[Music]
all right guys 9:30 so welcome to the
last presentation of the night this is
hotter not offensive security Edition
after dark right okay thanks for taking
some time out to join me I know a few of
you were probably over at that mad SEC
Meetup so I saw a few of you over there
that's where I came from too but thanks
for coming for a technical talk here at
9:30 at night who am I my name is Travis
I am a security consultant senior
security consultant with trusted SE I
see a few of my peers down this way here
um I'm also a creator of dad jokes I am
the husband to a wife we live over in
Madison area just north of inwan I got
three kids and we thought life was easy
enough so we just got a six-month old
puppy on the side too so life is is busy
but when um I'm at my day job I'm doing
offensive security engagements it's
going to be internal pen testing
external pen testing dabble and
adversary Sim simulations red teams
things like that but really trusted SE
does everything under the sun security
related when I'm not working um things I
enjoy are tinkering with electronic
devices um just last year at cyphercon I
built a Ghostbusters proton pack that
did a bunch of Wi-Fi hacks built in I
don't know if any of you guys saw that
talk um that was a fun one and actually
this year I got a one to one movie scale
replica goes us this proton pack so I've
been using Arduino devices to make it do
a bunch of cool fun things and learning
Hardware hacking that way um also I
dabble in ham radio so I'm a general
license holder W9 Hax is my handle my
call sign and uh I do a DMR um and
actually tomorrow there's some severe
weather sparking up in the area so we'll
have some of the uh uh Midwest storm
spotters jumping in hopefully and making
things interesting and then lastly uh I
know I just played Preston next door I'm
an avid Mortal Kombat player they got
Mortal Kombat 2 next next door so if
anyone wants to challenge or duel I'll
duel you right so what are we going to
do today we're going to talk about um uh
talk about things in a collaborative
manner I'm I'm more of a presentation by
um participation type of person so we're
going to do this in a game show format
Has anyone used the software cahoot in
the past right probably in the
Enterprise a few hands yeah so that's
what we're going to be using to kind of
Li pull the audience kind of bring you
guys in because there are no right or
wrong answers on what we're doing today
kind of want to see where you guys F in
to things um we're going to focus on
offensive tactics techniques procedures
so things that uh maybe some blue
teamers might not be as familiar with um
and we'll kind of get a poll of the
audience of who do who does what are you
red team are you blue team are you mixed
team um and what we're looking to do is
find things that maybe traditional
vulnerability scanners won't find and
bring your attention to those and really
I don't know what are those things
hopefully you the audience will help you
decide what those things are today and
lastly we're going to have some fun I
try not to take take myself too
seriously so let talk 9 :30 at night
it's a good fit so first thing we're
going to do go ahead scan the QR code
this going to bring you to hotter not
that's going to be where you register
and uh get in the queue we can go ahead
and play the game so let me know I'll
get a show hands once everyone's ready
ready to
go is that working for
anyone I
it'sing not working
[Music]
what's
working not working
okay how about this code that code was a
Rick Roll so maybe that was all right
you got the Rick Roll that if one person
got it that's that's good enough but no
this is the real code try that one does
that one work for
anyone
if not yeah you can go to Kai cahoot.com
and enter in the
52039 that's right it
is and we'll just give it a second let a
few others if they want to register and
get creative with the name have fun the
points don't matter every all the values
are made up so really we're just going
to kind of have fun with
it I don't know if I was dating myself
with that Meme reference that's kind of
an older one but that's a good one all
right all right I'm just going to check
here see who's all getting into the
queue so we got got a handful here 19
people few more want in or I'll give it
up for another minute or
so few more popping in and then we'll
get
going cool see a few more people with
their phones up
so and again if the QR code is not
working go to cahoot.com and enter in
the
5239 all right I think everyone's good
if we're ready to go let's see we have a
total
of roughly 30 2 people that's awesome
yeah it's great I think it's capped at
50 so we don't have a whole lot more
ceiling but Casey do you want in go
ahead and scan the code if you
do all
right okay so we'll go ahead and get
started
so thanks for joining so the first
question I'm going to ask is I'm going
to ask it be a cahoot but I'm going to
ask the audience I want to kind of get a
poll what it is or do you know a thing
or two about a thing or two so first
question let me pull up cahoot I'm going
to start this game here here
cool all
right two one countdown all right
start okay pull so there's no right or
wrong answers you can do a multi select
here but what is it you do here you have
like 30 seconds to answer on your phone
um are you an offensive tester by
offensive tester I mean do you use imp
packet daily do you know the switches do
you know what all the things do if not
are you a blue teamer are you a Defender
do
you third option do you maybe dabble in
both worlds you've maybe installed klie
in the past but don't really use it very
much kind of where are you guys uh
ranking on things and other options this
is all new to me I don't know what imp
packet is at all go and pull cool got 27
answers got a few more out
there awesome so okay we dabble in both
worlds we're kind of split in the blue
team red team that's awesome and nine of
you this is all new to me so that's cool
I'm kind of gearing this talk more
towards the people that dabble in both
worlds and people that this is all new
to and actually the blue teamers too so
I'm actually glad there's only eight of
you red teamer cuz this is going to be a
recap for you guys I'm looking at you
guys down here um awesome cool let me uh
pull up the slide back here and I only
got like a 100 slides to go through so
it really won't take too long tonight um
so first thing is we're going to take
this from an external perspective we're
going to work from the outside inside
cuz that's how an attacker works so
first thing we do and this has been done
since the you know early days is a
passage spraying but we have a different
approach at how we do this what is a
passage spray well don't you mean Brute
Force attack Travis I don't really mean
Brute Force attack because Brute Force
you're just hammering on things right
what happens when you hammer on things
you lock out accounts so passord
spraying is kind of a new way to
approach account springing so what we'll
do is we'll go at beginning of of an
engagement we'll go on sites like
LinkedIn or you know the the homepage of
your company they're about us their
company directories their leadership
page we'll figure out who works to the
company first names last names it
doesn't really matter we just kind of
merge it all together figure out the
email address format then we find an
authentication Point things like Outlook
web access things like Microsoft 0365
for example and we're going to take that
we're going to try to log in with all
those usernames we just identified all
those emails and we'll try to log in
with weak common known passwords things
like Seasons things like years spring
2023 winter 2022 exclamation point right
and more times than not we might hit one
right
well that's that's called a password
spring attack and actually the tool that
I'm going to show here is a tool that
one of our teammates wrote his name is
uh Melvin langik from my team and he
wrote this tool called team filtration
it's kind of neat on how it works is
because it uses the Microsoft teams API
to go through figure out whether an
account is valid or not we can
essentially Supply a domain enumerate
valid accounts and then it's all built
on database logic so it manages your
password sprays it knows when's the last
time you spray that account so you can
sleep 60 seconds before you spray it
again so you're not going to lock them
out so team filtration that's a really
cool passive spraying technique and just
in general passord spring something
we're going to do on nearly every
engagement and I'm going to give you
three of it and then you can kind of
rank them in the hotter not version or
in the in the game next say we don't get
in with the passard spray how else do we
get in well another common technique is
a credential harvesting attack there are
many Frameworks out there that do
credential harvesting one of our
favorite is a framework called Go Fish
who in the room has used goish in the
past I see some hands a few of you so
goish is um is a great framework it
allows you to use templated emails
landing pages to make things really easy
and um what we're doing here is you saw
the user entering credentials into a
simple a bootstrap web form when the
users are when the user credentials are
submitted they click login they go to
wherever we send them to we can redirect
that traffic in the meantime on the
framework side what you're seeing right
now is goish it's kind of a cool
framework it gives you all the results
you can go through you can see that that
User submitted data get the username
password and use it that's pretty cool
it's one of our favorite ways of fishing
because you're not delivering any kind
of maware or whatnot now that said one
thing one downfall of goish is you only
get the username and password and
nowadays everyone's using multiactor
right right all the companies are using
multifactor right so what can we do
against multiactor things like token
harvesting so there's another framework
out there that's three of them now that
exist uh this one is called evil Jinx
evil Jinx is great cuz it kind of does
all those things that goish was was
doing we still here user submits
username password which you just saw the
user submit then they get prompted for
that push code in the meantime in the
terminal here we have already harvested
that username and password well evil
Jinx allows us to use a proxy a
combination of Apache and engine X to
proxy that traffic we broker that
authentication and you see they still go
through that push notification they get
the prompt everything goes the way they
think it should go and then you'll see
right at the bottom right hand corner of
your screen real quickly here you're
going to see that a session cookie comes
in let's see when it happens here user
gets redirected okay session or all
authorization tokens have been
intercepted normally you see a 403 that
user normally logs in seamlessly they
are now logged into their account in the
meantime you've harvested a session
cookie what you can do is you can export
it it's a Json blob you can then take it
import it into your browser refresh your
browser guess what you are logged in
with an active session on behalf of that
user you essentially intercept their
username their password not their MFA
token but they've done that part for you
and you've gotten the session cookie in
return so very powerful attack
technique and that's called engine X so
what I'm going to do that's a pretty
cool meme I like that you're fishing
attack going in with the pizza and you
hit them with the spoon baby food I I
got out of the dad year so that's very
relevant to
me okay so on your phones again turn on
your phones next question is what's hot
what's not again no wrong answers you
can multiply select let me go into it
another
Poll for your fishing what would you
prefer what do you prefer what do you
use do you use password sprays do you
use credential harvesting token
harvesting or lastly malware delivery
that's that's tough nowadays right
malware delivery who's Landing c2s
nowadays sprocket
anybody got some answers popping in
here
let's see where everyone
ranks yes
[Music]
question
no yeah AAG against so these are all
attacks from the outside coming in so a
lot of what we do at trust SEC and a lot
of other firms are we're going to play
the role of the bad guys so we're we're
not in the company at all these are all
external attacks we're fishing in we're
trying to break the perimeter
essentially okay I
think let's see how do I push forward I
think it's got to just time out here
cool credential harvesting so a lot of
you pick credential harvesting some of
you guys are doing token harvesting
that's pretty cool show hands who's
doing token token harvesting out here
few you guys so you use the engine X
yeah evil engine X um one thing neat
about malware delivery there's a there's
six of you guys that have done that I
just had I came off at a successful I
was on I was on it since February and um
everyone knows that sending in a payload
is hard nowadays but we just had one
where we actually come I did a
combination of token I'm sorry
credential harvesting we sent out the
fish I actually use chat GPT to generate
the pretext of the email super easy just
be like send me an email that tricks
someone in or not tricks but send me an
email for a secure email notification
chat GPT did all the work copy past it
into an email template sent it out uh
user clicks on it they get get presented
with like what looks like an OCTA login
page they submit their username password
they click login and they get generate
or they get presented in HTA file secur
message. HTA to download well 90% of
users are going to download that not
thinking anything of it open that HTA
and execute some malicious macros in the
background we had four command and
control sessions call back from that
payload I'm like I haven't had that
since 2008 those were the good old days
um and you're thinking to it in the
minds of an attacker well how did that
work how did you bypass things well
there was nothing malicious in the email
the link actually linked to an Azure
blob that served the HTA that's probably
a trusted web category for them and it
was and then from there it was just
bypassing AV and getting in so yeah uh
kind of fun it's still out there
nowadays even though I thought it was
dead
cool so that was fishing next assume now
we're we're not on the external side
anymore we're on the internal side who's
done Network poisoning attacks yeah net
bies llr yeah so how that that works if
anyone doesn't know is uh a protocol say
a computer looks up a a a host name
account file server01 for example how
that works is if it if DNS isn't there
it's going to fail DNS or I'm sorry the
local host file if there's not a local
host entry it's going to fail it's going
to go to DNS say hey DNS server do you
know how to get the file1 if DNS isn't
populated or if they're having a problem
communicating with
DNS it's going to then go to net bios
the way net bios works is uh there's a
broadcast that goes out on the local
subnet and we all talk about subnets and
you know segmenting subnets and making
things smaller well this is the reason
why if the broadcast domain is large an
attacker could be sitting on that
broadcast domain an a query will go out
being like hey who has file server01 we
as the attacker can be like I'm file
server01 we see the beacon come through
or the request come through we're going
to respond to it we respond and that
machine says Hey I want to authenticate
to you apparently here is my hash here's
my password hash we take it we can then
use it we can relay it we can crack it
we'll go into that a little bit more
well what does that attack look like
who's who in this rooms use responders
show hands responder few okay I thought
there'd be a few more that have used
responder in the past responder is a
great way to kind of automate and listen
for those broadcast come through we can
selectively then um poison what we want
to and you'll see that coming here right
now so I have responder listening I'm on
my uh victim machine right now all
they're going to do is browse for a file
share file1 for example or file server1
respond sees that on the attacker
machine we see that one host created for
file1 we as the attacker we replied to
it and we said okay Angela Moss Right
From Evil Corp who's seen Mr Robot
everybody should have their hands up
here right now um so Angela Moss has
sent us uh an authentication we see the
password hash come through we can then
take that we can relay it we can crack
it move on with it so we essentially
have domain credentials at that point or
domain user access so that's um uh net
bios name spoofing another attack that
we've been using as attackers is IPv6
cool thing about IPv6 is the windows
stack by default now has IPv6 enabled
probably not using it but it's out there
it's enabled so we as an attacker know
that and the neat thing about IPv6 as
well is it takes priority over ipv4 so
we as a bad guy will spin up a IPv6 DHCP
server issue out IPv6 base addresses
those machines will bind to it and now
all of a sudden that traffic's being
routed through us the attacker it's kind
of a a cool way to become man in the
middle right um don't really have a live
demo for that one but you can kind of
see how that attack works out
here so let me again whoop let go back
here I'm going too far ahead let me pull
the
audience so pull out your phones again
get ready
anticipation a multi- select question
Network poisoning attacks what do you
prefer I got a few options are you a net
bios fan do you like using responder
what is that still hot or is that dried
up in your environment I'm kind of
curious IPv6 is that cool still
effective or are you a crazy man and
still use art poisoning and crash
everything yeah or do you have another
other and if you have another I'm going
to call on
you got
few yeah we do see it on occasion um nor
the longer you run the more problems
come into we've seen I want to say
Justin if you're if you know uh with
teams right with teams uh automation
like go break the team's communication
so there are definitely a few nuances
you want to be careful with it
[Music]
yeah yeah normally just to kind of
capture what you need to and and so if
anything it might be a hiccup on the
network but I guess that comes with any
poisoning technique is you're bound to
maybe break something and even with
responder there probably is some archaic
thing that's realiz in upon that bios
and if you break that communication it
could yeah affect things but you try to
have that minimal impact on on users
okay I think we're all picked oh there's
a lot of you guys that picked other but
a lot of you guys are using responder
same thing you would think that attack's
been out what since 2010 2011 or so it's
but it's still out there it's still not
dried up we go into Enterprises new ones
every day and we're still seeing that
attack out there it's amazing even
mature clients still fall victim to net
bios attacks um IPv6 yeah it's still out
there as well until until a client's
gone through the cycle of a test a few
times normally that's going to be a new
one for them um ARP you got you all
crazy seven yeah and then other so show
hands who who who did other I just want
to pick on one of you other than Justin
who else you're not seven people right
there someone else picked other there
who I'm no
one what what do you prefer smv relay
SMB relay we're going to cover that one
yeah right on cool yeah that's a good
one that's a good one yeah Justin what
else do you use for your man in the
okay right on cool cool all right so
next um jumping out of uh Network
poisoning attacks go
this wh is Windows 2000 accounts is that
hot is that not and I'm actually going
to quiz you on this one before I go into
it so let me let me pause this I'm going
to poll the audience Windows 2000
Windows 2000 pre-2000 accounts is that
hot or not
sh no spoilers
Justin there are no wrong answers the
points don't matter everything the
totals are made up you ever see who Line
Is It
Anyway so we got 25 answers
por so let this one time out here
oh gee there is still 20 seconds left so
I know most of you guys that have
answered you can always change your
answer so a member from our team uh
avvar Mo did a lot of research on
Windows Windows 2000 accounts and he
came from an era where he was assist
admin during this time and he remembered
a check box that said assign this
computer the pre-2000 computer account
what that meant is that a lot of times
when machines were being joined to a
domain or administrator was doing things
oh man split right down the middle 14 15
cool um so when you were joining a
domain back in the day often times you
wouldn't join it right away or maybe the
machine was inactive so you create this
computer account and you would join it
later on well in order to to do so they
would name the or name the computer
account and the password be would be the
same as the computer name just in
lowercase so workstation 01 would be
lowercase workstation 01 that's how
things were done so we can go into an
organization now and scan for these
accounts there's actually ldap PL you
can search for and find let me and find
which accounts have U Windows 2000
accounts and I'll tell you Justin will
tell you too they're out there and what
happens when you get a computer account
you now have a domain foothold right and
um so here's an example of setting up
that account you can see where you
assign that uh pre-2000 computer account
check box and uh there's an individual
that took the research of adbar and put
it into his own tooling called pre- 2K
Garrett Foster and uh he cre created a
great script that you can run either
unauthenticated or authenticated in the
authenticated mode you can live query L
app to figure out who all the user uh
who all the accounts are or if you were
unoff you could do like a DNS scan dump
all those machine account names and then
go ahead and run it and all all is doing
is uh testing the account the computer
name and testing the password being the
same as a computer name just all
lowercase and you can kind of see that
being run right here where workstation
02 was workstation 02 and Workstation 6
was workstation 06 lowercase it's a
great way to kind of um find that domain
foothold if you're struggling for it I
can't tell you how many times every all
my other avenues have dried up I'll run
pre- 2K and boom we have a foothold on
the domain so something to keep in mind
especially if your domain's a little
older if your company's a little older
it's been established since
pre-2000 look for
these okay next SMB relaying right so I
I talked earlier about some of those uh
um man- in-the middle techniques the
responders where you can harvest the
hash you can take them offline you can
crack them well for say example they
don't crack you don't have a Justin on
your team that's a cracking wizard you
can take them you can relay them and
that's kind of a neat thing um who who
here is doing like vulnerability scans
Nessa scans in the organization probably
should be everyone right you got y'all
are probably patching the criticals you
probably patching the highs are you
really concerned about the mediums not
as much right well this finding here is
SMD signing that's a medium severity
finding so often times this goes under
the radar
and I can't tell you how many times they
come to an organization on year one year
two and we find that hosts do not have
SB signing enabled well what's the
impact of that we can take those
credentials we harvested earlier we can
relay to them so that's what this um
demonstration is going to show we'll set
up a um impacket script called ntlm
relay X we select a Target in this case
we're just targeting a a host we have it
up and listening SBS listening and then
we're going to um hit responder here go
to our go to our Target machine again
query for things like file1 just
generating some Network traffic here
we'll see file1 gets queried start run
file1 Co F1 so that's everyday Windows
traffic and you see down here file1 was
poisoned we poisoned it we see Tyler
wellik I'm sorry not Tyler Tyrell wellik
um logged in again that's a Mr Robot
reference for anyone that didn't know um
logged in from um 183 and we're going to
relay his connection to 82 and since Ty
Tyrell well is an administrator it
automatically dumped the the local Sam
administrator CS file and extracted the
hashes we can take those hashes we can
pass them around we can crack them we
can do cool things with them if they're
not using things like laps that might
get you the entire subnet administrator
access so that's a technique known as um
SMB relaying one thing neat is SB isn't
the only protocol you can relate to what
if they got SMB signing enabled are you
are you out of luck no it relate to
another protocol you could relate to SQL
you could relate to things like ldb lb's
great it doesn't give you maybe as much
as SB not administrative access over a
machine but again we're dealing with
ldap we could query the domain with
relayed credentials we could dump
extract give me everything there is to
know about the domain the users the
groups the memberships otherwise by
default Windows has the ability for
every domain user to create up to 10
machine accounts it's the machine
account quota by default that's 10 so if
they haven't changed that value we can
simply take that same activity we saw F
the query to F1 relay it to ldap against
the domain controller in this case ldaps
and then add a machine in this case
we're going to add a machine called demo
let's see that in action here so we're
targeting ldaps against their domain
controller we're going to add a computer
called demo same thing we're we're on
our host machine we're quering for file1
that traffic will come in we're loaded
the ldap module
here here comes the traffic coming in
from 182 and we're targeting 180 the
domain controller and we can see that uh
user Elliot Alderson he's just an
average domain user on the network not
privileged by any means had the ability
to create up to 10 machine accounts and
sure enough we have now a machine
created on the network called demo with
a password that we know and again once
we have that machine account we now have
actor directory access we can query we
can do things we can request service
principles our the whole playing field
has just increased dramatically because
now we have credentials for domain
account in this case a domain machine
account on the network so pretty
powerful stuff so let me pause there I
like that M just a lot of relaying
failures and ask you guys the audience
about relaying
attacks so what's hot what's not what do
you prefer what do you use I have SNB
what protocol ldap do you like to query
or do you like to relay to SQL or are
you a ticket relayer go ahead and
choose I quered it or I've relayed the
sequel a few times but never really had
much luck with it I think we were like a
non-domain join test machine or
something cool so yeah SMB is the big
one ldap I like ldap it's been growing
on me it's it's kind of a great way to
uh um
get that domain
foothold but SMB is the one that's going
to get you you know what you need to you
need to get a SMB shell on it you can
dump uh dump hashes things like that
cool go back to the talk
here okay next coion technique so this
is kind of a newer one who's heard of uh
the hippopotamus name p Pam yeah right
so the way this works is we're coarsing
domain controllers we can either do this
from an unauthenticated again or from an
authenticated perspective and the neat
thing with about it is um we're tricking
the domain controller into querying back
to us the attacker we're saying hey go
look up here we'll look for the EFS
system the encrypted file system and
we'll say hey query back the attacker
that machine then calls back to us and
provides us with an
authentication in the machine user
context so in this case if we're
targeting things like a domain
controller that domain controller is
authenticating back to us we can take
that we can relay it to other things
things like adcs which we'll cover in
just a minute let's look at what that
attack looks like in in the Gran schem
so again we have responder running this
is simply responder the only reason
we're running it here is to capture the
inbound handshake you could use other
protocols too um we're using corser
we're using again the domain user Elliot
Alderson real basic account we provide
our attacker machine IP and then our
domain controller we see all these um
EFS um requests come through sorry it
went by quick and then boom all of a
sudden Hive dco1 calls back to us we now
have the machine account password for
Hive dco1 now granted that's an ntlm
hash we we could crack that potentially
you're probably not going to crack a
machine account but more likely you
could take that you could relay it kind
of a neat coion technique something to
know about and the thing you could
relate it to are things like active
directory certificate Services who's
familiar with adcs right the red teamers
in the hand in the room should
definitely raise their hands so there's
a a various um degree of adcs exploits
like things like esc1 where we could
provide an alternative sand name or esc8
where where it provides well web
enrollment it we could take that that
hash that just came in and relate to web
Enrollment Services and then essentially
take over that machine let's take a look
at what adcs looks like in action so in
this case what we're going to do is
we're going to first find if any
certificate templates are out there
again this is certificate Services I'm
sorry for using acronyms sometimes I
forget in people know just assume people
know what these acronyms stand
for so we're using again Elliot Alderson
he's just an average domain user on the
network we could use any of those
machine accounts we just created again
once you have that domain foothold the
playing field really expands so we see
here that um Elliott was able to find 34
certificates enabled and we found one
here one template name named esc1 server
um we see that uh enroll en rolly Supply
subject is true and we see the manager
requires approval is false this is right
for an attack known as esc1 we can
supply the subject name so we can
essentially request using this
certificate template say hey we want a
different subject name as maybe
administrator or one of like Ty Tyrell
wellik one of the domain admins um
there's no approval needed so that's
what we're doing here right now is so we
go through we then use uh certify to
request that um use the template of esc1
we request the alternative name as
dco1 and sure enough we get a
certificate issued as dco1 we can use
that we can authenticate we can pull the
Nash and then we can take over do a d or
secret stump extract the domain
controller so that's kind of the gift
that's been keeping on given in since
2021 so cool who's used adcs attacks in
the past right cool awesome
awesome so let me um let me jump down
here I think I have a few more
questionss for you guys
phones so coion attacks we'll jump back
to corion real quick that was the petite
Pam and corser hot or not you guys using
it should be an easy one to
answer but if not like select like you
know I haven't ever used
it have you patched against it hot or
not
least we have some background filler
music coming in from over there again
the offer for Mortal Kombat is still on
the
table all right so yep there's a lot of
you guys like it Justin you're probably
one of the ones that don't like it um
yep corion tax I would agree that's
that's a hot attack and then uh next
question is regarding actor directory
certificate Services Hot or
Not spoiler that's super
hot we have a minute so we'll skip on
that one here but yeah the answer is
coming
in cool 17 yeah I would agree very hot
okay um next uh just kind of rounding
things out here last few slides is uh a
pass the hash attack so earlier on we
did this the SMB relay where we
extracted the local Sam accounts file so
in this case we're just taking one of
those hashes we can take it and we're
using the um the Walter peek so Walter
peek isn't a Mr Robot example who's
Walter peek from anyone know Walter peek
EPA Ghostbusters come on 84 Ghostbusters
no one I was hoping for someone get that
reference but anyway we're taking Walter
peek's account we're using a hash so in
this case we're not using a password
just using the hash spraying it around
on the local Subnet in this case the
entire uh 25.0 net take a look at what
that attack looks like and then where
I'm going with this is um what do you
prefer pass a hash attacks or are you
more into keros ticket attacks um
nowadays there's a whole lot more
detections based on pass the hash and I
feel like uh ticketing is kind of where
I'm leaning things but you can see here
we pass the hash he's not the
administrator and the domain controller
but he has admin on um the certificate
Authority and also on workstation 01 you
can denote that by the pwn but just kind
of shows especially for blue teamers
that you don't need the password to be
able to authenticate to a machine often
times we walk through an entire pentest
and not even get one password until the
very end once you have that hash just as
good as the
password and next I feel like this is
like one of the last ones here is
Kerberos so
less less pass the hash but it's kind of
neat to to pass the hash you have to get
the hash that can be tricky in some
situations you can request out to be
able to get the traffic to your box or
else you could do like a local Sam dump
or something but normally EDR is going
to try to prevent that activity from
happening um this goes back to an
engagement I was just on for a few weeks
whereas I landed as a domain use on a
few boxes we had four boxes that called
back from that fishing campaign we had
launched and we used something called a
TGT delegation and this is a beacon
object file so this is a memory resident
file that allows us to inject our code
into it and extract the um the current
user TGT ticket so essentially we have a
ticket now once we have that ticket we
can request things on behalf with that
ticket um kind of like a a hash in this
case so here it is where we're we're
receiving the user ticket we extracted
it and then from there we were using
that ticket um in a blood hound query to
extract the domain so in this case by
simply using and requesting the ticket
on behalf of the user I still don't know
their password don't have I don't know
their hash but I do have a ticket that's
normal users traffic I then use that
ticket request it with blood hound and
extract um 36,000 users 21,000 groups
gpos 1,000 containers computers 22,000
so we're just like getting all this
information from the domain just because
we we landed on a box as a user
essentially we have the rights add that
user so um I believe that's one of my
last questions on the cahoot is Hot or
Not what do you prefer do you prefer
passing the hash do you prefer ceros
authentication what other options do I
have here yeah so like the keros logo
with the three-headed dog is not
really
cool so we got most of the answers we
need here we'll go ahead and move
forward and um okay yeah I'd say it's
kind of like a multi slug here I use
both when needed um sometimes if you
want to be more stealthy I'd probably
lean towards the cerose tickets but yeah
I I agree kind of a split right down the
middle but uh anyway that's that's
everything I had planned for today
that's my talk so if you have any
questions you can reach out my name is
Travis W 9hx hit me on the Twitter um
you have any questions about Services
trust a sec but uh yeah thanks for
joining tonight enjoy your night go over
play me Mortal Kombat right
[Applause]
thanks