0:13 if you have questions um please put them in the chat that will be moderating those um answering those that she is able to and if she feels that there's a point that she could maybe stop some of the demo and ask questions she'll kind of make those determinations or save it to the end so Val you want to say a little bit about who you are and maybe a little known fact about you hi everyone uh um it is true my name is Val and um I'm a pentester here on red team um well uh in a past life I used to teach creative problem solving and effective communication and now I break expensive things
0:58 well fines of work are good um and um a little known thing about me um I I speak Italian and and um I enjoy reading Italian uh thrillers oh did not know that I'm trying I'm already learning stuff so good that's true well um John and Brian thank you so much for all your work and getting us prepared for this um Mish and the other other rest of our teams thanks for getting this pulled together and with no uh further Ado I'm gonna hop off here and um John I'm gonna let you go ahead and kick us off
1:48 here can everybody see my screen it should be a Linux terminal window yes I can all right excellent um so let's get started uh the first thing that we typically do when we are on an internal pen test um is we run a tool called responder what responder does is it kind of it's basically a liar is what it is so there's certain uh protocols um multicast name resolution protocols like llmnr mbtns and what those do is they broadcast to the whole network and it's
2:34 like Hey where's machine a and what responder does is it says oh yeah that's me I'm machine a and then the machine that asks for that starts talking to whatever responder tells it basically and in so doing it passes things like Windows hashes um and other things that we can then either crack offline or relay to other hosts so it's a very useful tool for attacking AV environments so let's get that fired up um Dash I for interface uh Dash W for wpad and dash F2 Force wpad Authentication let's see what we get out of this
3:25 [Music] oh there there got some stuff so you're saying the domain name hackney.local some usernames their Associated hashes coming through a little skip previously captured ones and all of this gets logged so typically what we do on an engagement is we'll fire this up in the morning um it's pretty dependent on user activities so the best time to do it is in the mornings or maybe after lunch when users are coming back they're signing into their computers they're getting back to work and there's lots of network traffic going on um now since this is just a demo
4:12 environment um it's it's very small and there's not going to be a whole lot for us to capture so I'm actually going to kill this now because it should be about done so once we've captured some of those hashes we can go into the the logs folder for the tool and within here it's got the all the session logs and you've also got files like this here where it's captured uh ntlm V2 hashes from HTTP this is likely from wpad Force authentication you also
4:58 to see things like this where it's it's captured some SMB and then also web dev traffic now if you were to actually look in these text files this is what you saw scrolling by on those screens so you've got a username the domain come here come here and the uh the associated hash now you'll notice that lots of these are duplicated um hey the the reason for that is that these uh hashes had salt associated with them um and the hash may look a little bit different because of that um but it's all basically the same password going on there
5:44 so what we can do is we're gonna take all of those text files we're going to dump them into a file called hashes.txt everything's there so then what we can do is we can run a tool called hashcat now this is a virtual machine that I'm running this on and it doesn't actually have um a GPU so typically what we will do on an actual engagement is we'll run this through what's called a password cracking rig um it's got a bunch of high-powered graphics processor units in it which are very efficient at cracking hashes um for me since this is a demo and because
6:30 we're interested in doing this in a timely manner I'm going to use a very short password list um and so what I'm doing here is so the the dash m is basically telling it what type of um hashes were cracking the 5600 is for ntlmv2 the the next item there is the that list of password hashes that I just made um after that we are going to put the list to our passwords text file this is just a list you can get these off the dark web or all sorts of different places um one that people might be familiar with is called Rock you and it comes with uh Cali distros and lastly we are going to do Dash o for
7:17 output or write this to a file called cracked txt and the dash force is basically because I'm not actually running uh gpus and this is just going to kind of force it to try to compile something that it works with in in the meantime it's definitely not as fast as an actual GPU but takes a second here and so there we go it ran pretty quick it was a short password list I think there's only about uh 10 or I guess 1 000 passwords in that list but what you can see here is we did recover some so we got 5 out of 13. um several of those were salted but we definitely got some results so if we take a look at that cracked.txt
8:04 file you can see we got a password for the user l Miller on the hackme.local domain and her password is summer 2020. so uh super secure password there l Miller um so now we've got a credential that we can use against active directory and we could do a lot of stuff with this we could use it for additional enumeration we could see what shares are out there we could log into the user's workstation while they're on lunch break and see what kind of applications are running um all sorts of stuff for our purposes today what I'm going to show you is a uh Bloodhound ingester that uses python and what we're going to do
8:51 so Dash C all is um the the types of information that this ingester is going to try to pull down from the domain um the domain hackme.local user l Miller and her super secure password summer 2020. lastly we're going to throw in a name server just so that all of this works out nicely during the demo and everything resolves and that's information you would probably find from other parts of your test like finding through nmap or nessus or whatever um
9:36 application you're using to discover assets so you might find a name server you might find them in controllers things like that and those IP addresses so let's run this and of course I got most of the information we need but not all of it so I'm going to run this one more time so there's a lot of uh moving parts to this demo we basically have to have um a functional active directory environment okay there we go so the reason I was running that over and over and over is I wanted to capture some session data
10:23 and you'll notice that the first few attempts here I got information about the domain the number of computers number of users groups Etc um but one thing we didn't get was user is logged on so for this demo I have scripts running to imitate actual traffic and log users in and out and things like that and so those first few times that I ran that that user wasn't actually run but it eventually happened for us which is fantastic so in a large active directory environment um these python ingesters can run for a long time I've seen them go for many minutes uh even hours in large
11:09 domains with lots of trusts and things of that nature we're talking like tens of thousands of users hundreds of thousands of computers things like that but anyway once it collects all the information we will let's start up neo4j this is basically the database um that Bloodhound uses and oh also one thing I should mention so these Json files are what that uh that python ingester created for us so after we start up the neo4j database we're going to start the Bloodhound GUI and we'll get signed in here
12:06 at this point we're going to upload the data that we got so it's four files for the computer's domains groups and users it actually looks like I forgot to clear my database the last time that I did this let me do that real quick for us well let's re-upload all right so now you can see the database information and it has all that summary information we saw before plus a few extra things like ACLS and relationships um what this tool is really good for is it basically draws out in graphical form
12:53 uh kind of the layout of the domain and what we use it for is pen testers you can do things like run queries on different hosts on users like for example if I want to find all domain admins this is a pre-built query and domain admins is the group here member of we've got the administrator user we've also got R Smith da so those are our two domain admins on this this network the other thing and this this is super useful to us as pen testers if the the goal is to try to get domain administrator on the network is find shortest paths to domain admins and let me show you what this looks like now this this is why I needed that
13:39 session information to come in so sometimes you do have to run python ingesters a lot to to capture session information you can also rather than doing just C Dash all you can run specific um uh um an option to pull down those sessions and repeatedly because the more session information you get uh the better chance you're going to have of finding a path so here we've got our graph laid out here again it starts I I like to work backwards um when I'm in Bloodhound because it kind of helps me understand where we want to get to First and how we're going to get there so we start with the domain admins group over here we can see the number of is
14:26 our Smith d a which we already saw R Smith da has a session on win7-a Dot hackme.local so he's probably signed in in some way um we don't know for sure how it could be remote desktop he might have uh uh a mapped network drive it could be a variety of things what's also interesting about this is we can see there's an admin to win7 hack me.local and that user is e Thompson and I definitely saw some traffic from E Thompson going by and responder so what we're going to try to do is get ntlm relay which is a tool I mentioned before to
15:12 basically take e Thompson's hash by having responders say hey I'm the computer you're looking for take his hash it over to this win7 machine have it do a little bit of magic in the background basically what it does is it starts a service runs it as the system account and then executes some commands so what what we're gonna the goal out of this is to obtain um a shell on win7 so without further Ado let's get to it that's our path that we're gonna follow here to try to get domain admin um one thing that we should probably do first is we need to verify that our
15:58 Target computer has SMP signing disabled this is a pretty big requirement of using tools like ntlm relay and to do that we're going to run crack map exec um it has a feature where you can generate a relay list and dump it out to the targets.txt file that I've got listed there um and then I'm going to run it on the entire 24 Network that I'm on um but you could also Target individual machines this way and so I'm just going to kill this because we've got the information we need so as you can see we've got that's data 2012 Windows Server 2012 R2 signings disabled so that's good to know the domain controller has signing
16:43 enabled so we can't do a tax directly against the DC um and then here's that that Target we saw win7a and you can see that signing is disabled so that's great news for us that means we can definitely do that in tlm relay attack against that system um for those of you that are interested if we were to take a look at that targets it's just got the two that had signing disabled so data 2012 and win7 in it so let's see here okay so
17:29 um initially when I was trying this antivirus that's installed on this machine kept capturing and blocking what I was trying to do with ntlm relay and I've run into this in the past on some engagements as well so what I'm going to talk about now is kind of basically my way of getting ntlm relay working again and how we can get it working to bypass that antivirus so to do this this is a a Ms Guild c-sharp reverse shell that I found just online somebody's public GitHub um what this does is it can be used with a
18:14 tool that comes with windows.net it's called Ms build and essentially what newer versions of that allow us to do is we can start these tasks so this is all just C sharp it's a reverse shell very simple very basic um and I wanted to start with something like that so that I wasn't trying to troubleshoot you know is this uh two issue or what I just wanted to start with something that I could understand and easily diagnose and troubleshoot on my own so Ms build compiles this on the Fly and runs it and that's the idea behind it so I downloaded this and let me close this window out
19:02 and that's kind of our our starting point so the first thing that I did rt1.xml is what I just showed you from that GitHub that's the original code now what I'm going to do is I'm going to show the differences as I made these uh progressions through this so let's look at it color diff is going to show us the differences between these two files so red is the original you can see IP address and Port this is me setting up my own ipn port I also added a function that would exit cleanly if I typed exit from this shell otherwise it tend to just hang and it would leave Ms build processes all over the place and
19:48 then I just deleted this comment that wasn't really doing anything um so I tried running uh ntlm relay on this and it got caught by AV now let me talk about the setup a little bit real quick here so I want to host this XML file from something I have control over for example a SMB server or you could use web dev um in my case I'm just going to use the SMB server because it's it's easy and it's here and I'm actually going to use the the samba demon so first things first we'll get that started
20:33 um the other thing that we need to do is we need to slightly modify the config file that responder uses because what we're doing now is we're we're relaying hashes instead of capturing them so we don't want it um to run SMB and we don't want it to do HTTP for wpad entries so we're going to turn those things to off oops let's do that again with the right privileges
21:21 all right so at this point we can run responder again and it's going to do what we want so that we can relay these these hashes now the first time that I ran this I'm going to copy and paste this because it's kind of a long command Let Me Clear My screen up this is what I I ran so we've got the ntlm relay tool um I'm including smb2 support which is probably required on newer Windows operating systems I'm excluding the Samba server because I'm going to be serving my own stuff this is the target Dash T this is that win7-a that we were talking about earlier and then this is the command that I'm going to run so in this case I'm running command with the following commands in quotes we're
22:07 doing net use what this is doing is it's basically connecting to my evil Samba share where I'm going to be hosting this file from the user that's required and the password that's required why that's necessary is uh it's primarily on newer Windows 10 systems um and 2016. uh greater than I think build 1709 um there pretty much is No guest access anymore so you you need to have username and password authentication so I included that for everybody's reference here your mileage may vary in in this case since we're attacking a Windows 7 box we probably didn't need that but I included it anyway
22:53 and then what we're doing is we're running that Ms build executable that I talked about before and this path is basically the same on every version of Windows Windows Microsoft .net for Ms build and then it's going to that file share that we set up and our shell um that that code that we were looking at before now when I ran that it got caught immediately by antivirus and this is the message it gave me oh so we've blocked execute.bat it was infected with IDP generic here's the path information execute.bet cmd.exe well that's a bummer so that's that's directly related to ntlm relay
23:42 and tlm relay like I was telling you when you run it it creates a service and it runs that service basically the service that it's running is this batch file execute.bat so my first idea for bypassing this and getting past antivirus is well what if I just um rename that that executable and so if you look in the code for ntlm relay you can find these this blue part here is the comment this is what was originally there temp execute.pad and then it's also got an output file and what I did is I basically just replaced it instead of just underscore
24:27 underscore output it's red team underscore underscore output and red team.bat so I did that I tried running this command again and this time I got this so basically the same message only with my red team.bat changes um so okay av's a little bit smarter than we thought uh what can we do next so where I went from here was uh clear this out
25:14 hold one second sorry everybody so if we take a look at this file this is the actual path to the file that is kind of working for ntlm Relay behind the scenes it comes out of the secret stump.python and this took me a little bit of trial on there to figure out because I wouldn't have expected it to come from Secret stump but that's how it is at least on the version of impact it that comes with Cali so your mileage may vary um but that's where it is for me so since the last attempt failed what I did this time rather than using the temp directory I was like okay well let's see if I can get this to work anywhere else and so I just stuck it in the root of c and that's what you're seeing here with the c column backslash red team.bet and then
26:02 same with that output file so I'm actually modifying the tool and you know this this requires some programming expertise and things like that but it's it's nothing too crazy it's not much more than a config file honestly so made that change ran it again and this time we got this from antivirus so that's interesting it's a slightly different message the batch file doesn't seem to be getting caught anymore now it says it's actually catching that XML now at this point I was kind of Blown Away um because I didn't think that AV could really do this most of what's Happening should be happening in memory it's
26:49 pulling this rt.xml off of a file share and it's being compiled on the fly in memory nothing's really touching the disk so what what is Av doing here at this point I kind of went down a rabbit hole honestly um my assumption was that it was seeing something in that XML file and so I went about trying to change that XML file to make it so that it would bypass a b and so I'm going to show you some of those changes now so um I don't know if anybody on this has
27:35 ever heard of uh Mimi dogs but it's a project that um Black Hills information security uh made a while back and it was talking about bypassing the annivers and their goal was to get Mimi cats to bypass a b and bite one of the ways that they did this is by editing the code in Mimi cats and changing Mimi cats to Mimi dogs it was just a simple obfuscation but it was enough to get it past certain types of antivirus so that's kind of where my methodology was starting um so I'm going to run color diff again so you can see what kind of things I changed basically all that I did was I opened the last file and I would run
28:21 find and replace and I would replace certain things so hello becomes high class example becomes red team you can see class examples there again um public class red team variable names I'm just changing those I'm changing the names of functions that I can and variable names that I can that won't impact what the program is doing but which might trick antivirus so stream writer becomes dancer and I'm just thinking of random words as I'm going along here you know client becomes fishermen stream becomes glue RDR becomes bananas P becomes X you know it's it's me being random as random as I can would just finding her
29:07 place but there's tools out there that will do obfuscation like this for you as well um especially with power shell tools um so anyway that's that's the kind of thing that we're trying to do here is we're obfuscating the code a little bit in hopes that it's going to make antivirus say I don't know what this is must be fine good luck so anyway we've uh that that was my first change the other thing that I changed is a part of this I wanted to um one thing you'll notice that this does when it sets up all the streams and the the network sockets and everything it's called calling a new process and it's spawning cmd.exe well that type of thing is very common
29:53 in Shell Code um and malicious files so I wanted to try to obfuscate cmd.exe a little bit so to do that again this requires a little bit of code knowledge but hopefully nothing that's too far beyond the Realms of understanding so what you see here here's the original and would I change it to I'm using some net functions or converting to a string we're taking this big ugly screen concatenating it with a period and then an e and then this big ugly string and then what we're doing is we're running substring against it from character position 15 and length 8.
30:38 and so if you were to look at that what we're actually getting is cmd.exe so it's that same thing just obfuscate it a little bit more changing that file a little bit more so that hopefully antivirus doesn't catch it so I ran this and any guesses on what happened same thing same exact thing even in spite of all of my obfuscation efforts and so at this point it was kind of a pain to run ntlm relay
31:24 over and over and over on this um shutting it down and restarting it takes a little while getting all those Network the the bogus network communication running things like that so what I I did instead is I fired up a test system with the antivirus installed and I started um testing directly on that system and to do that I would basically just run this Command right on the Windows command prompt and that worked as a standard user and I was like huh that's interesting so then I tried starting a an administrative command prompt and I ran that same exact command
32:12 and it worked again I got a shell back and I was like okay so what is going on here it doesn't seem to be catching um thank you it when I run it as a standard user or as a local admin so then what I ended up doing is I I wanted to run it as system because that's what ntlm relay is doing for us when it sets up that service it runs it as the local service account and so I grabbed the assist internals tool called PS exec and you can look that up on on your own but basically what I did is I ran PS exec Dash I for interactive and dash s for system and then cmd.exe which
33:00 launches a CMD process as the local system user so now I've got a CMD process running as the system account and I ran that same thing one more time and that got caught so if we look at that that error again does anybody noticed anything interesting about this so every time it's always been ibp.generic this has changed the paths have changed one thing that's always remained the same though is behavior Shield so at this point I was thinking well maybe it's catching behaviors instead of
33:45 an actual like uh you know virus signature maybe what it's looking for is certain processes that it knows can be dangerous like Ms build.exe in certain conditions for example running as the system level account well okay that's the theory anyways so how did I prove that well um I I also ran a scan on rt.xml using this Hannah virus product and no results it thought it was totally fine no issues with it at all so that further made me think that rt.xml wasn't the issue so
34:31 next what I did simplest way that I could think of to bypass this is if it's looking for that behavior if it's looking for Ms build.exe what if I renamed msbuild.exe so what I did is I basically just made a copy of that file and this is basically the the command that I used so again you've seen this that's the mapping the network and then I ran copy overwrite the slash B is for binary which is found was pretty much a requirement for this and then it's copying in this build to and in this case I just stuck it in the
35:16 root it's the combat slash rt.exe then I'm running this against our payload now that got caught again and I thought well you know maybe it sees this somewhere maybe I need to obfuscate the actual Ms build part of this and so what I came up with another command or chain of commands I suppose oops so this time I'm changing directory into that folder then I'm copying MSB star dot EXE
36:03 so we're hiding the fact that it's Ms build but we're still getting it to be able to copy to a rename file okay and again just running this against rt.xml now the downside to that is if app white listing is involved you're renaming the file this might not make it through Windows App application white listing but it is still assigned Microsoft binary so maybe it would in certain circumstances but there's other options for you too you could potentially rename it to a different file name put it in a specific folder that you know that app uh whitelisting is allowed on things like that so it's not necessarily the end of the road
36:49 but this is what I did for this demo so let's continue on um so now we've got a command where I'm I'm getting a call back I'm getting a shell so let's plug this in two our Cali system and see if we can get it to work so the first thing we're going to do oops wrong pane there we're going to start up responder again interface eight zero wpad Force Authentication get that running and let's go down to this pane let's get
37:35 a netcat listener going and see as netcat it's a Swiss army knife of Network Tools I think it's called so for for us we're basically using it to catch our reverse shell and so L is listen V verbose P Port we're going to specify one two three four because that's what I had in my XML file from before so we'll get that running and now we're going to use our special ntlm relay command so this is the whole thing um I guess I don't need sudo for this so ntlm relay x with smb2 support no
38:20 Samba server to that same Target and all the stuff that we just learned so we're mapping the share we're changing directory into the.net folder we're copying MSB star.exe to the root we're calling it RT for red team dot EXE and then we're running that against our RT pal um XML payload which is hosted by our zombie server lastly we're going to delete that rt.exe just to tidy up a bit so Moment of Truth fingers crossed let's pray to the demo gods that this works and what we should see if it would
39:08 if it does work is a shell callback down in that bottom pane all right there we go so who am I NT Authority system fantastic and what's the hostname it's that same host that we saw before so at this point I got a shell I'm going to close out of these other two panes here so we can focus on
39:55 this shell that we just obtained so what was our goal with this we were trying to get on this machine so that we can try to get the domain admin right so we can do that with just some built-in Windows tools um first one I'm going to show you is wmic we're going to do a query for um the process lsass.exe and we're going to get the process ID so here we've got process five five six so
40:41 uh element here looking at my notes so what what we're trying to do is is we're trying to dump this is the windows logon service we're trying to get a memory dump of that because it can contain clear text passwords and password hashes um now since we're running as the system account this shouldn't be a problem um and all that we really have to do is run a specific command for us Windows Powershell has debugging uh privileges enabled by default so we can use it to execute run dll 32 this is
41:26 another Windows process we're going to have it call the com services dll that dll has something called a mini dump method in it this 556 is the process ID we just found and then what we're going to do is we're going to save this back off to our our file share as the computer name in dump format and the full is a full dump of a process so we'll run this fingers crossed again that uh the demo Gods smile upon me and this can take a little while okay it looks like we're back so let's switch over
42:12 let's go to our SMB share to our dumps folder there's the dump we just created so then we can use a tool called Pi Pi cats um python equivalent of Mimi cats essentially but uh it can do offline analysis from our Cali box so we run pipe by cats LSA mini dump and then we will load in that file we just got and we get a whole bunch of stuff back so what is all of this well it's a bunch of things mostly it's the computer password for win7a in various forms Kerberos W digest all sorts of different forms uh here's a
42:57 clear text password that's one that we sent over this is what happened when we we mapped our file share you can see there's hashes in here this is again for that Windows 7 box so that's the the password hash of that computer keep looking let's see what we got in here uh oh here we go username TS PKG so this was probably from a terminal server uh session on this so he had remote desktopped in our smithda and here's his super secret password one two three so it looks like we've got a valid domain admin password we can test that with one more command that I'll show you
43:45 so and it's one we've talked about before um so we're going to do uh let's see correct map exec SMB 172 16 48 60 is the domain controller user R Smith uh whoops da account password that super secret password one two three and the tool spits out pound and it does that if you've got local admin on the box so we're local admin on domain controller 2012.
44:30 at this point we've got domain admin rights to this domain we could do Post exploit we could do all sorts of stuff so that's basically the end of the demo one thing I'm gonna I'm gonna talk about in my final thoughts here real quick so in this case we just used um a very simple reverse shell but there were other options you can use lots of the command and control systems out there supports Ms builds um versions of their payloads C2 is like silent Trinity for example and Covenant there's also tools like NPS payload which you can use you can do
45:16 um interpreter shells through NPS payload the other thing if you do that and if you get a big list you remember that targets list so I guess I'm in the wrong folder so if you get a big list of machines with SMB signing disabled you can Target them all within tlm relay and if you're using a C2 infrastructure you can potentially get access to every machine on that network with just a couple of commands so that's pretty cool during my testing I was able to get silent Trinity working with this it did bypass all the AV um
46:02 and let's see one issue that I did have with running silent Trinity that way is if multiple um payloads ran on the same machine it tended to kind of Gunk up the works of Silent Trinity I I think maybe it doesn't know what to do and so when you would try since it's an asynchronous and C2 things would just start not working right so your mileage may vary depending on the CTU that you use and um lastly the one thing that I'll mention is there is a rock band this is in a um so if if you were to look at the GitHub for ntlm relay
46:49 there is a pull request that hasn't been approved yet and this will be in my blog post that should be posted probably within the next week um but there is a um a pull request and what it would do is it would add a raw option to ntlm relay basically what that does is it allows the command to run directly without having it um placed into a batch file first I tested that I merged the code manually and ran that that worked as well and that that basically makes it so you don't have to change the file name of the batch file on the executable it just dumps whatever you put in there directly into the service that gets
47:35 called so um that's definitely an option as well and I don't know when that pull request will happen but it's out there if you're interested definitely check our blog later on and uh that's all I've got so nice job this is um some amazing finds I'm so glad that you walked us through that I um also I was going to mention your blog so thank you for doing that I'm like that's great so I've been kind of watching some texts go by and they're trying to figure out where to put it and so we'll let all of you know um um we're gonna try to get links to that as well as a copy of this presentation so um with both of those pieces you'll be pretty armed to kind of replicate uh what John just showed us so thank you
48:21 are there any questions before we move on um real quick that you might want to ask John directly is there anything I know there's been quite a active chat going so okay did I see somebody raise their hand oh oh people are clapping oh look at that nice job I'm really really good work with this pretty amazing and thanks everybody I hope hope it's useful I hope it's been informative and educational so yes thank you thank you for all your hard work pulling this together and uh thanks for your uh hard work actually uh figuring this out it's pretty amazing work
49:08 thanks all right well good well thank you if any questions um you know hit you um before the end of this feel free to put them in the chat um or I'll put my contact information up at the end and you can pass them on to me and I'll make sure to get those answered for you as well next up we have Brian Brian halbach he is going to show us a little bit more demo um and are you a great audience participation oh right with the audience participation good good good so um I'll just go ahead and let you take it from here yeah so uh I'll do a little bit of talking first then there's going to be some audience participation I don't know what everybody's knowledge level is at
49:54 um so the purpose of now or the audience participation is so that I can hopefully gauge the general knowledge level of the group and then we're actually going to work through a scenario together uh based on our cumulative knowledge and see what we can do as a malicious Insider and then I'll show you also what we can do as a malicious hacker so you can kind of get a little comparison um so yeah let's see you guys probably want to see my screen so you can see what I'm doing I will show you let's close that out just let us guess that's true I'm very I'm very good at describing uh things on computers after my days in the help desk I spent uh five and a half years doing help desk and uh one of my favorites was I had to help
50:40 somebody turn their Wi-Fi back on um but they didn't know the name for the Wi-Fi icon so they kept calling it The Little stairs at the bottom of the corner because if you look at it it's like little bars that go up and this person assumed that those were stairs and not the Wi-Fi icon so I can do a very good job of describing if we need zero oh yeah so one of the extra things I wanted to talk to everybody about well since we're all uh coveted land together is some of the fun opportunities red team has had to do and uh things we've worked on and one of the cool things is uh recently our other our laptops are coming up on being about five years old which is about the time you do a laptop refresh just to make sure you're on the latest and greatest Hardware
51:26 um and traditionally we always use Max and if you're paying attention to our screens and you are doing your reconnaissance and intelligence gathering you'll notice that this is not a Macintosh that we're on anymore um and this was actually a recommendation by one of our other pen testers is he found this really cool model uh laptop which essentially is like a little micro server um and we just got a ton of horsepower and so because of this we're actually able to set up fully interactive uh active directory environments on our computers without taking a performance hit um you know I'll show you real quick let me make sure there's nothing critical on my screen here we go so yeah I got this beautiful just look at all those cores purring away I got VMS running barely taking a hit on
52:13 performance nine gigs of RAM out of 62 being used I'm just so happy with this it's just uh real nice and because of that we're able to do this kind of uh research um where in the past you know the Macs are okay the max performed really well but you could generally only run about two three VMS before the thing starts becoming slow and dragging its feet um so yeah we got that where each uh each pen tester has one of these laptops and a Macbook also so we can do plenty of virtualization also nice for customers environments because we're not you know learning on your systems like some other companies that I won't name uh may do will actually install you know a Windows Server 2012 R2 or I'll install
52:58 Windows Server 2019 and I'll start throwing um my tax at it before I actually go on to a company's Network that way I can say hey I will or I will not do this attack because I know from actual real life experience that it is either a good attack to do or not to do so that's um just some of the stuff that's good to do in general um I think it's great that we're doing it um and that red team empowers us to get beefy computers to do all this fun stuff uh so going off of that um let's see I need to bring up the chat because I'll be asking questions for you to type into chat later and so now we're going to go through another fun scenario together and this
53:43 one is the malicious Insider and for those of you who can't who don't know or can't figure out from the name this is somebody on the inside of your network who either goes bad because they know they're going to be fired or they're upset with what's happening and they you know they want to extract some data and start their own competing business or they want to cause Havoc or they're one of my favorite cases was um one of the guys went and changed everybody's password and then quitting uh went and moved five states over without telling anybody so those are just some examples and we're going to go through together and figure out hey what can we do what would a malicious Insider think like how is that thinking different than a pen tester or an actual attacker and uh
54:28 you'll see some differences so um I set up my own active directory environments my username is Ian cider sounds like Insider I know I'm so clever um so let me get logged in oh yeah there someone's posting in the chat that um they also have service yeah we also have three servers we got four servers um so some of this is hosted on my laptop I got one to these are all my personal servers that are in my home office I deleted the work one because I didn't want you guys to see the uh I don't know we got 30 40 VMS running on our work servers that are doing different jobs but just the nice fact
55:16 that we can run fully interactive uh lab environments off of a laptop without needing to VPN in and connect to work servers is real nice so this is my own personal one that I I got off a Craigslist for a couple hundred bucks um I would recommend people if they're really into doing research and learning how to be a better it professional to pick up an old server and just spin it up and learn from that but do note that things can go wrong I recently just lost over a terabyte of hard drive space because I kept saying oh I'll properly set up raid I'll do that next month I'm too busy I'll do that next month and then I had a failure of two hard drives which cost me a whole weekend of my time getting things back up and running
56:02 so if you do set up your own home lab which I got running here on three servers with uh 12 cores 32 gigs of RAM each um in addition to my computer yeah do your research on what equipment you got um and get it set up correctly the first time instead of keep promising yourself that you'll do it correctly and then something bad happens so going back here we are now logged in as Ian cider we are on the corporate Network and we want to do something bad we are angry with our company our motivation is to find out everything we can about our Corporation because we've only been around for a year and we found out we're not getting a pay raise
56:48 and uh that the guy down um in our department is getting a giant pay raise so we're angry and we want to do something so I'm going to ask the group uh if you are an angry person inside of the company what would you do um I I have a little demo fired up that we're going to look at um but if you are an angry Insider and I know there's about a a minute to two minute delay from the chat just from what I've been judging from people typing um and what John was saying earlier so I'll just keep filling time and give you guys uh so go to that chat and zoom and uh put put on your your black hat uh the term for a malicious actor so put put on your black hat and if you were
57:34 bad what would you do on this computer on this computer that we're looking at right now hoping we'll get some responses soon so how much access do they have that is actually a great starting point so generally if you want to do something malicious you want to see what level of access you have and where you can get to on the network oh here now we got answers coming in great send ransomware to encrypt the disk great answer because you will in fact have access to the whole uh internal email system and you can send emails as a trusted individual
58:20 somebody else put in the shutdown command to shut down essentially all the computers that you have access to another great one uh actually I like that one we might actually try that in this demo um so yeah someone else is uh yeah determine a goal or what kind of access you have uh so yeah that's actually where we're gonna start um and we need to figure out what access do we have oh this is the wrong command prompt we'll look at that later I also have a fun um antivirus bypass combined into a application whitelisting bypass in one so you get a little two for one um except it may or may not work there is actually a patch that just came out for it
59:07 um so let's let's take a look first and uh user is probably going to say hey what do I have access to on this network are there any file shares um I'm actually currently on a flat Network right now because of a failure of Enterprise networking equipment um I actually was having fun and I hacked my own router earlier and took it down which was serving DHCP so uh hack whatever you want but just remember that if you break it you get to fix it if it's your home network and I learned that one the fun way oh I it actually gives me another fun point to share so if anybody wants an old switch I have too many of them and if you live within the Minneapolis-St Paul area I will give you as many switches as you can carry so please take switches off my hands I
59:54 have I have too many um so yeah the first thing we're going to do is we're going to look around for Access so we see there's this test net 2019 DC server and we got some shared files work files oh and what are we going to do um this is still existing from what I tested before we're going to upload malicious files onto the workshare um why is that a lot of times work Shares are only scanned at the beginning of the day so if you or that's the policy for this environment so if you put the malicious files in in this case I put in Bloodhound which John went over earlier I put in Mimi cats which John also talked about earlier
1:00:40 um and I put in some Shell Code and uh oftentimes unless you're running active well it depends on your security posture and how you're running your antivirus scans configured in your environment um this is actually on a domain controller and it's set to scan once a day so we drop it in the middle of the day we're good so um as a recommendation what do I recommend I'm guessing you guys can guess have some sort of active scan always going as soon as somebody puts a file on there check it make sure somebody did not just drop in Bloodhound or Mimi cats into the file share um actually I'm in this case I also turned off the scanning just so I could show you guys I'm going to show you guys a before and after of what actually
1:01:26 happens and what gets picked up because you I bet you're gonna think shell code is going to pick up going to get picked up well we're going to do this together and we're going to find out so we also have somebody else commenting uh before doing anything we can disable any kind of uh logs that would be good um we in fact can do that a little bit further down the line or when I get further down this attack chain uh but right now we don't have that ability yet so our malicious Insider they want to do uh some password spraying so they went home and they Googled how do I hack my company and they've they've found on some form and somebody just said we'll do password
1:02:12 spring duh and this person goes well I don't know what password spraying is but I can Google password spring which is exactly what they did um this is a good attack pretty simple to do and it's something that a low privileged user can usually get away with and possibly go unnoticed so uh read about protecting no they just they what they did is they this YouTube video and they watched a two-minute demo of what to do so then they go out and uh let's see I do have anti-virus running so we're going to see if this works because this is active and this downloaded new updates uh today so I want everybody that's
1:02:58 watching right now to please pray to the demo gods or what your god of choice that this will in fact work so we're going to go and we're going to download this we're going to save it open the folder antivirus is still running we're going to extract all right no files have been deleted no need for antivirus bypassing yet so now this person needs to know what to do so they they go back and they so there's a this middle of the interest to learn more about this Tool uh this is the creator of this tool talking about the tool that he created how I created it how to use it how to protect against it um so if you are interested there's a
1:03:44 whole 10 minute video instead of a two minute demo um out there and so what that says is in order to do this attack you start Powershell and so Powershell is allowed right now I would recommend for a fix to this is that you do some sort of application white listing uh there's a free one built into Windows called app Locker where you can go and make policies and Define what programs can and cannot be run I'm actually running app Blocker in audit mode I believe let's find out let's hop on my domain controller and I'll show you guys some of the behind the scenes so for those of you who don't know the domain controller is like the whole brains of the active directory
1:04:30 environment uh and here in the brains of it we can make I'll show you a so this is the behind the scenes this is what our user wants to find or as a user wants to find this list of users our user wants to find what groups exist full-time employees it admins another branch um they want to find what computers are in here they want to find what domain controllers so if they could get control of this computer they could get control of the whole brains of the operation um and so that might be one of their goals it doesn't have to be but it could be one of them
1:05:16 uh so I have some group policies in here and what a group policy is it's kind of just a well it's kind of like what it sounds like it's a policy for a group of users or computers within the system to do something and so I named this one block programs with app blocker GPO um you know generate what it's doing so if I scroll down thank you it'll essentially say hey here's the policy of rules uh for programs that are allowed to be run and then you would have to go through and with a fine-tooth comb go through and make sure all the executables that
1:06:01 you want to run on your domain are in their um I made a corporate software installed GPO to install some software um I made a disabled Powershell this one is not running yet but I can enable this GPO and then show you guys what would actually happen depending if we have enough time and if that's something you're interested in again this is going to be some audience participation so we'll get to see what we want so now we need to load our password spring uh so we're going to change directories into here and now we have on this line our domain
1:06:49 password spray program uh but you may be asking well how do we use that well we had this lovely command called import module and what this does it's going to take this domain password spray module and load it into memory and then we're going to cross our fingers and see if it gets picked up by antivirus oh it didn't but we have something else that happened uh oh and so it says it cannot be loaded because scripts are disabled on this system for more information see execution policies at this link so our user is now upset they still want to use this but they don't know exactly what to do so they're going to say
1:07:37 they're just going to grab this I'm going to go out to Google and oftentimes this is exactly how we do our research we run into an error message and we either do a brute force of make small change and then re redeploy or do it again or we just go ahead and see what it says um and so if you actually read through here um it'll actually eventually show you how to bypass this so we're going to run so our user Now using malicious Insider wants to know what to do he's doing some research and he says get execution policy oh it's restricted okay
1:08:26 um eventually if they keep reading more and more I'm not going to show you guys five pages of Google links but eventually they'll get to that command and now we've just loaded Powershell inside of Powershell and we're going to try this again this may or may not work oh would you look at that so it ends up if you um if you just take that much information and you Google it there'll be people out there who will tell you yeah you can set your policy to unrestricted or better yet this is actually what we did we did Powershell knob for no profile Dash execution policy bypass and then we ran our script
1:09:11 so uh thank you stack users on stack exchange you just showed us how to hack into our company and to see that it's loaded type A git module and up here we can see that we have loaded a script into memory and again we have antivirus running no need to bypass yet because nothing's happened so then our Insider they're not exactly sure what to do they watch that video they just come back here and oh would you look at that there's just a command that you can just copy in here and it's going to do something great for you so a attacker with not much skill other than the power of Google
1:09:57 May nope I have to copy it again they'll go in here and uh they know the name of their domain testnet.local so they're gonna get domain user list and if you read the instructions it's gonna do what it says it's gonna get a list of users in the domain and we're going to remove disabled accounts and removed potential lockouts and this second part is very important because they don't want to get caught so this will actually look at one of the properties in active directory and one of the properties is uh amount of failed login attempts and it'll compare the
1:10:43 amount of failed login attempts to the total amount of login attempts that a user is granted before being locked out and if those numbers are too close it won't add them to the user list because it doesn't want to lock any accounts out because that could you know tip somebody off that this user Ian cider is trying to do something so once we generate our username or our user list we're going to pipe this to an out Dash file we're going to encode it with ASCII we're just going to call it userlist.txt so sure enough it tells us what it's doing this is great for somebody that doesn't have a lot of knowledge it says it's creating a list of users to spray there appears to be no lockout policy oh maybe they want to fix that removing disabled users there's 13 total
1:11:30 users removing um user within one attempt of locking out from the list so then we got a final list of 12 users and we see that we have this user list now and if you remember before for me uh showing you the behind the scenes this list is pretty much uh what is what we saw on the domain controller minus one account that was close to its lockout attempts so now this malicious Insider has a a list of potential users to attack and if you're looking at this they're probably going to want the administrator that sounds good or they may want help desk admin or help desk because they know that help desk
1:12:17 can change passwords and help desk admin can do whatever they want so now they go back and they want to do invoke domain password spray so this is the important part of it and so again they're probably not very skilled they're just going to copy and paste sorry the copy and paste on Powershell leaves a lot to be desired oh darn it didn't work they just copied and pasted and didn't pay attention to what they were doing and why didn't it work well they gave it a password list but we don't have a password list
1:13:04 and put in the wrong domain name and our list was actually called uh user list so now this should work they're going to do invoke domain password spray with a user list that was generated they're going to correctly type the name of the domain all right and they're going to put it to an out file called sprayed creds and now we need some audience participation they need a password to guess the one that was suggested in here a spring 2017. uh
1:13:49 so we'll give that a shot and while I'm trying this right now um I want everybody that's watching to think of a possible password to guess and then I want you to type it into the chat and we'll try a couple of these passwords and we'll see what results we get so I'm going to try spring 2017 maybe that'll work somebody else suggested password01 Cobra 2020 socks that's good oh we actually we got some real good ones in here oh
1:14:55 there we go all right we got a we got a bunch of good ones so we're going to give some of these a shot I'm actually going to exclude the domain and I'm going to try oh all right so it tried all of our users all passwords that were successfully sprayed have been uh put in the output file oh there is no um
1:15:41 there's no creds one file so that means that we didn't get any users so let me go and scroll up we'll try this again but we have to remember we only get a couple attempts before we start locking accounts out so we have to be very careful so I'm going to try another one and copy and paste doesn't work into the virtual machine I just realized password 01 again let's let's see if we got any results
1:16:26 nothing yet all right I'm going to do one more So currently um if you remember back from actually John's demo he had uh Jonah was you had a user that had summer 2020 is that correct yeah I did I think you said yes um but in this in this domain they have to have a special character so we're going to try summer 2020 exclamation mark oh would you look at that we just got a couple users uh because this is in fact a common uh password uh output where uh we didn't get summer or in this case summer 2020 wouldn't have worked summer
1:17:13 2020 exclamation mark works it's a very common tactic that we'll do where we will put um uh an exclamation mark at the end of any password that we try because we know that users want to create easy to remember passwords and we also know that their administrators are making them put in special characters and so what are those people going to do they're going to put that password right at the end so there I recommend that if you have an exclamation mark at the end of your password if you want to make my job harder uh use either a different special character or put it somewhere else um let's see I'm gonna grab one other password all my passwords yeah if this is currently your password I also recommend changing that
1:17:59 um so I'm going to do one more just because I want to see let's see what happens oh I'm going to hit no because I need to do creds too so uh this user can keep trying this over and over but uh most attackers and especially Insider threats they're going to take the path of least resistance whatever is easiest for them to do is exactly what they're going to do oh and I just realized that my text on
1:18:45 this screen is incredibly tiny I am sorry about that you guys um can I make this bigger for me it's great because I have giant monitors uh but if you don't have giant monitors to watch this on as you can tell I don't spend a lot of time on Windows 10. except for exploitation this looks oh wow that's bigger can everybody see that better definitely okay Let's uh make stuff bigger there we go I'm sorry everybody I hope you can still read that
1:19:31 there hopefully you can see this uh I'll put a little bit better I think I can go in and uh properties fonts let's go up to size 20. oh that's big but there we go I know we had at least okay so hopefully that's readable now um so yeah just to show again now with actually readable text on the presentation we ran the domain password spring it tells us what it is it tells us where the success is and look at this help desk admin so now our user has these credentials plus their credentials they have one that's an
1:20:17 admin they want to figure out what can this admin do um so I'm going to ask you guys does anybody know of an easy way to figure out what permissions an account has I'll give you a hint you would probably just Google it and it might just show up and tell you net account uh yes we got we got some answers get 80 member yes we got some Powershell answers also um so there's several ways that you can do this there's I can think of at least five um I don't think I have the 80 module
1:21:03 loaded I'd have to install that uh net users so net users tells us the local users when somebody else dropped in the name of another tool so our person is semi-skilled let's say they've been doing their research they now have passwords and they're getting better at uh using the computer um so they're going to use another tool they're going to use a Microsoft tool
1:21:48 this one's called active directory Explorer by Microsoft Microsoft and so again they're going to use this to figure out what they can do so they're going to download ad Explorer my screen might be too big now and they just like running everything oh we need to Strack to extract all these first because it's in a zip file they're just going to go and click this program and we're going to see what happens they're going to connect to um so you're going to type in
1:22:34 thank you we're going to see if this works we now have helped us admin and their password and we're actually going to get an error message back because connect 2 wasn't expecting the domain name or was it expecting the actual active directory server I was expecting the active directory server oh and now it's not responding oh wow okay so this resolved it for us this actually picked the closest active directory server so I have two I am in this instance I have a Windows 2012
1:23:20 server in 2019 um they're synced up so it connected us to the 2012 server so now what do we have in here oh this looks like all that behind the scenes stuff I was showing you guys earlier and in fact it is we got Joe Doe and here's all the properties and information about them we that we can gather uh with these information we can do other types of attacks but they just want to look around and see hey what can what can these different uh accounts do so help desk admin is the one that we got anything interesting what's this members of oh they're members of domain admins uh so they're they're gonna go out and say hey
1:24:11 like all good hackers they use Bing I realize I'm uh getting pushed for time so I'm gonna I may have to speed this up and not go through all the Insider scenarios so essentially they're going to say what can I do as a domain atom and it'll show you a list of different uh activities you can actually perform as a domain admin that you're supposed to do but we're going to keep looking uh and the one I want to show you is there's also SQL server and as they're scrolling through the SQL Server each one of these actually has a field called description uh krb TGT is a very
1:24:57 important one it's the key distribution center service count this is the account that helps do the Kerberos authentication which can be a whole two hour presentation in and of itself we're not going to dive we're going to we're going to talk about this a little bit I'm going to do a little bit of an attack on it but um that may be a whole other webinar but wait what's the description for sql1 oh the description in here is password is my password one two three pound so this in fact because oftentimes people will put notes into the description this has actually been found on actual pen tests where they have more than 12 users they have something around the lines of 8 000 to 20 000 users and somebody five years ago put a little note in the description of what the
1:25:43 password was or a password reminder in the description they didn't realize that this is actually viewable by most people and uh so I'm going to connect as our username Insider and we're going to see what different information we can see so I'm going to close this one so this is actually logged in as our normal user
1:26:29 account
…
