>> This is acquired current user hashes without admin privileges. So please join me in giving
Anton Sapozhinikov a very warm welcome. (Applause.) >> Hi guys. So what this talk about I will
discuss common penetration testing case I expect to see during any engagement during my
work. We will discuss traditional techniques to gather credentials for the user and
(indiscernible) SSPI. So, who is me? A little bit of penetration tester for seven years. CTF
player; maybe you know my team is MoreSmokedLeetChicken (indiscernible 1:04 – 1:10) but
anyway. Working for KPMG Russia and project volema. So let's start. Let's imagine a situation
where we don't have ‑‑ we exported some vulnerability in the (indiscernible) sites of
(indiscernible) for example browser or I don't know, Flash Player . Or maybe these are just
downloaded and executed a payload from internet. And there is no access to internet from
his computer. I mean, about (indiscernible) for example or there is some kind of
restrictions on it. Of course we have showed access to user workstation because our payload
was (indiscernible) framework or some kind of rank. And these rank fully (indiscernible)
windows and any kind of rank from XP to the latest 8.1. And of course we don't have any
privileges on that workstation. I mean usually running credentials of a user. So, the
admin working have done. Admin drop was done. So our goal was to find an ‑‑ our goal is oh to
find out a password for user and try to use it that way after that. Why do we need to try to
get user password? First of all, any shell is going to die from day‑to‑day. We use buggy
software. How many of you see (indiscernible) unexpectedly dying? So it's - - I see every
day unfortunately. So workstation of the user may be powered off. For example,
(indiscernible) for a weekend maybe your dock was detected and forensics people start to
instigate a computer. So your shell will die and you will have no access to work station after
that. But if you grab a password for the user, you can use it to connect I don't know, web mail,
Citrix, VPN, exchange, any incorporation, and incorporate sources what is available from
the internet. What's the traditional ways to get a password of a user? There are
famous tools like Fgdump or maybe you know Mimikatz or those credentials editor. Or maybe
just extract passwords from not (indicernible) but hashes from (indiscernible), registry or SAM
file. But the disadvantages of those ways is that you have to have admin privileges for
example, to grab registry or some debug privileges to extract hashes and passwords from a
memory like Mimikatz or Fgdump. If you remember during the definition of our task, we don't
have heightened privileges on our workstation. So we can't use those tools to perform our
engagement. The second way could be try to elevate privileges in some way, for example, try to
find some third party service. We filed permissions and over write some sensitive files. Or
from DLL hijacking attacks or something else. But, as I mentioned before, we have fully
portioned operating system. We have fully function (indiscernible). So still no way
to escalate privileges and exploit it and use our favorite tools like Mimikatz. That's sad.
There's some alternative ways. For example, we could try to popup user window could look
like that. It's a standard window from Windows XP. But as I mentioned, there is some
localisation. Just imagine what you are exposing computer sort of staying somewhere in Russia
or China, you couldn't popup a window with the correct word ‑‑ we would call it letters so when
the native speaker will mention it with the letters and he will not trick and he will not enter
his password in that window. So you fail. And you wait, even if you, if you use your real belief
to your window, he will, for example, enter some different words that are not actually user
names or passwords. During my experience, during my engagements, I see a lot of
users were trying to put, for example, some words like, I don't know, get off or something
like that. If they actually realize it was some kind of social engineering type. We try
to have some fun with you, I don't know. The second way could be for example, use of script
from Metasploit frame work. It's actually called hash snarfing. Also, this technique is
implemented in a tool called Incognito. How it works, it approaches (indiscernible)
credentials of a current user trying to connect to SMB server that's arriving somewhere in the
network, the local network and authenticate using credentials for current user. And attacker
should control its SMB server to grab the credentials and somehow extract the passwords from it.
But as I mentioned in the definition of the task, we do not have access to the network.
So we do not have any SMB servers in the networks and we can't execute such kind of
attacks. The third way is try to use Internet Explorer. The default browser could use
credentials from a current user to authenticate you. And you also could grab the hashes but
there are some disadvantages. For example, the host name you should use. Browse with Internet
Explorer should be like everything in the trusted zone of the domain and
(indiscernible) should be allocating the local net work. Wherever the user is current
located. That's option number one. Or option number two is whether it could change a proxy
server of the browser, and for example, the proxy server will be actually ‑‑ your seller and
(indiscernible) from the browser will go through that proxy and capture the hashes. But it's
quite difficult to perform because actually could (indiscernible) control internet
access for public user, and you know if Internet is not working for the user, he will call help
desk. And your shell or your Metaputuer or something, (indiscernible) will be killed.
You'll be, you're incident will be investigated. Anyway, we're ‑‑ if you want to follow the way
of using internet explorer, all of you know, if you're executing internet browser, it will use a
lot of (indiscernible)s and you'll be very, very slow and user will notice it. So I think
in terms of pace, it's not for us. So what is security support provider? Provider interface?
It's some kind of layer. What allows different applications starting from browsers any kind
of applications to talk to security providers what implemented by breaking systems.
So what is it? It's several packages. Simplest of then is Microsoft Negotiate. It just
picks the best security package to handle the current configuration of a computer and
try to use the package was actually configured by admins. The second package is Microsoft
NTLM and everybody thinks, no what is it? Microsoft Kerberos and Microsoft Digest SSP. Digest
SSP currently, not widely used, but in the past it was used to authenticate users of a mail
systems like three POP3 protocol or for example HTTP Digest Authentication. And a Secure
Channel package, it's just implementation of SSL or TLS by a Microsoft. So how does any
application talk to any server using SSPI. For example, we have a client application and the
server application. Umm, and the client would like to authenticate on the server using
password of the current user. It will change (indiscernible) some kind of messages and any way ‑‑
client should generate the message called ETLM. Negotiate and send it to the server. The
main advantage of it is SSPI interface is at client application shouldn't know
anything about what NTLM negotiate is. It'll just tell SSPI. SSPI please can you write
me that type of message and then client just get it from a buffer and send it to a center and log
any authentication. On the server side, happens the same. Server will talk to SSPI
interface and read the following: Hay SSPI, here is a message from a client. Go read
it from buffer. Please prevent buffer and can you write for please, NTLM challenge and I
will send it to the client. After that, client will receive NTLM challenge message, also
will send it to SPPI interface. And SPPI will prepare for client the message what should be sent
to the server. So SPPI allows us to extract from implementation of different mechanism currently
running from breaking systems, power (indiscernible). What options are configured? Various
domain controller or within an (indiscernible). What's it current. Where is location, how
many of them? Just ask SPPI to perform authentication and that's solved. So there is three
types of messages as I told before. That message type one is just contains features that
supported by the client. Message type two just contains features that are supported by the server
and it contains a challenge generated by the server. The challenge should be used to
generate the message type three. And the hashes that are contained in the message type
three calculated using the change from a message type two. So let's optimize approaches.
I'll talk the SSPI, for example, implement the server and the client application in the one
process. What does this mean? We will send the message type one message type two, and message
type three from ourself to client to server in one application. That means that
application actually know what is the challenge, what is sent through the server and what was
captured by the client. So there is not any traffic on the network. And the application
could grab all that information what was passed and use it somehow to calculate and extract
later applications. So how it looks like. Message type one, it's just different bytes. Using
that you could extract the knowns, the challenge. The hashes were calculated by the
challenge and if you grab all the things, you could just format it for different crackers
for example, John the Ripper, and it will crack it for you. And after a little bit of brute
forcing, you will get a password of a user. I did little bit of benchmarking, as you can see. If
you are using different types of protocols for authentication, for example, you could brute
force as fast as one million hashes per second. If you are currently using NTLM version
one, it's about two million hashes and NTLM version two is about 500 hashes per second.
What is mean for us? It means NTLM version one is disabled on the computer we could try to use
HTTP Digest to authenticate the user. It allows us to brute force at double speed. So what
attack flow willl actually look like? The processer will send the user some kind of spear
fishing user will be navigating, clicking on the link or downloading some payload or any
exploited any how. Payload will try to authenticate a user on itself and send the
authentication data and what was extracted on the data flow to a pentester. The pentester will
force it and extract the user name and password of the user. Afterward, he will use it to
connect to any incorporated sources and exfiltrate the data what means is the
(indiscernible) was successful. How again exfiltrate code load can send the message to our
common control center with authentication data what was just extracted. Where is, I
think we used ‑‑ everybody will know that some kind of (indiscernible) shells, but
(indiscernible). But it's off the blogs. And umm, I would like to present you with two
(indiscernible) and (indiscernible). The way number one is using DNS for it. For
example, we could try to use, to ask that DNS server to resolve for us some kind of name like
some information goes here dot to my dot evildomain dot com. That means that our DNS servers
are trying from that domain will capture the data, what was requested. But every time your
payload will try to resolve a domain, window's security alert, for example, or any other
personal firewall will alert it and these may block your payload. There are some work
arounds for it. For example, a workaround I suggest is using file system. For example,
windows acted like create file set current directory with a way like slash slash some
information goes here in my domain slash some directory will force break in systems to result
the DNS main for you. And it will send a DNS request to your server. And umm, personal
firewall, actually will not block it. And that means you win. If you would like some to
get some information back from DNS server and not using any network connections, you for
example would like, use for example IPConfig slash display DNS. And you will see the result
of DNS replies or test by DNS client for you and you could extract from that and actually
know there's not any personal firewalls that will get you doing such things. It's slowly,
but if you want just to send your user name and password to somewhere in the internet,
that's quite enough. Second way to send the user name and hashes to what you just dropped to your
common control center is using Google. Many times during my penetration testing works I see
the company was using some kind of white listing (indiscernible) or proxy servers a we block any
unknown web sites but Google come in quite often. It's opened for everybody even for
(indiscernible) company. Even for the most unprivileged users so we could use to, we could try
to use it to send data back to home. The trick is using the IP off Google.com and try to ask
Google.com to send the data to a application in China for Google. So to perform that attack we
should install our own application engine and capture the data is and send it to
somewhere else where actually could brute force it. And using that way, any proxy server that
is monitoring the internet of users, could see what user just searching something in internet
and nothing else. So we will win after that. How could we mitigate of those kind of that
attacks? First of all, we could try to use two factor authentication. Any kind of
talking or hardware talking or software talking strong passwords as you mentioned. We
should brute force caches that we just drop to extract the passwords. If the password was
quite strong we will fail and passwords wouldn't be extracted. And the last suggestion is just
to try to disable unused packages. For example, as you see the benchmarking slide.
There is it, HTTP Digest package allows you to double the speed of brute force and passwords. So
if you disable it, the attackers only, will use only (indiscernible) to attack your
users. So what's next? In a week, I will release Metasploit post exploitation model. My
implementation of attacks (indiscernible) in the seat currently on a github. But the
Metasploit model is currently in the work. It has some bugs, for example, it doesn't support
fully supported protocol and do not extract hashes from every operating system. I know at
least, I know it (indiscernible) hashes, but, it's difficult to extract because (indiscernible)
for that protocol is about one hundred pages. So I don't have time to read it full. And umm, I
don't know something else. Something else to improve. So that's all. I am ready to think
maybe answer questions. (Applause.)