Earth vs. The Giant Spider: Amazingly True Stories of Real Penetration tests
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Havelt, Rob
Henrique, Wendel Guglielmetti
Earth vs. The Giant Spider: Amazingly True Stories of Real Penetration Tests brings the DEF CON 19 audience the most massive collection of weird, downright bizarre, freaky, and altogether unlikely hacks ever seen in the wild. This talk will focus on those complex hacks found in real environments - some in very high end and important systems, that are unlikely but true. Through stories and demonstrations we will take the audience into a bizarre world where odd business logic flaws get you almost free food [including home shipping], sourcing traffic from port 0 allows ownership of the finances a nation, and security systems are used to hack organizations. The SpiderLabs team delivered more than 2300 penetration tests last year, giving us access to a huge variety of systems and services, we've collected a compendium of coolest and oddest compromises from the previous year to present at DEF CON. Our goal is to show effective attacks and at the same time not the trivial ones that can be found by automated methods. By the end of this presentation we hope to have the audience thinking differently about systems and applications that organizations use every day, and how they may be used against them. Rob Havelt is the director of penetration testing at Trustwave's SpiderLabs, the advanced security team within Trustwave focused on forensics, ethical hacking, and application security testing for premier clients. Rob has worked with offensive security seemingly forever, and from running a start-up ISP, to working as a TSCM specialist, he's held just about every job possible in the realm of system administration and information security. Formerly a bourbon-fueled absurdist, raconteur, and man about town, currently a sardonic workaholic occasionally seeking meaning in the finer things in life - Rob is, and will always be, a career hacker. Wendel Guglielmetti Henrique is a Security Consultant at Trustwave's SpiderLabs, the advanced security team within Trustwave focused on forensics, ethical hacking, and application security testing for premier clients. He has over 11 years experience in Information Technology, where the last 6 years were dedicated to penetration testing. He has performed security focused code reviews, secure development training, forensics analysis and security assessments. Wendel has performed countless network, application and web application penetration tests for various organizations across the globe, including government, banking, commercial sectors, as well as the payment card industry. Recent presentations include Black Hat Arsenal 2010 (USA), OWASP AppSec Research 2010 (Sweden) and Black Hat Europe 2010 (Spain). Previously, Wendel spoke in Troopers 09 (Germany), OWASP AppSecEU09 (Poland), YSTS 3.0 (Brazil), and has spoken in well known security conferences such as DEF CON 16 (USA) and H2HC (Brazil). Wendel developed a tool to detect and remove the famous BugBear virus, before most of the antivirus companies around the world in 2002. During his career, he has discovered vulnerabilities across a diverse set of technologies including webmail systems, wireless access points, remote access systems, web application firewalls, IP cameras, and IP telephony applications. Some tools he wrote already were used as examples in national magazines like PCWorld Brazil and international ones like Hakin9 Magazine.
 Thanks everyone for coming out. Welcome to Earth versus the Giant Spider, amazingly true stories of real penetration tests. My name is Rob Havalt and I'm the director of penetration testing for Trustwave Spider Labs. Over to my right, left, my other right. Is my Brazilian friend Wendell Enrique Wendell, you want to introduce yourself? I work on the Trustwave Spider Labs penetration team for almost three years I guess. I have you over 90 years on the security industry. I have found some vulnerable in different set of products, web application, firewalls, camera, remote application systems and probably a lot of others. I represented at Black Hat, DEF CON, OASP and some other big conference. We are in the process of getting a patent-impending technology for a penetration test project with EDE and a few other things. That's me. And like I said, I'm the director of penetration testing at Trustwave Spider Labs. I've been around the security industry kind of forever. I've worked from starting up an ISP to doing TSCM to just about every possible job and system administration and information security. I spoke at a lot of venues and this is a great opportunity for us to speak at, to you guys, at probably one of the best security conferences ever, DEF CON, the greatest crowd. So what's this all about? Basically we put together a collection of the weirdest, freakiest and most unlikely hacks that we've ever found. And we'll walk you through like these weird, freaky, unusual, just out of the ordinary stuff. We'll let you meet the victims of these odd hacks because some of these actually have serious implications. And we'll kind of walk you through a few of these things and kind of wrap it up after that. So basically we've been in a unique opportunity to see like some very real, interesting, uncommon and very non-trivial things that can't really be found either using traditional, like attacking methods, like vulnerability exploits, or straight on technological methods, or even like ways that make sense and follow the laws of, seemingly the laws of physics. And we've done this because we, you know, we have a huge team that does like more than like 2300 penetration tests in a year, but only the coolest and freakiest stuff we're selected to present to you guys. So by the end of this presentation, we hope to have you thinking about these systems and applications that organizations use every day and how, even like the most basic things, security tools, security systems, coffee machines and things like that might be used against them. So on with Earth versus the Giant, Spider. Do you want to talk about this one? This case is a big network, restaurant franchise around the world that sells food the over the Internet. They have some good maturity of security. So for example, the application, we couldn't find any cross-site scripting, psycho-injection, or things like that. The application was basically created in Java and Flashy, and the no-common parameter manipulation was working, for example, including negative values on products and things like that. However, during the transaction, we detected that the checkout was redirected to a 30-party gateway, and this gateway, when we get this information, it's sent the information to a security channel directly to this company, and they just got a response like approved or not approved. So what we did is manipulated these requests to change the final value of the transaction itself on the gateway, since it was redirected over JavaScript from our browser by the main application. Consequently, the final price that appeared on the website and all this stuff was the real price of the products. But when we conclude the transaction, we could put any kind of price that we would like, and they just got accepted or not, and this way you could get almost any kind of food for any value. Do you see if we should show these screenshots? Yeah? Yeah, sure. Okay, do you have them? No, I don't have them. Okay, never mind. So, and something else. You're talking now. Okay. You can't look at it because I think the customers have to be very quick to check the phone. Talk to them, not me. Yeah, well, basically, as a result of this penetration test, we could get some good amount of food delivered to our home. We've almost 50 cents at the end of the engagement. One of the cool things was we actually did engage a delivery driver that came out with bags of food and everything like that and took a bunch of pictures. Yeah. And it was all kinds of fun. But it's just a weird thing that, you know, and kind of a bad thing to do to let somebody kind of manipulate things and just kind of trust that everything's happening behind the scenes the way it should be. So, moving on. Okay. So this one was, we're called the OnePBX, we'll rule them all kind of hack. This was a large financial institution that had a lot of different technologies in place, some new technologies, but some like ancient technologies. In the course of testing this institution, one of the things that you normally want to do is kind of dial the space. Sometimes you do it just to voicemail surf and see who's out, who's in, who's doing what, what people's names are, and, you know, things like that. A side benefit of just kind of calling random numbers and listening is sometimes you run into something where you get a modem tone. Well, in doing this, you know, I called a number, got a modem tone, and just a weird kind of series of characters and a login prompt that was kind of generic, but kind of dissecting like the series of characters and what we got back from the modem over making like several calls, figured out that it was an old Siemens-Rome PBX. Well, in this case, that's great. You know, you get a PBX kind of manual. It turns out that they changed the administrator password, they changed the user, the opera password on it, but there was one account that actually had better credentials than administrator. It was a field tech account, and they didn't change that password. When you get into the field tech account, it actually lets you go into like any user account that you want. So, went into the Rome PBX as administrator and, you know, just kind of browsed that. Having like done some voicemail surfing previously, I knew that the extension for the help desk. So, one of the features is to like clone a voicemail box. So, one of the things we did is created a new extension, clone the voicemail box for the corporate tech support, and at the end of the day, we'd kind of listened to the various messages. Well, it turns out that like there was some dude that was traveling on the road and called in frantically to tech support after hours when they weren't picking up, asking a problem about a VPN problem. It just so happens that in a previous life, I was a certified checkpoint instructor, and I happened to know a lot about checkpoint. In a previous life, I actually sat on help desks and did like checkpoint like managed services. And the problem he was describing, I knew exactly what it was right away. It was a stupid like settings problem. So, I actually just called the guy back. I called the guy back and I walked him through like his problem. First, I asked him for his username, then I asked him for his password, so that I can check and verify his account. And then I fixed his machine. Afterwards, like, you know, he logged in and, you know, he logged out and Bingo, he logged in as himself, paying free credentials. The funny part about that was in the wrap-up of testing, we found out that this guy actually sent an email to the head of tech support, like praising them for like the wonderful tech support they got. And the quick responsiveness of the tech. So, that one was kind of awesome and freaky and weird. And, you know, sometimes you just kind of have to think outside the box. But, you know, something stupid, like, you know, not realizing that, hey, the field tech has their own like super account on this piece of antiquated technology, can, you know, have kind of severe implications. So, and well, this penetration test on the reality happened at least three or three times. Similar wishes like this one. Well, we were doing an internal penetration test, and during the internal penetration test, the network segmented was very limited. We had almost very few things to test, like one open SSH server, very well updated. One Samba server that's almost without sharing no folders, nothing, a few in those box that just block every single set to ping, like echo request and echo response. Also, Vlan attack bypass or Vlan hoping was not possible on this specific customer. And neither on this two or three that you used a similar attack during the last year. Arps spoofing that everybody knows, and it is very common was present, it was possible to be executed. But it gave no juice. We couldn't get any credential or anything in special. However, during the previous external penetration test, we figured out that this customer had an external site in a data center that had a VPN SSL and this external VPN SSL used a self-signad certificate. And they used this a lot, but we couldn't compromise during the external. So during the internal, we saw some traffic over the SSL port, and we did an 80PS man in the middle, since it was a self-signad certificate, probably the users did not figure out the difference. When we dumped the contents, we saw connections to this external VPN SSL server with self-signad certificates. So we just got the cookies and the cloning in our box with a burp suite and the access again, the same external data center server, and as a result, we get a successful login on the wholly VPN over SSL, getting access to file servers, applications, and a lot of stuff that was not accessible before, including credit card data and a lot of interesting stuff. So it's very interesting demonstration of how sometimes a vulnerability that you couldn't exploit from the external side and is not easily detected by the automated tool can be exploited for example from the inside network. It's kind of interesting because it could reproduce the same kind of vulnerability at least in three different customers during the last year. So this kind of vulnerability is the kind of vulnerability we would like to show you. They are kind of a freak difference and not easy to find with automated tools and stuff like that. Yeah, and that's always interesting because you're taking an external, you know, and organizations tend to think of the perimeter is the perimeter and the inside is the inside, and, you know, we need to secure the perimeter and the things that we do to secure the perimeter, you know, that's out there and, you know, that's basically our wall against the big bad internet and inside we need to do different things. But like Wendell said, you know, as a malicious attacker or a malicious insider could use, use external systems just as easily, you know, against internal resources. There was another instance of something like a kin to that where we were taking a look at a phone directory and from the inside of a network and we're just able to basically get like names of people. However, on the outside there was actually like an HR system with the vulnerability but you had to have like people's name and they're like HR code. Well, when used with the phone directory inside, it had the HR code and the vulnerable app from the outside, you know, gave enough information to kind of go through and like actually get like HR data from every single user at that company, including the CEO's payroll information. So those are always interesting. And it's interesting because somehow it was internal that you have to compromise external to come back to internal. This one makes no sense and we're still trying to figure out how this even worked. But we're taking a look at a card processor for actually like an entire country that processed most of the MasterCard visa transactions. And they had a transaction switch that they couldn't touch that was from the card brands and there was kind of a war of we suspect that's not secure. No, it's not. Yes, it is. No, it's not. Yes, it is kind of thing. And it was very much, you know, they said this, they said that kind of going back and forth. The best they could do is kind of like build a wall around it. But because of their, you know, their idea that it wasn't very secure, they put some very restricted firewall policies in place. They were using some weird old technology that as it turns out was very misconfigured. Nothing would get through to the transaction switch. It was kind of set down and you can only actually like reach it from a couple of stations inside that were kind of like the major databases. Yeah, absolutely. That's exactly what I was getting at. Yeah. Right. And so what he's saying is then that's exactly what we found out is so they spent all this time building this firewall around it on this legacy equipment and basically like things source from port zero like being a wild card on a legacy stack. It actually kind of sailed right through. So it turned out that the people that said, no, it's not secure was actually right because we found out that the transaction switch with an admin-admin user pass pair, that's awesome. That's always the thing that you want running every financial transaction from your country from. And you know, because of that, like, you know, the Webman interface, they're able to get it at an OS level and basically like, you know, see processing for basically the whole country. This one's really funny. All right. So there was an external pentest, you know, just as an outside in kind of thing. Very few services, a couple applications. There was an administrative like Web interface. And it was some cheesy thing we thought might be vulnerable, but, you know, we were able to get like some of the code to leak and things like that enough so that, you know, you could Google it and kind of search for it. So it turned out that that led us to looking at like comments and metadata in there. We actually found a news group where the administrator actually like posted like huge snippets of the source code for it, as well as like all of his information, who is very, very chatty on the news groups. Unfortunately, that didn't get as much, you know, so looking through like the snippets, like, you know, you think like bingo, I have like source code here, you know, surely I can get like something from that. It didn't end up getting much. However, we ended up like looking up the guy by name and we found his Facebook page and like, you know, like nicknames and a bunch of stuff about it, which led us to a forum called Caucasian Asian Love. And it was a forum for Caucasian men to find Asian women to love. Yeah. So this guy had a full profile on there. Apparently, he was really, really into it and really, really active in the Caucasian Asian love. So anyway, we ended up building up a word list from his dating profile. And his password was a variant of love machine with the common U spelling of love, which was actually rather awesome. So we ended up getting into the administrative interface, which actually like yielded like a ton. So. Okay. Well, it was another external penetration test where we couldn't find any trivial vulnerability. Actually no kind of web vulnerability, no vulnerable services, no weak accounts, no things like that. It was a huge network. And we found that on this huge network, they had almost the 20 high definition IP cameras and they also a specific part that was unrecognized by network mapper that probably was the application to centralize all these IP cameras into a single service. Well, these IP cameras, we looked around the vulnerability databases and we couldn't find any vulnerability. So we just look for a copy of these IP cameras and in a lab, we tested them and we find a few vulnerabilities like authentication bypass that allowed us to dump the whole password from the Linux based system inside the IP camera and a lot of stuff. We cracked the local root password and stuff. On the end, we created a modified firmware and we uploaded the over this interface and they created a web shell from this web shell on the web camera. They was connected on the inside network and consequently from these web cameras, we could look for example, internal employees working, give zoom up to ten times, get screenshots, IP of systems, user names and obviously from the web shell we created on the modified firmware, we could access the whole internal network that was accessible from this IP cameras network that was on the management administrative segment. It is interesting because it resulted in advisory. So we used the video cameras that's a security service. The great thing about that one is you take a look once you're into these video cameras and these were like by them having the good video cameras instead of the crappy grainy like black and white ones, it really helped a lot because he had an optical zoom of ten times and some of these were trained on machines and keyboards and things like that. So it ended up becoming like a password bonanza as you kind of just sat there remotely in a different country watching a user kind of sit down at a station and type in their password and then like okay, so that user name has this password and throughout the day you end up collecting a bunch of stuff. And once you have credentials, the stuff on that hardened exterior with the various servers that you can do much with, it isn't really like so hardened anymore. You can kind of, a lot of password reuse is problematic and all pervasive. So it tends to lead to compromise that way. Okay, that's good. All right, so after this one we have a video to show you of exactly how this all works. I'll let Wendell describe it first and then I'll hand you this. Sure. All right. Go for it. Well, personally I really like database security and we commonly find raw BI and all guys on the internal network penetration test. We see a lot of database, SQL server, Autocodes, DB2 and MySQL and a lot of else. Well sometimes we can compromise them with different techniques, overflows, weak accounts, like bad DNS configured services, et cetera, and Oracle. However, sometimes we can get like ARPs poofing, but no new connections, not people reconnectional. They have strong passwords so we can't get the creeps, the credentials during the span time of the engagement. And that's a frustrating thing. You're in the middle and you're seeing all this stuff and you wish you could do something with it. And it's like, well, I have all these sessions going. Why can't I just grab one? So that's what Wendell and Steve did. They wrote a tool. Basically, all right. This is an already authenticated session. Let's just go ahead and grab one. Yeah, exactly. Also, big thanks to Steve for working with us. He did a great job. And Tic Nett also supports the SQL server. So the main idea is if you have the sessions running for Oracle or even SQL server, why force them to range Acti to disconnect and get credentials or whatever if you can just take this connection and send your own comments and do whatever we want? So as you know, we can show screenshots of this penetration test we are talking about because they are customer. And it's not a good thing, but we created the in-house video just to demonstrate how works we used it recently, a lot in different internal penetration tests with a good level of success. And the tool also is free and available on the internet for who is interested. Go ahead and explain what's happening while it's running. So we start off with this tool called VAMP that actually does the ARP spoofing. It's a ProScript that does kind of like some reverse ARP spoofing. With VAMP, then you run this tool called Tic Nett. And now we are just showing a normal connection to our Oracle database. From a supposedly client, this virtual machine is like a client that you want to access. This first showing that we can't log in with the credential, when the database, as you can see on the first line, then it's logged with the user Steve, that's a valid user. So Steve is executing a very simple query like select 123 from the wall or whatever. Now back to Tic Nett. If you use the LS comments, we can see the active sessions. The one is marked with the eye letter that means that it's injectable. It was detected as injectable by Tic Nett. So the next thing you do is you actually go ahead and use Tic Nett to steal the session. It's a real easy thing. And basically what you end up with is taking that session over. The normal user just reconnects. In most cases they don't know that anything really happens. It just is kind of like a blip. And a lot of like database clients have connection pools. Anyway, so they just start a new connection. You take their old one and basically end up with a shell interface to the Oracle database. Yeah, at this point we could for example send any comments. I see we stole in the connection. So just to demonstrate, we are sending this SQL query that you'll be creating an account that's called the window that on the beginning of the video was not an account that exists on the database. As you can see, you get on the end the ORIHER01003. This means that the command was sent and partially successfully. Now we are just stopping the RPP poison and making sure that we are not breaking the RPP tables. And now we are trying to log in again with the same account that was when the just to make sure it really works. We used the vamp to intercept and inject a live connection and create a new account on the Oracle database. Now as you can see, we can log in with the account that previously doesn't exist on the database. And now we can do any query like the privilege of this account. As you see, we're just kind of doing a select query. Just to demonstrate that it's possible to execute an query. Obviously, in this case, the session that was stolen was a administrative query, a administrative account. So we could create an account, but you can always get the privilege of that account. For example, recently, on our team meeting, we got another guy from the network penetration testing team. And it's very nice to, last week, we got a stolen SQL server, Microsoft SQL server with this tool, and they could use the XPC MD shell to execute the commands just for a nice stolen session also. We have the other nice things from TicNet, like steel credentials, and even Microsoft has some very specific, Oracle has some very specific stuff from Windows clients that leak Windows authentication. So I suggest everybody that is interested to check TicNet. It's very interesting. Is that it? Sure. There we go. Okay. Great. Thanks. Great. Whoa. All right. Okay. Thanks. Thanks. Thanks. Thanks. Thanks. Thanks. Thanks. Thanks. Okay, Kwil. These are going insane here. Oh, okay. So technology is against me? Okay. Let's try this again. Okay. So it's time to, you know, talk about some of the victims of these attacks because they all have very serious implications. You know, they make for kind of like fun stories and, you know, sometimes funny get a chuckle out of them. But let's talk about none of these attacks really led to anything trivial. The reason, you know, why they're included here is all of these attacks led to ginormous compromises of huge amounts of data. You know, in some cases, CHD in the numbering in the millions, PII numbering in the millions, and huge, huge, huge amounts of data. So the organizations that, you know, we're talking about here are multinational banks, global restaurant franchise, major retail chains, credit card processor for an entire nation. And the types of data stolen that we're talking about here is, you know, every visa and master card transaction processed in the entire country, hundreds of millions of pan and track data, HR data. In one case, you know, it led to accessing like the DHS terrorist watch list for financial institutions that they're supposed to check against. And, you know, obviously like billions of dollars in transactions. So just kind of in conclusion to this, before I say something about stuff you didn't see, is this talk was focused on those complex or uncommon hacks found in real environments. Some are in very high end and important systems, and some are unlikely but true. And this is, you know, a bizarre world where you have like old ancient anomalies, you know, like affecting like newer systems, security systems that are used to hack organizations, you know, new techniques developed on the fly and things like that. So, you know, we're happy to be here, hopefully you enjoyed these stories. So I think one of the things that we were going to do with this is we spent like two weeks setting up like this whole like hacking challenge that we're going to run during the talk. And so, you know, we checked on it when we got here, we checked on it last night, checked on it this morning and like three machines that we had like wooden boot. And that's just awesome. So you know, the winner was supposed to get a prize. And so we still have the prize. We have a few prize. But I know like a lot of you out there have like bizarre and weird stories of their own. So we're going to change it. Anybody that comes up with just a truly weird fucked up story will get the prize of a Duke Newcombe forever PC version game. Anybody want to take a shot? Come on up. Well, yeah, we're showing you that we have the game today, but you won't actually get it for another 12 years. Have a seat. What's your name? Tim. Tim, what's your weird fucked up story? Well, we were doing a pen test one time. And we were war dialing all their, you know, phone lines. And like you, we found a system that was returning odd characters. And basically we were able to determine that this was an HVAC control system. And so did some research and found that there was a default technician login, got into the HVAC control system. And then we shut down the exhaust fan in their server room. So then we just sent somebody out dressed up as an HVAC technician. And we're able to get right into the daydissener. What do you guys think? Did Tim get the prize? Yeah. Oh, yeah. There you go, man. Thank you. Sure. Wait. Wait. No, no, no. Wait. Does anybody else? Like I saw a couple of people that were kind of coming towards this stuff. Anybody else want to try for the runner up prize? Anyone? All right, well, in that case, I'll drink the kachasa myself. Thanks, everyone. I hope you enjoyed it. And thanks for coming out.
 Thanks everyone for coming out. Welcome to Earth versus the Giant Spider, amazingly true stories of real penetration tests.  My name is Rob Havalt and I'm the director of penetration testing for Trustwave Spider Labs.  Over to my right, left, my other right. Is my Brazilian friend Wendell Enrique Wendell, you want to introduce yourself?  I work on the Trustwave Spider Labs penetration team for almost three years I guess.  I have you over 90 years on the security industry. I have found some vulnerable in different set of products, web application,  firewalls, camera, remote application systems and probably a lot of others.  I represented at Black Hat, DEF CON, OASP and some other big conference.  We are in the process of getting a patent-impending technology for a penetration test project with EDE and a few other things. That's me.  And like I said, I'm the director of penetration testing at Trustwave Spider Labs.  I've been around the security industry kind of forever. I've worked from starting up an ISP to doing TSCM to just about every possible job  and system administration and information security. I spoke at a lot of venues and this is a great opportunity for us to speak at,  to you guys, at probably one of the best security conferences ever, DEF CON, the greatest crowd.  So what's this all about? Basically we put together a collection of the weirdest, freakiest and most unlikely hacks that we've ever found.  And we'll walk you through like these weird, freaky, unusual, just out of the ordinary stuff.  We'll let you meet the victims of these odd hacks because some of these actually have serious implications.  And we'll kind of walk you through a few of these things and kind of wrap it up after that.  So basically we've been in a unique opportunity to see like some very real, interesting, uncommon and very non-trivial things  that can't really be found either using traditional, like attacking methods, like vulnerability exploits,  or straight on technological methods, or even like ways that make sense and follow the laws of, seemingly the laws of physics.  And we've done this because we, you know, we have a huge team that does like more than like 2300 penetration tests in a year,  but only the coolest and freakiest stuff we're selected to present to you guys.  So by the end of this presentation, we hope to have you thinking about these systems and applications  that organizations use every day and how, even like the most basic things, security tools, security systems,  coffee machines and things like that might be used against them.  So on with Earth versus the Giant, Spider.  Do you want to talk about this one?  This case is a big network, restaurant franchise around the world that sells food the over the Internet.  They have some good maturity of security.  So for example, the application, we couldn't find any cross-site scripting, psycho-injection, or things like that.  The application was basically created in Java and Flashy, and the no-common parameter manipulation was working,  for example, including negative values on products and things like that.  However, during the transaction, we detected that the checkout was redirected to a 30-party gateway,  and this gateway, when we get this information, it's sent the information to a security channel directly to this company,  and they just got a response like approved or not approved.  So what we did is manipulated these requests to change the final value of the transaction itself on the gateway,  since it was redirected over JavaScript from our browser by the main application.  Consequently, the final price that appeared on the website and all this stuff was the real price of the products.  But when we conclude the transaction, we could put any kind of price that we would like,  and they just got accepted or not, and this way you could get almost any kind of food for any value.  Do you see if we should show these screenshots?  Yeah?  Yeah, sure.  Okay, do you have them?  No, I don't have them.  Okay, never mind.  So, and something else.  You're talking now.  Okay.  You can't look at it because I think the customers have to be very quick to check the phone.  Talk to them, not me.  Yeah, well, basically, as a result of this penetration test, we could get some good amount of food delivered to our home.  We've almost 50 cents at the end of the engagement.  One of the cool things was we actually did engage a delivery driver that came out with bags of food and everything like that  and took a bunch of pictures.  Yeah.  And it was all kinds of fun.  But it's just a weird thing that, you know, and kind of a bad thing to do to let somebody kind of manipulate things  and just kind of trust that everything's happening behind the scenes the way it should be.  So, moving on.  Okay.  So this one was, we're called the OnePBX, we'll rule them all kind of hack.  This was a large financial institution that had a lot of different technologies in place, some new technologies,  but some like ancient technologies.  In the course of testing this institution, one of the things that you normally want to do is kind of dial the space.  Sometimes you do it just to voicemail surf and see who's out, who's in, who's doing what, what people's names are,  and, you know, things like that.  A side benefit of just kind of calling random numbers and listening is sometimes you run into something where you get a modem tone.  Well, in doing this, you know, I called a number, got a modem tone, and just a weird kind of series of characters  and a login prompt that was kind of generic, but kind of dissecting like the series of characters  and what we got back from the modem over making like several calls, figured out that it was an old Siemens-Rome PBX.  Well, in this case, that's great.  You know, you get a PBX kind of manual.  It turns out that they changed the administrator password, they changed the user, the opera password on it,  but there was one account that actually had better credentials than administrator.  It was a field tech account, and they didn't change that password.  When you get into the field tech account, it actually lets you go into like any user account that you want.  So, went into the Rome PBX as administrator and, you know, just kind of browsed that.  Having like done some voicemail surfing previously, I knew that the extension for the help desk.  So, one of the features is to like clone a voicemail box.  So, one of the things we did is created a new extension, clone the voicemail box for the corporate tech support,  and at the end of the day, we'd kind of listened to the various messages.  Well, it turns out that like there was some dude that was traveling on the road  and called in frantically to tech support after hours when they weren't picking up,  asking a problem about a VPN problem.  It just so happens that in a previous life, I was a certified checkpoint instructor,  and I happened to know a lot about checkpoint.  In a previous life, I actually sat on help desks and did like checkpoint like managed services.  And the problem he was describing, I knew exactly what it was right away.  It was a stupid like settings problem.  So, I actually just called the guy back.  I called the guy back and I walked him through like his problem.  First, I asked him for his username, then I asked him for his password,  so that I can check and verify his account.  And then I fixed his machine.  Afterwards, like, you know, he logged in and, you know, he logged out and Bingo,  he logged in as himself, paying free credentials.  The funny part about that was in the wrap-up of testing,  we found out that this guy actually sent an email to the head of tech support,  like praising them for like the wonderful tech support they got.  And the quick responsiveness of the tech.  So, that one was kind of awesome and freaky and weird.  And, you know, sometimes you just kind of have to think outside the box.  But, you know, something stupid, like, you know, not realizing that,  hey, the field tech has their own like super account on this piece of antiquated technology,  can, you know, have kind of severe implications.  So, and well, this penetration test on the reality happened at least three or three times.  Similar wishes like this one.  Well, we were doing an internal penetration test, and during the internal penetration test,  the network segmented was very limited.  We had almost very few things to test, like one open SSH server, very well updated.  One Samba server that's almost without sharing no folders, nothing,  a few in those box that just block every single set to ping, like echo request and echo response.  Also, Vlan attack bypass or Vlan hoping was not possible on this specific customer.  And neither on this two or three that you used a similar attack during the last year.  Arps spoofing that everybody knows, and it is very common was present, it was possible to be executed.  But it gave no juice.  We couldn't get any credential or anything in special.  However, during the previous external penetration test, we figured out that this customer had  an external site in a data center that had a VPN SSL and this external VPN SSL used a self-signad certificate.  And they used this a lot, but we couldn't compromise during the external.  So during the internal, we saw some traffic over the SSL port, and we did an 80PS man in the middle,  since it was a self-signad certificate, probably the users did not figure out the difference.  When we dumped the contents, we saw connections to this external VPN SSL server with self-signad  certificates.  So we just got the cookies and the cloning in our box with a burp suite and the access again,  the same external data center server, and as a result, we get a successful login on the  wholly VPN over SSL, getting access to file servers, applications, and a lot of stuff that was not  accessible before, including credit card data and a lot of interesting stuff.  So it's very interesting demonstration of how sometimes a vulnerability that you couldn't  exploit from the external side and is not easily detected by the automated tool can be exploited  for example from the inside network.  It's kind of interesting because it could reproduce the same kind of vulnerability at least in three  different customers during the last year.  So this kind of vulnerability is the kind of vulnerability we would like to show you.  They are kind of a freak difference and not easy to find with automated tools and stuff like that.  Yeah, and that's always interesting because you're taking an external, you know, and organizations  tend to think of the perimeter is the perimeter and the inside is the inside, and, you know, we  need to secure the perimeter and the things that we do to secure the perimeter, you know,  that's out there and, you know, that's basically our wall against the big bad internet and inside  we need to do different things.  But like Wendell said, you know, as a malicious attacker or a malicious insider could use,  use external systems just as easily, you know, against internal resources.  There was another instance of something like a kin to that where we were taking a look at a  phone directory and from the inside of a network and we're just able to basically get like  names of people.  However, on the outside there was actually like an HR system with the vulnerability but you had  to have like people's name and they're like HR code.  Well, when used with the phone directory inside, it had the HR code and the vulnerable app from  the outside, you know, gave enough information to kind of go through and like actually get like  HR data from every single user at that company, including the CEO's payroll information.  So those are always interesting.  And it's interesting because somehow it was internal that you have to compromise external to  come back to internal.  This one makes no sense and we're still trying to figure out how this even worked.  But we're taking a look at a card processor for actually like an entire country that processed  most of the MasterCard visa transactions.  And they had a transaction switch that they couldn't touch that was from the card brands and  there was kind of a war of we suspect that's not secure.  No, it's not.  Yes, it is.  No, it's not.  Yes, it is kind of thing.  And it was very much, you know, they said this, they said that kind of going back and forth.  The best they could do is kind of like build a wall around it.  But because of their, you know, their idea that it wasn't very secure, they put some very  restricted firewall policies in place.  They were using some weird old technology that as it turns out was very misconfigured.  Nothing would get through to the transaction switch.  It was kind of set down and you can only actually like reach it from a couple of stations inside  that were kind of like the major databases.  Yeah, absolutely.  That's exactly what I was getting at.  Yeah.  Right.  And so what he's saying is then that's exactly what we found out is so they spent all this  time building this firewall around it on this legacy equipment and basically like things  source from port zero like being a wild card on a legacy stack.  It actually kind of sailed right through.  So it turned out that the people that said, no, it's not secure was actually right because  we found out that the transaction switch with an admin-admin user pass pair, that's  awesome.  That's always the thing that you want running every financial transaction from your country  from.  And you know, because of that, like, you know, the Webman interface, they're able to get  it at an OS level and basically like, you know, see processing for basically the whole  country.  This one's really funny.  All right.  So there was an external pentest, you know, just as an outside in kind of thing.  Very few services, a couple applications.  There was an administrative like Web interface.  And it was some cheesy thing we thought might be vulnerable, but, you know, we were able  to get like some of the code to leak and things like that enough so that, you know, you could  Google it and kind of search for it.  So it turned out that that led us to looking at like comments and metadata in there.  We actually found a news group where the administrator actually like posted like huge snippets of  the source code for it, as well as like all of his information, who is very, very chatty  on the news groups.  Unfortunately, that didn't get as much, you know, so looking through like the snippets,  like, you know, you think like bingo, I have like source code here, you know, surely I  can get like something from that.  It didn't end up getting much.  However, we ended up like looking up the guy by name and we found his Facebook page and  like, you know, like nicknames and a bunch of stuff about it, which led us to a forum  called Caucasian Asian Love.  And it was a forum for Caucasian men to find Asian women to love.  Yeah.  So this guy had a full profile on there.  Apparently, he was really, really into it and really, really active in the Caucasian Asian  love.  So anyway, we ended up building up a word list from his dating profile.  And his password was a variant of love machine with the common U spelling of love, which  was actually rather awesome.  So we ended up getting into the administrative interface, which actually like yielded like  a ton.  So.  Okay.  Well, it was another external penetration test where we couldn't find any trivial vulnerability.  Actually no kind of web vulnerability, no vulnerable services, no weak accounts, no  things like that.  It was a huge network.  And we found that on this huge network, they had almost the 20 high definition IP cameras  and they also a specific part that was unrecognized by network mapper that probably was the application  to centralize all these IP cameras into a single service.  Well, these IP cameras, we looked around the vulnerability databases and we couldn't find  any vulnerability.  So we just look for a copy of these IP cameras and in a lab, we tested them and we find a  few vulnerabilities like authentication bypass that allowed us to dump the whole password  from the Linux based system inside the IP camera and a lot of stuff.  We cracked the local root password and stuff.  On the end, we created a modified firmware and we uploaded the over this interface and  they created a web shell from this web shell on the web camera.  They was connected on the inside network and consequently from these web cameras, we could  look for example, internal employees working, give zoom up to ten times, get screenshots,  IP of systems, user names and obviously from the web shell we created on the modified firmware,  we could access the whole internal network that was accessible from this IP cameras network  that was on the management administrative segment.  It is interesting because it resulted in advisory.  So we used the video cameras that's a security service.  The great thing about that one is you take a look once you're into these video cameras  and these were like by them having the good video cameras instead of the crappy grainy  like black and white ones, it really helped a lot because he had an optical zoom of ten  times and some of these were trained on machines and keyboards and things like that.  So it ended up becoming like a password bonanza as you kind of just sat there remotely in  a different country watching a user kind of sit down at a station and type in their password  and then like okay, so that user name has this password and throughout the day you end  up collecting a bunch of stuff.  And once you have credentials, the stuff on that hardened exterior with the various servers  that you can do much with, it isn't really like so hardened anymore.  You can kind of, a lot of password reuse is problematic and all pervasive.  So it tends to lead to compromise that way.  Okay, that's good.  All right, so after this one we have a video to show you of exactly how this all works.  I'll let Wendell describe it first and then I'll hand you this.  Sure.  All right.  Go for it.  Well, personally I really like database security and we commonly find raw BI and all guys on  the internal network penetration test.  We see a lot of database, SQL server, Autocodes, DB2 and MySQL and a lot of else.  Well sometimes we can compromise them with different techniques, overflows, weak accounts,  like bad DNS configured services, et cetera, and Oracle.  However, sometimes we can get like ARPs poofing, but no new connections, not people reconnectional.  They have strong passwords so we can't get the creeps, the credentials during the span  time of the engagement.  And that's a frustrating thing.  You're in the middle and you're seeing all this stuff and you wish you could do something  with it.  And it's like, well, I have all these sessions going.  Why can't I just grab one?  So that's what Wendell and Steve did.  They wrote a tool.  Basically, all right.  This is an already authenticated session.  Let's just go ahead and grab one.  Yeah, exactly.  Also, big thanks to Steve for working with us.  He did a great job.  And Tic Nett also supports the SQL server.  So the main idea is if you have the sessions running for Oracle or even SQL server, why  force them to range Acti to disconnect and get credentials or whatever if you can just  take this connection and send your own comments and do whatever we want?  So as you know, we can show screenshots of this penetration test we are talking about  because they are customer.  And it's not a good thing, but we created the in-house video just to demonstrate how  works we used it recently, a lot in different internal penetration tests with a good level  of success.  And the tool also is free and available on the internet for who is interested.  Go ahead and explain what's happening while it's running.  So we start off with this tool called VAMP that actually does the ARP spoofing.  It's a ProScript that does kind of like some reverse ARP spoofing.  With VAMP, then you run this tool called Tic Nett.  And now we are just showing a normal connection to our Oracle database.  From a supposedly client, this virtual machine is like a client that you want to access.  This first showing that we can't log in with the credential, when the database, as you  can see on the first line, then it's logged with the user Steve, that's a valid user.  So Steve is executing a very simple query like select 123 from the wall or whatever.  Now back to Tic Nett.  If you use the LS comments, we can see the active sessions.  The one is marked with the eye letter that means that it's injectable.  It was detected as injectable by Tic Nett.  So the next thing you do is you actually go ahead and use Tic Nett to steal the session.  It's a real easy thing.  And basically what you end up with is taking that session over.  The normal user just reconnects.  In most cases they don't know that anything really happens.  It just is kind of like a blip.  And a lot of like database clients have connection pools.  Anyway, so they just start a new connection.  You take their old one and basically end up with a shell interface to the Oracle database.  Yeah, at this point we could for example send any comments.  I see we stole in the connection.  So just to demonstrate, we are sending this SQL query that you'll be creating an account  that's called the window that on the beginning of the video was not an account that exists  on the database.  As you can see, you get on the end the ORIHER01003.  This means that the command was sent and partially successfully.  Now we are just stopping the RPP poison and making sure that we are not breaking the RPP  tables.  And now we are trying to log in again with the same account that was when the just to  make sure it really works.  We used the vamp to intercept and inject a live connection and create a new account on  the Oracle database.  Now as you can see, we can log in with the account that previously doesn't exist on the  database.  And now we can do any query like the privilege of this account.  As you see, we're just kind of doing a select query.  Just to demonstrate that it's possible to execute an query.  Obviously, in this case, the session that was stolen was a administrative query, a  administrative account.  So we could create an account, but you can always get the privilege of that account.  For example, recently, on our team meeting, we got another guy from the network penetration  testing team.  And it's very nice to, last week, we got a stolen SQL server, Microsoft SQL server with  this tool, and they could use the XPC MD shell to execute the commands just for a nice stolen  session also.  We have the other nice things from TicNet, like steel credentials, and even Microsoft  has some very specific, Oracle has some very specific stuff from Windows clients that leak  Windows authentication.  So I suggest everybody that is interested to check TicNet.  It's very interesting.  Is that it?  Sure.  There we go.  Okay.  Great.  Thanks.  Great.  Whoa.  All right.  Okay.  Thanks.  Thanks.  Thanks.  Thanks.  Thanks.  Thanks.  Thanks.  Thanks.  Okay, Kwil.  These are going insane here.  Oh, okay.  So technology is against me?  Okay.  Let's try this again.  Okay.  So it's time to, you know, talk about some of the victims of these attacks because they  all have very serious implications.  You know, they make for kind of like fun stories and, you know, sometimes funny get  a chuckle out of them.  But let's talk about none of these attacks really led to anything trivial.  The reason, you know, why they're included here is all of these attacks led to ginormous  compromises of huge amounts of data.  You know, in some cases, CHD in the numbering in the millions, PII numbering in the millions,  and huge, huge, huge amounts of data.  So the organizations that, you know, we're talking about here are multinational banks,  global restaurant franchise, major retail chains, credit card processor for an entire  nation.  And the types of data stolen that we're talking about here is, you know, every visa and master  card transaction processed in the entire country, hundreds of millions of pan and track data,  HR data.  In one case, you know, it led to accessing like the DHS terrorist watch list for financial  institutions that they're supposed to check against.  And, you know, obviously like billions of dollars in transactions.  So just kind of in conclusion to this, before I say something about stuff you didn't see,  is this talk was focused on those complex or uncommon hacks found in real environments.  Some are in very high end and important systems, and some are unlikely but true.  And this is, you know, a bizarre world where you have like old ancient anomalies, you know,  like affecting like newer systems, security systems that are used to hack organizations,  you know, new techniques developed on the fly and things like that.  So, you know, we're happy to be here, hopefully you enjoyed these stories.  So I think one of the things that we were going to do with this is we spent like two  weeks setting up like this whole like hacking challenge that we're going to run during the  talk.  And so, you know, we checked on it when we got here, we checked on it last night, checked  on it this morning and like three machines that we had like wooden boot.  And that's just awesome.  So you know, the winner was supposed to get a prize.  And so we still have the prize.  We have a few prize.  But I know like a lot of you out there have like bizarre and weird stories of their own.  So we're going to change it.  Anybody that comes up with just a truly weird fucked up story will get the prize of a Duke  Newcombe forever PC version game.  Anybody want to take a shot?  Come on up.  Well, yeah, we're showing you that we have the game today, but you won't actually get  it for another 12 years.  Have a seat.  What's your name?  Tim.  Tim, what's your weird fucked up story?  Well, we were doing a pen test one time.  And we were war dialing all their, you know, phone lines.  And like you, we found a system that was returning odd characters.  And basically we were able to determine that this was an HVAC control system.  And so did some research and found that there was a default technician login, got into the  HVAC control system.  And then we shut down the exhaust fan in their server room.  So then we just sent somebody out dressed up as an HVAC technician.  And we're able to get right into the daydissener.  What do you guys think?  Did Tim get the prize?  Yeah.  Oh, yeah.  There you go, man.  Thank you.  Sure.  Wait.  Wait.  No, no, no.  Wait.  Does anybody else?  Like I saw a couple of people that were kind of coming towards this stuff.  Anybody else want to try for the runner up prize?  Anyone?  All right, well, in that case, I'll drink the kachasa myself.  Thanks, everyone.  I hope you enjoyed it.  And thanks for coming out.
DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_0_887.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_888_1271.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_1272_1703.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_1704_2699.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_2700_2747.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_2748_3743.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_3744_3815.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_3816_5843.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_5844_5999.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_6000_10595.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_10596_14039.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_14040_14135.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_14136_17135.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_17136_17195.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_17196_17255.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_17256_18167.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_18168_23291.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_23292_23339.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_23340_26303.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_26304_30839.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_30840_30887.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_30888_31019.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_31020_34067.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_34068_34115.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_34116_35015.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_35016_38135.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_38136_38183.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_38184_40943.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_40944_43967.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_43968_44015.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_44016_44711.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_44712_44879.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_44880_44927.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_44928_44975.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_44976_45047.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_45048_45107.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_45108_45287.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_45288_45395.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_45396_45923.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_45924_46655.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_46656_47651.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_47652_48995.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_48996_49163.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_49164_49367.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_49368_52211.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_52212_52355.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_52356_52751.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_52752_53339.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_53340_53435.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_53436_53531.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_53532_53639.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_53640_53771.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_53772_54155.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_54156_54275.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_54276_54359.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_54360_54443.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_54444_54503.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_54504_54551.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_54552_55031.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_55032_57251.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_57252_57299.png DEF_CON_19_-_Rob_Havelt__Wendel_Guglielmetti_Henrique_-_Earth_vs__The_Giant_Spider_r_4OLpP1J7w_1_57300_64082.png