Kinectasploit: Metasploit Meets Kinect

Video thumbnail (Frame 0) Video thumbnail (Frame 2321) Video thumbnail (Frame 2786) Video thumbnail (Frame 3087) Video thumbnail (Frame 3721) Video thumbnail (Frame 4880) Video thumbnail (Frame 5603) Video thumbnail (Frame 5916) Video thumbnail (Frame 6487) Video thumbnail (Frame 6949) Video thumbnail (Frame 7293) Video thumbnail (Frame 7513) Video thumbnail (Frame 8304) Video thumbnail (Frame 8527) Video thumbnail (Frame 9039) Video thumbnail (Frame 9378) Video thumbnail (Frame 15901)
Video in TIB AV-Portal: Kinectasploit: Metasploit Meets Kinect

Formal Metadata

Kinectasploit: Metasploit Meets Kinect
Title of Series
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
We've all seen hackers in movies flying through 3D worlds as they hack the gibson. How about trying it for real? Now that we've got the kinect, lets hook it up to some hacking tools and see what it looks like to hack via kinect! Jeff Bryner has 20 years of experience integrating systems, fixing security issues, performing incident response and forensics. He writes for the SANS forensic blog, has spoken at RSA on SCADA security issues, DEFCON 18 on the google toolbar and runs just for fun. Twitter: @p0wnlabs

Related Material

Video is accompanying material for the following resource
Slide rule Trail Context awareness Demo (music) Code Multiplication sign Projective plane Physicalism Real-time operating system First-person shooter Computer animation Connected space Programmer (hardware) Skeleton (computer programming) Integrated development environment Internetworking Cuboid Point cloud Video game Game theory Whiteboard YouTube
Integrated development environment Physicalism Computing platform
Real number Software developer Combinational logic Video game Website Real-time operating system Game theory Term (mathematics) Computer animation Frame problem YouTube Front and back ends
Skeleton (computer programming) Game controller Internetworking Open set Line (geometry) Streaming media Communications protocol Computer programming Connected space
Variety (linguistics) Streaming media Computational complexity theory Number
Lie group Mereology
Polygon mesh Mapping Open source Internetworking Personal digital assistant Volumenvisualisierung Electronic visual display Figurate number Series (mathematics) Cycle (graph theory)
Demo (music)
Civil engineering Convex hull
Degree (graph theory) Arm Integrated development environment Basis <Mathematik> Game theory Disk read-and-write head Hydraulic jump
Internet forum Demo (music) Integrated development environment First-person shooter Game theory Hydraulic jump
Cuboid Connected space Neuroinformatik
Real number Range (statistics) Translation (relic) Function (mathematics) IP address Neuroinformatik Wave packet Mixture model Cuboid Electronic visual display Module (mathematics) Arm Mapping Inheritance (object-oriented programming) Interface (computing) Feedback Horizon First-person shooter Demoscene Word Process (computing) Integrated development environment Personal digital assistant Right angle Video game console Row (database)
this is a connect displayed so this is a talk about joining the connect microsoft kinect to metasploit via a 3d first-person shooter game environment in real time and we're going to use that to to own a box so this is all demo there's there's no slides but it only takes about 10 minutes or so to do the demo so let me just give you a brief little intro so you have some context about what's going on so I got to connect about a year ago or whatever it was they came out and first couple projects I did you can see these on youtube I did a drum machine using pi game it's just like three cubes and you're a point cloud and if you swat at it vigorously enough you can make a make a beat out of that and then the second one I did was a David Lee Roth sound board that I'm sure you guys have seen on the internet a long time ago they took David Lee Ross vocal from running with the devil and chopped it up and put it on the sound more you can click it get all this crazy who's and all that stuff same thing just cubes you're a point cloud you swat at it but what that taught me what I bring it up is that I'm a Python programmer so I'm not into mounds and mounds of OpenGL code which is what you end up doing there and physics as well so I and then the third thing is that there wasn't made and there still isn't as far as I know skeleton tracking for Kinect and in a Python a rapper so those are the problems that stop me from doing anything else and then I stumbled upon a blender so Christopher Webber to the talk at PyCon 2011 talking about blender 2.57 blenders a 3d game environment let me show you that you can use to do CGI animations and also has a game engine so
that solves the OpenGL and physics
issues and gives you a platform that you
can use to decree all kinds of stuff so it's a 3d I'm assuming you guys haven't seen blender so i'll just give you a brief little quick tour 3d animation environments and the cool thing coolest thing is that i don't if you can see the
swap on the top they're telling us 60 frames a second so it's real real life real time game engine all driven on the back end by Python Python 3 nonetheless
so you should check it out blender org is the site they fostered the development of blender by putting cgi animators and developers together make a movie with it so there's a movie on YouTube you could watch called syntel SI mtel is 15 minute animation is great that's how they made they use that combination of folks to actually make make this so seem blender we still have
a problem though how do we get skeleton data into Python like I mentioned there's no no easy way to do that so the answer to that this is OS selatan OS hello skeleton is a program it uses the OSC protocol open sound control protocol to make a UDP stream of joint data so you get this just over your local connection or you can send it over the internet if you felt like it a stream of all the joints that connect is seeing so let me set this up and here's just a quick little Python debug about 10 lines or so and it's just going to blast out everything that we see so if this goes well so it's initialized at me for me found me I do the the pose now we get
joint data so just like that they got joint data in in Python let me show you
what we get is this is what goes into into blender so you got a variety of joints usually it's just elbow hand shoulder and he's all that stuff but it gives you the joint the player come on player number and then you get x y and z coordinates so now that's what we're going to stream into blender so you start this up again let find me and I'm
going to show you the first part of the oh I think it's done
it's done so now they got that into in
the blender the first thing first thing I like in these displays when they actually have a person that maps to what you're doing so I built this using just some open source mesh stuff that's out there on the internet this is just a human male figure but the important thing the thing I want to show you is that it's complete when you make that
bigger it's complete down to what blender calls an armature which is a series of bones put together that when you move them in and they usually in a render engine you can make like walk cycles poses stuff like that in our case we're going to link that up to the OSC data coming in to actually get to get poses so let me pull this back and we'll
demo this guy is called super harmer so
it's running a little slow gets better let me do this again
still a little buggy blender okay that's
better so as real-time joint data you can see arms are kind of the best legs are a little twitchy so I don't really have them doing too much because I'm not a dancer but you can move your arms around the head is also a little twitchy and then so from the basis of the and the reason i want to show you though the bones stuff in there because that becomes the basis for gestures so there's going to be a flex gesture later when we get into a game environment and so that's this bone 90 degrees to X so you can start to recognize all kinds of gestures so let's jump into the kinect
exploit environment so this is connect
to split it say you know first-person
shooter game environment it's kind of memilih this there's only a couple rooms and it will only use one room and it's built so there was a guy on the blender forums who built this is just as kind of a first-person shooter game he was messing around with and he gave me permission to use it to use the background anyways for this is demo so let's jump in and I'll show you the gestures the first thing is going to do
when we start up is make a connection to metasploit I got metasploit running over
here and in a victim box and it's going to announce it that will start going through the owning of computer connect
just boys initiated so I'm already recognized from OS selatan and there's a little super Harmer and what's uh what's called a heads-up display in the blender so it's just mapping to scenes on top of each other and you can see we got our real-time running metasploit console output up in the top so some of the initial gestures are if you move forward you go forward you are you lean backwards you go backwards and you know they're left your left lean to the right you go right and if you want to get a look around the room just rotate your hips and like I said this is a training environment so we've got some inspirational posters on the wall here too to get us get us a little in the mood to do there's a pointing the more depot in the more you know and of course the last poster ICBM now you could also this door here you could you know move yourself through the door and all that I won't go through all the rooms because this is the main room that we want to deal with the idea would be you know room equals an IP range just a local IP arranged on my box in this case so to get into actually using this to drive tools of course you gotta scan to find them first so the scanning gesture is both hands up to your forehead like you were scanning the horizon so we'll do that come on it gives you a countdown because scanning is and announces your presence when it's done yeah so you can so you can see the output from men map up there just you know right I ran out of a mess boy console that was my idea anyways what em map sounds like it was a weird thing trying to come up with sounds for this because what does that map something like it sounds like that now so these are two computers that we found victims that we can we can attack and I was talking to my daughter about this because you know first person shooter he really is a shooter you have a gun that you can use to target things and she's like well maybe you can just use your gun gun the flexing gun like your gun gesture so that's the gesture to target one of these guys so you do a flex and touch your shoulder and elbow like in a cocky motion and you get a targeting range target acquired so there we go thank you if you like that you're really gonna love this so the last the last gesture in this thing is the only one I could come up with for for owning a box it's the well the French have a word that I can't say for it but it's called arm of Honor if it if my translation is right it's this DVL chose Pony initiator so this guys having DV auto go and run against him and this is my idea what dibiago phone sounds like the mixture of bats and the skype feedback sound don't have to have to find someone who has a better idea what that should actually sound like maybe keep your eye on the metasploit console interface up there you'll see it'll know announce the modules that it's launching effort it gets done looking for what it could possibly use against this thing and the animation happen again you know it come boy his brains out as we're recording it and if all goes well we'll get sessions and that's that's the end of what we can do so far we've got five modules left two sessions so there you go thank you so those I'll get out of the game and show you their actual real live sessions in metasploit and there but the next idea that i got for this one is this doesn't work yet it'll be at you you know march up to this thing and do through some gesture may be hopping or something you launch yourself into the computer that becomes a different scene and that you could use to drive you know one of the motor processions that you got in there so like I said there are
real sessions to them in there and that is connected