Sukoshi | 少し

Overview

Sukoshi is a proof-of-concept Python/C++ implant that leverages the MQTT protocol for C2 and uses AWS IoT Core as infrastructure. It is intended to demonstrate the use of MQTT for C2 and the way in which IoT cloud services can be integrated with an implant.

Note: This project was not built to be used in a production setting. It is designed as a proof-of-concept and it intentionally omits many features that would be expected in a modern C2 project. For OPSEC considerations, see here.

screen_0

Features

Automated setup and deployment of an implant using MQTT for C2. Can be used to easily test and analyze an implant leveraging this protocol.
Connects AWS IoT Core to an implant. Can be further expanded to integrate AWS services such as IoT Analytics for logging/data analysis/visualization and IoT Events for automated response to significant data events.

IoT Services for C2

C2 operators face many challenges such as having to manage a fleet of agents, implement a secure communications channel, quickly respond to events and log/analyze/visualize data. These same issues are being addressed by cloud providers who offer IoT services. As a result, they can be leveraged for C2 and implant management. This project uses AWS IoT Core as infrastructure, but other providers could possibly be re-purposed for C2 as well (Azure IoT, HiveMQ).

AWS offers sophisticated IoT services and capabilities that can be readily adapted for C2. As an example, telemetry from operators and implants can be stored, prepared, analyzed and fed into machine learning models using IoT Analytics. The IoT Device Defender service can be used to run regular audits on deployed implants, check for anomalous activity and produce alerts.

Telemetry gathered in IoT Core is not restricted to IoT services. Using Rules for AWS IoT, your implant data can be forwarded to many other services in the AWS ecosystem. You can do things like pass the data to Lambda functions, store it in DynamoDB or S3, send the data to Amazon Machine Learning to make predictions based on an Amazon ML model, start execution of a Step Functions state machine, and much more.

I believe that this project only scratches the surface of what can be done with cloud IoT service providers. The time saved by not needing to implement these capabilities by yourself is enormous. You can instantly get access to sophisticated services that are highly benficial to C2 operators.

Setup

Python Requirements

The AWS IoT Python libraries are needed by the implant and can be installed with the steps below:

From the root of the Sukoshi project, navigate to the /python directory
Execute the following command to install the Python dependencies:

pip install -r requirements.txt

C++ Requirements

Build Environment

A Windows 10 host was used as the environment for testing/compilation.
Visual Studio 2019 was used for development of this project.
The Visual Studio package Desktop Development with C++ was installed to support building the implant in C++.
CMake was used to build and install the required AWS IoT libraries, it can be installed here.
vcpkg was used to build and install the required Boost Property Tree libraries, it can be installed here.
Git is needed to fetch the required libraries from GitHub and can be installed for Windows here.

The AWS IoT C++ libraries and Boost Property Tree libraries are needed by the implant and can be installed with the steps below:

Automated Installation

I've used the script located here to automate installation of the AWS IoT libraries on my host. I've used the script located here to automate installation of vcpkg and the Boost Property Tree libaries on my host. You may be able to use these scripts to perform the same automated installs on your host or you can use them as a template for your own custom installation.

Manual Installation

To build the AWS IoT C++ libraries, create a directory within a short path (e.g. C:\dev\iotsdk), navigate into the newly created directory and execute the following commands:

mkdir sdk-cpp-workspace
cd sdk-cpp-workspace
git clone --recursive https://github.com/aws/aws-iot-device-sdk-cpp-v2.git
mkdir aws-iot-device-sdk-cpp-v2-build
cd aws-iot-device-sdk-cpp-v2-build
cmake -DCMAKE_INSTALL_PREFIX="C:\dev\iotsdk\sdk-cpp-workspace" ../aws-iot-device-sdk-cpp-v2
cmake --build . --target install --config "Release"

To build the Boost Property Tree libraries, navigate to the location of your vcpkg install and execute the following commands:

.\vcpkg.exe install boost-property-tree:x64-windows
.\vcpkg.exe integrate install

C++ Library Integration

The included Visual Studio project should be pre-configured to include all the required directories and dependencies. It has been hardcoded with the C:\dev\iotsdk\sdk-cpp-workspace path for the AWS IoT SDK dependencies. If you would like to select an alternative path for these dependencies, perform the following steps where C:\dev\iotsdk\sdk-cpp-workspace is replaced with your custom installation path:

Set the following flags in the solution: Release, x64
In project properties, set "C/C++ > General > Additional Include Directories" to C:\dev\iotsdk\sdk-cpp-workspace\include
In project properties, set "Linker > Input > Additional Dependencies" to:

C:\dev\iotsdk\sdk-cpp-workspace\lib\aws-crt-cpp.lib
C:\dev\iotsdk\sdk-cpp-workspace\lib\aws-c-mqtt.lib
C:\dev\iotsdk\sdk-cpp-workspace\lib\aws-c-event-stream.lib
C:\dev\iotsdk\sdk-cpp-workspace\lib\aws-checksums.lib
C:\dev\iotsdk\sdk-cpp-workspace\lib\aws-c-s3.lib
C:\dev\iotsdk\sdk-cpp-workspace\lib\aws-c-auth.lib
C:\dev\iotsdk\sdk-cpp-workspace\lib\aws-c-http.lib
C:\dev\iotsdk\sdk-cpp-workspace\lib\aws-c-io.lib
Secur32.lib
Crypt32.lib
C:\dev\iotsdk\sdk-cpp-workspace\lib\aws-c-compression.lib
C:\dev\iotsdk\sdk-cpp-workspace\lib\aws-c-cal.lib
NCrypt.lib
C:\dev\iotsdk\sdk-cpp-workspace\lib\aws-c-sdkutils.lib
C:\dev\iotsdk\sdk-cpp-workspace\lib\aws-c-common.lib
BCrypt.lib
Kernel32.lib
Ws2_32.lib
Shlwapi.lib
kernel32.lib
user32.lib
gdi32.lib
winspool.lib
shell32.lib
ole32.lib
oleaut32.lib
uuid.lib
comdlg32.lib
advapi32.lib

In project properties, set "C/C++ > Language > Conformance mode" to No (/permissive). Otherwise, when you try to execute a build, you will get an error for the file StringView.h on line 861:

Error	C7527	'Traits': template parameter name cannot be redeclared

If you are interested in tracking the status of this issue, see the following: https://github.com/aws/aws-iot-device-sdk-cpp-v2/issues/372

Terraform

This project includes Terraform files to automate deployment of the AWS IoT Core infrastructure that is needed by the implant.

The following resources will be created in the target AWS account:

AWS IoT Certificate
AWS IoT Policy
AWS IoT Thing

The certificates needed to connect the implant with AWS infrastructure will be created in the /terraform/certs folder.

The process for setting this up is as follows:

Ensure you have Terraform setup and installed (https://learn.hashicorp.com/tutorials/terraform/install-cli)
Ensure you have AWS user credentials with the proper IAM permissions configured on the CLI (https://docs.aws.amazon.com/cli/latest/userguide/getting-started-quickstart.html). For testing purposes, you can attach the managed policy AWSIoTConfigAccess to the user.
From the command line, navigate to the /terraform folder
Execute the following commands to setup the required infrastructure using Terraform:

terraform init
terraform plan
terraform apply

Take note of the python_implant_command_line and cpp_implant_command_line output from Terraform, it will be used to start the implant builds for Python and C++ respectively
Execute the following command to destroy the infrastructure when finished testing:

terraform destroy

Usage

The implant has been configured with very basic functionality to demonstrate the usage of MQTT for C2 and integration with AWS IoT Core. For simplicity, interaction with the implant by an operator is primarily done through the MQTT test client in the AWS IoT Core console page.

The following is an example of the end-to-end flow for the implant C2:

Navigate to the AWS IoT Core console page
Under the "Test" dropdown in the sidebar, click "MQTT test client"
On the "Subscribe to a topic" tab in the "Topic filter" field, enter c2/results as a topic and click "Subscribe". Note that c2/results appears under the "Subscriptions" window.
Repeat the above step for the c2/tasking and c2/heartbeat topics. For convenience, you may choose to favorite each of these subscribed topics by clicking the heart icon.
There are two builds of the implant (Python/C++) and their execution instructions will vary:

For Python, navigate to the root directory of Sukoshi and start the implant by exec

Sukoshi

Install / Use

README