00:00:00.500-->00:00:06.006 So, um, my name is Gabriel Ryan. I'm a security engineer at, let's adjust this, OK. In the 00:00:06.006-->00:00:09.243 back, can you hear me? OK, good stuff. My name's Gabriel Ryan. I'm a security engineer at 00:00:09.243-->00:00:13.914 Gotham Digital Science. Um, also known as Solstice. Uh, uh we primarily do like uh like 00:00:13.914-->00:00:19.319 Appsec, infrastructuring testing, red teaming, research, etcetera. Uh some new things in 00:00:19.319-->00:00:22.556 this presentation. Uh we're going to be talking about hostile portal attacks that's a 00:00:22.556-->00:00:26.994 method of stealing active directory credentials from uh WPA2-EAP networks without 00:00:26.994-->00:00:31.064 network access and we're also going to be talking about indirect wireless pivots. Uh 00:00:31.064-->00:00:34.701 which is a way of using rogue WPA2 attacks to bypass uh port-based access control 00:00:34.701-->00:00:38.872 mechanisms by controlling the physical layer of the network. Uh, so before we move on into 00:00:38.872-->00:00:42.976 that stuff, a little background info. Uh we're going to talk about WPA2-EAP and the 00:00:42.976-->00:00:47.547 vulnerabilities that affect them. Um, so historically uh WP PA2 EAP or at least the weaker 00:00:47.547-->00:00:50.951 forms of it has been susceptible to evil twin attacks or rogue access points in general 00:00:50.951-->00:00:54.154 actually. So, rogue AP attacks uh you could consider them the bread and butter of the modern 00:00:54.154-->00:00:57.758 wireless pen tests. Uh you can use them for the stealthy man in the middle attacks, uh stealing 00:00:57.758-->00:01:01.828 radius credentials, uh all kinds of cool stuff. And the way that they work, I mean that the 00:01:01.828-->00:01:05.198 simplest form of rogue AP attack is the evil twin attack. The way that it works is that you have 00:01:05.198-->00:01:09.903 an access point um, like the one that we see here and then you ha..have a bunch of clients to 00:01:09.903-->00:01:14.074 it. So so let's take a look at these four clients are connected to Def Con open on channel 6. 00:01:14.074-->00:01:19.580 Um, so if an attacker creates um an identical access point to this one uh, but with a with a 00:01:19.580-->00:01:24.051 stronger signal strength so uh a stronger signal strength but also has Def Con open channel 6 00:01:24.051-->00:01:29.923 uh what will happen is this will cause the clients to drop their associations to the uh to the 00:01:29.923-->00:01:33.961 valid access point and then connect to uh the the rogue access point which you see down 00:01:33.961-->00:01:36.763 here and at this point the attacker has the man in the middle that that he or she can 00:01:36.763-->00:01:41.301 use uh to do all kinds of crazy stuff like, whoa, I almost dropped the shot glass. Um, heh 00:01:41.301-->00:01:46.640 heh, uh like stealing creds and and the attacks that we're going to see today. So. I mean, these 00:01:46.640-->00:01:51.111 are these are these are not new attacks. They been around for a really long time. Um, you know, 00:01:51.111-->00:01:55.048 in fact uh the first the first mention I could find of them was in 2002 and uh this this wire 00:01:55.048-->00:02:00.020 wireless LAN Security FAQ by CW Klaus talks about evil twin attacks. Uh fast forward a bit, 00:02:00.020-->00:02:03.957 you have 2003 you have asleap by Joshua Wright. 2004 we start seeing karma attacks, we're not 00:02:03.957-->00:02:06.626 really going to go into into those today, but uh if you don't really know what they are check 00:02:06.626-->00:02:10.263 them out. They're pretty cool. That was Dino Dai Zovi and Shane Macaulay. You know in 2008 you 00:02:10.263-->00:02:14.534 have Josh Wright and Brad Antoniewicz um uh comes out with uh you know attacks you know 00:02:14.534-->00:02:19.206 this is where you start to see attacks against WPA2-EAP uh using rogue AP attacks and 00:02:19.206-->00:02:23.910 that's freeradius-wpe. 2014 uh, by that point, karma attacks had stopped working as well also so 00:02:23.910-->00:02:28.915 two researchers Dominic White and Ian de Villiers uh, came up with uh uh essentially fixed 00:02:28.915-->00:02:32.919 karma and then also added a bunch of uh cool techniques for adding E..uh attacking EAP which 00:02:32.919-->00:02:37.290 uh we are going to talk about. And also in 2017 very, very recently you have the guy who 00:02:37.290-->00:02:41.928 wrote wifi fisher, um implemented the lure 10 attack which you can use against uh 00:02:41.928-->00:02:46.566 Windows 10 wifi attacks. So um what's common, the the common theme here is that you know 00:02:46.566-->00:02:50.303 rogue AP attacks have been primarily used to fill one of two roles. Uh, stealing creds 00:02:50.303-->00:02:53.206 using man in the middle attacks or breaching WPA/WPA2 networks. Um in this talk we're going to 00:02:53.206-->00:02:57.210 do something a little different. We're going to talk about uh using rogue AP attacks as a 00:02:57.210-->00:03:01.014 means of lateral movement. So, uh, before we continue we should probably talk about you know 00:03:01.014-->00:03:05.719 about how you can use evil twin against WPA2-EAP and you know to do that we have to understand 00:03:05.719-->00:03:09.222 how the EAP or how the extensible authentication protocol works. So logically, 00:03:09.222-->00:03:12.859 and for those of you who are familiar with the EAP, I'm going to leave out that the the the 00:03:12.859-->00:03:17.264 authenticator for now uh just to make this um just to you know to address this you know from like 00:03:17.264-->00:03:21.835 a high level perspective first, but logically authentication in EAP um occurs between the 00:03:21.835-->00:03:24.838 supplicant and the authentication server. So the supplicant is just a fancy way 00:03:24.838-->00:03:27.774 of saying the wireless client and the authentication server's the radius server and it's 00:03:27.774-->00:03:31.178 sitting you know in the background. Uh you know deeper in the network. So the first 00:03:31.178-->00:03:34.548 thing that happens is the client's authenticating a request to authenticating 00:03:34.548-->00:03:40.087 server. At that point, the authentication server responds with with a X509 certificate and 00:03:40.087-->00:03:44.057 this X, the role this X509 certificate is to verify the identity of the authentication 00:03:44.057-->00:03:47.828 server and and and if the client, you know, accepts the certificate it's saying that it 00:03:47.828-->00:03:52.332 it it trusts the authentication server and you know from that point forward uh we move from 00:03:52.332-->00:03:55.669 the outer authentication which is what we're seeing here to this this what we're seeing at 00:03:55.669-->00:03:59.339 the bottom of this diagram here and that's the your inner authentication. The inner 00:03:59.339-->00:04:03.677 authentication occurs through a secure tunnel that's established at that point. Now the reason 00:04:03.677-->00:04:08.882 why we need this secure tunnel is that, you know, because it's being used for although it's 00:04:08.882-->00:04:13.487 being used as a authentication mechanism for WPA, that WPA does not actually kick in until this 00:04:13.487-->00:04:17.324 entire process is complete. So essentially, this is all happening over open wifi, so 00:04:17.324-->00:04:21.228 without that secured tunnel it's established um this authentication process can be 00:04:21.228-->00:04:25.265 sniffed and in fact legacy implementations of EAP were were susceptible to thi..to this, 00:04:25.265-->00:04:29.669 specifically EAP MD5. Uh, so when I said there were 2 components to EAP 00:04:29.669-->00:04:33.406 authentication, I actually that wasn't entirely accurate. Um, there's a third component 00:04:33.406-->00:04:37.077 involved as well and that's the authenticator. The authenticator um, at least when we're dealing 00:04:37.077-->00:04:41.648 with wireless is the access point and the job of the access point in in this case is to, um, 00:04:41.648-->00:04:45.752 act as an intermediary between the the wireless client and the authentication server. Uh, 00:04:45.752-->00:04:48.588 typically there's like a wire connection between the access point and the authentication 00:04:48.588-->00:04:53.193 server and then all the communication layers happening over layer 7 radius and then on 00:04:53.193-->00:04:56.296 layer 2 we have we have the supplicant and the um the EAP...that's and that's 00:04:56.296-->00:05:01.434 communication over wireless. So at this point, you know, in order for this this uh uh this 00:05:01.434-->00:05:05.572 communication to eh, eh, to in order for this to work 2 things have to happen uh for this to be 00:05:05.572-->00:05:09.009 secure. You know the client has to be able to trust the authentication server and the 00:05:09.009-->00:05:13.647 client also has to be able to trust um uh the access point and you know as as we mentioned this 00:05:13.647-->00:05:17.984 is all happening over over open wifi and and as we also mentioned earlier, open wifi 00:05:17.984-->00:05:22.889 networks are susceptible to evil twin attacks. So, likewise, this whole process um can actually be 00:05:22.889-->00:05:26.860 middled using evil twin attack. You know what you do is create a rogue access attack or a rogue 00:05:26.860-->00:05:31.031 access point and that and you force the client to connect to you and at that point you run 00:05:31.031-->00:05:34.267 your own radius server in the background and so long as the client accepts your forged 00:05:34.267-->00:05:38.405 certificate your X509 certificate and and and by doing that is saying that it trusts 00:05:38.405-->00:05:42.275 you at that point it will establish a secure tunnel with you and then you can it will it 00:05:42.275-->00:05:46.112 will perform the authentication process with you and that allows you to uh crack the EAP 00:05:46.112-->00:05:51.818 challengers response off line uh giving you credentials. So this attack, uh first talked about by 00:05:51.818-->00:05:57.190 Brad Antoniewicz in 2008 as well as uh Joshua Wright in their SchmooCon presentation and uh 00:05:57.190-->00:06:00.493 it's been around for a while. So for for the new stuff we're going to do live demos, but just 00:06:00.493-->00:06:03.930 for the sake of time and also not p*****g off the demo gods if it's just like review stuff I'm 00:06:03.930-->00:06:08.802 just going to stick to videos. Um, also just because it's Sunday, but whatever. So ya..you 00:06:08.802-->00:06:11.671 know the first stage of the attack uh what's going to happen what you're seeing here is the 00:06:11.671-->00:06:14.774 attacker is is actually creating a a a forged certificate. Assault sign certificate and 00:06:14.774-->00:06:19.846 that's what's going to be sent to the client. Fast forward it a bit and, you know, the attacker 00:06:19.846-->00:06:24.918 is starting the EAP. As you see here, uh the EAP is enabled and what's going to happen shortly 00:06:24.918-->00:06:29.189 is that you're going to get a client associating so see the client now is associating with 00:06:29.189-->00:06:33.526 the with the access point and shortly thereafter you should see, right there, we have the 00:06:33.526-->00:06:38.932 username challenge and response. So, at this point you have the username challenge and response 00:06:38.932-->00:06:43.270 and you can at this point you crack it to obtain ee.. the plain text credentials or um, 00:06:43.270-->00:06:46.806 the NT hash, which is uh equivalent to plain text credentials in terms of what you 00:06:46.806-->00:06:50.610 can use it for. So there two ways of doing this. The the oldest way of doing it is with a 00:06:50.610-->00:06:53.613 dictionary attack and the success rate of this is inversely proportionate to the 00:06:53.613-->00:06:56.449 strength of the password. So say for a really strong password it's going to be pre...it's it's 00:06:56.449-->00:07:01.254 actually like a a pretty bad attack. Um, you know in 2012 um Moxie Marl..Marlinspike and 00:07:01.254-->00:07:06.559 David Hulton, uh, you know they they actually uh,uh, did a talk where they did they um at at Def 00:07:06.559-->00:07:12.232 Con where they did a divide and conquer attack. So MS-CHAPv2 which is which is uh the the um 00:07:12.232-->00:07:17.470 inner authentication protocol used by EAPP um actually uses the same 50 60 s encryption as 00:07:17.470-->00:07:22.275 NTLMv1 so the security of this protocol is actually reducible to the strength of a single DES 00:07:22.275-->00:07:25.945 encryption. So, instead of, you know, um with a dictionary attack we're we're trying to 00:07:25.945-->00:07:31.251 recover plaintext password for this you tend to sort of cover a NT hash and it actually with a 00:07:31.251-->00:07:36.423 with a um a powerful FPGA cracking rig such as crack dot s h, um, which you can go look up. 00:07:36.423-->00:07:39.526 It is pretty cool. Um, which is pr..previously per Cloudcracker. You actually can achieve a 100 00:07:39.526-->00:07:41.528 percent success rate in less than 24 hours for recovering NT hash. So as you can see it's 00:07:41.528-->00:07:43.530 it's it's pretty vulnerable so the solution that was introduced to kind of mitigate this issue 00:07:43.530-->00:07:48.535 was EAP-TLS and this was introduced in 2008. Um probably in response to uh, the attacks 00:07:53.807-->00:07:57.344 that came out around the same time period and and the cool thing about EAP-TLS is that it 00:07:57.344-->00:08:01.815 uses mutual authentication using x509 certificates right off the bat. So, the strength lies in 00:08:01.815-->00:08:05.652 the in the use of the client-side certificates. Uh,it because you know with those you 00:08:05.652-->00:08:07.887 can can't really do the evil twin attacks that we that we that we showed you in the 00:08:07.887-->00:08:12.225 beginning. Um, unfortunately, how many network admins are out there right now? Show of hands. 00:08:12.225-->00:08:16.329 Alright, so how many how many how many people out there, you know think that that putting the 00:08:16.329-->00:08:21.801 client-side or client cert on every device of your network is like a good time? Ye..yea yea 00:08:21.801-->00:08:25.538 so, I mean this is why it never really took off because it it's like, oh yea I just put I just 00:08:25.538-->00:08:29.976 put a uh cert on everything and and it's actually not that simple and you know it's and 00:08:29.976-->00:08:32.912 it's even more difficult if you have like existing network infrastructure to integrate this 00:08:32.912-->00:08:37.150 stuff into to or if you're in in like uh uh special scenario like you know you're dealing with you 00:08:37.150-->00:08:40.920 know industrial control systems or or medical equipment or something like that uh it might 00:08:40.920-->00:08:44.858 not even support client um client based certificates. So you know you run into this 00:08:44.858-->00:08:48.528 classic security versus convenience scenario. And you know it's it's kind of, you know 00:08:48.528-->00:08:52.399 network administrators are forced to choose between uh uh two really kind of like poor 00:08:52.399-->00:08:56.469 choices. You know authentication mechanisms with known weaknesses or you can use the EAP-TLS which 00:08:56.469-->00:09:01.241 is highly secure, but it's also very um very impractical. So what this does is it actually 00:09:01.241-->00:09:04.444 creates a market gap and you know there there are all kinds of products that have tried to 00:09:04.444-->00:09:07.881 address this over the years uh and and tried to compensate for this security issues found in 00:09:07.881-->00:09:13.453 EAP-PEAP/EAP TTLS but are also kind of easy to use. So the current trend that that the you 00:09:13.453-->00:09:17.590 know we tend to see over and over and over again um, is is the focus on breach containment, 00:09:17.590-->00:09:21.528 rather than breach prevention. So the idea is you acknowledge that um, yes, the wireless in 00:09:21.528-->00:09:27.000 the the wireless perimeter is is weak um but you you try to you know stop the the threat once it 00:09:27.000-->00:09:31.971 gets in that inner layer of that that first layer of defense. So, we're going to talk about this, 00:09:31.971-->00:09:37.744 uh today is whether or not this actually works. So um I I guess the the most common way of 00:09:37.744-->00:09:41.981 approaching this containment problem is using uh uh network access control mechanism uh to 00:09:41.981-->00:09:47.887 attempt to stop threats uh as a as they occur. So before that, I am going to present you with 00:09:47.887-->00:09:54.394 this this awesome little cartoon. [silence] Yeah. OK, so um, so yeah, the most common way 00:09:54.394-->00:09:59.532 uh that this this is implemented is is to use a NAC to to um, once once an attacker gets on 00:09:59.532-->00:10:03.503 the network uh you identify them as an untrusted endpoint and you quarantine them. You either, you 00:10:03.503-->00:10:08.675 know, completely block the port or you or you you place them in a a quarantined VLAN and um you 00:10:08.675-->00:10:12.645 know and and you know there are two varieties of NAC out there. There's an agent-based NAC and a 00:10:12.645-->00:10:17.016 agentless NAC. And a agent-based NAC you know what that involves is it's a software component 00:10:17.016-->00:10:21.120 installed on on on every authorized endpoint of the network and these these uh and 00:10:21.120-->00:10:23.790 and this software component is called an agent. And this agent communicates with the brain of 00:10:23.790-->00:10:27.894 the NAC and uh and and and that's how the brain of the NAC distinguishes it will tell that 00:10:27.894-->00:10:32.031 a particular endpoint is is allowed to be there. And this is this is highly effective, but 00:10:32.031-->00:10:34.634 once again you have something you have to put on every authorized endpoint so it's 00:10:34.634-->00:10:38.605 nearly as impractical as the EAP-TLS. So then on the other side of the spectrum you have 00:10:38.605-->00:10:43.776 you have have agentless NACs. And uh agentless NACs they use the they're purely external. Uh 00:10:43.776-->00:10:46.980 they use passive fingerprint fingerprinting, active scanning and they're much easier to 00:10:46.980-->00:10:50.783 deploy than agent-based NACs, uh but unfortunately they're also unable to examine the internals 00:10:50.783-->00:10:54.921 of the network components so you can bypass them simply by masquerading as a valid uh host 00:10:54.921-->00:10:59.592 on the network. So once again you know you've you've even by using NAC we run into uh the 00:10:59.592-->00:11:04.097 same recurring dilemma which is, you know, insecurity versus impracticality. So this creates 00:11:04.097-->00:11:06.399 yet another market gap, you know, where you have a high demand for a solution that 00:11:06.399-->00:11:10.570 offers a deep interrogation capabilities of an agent-based NAC, but without the additional 00:11:10.570-->00:11:14.974 overhead. So you know there's a third gr..category that are all kinds of uh really interesting 00:11:14.974-->00:11:18.945 solutions that that have once again tried to tried to bridge this gap. Uh and and we usually 00:11:18.945-->00:11:22.849 refer to those as the next generation gap uh NACs. You have um kind of like AI based 00:11:22.849-->00:11:25.685 solutions that kind of you know establish a baseline on the network and try to figure out 00:11:25.685-->00:11:29.622 look for anomalies, uh you have, we're going to talk about one in particular just because uh it's 00:11:29.622-->00:11:34.527 a pretty good example of uh uh a interesting attempt at doing at doing this. Uh, I tried to 00:11:34.527-->00:11:38.631 borrow this particular network appliance, uh from from my IT department I opened up a help 00:11:38.631-->00:11:42.936 desk ticket. It's a 10-->000 dollar piece of equipment though, and uh yeah, I could 00:11:42.936-->00:11:47.507 have seen that coming, right? But interestingly enough, I also got like a warning from legal 00:11:47.507-->00:11:52.445 not to to name drop this people so we're going to refer to this as vendor A. Um, heh, but you 00:11:52.445-->00:11:55.481 know this this one really interesting uh piece of equipment, it uses WMI to 00:11:55.481-->00:11:59.052 interrogate new devices. And uh you know this is really cool because you can it's capable of 00:11:59.052-->00:12:04.224 performing internal checks without using an agent. Um, with that said, I mean, it the way it 00:12:04.224-->00:12:07.327 does this is that it authenticates over SMB using a single administrative service 00:12:07.327-->00:12:10.530 account. The service account you know is given remote login privileges to all authorized 00:12:10.530-->00:12:15.535 devices at the group policy level um and and and the and this allows it to perform deep 00:12:15.535-->00:12:19.339 interrogations without using an agent. Pretty cool, except that it also provides a single point 00:12:19.339-->00:12:22.208 of failure where you have this device that's sending godmode hashes to every new device 00:12:22.208-->00:12:26.980 that's added to the network. So, you know, um wh...you know, what what this what happens here is 00:12:26.980-->00:12:30.950 we end up with a situation where the the the first potential threat here is it introduces the 00:12:30.950-->00:12:35.521 risk of SMB relay attacks. Um, in case you're unfamiliar NTLM is is a simple authentication 00:12:35.521-->00:12:39.826 protocol. Um, the way that it works is that you know the client first attempts to 00:12:39.826-->00:12:43.096 authenticate with with the server. The server issues a plain text uh string of 00:12:43.096-->00:12:46.332 characters as a challenge to the client. The client then has to encrypt that string of 00:12:46.332-->00:12:50.103 characters using its password hash and then send the encrypted hash back to the server as a 00:12:50.103-->00:12:53.239 response. The server then decrypts it and compares it to the original string that it sent 00:12:53.239-->00:12:58.444 and it does the same authentication attempts succeeds. So with an SMB relay 00:12:58.444-->00:13:01.547 attack you literally just put yourself in the middle of that process um using a man in the 00:13:01.547-->00:13:04.751 middle attack the victim sends you the the the the authentication request. You 00:13:04.751-->00:13:09.288 forward that to the target. Uh, the target then it sends you the plain text string the challenge. 00:13:09.288-->00:13:12.692 You forward that to the victim and, oops, and you keep forwarding stuff back and forth 00:13:12.692-->00:13:16.195 and so what ends up happening is your you end up authenticating with the target instead of the 00:13:16.195-->00:13:21.200 victim. So you know once gain we have we have the system but you know we we've introduced the 00:13:21.200-->00:13:25.538 risk of SMB relay attacks um because you know it it's sending you NTLM hashes and trying to 00:13:25.538-->00:13:29.609 authenticate with you over NTLM. Um, but at the same time uh you you could mitigate this 00:13:29.609-->00:13:34.681 potentially by using uh um SMB signing which which interestingly enough it's 00:13:34.681-->00:13:38.818 actually disabled by default. Everything but the domain controller um in in in Windows. 00:13:38.818-->00:13:43.222 So, um and the reason for this is that the main controller uh downloads group policy over SMB. 00:13:43.222-->00:13:47.260 Um, but even if you enable SMB signing, which its its what you do with SMB signing is you 00:13:47.260-->00:13:51.631 digitally sign packets uh to confirm their authenticity. Um even if you enable SMB signing 00:13:51.631-->00:13:56.302 you still uh the issue of hashes being sent directly to untrusted endpoints. So, um interestingly 00:13:56.302-->00:14:01.340 enough there is like uh a piece of software that you can put on every single network endpoint uh 00:14:01.340-->00:14:05.244 that's provided by this vendor but uh essentially then you're back to using an agent again so 00:14:05.244-->00:14:08.781 you're kind of back to square one. So, I mean, I I guess the the point I'm trying to make is 00:14:08.781-->00:14:12.385 that you know, no matter how much thought into this, there's really no magic bullet here. I 00:14:12.385-->00:14:16.456 mean your you have this security with convenience um uh statement but the problem is security with 00:14:16.456-->00:14:22.995 convenience is actually a paradox. So, back to wireless. Um another another technology 00:14:22.995-->00:14:26.766 that that's often used as a wireless security mechanism that that's worth looking at is is is 00:14:26.766-->00:14:31.671 client isolation. So the way that um the the what client isolation is suppose to do it's 00:14:31.671-->00:14:35.141 suppose to prevent wireless clients from from talking to one another on the network. And you 00:14:35.141-->00:14:38.044 know a couple of use cases on open network. If you go onto your hotel wifi you may notice 00:14:38.044-->00:14:41.080 you can't ping one another. That's because they probably have client isolation, um, 00:14:41.080-->00:14:46.619 enabled. And you know the way that um it 802 11 is suppose to work in theory is that the AP um 00:14:46.619-->00:14:51.724 mediates all communication between the the clients. So if this guy here wants to send a 00:14:51.724-->00:14:56.963 package to this guy over here, the client can just stop it and say no you can't do that. Um, 00:14:56.963-->00:15:00.533 the problem is the client isolation ii..at least on on a wireless network is a logical 00:15:00.533-->00:15:03.936 control, it is not a physical control. So you know the problem is how do you prevent radio 00:15:03.936-->00:15:07.106 transceivers from communicating with one another? So a really awesome researcher who 00:15:07.106-->00:15:10.777 unfortunately is no longer with us named Cedric Blancher. Uh back in 2005 his response to 00:15:10.777-->00:15:16.115 this is you can. He released a tool called a Wifitap. Uh, and and this was like revived in 00:15:16.115-->00:15:20.553 2013 by Oliver Lavery of Gotham Digital Science. Way before my time. Um, but the way that 00:15:20.553-->00:15:25.391 Wifitap is that it reads packets from the victim to AP using a wifi interface in in monitor 00:15:25.391-->00:15:28.227 mode. And then you know every time it receives one of those packets it's going out to the 00:15:28.227-->00:15:32.431 distribution system it injects a response as if it's coming from the AP. So this allows it to 00:15:32.431-->00:15:37.336 actually um communicate with the um with the variable sources on the network without actually 00:15:37.336-->00:15:41.207 being associated with the network at all. And it provides a neat little tun tap device 00:15:41.207-->00:15:45.511 that you can use to to to bridge over to the uh, uh to to the monitor mode interface that do 00:15:45.511-->00:15:49.949 this. So, I mean there are some later tools that that let you do even more stuff. Aircrack suite 00:15:49.949-->00:15:51.951 has airtum-ng which you can do this with web. And there's also tkiptun-ng which you can do this 00:15:51.951-->00:15:56.956 with WPA1. Um, there's also this this uh theoretical attack uh has been talked about called 00:15:59.792-->00:16:05.064 hole 196 where uh I I I guess the idea is that pro..you might be able to do this WP2. It's 00:16:05.064-->00:16:08.367 really, really really debatable whether this actually works. I've never seen it pulled off 00:16:08.367-->00:16:13.840 before. Uh, but it's worth mentioning just to be thorough. So, uh, here's an example of of 00:16:13.840-->00:16:20.112 of Wifitap doing it's thing. In the top right we uh have a we're going to create a a valid a an 00:16:20.112-->00:16:23.916 open access point and then we're going to connect to this open access point from our host 00:16:23.916-->00:16:27.987 operating system. This this terminal is just been changed into a VM by the way. And then 00:16:27.987-->00:16:32.325 we're going to start sending the uh sending sending ICMP packets uh, to this AP and what you're 00:16:32.325-->00:16:34.327 going to notice is we're going to have 5 ICMP packets sent and they're going to be 5 responses. 00:16:34.327-->00:16:36.329 So now what we're going to do is we're going to in in this terminal to the left we're going 00:16:36.329-->00:16:38.331 to start a wifi ping and a wifi ping is a modified version of Wifitap that um essentially all 00:16:38.331-->00:16:41.033 it does is that everytime it sees an ICMP packet and and sniffs one, it injects a 00:16:41.033-->00:16:46.038 response in that ICMP packet in in the form of an ICMP reply. So we're going to run that as well 00:16:56.682-->00:17:02.188 and repeat the what we did in the last process. Uh, sending 5 ICMP packets and notice now 00:17:02.188-->00:17:06.459 instead of receiving 5 ICMP replies, we receive 10 of them. And we also get little warnings 00:17:06.459-->00:17:12.832 that we're receiving duplicates. So, what we've just done is we sent packets to um uh uh uh 00:17:12.832-->00:17:16.903 network endpoint without actually being associated with that network. So, you know, food 00:17:16.903-->00:17:19.705 for thought, you know going back to the whole issue of NAC, right? You know, what if we're 00:17:19.705-->00:17:23.075 missing the point? You know wh..what we have been talking to up to this point is is whether 00:17:23.075-->00:17:29.115 or not you know NACs are capable of of of stopping a direct attack. But, you know, when 00:17:29.115-->00:17:32.351 we're talking about wireless NAC isn't the only problem. Um, you know the role of NAC is to 00:17:32.351-->00:17:36.956 prevent attackers from accessing sensitive resources after the breach has occurred. Um, you 00:17:36.956-->00:17:40.259 know, and they did this by by when unauthorized endpoint has been detected, uh, they take one 00:17:40.259-->00:17:43.763 of two actions. Either the endpoint is placed in quarantine or the port is blocked. But you 00:17:43.763-->00:17:47.366 know, violating access control policies uh what this does is it causes the NAC to impose a 00:17:47.366-->00:17:51.170 restriction and in a wired, this is a physical restriction, but in a wireless network this can 00:17:51.170-->00:17:56.842 only be a logical restriction. More on this later. So, I want you to think of a scenario that 00:17:56.842-->00:17:59.946 that that's pretty common in in in in you know if you're doing pen testing or or anything 00:17:59.946-->00:18:04.150 that's still kind of a infrastructure testing. So, um you know we've already breached 00:18:04.150-->00:18:06.686 the perimeter using the attack that we we described in the first section of the of the of 00:18:06.686-->00:18:11.324 this talk. And this is also where over on the left where we we've been quarantined and we 00:18:11.324-->00:18:14.093 want to get over here. We want to pivot further into the network where we ca..can 00:18:14.093-->00:18:18.030 actually do some damage. Uh, unfortunately we've been quarantined by this NAC here, 00:18:18.030-->00:18:20.967 but fortunately for us there's this victim over here that we can potentially do something 00:18:20.967-->00:18:26.672 with. And and and also is a wireless client. So, more on that later. Uh, but the question 00:18:26.672-->00:18:31.610 is how do we get out of this situation? So, I mean to understand this um we need to 00:18:31.610-->00:18:37.516 look at something called LLMNR/NBT-NS poisoning. Um, and and LLMNR/NBT-NS S it it 00:18:37.516-->00:18:42.321 basically takes advantage of a flaw with that exists within netbios name resolution. Um, so 00:18:42.321-->00:18:46.892 the way netbios resolution works is that uh, the first thing that will happen is that a Windows 00:18:46.892-->00:18:51.697 host when it is trying to resolve a netbio signal it will check internally its local cache 00:18:51.697-->00:18:54.867 and also its LMHosts file. If that fails um it will then attempt to attempt DNS 00:18:54.867-->00:18:59.205 resolution using local nameservers. Uh and then at that point um if that fails as well 00:18:59.205-->00:19:03.609 it will fall back to LLMNR and then NBT-NS uh and and send broadcast requests to the entire 00:19:03.609-->00:19:08.814 subnet. So uh, LLMNR/NBT-NS they're actually different mechanisms, but they serve the 00:19:08.814-->00:19:12.752 same logical functionality. And this is best understood through example. Let's say we have two 00:19:12.752-->00:19:16.122 computers named Alice and Leeroy. Alice wants to request a file from Leeroy but doesn't 00:19:16.122-->00:19:20.292 know Leeroy's IP, all all Alice knows is is Leeroy's netbios name. So Alice will attempt to 00:19:20.292-->00:19:24.530 resolve Leeroy's name locally in using DN..locally and also using local DNS, but let's say this 00:19:24.530-->00:19:29.969 attempt fails. Alice will then make a broadcast request using LLMNR/NBT-NS. At this point 00:19:29.969-->00:19:33.939 every single computer on Alice's subnet will receive this request and the idea here is that only 00:19:33.939-->00:19:37.676 Leeroy should respond to this, but this is based on on honor system. Does anyone see a 00:19:37.676-->00:19:42.615 problem with this yet? Yeah, yeah, so I mean it's a lot like art where you know there is no 00:19:42.615-->00:19:46.519 honor among thieves. If Alice receives two of these responses, only the first one is going to 00:19:46.519-->00:19:48.921 be considered valid and this is going to create a race condition. The attacker can 00:19:48.921-->00:19:53.125 simply wait for LLMNR/NBT-NS queries and respond to all of them. And this will cause um the 00:19:53.125-->00:19:57.029 victims of this attack to send their traffic to the attacker. So there's uh the the most 00:19:57.029-->00:20:00.132 co...I guess like the most popular tool for doing this, and really pioneer in doing this was 00:20:00.132-->00:20:05.604 um uh responder by Lawrence Joffy or Lawrence Jewish I should say. And we're going 00:20:05.604-->00:20:10.609 we're going to start this up on the left and we're going to run this. Uh you can see here that 00:20:14.246-->00:20:18.017 we're poisoning LLMNR/NBT-NS and we're also have off servers that are waiting for us when this 00:20:18.017-->00:20:22.755 thing tries to connect to us and authenticate. So we're running responder and then we're going 00:20:22.755-->00:20:26.725 do over here on the right we have a victim computer, uh, named Jenkins. We attacked 00:20:26.725-->00:20:33.299 Leeroy earlier. Um, n..heh. So, Jenkins is going to try to connect to um.. He's going to 00:20:33.299-->00:20:37.570 try to connect to to a non existent uh file server. And the reason why we're using a 00:20:37.570-->00:20:42.475 hostname that is invalid is because it will force Jenkins to fall back to LLMNR/NBT-NS 00:20:42.475-->00:20:46.345 because it obviously won't be resolvable using the first three methods. And then when this 00:20:46.345-->00:20:52.918 happens, um the responder told it running on the left is going to poison those uh send poison 00:20:52.918-->00:20:59.525 answers to Jenkins. And oh we have the user task right there. So we're about uh 5 percent you 00:20:59.525-->00:21:04.396 know finished with our escape attempt. Um, I'm just going to check the time really fast. OK 00:21:04.396-->00:21:08.501 we're doing great. Awesome. So um the next thing we need to go over in order to understand how 00:21:08.501-->00:21:12.104 we can get out of this is something called redirect to SMB. Now the idea behind 00:21:12.104-->00:21:16.041 redirect to SMB is that you force the victim to visit an HTTP endpoint that redirects to 00:21:16.041-->00:21:20.346 an SMB share in the attacker's machine so you send them a URL. They click the URL and this 00:21:20.346-->00:21:23.949 takes them to a specially configured HTTP server and the on..only thing that the HTTP 00:21:23.949-->00:21:29.321 server does is one thing and one thing only and it redirects all the HTTP requests to a rogue SMB 00:21:29.321-->00:21:34.326 server that's sitting there um waiting to accept um uh NTLM authentication. And what this 00:21:34.326-->00:21:37.530 does is it causes the victim's browser to attempt NTLM authentication with the 00:21:37.530-->00:21:41.667 attacker. Uh, there's a variation of this uh call...you know where where where you 00:21:41.667-->00:21:45.704 simple redirect to a non-existent SMB share and this triggers LLMNR/NBT-NS. But it's 00:21:45.704-->00:21:48.641 a really fast way to get hashes. It does require social engineering though.For some way 00:21:48.641-->00:21:54.513 of getting access to that that that server. So, um, now is where we get into new stuff. And 00:21:54.513-->00:21:58.050 it looks like we have lots of time to go over it too so. Demogods will probably be 00:21:58.050-->00:22:02.421 somewhat happy about this. Um, so, now we're going to talk about hostile portal attacks. So 00:22:02.421-->00:22:06.525 the hostile portal attack it's a way of stealing active active dire..directory credentials from 00:22:06.525-->00:22:10.896 a wireless network without direct network access. And the way that you do this is is you 00:22:10.896-->00:22:14.300 essentially make a modified captive portal. So a captive portal.. How many of you have 00:22:14.300-->00:22:18.304 seen something like this recently? Yeah, ya so if you're staying at a hotel you run into 00:22:18.304-->00:22:22.975 this this captive portal and the idea here is that you restrict wi...wifi access by um forcing 00:22:22.975-->00:22:27.213 the users to to visit this page first and you know at that point you can do anything you want it 00:22:27.213-->00:22:32.084 it's most commonly used to uh uh you you either prompt it to authenticate or or or provide 00:22:32.084-->00:22:35.988 credit card information or something like that. So the way this works is that um all DNS 00:22:35.988-->00:22:39.792 queries are resolved to the captive portal. You know and and and this usually specializes in 00:22:39.792-->00:22:41.794 HTTP option, but also in case they are manually saying the victims mail is saying their 00:22:41.794-->00:22:43.796 their DNS server uh, you can also redirect DNS traffic to your own DNS servers so that 00:22:43.796-->00:22:45.798 they're forced to use yours. And then if you really want to be nasty you just redirect HTTP 00:22:45.798-->00:22:47.800 traffic to to your uh captive portal as well so that even if they're not using DNS um at all, 00:22:47.800-->00:22:49.802 uh you you still have them trapped. Uh so what a hostile portal attack is that you kind 00:22:49.802-->00:22:55.274 of modify this so that if performs redirect to SMB attack. Uh, the victim's forced to 00:22:55.274-->00:23:00.212 connect to the attacker using the rogue AP attack. Kinda like that, right? And the next thing 00:23:00.212-->00:23:04.116 that happens is that you instead of redirecting everything to a captive portal you perform a 00:23:04.116-->00:23:09.121 redirect test SMB and and what happens is that the victim is then forced to um, if if they're 00:23:15.794-->00:23:20.799 if they're using HTTP traffic at all they will be forced to authenticate with the attacker 00:23:22.901-->00:23:28.807 and that gives you NTLM creds. So um, and and and and in the background also to make this 00:23:28.807-->00:23:34.980 more effective uh we can run a responder to poison LLMNR/NBT-NS uh re..request so that even if 00:23:34.980-->00:23:40.586 they're just kind of idle we can still get them that way. So now, now we're going to do a live 00:23:40.586-->00:23:45.591 demo. So, I am going to I have to switch screens here. Alright, so in the bottom left here we're 00:23:48.560-->00:23:51.864 going to create, um.. We're going to do this on the open access point first because 00:23:51.864-->00:23:58.604 there's another couple steps we have to do to get this to work with a um a not so open acces 00:23:58.604-->00:24:03.542 point uh, uh WPA2 EAP access point. Well, it's not on the screen. Uh, oh. Alright, do you 00:24:07.146-->00:24:12.151 see one thing now? Alright, I'm just going to ... It's still not on the screen. Oh, whatever. OK. 00:24:16.722-->00:24:22.061 I'm going to just use the video then. Uh cause, just one second, oh. I have 35 minutes. Here 00:24:22.061-->00:24:27.066 check this out. Isn't that a fun. Uh Do I have a command but..this is a Mac so I'm not 00:24:30.135-->00:24:35.607 sure. Alright, can you can you see stuff now? Alright, cool. Nothing like system 00:24:35.607-->00:24:40.612 prefe..preferences to the the rescue. Thanks Steve Jobs. Um, so so if your Mac breaks you 00:24:43.215-->00:24:49.288 just you just pray to Steve Jobs and then everything works again. Except now my stuff's on two 00:24:49.288-->00:24:54.126 different desktops because I tried to fix it that way. Alright. That's the first 00:24:54.126-->00:24:59.999 desktop. And I'm going to put a 2 minute curfew on this DMU demo or a 1 minute curfew on this 00:24:59.999-->00:25:04.903 demo should I say? Aaah I'll go 2 and if I if I encounter 2 minutes worth of problems just 00:25:04.903-->00:25:08.273 so we can squeeze everything in, I'm going to just move on. But hopefully, the way things are 00:25:08.273-->00:25:12.311 going. Uh, you know knock on wood. [tap, tap] OK this shouldn't, this should work. 00:25:12.311-->00:25:17.316 Alright so the first thing I'm going to do is I'm going to create a...so these are 00:25:20.052-->00:25:24.456 backwards... that moves here..OK so we've we've created the open access point. This is not 00:25:24.456-->00:25:28.193 looking like an open access point. Alright so so so we've tried to create an access open 00:25:28.193-->00:25:33.198 access point. Now we're we're we're uh we're killing the peep..uh..OK. Alright here we 00:25:39.905-->00:25:43.242 go. So we're going to create an open access point uh using eap hammer we're actually going to 00:25:43.242-->00:25:46.311 use the same attack uh attack tool that we used for um for attacking this thing to create 00:25:46.311-->00:25:51.316 our valid access point. Uh, cause why not. Now we're going to have Leeroy up here in in the 00:25:53.619-->00:26:00.292 top left. Um, can you guys see this? OK, good stuff. And OK it looks like we're already 00:26:00.292-->00:26:05.297 connected. Excellant. Uh we're now going to create our rogue access point over here. Uh and 00:26:08.434-->00:26:13.906 this we're going to launch this attack and then we're going to get ready to deauthenticate uh 00:26:13.906-->00:26:17.910 Leeroy to get it to roam from one DNS sight to another, which will make this attack effective 00:26:17.910-->00:26:22.915 with all these network interfaces really close together. So we're doing this. 00:26:26.251-->00:26:31.290 And OK so we got it to associate. And notice that when we open up IE, OK now we have 00:26:31.290-->00:26:36.295 hashes. Now to get everything... Now to get everything to stop. OK. There we go. Cool stuff. So 00:26:44.670-->00:26:49.041 that that that's a hostile portal attack against a open network. It's so impressive 00:26:49.041-->00:26:52.044 we're going to make it a little more impressive. We're going to use it against WPA2 in a second. 00:26:52.044-->00:26:55.914 Once I clear this uh previous hash that we just captured, so we get it twice...Alright.... 00:27:09.194-->00:27:14.199 Oh, really, OK. It's I feel like we've been here before for some reason...OK..Magic. OK, so uh, 00:27:25.077-->00:27:29.147 OK so now let's talk about how to do this with WPA-EAP networks. So in most cases uh 00:27:29.147-->00:27:34.319 WPA-EAP means EAP-TTLS or EAP-PEAP. Both of these use MS-CHAPv2 as the inner 00:27:34.319-->00:27:37.789 authentication protocol. Interesting thing about MS-CHAPv2 it uses a mutual 00:27:37.789-->00:27:41.260 authentication which means at the very end of the authentication uh process the 00:27:41.260-->00:27:46.498 radius servers must actually do pru..acknowledge of uh the user's password to the client uh 00:27:46.498-->00:27:49.935 for the entire authentication process to succeed. So what this means is that although the 00:27:49.935-->00:27:53.906 attacker can force the victim to authenticate with an evil um evil twin uh to steal the 00:27:53.906-->00:27:57.709 hashes, uh the the radius server will still fail the final stage of the authentication process 00:27:57.709-->00:28:01.346 and the client will not associate with the attacker. So the way that you get around 00:28:01.346-->00:28:04.650 this, because you do need to, in order to get around the hostile portal attack you need you do to 00:28:04.650-->00:28:09.087 get it to completely associate with you. There are a couple of options. So for for weak radius 00:28:09.087-->00:28:13.058 passwords uh, you can use a technique uh that uh Dom White and Ian de Villiers came out 00:28:13.058-->00:28:16.795 with in in Def Con 22 called auto crack 'n add and we'll talk about that in a second. And the 00:28:16.795-->00:28:21.033 second solution we can use um is simply the crock..crack crack from offline and finish the 00:28:21.033-->00:28:27.039 attack later. Um so uh the the way the the at the very end of the uh MS-CHAPv2 authentication 00:28:27.039-->00:28:30.475 process, uh the big thing here is going to send the challenger's response which is 00:28:30.475-->00:28:34.746 part of what we're cracking um offline to obtain the credentials uh, to uh the uh 00:28:34.746-->00:28:38.483 radius server. Which in this case uh with with the tools that we're using for the attack is 00:28:38.483-->00:28:43.188 hostAPD. Um, at that point the hosting ADP is going to load uh the password from this file 00:28:43.188-->00:28:46.725 called the EAP user file which is just like uh, especially uh it's like a special text file 00:28:46.725-->00:28:52.297 that uses a database that contains that information. So, you know at that point um the 00:28:52.297-->00:28:57.135 the the attacker or the the radius server in this case is going to attempt uh to construct 00:28:57.135-->00:29:00.572 uh authentication response that proves knowledge of users password. And then that will be 00:29:00.572-->00:29:05.277 sent with the au..auth success message back to the victim. So when you when you're using auto 00:29:05.277-->00:29:08.947 crack 'n add technique uh what you're doing is instead of um immediately loading that 00:29:08.947-->00:29:13.051 password from the EAP user file uh, you you you instead take the challenger's response and send 00:29:13.051-->00:29:16.054 it to a cracking rig. And this can be like our remote cracking where it's very powerful. It 00:29:16.054-->00:29:19.625 doesn't have to be something that is on your laptop. And then you you you send that off and 00:29:19.625-->00:29:24.296 then you know the idea is that hopefully uh you will get the the results of that back in time 00:29:24.296-->00:29:28.533 where you can actually just append it to that user file in real time and then use that to 00:29:28.533-->00:29:32.237 construct the authentication response. You know, thi..this may not work the first time, but 00:29:32.237-->00:29:35.340 you know the idea is that maybe like in a few seconds or even a few minutes when the the victim 00:29:35.340-->00:29:39.745 tries to reassociate um that this will work and the full association will will will 00:29:39.745-->00:29:45.651 happen. Um, and the second option, of course, uh for for all those other passwords, uh uh 00:29:45.651-->00:29:49.254 is simply to crack offline and and and finish it later. Um, you know without even going into 00:29:49.254-->00:29:53.525 discussion that you know advance persistance threats like this guy on the right um you know are 00:29:53.525-->00:29:57.129 really limited by time boxing uh remember that we talked about how the divide and conquer 00:29:57.129-->00:30:01.700 technique uh with with with sufficiently powerful hardware uh can crack MS-CHAPv2 uh within 00:30:01.700-->00:30:06.838 24 hours within a 100 percent success rate. So you can just you can just go with that and 00:30:06.838-->00:30:12.477 just you know do the cracking and then then uh come back the next day and do it. So for for 00:30:12.477-->00:30:16.715 demo purposes, I'm obviously not going to connect to the Def Con wifi and and send stuff over 00:30:16.715-->00:30:21.720 there, so we're going to go with the first option. Alright, so here we are this is uh very 00:30:25.824-->00:30:30.862 similar .. Can you guys see the uh..OK yeah, I can see that so so that's working. So we're 00:30:30.862-->00:30:35.867 going to first create a PEAP access this time using WPA2 P E A P.. and this this uh wireless 00:30:38.136-->00:30:44.242 client here Leeroy's going to attempt to connect to it. And it did. OK. So we have the a 00:30:44.242-->00:30:50.415 connection. Now we're going to start our rogue.. And actually before I do that, I'm going to 00:30:50.415-->00:30:56.888 go in here and actually because I did I did this earlier to practice and the credentials are 00:30:56.888-->00:31:01.827 already there. So I'm going to get rid of them. OK. Now we're going to do a local autocrack. 00:31:04.730-->00:31:09.735 So we're just going to do this internally. And finally to get this thing to roam, the off hash 00:31:14.740-->00:31:19.745 before. Hopefully this works. Uh oh. Alright, so what are we running here? No?! OK It emptied 00:31:30.922-->00:31:37.129 off into the wrong thing. That would be bad. What.. no it's still connected to that uh so 00:31:37.129-->00:31:42.134 OK. Uh, authenticated. I'm actually just going to copy. I'm uh and going to paste this uh 00:31:45.370-->00:31:50.375 this Mac address from from here and see if I can see if I can try it again. Alright, try 00:31:58.750-->00:32:03.688 number 2. Oh, you know what this is? You see how I'm clicking this uh, this thing right here 00:32:11.396-->00:32:14.666 um over and over again and it's not bringing up the network manager? That's because I'm 00:32:14.666-->00:32:18.703 using a virtual machine and the virtual interface has has cooked itself and is not doing a thing. 00:32:18.703-->00:32:24.509 But luckily I came prepared because uh I've seem to be on the Demogod's bad side recently. 00:32:24.509-->00:32:29.514 So. We'll just, we'll just go at that route. OK, so back to where we were. Um in the top right uh 00:32:42.427-->00:32:47.199 we have the legitimate access point. Now we're going to create a wifi network called example 00:32:47.199-->00:32:51.269 wifi. It's going to be a PEAP network. And the bottom right we're going to have Jenkins this 00:32:51.269-->00:32:55.807 time. And Jenkins is going to attempt to uh uh as..authenticate with this. And 00:32:55.807-->00:33:00.912 this is a valid access point so we're just going to go ahead and connect them. And then the left 00:33:00.912-->00:33:04.049 hand of the side of the uh screen here, uh this is where our we're going to launch the 00:33:04.049-->00:33:07.719 rogue access point attack. So we're going to create that. We've created the rogue AP and 00:33:07.719-->00:33:13.792 started it. And then on, in in this tab right here, we're uh going to perform the alpha 00:33:13.792-->00:33:18.897 attack to get it to roam over to us. Uh sometimes what happens with.. Oh, wait tha..Yeah, so 00:33:18.897-->00:33:22.901 sometimes what happens here right is that when uh uh certain clients uh they'll actually just 00:33:22.901-->00:33:26.671 you know pop off uh the network completely, but then then when they try to reassociate, they'll 00:33:26.671-->00:33:32.010 end up on the rogue AP. So, a little user inconvenience there, but we don't really care about 00:33:32.010-->00:33:37.782 them anyways. Uh so we see here that we've captured the credentials. Uh they they've 00:33:37.782-->00:33:41.586 been written to the end of the um.. And now they've been written to the end or the um the 00:33:41.586-->00:33:45.190 end of the uh EPA user file that's we're just going to just capture the contents of that 00:33:45.190-->00:33:50.195 file really fast. Here we go. It's to the end. They've been added. So now we're going to 00:33:52.831-->00:33:57.836 repeat the attack. And notice that when we do that.. Go ahead and accept that that cert 00:34:02.574-->00:34:07.579 warning is popping up. So we do that. Um interesting things sometimes for some reason when 00:34:09.648-->00:34:14.185 you connect to a network uh you you IE just manages to open itself. Uh, by itself. And of 00:34:14.185-->00:34:18.189 course when that happens you're going to send HTTP traffic and you get hashes. And also check 00:34:18.189-->00:34:22.460 check this out. This is going to be pretty cool. Um every time you type in a character in the 00:34:22.460-->00:34:26.665 IE address bar, it tries to do a Bing search. So we're doing this and it's making each HTTP 00:34:26.665-->00:34:29.167 request so that every time you're typing in a character we're just getting a hash over 00:34:29.167-->00:34:32.604 and over and over again. In fact it looks like the E panel over here is starting to complain 00:34:32.604-->00:34:37.075 that we're doing it so often. Um and then over also IE is like what what's going on? We can't 00:34:37.075-->00:34:42.914 request anything. So yeah, that's a hostile portal attack against WPA2-PEAP. And what this 00:34:42.914-->00:34:46.885 gets you is lots and lots of NTLM hashes. You get similar results to LLMNR/NBT-NS 00:34:46.885-->00:34:50.588 poisoning, uh but there are a few key advantages here. Uh, no direct network access required 00:34:50.588-->00:34:53.358 and you're not limited to a local subnet. You get everything that is connected to wireless. 00:34:53.358-->00:34:56.227 And it's also not a passive attack. You're not waiting for LLMNR to show up on the 00:34:56.227-->00:35:01.099 subnet... on your local subnet. Uh, you're actually forcing things to happen. So back to our 00:35:01.099-->00:35:04.903 scenario. Here we are. Um, we're going we're going to do a new technique that that builds off a 00:35:04.903-->00:35:09.140 hostile portal attack and it's a technique for using a rogue AP attack to bypass port-based 00:35:09.140-->00:35:13.111 access control mechanisms. Um, so here we are with the attacker. We're back on this 00:35:13.111-->00:35:16.214 quarantine VLAN and we're actually going to do our escape attempt now. Once again we've 00:35:16.214-->00:35:21.686 been quarantined here by the NAC and um, over here we have the victim that's been placed in the 00:35:21.686-->00:35:24.789 restricted VLAN. You know and and obviously you want to get over here and access the 00:35:24.789-->00:35:30.462 sensitive resources. So what if we first, um, let's say that we have uh one network that after 00:35:30.462-->00:35:33.765 that's being after it's being used to activate this VLAN, what if we first take a second 00:35:33.765-->00:35:38.069 network adapter and then force this this victim to connect with that second network network 00:35:38.069-->00:35:43.475 adapter using the evil twin attack? Well, at that point the the victim is uh you know we we 00:35:43.475-->00:35:47.412 take them off the restricted uh the network that we're attacking and we force them to associate 00:35:47.412-->00:35:51.316 with us. We then attack them using a ho..a hostile portal attack to obtain their NTLM 00:35:51.316-->00:35:55.987 hashes. Crack the hashes offline. Come back later. Pick up where we left off. We might 00:35:55.987-->00:35:59.357 have to repeat the first step to make this work, but at that point we can we can place a 00:35:59.357-->00:36:03.228 timed payload on the victim, right? Uh, like a scheduled task or something. At that point we 00:36:03.228-->00:36:08.366 we we kill our our rogue AP our rogue AP that's operating in our second network interface. We 00:36:08.366-->00:36:12.837 allow the victim to reassociate uh with the target network. The NAC moves the victim back to the 00:36:12.837-->00:36:15.940 restricted VLAN because it's not authorized at that point. At that point we just wait for the 00:36:15.940-->00:36:21.012 reverse schel and this can be the best Mac in the world and it would not even matter. So um 00:36:21.012-->00:36:25.350 that was cool, but it requires some offline cracking of NTLM. Uh we obviously don't want to do 00:36:25.350-->00:36:29.154 that. Uh, well, I mean it it will work but it would be cooler if we could we could speed that 00:36:29.154-->00:36:34.559 process up a bit. So to do this we can use SMB relay attack. Um, and we talked about this 00:36:34.559-->00:36:38.763 earlier. So with an SMB relay attack, uh, what we're going to do is we're going to we're going 00:36:38.763-->00:36:43.301 to first uh u..use the rogue AP attack as before to force the victims to associate with our 00:36:43.301-->00:36:47.939 with our hostile portal and then when that happens uh, we then initiate the hostile portal 00:36:47.939-->00:36:50.675 attack but instead of just capturing uh those those NTLM hashes, we instead um, er, eh, 00:36:50.675-->00:36:52.677 perform a SMB relay attack to obtain uh uh uh schel on one of these victims. And we use we use 00:36:52.677-->00:36:57.682 that schel to place a time victim uh, time payload on that victim. So that that happens 00:37:03.054-->00:37:08.159 much more instantaneously you don't have to to crack those NTLM hashes offline. At this 00:37:08.159-->00:37:13.131 point we uh we kill our rogue AP as before. This allows the victim to reassociate with 00:37:13.131-->00:37:18.937 target network. Wait for the reverse schel and we've bypassed the NAC. Uh and as I said my USB 00:37:18.937-->00:37:23.942 interface is dead. So.. I have a back up. Hmhm. So here um.. Show of hands, how many people have 00:37:26.444-->00:37:30.081 used empire before? Alright, cool. For those of you who haven't, check it out. It's 00:37:30.081-->00:37:32.851 really easy to use and it's it's really really fun. And actually has a module it's called 00:37:32.851-->00:37:38.890 trolls..trolls ploit which you can use to like you know just re your um your victims, um er send 00:37:38.890-->00:37:43.094 little prompts that say stuff like you've been disconnected from the domain controller. Just 00:37:43.094-->00:37:47.799 all kinds of funny stuff. So we're going to connect these these two uh these two VMs these 00:37:47.799-->00:37:54.439 two victim VMs. We're going to use two them at a time. Uh, two art are uh are legitimate access 00:37:54.439-->00:37:59.477 point over here in the bottom left. On the right here we're setting up uh empire to perform 00:37:59.477-->00:38:01.713 this attack. We're going to create two listeners. That's what our victims are going to 00:38:01.713-->00:38:07.285 connect back to. We've also created uh uh payload and this this big blob of of 802 dot 1X 00:38:07.285-->00:38:10.555 that's a power command that's going to give us our reverse schel and we're going to tell 00:38:10.555-->00:38:14.692 our SMB relay uh script, so we're using SMB relay X although you can use anything for this 00:38:14.692-->00:38:19.697 really. Um to execute that on a target machine. We then lodge the rogue AP attack. And as 00:38:24.135-->00:38:29.140 before, once the rogue AP is running, we use replay to uh uh force these devices to associate 00:38:31.242-->00:38:36.247 with us. There by authenticating them to roam over to us. And you can see that happening here. 00:38:38.716-->00:38:44.389 Alright. So we have one associated. We're going to have to force the other on to 00:38:44.389-->00:38:49.394 associate as well. Sorry, I repeat that. And it's waiting for beacon frames so I'm going 00:38:56.835-->00:39:00.939 to fast forward through that. So, we've um, we've we've got the second victim. The second 00:39:00.939-->00:39:05.577 victim is now going to roam over to us. And you can see that there's some bad th..thought the 00:39:05.577-->00:39:10.515 IE weirdness happening in the background when you first connect. Um, but now we're going 00:39:10.515-->00:39:14.752 to take a payload and we're also going to grab the IP address of one of these victims and then 00:39:14.752-->00:39:20.859 feed it to our SMB relay script. So we're just going to copy and paste that over to our SMB relay 00:39:20.859-->00:39:26.030 script. Which we've done here. Now we're going to start it. At this point we're going to 00:39:26.030-->00:39:30.969 generate some HTTP traffic um on one of these machines uh just to make sure the SMB relay attack 00:39:30.969-->00:39:35.974 happens. So we're doing that here. And notice there that you see a lot of activity from the 00:39:37.976-->00:39:41.379 SMB relay terminal and then that's why that's because it's just the attack's actually 00:39:41.379-->00:39:45.049 executing. And now we just wait for the reversal there was a 45 second delay on the on on the 00:39:45.049-->00:39:48.653 payload. Uh so you're just going to have to, I'm going to kind of skip a little bit, but I want to 00:39:48.653-->00:39:51.923 see you guys.. I want you guys to see the other connecting. There it is! That green text. 00:39:51.923-->00:39:55.927 That's our that's our initial payload. So now what the scenario that we have is that we 00:39:55.927-->00:40:01.232 have two um two devices that are associated with our rogue access point attack and we've used SMB 00:40:01.232-->00:40:07.538 relay to uh gain a schel on one. So now that we've pivoted into one of them, uh, we're going to 00:40:07.538-->00:40:11.876 use the persistence module uh from empire. Uh for for illustrator purposes schedule 00:40:11.876-->00:40:15.913 tasks work works very nicely for this, although it's also really loud. It touches disks so so in 00:40:15.913-->00:40:19.817 a real scenario you want to use something that lives purely in memory. But I like scheduled 00:40:19.817-->00:40:24.822 tasks because it's like easy to explain uh for doing for doing like a talk. So. And and you can 00:40:28.926-->00:40:32.230 see now we we've executed the the command hostname and the command who am I. We have entity 00:40:32.230-->00:40:38.970 authority pri..privileges on Jenkins up here on the top left. So, we're we're going to execute 00:40:38.970-->00:40:43.474 the scheduled task and we're going to set the timer for for 2 minutes in the future. And you 00:40:43.474-->00:40:46.844 know something really interesting happened when I when I was recording this. Um, I 00:40:46.844-->00:40:53.318 actually forgot connect the uh uh attach the the the virtual interface that was attached to 00:40:53.318-->00:40:59.490 my USB wifi adapter for the for the for the the nick that was connected to uh the the the 00:40:59.490-->00:41:02.794 target network. Uh, so I was going to start clearing this just just like start the 00:41:02.794-->00:41:06.764 recording over and over again. But something very interesting happened and that's when I um uh 00:41:06.764-->00:41:11.502 I actually had set 160 retries on that reverse schel. Uh for some reason that I that I don't 00:41:11.502-->00:41:17.075 know why it did that but, um. So one, the second I reattached it the reverse schel just suddenly 00:41:17.075-->00:41:20.011 appeared and suddenly worked. So I thought that was kind of cool so I left it in there. And it 00:41:20.011-->00:41:23.848 kind of proves an interesting point about um you know good implants is that they'll kinds 00:41:23.848-->00:41:27.352 of doggedly try to you know get back to the attacker even if they don't can't immediately do 00:41:27.352-->00:41:32.357 so. But, yeah. You'r we're going to fast forward a little bit. And you see here that we've 00:41:35.760-->00:41:40.765 executed the uh, the scheduled task... and..I'm sure you don't want to sit here. You can see me 00:41:44.002-->00:41:47.405 wiggling my mouse because I was totally bored waiting for this task to execute and I'm not 00:41:47.405-->00:41:51.209 going to do that to you guys as well. So I'm going to try to loop through that as much as I 00:41:51.209-->00:41:57.548 can. Alright. At at some point this is when I realize that oh, yeah, I didn't connect this 00:41:57.548-->00:42:02.487 thing. So I I fixed the problem by attaching the network adaptor. So very, very jerk 00:42:05.490-->00:42:07.492 moment there. Um, and then I started getting ready to to uh start this recording all over 00:42:07.492-->00:42:09.494 again. Right? So I started cleaning the terminals and then I go back to um to empire here 00:42:09.494-->00:42:14.499 and I start going back to the main menu and oh, wait! There's the reverse schel. Alright, so 00:42:22.707-->00:42:26.811 now we've received the second reverse schel this time on the target network and we've now now 00:42:26.811-->00:42:30.848 can use this. Uh we're going to interact with that that that agent that's now living on the 00:42:30.848-->00:42:35.853 target machine and we've we've just pivoted into you know from one VLEN to the other. So, 00:42:40.091-->00:42:43.428 that's indirect wire wireless pivot and the equivalent technique, I mean it's actually 00:42:43.428-->00:42:46.431 really like straightforward. It's not very complicated. The equivalent technique in a wired 00:42:46.431-->00:42:50.601 network would be to unplug an authorized device from the wall and just connect it to a hostile 00:42:50.601-->00:42:54.972 network on which you can actually attack it. And you know um the reason you could do this 00:42:54.972-->00:42:58.676 is because port-based access controls uh they rely on the assumption that the physical 00:42:58.676-->00:43:02.880 layer can be trusted. In a wireless network, uh, WPA is the uh means through which the 00:43:02.880-->00:43:07.985 integrity of the physical layer is protected. So if you're using a weak form of WPA2-EAP uh the 00:43:07.985-->00:43:11.456 attacker can actually freely control the physical layer using rogue access point attacks and 00:43:11.456-->00:43:16.661 this renders port-based MAC NAC mechanisms useless. So what this demonstrates is that ports 00:43:16.661-->00:43:21.599 port-based NAC mechanisms uh do not effectively mitigate the risk presented by weak WPA2-EAP 00:43:21.599-->00:43:25.736 implementations. Um, furthermore, uh it demonstrates that adding port-based NAC 00:43:25.736-->00:43:29.974 mechanisms to a wireless network does not make the use of EAP-TTLS or EAP-PEAP any less 00:43:29.974-->00:43:34.612 in..inappropriate if the network is question is used to grant access to sensitive information. 00:43:34.612-->00:43:40.685 And finally, um, um uh yeah, oh well. Finally, finally, OK. I guess this is another... I 00:43:40.685-->00:43:45.122 thought there was another slide there. Whatever. OK so um yeah. So by the way when we're talking 00:43:45.122-->00:43:49.093 about sensitive information..heh heh, it's Sunday. Um when when we talk about sensitive 00:43:49.093-->00:43:53.531 information um, we're usually referring to PCI or HIPAA data. Uh, but you know. It's important 00:43:53.531-->00:43:58.269 to remember that compliance doesn't necessarily you know mean security. So I'm going to 00:43:58.269-->00:44:03.074 make like one last case for EAP-TLS. Um it it it it still is pretty painful, but it's not as 00:44:03.074-->00:44:07.044 bad as it used to be. Uh, you can use a group policy to configure 802 dot1x clients. And 00:44:07.044-->00:44:11.582 that I think that's pretty cool. I I think your best options is to use a private CA. Uh, you 00:44:11.582-->00:44:14.752 know you can you can lev..leverage active directory to deploy EAP-TLS. And if you 00:44:14.752-->00:44:19.891 have a a BYOD um processes that you have to worry about uh for that you could just use a solid 00:44:19.891-->00:44:24.996 MDM solution. Um, or or even just you know relay your BY on your onboarding solution uh to 00:44:24.996-->00:44:30.301 make that work. You can even use let's encrypt to to employ EAP-TLS. Although, to be honest 00:44:30.301-->00:44:33.604 even the folks at let's encrypt state that this is far from the best solution out there. As in 00:44:33.604-->00:44:39.844 like you can technically do this, but.. Uh so just some closing thoughts. Uh just 00:44:39.844-->00:44:43.548 because you know wireless and wire wired networks operate similarly at the logical level 00:44:43.548-->00:44:48.185 and and that's that's by design. You you want you don't want to have to uh fundamentally think 00:44:48.185-->00:44:52.089 about your networks differently depending on what what physical medium you're working with. Um 00:44:52.089-->00:44:56.060 that that does not mean that they work the same way at the physical level. And you know um 00:44:56.060-->00:44:59.397 you have to remember that when we're designing uh security mechanisms that are designed to 00:44:59.397-->00:45:03.768 protect these things. And also as a community, uh we should really question whether or not 00:45:03.768-->00:45:07.738 it is a sound business decision to neglect EAP-TLS in favor of a more reactive approach that 00:45:07.738-->00:45:13.144 focussed on access control or threat containment. And you know finally, um if if there's one 00:45:13.144-->00:45:16.581 thing to take away from this is that needs for convenience and security are often you know at 00:45:16.581-->00:45:20.084 odds with one another. You know, be honest with yourselves. Maintain a healthy skepticism 00:45:20.084-->00:45:23.921 toward proposed solutions that promise both. And if you want to check out the attacks and try to 00:45:23.921-->00:45:28.125 implement them yourself uh, relevant the the tool question is github dot com slash solstice 00:45:28.125-->00:45:33.130 slash eap hammer. And that's it. Thank you [applause]