1 00:00:00,000 --> 00:00:03,520 You gave a workshop, what, a couple of days ago? 2 00:00:04,360 --> 00:00:12,000 You gave it yesterday, and you'll also be on the big stage tomorrow, right? 3 00:00:12,840 --> 00:00:13,900 Tomorrow afternoon. 4 00:00:14,600 --> 00:00:15,580 Tomorrow afternoon. 5 00:00:16,060 --> 00:00:24,220 And, you know, it's a very good one, too, to start off the Saturday at the speaker workshops. 6 00:00:25,860 --> 00:00:31,920 And it is, give me the, actually, I'm not sure. 7 00:00:32,020 --> 00:00:36,040 I'm just going to wait for it, wait for it, wait for it, and mute the mic. 8 00:00:42,660 --> 00:00:43,920 I mean, don't worry about it. 9 00:00:43,980 --> 00:00:44,740 This is pretty common. 10 00:00:45,200 --> 00:00:49,100 We're really right on schedule, like on the dot, which is excellent. 11 00:00:50,240 --> 00:00:52,440 Story yesterday, I don't know if anyone caught it yesterday. 12 00:00:52,520 --> 00:00:53,380 We had a... 13 00:00:54,220 --> 00:00:58,320 We had plenty of AV issues, but one of the more, the worst one was, 14 00:00:58,380 --> 00:01:04,820 imagine if you bring in a work laptop from, I'm not going to name who the company is, 15 00:01:05,880 --> 00:01:11,380 and imagine that the company laptop you're trying to use for the presentation got everything locked down. 16 00:01:11,720 --> 00:01:20,000 No devices, no Ethernet, no USB, and you can't even get your laptop working on one of these things. 17 00:01:20,480 --> 00:01:24,040 How in the world are you ever going to be able to, I mean, it was like the most wonderful, 18 00:01:24,080 --> 00:01:24,200 the most wonderful thing. 19 00:01:24,200 --> 00:01:29,500 Lockdown machines, like, basically, it's normal to a point where it's useless, and we had a 15-minute delay. 20 00:01:29,760 --> 00:01:30,960 Nothing could be worse than that. 21 00:01:31,200 --> 00:01:37,680 I think we're, but I think we're ready, but without much ado, it is absolutely my pleasure to introduce you to Gabriel Ryan. 22 00:01:44,860 --> 00:01:46,000 How you doing, everyone? 23 00:01:48,660 --> 00:01:51,160 You guys recovered from last night? 24 00:01:51,940 --> 00:01:53,560 Not yet, still working on it? 25 00:01:54,200 --> 00:01:54,540 It's all right. 26 00:01:58,000 --> 00:02:00,660 Whoa, wait a minute. 27 00:02:04,120 --> 00:02:05,500 I have to do some slide shenanigans. 28 00:02:08,420 --> 00:02:11,420 This might be the wrong slide deck, but it's okay. 29 00:02:11,620 --> 00:02:13,500 I have it, the other one, like, right here. 30 00:02:17,740 --> 00:02:18,460 Uh-oh. 31 00:02:22,740 --> 00:02:23,280 It's okay. 32 00:02:23,400 --> 00:02:24,100 This actually, 33 00:02:24,200 --> 00:02:25,600 this isn't the demo gods, it's the slide gods. 34 00:02:26,060 --> 00:02:30,560 So, I mean, if I can just settle for the slide gods, that's, I mean, I can deal with that. 35 00:02:31,300 --> 00:02:35,680 But as long as this, does this have, does this have everything that we need? 36 00:02:35,780 --> 00:02:36,180 Yes, it does. 37 00:02:36,360 --> 00:02:36,580 Okay. 38 00:02:37,340 --> 00:02:42,320 Next year, I think we're going to have a, you know what, this reminds me, I think next year we're going to have bingo cards. 39 00:02:42,600 --> 00:02:49,100 Like, you know, if people have AV issues, speakers have AV issues, you know, say, if someone brings alcohol and says, 40 00:02:49,200 --> 00:02:50,500 push this, we get off it. 41 00:02:50,640 --> 00:02:50,920 We go? 42 00:02:50,920 --> 00:02:55,420 I mean, we could just do, like, the DEFCON AV issues drinking game. 43 00:02:55,620 --> 00:02:56,280 Eh, it's not. 44 00:02:57,100 --> 00:02:59,220 Because I don't think any of us would make it out of this room, so. 45 00:03:01,000 --> 00:03:01,520 All right. 46 00:03:01,580 --> 00:03:03,840 So, disclaimer. 47 00:03:04,040 --> 00:03:04,180 Okay. 48 00:03:04,260 --> 00:03:05,320 So, my name is Gabriel Ryan. 49 00:03:06,000 --> 00:03:07,840 I'm a security engineer at Gotham Digital Science. 50 00:03:08,260 --> 00:03:11,000 We're a New York and London-based security consulting company. 51 00:03:11,820 --> 00:03:14,400 Just do infrastructure testing, red teaming. 52 00:03:15,460 --> 00:03:17,280 I'm not going to drive this part out too long, because time. 53 00:03:18,880 --> 00:03:20,280 So, new stuff in this presentation. 54 00:03:21,480 --> 00:03:25,500 So, we're going to be looking at a couple of new attacks today, which, I mean, really are just kind of, like, 55 00:03:25,560 --> 00:03:30,620 building off of, like, the previous, you know, 15 years of rogue X1 attacks and just kind of adding a little bit to the top of that 56 00:03:31,620 --> 00:03:32,860 and just doing some new stuff. 57 00:03:33,000 --> 00:03:37,800 So, we're going to be talking about hostile portal attacks, in which you can actually steal Active Directory credentials 58 00:03:37,800 --> 00:03:40,060 without actually being associated with the network, which is pretty cool. 59 00:03:40,440 --> 00:03:47,540 And we're going to look at indirect wireless pivots, which is a way of bypassing port-based access control mechanisms on wireless networks. 60 00:03:48,660 --> 00:03:50,900 But before we talk about any of this stuff, we need to talk about WPB. 61 00:03:50,920 --> 00:03:51,560 WPBA2 EAP. 62 00:03:52,160 --> 00:03:56,100 Reason being, it's kind of the background info that we need to understand everything that we're going to be doing later in this talk. 63 00:03:56,560 --> 00:03:58,760 So, anybody here familiar with rogue X1 attacks? 64 00:04:00,060 --> 00:04:01,780 Okay, about 50-50. 65 00:04:02,580 --> 00:04:06,180 So, rogue X1 attacks, I mean, they're the bread and butter of modern wireless penetration tests. 66 00:04:06,380 --> 00:04:11,840 You can use it for all kinds of cool stuff, including stealing radius credentials, performing really, really stealthy man-in-the-middle attacks, 67 00:04:12,520 --> 00:04:16,040 you know, making, like, little fake phishing logging portal things, et cetera. 68 00:04:16,140 --> 00:04:17,820 If you ever use a pineapple, that's the kind of attack they use. 69 00:04:18,660 --> 00:04:20,440 There are a lot of different kinds of rogue AP attacks. 70 00:04:20,920 --> 00:04:23,000 I mean, the most basic one is the evil twin attack. 71 00:04:23,680 --> 00:04:28,200 So, let's say that we are, we have this access point, DEF CON open, and it's operating on channel 6. 72 00:04:28,280 --> 00:04:30,120 We have these four clients that are associated with it. 73 00:04:31,520 --> 00:04:35,360 So, let's say that we were to, an attacker were to create, can you guys hear? 74 00:04:36,560 --> 00:04:37,380 Can you guys hear now? 75 00:04:37,540 --> 00:04:38,640 Oh, this is a really directional mic. 76 00:04:38,940 --> 00:04:40,460 Okay, so I've got to hold it like this the whole time. 77 00:04:40,620 --> 00:04:40,900 Cool. 78 00:04:41,360 --> 00:04:41,640 Awesome. 79 00:04:43,900 --> 00:04:45,840 So, we're going to walk around just kind of like, all right. 80 00:04:46,180 --> 00:04:46,580 All right. 81 00:04:46,620 --> 00:04:49,060 So, I'll just pick up. 82 00:04:49,120 --> 00:04:49,240 Okay. 83 00:04:49,280 --> 00:04:50,900 So, the first thing we're going to talk about are, like, rogue X1s. 84 00:04:50,920 --> 00:04:51,260 Rogue X1 attacks. 85 00:04:51,420 --> 00:04:53,700 Just going to repeat that section because I wasn't, yeah. 86 00:04:55,660 --> 00:04:58,940 So, let's say that we have this access point here, DEF CON open. 87 00:04:59,080 --> 00:05:00,000 It's operating on channel 6. 88 00:05:00,220 --> 00:05:03,160 And we have these four clients associated with it. 89 00:05:04,200 --> 00:05:09,780 And, you know, let's say that an attacker were to create an access point that was an exact duplicate of that. 90 00:05:09,920 --> 00:05:11,560 So, same ESS ID, same channel. 91 00:05:12,020 --> 00:05:17,480 Do you guys know how, show of hands, do you guys know how these clients would be able to distinguish between the two access points? 92 00:05:19,240 --> 00:05:19,800 Signal strength. 93 00:05:20,360 --> 00:05:20,720 Yeah. 94 00:05:20,920 --> 00:05:25,600 So, like, if the attacker just creates another access point that is these exact same attributes, 95 00:05:26,140 --> 00:05:31,780 but is able to amplify the gain on that ever so slightly stronger than the target access point, 96 00:05:31,880 --> 00:05:35,960 all these clients will actually drop their connections and connect to the attacker. 97 00:05:36,260 --> 00:05:39,480 So, of course, from here, you have a bunch of stuff connected to you, and you are a router, 98 00:05:39,540 --> 00:05:42,480 and you can do man-in-the-middle attacks, all this really, really delicious, awesome stuff. 99 00:05:42,820 --> 00:05:44,780 And these have been around for, like, a really long time. 100 00:05:45,300 --> 00:05:47,960 Actually, the first documented case that I could find was in 2002. 101 00:05:49,080 --> 00:05:50,840 You know, this FAQ on how to make wireless. 102 00:05:51,900 --> 00:05:55,340 Land security more secure, and that was by C.W. Klaus. 103 00:05:55,700 --> 00:05:58,960 Of course, in 2003, we had the classic ASleep tool by Josh Wright. 104 00:05:59,420 --> 00:06:02,260 Moving forward a bit, we have Karma attacks, which are a more sophisticated attack, 105 00:06:02,680 --> 00:06:04,940 which we're not actually going to talk about today, but worth looking into, 106 00:06:05,140 --> 00:06:07,480 by Dino Diazovi and Shane McCauley. 107 00:06:07,540 --> 00:06:08,040 That was in 2004. 108 00:06:08,540 --> 00:06:13,200 And then, of course, in 2008, we have, and this is where we actually start building off of, 109 00:06:13,240 --> 00:06:17,260 Free Radius WPE by Josh Wright and Brad Antonowitz. 110 00:06:17,420 --> 00:06:18,320 Very classic tool. 111 00:06:18,580 --> 00:06:20,760 And then, of course, back in DEF CON 2013, 112 00:06:20,840 --> 00:06:24,940 2022, you know, 2014, this was actually the talk that got me into Wi-Fi. 113 00:06:25,660 --> 00:06:28,960 We have improved Karma attacks by Dom White and Ian DeVilliers, 114 00:06:29,020 --> 00:06:31,900 because, you know, at this point, Karma had actually been broken for a while, 115 00:06:31,940 --> 00:06:32,520 and they managed to fix it. 116 00:06:33,060 --> 00:06:35,460 And they also did some EAP stuff that we're going to be building off of as well. 117 00:06:35,680 --> 00:06:40,780 And then 2017, very recently, we had Lure 10 by the guy who wrote Wi-Fi Fisher. 118 00:06:41,080 --> 00:06:45,640 And this was, this is actually a way of, like, exploiting Wi-Fi sense in Windows 10 119 00:06:45,640 --> 00:06:47,680 to get stuff to connect to you. 120 00:06:47,800 --> 00:06:50,520 So, as you can see, these attacks have been around for a really, really long time. 121 00:06:50,840 --> 00:06:53,400 And, you know, they haven't really found a way of fixing this with open networks. 122 00:06:53,540 --> 00:06:57,780 So, pretty much the thing that you use to prevent these attacks is your WPA. 123 00:06:58,000 --> 00:07:00,140 And we're going to look into that further today. 124 00:07:02,140 --> 00:07:05,160 So, traditionally, rogue AP attacks have been used to fill two basic roles. 125 00:07:05,680 --> 00:07:07,960 You know, man-in-the-middle attacks, which is stealing creds, 126 00:07:07,960 --> 00:07:11,520 and also gaining access to the wireless network. 127 00:07:11,880 --> 00:07:15,820 But in this talk, we're going to look into rogue AP attacks as a means of lateral movement, 128 00:07:16,860 --> 00:07:19,340 which is kind of newish, new, yeah. 129 00:07:20,840 --> 00:07:23,180 So, I mean, let's talk about evil twin attacks against WPA2 EAP. 130 00:07:23,380 --> 00:07:26,120 And to do this, we first actually have to cover EAP. 131 00:07:27,140 --> 00:07:28,200 Anybody know what EAP is? 132 00:07:29,140 --> 00:07:29,900 Or how it works? 133 00:07:30,040 --> 00:07:32,880 Okay, so EAP is the, and for those of you who do know how this works, 134 00:07:33,200 --> 00:07:35,060 yes, I'm going to oversimplify this for, like, two minutes, 135 00:07:35,120 --> 00:07:36,920 but I'm going to actually go into the full definition later. 136 00:07:37,340 --> 00:07:38,040 So bear with me. 137 00:07:38,460 --> 00:07:42,340 Logically, EAP, it's an authentication process that occurs between the supplicant 138 00:07:42,340 --> 00:07:43,020 and the authentication server. 139 00:07:43,160 --> 00:07:43,720 What is the supplicant? 140 00:07:43,840 --> 00:07:46,440 The supplicant is just a fancy way of talking about your wireless client. 141 00:07:46,660 --> 00:07:49,700 And the authentication server is like your radio server running in the back end. 142 00:07:50,840 --> 00:07:54,280 So the first stage of EAP, if we're talking about EAP-PEEP and EAP-TTLS, 143 00:07:54,340 --> 00:07:56,000 which is what we're focusing on today, 144 00:07:57,420 --> 00:08:01,280 the first stage of this is that the client makes an authentication request 145 00:08:01,280 --> 00:08:02,980 to the authentication server. 146 00:08:03,240 --> 00:08:07,260 And at this point, the authentication server responds to an X509 certificate. 147 00:08:07,640 --> 00:08:11,040 And the goal of, you know, the reason why it responds to this X509 certificate 148 00:08:11,040 --> 00:08:13,880 is the authentication server needs to be able to prove to the client 149 00:08:13,880 --> 00:08:15,500 that it is who it says it is, right? 150 00:08:15,580 --> 00:08:17,860 Otherwise, you don't know what you're actually connecting to or authenticating with. 151 00:08:18,100 --> 00:08:20,480 So at this point, if the client accepts that certificate, 152 00:08:20,840 --> 00:08:24,220 it's valid, which is essentially saying that it trusts the authentication server. 153 00:08:24,780 --> 00:08:27,420 We've moved from, we were just at the outer, 154 00:08:27,480 --> 00:08:30,340 what we call the outer layer of EAP authentication 155 00:08:30,340 --> 00:08:33,500 to the inner authentication protocol. 156 00:08:34,100 --> 00:08:36,560 And what that is, essentially, we set up a secure tunnel 157 00:08:36,560 --> 00:08:38,240 between the client and the authentication server, 158 00:08:38,400 --> 00:08:41,400 and all authentication process happens through there. 159 00:08:43,900 --> 00:08:47,020 So, you know, the reason why, by the way, we use a secure tunnel 160 00:08:47,020 --> 00:08:50,340 is that without it, this entire authentication process can be sniffed. 161 00:08:50,840 --> 00:08:54,540 Remember that, you know, regardless of the fact that this is WPA2 EAP, 162 00:08:55,020 --> 00:08:58,040 the EAP is actually what we're using as the authentication mechanism. 163 00:08:58,200 --> 00:09:00,820 That means that the WPA, the encryption from that, 164 00:09:00,860 --> 00:09:03,580 doesn't actually kick in until after authentication finishes. 165 00:09:03,860 --> 00:09:07,200 So up until this entire process finishes right here, 166 00:09:07,880 --> 00:09:10,080 what we're actually looking at is an open access point. 167 00:09:10,200 --> 00:09:11,440 So this is all, like, open. 168 00:09:11,660 --> 00:09:15,740 And without that secure tunnel, you can just sniff the credentials, right? 169 00:09:16,240 --> 00:09:19,480 So, in fact, legacy implementations of EAP were very susceptible to this. 170 00:09:20,100 --> 00:09:20,820 You know, EAP... 171 00:09:20,840 --> 00:09:22,700 EAP-MD5 is a really good example that comes to mind. 172 00:09:24,200 --> 00:09:27,280 So when I mentioned that there were, like, two components to the EAP authentication process, 173 00:09:28,360 --> 00:09:29,420 I kind of... 174 00:09:29,420 --> 00:09:31,000 That was a bit of a simplification. 175 00:09:31,180 --> 00:09:31,900 There are actually three, right? 176 00:09:32,020 --> 00:09:34,160 There is a supplicant in the authentication server, 177 00:09:34,280 --> 00:09:38,000 or that is the wireless client and the RADIUS server in the background. 178 00:09:38,120 --> 00:09:41,840 But there's this intermediary that has to be between the two of them 179 00:09:41,840 --> 00:09:43,660 in order to make this work, and that's the authenticator, 180 00:09:44,100 --> 00:09:45,360 a.k.a. the access point. 181 00:09:45,600 --> 00:09:49,220 So, you know, in the back end, you have a RADIUS server, 182 00:09:49,320 --> 00:09:50,820 and at the very end, you have a WPA2 EAP. 183 00:09:50,820 --> 00:09:53,940 You know, at the front of it, you have the supplicant or the wireless client 184 00:09:53,940 --> 00:09:55,420 that's trying to authenticate with the RADIUS server, 185 00:09:55,520 --> 00:09:58,000 but all this communication has to go through the access point. 186 00:09:58,740 --> 00:10:01,080 You know, and, in fact, the communication between the supplicant and the access point 187 00:10:01,080 --> 00:10:01,920 is going over layer two, 188 00:10:02,280 --> 00:10:06,680 and, of course, the access point is communicating with the authentication server 189 00:10:07,580 --> 00:10:11,420 using RADIUS, which is higher up on the protocol stack, layer seven. 190 00:10:12,440 --> 00:10:16,640 So our complete picture of how EAP works kind of looks more like this, right? 191 00:10:16,920 --> 00:10:19,060 So you have the initial... 192 00:10:20,820 --> 00:10:23,560 The client is sending the authentication request to the authenticator, 193 00:10:23,660 --> 00:10:25,900 and then, you know, once again, you're getting this response, 194 00:10:26,060 --> 00:10:28,700 this X509 certificate, and that's coming from the authentication server, 195 00:10:28,820 --> 00:10:30,460 but it's being sent to the client by this AP. 196 00:10:30,840 --> 00:10:34,860 And at this point, you know, once again, the client has to accept the certificate, 197 00:10:35,580 --> 00:10:37,760 and, you know, if the client accepts the certificate, 198 00:10:37,880 --> 00:10:41,580 the secure tunnel's established, and, you know, the actual credentials, 199 00:10:41,820 --> 00:10:46,640 you know, the EAP challenge and response go through that secure tunnel. 200 00:10:48,040 --> 00:10:50,620 So remember that this authenticator is an open access point. 201 00:10:50,820 --> 00:10:51,880 Anybody see a problem with this yet? 202 00:10:52,020 --> 00:10:52,140 Whoops. 203 00:10:53,780 --> 00:10:54,340 No one? 204 00:10:56,120 --> 00:10:56,560 Okay. 205 00:10:56,920 --> 00:11:02,420 So remember that, you know, we were talking about earlier 206 00:11:02,420 --> 00:11:05,140 how open access points are susceptible to these evil twin attacks. 207 00:11:05,760 --> 00:11:09,760 Well, and up until this whole process finishes, this is an open access point. 208 00:11:09,900 --> 00:11:13,200 So what an attacker can do is actually, you know, 209 00:11:13,260 --> 00:11:17,240 use an evil twin attack to force the client to associate with the attacker 210 00:11:17,240 --> 00:11:18,880 and begin this authentication process. 211 00:11:19,120 --> 00:11:20,780 And then the attacker just runs a... 212 00:11:20,820 --> 00:11:21,980 the rogue radius server in the background, 213 00:11:22,660 --> 00:11:24,960 and, you know, goes through this entire authentication process. 214 00:11:25,060 --> 00:11:28,960 The first thing that happens is the victim is upsetting the auth request to the attacker. 215 00:11:29,120 --> 00:11:31,220 The attacker responds to the forged X509 certificate. 216 00:11:31,660 --> 00:11:34,900 At this point, the onus is on the user to reject the certificate, 217 00:11:35,040 --> 00:11:39,340 you know, barring situations where the client device is actually misconfigured 218 00:11:39,340 --> 00:11:41,160 and just blindly accepts invalid search, 219 00:11:41,320 --> 00:11:42,820 which that actually does happen quite a lot. 220 00:11:43,280 --> 00:11:44,760 But leaving aside that scenario, 221 00:11:45,800 --> 00:11:48,360 basically the responsibility is completely placed on the user 222 00:11:48,360 --> 00:11:50,800 to identify this as an invalid certificate, 223 00:11:50,820 --> 00:11:52,780 that they should not accept, and to reject it. 224 00:11:52,820 --> 00:11:53,740 If that does not happen, 225 00:11:54,980 --> 00:11:59,580 this inter-authentication process that goes through the secure tunnel 226 00:11:59,580 --> 00:12:00,760 actually happens with the attacker, 227 00:12:00,920 --> 00:12:03,100 then the attacker receives both the challenge and response 228 00:12:03,440 --> 00:12:05,520 that can be cracked offline to obtain credentials. 229 00:12:09,680 --> 00:12:11,820 So, I mean, I'm going to do two kinds of demos in this. 230 00:12:11,980 --> 00:12:14,040 Like, if it's just like a background demo, 231 00:12:14,640 --> 00:12:15,820 I'm not going to bother with the live stuff, 232 00:12:15,920 --> 00:12:16,920 because why tempt the demo gods? 233 00:12:17,120 --> 00:12:18,180 So this is going to be a video. 234 00:12:18,400 --> 00:12:20,160 I'm just going to get later on in this presentation, 235 00:12:20,380 --> 00:12:20,800 we're going to do... 236 00:12:20,820 --> 00:12:21,580 We're going to do more live stuff. 237 00:12:22,200 --> 00:12:23,500 But for the sake of time, 238 00:12:24,440 --> 00:12:26,060 this is what this attack would look like 239 00:12:26,060 --> 00:12:28,120 from the perspective of the attacker. 240 00:12:28,500 --> 00:12:29,280 So as you see here, 241 00:12:29,320 --> 00:12:33,280 the attacker is creating a forged certificate. 242 00:12:35,820 --> 00:12:37,840 And it's kind of filling in bogus values here. 243 00:12:38,740 --> 00:12:40,220 I'm going to kind of skip through this. 244 00:12:42,380 --> 00:12:42,900 Bless you. 245 00:12:43,720 --> 00:12:44,620 And at this point, 246 00:12:44,700 --> 00:12:49,240 the attacker is actually going to start up this rogue access point. 247 00:12:49,520 --> 00:12:50,560 And as you can see, 248 00:12:51,500 --> 00:12:52,920 at this point, we have this... 249 00:12:53,580 --> 00:12:55,180 We have a client, you know, where it says... 250 00:12:55,180 --> 00:12:56,020 If you see... 251 00:12:56,020 --> 00:12:56,520 I don't know if it's... 252 00:12:56,520 --> 00:12:58,080 It's probably pretty small from the back. 253 00:12:58,200 --> 00:12:58,900 I apologize for that. 254 00:12:59,040 --> 00:13:01,160 But you have a client that's associating with the attacker. 255 00:13:01,300 --> 00:13:02,200 And then there you go. 256 00:13:02,600 --> 00:13:04,240 You have credentials. 257 00:13:04,600 --> 00:13:06,160 Or not the credentials, but the challenge and response 258 00:13:06,160 --> 00:13:07,340 that can be used to obtain credentials. 259 00:13:08,140 --> 00:13:09,340 And then, of course, from there, 260 00:13:10,140 --> 00:13:11,540 you can crack this challenge and response 261 00:13:14,580 --> 00:13:15,140 using ASleep, 262 00:13:15,220 --> 00:13:16,500 which, by the way, as we mentioned, 263 00:13:16,620 --> 00:13:19,100 was, you know, came out, like, well over 10 years ago. 264 00:13:19,100 --> 00:13:22,200 And there you go. 265 00:13:22,260 --> 00:13:22,940 You have plain text credentials. 266 00:13:26,120 --> 00:13:27,160 So, that's pretty cool. 267 00:13:27,660 --> 00:13:30,000 You know, about the same time that this attack came out, 268 00:13:30,580 --> 00:13:31,840 have you guys heard of EAP-TLS? 269 00:13:32,740 --> 00:13:35,680 Or have you seen that form of WPA2 EAP 270 00:13:35,680 --> 00:13:38,700 where you have to put, like, a cert on every single machine? 271 00:13:39,160 --> 00:13:39,740 Have you heard of that? 272 00:13:39,860 --> 00:13:43,020 Yeah, so that protocol actually came out, 273 00:13:43,100 --> 00:13:44,740 I believe, in response to these attacks 274 00:13:44,740 --> 00:13:46,240 around the same time in 2008. 275 00:13:47,240 --> 00:13:48,820 And, you know, the idea is that 276 00:13:48,820 --> 00:13:49,080 you have to put a cert on every single machine. 277 00:13:49,100 --> 00:13:50,500 And, you know, because you're using mutual authentication, 278 00:13:50,800 --> 00:13:51,760 using X5-9 certificates, 279 00:13:52,440 --> 00:13:54,200 you know, from the get-go, 280 00:13:55,460 --> 00:13:56,720 none of this would work, right? 281 00:13:56,800 --> 00:13:58,280 Because the client would identify... 282 00:13:58,280 --> 00:14:00,760 It wouldn't even enter the first phase of the authentication. 283 00:14:01,300 --> 00:14:03,080 So, the strength really lies in these client-side certificates. 284 00:14:03,840 --> 00:14:05,280 Any network administrators out there? 285 00:14:06,620 --> 00:14:07,620 Anybody, like... 286 00:14:07,620 --> 00:14:09,780 I mean, raise your hand if you, like, 287 00:14:09,940 --> 00:14:11,080 think that, you know, 288 00:14:11,080 --> 00:14:12,840 putting a client-side certificate 289 00:14:12,840 --> 00:14:15,120 on every single device in your network sounds fun. 290 00:14:15,340 --> 00:14:16,300 Is this something that you'd like to do? 291 00:14:16,400 --> 00:14:17,040 Okay, we have one guy. 292 00:14:18,340 --> 00:14:20,260 But, I mean, so EAPTLS, 293 00:14:20,300 --> 00:14:21,160 although it protects against this, 294 00:14:21,260 --> 00:14:22,520 it's wildly unpopular. 295 00:14:22,740 --> 00:14:23,920 I mean, it's really arduous. 296 00:14:23,960 --> 00:14:25,580 You have to put one of these certs 297 00:14:25,580 --> 00:14:26,640 on every single device in your network. 298 00:14:26,760 --> 00:14:27,700 And not only that, you know, 299 00:14:27,720 --> 00:14:29,840 it's possible that you may have devices 300 00:14:29,840 --> 00:14:31,040 that aren't even compatible with this. 301 00:14:31,300 --> 00:14:33,120 I mean, especially, like, if you work, like, 302 00:14:33,120 --> 00:14:34,740 in healthcare or, you know, 303 00:14:34,740 --> 00:14:36,520 industrial control systems, stuff like that, 304 00:14:36,600 --> 00:14:38,660 they may not even support client-side certs. 305 00:14:38,760 --> 00:14:40,660 So, I mean, you run into this classic 306 00:14:40,660 --> 00:14:41,920 security versus convenience scenario 307 00:14:41,920 --> 00:14:44,480 where you're forced to choose between 308 00:14:45,060 --> 00:14:46,920 an authentication mechanism with a known weakness, 309 00:14:47,040 --> 00:14:49,440 or a highly secure authentication mechanism 310 00:14:49,440 --> 00:14:51,200 that is just really difficult to implement. 311 00:14:53,200 --> 00:14:54,220 So, of course, you know, 312 00:14:54,240 --> 00:14:56,380 anyone go to a certain other security conference 313 00:14:56,380 --> 00:14:57,840 with lots of vendors and flashing lights earlier? 314 00:14:58,880 --> 00:15:00,220 Yeah, so, like, of course, 315 00:15:00,240 --> 00:15:01,260 this creates a market gap. 316 00:15:01,680 --> 00:15:03,300 You know, someone is going to come in 317 00:15:03,300 --> 00:15:05,020 and try to create a product 318 00:15:05,440 --> 00:15:07,700 that can be used to compensate for these security issues 319 00:15:07,700 --> 00:15:09,440 while still being easy to use. 320 00:15:10,940 --> 00:15:12,840 So, and the current trend, actually, 321 00:15:12,860 --> 00:15:13,800 is to focus on breach containment 322 00:15:14,200 --> 00:15:15,120 rather than prevention. 323 00:15:15,680 --> 00:15:17,020 So, the idea is that, you know, 324 00:15:17,040 --> 00:15:19,040 yes, you acknowledge the risk associated with 325 00:15:19,780 --> 00:15:21,740 using EAPP or EAPTTLS, 326 00:15:21,780 --> 00:15:23,360 and that this network, you know, 327 00:15:23,380 --> 00:15:24,300 is vulnerable to these attacks, 328 00:15:24,520 --> 00:15:26,280 but the idea is that, you know, 329 00:15:26,280 --> 00:15:27,860 once the attacker gets on your wireless network, 330 00:15:28,000 --> 00:15:28,960 you immediately contain them 331 00:15:28,960 --> 00:15:30,820 and, you know, prevent them from accessing 332 00:15:30,820 --> 00:15:31,900 anything important. 333 00:15:34,000 --> 00:15:35,500 So, what we're going to explore today 334 00:15:35,500 --> 00:15:36,540 is whether this actually works. 335 00:15:41,180 --> 00:15:44,240 So, the, I guess the most common way 336 00:15:44,240 --> 00:15:44,960 of approaching this scenario 337 00:15:44,960 --> 00:15:46,480 is to use a network access control mechanism. 338 00:15:47,040 --> 00:15:48,560 And I'm just going to present to you guys 339 00:15:48,560 --> 00:15:50,220 this little cartoon before I continue. 340 00:15:54,840 --> 00:15:56,300 So, network access control mechanisms. 341 00:15:56,640 --> 00:15:57,800 I mean, this is like one of the most popular ways 342 00:15:57,800 --> 00:15:58,740 of containing wireless breaches. 343 00:15:58,960 --> 00:15:59,980 And the idea is that, you know, 344 00:15:59,980 --> 00:16:01,160 when a new device is added to the network, 345 00:16:01,260 --> 00:16:02,320 you immediately, you know, flag it 346 00:16:02,320 --> 00:16:04,000 as either authorized or unauthorized. 347 00:16:04,140 --> 00:16:05,600 If it's authorized, you let it continue 348 00:16:05,600 --> 00:16:06,880 and access stuff. 349 00:16:07,180 --> 00:16:08,540 And if it's unauthorized, 350 00:16:08,560 --> 00:16:09,920 you place it on a quarantine VLAN 351 00:16:09,920 --> 00:16:12,460 or flat out, you know, block the port 352 00:16:12,460 --> 00:16:14,760 and not, you know, disconnect it entirely. 353 00:16:15,860 --> 00:16:17,020 And it's not allowed to do that. 354 00:16:17,040 --> 00:16:17,300 It's not allowed to do anything. 355 00:16:19,580 --> 00:16:21,340 So, I mean, there's two ways of doing this. 356 00:16:21,480 --> 00:16:23,340 You know, there are two traditional varieties of NAC. 357 00:16:23,400 --> 00:16:24,740 Yes, there are next generation NACs 358 00:16:24,740 --> 00:16:25,700 and we'll talk about them more later. 359 00:16:26,000 --> 00:16:27,580 But traditionally, we've had two different kinds 360 00:16:27,580 --> 00:16:28,840 of network access control mechanism. 361 00:16:29,080 --> 00:16:30,740 We've had agent-based and agentless. 362 00:16:32,500 --> 00:16:34,040 So, with an agent-based NAC, 363 00:16:34,160 --> 00:16:35,620 you actually have a software component 364 00:16:35,620 --> 00:16:37,460 that's installed on every single author's endpoint. 365 00:16:37,840 --> 00:16:40,020 You know, this agent, the job of this agent 366 00:16:40,020 --> 00:16:41,540 is to communicate with the brain of the NAC 367 00:16:41,540 --> 00:16:42,940 and pretty much, you know, 368 00:16:42,980 --> 00:16:44,280 allow the brain of the NAC 369 00:16:44,280 --> 00:16:46,040 to perform deep interrogations on the endpoint. 370 00:16:47,200 --> 00:16:48,480 You know, it's really effective, 371 00:16:48,680 --> 00:16:49,440 but, you know, once again, 372 00:16:49,520 --> 00:16:50,900 you're in a situation where you have to install something 373 00:16:50,900 --> 00:16:52,120 on every device on the network. 374 00:16:52,460 --> 00:16:53,500 So, it's very impractical, 375 00:16:53,560 --> 00:16:54,460 kind of like the APTLS. 376 00:16:55,420 --> 00:16:56,680 You also have agentless NACs, 377 00:16:56,720 --> 00:16:58,260 which it just uses passive fingerprinting 378 00:16:58,260 --> 00:16:59,420 and also does, like, external scans 379 00:16:59,760 --> 00:17:01,820 to try to identify what's authorized and what's not. 380 00:17:02,400 --> 00:17:03,500 You know, as you can imagine, 381 00:17:03,540 --> 00:17:04,580 this is pretty easy to deploy, 382 00:17:05,100 --> 00:17:06,520 but, you know, you can't examine 383 00:17:06,520 --> 00:17:07,500 the internals of the devices, 384 00:17:08,500 --> 00:17:10,300 so it can be bypassed pretty easily 385 00:17:10,300 --> 00:17:12,380 by masquerading as something valid. 386 00:17:13,320 --> 00:17:14,260 So, you know, once again, 387 00:17:14,320 --> 00:17:15,200 you run into this recurring dilemma 388 00:17:15,200 --> 00:17:16,820 where, you know, you have a more, 389 00:17:16,820 --> 00:17:17,460 more insecure solution, 390 00:17:17,700 --> 00:17:18,640 but that's pretty practical, 391 00:17:18,840 --> 00:17:21,400 but you also have a very secure solution 392 00:17:21,400 --> 00:17:22,420 that's very impractical. 393 00:17:22,660 --> 00:17:23,560 So, we're kind of, you know, 394 00:17:23,580 --> 00:17:24,580 back to square one here. 395 00:17:24,740 --> 00:17:26,680 And, of course, this creates yet another market gap, 396 00:17:27,620 --> 00:17:29,140 you know, where there's this high demand 397 00:17:29,140 --> 00:17:30,540 for a solution that, you know, 398 00:17:30,540 --> 00:17:32,180 offers the deep interrogation capabilities 399 00:17:32,180 --> 00:17:33,700 of an agent-based NAC, 400 00:17:33,860 --> 00:17:36,120 but has the convenience of an agentless NAC. 401 00:17:37,520 --> 00:17:40,080 So, you know, this led to the rise 402 00:17:40,080 --> 00:17:42,020 of something called the next generation NAC, 403 00:17:42,060 --> 00:17:43,000 and there's a lot of different, 404 00:17:43,680 --> 00:17:46,000 there's a lot of different approaches 405 00:17:46,000 --> 00:17:46,640 that people have taken, 406 00:17:46,820 --> 00:17:47,960 and we're just going to explore one 407 00:17:47,960 --> 00:17:49,180 just to kind of, you know, as an example. 408 00:17:50,600 --> 00:17:51,880 So, there's a particular NAC 409 00:17:51,880 --> 00:17:52,560 that I wanted to bring in here 410 00:17:52,560 --> 00:17:53,180 to do a demo with. 411 00:17:54,460 --> 00:17:56,140 So, I actually tried to get approved 412 00:17:56,140 --> 00:17:56,940 to bring one here, 413 00:17:57,060 --> 00:18:00,080 so I put in a ticket to my company's IT department. 414 00:18:01,420 --> 00:18:03,860 Of course, these things cost $10,000 a pop. 415 00:18:04,280 --> 00:18:05,120 As you can imagine, 416 00:18:07,320 --> 00:18:08,880 yeah, that didn't go very well, 417 00:18:08,920 --> 00:18:09,600 but not only that, you know, 418 00:18:09,640 --> 00:18:10,820 our legal department just kind of said, 419 00:18:11,720 --> 00:18:13,140 yeah, you shouldn't go up, 420 00:18:13,580 --> 00:18:14,580 keep this vendor neutral. 421 00:18:14,740 --> 00:18:16,600 So, for the sake of keeping 422 00:18:16,600 --> 00:18:17,180 this vendor neutral, 423 00:18:17,300 --> 00:18:18,580 the vendor that we're going to talk about 424 00:18:18,580 --> 00:18:20,500 is going to be referred to as Vendor A, 425 00:18:20,680 --> 00:18:21,440 and if you're really curious 426 00:18:21,440 --> 00:18:22,140 and want to know, you know, 427 00:18:22,160 --> 00:18:23,060 who or what I'm talking about, 428 00:18:23,180 --> 00:18:23,760 do some research, 429 00:18:24,080 --> 00:18:25,120 you can probably figure it out, 430 00:18:25,220 --> 00:18:25,920 but I know nothing. 431 00:18:26,540 --> 00:18:28,180 So, you know, Vendor A uses, you know, 432 00:18:28,220 --> 00:18:29,660 a good example of a next generation NAC, 433 00:18:30,420 --> 00:18:32,320 and an approach to kind of like, 434 00:18:32,380 --> 00:18:33,780 you know, bridge this, you know, 435 00:18:33,780 --> 00:18:35,020 gap between agentless and agentless, 436 00:18:35,500 --> 00:18:36,740 agent-based and agentless solutions, 437 00:18:37,820 --> 00:18:38,580 is Vendor A. 438 00:18:38,660 --> 00:18:41,300 Vendor A uses WMI to interrogate new devices, 439 00:18:42,100 --> 00:18:43,620 and this allows it to, you know, 440 00:18:43,620 --> 00:18:45,000 to perform deep internal checks 441 00:18:45,000 --> 00:18:46,140 without using an agent. 442 00:18:46,600 --> 00:18:47,660 And to do this, 443 00:18:47,660 --> 00:18:49,020 it authenticates over S and B, 444 00:18:49,140 --> 00:18:51,320 using a single administrative service account, 445 00:18:51,420 --> 00:18:52,480 and this single administrative service account 446 00:18:53,000 --> 00:18:54,540 runs with, you know, pretty high privileges. 447 00:18:54,680 --> 00:18:56,460 I think it actually runs as DA, 448 00:18:56,680 --> 00:18:57,780 if I remember correctly, 449 00:18:58,000 --> 00:19:00,180 and this allows it to perform deep interrogations 450 00:19:00,180 --> 00:19:01,440 without the use of a network. 451 00:19:01,780 --> 00:19:03,900 Unfortunately, does anyone see a problem with this? 452 00:19:05,240 --> 00:19:06,760 Yeah, you have this single point of failure. 453 00:19:06,920 --> 00:19:08,080 You have this device that, you know, 454 00:19:08,080 --> 00:19:09,160 can access everything on the network 455 00:19:09,160 --> 00:19:09,860 with high privileges, 456 00:19:10,000 --> 00:19:12,020 and it's sending hashes to every new endpoint 457 00:19:12,020 --> 00:19:13,060 that accesses the network. 458 00:19:13,600 --> 00:19:15,180 So, you have Godmode hashes 459 00:19:15,180 --> 00:19:16,580 sent to any device that's got 460 00:19:16,580 --> 00:19:16,880 access to the network, 461 00:19:17,020 --> 00:19:18,180 and you have a single point of failure. 462 00:19:19,660 --> 00:19:20,560 So, background info, 463 00:19:21,020 --> 00:19:22,560 raise your hand if you do not know 464 00:19:22,560 --> 00:19:24,200 what an S and B relay attack is. 465 00:19:25,100 --> 00:19:25,420 Okay. 466 00:19:26,060 --> 00:19:27,420 What about those of you who do know 467 00:19:27,420 --> 00:19:28,420 what an S and B relay attack is? 468 00:19:28,440 --> 00:19:28,780 Raise your hand. 469 00:19:28,900 --> 00:19:30,220 Oh, there are a lot of undecided people here. 470 00:19:30,300 --> 00:19:30,500 Great. 471 00:19:32,520 --> 00:19:33,300 It's okay, it's early. 472 00:19:35,360 --> 00:19:36,860 So, you know, S and B relays, 473 00:19:36,920 --> 00:19:37,440 you know, pretty much, 474 00:19:37,520 --> 00:19:40,900 they take advantage of the NTLM protocol. 475 00:19:41,180 --> 00:19:42,320 You guys familiar with NTLM at all? 476 00:19:42,480 --> 00:19:44,560 It's a simple challenge response mechanism, 477 00:19:44,820 --> 00:19:45,620 very similar to PEEP, 478 00:19:45,660 --> 00:19:46,520 which is what we talked about earlier, 479 00:19:46,580 --> 00:19:47,980 and the way that this works, 480 00:19:49,120 --> 00:19:49,920 actually, I need two volunteers. 481 00:19:50,140 --> 00:19:50,940 You start with the tattoos. 482 00:19:51,860 --> 00:19:53,180 Okay, so you want to authenticate 483 00:19:53,180 --> 00:19:54,160 with that guy on the computer, right? 484 00:19:55,380 --> 00:19:56,540 So, what you're going to do is 485 00:19:56,540 --> 00:19:59,020 you're going to send him a plain text string, right? 486 00:20:00,240 --> 00:20:01,360 Or, actually, no, you're going to say, 487 00:20:01,380 --> 00:20:02,180 I want to authenticate with you, 488 00:20:02,220 --> 00:20:02,780 and you're going to say, okay, 489 00:20:03,780 --> 00:20:04,420 that's great, right? 490 00:20:05,280 --> 00:20:06,160 Here's a plain text string, 491 00:20:06,260 --> 00:20:07,760 encrypted for me using your password hash. 492 00:20:08,480 --> 00:20:09,400 And you're going to say, okay, 493 00:20:09,480 --> 00:20:10,520 you encrypted using password hash, 494 00:20:10,680 --> 00:20:11,580 send it back to him, 495 00:20:11,660 --> 00:20:13,580 and then at that point, you know, 496 00:20:13,600 --> 00:20:14,100 he's going to say, 497 00:20:14,180 --> 00:20:16,140 he's going to decrypt the encrypted string. 498 00:20:16,580 --> 00:20:17,220 Using your password hash, 499 00:20:17,420 --> 00:20:20,160 and if the decrypted string matches the original string, 500 00:20:20,860 --> 00:20:23,700 then the authentication attempt succeeds, right? 501 00:20:23,880 --> 00:20:25,020 Does everyone kind of get how that works? 502 00:20:25,920 --> 00:20:26,880 All right, that's NTLM, guys. 503 00:20:28,880 --> 00:20:30,660 So, no need to over-complicate it. 504 00:20:31,100 --> 00:20:32,560 So, with an SMB relay attack, 505 00:20:32,800 --> 00:20:33,720 okay, now I need three people. 506 00:20:33,940 --> 00:20:34,800 Can someone stand right there? 507 00:20:37,080 --> 00:20:37,780 Yes, excellent. 508 00:20:38,040 --> 00:20:40,160 And, actually, I'll tell you what, 509 00:20:40,620 --> 00:20:41,740 can you guys like pass it, 510 00:20:41,800 --> 00:20:42,340 I don't know what this is, 511 00:20:42,360 --> 00:20:42,940 but I'm going to borrow it. 512 00:20:43,540 --> 00:20:44,620 All right, can you head it to that? 513 00:20:45,160 --> 00:20:46,320 Yeah, so, now, 514 00:20:46,320 --> 00:20:47,980 you are going to attempt to authenticate with this dude. 515 00:20:48,240 --> 00:20:51,080 But the thing is, you think that he is him, right? 516 00:20:51,300 --> 00:20:54,280 So, you're going to pass your authentication attempt 517 00:20:54,280 --> 00:20:54,960 to him, right? 518 00:20:55,180 --> 00:20:57,260 And you're going to just pass it directly on to this dude. 519 00:20:58,760 --> 00:20:59,640 No, you're not going to keep it. 520 00:20:59,920 --> 00:21:02,700 And then you're going to pass it back to him, right? 521 00:21:03,340 --> 00:21:05,000 And that's the encrypted string you're passing back. 522 00:21:05,120 --> 00:21:06,340 You're going to, or the plain text string. 523 00:21:06,460 --> 00:21:07,500 You're going to encrypt it, 524 00:21:08,400 --> 00:21:09,580 and pass it back to this dude. 525 00:21:09,920 --> 00:21:10,560 Yes, exactly. 526 00:21:11,220 --> 00:21:13,080 And now you're going to just, you know, 527 00:21:13,080 --> 00:21:15,340 relay it back to the server, 528 00:21:15,460 --> 00:21:16,300 and you're going to decrypt it, 529 00:21:16,320 --> 00:21:17,380 and, is it good? 530 00:21:17,500 --> 00:21:19,020 It's good, okay, so you're going to pass it to this dude. 531 00:21:19,740 --> 00:21:22,080 And, oh, shoot, he's authenticated with him instead of him. 532 00:21:22,420 --> 00:21:23,700 And that's an SMB relay attack. 533 00:21:24,140 --> 00:21:26,020 And, you know, you can kind of explain this 534 00:21:26,020 --> 00:21:27,040 using diagrams, too, but, 535 00:21:27,100 --> 00:21:28,680 I mean, does everyone get SMB relay now? 536 00:21:29,520 --> 00:21:30,180 Okay, good stuff. 537 00:21:32,280 --> 00:21:34,240 So, you know, going back to, you know, 538 00:21:34,240 --> 00:21:35,960 these next generation NAGs, or this particular one, 539 00:21:36,380 --> 00:21:38,120 you know, of course, if you have everything authenticating, 540 00:21:38,160 --> 00:21:39,120 you know, using NTLM, 541 00:21:39,780 --> 00:21:41,140 then, and you're sending, you know, 542 00:21:41,200 --> 00:21:42,800 hashes to every new thing on the network, 543 00:21:43,300 --> 00:21:45,480 at this point, you have the risk of SMB relay attacks. 544 00:21:46,320 --> 00:21:47,140 Where you can just, you know, 545 00:21:47,840 --> 00:21:48,640 authenticate with the network, 546 00:21:48,800 --> 00:21:51,640 and wait for the hash to be sent to you, 547 00:21:51,680 --> 00:21:52,640 and then relay them to anything 548 00:21:52,640 --> 00:21:53,600 that you want to authenticate with. 549 00:21:54,240 --> 00:21:54,920 So that's bad. 550 00:21:55,320 --> 00:21:56,400 But you could also, you know, 551 00:21:56,400 --> 00:21:57,460 of course you could mitigate this 552 00:21:57,460 --> 00:22:00,020 by enabling something called SMB signing, 553 00:22:00,140 --> 00:22:01,220 which is where you digitally sign packets 554 00:22:01,220 --> 00:22:02,460 to confirm their authenticity. 555 00:22:04,780 --> 00:22:06,180 You know, but by default, 556 00:22:06,300 --> 00:22:08,560 this is actually disabled on Windows machines, 557 00:22:08,640 --> 00:22:09,680 except domain controllers. 558 00:22:10,020 --> 00:22:11,240 And that's because group policy 559 00:22:11,240 --> 00:22:12,540 is actually downloaded over SMB. 560 00:22:14,140 --> 00:22:16,300 So, you know, and the cool thing is, 561 00:22:16,320 --> 00:22:17,440 in this case, you don't actually need 562 00:22:17,440 --> 00:22:18,040 a man-in-the-middle attack, 563 00:22:18,160 --> 00:22:19,220 because the NAC appliance is trying 564 00:22:19,220 --> 00:22:19,860 to authenticate with you. 565 00:22:20,260 --> 00:22:21,760 Of course, you know, if you do turn it on, 566 00:22:21,860 --> 00:22:25,180 it'll, SMB signing on, it will mitigate this issue. 567 00:22:26,160 --> 00:22:27,820 But you still have a situation where you have, 568 00:22:28,660 --> 00:22:30,480 you know, hashes being directly sent 569 00:22:30,480 --> 00:22:32,080 to untrusted endpoints. 570 00:22:34,140 --> 00:22:35,360 So, I guess, you know, 571 00:22:36,360 --> 00:22:37,700 that wasn't just a tangent for a reason. 572 00:22:37,740 --> 00:22:38,860 I mean, this tangent actually serves a purpose, 573 00:22:38,940 --> 00:22:39,860 and that's to show that, you know, 574 00:22:39,900 --> 00:22:40,940 there really is no magic bullet. 575 00:22:41,060 --> 00:22:42,340 I mean, here's actually a really solid attempt 576 00:22:42,340 --> 00:22:43,960 to kind of bridge these gaps 577 00:22:43,960 --> 00:22:44,840 between security and convenience. 578 00:22:44,980 --> 00:22:46,000 But unfortunately, the problem is 579 00:22:46,000 --> 00:22:48,180 that security with convenience is often a paradox. 580 00:22:49,000 --> 00:22:50,880 And, you know, that goes right back 581 00:22:50,880 --> 00:22:51,940 to the issue of EAP-TLS, 582 00:22:52,000 --> 00:22:54,640 which we're gonna look at later on. 583 00:22:57,140 --> 00:22:58,680 So, let's talk about client isolation. 584 00:22:58,940 --> 00:23:00,200 Are any of you familiar with it? 585 00:23:00,500 --> 00:23:02,180 Have any of you tried to get on, like, 586 00:23:02,200 --> 00:23:04,440 a hotel network or something recently 587 00:23:04,440 --> 00:23:05,840 and tried to ping something and you couldn't? 588 00:23:06,080 --> 00:23:07,620 That's because client isolation's enabled. 589 00:23:08,700 --> 00:23:11,740 So, the way that 802.11 is supposed to work 590 00:23:11,740 --> 00:23:14,580 is that the AP is supposed to mediate all traffic 591 00:23:15,040 --> 00:23:15,960 between, you know, 592 00:23:16,000 --> 00:23:17,740 the clients associated with the AP 593 00:23:18,400 --> 00:23:20,460 and, you know, other endpoints of the network. 594 00:23:20,560 --> 00:23:21,740 So, for example, you have these two clients 595 00:23:21,740 --> 00:23:22,980 associated with this access point, 596 00:23:23,100 --> 00:23:25,420 and in theory, the AP's supposed to mediate 597 00:23:25,420 --> 00:23:26,900 all the packets going between these devices. 598 00:23:27,320 --> 00:23:29,060 So, to enable client isolation, 599 00:23:30,680 --> 00:23:32,500 you know, you basically just prevent, 600 00:23:32,680 --> 00:23:34,000 if you see a packet that's going 601 00:23:34,000 --> 00:23:35,140 from one of these client devices, 602 00:23:35,200 --> 00:23:36,360 and instead of going upstream, 603 00:23:36,540 --> 00:23:37,980 it's going to another device 604 00:23:37,980 --> 00:23:39,000 associated with the access point, 605 00:23:39,160 --> 00:23:41,640 you just deny it and don't let it through, right? 606 00:23:42,000 --> 00:23:44,340 And on a wired network, this is actually possible 607 00:23:44,340 --> 00:23:45,080 at the physical level. 608 00:23:45,080 --> 00:23:46,920 But the problem is that on a wireless network, 609 00:23:47,140 --> 00:23:48,840 client isolation is a logical control. 610 00:23:49,000 --> 00:23:50,100 It's not a physical control. 611 00:23:51,120 --> 00:23:52,820 So, you know, this raises the question, 612 00:23:53,040 --> 00:23:54,680 you know, how do you prevent radio transceivers 613 00:23:54,680 --> 00:23:56,160 from communicating with one another? 614 00:23:56,280 --> 00:23:57,140 And this awesome researcher, 615 00:23:58,340 --> 00:23:59,800 unfortunately, he's no longer with us, 616 00:23:59,880 --> 00:24:01,780 but this awesome researcher named Cedric Blancher, 617 00:24:01,860 --> 00:24:03,600 in 2005, his answer was, you can't. 618 00:24:04,140 --> 00:24:06,420 And, you know, he introduced this tool called Wi-Fi Tab. 619 00:24:07,020 --> 00:24:08,960 And this was first released by Cedric Blancher, 620 00:24:09,040 --> 00:24:10,680 as we mentioned, in 2005. 621 00:24:11,420 --> 00:24:12,940 So, once again, quite a long time ago. 622 00:24:13,080 --> 00:24:14,360 And it was revived more recently. 623 00:24:15,080 --> 00:24:16,880 By Oliver Lavery of Gotham Digital Science, 624 00:24:17,080 --> 00:24:17,980 way before my time. 625 00:24:19,540 --> 00:24:21,080 And, you know, the idea here is, 626 00:24:21,120 --> 00:24:22,400 what this does is it reads packets. 627 00:24:22,560 --> 00:24:23,800 It has a, you have two interfaces. 628 00:24:24,320 --> 00:24:26,100 A ton tab interface that's attached 629 00:24:26,100 --> 00:24:27,800 to a monitor mode interface. 630 00:24:28,040 --> 00:24:29,980 And this monitor mode interface just listens 631 00:24:29,980 --> 00:24:35,180 for packets coming from, to and from the AP, right? 632 00:24:35,440 --> 00:24:38,620 And, you know, when you see a packet being sent 633 00:24:38,620 --> 00:24:40,740 from the client to the AP, you inject the response 634 00:24:41,260 --> 00:24:42,860 as if it came from the access point. 635 00:24:43,080 --> 00:24:44,360 And this actually allows you 636 00:24:45,080 --> 00:24:45,340 to get the data in isolation. 637 00:24:48,140 --> 00:24:49,280 And, you know, of course, there were, 638 00:24:50,940 --> 00:24:52,520 there's some later tools that build off of this. 639 00:24:53,000 --> 00:24:54,580 Air Ton and G, it supports WEP. 640 00:24:54,720 --> 00:24:58,160 And, you know, T-CAP Ton and G, it supports WPA1. 641 00:24:58,400 --> 00:24:59,740 These are both part of the Aircrack Suite, 642 00:24:59,860 --> 00:25:00,780 if you were here earlier this morning. 643 00:25:02,720 --> 00:25:04,280 And actually, there is one that, apparently, 644 00:25:04,400 --> 00:25:06,460 you theoretically could use it against WPA2, 645 00:25:06,540 --> 00:25:09,120 although I don't believe it, called Hull 196. 646 00:25:10,320 --> 00:25:11,500 You know, it's worth mentioning, 647 00:25:11,580 --> 00:25:13,000 just because it's been talked about. 648 00:25:13,120 --> 00:25:15,060 But it's also, you know, a considerably important tool. 649 00:25:15,060 --> 00:25:16,200 And I think it'll be debatable whether it actually works. 650 00:25:16,440 --> 00:25:19,320 So, to kind of demonstrate how this, how this does its thing, 651 00:25:20,340 --> 00:25:21,540 let me just check the time really fast. 652 00:25:22,400 --> 00:25:23,760 Okay, we're doing decently, we've got to hurry. 653 00:25:26,400 --> 00:25:30,060 So, over here, we have, you know, the bottom right, 654 00:25:30,160 --> 00:25:31,820 we have one terminal, right? 655 00:25:31,920 --> 00:25:35,240 And this terminal is the host operating system. 656 00:25:35,380 --> 00:25:37,700 In the top right, we're going to create an access point. 657 00:25:38,140 --> 00:25:39,400 And this is going to be the access point 658 00:25:39,400 --> 00:25:41,060 that we're going to be, you know, 659 00:25:41,060 --> 00:25:42,280 the network that we're going to be attacking. 660 00:25:42,620 --> 00:25:43,380 And then on the left here, 661 00:25:45,740 --> 00:25:47,480 we have an attacker machine. 662 00:25:47,640 --> 00:25:49,040 This is an SSH into an attacking machine. 663 00:25:49,520 --> 00:25:50,920 So, what we're first going to do is, 664 00:25:50,940 --> 00:25:51,960 we're going to send five ping packets, 665 00:25:52,740 --> 00:25:55,520 you know, to the AP on this target network. 666 00:25:55,660 --> 00:25:57,500 And that's happening on the bottom right here. 667 00:25:57,800 --> 00:25:59,920 As you see, we sent five ping packets, 668 00:26:00,160 --> 00:26:01,180 and we have five responses. 669 00:26:01,760 --> 00:26:03,540 So, and then, why did that do that? 670 00:26:03,640 --> 00:26:03,820 Okay. 671 00:26:06,260 --> 00:26:06,780 There you go. 672 00:26:06,880 --> 00:26:08,220 Okay, so, and then on the left, 673 00:26:08,280 --> 00:26:09,780 we're going to, in this terminal here, 674 00:26:10,300 --> 00:26:11,700 we're going to run a tool called Wi-Fi Ping. 675 00:26:11,780 --> 00:26:13,360 And it's essentially a modified version of Wi-Fi tab 676 00:26:13,360 --> 00:26:13,840 that just sent, 677 00:26:15,060 --> 00:26:17,000 if there's an ICMP request that it sees, 678 00:26:17,140 --> 00:26:18,260 it'll send an ICMP response. 679 00:26:19,440 --> 00:26:21,620 So, it's a pretty good way to do a proof of concept of this. 680 00:26:21,920 --> 00:26:23,420 So, now, you know, on the bottom right, 681 00:26:23,480 --> 00:26:24,900 now that we're running this Wi-Fi Ping tool, 682 00:26:25,280 --> 00:26:27,280 you'll notice that we're doing the ping again. 683 00:26:27,380 --> 00:26:28,900 But this time, this time you can see, 684 00:26:29,000 --> 00:26:31,400 you know, although we sent five ICMP packets, 685 00:26:31,940 --> 00:26:33,640 we've received 10. 686 00:26:33,880 --> 00:26:34,520 And that's because, 687 00:26:35,320 --> 00:26:36,640 and you see all these warnings saying 688 00:26:36,640 --> 00:26:37,780 they're duplicate ICMP packets. 689 00:26:37,900 --> 00:26:39,060 And that's because we're actually sending packets 690 00:26:39,060 --> 00:26:40,520 to this device without even being associated 691 00:26:40,520 --> 00:26:41,020 to the network. 692 00:26:41,460 --> 00:26:42,840 So, that just kind of shows you how, 693 00:26:43,240 --> 00:26:44,880 you know, Wi-Fi client isolation 694 00:26:45,060 --> 00:26:45,860 can be bypassed. 695 00:26:46,160 --> 00:26:49,680 So, yeah, anyways, back to NACs, right? 696 00:26:49,840 --> 00:26:51,000 You know, some, food for thought. 697 00:26:52,440 --> 00:26:54,720 You know, we've been focusing on whether or not, 698 00:26:54,720 --> 00:26:57,600 you know, NACs in general are effective against, 699 00:26:57,640 --> 00:27:00,080 you know, stopping direct attacks, right? 700 00:27:00,220 --> 00:27:01,560 But, I mean, what if we're missing the point? 701 00:27:01,640 --> 00:27:04,000 And not approaching this the right way at all. 702 00:27:04,220 --> 00:27:06,060 The role of a NAC in containing a wireless breach 703 00:27:06,060 --> 00:27:08,120 is to prevent an attacker from accessing 704 00:27:08,120 --> 00:27:09,680 sensitive resources after the breach occurs. 705 00:27:10,080 --> 00:27:12,020 And, you know, unauthorized endpoints detected 706 00:27:12,020 --> 00:27:14,140 is either placed in quarantine or the port is blocked. 707 00:27:15,060 --> 00:27:18,300 When this happens on a physical or on a wired network, 708 00:27:18,420 --> 00:27:19,500 this is actually a physical restriction. 709 00:27:19,800 --> 00:27:21,020 So, it's pretty solid. 710 00:27:21,860 --> 00:27:23,000 But on a wireless network, 711 00:27:23,260 --> 00:27:25,040 this can only be a logical restriction. 712 00:27:26,020 --> 00:27:27,180 And more on this later. 713 00:27:28,320 --> 00:27:30,340 So, you know, I think to understand 714 00:27:30,340 --> 00:27:31,320 the implications of this, 715 00:27:31,420 --> 00:27:33,440 it's best to use an example scenario. 716 00:27:33,780 --> 00:27:35,200 You know, we're attacking a wireless network 717 00:27:35,200 --> 00:27:36,560 and it's used to access sensitive resources. 718 00:27:36,880 --> 00:27:38,000 And we've already breached the perimeter 719 00:27:38,000 --> 00:27:41,080 using the attack we did in the first part of this talk. 720 00:27:41,340 --> 00:27:42,240 This is us on the left. 721 00:27:42,280 --> 00:27:44,140 You know, we're an attacker on this quarantine VLAN. 722 00:27:44,140 --> 00:27:45,600 And on the right, we have the victim 723 00:27:45,600 --> 00:27:47,000 that's on this restricted VLAN. 724 00:27:48,160 --> 00:27:49,520 And we obviously, you know, 725 00:27:49,560 --> 00:27:50,900 we don't want to be on this quarantine VLAN. 726 00:27:51,000 --> 00:27:52,660 We want to be able to get over to this restricted VLAN 727 00:27:52,660 --> 00:27:54,940 and access, you know, the sensitive resources and stuff. 728 00:27:55,020 --> 00:27:56,460 Unfortunately, we've been flagged 729 00:27:56,460 --> 00:28:00,680 by this network access control mechanism as unauthorized. 730 00:28:00,840 --> 00:28:03,140 So, you know, we're kind of, you know, we've been jailed. 731 00:28:03,140 --> 00:28:03,820 We can't really do much. 732 00:28:04,800 --> 00:28:05,980 So, the question is how do we get out? 733 00:28:06,640 --> 00:28:07,840 Well, let's talk about some more stuff. 734 00:28:07,980 --> 00:28:09,180 Anybody here use Responder before? 735 00:28:10,400 --> 00:28:10,900 Okay, cool. 736 00:28:11,020 --> 00:28:12,540 So, I mean, some of you probably are familiar 737 00:28:12,540 --> 00:28:14,100 with LMNR or MBTN. 738 00:28:14,140 --> 00:28:14,380 That's poisoning. 739 00:28:14,900 --> 00:28:15,820 Once again, quick review. 740 00:28:16,600 --> 00:28:18,660 Who here knows how NetBios name resolution works? 741 00:28:20,080 --> 00:28:21,220 Okay, a couple people. 742 00:28:21,580 --> 00:28:23,440 All right, so, you know, quick refresher. 743 00:28:23,540 --> 00:28:25,000 The way NetBios name resolution works, 744 00:28:25,480 --> 00:28:27,560 you know, basically there's a cycle that goes through. 745 00:28:28,820 --> 00:28:30,940 The first thing that happens is that the Windows host 746 00:28:31,510 --> 00:28:33,500 checks the local cache of stuff 747 00:28:33,500 --> 00:28:35,700 that's previously sent information to. 748 00:28:36,280 --> 00:28:37,800 It'll also check the LM host file, 749 00:28:37,920 --> 00:28:39,860 which it has, it's a hard-coded file of, 750 00:28:39,920 --> 00:28:43,120 that resolves, you know, host names to IP addresses. 751 00:28:43,120 --> 00:28:46,140 If that fails, it'll use a local DNS 752 00:28:46,140 --> 00:28:47,900 to attempt to resolve these names. 753 00:28:48,140 --> 00:28:50,920 And finally, if all those options are exhausted, 754 00:28:51,040 --> 00:28:52,320 it'll fall back to two protocols that, 755 00:28:52,360 --> 00:28:54,160 although under the hood, work a bit differently 756 00:28:54,160 --> 00:28:55,820 from a higher-level logical perspective, 757 00:28:56,120 --> 00:28:58,220 and also in terms of the security implications 758 00:28:59,620 --> 00:29:00,600 associated with them, 759 00:29:02,880 --> 00:29:05,320 can be thought of as logically equivalent. 760 00:29:05,560 --> 00:29:07,080 And that's LMNR and MBTNS. 761 00:29:07,460 --> 00:29:11,080 And these protocols are best, you know, 762 00:29:11,080 --> 00:29:12,080 best understood through example. 763 00:29:12,080 --> 00:29:14,140 You know, let's say that you have two, you know, 764 00:29:14,160 --> 00:29:15,440 NetBios machines on the network, 765 00:29:15,540 --> 00:29:16,860 named Alice and Leroy. 766 00:29:16,980 --> 00:29:19,140 Alice wants to get a file from Leroy, 767 00:29:19,220 --> 00:29:20,880 but Alice does not know Leroy's IP. 768 00:29:21,200 --> 00:29:23,580 So Alice is first gonna exhaust those three options, right? 769 00:29:23,700 --> 00:29:25,980 You know, attempt local resolution, 770 00:29:26,080 --> 00:29:27,380 also try local DNS. 771 00:29:27,680 --> 00:29:30,500 And if that fails, Alice is going to, you know, 772 00:29:30,500 --> 00:29:33,060 make a broadcast request across the entire subnet 773 00:29:33,060 --> 00:29:34,460 using LMNR and MBTNS. 774 00:29:34,880 --> 00:29:37,100 So at this point, every computer on Alice's subnet 775 00:29:37,100 --> 00:29:38,500 is going to receive this request. 776 00:29:38,780 --> 00:29:41,540 And the idea here is that, despite all of them receiving it, 777 00:29:43,680 --> 00:29:44,920 only Leroy will respond. 778 00:29:45,620 --> 00:29:46,800 Does anyone see a problem with this? 779 00:29:48,000 --> 00:29:49,940 Yeah, so like, it's kind of an honor system. 780 00:29:50,200 --> 00:29:51,500 It's very similar to ARP, in fact. 781 00:29:52,640 --> 00:29:53,840 Although it came out like 10 years later, 782 00:29:53,920 --> 00:29:54,860 so I don't get it exactly. 783 00:29:56,480 --> 00:29:58,460 But the problem is, like, if Alice receives two responses, 784 00:29:59,260 --> 00:30:00,620 only the first one is considered valid. 785 00:30:00,860 --> 00:30:01,900 You know, this creates a race condition 786 00:30:02,540 --> 00:30:04,440 where an attacker can just wait on the network 787 00:30:04,440 --> 00:30:07,140 for LMNR and MBTNS queries and respond to all of them. 788 00:30:07,220 --> 00:30:09,620 At that point, the victim will end up sending traffic 789 00:30:09,620 --> 00:30:11,220 to the attacker instead, creating a man in the middle. 790 00:30:12,080 --> 00:30:13,340 So a quick demo on how that works. 791 00:30:14,060 --> 00:30:16,120 We have the attacker on the right, or the left, should I say, 792 00:30:16,160 --> 00:30:17,240 and a victim on the right. 793 00:30:18,160 --> 00:30:20,640 And the attacker is going to run a tool by Lawrence Joffe 794 00:30:20,640 --> 00:30:24,040 called Responder that's going to do this. 795 00:30:25,000 --> 00:30:27,560 As you can see, we're poisoning LMNR and MBTNS, 796 00:30:27,660 --> 00:30:29,520 and we have these rogue servers here 797 00:30:29,520 --> 00:30:31,000 that are going to wait for the authentication attempts. 798 00:30:31,340 --> 00:30:35,200 And on the right, we're going to attempt 799 00:30:35,200 --> 00:30:37,200 to access a non-existent SMB share. 800 00:30:37,360 --> 00:30:39,100 And the reason why we're doing a non-existent SMB share 801 00:30:39,100 --> 00:30:41,600 is because it's guaran- you know, the host is going to see that, 802 00:30:41,600 --> 00:30:43,940 and it's going to- it's guaranteed not to be able 803 00:30:43,940 --> 00:30:46,220 to be resolved locally, or using local DNS. 804 00:30:46,440 --> 00:30:48,680 So it's going to automatically- we know that it's going to fall 805 00:30:48,680 --> 00:30:50,880 back to LMNR and MBTNS. 806 00:30:53,660 --> 00:30:54,860 So we're going to do this. 807 00:30:57,620 --> 00:31:01,020 As you can see here, we end up with hashes very quickly. 808 00:31:04,360 --> 00:31:06,400 So we're about 5% through a little escape attempt 809 00:31:06,400 --> 00:31:09,640 from that thing, but I mean, this is- alright. 810 00:31:09,840 --> 00:31:11,420 The other thing we need to understand in order to figure 811 00:31:11,420 --> 00:31:13,440 out, you know, understand how we can get out of this is another 812 00:31:13,440 --> 00:31:16,720 attack that we'll briefly cover called redirect to SMB. 813 00:31:16,880 --> 00:31:19,220 So anyone know what redirect to SMB is? 814 00:31:20,080 --> 00:31:21,240 Alright, it's pretty straightforward, right? 815 00:31:21,300 --> 00:31:24,220 You trick the victim into accessing a URL that takes them 816 00:31:24,220 --> 00:31:27,160 to a server, and all this server does is redirects them 817 00:31:27,160 --> 00:31:28,880 to an SMB share on the attacker's network, 818 00:31:29,020 --> 00:31:29,800 or an SMB server. 819 00:31:29,980 --> 00:31:32,580 So they get redirected to this SMB server, and at this point, 820 00:31:32,620 --> 00:31:36,180 IE or whatever it is they're using is forced to do NTLM 821 00:31:36,180 --> 00:31:38,080 authentication with the attacker, and you get hashed 822 00:31:38,080 --> 00:31:39,980 as much as we previously saw. 823 00:31:40,220 --> 00:31:41,340 Requires a bit of social engineering. 824 00:31:42,240 --> 00:31:44,680 Okay, back to wireless, and this is where we go into new 825 00:31:44,680 --> 00:31:46,140 stuff, which is cool. 826 00:31:48,080 --> 00:31:49,600 Let's talk about hostile portal attacks. 827 00:31:50,360 --> 00:31:52,400 Hostile portal attacks are a way of stealing active directory 828 00:31:52,400 --> 00:31:54,360 credentials without direct network access. 829 00:31:55,400 --> 00:31:59,080 So how many of you guys seen something like this recently? 830 00:32:00,020 --> 00:32:02,100 Yeah, so that's a captive portal, and the way a captive 831 00:32:02,100 --> 00:32:04,880 portal works is that all DNS queries are resolved to the 832 00:32:05,280 --> 00:32:05,780 captive portal. 833 00:32:05,920 --> 00:32:07,840 You know, the DNS server is pushed out through a DHCP 834 00:32:07,840 --> 00:32:11,340 option, and then that's- the DNS server then sends every 835 00:32:11,420 --> 00:32:12,600 thing to the captive portal. 836 00:32:12,740 --> 00:32:15,920 Of course, you can also redirect DNS traffic in case 837 00:32:15,920 --> 00:32:20,040 they're manually specifying a DNS server, and of course you 838 00:32:20,040 --> 00:32:22,440 can- if that fails, they're trying to access stuff directly 839 00:32:22,440 --> 00:32:25,100 using an IP address, you can actually redirect HTTP traffic 840 00:32:25,100 --> 00:32:25,820 to the portal as well. 841 00:32:26,880 --> 00:32:30,160 So a hostile portal attack is very similar to this. 842 00:32:30,340 --> 00:32:33,600 It's based on, you know, the redirect to SMB attack, but, 843 00:32:33,720 --> 00:32:35,480 you know, instead of being forced to- the victim being 844 00:32:35,480 --> 00:32:39,980 forced to visit this captive portal login page, they're 845 00:32:39,980 --> 00:32:41,400 actually just forced to have access to the portal. 846 00:32:41,420 --> 00:32:43,100 They have access to an SMB share, so you redirect to an SMB 847 00:32:43,100 --> 00:32:44,020 share instead of a login page. 848 00:32:44,260 --> 00:32:46,980 Very simple, but very effective. 849 00:32:47,160 --> 00:32:50,720 You force the- if you look at this- oh, in the background, by 850 00:32:50,720 --> 00:32:53,180 the way, you poison all LMNR and MBTNS in case they're just 851 00:32:53,180 --> 00:32:54,000 completely idle. 852 00:32:54,740 --> 00:32:56,100 But, you know, this is how it would work. 853 00:32:56,280 --> 00:32:58,240 You have an attacker, and you have a victim on the target 854 00:32:58,240 --> 00:32:58,480 network. 855 00:32:58,920 --> 00:33:01,340 Use a rogue access point attack to force the victim to associate 856 00:33:01,340 --> 00:33:03,500 with you, and then you immediately redirect them to 857 00:33:03,500 --> 00:33:06,100 this SMB share using the same technique we use for a captive 858 00:33:06,100 --> 00:33:06,340 portal. 859 00:33:06,660 --> 00:33:09,240 And this results in lots and lots of hashes. 860 00:33:09,340 --> 00:33:11,120 And, you know, we're first going to show you a demo 861 00:33:12,120 --> 00:33:12,440 here. 862 00:33:12,440 --> 00:33:16,440 And I actually have- it looks like 15 minutes left, so I'm 863 00:33:16,440 --> 00:33:22,480 just going to fly through this video, because- so here on the 864 00:33:23,580 --> 00:33:28,580 top right, we have a- you know, we're going to create our 865 00:33:31,760 --> 00:33:32,640 legitimate access point. 866 00:33:32,800 --> 00:33:33,780 This is our target network. 867 00:33:34,060 --> 00:33:35,740 And we're going to connect to it from our victim machine 868 00:33:35,740 --> 00:33:37,700 that's on the bottom right. 869 00:33:38,340 --> 00:33:40,220 And, you know, as I said, we're going to do this with an open 870 00:33:40,220 --> 00:33:40,820 network first. 871 00:33:40,820 --> 00:33:42,640 Because there are a couple more steps that we have to do in 872 00:33:42,640 --> 00:33:46,420 order to get this to work with EAP, or WPA2 EAP, should I say. 873 00:33:48,600 --> 00:33:49,960 But yeah, we'll get to that in a second. 874 00:33:50,480 --> 00:33:54,520 So- and I just got prompted to update when I recorded this. 875 00:33:54,660 --> 00:34:00,240 But- so we're first going to associate it with this target 876 00:34:00,240 --> 00:34:01,000 network at some point here. 877 00:34:01,360 --> 00:34:01,980 Okay, there we go. 878 00:34:02,480 --> 00:34:04,880 Yeah, so our client device is now connected with the network. 879 00:34:05,100 --> 00:34:09,120 And on the left here, we're going to launch the rogue 880 00:34:09,120 --> 00:34:09,700 access point attack. 881 00:34:09,700 --> 00:34:15,000 So the first thing that's going to happen is we're going to start 882 00:34:15,000 --> 00:34:15,640 our rogue access point. 883 00:34:18,860 --> 00:34:21,000 And then we're going to send some DL packets to kind of force 884 00:34:21,000 --> 00:34:24,320 it to roam from the target BSSID to our rogue access point. 885 00:34:24,560 --> 00:34:26,460 So as you can see here, we have an association. 886 00:34:27,020 --> 00:34:31,360 And then, interestingly enough, as soon as the victim opens IE, 887 00:34:31,760 --> 00:34:34,960 which we're going to do in a second, we have hashes. 888 00:34:35,360 --> 00:34:37,220 So if they're, you know, previously doing anything that 889 00:34:37,220 --> 00:34:39,680 requires HTTP, it'll- you know, it's going to be a little bit 890 00:34:39,700 --> 00:34:41,000 So we'll just send hashes to the attacker. 891 00:34:41,120 --> 00:34:44,000 At this point, the attacker- and actually, thing to note, look how 892 00:34:44,000 --> 00:34:45,940 many times it's actually sending us authentication and that- 893 00:34:45,940 --> 00:34:46,980 or hashes, should I say. 894 00:34:47,260 --> 00:34:49,720 And that's because every time we type in a new character into 895 00:34:49,720 --> 00:34:52,900 the address bar there, that's actually sending out an HTTP 896 00:34:52,900 --> 00:34:53,900 request to Bing search. 897 00:34:54,940 --> 00:34:57,260 And that, you know, of course, we're just redirecting that. 898 00:34:57,360 --> 00:35:00,040 So every time you type in a character, we're trying to 899 00:35:00,040 --> 00:35:00,880 authenticate with the attacker. 900 00:35:04,560 --> 00:35:09,040 So, all right, so, you know, if we're doing this with WPA EAP networks, it's going to require 901 00:35:09,040 --> 00:35:09,680 a little more work. 902 00:35:09,700 --> 00:35:13,640 And this is because, you know, in most cases, we're going to be talking about EAP-TTLS 903 00:35:13,640 --> 00:35:14,340 and EAP-PEAP. 904 00:35:14,860 --> 00:35:21,480 Both use MS-CHAPI2 as the inter-authentication method, although it's- you can kind of- you 905 00:35:21,480 --> 00:35:26,500 can often get EAP- you know, clients that are connected to an EAP-TTLS network to agree 906 00:35:26,500 --> 00:35:29,480 to something a little less secure than that. 907 00:35:29,600 --> 00:35:32,260 But especially with EAP-PEAP, you're stuck with MS-CHAPI2. 908 00:35:32,800 --> 00:35:38,160 So what this means is that with MS-CHAPI2, it's actually a mutual authentication protocol. 909 00:35:38,160 --> 00:35:42,540 So this means that the server- the RADIUS server must prove knowledge of the supplicant's 910 00:35:42,540 --> 00:35:45,240 password in order for the inter-authentication to have to succeed. 911 00:35:45,600 --> 00:35:50,960 So this means that although the- you know, you can force a device to connect to you and 912 00:35:50,960 --> 00:35:54,140 do that authentication process and give you an EAP challenge or response that you can 913 00:35:54,140 --> 00:35:59,440 crack offline, you know, there's still that very, very, very final step, that final stage 914 00:35:59,440 --> 00:36:03,000 of the inter-authentication process in which the client will actually not be able to fully 915 00:36:03,000 --> 00:36:05,900 associate with the attacker because it's going to- you know, the RADIUS server is going to 916 00:36:05,900 --> 00:36:08,060 fail that final stage of the authentication. 917 00:36:10,060 --> 00:36:14,220 So the solution to this is- well, we have a couple of them, depending on the strength 918 00:36:14,220 --> 00:36:16,460 of the RADIUS passwords in use. 919 00:36:16,580 --> 00:36:19,920 We can use something that- this came out in the same talk I mentioned earlier in DEF CON 920 00:36:19,920 --> 00:36:24,200 22 by the guys from SensePost, Don White and Ian DeVilliers. 921 00:36:24,420 --> 00:36:28,900 They came up with a method called auto-crack-and-add where you basically- you perform that first 922 00:36:28,900 --> 00:36:32,540 attack that we saw in the very beginning where we captured the challenge response, but then 923 00:36:32,540 --> 00:36:37,740 we immediately append it to the kind of the database file that our RADIUS server reads 924 00:36:37,740 --> 00:36:37,920 from. 925 00:36:38,160 --> 00:36:39,500 And we'll talk about that in a second. 926 00:36:39,860 --> 00:36:43,780 But if the- if the creds are stronger, you actually have to, you know, crack them offline 927 00:36:43,780 --> 00:36:44,920 and finish the attack later. 928 00:36:45,160 --> 00:36:48,100 And that's actually pretty feasible, too, and we'll talk about that in a second. 929 00:36:50,300 --> 00:36:54,380 So talking about the first method, the way the auto-crack-and-add thing works is that 930 00:36:54,380 --> 00:36:57,920 you take the challenge- you receive the challenge response, and that's the thing that you're 931 00:36:57,920 --> 00:36:59,940 cracking to obtain creds. 932 00:37:00,020 --> 00:37:04,460 At this point, what is supposed to happen at the very end of the MSHAP v2 authentication 933 00:37:04,900 --> 00:37:07,720 protocol is that the RADIUS server, or host APD in this case, is going to crack the challenge 934 00:37:07,740 --> 00:37:11,520 database, loads the password from a file called the EAP user file. 935 00:37:11,660 --> 00:37:14,780 It's basically a very simple database that's implemented using a text file, and it has 936 00:37:14,780 --> 00:37:18,700 information like the user name, password, then information about how that user is allowed 937 00:37:18,700 --> 00:37:20,140 to associate with the network. 938 00:37:20,400 --> 00:37:25,440 So it loads this password, and it uses that to forge the authentication response, which 939 00:37:25,440 --> 00:37:27,400 is sent with the success message to the victim. 940 00:37:27,880 --> 00:37:33,660 And you know, of course, you know, if the- if it was able to load that file, and it's 941 00:37:33,660 --> 00:37:37,500 able to provide a valid authentication response, the association attempt succeeds. 942 00:37:37,740 --> 00:37:39,100 Or authentication attempt succeeds, should I say. 943 00:37:41,060 --> 00:37:45,920 So with the auto-crack and add technique that we talked about, what's going to happen is 944 00:37:45,920 --> 00:37:51,020 that the, you know, the attacker, instead of immediately loading that password from 945 00:37:51,020 --> 00:37:56,720 the EAP user file, the password actually- the attacker is going to take that challenge 946 00:37:56,720 --> 00:37:59,120 and response and then immediately send them off to a cracking rig. 947 00:37:59,400 --> 00:38:02,140 And the idea is that especially if you're using a remote cracking rig like, you know, 948 00:38:02,160 --> 00:38:05,400 Cloud Crack or something like that that, you know, that has, you know, a significant amount 949 00:38:05,400 --> 00:38:06,380 of horsepower behind it. 950 00:38:06,380 --> 00:38:12,080 You should be able to, or at least within a couple attempts, you know, crack that in 951 00:38:12,080 --> 00:38:16,620 time to then add it to the end of your EAP user file, just kind of append it to the 952 00:38:16,620 --> 00:38:21,540 end of the file, and then send the, you know, use that to create the authentication response. 953 00:38:22,140 --> 00:38:23,800 So it's almost like this race condition. 954 00:38:24,040 --> 00:38:26,900 And if that doesn't work the first time, you just try it immediately again. 955 00:38:26,980 --> 00:38:31,300 This time you already have it, and as the client tries to re-associate with you, you 956 00:38:31,300 --> 00:38:31,880 pull off the attack. 957 00:38:32,280 --> 00:38:36,360 So the second, you know, of course that works with weaker credentials. 958 00:38:36,360 --> 00:38:39,280 But our second option is, you know, the offline crack. 959 00:38:40,640 --> 00:38:43,980 And, you know, you may be thinking, yeah, this is going to take a little more time. 960 00:38:44,640 --> 00:38:47,980 But remember that, you know, it actually isn't as bad as you think, you know, rather 961 00:38:47,980 --> 00:38:50,400 than the attack taking, you know, minutes to an hour, it's not going to take a few 962 00:38:50,400 --> 00:38:51,300 hours to maybe a week. 963 00:38:51,660 --> 00:38:55,620 And of course, you know, real attackers aren't time-blocked, so even if you have a really, 964 00:38:55,700 --> 00:38:59,660 really long radius password, you still have your APTs out there, like the guy on the right. 965 00:38:59,940 --> 00:39:06,200 But so, one more thing to consider. 966 00:39:06,320 --> 00:39:06,340 It's a little bit more complicated. 967 00:39:06,360 --> 00:39:09,000 It's the fact that you already have the credentials if you're on the network in the first place, 968 00:39:09,520 --> 00:39:11,660 which is how we're trying to get out of this situation. 969 00:39:12,160 --> 00:39:13,720 But yeah, here we are once again. 970 00:39:14,320 --> 00:39:19,800 We're going to use the auto-crack and add technique to perform the previous attack 971 00:39:19,800 --> 00:39:22,720 against this time using a WPA2 EAP. 972 00:39:23,020 --> 00:39:25,020 I'm going to fast-forward again because we have ten minutes. 973 00:39:26,440 --> 00:39:32,420 So we're going to connect the victim device to the legitimate access point on the top 974 00:39:32,420 --> 00:39:32,620 right. 975 00:39:35,140 --> 00:39:36,340 And then we're going to start the roadmap. 976 00:39:36,360 --> 00:39:36,880 Rogue access point attack. 977 00:39:40,340 --> 00:39:42,000 And that's going to happen right here. 978 00:39:45,140 --> 00:39:47,560 So we're now spotting the rogue access point on the left. 979 00:39:47,860 --> 00:39:53,380 And then we're going to lob deauth packets at this, you know, at the legitimate access 980 00:39:53,380 --> 00:39:55,320 point, at the client associated with the legitimate access point. 981 00:39:55,460 --> 00:39:57,400 And that's going to cause it to roam over to our rogue access point. 982 00:39:57,500 --> 00:39:58,720 As you can see, we've roamed over. 983 00:39:59,760 --> 00:40:03,540 And you know, it's tried to authenticate. 984 00:40:03,720 --> 00:40:06,340 It's kicked us off because we failed the initiative. 985 00:40:06,360 --> 00:40:13,600 It's the initial, the very last phase of the, of the inter-authentication. 986 00:40:14,680 --> 00:40:18,500 But you know, at this point, you know, we've also just cracked the, we've performed the 987 00:40:18,500 --> 00:40:20,160 auto-crack and add, which you can see on the left here. 988 00:40:20,440 --> 00:40:23,680 And it's going, you know, at this point we just relaunched the attack, you know, restart 989 00:40:23,680 --> 00:40:24,240 the access point. 990 00:40:24,740 --> 00:40:25,680 And do it again. 991 00:40:25,900 --> 00:40:28,140 And we'll notice that the victim associates with us. 992 00:40:30,480 --> 00:40:31,260 So hit connect. 993 00:40:34,120 --> 00:40:36,340 And at this point we're actually associating once again. 994 00:40:36,360 --> 00:40:37,480 With the target access point. 995 00:40:37,620 --> 00:40:39,100 So we can rinse and repeat. 996 00:40:44,160 --> 00:40:45,440 And here we go. 997 00:40:49,500 --> 00:40:50,160 Bear with me. 998 00:40:51,200 --> 00:40:53,820 Will happen like, I'll just skip forward a little bit. 999 00:40:55,220 --> 00:40:55,620 Okay. 1000 00:40:55,760 --> 00:40:56,160 Yeah. 1001 00:40:56,280 --> 00:40:56,680 So. 1002 00:40:58,040 --> 00:40:58,440 Okay. 1003 00:40:58,500 --> 00:40:58,840 So. 1004 00:40:59,300 --> 00:40:59,920 Where is it? 1005 00:40:59,980 --> 00:41:00,160 Yeah. 1006 00:41:05,080 --> 00:41:05,480 Oh. 1007 00:41:05,940 --> 00:41:06,340 Okay. 1008 00:41:09,740 --> 00:41:10,020 Um. 1009 00:41:11,060 --> 00:41:11,340 Where's the, oh. 1010 00:41:11,480 --> 00:41:12,920 So we're getting a weird, like, start warning thing. 1011 00:41:13,060 --> 00:41:13,180 But. 1012 00:41:16,940 --> 00:41:17,380 There we go. 1013 00:41:17,480 --> 00:41:17,660 Okay. 1014 00:41:17,700 --> 00:41:18,320 So we, you know. 1015 00:41:18,640 --> 00:41:22,600 At this point the, the victim has just associated with the rogue access point. 1016 00:41:22,820 --> 00:41:24,400 As you can see we have hashed on the left. 1017 00:41:25,140 --> 00:41:28,120 And, you know, as we type stuff in the address bar, you know, we're sending out these HTTP 1018 00:41:28,120 --> 00:41:30,780 requests and it's just forcing more authentication demo with the attacker. 1019 00:41:32,360 --> 00:41:36,340 So that, that's a hostile portal attack against, you know, HTTP. 1020 00:41:36,340 --> 00:41:37,960 against WPA2 EAP. 1021 00:41:38,400 --> 00:41:39,560 So what does this get us? 1022 00:41:39,800 --> 00:41:41,720 I mean, it gets you similar results 1023 00:41:41,720 --> 00:41:43,260 to LMNR and MVTNS poisoning. 1024 00:41:43,520 --> 00:41:44,740 There are a few key advantages here. 1025 00:41:45,100 --> 00:41:46,340 One, no network access required, 1026 00:41:46,680 --> 00:41:48,280 and we're also not limited to a local subnet 1027 00:41:48,280 --> 00:41:49,720 because you get everything that's connected to wireless. 1028 00:41:50,360 --> 00:41:52,280 It's also not a passive attack, which is pretty cool. 1029 00:41:52,440 --> 00:41:55,840 We're not waiting for an LMNR and MVTNS lookup request. 1030 00:41:56,040 --> 00:41:59,840 You're actually forcing stuff to authenticate with you. 1031 00:42:00,020 --> 00:42:01,000 So back to our scenario. 1032 00:42:01,580 --> 00:42:03,180 And now we're gonna move on to something 1033 00:42:04,120 --> 00:42:05,420 called an indirect wireless pivot, 1034 00:42:05,420 --> 00:42:07,740 and this is how you use rogue AP attacks 1035 00:42:07,740 --> 00:42:09,520 to bypass NAC mechanisms. 1036 00:42:12,680 --> 00:42:13,780 So here we are. 1037 00:42:13,820 --> 00:42:15,340 We're back at our scenario again. 1038 00:42:15,900 --> 00:42:18,620 And we have the attacker, which is us, 1039 00:42:18,700 --> 00:42:20,200 and we're on this quarantine VLAN over here. 1040 00:42:20,340 --> 00:42:22,200 And of course we wanna get over to this restrictive VLAN 1041 00:42:22,200 --> 00:42:23,340 and access these sensitive resources. 1042 00:42:24,420 --> 00:42:25,880 Unfortunately, as we mentioned earlier, 1043 00:42:26,000 --> 00:42:27,640 we've been jailed by this NAC 1044 00:42:27,640 --> 00:42:29,060 and we're kind of stuck over here. 1045 00:42:29,420 --> 00:42:34,560 Well, although, what if we use a second wireless interface 1046 00:42:34,560 --> 00:42:37,140 to perform a rogue AP attack 1047 00:42:37,140 --> 00:42:39,260 and then just force that authorized device 1048 00:42:39,840 --> 00:42:41,900 to connect to our rogue access point? 1049 00:42:42,120 --> 00:42:42,960 You know, at that point, 1050 00:42:43,040 --> 00:42:45,660 we could just use the hostile portal attack, 1051 00:42:45,800 --> 00:42:46,680 which we just talked about, 1052 00:42:47,820 --> 00:42:50,340 to get this device to send us NTLM hashes. 1053 00:42:51,220 --> 00:42:52,400 Crack those hashes offline, 1054 00:42:52,660 --> 00:42:53,760 and at this point you have the capability 1055 00:42:53,760 --> 00:42:55,420 to authenticate with the victim 1056 00:42:55,420 --> 00:42:57,000 and place a payload on the victim. 1057 00:42:57,280 --> 00:42:58,260 You know, you might have to come back, 1058 00:42:58,300 --> 00:42:59,540 repeat the first part of the attack 1059 00:42:59,540 --> 00:43:01,340 to get it to connect to you, but whatever. 1060 00:43:01,340 --> 00:43:05,380 So, at this point, we send this payload to the victim, 1061 00:43:05,500 --> 00:43:08,200 and what if we use a scheduled task or something like that? 1062 00:43:08,500 --> 00:43:09,400 For the sake of an example, 1063 00:43:09,420 --> 00:43:10,620 forget about being stealthy for a second, 1064 00:43:10,740 --> 00:43:12,060 but just for the sake of an example, 1065 00:43:12,060 --> 00:43:13,820 we use a scheduled task, a time payload, 1066 00:43:14,020 --> 00:43:15,680 and then we just allow the victim device, 1067 00:43:15,820 --> 00:43:16,560 which is an authorized member, 1068 00:43:16,780 --> 00:43:19,240 to re-associate with the wireless network 1069 00:43:19,240 --> 00:43:20,900 that it was originally associated to that we're attacking. 1070 00:43:21,420 --> 00:43:22,800 Well, at this point, it's still authorized, 1071 00:43:23,000 --> 00:43:24,780 so it just gets moved over to the restricted VLAN, 1072 00:43:24,940 --> 00:43:26,420 and now we just wait for the reverse shell. 1073 00:43:26,900 --> 00:43:28,680 And this NAC that you see in the middle, 1074 00:43:29,140 --> 00:43:31,240 this could have been the most effective NAC 1075 00:43:31,340 --> 00:43:31,540 in the world. 1076 00:43:31,620 --> 00:43:32,080 It wouldn't have mattered, 1077 00:43:32,120 --> 00:43:33,800 because we're still able to remove this device 1078 00:43:34,900 --> 00:43:37,500 from its habitat, from its target network, 1079 00:43:37,620 --> 00:43:39,120 onto a network that we completely control, 1080 00:43:39,280 --> 00:43:40,160 and we can attack it. 1081 00:43:42,040 --> 00:43:44,220 So, a better approach, a faster approach for doing this, 1082 00:43:44,280 --> 00:43:46,220 is to use an SMB relay attack, right? 1083 00:43:46,340 --> 00:43:48,140 So, you know, we talked about that earlier, 1084 00:43:48,280 --> 00:43:49,480 but let's say we have two devices now, 1085 00:43:49,520 --> 00:43:50,340 and you have to use two devices, 1086 00:43:50,420 --> 00:43:52,460 because unfortunately, since 2008, 1087 00:43:52,580 --> 00:43:56,560 due to a service patch by Microsoft, MS08068, I believe, 1088 00:43:57,400 --> 00:43:59,660 you can't actually just do an SMB relay attack 1089 00:43:59,660 --> 00:44:01,300 from one device and then back to it 1090 00:44:01,340 --> 00:44:02,100 because that's an SMB reflection. 1091 00:44:02,640 --> 00:44:05,640 You need at least two devices in order to make it work. 1092 00:44:07,600 --> 00:44:09,600 Let's say we have a couple of devices on the network, right? 1093 00:44:10,280 --> 00:44:12,220 You know, once again, you force them to associate with you, 1094 00:44:12,300 --> 00:44:14,820 and, you know, assuming that, you know, 1095 00:44:15,560 --> 00:44:18,400 you have an account that can authenticate with both, 1096 00:44:18,600 --> 00:44:20,260 you perform the SMB relay attack. 1097 00:44:21,840 --> 00:44:23,360 Well, you do the hostile portal attack, 1098 00:44:23,480 --> 00:44:24,280 and then that allows you, remember, 1099 00:44:24,340 --> 00:44:26,980 you're receiving NTLM hashes at that point, 1100 00:44:27,040 --> 00:44:28,680 so you can perform an SMB relay attack. 1101 00:44:29,240 --> 00:44:31,240 And then, you know, once again, we place a time payload, 1102 00:44:31,340 --> 00:44:33,180 on the victim, on one of the victims. 1103 00:44:33,220 --> 00:44:35,180 You allow the devices to re-associate with the target network 1104 00:44:35,180 --> 00:44:36,420 by killing your rogue AP, 1105 00:44:37,180 --> 00:44:39,040 and then, once again, just wait for the reverse shell. 1106 00:44:42,300 --> 00:44:44,160 And let's do, let's do this last, 1107 00:44:44,300 --> 00:44:47,020 let's show you guys this last, this attack in action, 1108 00:44:47,200 --> 00:44:48,040 and then we'll wrap this up. 1109 00:44:50,000 --> 00:44:52,160 So now we have, now we have two victim devices 1110 00:44:52,160 --> 00:44:53,200 on the top left and right. 1111 00:44:53,280 --> 00:44:54,080 We have Leroy and Jenkins. 1112 00:44:55,420 --> 00:44:57,040 And then on the bottom left, 1113 00:44:57,140 --> 00:44:59,640 we have our legitimate access point, 1114 00:44:59,780 --> 00:45:01,320 and then on the right, we have, you know, 1115 00:45:01,340 --> 00:45:02,180 we have the attacker. 1116 00:45:02,600 --> 00:45:04,060 So the first thing we do is we're gonna connect 1117 00:45:06,420 --> 00:45:08,980 both of these devices to the network. 1118 00:45:10,820 --> 00:45:12,280 And we're gonna start our rogue access point attack. 1119 00:45:14,940 --> 00:45:16,000 Like so, on the right. 1120 00:45:20,000 --> 00:45:21,920 And so our rogue access point is now live, 1121 00:45:22,080 --> 00:45:23,900 so we're gonna send DL packets to force it to roam, 1122 00:45:24,400 --> 00:45:25,620 the client devices to roam. 1123 00:45:27,460 --> 00:45:28,800 All right, one of them has authenticated, 1124 00:45:28,920 --> 00:45:29,600 as you can see right here. 1125 00:45:34,280 --> 00:45:35,400 And we're gonna do this again, 1126 00:45:35,580 --> 00:45:36,740 but this time for the second client device. 1127 00:45:36,940 --> 00:45:38,580 And there we have this second authentication. 1128 00:45:38,840 --> 00:45:40,000 So both devices are now associated 1129 00:45:40,000 --> 00:45:40,920 with our rogue access point attack, 1130 00:45:41,440 --> 00:45:42,500 or our rogue access point. 1131 00:45:44,020 --> 00:45:47,000 So now we're going to create a stager. 1132 00:45:47,100 --> 00:45:48,760 We're using the Empire PowerShell framework, 1133 00:45:48,920 --> 00:45:49,980 if you guys are familiar with it. 1134 00:45:50,080 --> 00:45:51,660 But it's, if not, it's kind of like Metasploit, 1135 00:45:51,700 --> 00:45:53,820 but using PowerShell, it's the easiest way to describe it. 1136 00:45:53,940 --> 00:45:55,300 But the stager, that's our payload. 1137 00:45:55,460 --> 00:45:57,980 So we're gonna, we've generated our stager, 1138 00:45:58,820 --> 00:46:00,780 and we're going to, at this point, 1139 00:46:01,700 --> 00:46:02,920 we're gonna find an IP address 1140 00:46:02,920 --> 00:46:04,740 of one of our associated clients. 1141 00:46:05,260 --> 00:46:07,340 And so we're gonna settle for Jenkins here, 1142 00:46:07,440 --> 00:46:09,040 and we're gonna use Jenkins' IP address. 1143 00:46:10,280 --> 00:46:12,700 And then we're going to take our stager 1144 00:46:12,700 --> 00:46:15,520 and use it as a payload for SMB relay X, 1145 00:46:15,680 --> 00:46:19,200 which is a SMB relay tool, right? 1146 00:46:21,480 --> 00:46:24,160 And, you know, as you can see, we interacted with IE, 1147 00:46:24,220 --> 00:46:26,700 that gave us HTTP traffic, 1148 00:46:26,880 --> 00:46:28,900 which is enough to set up the SMB relay. 1149 00:46:29,080 --> 00:46:30,760 And if we go back, there's a bit of a delay 1150 00:46:30,760 --> 00:46:31,680 on the reverse shell here. 1151 00:46:33,280 --> 00:46:36,440 We're going to receive our first reverse connection, 1152 00:46:36,600 --> 00:46:37,620 which is gonna allow us to place 1153 00:46:37,620 --> 00:46:38,580 that time payload on the victim. 1154 00:46:38,800 --> 00:46:39,340 There we go. 1155 00:46:39,440 --> 00:46:40,460 If you can see that little green text, 1156 00:46:40,600 --> 00:46:43,520 it says initial agent, you know, blah, blah, blah, 1157 00:46:43,560 --> 00:46:47,820 connected to 10.0.0.184, now active. 1158 00:46:47,900 --> 00:46:51,580 That's our payload, and we are now, 1159 00:46:52,100 --> 00:46:54,600 we are now actually executing commands 1160 00:46:55,100 --> 00:46:56,200 on the victim machine. 1161 00:46:57,240 --> 00:46:58,640 So now we're gonna use module, 1162 00:46:58,800 --> 00:47:00,740 we're gonna use a scheduled tasks module, to, you know, 1163 00:47:00,740 --> 00:47:02,180 place a scheduled task on this machine, 1164 00:47:02,300 --> 00:47:03,760 now that we're authenticated with it. 1165 00:47:06,800 --> 00:47:08,400 Before we do that, we're gonna run Who Am I, 1166 00:47:08,540 --> 00:47:09,980 and also just, so see, we have, 1167 00:47:10,760 --> 00:47:12,460 our privilege right now, our NC Authority system, 1168 00:47:13,120 --> 00:47:14,980 and we're also gonna just, to check the host name 1169 00:47:14,980 --> 00:47:15,980 and figure out which one we're connected to, 1170 00:47:16,020 --> 00:47:17,280 we're gonna use the host name command. 1171 00:47:17,440 --> 00:47:18,380 So we're gonna do shell host name, 1172 00:47:19,340 --> 00:47:21,640 and yeah, we're connected, we're currently, you know, 1173 00:47:21,660 --> 00:47:24,140 have a shell on Jenkins, so that one, 1174 00:47:24,800 --> 00:47:26,480 we're this guy on the left right there. 1175 00:47:31,060 --> 00:47:32,520 Yeah, we're gonna create that scheduled task. 1176 00:47:33,080 --> 00:47:34,800 And what's gonna happen here is that we're gonna set 1177 00:47:34,800 --> 00:47:37,080 the time for execution, just a couple minutes 1178 00:47:37,080 --> 00:47:38,320 in the future, right? 1179 00:47:39,340 --> 00:47:41,140 So, interesting thing happened when I was like, 1180 00:47:41,180 --> 00:47:44,020 recording this, which was that I actually forgot to, 1181 00:47:46,000 --> 00:47:48,320 to attach the virtual device that was associated 1182 00:47:48,320 --> 00:47:52,400 with the first wireless interface to the virtual machine, 1183 00:47:52,600 --> 00:47:54,740 right, and I was originally gonna just like, 1184 00:47:54,800 --> 00:47:55,820 re-record it, right, but then like, 1185 00:47:55,840 --> 00:47:56,780 something really interesting happened. 1186 00:47:56,880 --> 00:48:00,720 I did set 160 retries for that second, for that second, 1187 00:48:00,740 --> 00:48:01,880 for that second payload, the time payload. 1188 00:48:02,860 --> 00:48:05,220 So, what I ended up doing is like, you know, 1189 00:48:05,260 --> 00:48:07,820 I reattached the, what you're gonna see me do is 1190 00:48:07,820 --> 00:48:11,520 you're gonna see me reattach the first device, 1191 00:48:11,620 --> 00:48:12,760 you know, that I forgot to attach. 1192 00:48:12,980 --> 00:48:14,280 And then, you know, a couple seconds later, 1193 00:48:14,640 --> 00:48:15,960 I'm still gonna receive the reverse shell, 1194 00:48:16,020 --> 00:48:17,900 because this thing is still consistently trying to connect 1195 00:48:17,900 --> 00:48:20,180 over and over again to this device that wasn't there. 1196 00:48:20,280 --> 00:48:20,980 So I thought that was kinda cool, 1197 00:48:21,020 --> 00:48:21,740 so I kinda left it in there. 1198 00:48:24,380 --> 00:48:25,420 So we've executed it. 1199 00:48:25,940 --> 00:48:27,540 At this point, we're going to actually kill 1200 00:48:27,540 --> 00:48:28,940 our rogue access point attack 1201 00:48:28,940 --> 00:48:29,820 and allow everything to reconnect. 1202 00:48:31,800 --> 00:48:33,340 And you'll notice on the left here, 1203 00:48:33,540 --> 00:48:35,200 we have one association right there, 1204 00:48:36,140 --> 00:48:37,540 and our second association 1205 00:48:40,820 --> 00:48:42,180 should have happened as well. 1206 00:48:46,380 --> 00:48:48,560 At this point, you know, I'm gonna skip through 1207 00:48:48,560 --> 00:48:49,600 waiting for two minutes of this. 1208 00:48:51,520 --> 00:48:52,100 Two minutes. 1209 00:48:52,660 --> 00:48:53,880 Just enough time we need. 1210 00:48:54,000 --> 00:48:54,400 Okay, cool. 1211 00:48:55,620 --> 00:48:56,780 So I'm gonna skip through this. 1212 00:49:01,000 --> 00:49:02,020 And you see here, 1213 00:49:03,520 --> 00:49:05,180 you should see me reattach the network adapter, 1214 00:49:05,420 --> 00:49:06,500 because I'm trying to figure out what's going on. 1215 00:49:06,640 --> 00:49:08,540 And then I'm like, oh, yeah, time to redo everything. 1216 00:49:09,820 --> 00:49:11,760 And then I start clearing everything, right? 1217 00:49:12,380 --> 00:49:12,700 Oops. 1218 00:49:15,260 --> 00:49:16,940 And I start clearing everything. 1219 00:49:17,060 --> 00:49:18,100 And I hit the back button on this, 1220 00:49:18,180 --> 00:49:18,940 because I'm about to clear everything 1221 00:49:18,940 --> 00:49:19,560 and start from scratch. 1222 00:49:19,680 --> 00:49:20,680 And then I receive the initial agent. 1223 00:49:20,920 --> 00:49:21,920 So it actually did work, 1224 00:49:21,960 --> 00:49:23,840 as soon as I plugged in the network adapter again. 1225 00:49:24,320 --> 00:49:25,860 So that's an indirect wireless pivot. 1226 00:49:27,020 --> 00:49:28,460 So the equivalent technique of doing this 1227 00:49:28,460 --> 00:49:30,400 in a wired network would be literally unplugging an authorized 1228 00:49:30,400 --> 00:49:32,780 device from the wall and then connecting it 1229 00:49:32,780 --> 00:49:35,120 to a hostile network on which you can actually attack it. 1230 00:49:35,720 --> 00:49:37,660 You know, the reason why we're able to do that 1231 00:49:37,660 --> 00:49:40,220 is because port-based access controls rely on the assumption 1232 00:49:40,220 --> 00:49:41,820 that the physical layer can be trusted. 1233 00:49:41,980 --> 00:49:45,280 In a wireless network, WPA2 EAP is the means 1234 00:49:45,280 --> 00:49:46,840 through which the integrity of the physical layer 1235 00:49:47,520 --> 00:49:48,560 is actually assured. 1236 00:49:48,860 --> 00:49:51,140 You know, and if you can't trust your EAP implementation 1237 00:49:51,640 --> 00:49:53,080 and you have a weak form of it, 1238 00:49:53,180 --> 00:49:54,980 the attacker can freely control your physical layer 1239 00:49:55,460 --> 00:49:57,020 and it basically, you know, 1240 00:49:57,020 --> 00:49:59,080 renders port-based access controls irrelevant. 1241 00:49:59,080 --> 00:50:02,180 So what this demonstrates is that port-based NAC mechanisms, 1242 00:50:02,360 --> 00:50:04,020 they don't really effectively mitigate the risk 1243 00:50:04,020 --> 00:50:06,140 presented by weak WPA2 implementations, 1244 00:50:06,220 --> 00:50:10,000 or EAP implementations, and that, you know, 1245 00:50:10,020 --> 00:50:12,080 adding port-based NAC mechanisms to a wireless network, 1246 00:50:12,280 --> 00:50:14,800 it doesn't really make the use of EAP-TTLS or EAP-PEEP 1247 00:50:14,800 --> 00:50:16,820 any less inappropriate if the network in question 1248 00:50:16,820 --> 00:50:18,940 is used to grant access to sets of information. 1249 00:50:19,720 --> 00:50:20,880 And, you know, by sets of information, 1250 00:50:21,380 --> 00:50:22,780 we're usually talking about, you know, 1251 00:50:22,800 --> 00:50:23,980 something like PCI or HIPAA data. 1252 00:50:24,140 --> 00:50:25,940 Remember that compliance doesn't necessarily mean security. 1253 00:50:27,740 --> 00:50:28,140 So... 1254 00:50:29,080 --> 00:50:30,880 I'm just going to make, like, one last case for EAP-TLS. 1255 00:50:31,740 --> 00:50:33,380 You know, it's not as bad as it used to be. 1256 00:50:33,600 --> 00:50:36,020 You can use group policy to push out the certs 1257 00:50:36,020 --> 00:50:37,580 to the various network endpoints. 1258 00:50:38,060 --> 00:50:40,120 And your best option, I think, is to, you know, 1259 00:50:40,120 --> 00:50:41,220 to mitigate this kind of attack, 1260 00:50:41,400 --> 00:50:43,820 is to use a private CA within your network 1261 00:50:43,820 --> 00:50:46,080 and then leverage the Active Directory to deploy EAP-TLS. 1262 00:50:46,580 --> 00:50:48,600 You know, and of course, you can, if you have, like, 1263 00:50:48,600 --> 00:50:51,900 you know, bring your own devices, like BYOD policy, 1264 00:50:52,060 --> 00:50:53,220 and people can bring their own devices on the network, 1265 00:50:53,660 --> 00:50:55,560 at this point, you could use, like, a solid MDM 1266 00:50:55,560 --> 00:50:57,160 to get those certs on there, 1267 00:50:57,240 --> 00:50:58,700 or just have, like, a really streamlined 1268 00:50:59,080 --> 00:50:59,900 BYOD onboarding solution. 1269 00:51:00,760 --> 00:51:03,260 And you could actually use Let's Encrypt, as well, 1270 00:51:03,260 --> 00:51:04,240 to roll out EAP-TLS. 1271 00:51:04,740 --> 00:51:06,640 Although, even the people who make Let's Encrypt are like, 1272 00:51:06,720 --> 00:51:07,900 this is probably not the best way to do it. 1273 00:51:09,960 --> 00:51:11,100 Yeah, but just some closing thoughts. 1274 00:51:11,640 --> 00:51:13,180 You know, just because wireless and wired networks 1275 00:51:13,720 --> 00:51:15,880 operate similarly at a logical level, 1276 00:51:15,940 --> 00:51:16,940 and they're designed to do that, 1277 00:51:17,020 --> 00:51:18,100 so it should be transparent 1278 00:51:18,500 --> 00:51:20,120 when you're looking at higher levels of abstraction. 1279 00:51:20,560 --> 00:51:22,960 On a physical level, in terms of the physics behind it, 1280 00:51:23,360 --> 00:51:24,920 they work in a completely different way. 1281 00:51:25,300 --> 00:51:27,440 And, you know, so you have to keep that in mind 1282 00:51:27,440 --> 00:51:28,620 when designing security 1283 00:51:29,080 --> 00:51:30,020 as a mechanism to protect them. 1284 00:51:30,240 --> 00:51:31,320 And, of course, as a community, 1285 00:51:31,420 --> 00:51:32,720 we should really question whether it's a sound decision 1286 00:51:32,720 --> 00:51:34,420 to neglect EAP-TLS completely 1287 00:51:34,940 --> 00:51:36,360 in favor of more reactive approaches 1288 00:51:36,360 --> 00:51:37,460 that focus on access control 1289 00:51:37,460 --> 00:51:39,640 rather than threat containment, and threat containment. 1290 00:51:40,280 --> 00:51:42,500 And, of course, I think most importantly, 1291 00:51:42,680 --> 00:51:44,360 you know, the needs for convenience and security, 1292 00:51:44,540 --> 00:51:45,680 they're usually at odds with one another. 1293 00:51:46,260 --> 00:51:48,020 So I think we should just, you know, 1294 00:51:48,020 --> 00:51:48,820 be really honest with ourselves 1295 00:51:48,820 --> 00:51:50,300 and maintain a very healthy skepticism 1296 00:51:50,880 --> 00:51:52,560 toward proposed solutions that promise both. 1297 00:51:53,620 --> 00:51:54,900 And if you want to look at the tool 1298 00:51:54,900 --> 00:51:56,500 that I've been using to do this stuff 1299 00:51:57,040 --> 00:51:58,160 throughout the demo, 1300 00:51:58,160 --> 00:51:59,580 or throughout the talk, 1301 00:52:00,280 --> 00:52:03,680 you can go to github.com slash solstice slash EAP Hammer 1302 00:52:03,680 --> 00:52:04,760 and check it out. 1303 00:52:05,000 --> 00:52:05,880 It's open source. 1304 00:52:06,740 --> 00:52:07,340 Thank you.