Laurent Desaulniers

### Overview In this talk, Laurent Desaulniers presents a collection of practical, low-complexity penetration testing and red teaming techniques. Rather than relying on deep reverse engineering, assembly, or complex zero-day exploits, the speaker emphasizes pragmatic workarounds based on the philosophy that "if it's stupid and it works, then it's not stupid." The session covers alternative methods for physical access, social engineering, email interception, command and control (C2), data exfiltration, geolocation, and hardware-based attacks.

### Key Topics - **Physical Social Engineering & USB Drops:** Enhancing the traditional USB drop by attaching keys and organizational artifacts to appeal to human psychology. - **Email Interception & Phishing:** Abusing Outlook's Offline Address Book (OAB) autocompletion. - **Physical Security Bypasses:** Circumventing motion sensors and magnetic door switches with common household items and inexpensive tools. - **Command and Control (C2) & Side Channels:** Blending C2 communications inside legitimate services, multi-step web forms, wireless SSID side channels, and Outlook. - **Exfiltration Workarounds:** Using VirusTotal and media transfer protocols to bypass loss prevention and storage blocks. - **Reconnaissance & Hardware Attacks:** Finding target physical addresses via automated phone systems and deploying low-cost keystroke injection hardware.

### Technical Details - **Enhanced USB Drops:** Traditional USB drops suffer from low success rates (~35%) due to awareness. The speaker pairs USB drives with actual keys bought in bulk by the pound, appealing to psychology and influence concepts studied by Stanley Milgram. Adding items like baby photos, Disney branding, or expired RSA VPN tokens prompts finders or sysadmins to plug the device in to locate the owner. - **Outlook Autocomplete Manipulation:** Outlook's Offline Address Book (OAB) autocompletes contacts based on prior replies. An attacker sends a passive-aggressive email from a spoofed name (e.g., "John A. Smith" to supersede "John Smith") asking if there are email delivery problems. Once the victim replies, the attacker's address appears first alphabetically in autocomplete suggestions. - **Bypassing Physical Sensors & Locks:** - Motion detectors can be blinded during business hours by spraying them with Pam cooking spray (a technique attributed to the Antwerp diamond heist) or placing plants directly in front of sensors. - Magnetic door alarm switches can be located through door seams using $5 magnetic viewing film, showing attackers precisely where to place shims. - Floor plans and architectural blueprints can be sourced legally through building research firms such as "Employees" for around $15. - **C2 Mechanisms:** - Leveraging client web infrastructure: Entering data into unauthenticated multi-step forms or forum fields on the victim's own web servers saves data server-side without completing the submission, allowing internal agents to poll these endpoints while bypassing outbound proxy inspections. - Wireless side channels: Utilizing malware frameworks like "GupT" to receive commands broadcasted via nearby Wi-Fi SSID names. - Email channels: Scripting Microsoft Outlook via documented TechNet interfaces to transmit and receive instructions over legitimate corporate email channels. - Optical Character Recognition (OCR): Avoiding complex shellcode-in-image steganography by simply taking a screenshot of source text as a JPG and using PowerShell to perform OCR on the image. - **Data Exfiltration:** - Uploading encrypted files as samples to VirusTotal and later retrieving them using a paid VirusTotal account, eliminating direct attacker-to-victim traffic links. - Bypassing standard USB mass storage policy blocks by using Media Transfer Protocol (MTP) devices, such as Microsoft Zune players. - **Phone Spoofing & Keystroke Injection:** - Discovering target home addresses by spoofing caller ID when calling automated, IVR-driven services (taxi dispatchers, energy outage hotlines, package tracking) that automatically prompt for or confirm registered service addresses. - Replacing $50 Hak5 Rubber Duckies with cheap $1 ATtiny85 microcontrollers programmed for keyboard emulation, or injecting keystrokes wirelessly into vulnerable non-Bluetooth wireless keyboards and mice.

### Takeaways Attackers and penetration testers often do not need advanced zero-days to achieve their objectives. Security teams frequently configure defenses against direct, sophisticated vectors while overlooking simple bypasses—such as non-storage USB device profiles, ambient physical controls, automated phone lookup interfaces, and human inclination to help return lost keys.