ERIC MILAM: How's it going?
First I want to say, holy shit, I'm speaking at DEF CON,
and it's an honor.
And second of all, holy shit, people showed up and that's
an honor as well.
I will talk to you about getting the goods with smbexec.
Some of you may know me as brav0hax.
I'm on the Accuvant LABS attack and pen team.
I'm involved with some open source projects
and maybe you have heard of Easy Creds and smbexec
and Ettercap, and we're involved with the Kali Linux.
We will go over what is smbexec and there's nothing 0day here.
But automation is awesome.
This is not that the sun and the moon have to align on a certain day.
It makes post exploitation much easier.
At least it has for me.
So what is smbexec?
It's a Bash script.
Everybody who knows me, knows I don't know how
to code for shit.
I'm very good with the Googles and I put a bunch
of shit together until works.
It's about 1500 lines and a million different functions.
Put it together in a week, about an hour's worth of time
and a year's worth of Mountain Due.
It relies on SMB client, and we have PAP system
for hash passing and that works as well.
Why would you need this?
We are on a bunch of pen tests and we realized that
the smbexec was getting popped.
And we threw it out to the community and basically
Mubix, wherever they are.
They found out real quick for us that basically what it was
triggering on was the injection and the service protection.
So, you know, fuck you turn micro, but thank you for the motivation.
After we ran into this, we found a blog post by Colonel Carnage
and that's where the script was born from.
So originally, right, we just wanted to get our shells.
We wanted our shells.
So we wrote it so it would create an obfuscated payload.
The newer versions, you can enable Hyperion and encrypt it
as well.
We also had it so it would create a metasploit rc file, and
if it doesn't recognize X is running, it will automatically launch
the attacks in the screen.
That's where it was at.
And then we started learning a little bit more about winexe.
We can run native Windows commands and there's a lot
of cool stuff we can probably end up doing.
I'm not a Windows guy and I went to Google and Google told me what
to do and we started realizing some of the great things we could do with it.
What we really wanted the tool to do is basically kind of go undetected
and just look like normal Windows, you know,
traffic or normal network traffic to our victims.
So winexe, I don't know if anybody is familiar with it.
I hope you guys are.
It's awesome.
It's similar to the system internal PSX I'm sorry,
and it has systems flag and it has an uninstall flag and I
will explain them in a little bit.
There's no quote/unquote payload necessary.
You can one winexe and just issue CMD and it will give you a shell back
from the victim community without executing a binary.
And it looks like normal windows traffic,
basically you are getting what they should end up seeing
is a successful log in over the network.
There's some caveats that I will discuss later that might be
red flags.
So if you can execute commands as system,
the possibilities are virtually limitless.
So you can dump hashes from workstations and server,
create volume shadow copy, run other tools as system, enable,
disable UAC, bypass it, you can also check systems
for DA/EA accounts logged in or running a process.
Is that some type of sign for me or I'm not fucking
with anybody!
You all know the drill.
What does every new speaker do?
AUDIENCE MEMBER: Drink!
ERIC MILAM: So I'm Mormon.
Not really.
(Laughter) I'm a recovering Mormon, so That's a good one.
Cheers!
Congratulations.
ERIC MILAM: Thank you.
(Applause) As you were.
Let's see him get back into it now.
ERIC MILAM: Oh, you can't hear me.
Okay.
I know.
All right.
Is this better?
AUDIENCE MEMBER: Yes.
ERIC MILAM: All right.
I apologize.
Okay.
So where were we at?
So basically we can execute shit as system, fuck it, we might as well.
Man, is that the alcohol or what?
(Laughter).
So we're like holy fuck, let's get some hashing right?
You know, old school way was to get the registry keys out and do it.
So fuck, let's automate that.
So we wrote smbexec to dump the hashes from work stations
and servers and what it basically does is runs Windows com regularsec.
And sys plus sam, and then we run it
through cred dump which converts it into the hashes and
the John format and then we have our high quality hash there as well.
So one of the other things that I was on a pen test, somebody brought
up to me was WCE, yes, I know about memi cats, the stuff that
they have done with minisploit.
I found this and it's awesome.
And WCE, basically with the minus w flag
will dump clear text passwords out of memory.
So it took me about five lines of code to code that in it.
It was super simple.
It runs automagically.
If you want to turn that off, you can.
You can comment out the code.
So smbexec, we're like, shit, let's get stuff
off the domain controller too while we're at it.
Again, I went to my friend Google and Google told me how to go
out and run everything from the command line
and so what this will actually do is it will log in over 445,
and create a volume shadow copy, and it will save off the NTDS.dit,
the sys key.
When it's done, it will clean up after itself.
It will delete stuff it does on shadow copy.
And I know there was a blog post in 2011 about this.
There was actually a blog post and forum post back in 2005
about doing this as well.
So it's been around for a while.
It's there.
Once everything is good, it runs NTDS extractor and Libby SDB
and gets the hashes out for you.
It creates a tab separated, cred list for you
for other functions within smbexec.
So let's go ahead and see a demo.
So I recorded the demo.
So fuck it, we'll do it live!
Okay.
Does that look all right to you guys?
All right.
So that's smbexec.
So first thing you are going to do, you are just going
to really quickly just do system enumeration, create a quick host list.
And basically what it's just doing is doing a quick Nmap scan
and it builds the list for you.
And then we'll go ahead and go into option three, which
is obtain hashes, work stations and servers.
Please provide the user name.
I'm just going to spit it out here.
This is Martin's password.
(Laughter).
So feel free, if you see pure hate anywhere,
that's how you log into his accounts.
Here's a local being, thanks to mimbix, it will give it a period or a dot, which
is how developers recognize local hosts.
And it recognizes that there was a host list created.
This takes a little bit of time, you will see, it's basically what it's doing
is it's going out and authenticating and logging
into the box and pulling down the registry keys.
And then when that's done, it will basically upload my
obfuscated WCE.
It does take a little bit.
Let he had hop over here and get this ready.
I'm just getting rid of some of this stuff here that I know comes
out of it, and then sort.
Can everybody see that?
I made the font super big so okay.
Cool.
AUDIENCE MEMBER: It's a little hard from the back.
ERIC MILAM: I'm a little hard up here,
but (Laughter) ERIC MILAM: But I try.
Is that a red card?
Okay.
So there we go, right/so basically, it's pretty much done.
There's local hashes.
I want to give a shout out to Royce Davis on our team,
who updated our team and took Carlos' cash grab and redid it so it's actually
a work standalone and it does include vista and non vista versions
and then here's what I love the most, if I could spell right.
Boom, clear text passwords, right?
So if you look at that, that's 20 characters.
I mean, you are not going to crack that shit.
There's no way.
So it's awesome that, you know, you can just get out of there.
So here's one here, top dog, brav0hax.
So let's go off the domain controller.
Go after the domain controller.
I'm going to authenticate as top dog.
This was Martin's old password.
And then I know that the domain controller, of course, is this,
but, you know, there's simple dit commands that you
can look up and find it.
It asks you for the path to the NTDS.dit.
You can put any path or any drive.
Oh!
Oh, wait a second.
It helps if I give it the correct IP address.
Okay.
Found the NTDS.dit and now it says where do you want
to save this stuff off to.
You can give it a different path.
So it checks to make sure that the path provided actually exists
and it checks to make sure that there's disk space
and creates the volume shadow copy
and copies them off to your machine and it deletes
the files that were created and removes
the volume shadow copy that it was created and then it runs Libya ESDB
to extract it and it gets the hashes out.
And you can see it's running there.
It takes a little bit.
Dramatic pause here and then success.
It looks like what we got what we came for.
So let's make sure that's true.
So there you go.
That's all the hashes off the domain controller right there
for you.
(Applause).
And it was like you were never there!
So I have one other surprise for you.
Might not be much of a surprise.
That's our desktop, right?
Oh, thank you.
Thank you very much.
Hey, it's Windows Server 2012, what do you know?
So this is going to work for a while!
(Applause).
All right.
So hold on.
Sorry.
Okay.
So caveats, right, there's always caveats being right?
You will need credentials to start with.
You are going to need something with local admin rights,
it could be a domain account or a local account.
But administrator and password tends to work in nine
out of the ten domains we pen test.
So go and do that.
Of course, there's NBNS spoofing and there's Ettercap.
And so when someone is caring or paying attention,
winexe creates a server that could be stopped
or creates a red flag.
It has a binary that could be installed in the system 32 or one of the paths.
So that could be a red flag and get caught it.
Touches disk, sometimes AV doesn't like WEC.
And the reason it took longer to run, obfuscated
the resource DSLs that are in the WCE binary and it takes
an extra couple of seconds but I'm pretty sure that AV
will have a hard time with it.
That's part of what I release.
Authentication over port 139 or 445 is required.
If you can't do that, this doesn't work.
And then locard exchange principles.
This touches disk.
It will not stand up to a forensics administration.
The admins will look at the server and think everything is just fine.
It has a lot of log ins.
It might log in three or four times, and that might look bad
if they are looking for that.
So where can I get smbexec?
It's out on sourceforge or git hub under brav0hax.
And Royce creates one.
Impact it looks like they developed something
in python that was developed on Royce's work.
I know bash, I don't know anything else
and I don't really know bash that well.
So a couple of our guys on team ported it to Ruby.
So it's multi threaded and less hiccups and that's Brandon McCann.
So credit where credit is due.
Of course, WCE, Herman Ochoa, and smbclient, and winexe,
and Skip Duckwall, you know, the original vanish script.
The samba team, and winexe, and metasploit team, and
the list goes on and on.
Basically I couldn't smbexec really wouldn't work without that.
So I don't know if I have time for questions, but please give
the hackers for charity, go buy a T shirt or something.
Thank you very much.