace another tool or to be the definitive tool or whatever... In the end, we use tools to simplify or complete a task. So the main objective of Kraken is to simplify post-exploration in some restricted and hardened environments.

The main feature of Kraken is that it has been designed to avoid command execution. Instead, it has been replaced by a re-implementation of the command in the language used. In this way, you will be able to make a first contact with the compromised web server (via the web implant) without being detected. This is very interesting if you are doing a red team exercise.

Currently Kraken works with 3 web technologies: PHP, JSP and ASPX. These technologies include web implants and modules to be used during the exploitation. By uploading a web implant and connecting it to Kraken Client, you can operate with a nice and powerful TTY:



From this tty you can use the available modules that replace the main functionality of some commands. These modules are designed to give similar output and behaviour to the original command:



Note: although you can execute commands with the "execute" module if you wish.

But that is not the only thing you can do. In certain technologies that allow you to do a lot of things, such as ASPX, you can use Kraken to...

Elevate privileges and maintain privileged context:

[secu77]

Impersonate other users and move laterally:



Dump credentials and/or use other post-exploitation tools (compatibility required):



And much more!

If you want to know more about Kraken don't doubt to attend the 12th of August at Society, Forum.

For more information, visit the tool's repository: https://github.com/kraken-ng/Kraken, and also the project's wiki, where you can find details on the installation process, requirements and much more!