1
00:00:00,000 --> 00:00:02,959
JUSTIN HENDRICKS: I'm Justin and I'm going to be going over AD

2
00:00:02,959 --> 00:00:05,999
and how you can own it using management software.

3
00:00:05,999 --> 00:00:09,375
And so we'll get started here.

4
00:00:09,375 --> 00:00:10,792
So, introduction.

5
00:00:10,792 --> 00:00:15,209
It's going to pretty much it's going to go over isolation and how you need

6
00:00:15,209 --> 00:00:19,375
to isolate AD from everything else and the management that

7
00:00:19,375 --> 00:00:24,209
the management environment of AD and how it's handled.

8
00:00:24,209 --> 00:00:27,999
So I'm specifically going to look at SCOM, HPI load, and hyper V

9
00:00:27,999 --> 00:00:32,459
and how they can be used to own ADs, essentially.

10
00:00:32,751 --> 00:00:34,167
There's no vulnerabilities.

11
00:00:34,167 --> 00:00:38,250
We're going to look at how it's abused if they're not managed right

12
00:00:38,250 --> 00:00:41,417
and not configured properly.

13
00:00:42,042 --> 00:00:46,125
So the software used to manage end domain controllers

14
00:00:46,125 --> 00:00:48,792
is often overlooked.

15
00:00:48,792 --> 00:00:51,834
As you know, it handles all Windows auth and all the hashes,

16
00:00:51,834 --> 00:00:54,999
which if you're after an environment you want to get

17
00:00:54,999 --> 00:00:59,125
all the hashes because once you get all the hashes you can own any box

18
00:00:59,125 --> 00:01:02,083
in the domain, and so so, yeah.

19
00:01:02,083 --> 00:01:06,083
It's the crown jewels of the environments.

20
00:01:06,083 --> 00:01:12,667
And recognitions usually look at ID seg, so they only look at active directory

21
00:01:12,667 --> 00:01:15,999
and the OS level ID seg.

22
00:01:15,999 --> 00:01:16,792
They don't look at everything that interacts

23
00:01:16,792 --> 00:01:18,626
with active directory.

24
00:01:19,959 --> 00:01:22,999
And so background, I'm going to go over SCOM, which

25
00:01:22,999 --> 00:01:25,417
is used for monitoring.

26
00:01:25,417 --> 00:01:28,083
Of course, if it's a high valued asset, you want to monitor it right,

27
00:01:28,083 --> 00:01:31,459
so you're going to use some sort of monitoring.

28
00:01:31,584 --> 00:01:33,918
In this instance we're going to look at SCOM.

29
00:01:34,209 --> 00:01:38,292
There's a SCOM security guide that's available on the internet.

30
00:01:38,292 --> 00:01:39,292
It's really long.

31
00:01:39,292 --> 00:01:40,626
Nobody probably read it.

32
00:01:40,626 --> 00:01:42,375
They probably hit next, next, next.

33
00:01:42,918 --> 00:01:46,334
There's also out of band management devices,

34
00:01:46,334 --> 00:01:51,999
which is network devices that allow out of band management, so

35
00:01:51,999 --> 00:01:57,626
if the machine is off, then you can restart it up.

36
00:01:57,626 --> 00:01:59,751
It's used for imaging, et cetera.

37
00:01:59,792 --> 00:02:02,584
And so we're going to look at HPI load in this instance,

38
00:02:02,584 --> 00:02:04,999
and then hyper V as well.

39
00:02:04,999 --> 00:02:08,459
So if you host which hyper V is a virtualization.

40
00:02:08,999 --> 00:02:13,584
So if you host AD on a hyper V host, then you also need to look

41
00:02:13,584 --> 00:02:16,125
at the hyper V host.

42
00:02:16,125 --> 00:02:20,876
There's warnings online about it, but it's often overlooked and everybody

43
00:02:20,876 --> 00:02:26,459
ignores the host and only looks at the OS level ID seg; right?

44
00:02:26,501 --> 00:02:27,918
First we'll look at SCOM and it's used

45
00:02:27,918 --> 00:02:30,125
for monitoring and alerting.

46
00:02:31,375 --> 00:02:33,918
The SCOM SDK service is what it uses to interact

47
00:02:33,918 --> 00:02:36,375
with the agents and everything.

48
00:02:36,626 --> 00:02:41,459
It's open up on 5723 and 5724 is what it uses.

49
00:02:41,667 --> 00:02:42,999
These are required.

50
00:02:42,999 --> 00:02:47,999
These need to be open if you want to access the SCOM management.

51
00:02:47,999 --> 00:02:49,751
Like if you actually want to look at the alerts and everything,

52
00:02:49,751 --> 00:02:51,626
these have to be open.

53
00:02:51,626 --> 00:02:54,584
So often times organizations have these open in the firewall in order

54
00:02:54,584 --> 00:02:56,876
to look at alerts outside the environment

55
00:02:56,876 --> 00:03:00,083
because they want to act upon them, right?

56
00:03:00,250 --> 00:03:03,209
And Nmap, for instance, won't scan for these.

57
00:03:03,209 --> 00:03:05,334
So if you use Nmap, then you'll need to add these

58
00:03:05,334 --> 00:03:08,999
to the list and you'll see why in a minute.

59
00:03:09,083 --> 00:03:12,125
And the SCOM agent, as well, which runs

60
00:03:12,125 --> 00:03:16,999
on every monitored machine, it runs as local system,

61
00:03:16,999 --> 00:03:21,999
and so it's great because it's admin access.

62
00:03:21,999 --> 00:03:23,709
So you'll see in a minute.

63
00:03:23,792 --> 00:03:26,999
So abusing the functionality of SCOM.

64
00:03:26,999 --> 00:03:29,125
So SCOM has this beautiful feature called "Task" and

65
00:03:29,125 --> 00:03:34,083
they let you run arbitrary DB script on every monitored machine.

66
00:03:34,459 --> 00:03:38,834
So, obviously, if you can own the SCOM app or the machine,

67
00:03:38,834 --> 00:03:42,375
then you can run arbitrary script as local system

68
00:03:42,375 --> 00:03:45,167
on every managed machine.

69
00:03:45,250 --> 00:03:47,918
And let's see, then you have to be a member

70
00:03:47,918 --> 00:03:51,083
of SCOM administrator's or author's role, which

71
00:03:51,083 --> 00:03:54,999
is application level roles within SCOM and you're able

72
00:03:54,999 --> 00:03:57,999
to then run these, obviously.

73
00:03:58,083 --> 00:04:01,083
And so, so if you have a SCOM instance, then you need

74
00:04:01,083 --> 00:04:05,125
to have another instance that only monitors AD and then one instance that

75
00:04:05,125 --> 00:04:07,667
monitors everything else.

76
00:04:07,667 --> 00:04:09,876
So, obviously, they need to be isolated.

77
00:04:09,876 --> 00:04:11,999
That's the whole goal here.

78
00:04:11,999 --> 00:04:13,918
So here's an overview of the architecture, which

79
00:04:13,918 --> 00:04:15,999
is on MSDN or yeah.

80
00:04:17,542 --> 00:04:19,999
So it uses the SDK, which then executes

81
00:04:19,999 --> 00:04:23,834
on the alert management server and then that runs the script

82
00:04:23,834 --> 00:04:27,626
on the agent managed machines and it usually runs as whatever

83
00:04:27,626 --> 00:04:31,667
the agent is running as, and by default it runs as local system,

84
00:04:31,667 --> 00:04:34,209
which I already mentioned.

85
00:04:34,626 --> 00:04:37,959
So they have an operations manager console as well,

86
00:04:37,959 --> 00:04:43,125
and that uses the SDK as well, but you can also use their libraries that

87
00:04:43,125 --> 00:04:45,542
they have as well.

88
00:04:45,542 --> 00:04:48,083
So here's just a screenshot of the installation.

89
00:04:48,083 --> 00:04:51,999
As you can see, by default it runs as local system.

90
00:04:52,375 --> 00:04:56,626
And there's many warnings out there on the Internet that it can be very

91
00:04:56,626 --> 00:04:59,999
dangerous and it's bad, but nobody reads them, of course,

92
00:04:59,999 --> 00:05:02,626
so we're going to abuse it.

93
00:05:02,667 --> 00:05:04,083
So demo time.

94
00:05:06,667 --> 00:05:09,834
I hope this is showing here.

95
00:05:12,292 --> 00:05:14,626
So we've got a few demos.

96
00:05:54,417 --> 00:05:57,999
AUDIENCE: Might have to adjust the resolution.

97
00:06:01,083 --> 00:06:03,542
JUSTIN HENDRICKS: Okay.

98
00:06:06,709 --> 00:06:07,999
Okay.

99
00:06:07,999 --> 00:06:08,999
Now demo time.

100
00:06:08,999 --> 00:06:10,999
The demo gods are not with me today.

101
00:06:10,999 --> 00:06:11,999
All right.

102
00:06:11,999 --> 00:06:13,501
There we go, we have something.

103
00:06:15,999 --> 00:06:17,751
(Applause.)    JUSTIN HENDRICKS: It's only on that screen, so I have

104
00:06:17,751 --> 00:06:19,167
to look down at that.

105
00:06:21,459 --> 00:06:22,709
All right.

106
00:06:22,709 --> 00:06:23,918
Well okay.

107
00:06:24,209 --> 00:06:25,792
Cool.

108
00:06:26,083 --> 00:06:27,876
All right.

109
00:06:27,876 --> 00:06:31,292
So pretty much here's the SCOM Operations Manager.

110
00:06:31,292 --> 00:06:33,959
So we're going to use it to auth these in a low privileged account,

111
00:06:33,959 --> 00:06:36,167
and that's in the SCOM administrator's role,

112
00:06:36,167 --> 00:06:38,876
because that's how it's added.

113
00:06:40,334 --> 00:06:43,834
So the SCOM console lists all the machines.

114
00:06:43,999 --> 00:06:46,584
One machine is a domain controller.

115
00:06:46,626 --> 00:06:50,918
Our new SCOM, what we're going to execute is going to execute

116
00:06:50,918 --> 00:06:54,751
a reverse HTTPS show, and the DB script is written

117
00:06:54,751 --> 00:06:59,792
out to hard disk and then executed in the SCOM task.

118
00:06:59,792 --> 00:07:02,999
So as you can see there, we're just running arbitrary power

119
00:07:02,999 --> 00:07:06,459
show, and then running the script that's going to start

120
00:07:06,459 --> 00:07:08,375
a reverse show.

121
00:07:08,918 --> 00:07:13,083
So we'll copy that, create a new SCOM task under the authoring.

122
00:07:13,999 --> 00:07:17,209
So next we'll just call it interpreter.

123
00:07:17,959 --> 00:07:21,999
And you can hide the name if you're going to be sneaky.

124
00:07:22,209 --> 00:07:24,999
Then we want to run it on all Windows computers.

125
00:07:24,999 --> 00:07:30,584
So increase the timeout value to half an hour, that way we have plenty

126
00:07:30,584 --> 00:07:34,334
to migrate into another process.

127
00:07:34,334 --> 00:07:36,792
And then, so we create the task.

128
00:07:38,083 --> 00:07:41,999
And so this SCOM SD so the actual user that is executing

129
00:07:41,999 --> 00:07:45,083
and has access into this, it only has access

130
00:07:45,083 --> 00:07:47,501
on the SCOM machine.

131
00:07:47,501 --> 00:07:52,292
So, obviously, it's not an admin in AD.

132
00:07:52,292 --> 00:07:53,918
So we're going to run the task.

133
00:07:53,918 --> 00:07:56,459
So we ran them against each of the machines; one

134
00:07:56,459 --> 00:07:59,083
is a domain controller.

135
00:07:59,083 --> 00:08:00,999
And you'll see we got the shells back.

136
00:08:01,250 --> 00:08:07,209
(Applause.)    JUSTIN HENDRICKS: So it runs as local system.

137
00:08:07,667 --> 00:08:09,999
And so we're just going to open a session

138
00:08:09,999 --> 00:08:12,709
on the domain controller.

139
00:08:13,709 --> 00:08:22,999
We get the let me just, yeah, we'll migrate we're not migrating yet.

140
00:08:23,999 --> 00:08:27,417
So yeah, it runs as local system by default.

141
00:08:27,417 --> 00:08:31,334
Then we're just going to list the processes, migrate into spooler,

142
00:08:31,334 --> 00:08:33,999
because after half an hour it will end

143
00:08:33,999 --> 00:08:37,999
because that's what we have our execution as.

144
00:08:38,584 --> 00:08:44,584
So you want to hurry up and migrate and then and

145
00:08:44,584 --> 00:08:52,083
the migrate processes empty the hashes, end of story.

146
00:08:53,667 --> 00:08:55,751
There we go.

147
00:08:57,083 --> 00:08:58,417
There you go.

148
00:08:58,417 --> 00:09:00,459
There's the hashes and now we've owned

149
00:09:00,459 --> 00:09:02,417
that domain.

150
00:09:02,959 --> 00:09:07,584
(Applause.)    JUSTIN HENDRICKS: Then you can also do it,

151
00:09:07,584 --> 00:09:11,584
you can also write arbitrary XZs.

152
00:09:11,709 --> 00:09:17,999
You can write a reverse shell in DB script as well, which works.

153
00:09:17,999 --> 00:09:21,083
There's and so in this instance we're just going

154
00:09:21,083 --> 00:09:24,250
to write an arbitrary XZ.

155
00:09:24,250 --> 00:09:30,667
So I'll skip ahead I also mention here, here's the SCOM administrators

156
00:09:30,667 --> 00:09:36,918
and there's the SCOM SDK users that is admins in the SCOM app and not

157
00:09:36,918 --> 00:09:39,334
in AD, obviously.

158
00:09:39,751 --> 00:09:42,167
And so, so if you're in admin in the SCOM app,

159
00:09:42,167 --> 00:09:44,999
then you're essentially an admin.

160
00:09:53,667 --> 00:09:56,083
So we'll just create another one here.

161
00:09:56,083 --> 00:09:58,083
It's pretty much the same thing.

162
00:09:58,083 --> 00:10:02,999
I'll skip through it.

163
00:10:02,999 --> 00:10:03,834
Except it's writing out an arbitrary XZ

164
00:10:03,834 --> 00:10:05,792
and then executing it.

165
00:10:05,792 --> 00:10:06,792
It runs it.

166
00:10:16,626 --> 00:10:19,000
And you can run this across however many machines

167
00:10:19,000 --> 00:10:20,667
there are.

168
00:10:20,667 --> 00:10:25,459
So it will, it will spin up an instance on every agent, so.

169
00:10:27,792 --> 00:10:31,999
And then it just runs and empties the hashes out.

170
00:10:33,999 --> 00:10:44,334
And one last example here that I had was the SCOM so we're at 5724

171
00:10:44,334 --> 00:10:55,542
is used by the SCOM SDK and the operations manager uses 57 5723.

172
00:10:55,709 --> 00:10:59,334
So if that's not open, but 5724 is open, then you can still use

173
00:10:59,334 --> 00:11:04,083
the SDK libraries that they have, you can execute everything using that

174
00:11:04,083 --> 00:11:08,792
use as well, you just have to implement it on your own.

175
00:11:08,792 --> 00:11:13,876
In this example we're going to import new management pack

176
00:11:13,876 --> 00:11:19,375
and it's just going to run arbitrary commands.

177
00:11:19,375 --> 00:11:20,667
And this is just a little app that I wrote that uses

178
00:11:20,667 --> 00:11:21,999
the SDK.

179
00:11:21,999 --> 00:11:23,999
Really shitty app, but it works.

180
00:11:24,083 --> 00:11:28,083
So imports to management and then you'll see, you kind of have

181
00:11:28,083 --> 00:11:32,501
an interactive, you know, you can execute whatever you want

182
00:11:32,501 --> 00:11:34,250
against it.

183
00:11:34,250 --> 00:11:36,083
So, just another example.

184
00:11:36,083 --> 00:11:37,083
All right.

185
00:11:37,083 --> 00:11:38,083
We'll move on.

186
00:11:46,250 --> 00:11:48,542
So recommendations.

187
00:11:48,542 --> 00:11:49,999
Here, let me switch this back.

188
00:11:59,999 --> 00:12:01,250
Okay.

189
00:12:01,250 --> 00:12:02,250
I'll just move on.

190
00:12:02,250 --> 00:12:04,334
So recommendations is that the SCOM servers used

191
00:12:04,334 --> 00:12:07,751
to monitor AD need to be isolated and not to rely

192
00:12:07,751 --> 00:12:10,209
on SCOM SDK ports open.

193
00:12:10,375 --> 00:12:12,709
If they are, they need to be closed off.

194
00:12:12,709 --> 00:12:15,083
SCOM administrators and authors should be limited

195
00:12:15,083 --> 00:12:18,083
to only the admins, obviously.

196
00:12:18,083 --> 00:12:21,334
So you'll need another instance that only monitors AD.

197
00:12:21,375 --> 00:12:26,209
Move engineers and everybody else into the read only or operator roles

198
00:12:26,209 --> 00:12:30,083
and that won't allow them to execute new agent, and also

199
00:12:30,083 --> 00:12:33,999
to reduce the agent, as well, so it doesn't need to run

200
00:12:33,999 --> 00:12:35,999
as local system.

201
00:12:36,125 --> 00:12:40,250
And there's a official security guide, too, that you can read.

202
00:12:48,999 --> 00:12:50,792
My bad.

203
00:12:59,459 --> 00:13:00,999
All right.

204
00:13:00,999 --> 00:13:03,083
So, for conclusion.

205
00:13:03,417 --> 00:13:08,709
So SCOM tasks all need to be audited, that way if there's any hidden task

206
00:13:08,709 --> 00:13:12,292
in there, they need to be audited.

207
00:13:12,459 --> 00:13:15,999
So it also has the execution logs in SCOM.

208
00:13:15,999 --> 00:13:19,459
And by default it's one week, but you can edit that.

209
00:13:19,459 --> 00:13:23,292
So it's good if you want to increase it or if you're the bad guy and you want

210
00:13:23,292 --> 00:13:27,501
to remove the execution logs, you can also edit it.

211
00:13:27,709 --> 00:13:33,083
Then it also logs every auth in the operations manager event log.

212
00:13:33,584 --> 00:13:36,459
So here's just a screenshot of the history,

213
00:13:36,459 --> 00:13:40,125
so you can obviously edit it to be zero days and nobody

214
00:13:40,125 --> 00:13:46,125
will know what ran, or you can edit it for one month if you want to audit.

215
00:13:46,125 --> 00:13:49,292
So next we're going to go over out of band management devices.

216
00:13:49,292 --> 00:13:50,999
Every machine usually has out of band management hardware

217
00:13:50,999 --> 00:13:53,751
used for monitoring and maintenance.

218
00:13:53,751 --> 00:13:57,459
So it's used for imaging, for restarting if you run out of hard disk space,

219
00:13:57,459 --> 00:13:59,792
et cetera, et cetera.

220
00:13:59,792 --> 00:14:01,626
It's for emergencies, essentially.

221
00:14:01,792 --> 00:14:09,584
So the admin interface is usually accessed over SSH or IPMI,

222
00:14:09,584 --> 00:14:12,375
HTTPS as well.

223
00:14:12,918 --> 00:14:15,501
It's equivalent to actually having the box in your office

224
00:14:15,501 --> 00:14:17,709
in your hands; right?

225
00:14:17,999 --> 00:14:24,999
So, and many of them, all except for HP, have really shitty default passwords.

226
00:14:24,999 --> 00:14:28,125
So most of the time organizations might not update those so you can use that

227
00:14:28,125 --> 00:14:29,751
as access.

228
00:14:29,751 --> 00:14:33,334
There's also, about a month ago Rapid 7 released

229
00:14:33,334 --> 00:14:39,751
some really nice remote root exploits that allow that allow admin access

230
00:14:39,751 --> 00:14:41,959
without auth.

231
00:14:41,999 --> 00:14:43,334
That's really useful.

232
00:14:46,167 --> 00:14:49,459
They're often hard to update because you have

233
00:14:49,459 --> 00:14:55,083
to it's usually very manual and so organizations might not update.

234
00:14:55,542 --> 00:14:59,083
And there's here's an example of HPI where they have

235
00:14:59,083 --> 00:15:03,584
an overwrite chip which is actually on the machine.

236
00:15:04,751 --> 00:15:08,375
If it's enabled, then it then you don't have

237
00:15:08,375 --> 00:15:10,709
to auth at all.

238
00:15:10,709 --> 00:15:16,999
So it's, you know, it's awesome if you're after that machine.

239
00:15:17,250 --> 00:15:20,417
So here's a list of common user names.

240
00:15:20,959 --> 00:15:24,667
IO is the only one that's actually updated and

241
00:15:24,667 --> 00:15:28,501
all the rest have So one more demo.

242
00:15:44,375 --> 00:15:46,459
Here, hang on.

243
00:16:02,375 --> 00:16:05,125
Let me switch this back.

244
00:16:21,083 --> 00:16:23,292
The mouse isn't coming over.

245
00:16:25,999 --> 00:16:31,167
Give me one sec, it's not cooperating.

246
00:16:44,250 --> 00:16:45,999
There you go.

247
00:16:45,999 --> 00:16:49,999
So this is HPI load here and what's going to happen

248
00:16:49,999 --> 00:16:56,125
is we're going to mount an ISO and we're going start into Knoppix

249
00:16:56,125 --> 00:17:01,999
and then do sticky keys and that's pretty much it.

250
00:17:02,083 --> 00:17:06,626
So so you mount the ISO in the HPI integrated remote.

251
00:17:09,459 --> 00:17:14,584
Let me skip back here.

252
00:17:14,584 --> 00:17:15,584
All right.

253
00:17:15,584 --> 00:17:18,999
So we mount the ISO here within the admin interface.

254
00:17:18,999 --> 00:17:24,999
We start the machine up, and rather than making you watch it

255
00:17:24,999 --> 00:17:29,459
start up, I'll skip ahead here.

256
00:17:31,999 --> 00:17:39,751
So it starts in the Knoppix, and we sticky key

257
00:17:39,751 --> 00:17:46,584
the box that way we can get access.

258
00:17:46,709 --> 00:17:50,459
So we're just going to replace the sen.exe

259
00:17:50,459 --> 00:17:54,542
with cmd.exe and that's one way to get access

260
00:17:54,542 --> 00:17:58,999
if you actually have access to the box.

261
00:18:01,751 --> 00:18:35,834
So we're going to rename that cmd.exe, paste, override it, restart the box.

262
00:18:35,834 --> 00:18:43,250
So we unlock the ISO, restart it back up, hit the shift key five times

263
00:18:43,250 --> 00:18:46,250
and there you go.

264
00:18:46,250 --> 00:18:48,417
So, obviously, you guys know how it works.

265
00:18:49,999 --> 00:18:53,083
We hit the shift key five times and then we have a show

266
00:18:53,083 --> 00:18:55,083
a system, sorry.

267
00:18:55,083 --> 00:18:59,959
(Applause.)    JUSTIN HENDRICKS: It's nothing new.

268
00:19:00,250 --> 00:19:05,375
And then here you can just add another user, empty the hashes, et cetera,

269
00:19:05,375 --> 00:19:07,083
et cetera.

270
00:19:08,876 --> 00:19:10,792
So we just add a user and then we get access

271
00:19:10,792 --> 00:19:12,167
to the box.

272
00:19:14,083 --> 00:19:15,999
Sticky keys off.

273
00:19:15,999 --> 00:19:16,999
No.

274
00:19:16,999 --> 00:19:17,999
All right.

275
00:19:18,334 --> 00:19:20,167
We'll move on here.

276
00:19:25,375 --> 00:19:28,083
We're running out of time.

277
00:19:33,334 --> 00:19:34,542
Okay.

278
00:19:34,542 --> 00:19:35,626
So recommendations.

279
00:19:35,626 --> 00:19:37,083
Update the default password.

280
00:19:37,083 --> 00:19:39,083
It should always be updated, obviously.

281
00:19:39,250 --> 00:19:42,626
Have regular patching for the out of band devices.

282
00:19:42,999 --> 00:19:45,334
Monitor audit logs for unauthorized access.

283
00:19:45,334 --> 00:19:54,999
Configure factor off, if you're able to.

284
00:19:54,999 --> 00:19:57,292
You should also have another management environment, you know,

285
00:19:57,292 --> 00:19:59,999
for all these out of band devices.

286
00:20:00,250 --> 00:20:03,999
There's an article online also that you can read that helps with that.

287
00:20:04,334 --> 00:20:07,167
So next we'll go over hyper V, it's virtualization software that hosts

288
00:20:07,167 --> 00:20:09,334
virtualization machines.

289
00:20:09,334 --> 00:20:11,709
Administrator on the host has admin rights

290
00:20:11,709 --> 00:20:15,375
on all the VMs that it hosts, obviously.

291
00:20:15,542 --> 00:20:20,667
Here's another example where you can also start into a live disk and steal

292
00:20:20,667 --> 00:20:23,999
the VHD file or either/or, I guess.

293
00:20:24,000 --> 00:20:27,999
So here's how you mount an ISO.

294
00:20:28,667 --> 00:20:32,876
Once you're in it, you can steal the MTDS, then you have

295
00:20:32,876 --> 00:20:38,999
all the directory and you can extract the hashes offline, essentially.

296
00:20:39,000 --> 00:20:42,584
So all they'll know is the machine unexpectedly restarted,

297
00:20:42,584 --> 00:20:46,250
unless they look at the host audit logs.

298
00:20:47,083 --> 00:20:49,125
So recommendations.

299
00:20:49,125 --> 00:20:51,042
The hyper V, the hyper V host they need to be isolated

300
00:20:51,042 --> 00:20:53,999
with AD exactly like everything else and the admins

301
00:20:53,999 --> 00:20:56,459
on it should only be admins.

302
00:20:56,999 --> 00:21:01,083
So it's easy principle.

303
00:21:02,083 --> 00:21:09,125
And also, you need to protect the protect the VHD files as well.

304
00:21:09,417 --> 00:21:11,667
So, yeah, only admin should have access

305
00:21:11,667 --> 00:21:13,083
to those.

306
00:21:13,584 --> 00:21:16,334
And it should also be in another management network,

307
00:21:16,334 --> 00:21:18,083
if available.

308
00:21:18,083 --> 00:21:19,626
There's another article.

309
00:21:20,999 --> 00:21:24,999
Then lastly, vulnerability standards as well.

310
00:21:24,999 --> 00:21:30,459
Organizations usually do auth scanning and those usually have admin rights

311
00:21:30,459 --> 00:21:32,542
on every box.

312
00:21:32,542 --> 00:21:36,542
So if you're scanning your domain controller with a domain admin creds,

313
00:21:36,542 --> 00:21:39,999
the box or whatever you're using should be treated

314
00:21:39,999 --> 00:21:42,542
as a domain controller.

315
00:21:42,542 --> 00:21:43,751
I mean, it's you know.

316
00:21:46,083 --> 00:21:49,834
And so, yeah, you can obviously if you own one of those,

317
00:21:49,834 --> 00:21:53,999
then you own AD as well if there's an isolation.

318
00:21:54,083 --> 00:21:57,959
So conclusion is everything that interacts

319
00:21:57,959 --> 00:22:02,999
with AD needs to be looked at, so management stuff also has

320
00:22:02,999 --> 00:22:05,999
to be properly secured.

321
00:22:05,999 --> 00:22:09,999
And so that's about it.

322
00:22:09,999 --> 00:22:14,584
And here's my information and I'll have everything up online next week.