1 00:00:00,000 --> 00:00:06,640 Welcome to the 410 talk for the speaker workshops. And we're 2 00:00:06,640 --> 00:00:09,900 going to get started and we're going to talk about Portia by 3 00:00:10,560 --> 00:00:17,300 Michael Gennarakis and Keith Lee from Spider Lab. Thank you. 4 00:00:17,560 --> 00:00:24,080 All right. There we go. Okay. So just to introduce ourselves. So 5 00:00:24,080 --> 00:00:26,460 my name is Michael Gennarakis. I'm the director for Spider Labs 6 00:00:26,460 --> 00:00:31,060 APAC. And Keith is the senior consultant in the Spider Labs 7 00:00:31,060 --> 00:00:33,980 APAC group. So I'm from Australia. Keith's from 8 00:00:33,980 --> 00:00:39,720 Singapore. So the motivation for the Portia tool is as pen 9 00:00:39,720 --> 00:00:41,980 testers, we do a number of internal network pen tests as 10 00:00:41,980 --> 00:00:44,920 part of our day to day. There are a bunch of awesome tools and 11 00:00:44,920 --> 00:00:47,860 techniques for capturing and cracking credentials, for 12 00:00:47,860 --> 00:00:50,800 example, Responder. And we really wanted to fill the gap 13 00:00:51,340 --> 00:00:53,920 from, you know, once we've got a low privileged account, even 14 00:00:53,920 --> 00:00:56,440 perhaps, you know, the client will give you a little bit of 15 00:00:56,460 --> 00:00:58,700 a low privileged account to start with. We really wanted to 16 00:00:58,700 --> 00:01:01,480 fill that gap between having a low privileged account and 17 00:01:01,480 --> 00:01:04,520 getting to a high privileged account in terms of the tooling. 18 00:01:04,860 --> 00:01:08,440 And we, and also help with a few common issues that we came 19 00:01:08,440 --> 00:01:12,060 across as pen testers on our day to day. So we developed a tool 20 00:01:12,060 --> 00:01:16,580 called Portia to help with this. We developed Portia because we 21 00:01:16,580 --> 00:01:21,140 found similar tools had a number of issues. So apart from the 22 00:01:21,140 --> 00:01:23,500 fact that, you know, they're all sort of disparate, you've got a 23 00:01:23,500 --> 00:01:26,440 number of PowerShell scripts and different, different tools that 24 00:01:26,460 --> 00:01:29,260 you use that don't really sort of sync together. And we're 25 00:01:29,260 --> 00:01:32,060 finding that a lot of the tools have limited support and success 26 00:01:32,060 --> 00:01:36,440 on more recent versions of Windows. They were not as 27 00:01:36,440 --> 00:01:38,980 effective against systems that have implemented common 28 00:01:38,980 --> 00:01:41,000 hardening techniques. So we had to sort of figure out ways to 29 00:01:41,000 --> 00:01:44,620 bypass that and then run what we needed to run. And we wanted a 30 00:01:44,620 --> 00:01:48,320 single but also modular tool to cover the techniques rather than 31 00:01:48,320 --> 00:01:53,320 having multiple tools. So Portia aims to automate a number of the 32 00:01:53,320 --> 00:01:56,440 techniques that we commonly perform on an internal test. And 33 00:01:56,460 --> 00:01:56,660 it's really amazing how much of that help we get out there. 34 00:01:56,660 --> 00:01:58,080 So we've designed our Portia after we've got a low privilege 35 00:01:58,080 --> 00:02:00,780 account. So things like privilege escalation, lateral 36 00:02:00,780 --> 00:02:04,040 movement, and also a bunch of convenience modules that that we 37 00:02:04,040 --> 00:02:08,200 typically would like to use. Just as an aside on the name, so 38 00:02:08,200 --> 00:02:11,700 Portia is actually a type of jumping spider that feeds on 39 00:02:11,700 --> 00:02:15,380 other spiders. They're known for being very intelligent and have 40 00:02:15,380 --> 00:02:18,520 good problem solving capabilities. So we thought that was a being 41 00:02:18,520 --> 00:02:20,880 from Spider Lad. We thought that was a pretty cool name. So 42 00:02:20,880 --> 00:02:25,800 that's where it is. So this is a basic workflow for for our for 43 00:02:25,800 --> 00:02:26,440 our purposes. If we were to kind of start off with a quick 44 00:02:26,460 --> 00:02:31,140 for demos. That's on the right, you can see a basic network that we've set up for demonstration 45 00:02:31,140 --> 00:02:38,060 purposes. It's got a domain controller, a couple of hosts, and the hacker, right? So this is the 46 00:02:38,060 --> 00:02:43,900 basic workflow of Portia. I'll dive into each of the individual items in more detail on how it 47 00:02:43,900 --> 00:02:48,300 works. But just to give you a bit of an overview, we've got our credentials, right? It checks the 48 00:02:48,300 --> 00:02:52,700 credentials, makes sure they're valid and they work. It enumerates a list of users in the domain 49 00:02:52,700 --> 00:02:57,080 admin group. It checks if the account is part of the domain admin group, because, you know, you 50 00:02:57,080 --> 00:03:02,800 might get lucky, you never know. It checks SysFall for stored credentials. It syncs the time with 51 00:03:02,800 --> 00:03:09,960 the domain controller and attempts to exploit MS14068. If it's vulnerable, if not, it goes in and 52 00:03:09,960 --> 00:03:18,480 checks MS08, 067, MS1710. It checks which host the account has admin access on. It checks for 53 00:03:18,480 --> 00:03:22,600 impersonation tokens belonging to the domain admin group. If you don't get lucky with that, 54 00:03:22,600 --> 00:03:28,740 find out what happens. If you do get lucky with that, it adds the impersonation token to the domain 55 00:03:28,740 --> 00:03:34,100 admin group and you can run Mimikatz on the DC. If not, it runs Mimikatz locally and you get some 56 00:03:34,100 --> 00:03:39,760 hashes and then if we get any new have has or passwords, we test those credentials and start 57 00:03:39,760 --> 00:03:45,540 again. The whole idea is that it's iterative. We work through it, and then every time we get a new 58 00:03:45,540 --> 00:03:50,380 pass over, we start the process again. Every time we get access to a new host, we start the process 59 00:03:50,380 --> 00:03:52,580 digit again. And we will just continually work through it. às 60 00:03:52,580 --> 00:03:55,620 through this sort of basic workflow until all the passwords 61 00:03:55,620 --> 00:03:58,500 or hashes have been exhausted, or all of the hosts have been 62 00:03:58,500 --> 00:04:01,260 compromised. And then we can continue with some of the post 63 00:04:01,260 --> 00:04:04,300 exploitation modules we have. Another thing that we added 64 00:04:04,300 --> 00:04:08,080 recently is, it's not just an automated sort of click and go 65 00:04:08,080 --> 00:04:13,060 tool, you can run any of these individual modules directly, or 66 00:04:13,060 --> 00:04:15,860 combine them. So we wanted to have that flexibility as well. 67 00:04:16,460 --> 00:04:20,500 So we start with the low hanging fruit. So credentials 68 00:04:20,500 --> 00:04:23,220 may be stored in group policy preferences. So there are a 69 00:04:23,220 --> 00:04:26,520 number of locations where you might find credentials. So drive 70 00:04:26,520 --> 00:04:31,040 maps, local users and groups, schedule tasks, etc. So when you 71 00:04:31,040 --> 00:04:35,380 create a new group policy preference, an XML file is 72 00:04:35,380 --> 00:04:37,080 created in SysVol, which contains all the relevant 73 00:04:37,080 --> 00:04:40,160 configuration information, and you may get passwords in there as 74 00:04:40,160 --> 00:04:43,540 well. And any authenticated domain account can access that, 75 00:04:43,600 --> 00:04:45,740 so you don't need elevated privileges for that. And 76 00:04:46,360 --> 00:04:50,380 passwords are encrypted using a known 32 byte AES key. I say 77 00:04:50,380 --> 00:04:55,360 known because Microsoft published it on MSDN. Presumably, 78 00:04:55,380 --> 00:04:58,920 inadvertently, it had been there for years. So, yeah, we can 79 00:04:58,920 --> 00:05:01,860 decrypt them. But, of course, you know, once this came out, 80 00:05:01,900 --> 00:05:04,700 you know, it's a pretty big fail. So Microsoft patched it 81 00:05:04,700 --> 00:05:10,400 in MS14.025. And so the result of that patch is you can't 82 00:05:10,400 --> 00:05:14,300 create new group policy preferences that rely on saved 83 00:05:14,300 --> 00:05:17,680 passwords. But it doesn't remove the old passwords, right? So 84 00:05:17,680 --> 00:05:20,040 how many clients and organizations do you know that 85 00:05:20,380 --> 00:05:23,260 just patching things, you know, sometimes wrote, you know, a new 86 00:05:23,260 --> 00:05:25,380 patch where you apply it, but they're not really understanding 87 00:05:25,380 --> 00:05:27,360 what's going on in the patch? They don't know what it's 88 00:05:27,360 --> 00:05:29,400 fixing, and they don't know that they need to go back and 89 00:05:29,400 --> 00:05:32,280 clear out those passwords. So we still see it all the time on 90 00:05:32,280 --> 00:05:36,140 tests where they still have old, insecure passwords that we can 91 00:05:36,140 --> 00:05:44,340 decrypt using that key. Then we check for MS14.068. So the, 92 00:05:45,160 --> 00:05:47,860 basically, it's a privilege escalation vulnerability that 93 00:05:47,860 --> 00:05:50,360 allows you to elevate your privileges to domain admin. And, 94 00:05:50,380 --> 00:05:54,200 so, basically, you can create a fake pack claiming that your 95 00:05:54,200 --> 00:05:56,420 regular user that you have access to is a member of the 96 00:05:56,860 --> 00:05:59,240 domain administrator's group and then, you know, elevate your 97 00:05:59,240 --> 00:06:04,220 privileges that way. If that's not successful, we do try, you 98 00:06:04,220 --> 00:06:09,120 know, the classics, right? MS08.067. It's an old one. It's 99 00:06:09,120 --> 00:06:11,420 mostly patched, but you never know your luck, right? So it's 100 00:06:11,420 --> 00:06:15,700 easy one to do. And so we check for that. The more recent one, 101 00:06:15,840 --> 00:06:19,280 you know, thanks to Shadow Brokers and the NSA, allegedly, 102 00:06:20,380 --> 00:06:26,140 we have MS1710, and that's the SMB4 that can also allow for 103 00:06:26,140 --> 00:06:28,540 remote code execution. So if we get remote code execution on 104 00:06:28,540 --> 00:06:32,380 those boxes, well, then that's great, right? So assuming 105 00:06:32,380 --> 00:06:35,960 there's no passwords in SysVol, and assuming those, those 106 00:06:35,960 --> 00:06:38,100 vulnerabilities have been patched and they're not 107 00:06:38,100 --> 00:06:41,340 exploitable, you know, what do we do next? And that's where we 108 00:06:41,340 --> 00:06:43,280 get to the impersonation token. I'll hand it over to Keith. 109 00:06:43,420 --> 00:06:48,000 Okay, thanks. Impersonation token is when a user logs into a 110 00:06:48,000 --> 00:06:50,360 system and then, which button is it? 111 00:06:50,380 --> 00:06:53,760 Okay. And then a delegation token is created, which is 112 00:06:53,760 --> 00:06:57,500 converted to an impersonation token even after the user logs 113 00:06:57,500 --> 00:07:01,000 out. So this impersonation token has exactly the same right as 114 00:07:01,000 --> 00:07:05,720 the delegation token. It doesn't get deleted and it 115 00:07:05,720 --> 00:07:10,100 remains on the system until it's rebooted. So what happens is if 116 00:07:10,100 --> 00:07:14,960 a domain admin logs into a box and then the attackers gets to 117 00:07:14,960 --> 00:07:18,440 the box, he can use that token to execute domain commands, 118 00:07:20,380 --> 00:07:24,460 that run on the domain controller, yeah, using, having the same 119 00:07:24,460 --> 00:07:32,900 privilege as the domain admin. So, yeah, this is just an example of 120 00:07:32,900 --> 00:07:37,420 what it looks like when we, using the privilege escalation, 121 00:07:37,440 --> 00:07:44,580 using the token. Sorry. Okay, so if there's no impersonation token, 122 00:07:44,780 --> 00:07:47,600 what happens? For sure, we'll run the Mimikatz and as well, 123 00:07:47,620 --> 00:07:50,300 down the local password hashes. So if there are new password 124 00:07:50,380 --> 00:07:54,840 hashes or new password that gets, it gets added to a database 125 00:07:54,840 --> 00:07:57,820 and then the process continues and it tries to use the new 126 00:07:57,820 --> 00:08:00,740 password to attack hosts that have not been tested before. And 127 00:08:01,120 --> 00:08:04,120 it repeats this again until there's, it runs out of password 128 00:08:04,120 --> 00:08:08,640 to test or until all hosts have been compromised. So the thing 129 00:08:08,640 --> 00:08:11,900 about shared local administrator password is, um, sometimes 130 00:08:11,900 --> 00:08:16,920 IT administrators are lazy or they've tried to do it the easy 131 00:08:16,920 --> 00:08:20,300 way out. Um, all the systems are using the same shared local 132 00:08:20,380 --> 00:08:23,900 administrator password. So when you compromise one host, you can 133 00:08:25,000 --> 00:08:27,740 compromise the other host in the network which having the same 134 00:08:27,740 --> 00:08:35,000 shared local administrator password. So yeah, so with the, um, with the 135 00:08:35,000 --> 00:08:38,420 shared, uh, local admin password, the idea is that, um, you know, 136 00:08:38,440 --> 00:08:41,120 typically when we talk about privilege escalation, right, we're, 137 00:08:41,120 --> 00:08:44,100 we're usually only looking to go up. But one, one of the things 138 00:08:44,100 --> 00:08:46,880 that we want to do on a pen test is get a lot of coverage and, you 139 00:08:46,880 --> 00:08:50,220 know, it's, it's a real sort of pain in the ass to check every sort of, 140 00:08:50,380 --> 00:08:53,060 uh, host in the, you know, in the network that you may be, uh, 141 00:08:53,120 --> 00:08:56,240 may be in scope, um, to see if the, uh, credentials that you 142 00:08:56,240 --> 00:08:59,080 have could be useful. So, so the idea is that we can get, uh, a 143 00:08:59,080 --> 00:09:01,560 lot of breadth and, um, we're looking to expand on that, uh, 144 00:09:01,660 --> 00:09:05,080 and I'll get, I'll get to that at the end. Um, so yeah, uh, so the 145 00:09:05,080 --> 00:09:07,520 other thing, you know, going back to the context, right, um, 146 00:09:07,640 --> 00:09:09,640 there are a number of, uh, controls that have been 147 00:09:09,640 --> 00:09:13,120 implemented, um, that, uh, you know, can stop us from doing 148 00:09:13,120 --> 00:09:15,660 these things. So we need to figure out ways to bypass that 149 00:09:15,660 --> 00:09:18,400 and Portia has support to automate some of these bypasses. 150 00:09:18,480 --> 00:09:20,360 So, uh, Microsoft's created the app called, uh, Microsoft 151 00:09:20,380 --> 00:09:23,880 Anti-Malware Scan Interface. Um, so it's designed to detect and 152 00:09:23,880 --> 00:09:26,400 prevent script attacks, so things like all your, all your 153 00:09:26,400 --> 00:09:28,580 PowerShell scripts, right, that you're running, it's designed 154 00:09:28,580 --> 00:09:32,800 to, to detect those and, um, to, to shut them down, right? 155 00:09:32,900 --> 00:09:35,860 So, uh, it implements a number of security checks, so it scans, 156 00:09:35,900 --> 00:09:39,420 you know, file and memory and stream, um, content source, URL, 157 00:09:39,540 --> 00:09:42,760 IP, you know, checks, um, and a whole bunch of other techniques. 158 00:09:43,020 --> 00:09:47,580 Um, it also has some support for, um, breaking through obfuscated 159 00:09:47,580 --> 00:09:50,360 scripts and, and identifying obfuscated scripts. Um, so, 160 00:09:50,380 --> 00:09:53,100 um, and Portia currently implements two techniques to 161 00:09:53,100 --> 00:09:58,160 automatically bypass, uh, AMSI. So, the, the first one is like a 162 00:09:58,160 --> 00:10:01,080 real basic one. You might get lucky with it. Most times no, 163 00:10:01,180 --> 00:10:02,740 but we still got it because it's pretty easy to implement. 164 00:10:03,000 --> 00:10:07,440 Um, so basically if the host is running .NET, uh, version 2.0, 165 00:10:07,500 --> 00:10:09,340 you know, you can see the whole string up there. It's a very 166 00:10:09,340 --> 00:10:11,820 specific version. You can actually force the use of 167 00:10:11,820 --> 00:10:17,600 PowerShell v2. So, um, AMSI is supported in, uh, PowerShell 168 00:10:17,600 --> 00:10:20,360 version 3, but not, currently not PowerShell version 2. So, 169 00:10:20,380 --> 00:10:23,460 um, so with that you can use the dash version option, so it's 170 00:10:23,460 --> 00:10:26,320 dash version 2, and you can, uh, force the use of PowerShell 2, 171 00:10:26,480 --> 00:10:31,140 which, you know, is bypasses AMSI. So, uh, works well. But, 172 00:10:31,240 --> 00:10:33,680 you know, it's, it's reliant on that single version being 173 00:10:33,680 --> 00:10:37,760 available. Um, the more robust technique, um, was created by a 174 00:10:37,760 --> 00:10:40,220 guy called Matt Graber. I apologize if I ruined his name. 175 00:10:40,380 --> 00:10:44,700 Um, but, uh, uh, basically, um, it's a simple one-liner, um, 176 00:10:44,760 --> 00:10:47,720 that unloads AMSI from the current process, and it doesn't 177 00:10:47,720 --> 00:10:50,320 require elevated privileges, and it works with PowerShell v3. 178 00:10:50,380 --> 00:10:53,120 Right? With AMSI. So, um, that's the robust one that 179 00:10:53,120 --> 00:10:55,780 usually works most of the time. Um, there's a bunch of other sort 180 00:10:55,780 --> 00:10:59,020 of bypass techniques that have been, um, presented, uh, over the 181 00:10:59,020 --> 00:11:02,680 years. Um, and, you know, we'll probably add some more, uh, as we 182 00:11:02,680 --> 00:11:05,980 continue to develop Portia. Um, the other, the other control 183 00:11:05,980 --> 00:11:09,340 that we frequently run up against is AppLocker. Um, so, 184 00:11:09,380 --> 00:11:12,440 Portia implements a number of AppLocker bypass techniques. Um, 185 00:11:12,580 --> 00:11:16,500 so, one, the first one is, um, you know, exploiting weak path 186 00:11:16,500 --> 00:11:19,240 rules. So, inappropriate folder permissions. So, by default, 187 00:11:19,240 --> 00:11:23,000 Windows allows read and write, um, uh, under the Windows, uh, 188 00:11:23,060 --> 00:11:25,740 directory, but Windows slash tasks, Windows slash temp, and 189 00:11:25,740 --> 00:11:29,020 Windows slash tracing. Um, so, any binary that executes from 190 00:11:29,020 --> 00:11:31,740 these folders won't be blocked by AppLocker. And so, you, 191 00:11:31,820 --> 00:11:34,380 Portia just loads PowerShell into that, into the task 192 00:11:34,380 --> 00:11:36,400 directory, and, and we're good to go. So, pretty 193 00:11:36,400 --> 00:11:39,740 straightforward bypass. Um, the other one that it tries, uh, is 194 00:11:39,740 --> 00:11:44,180 with MSBuild.exe. So, injecting code into a signed Microsoft 195 00:11:44,180 --> 00:11:47,340 binary, um, you know, if you, if you manage to do that, it will 196 00:11:47,340 --> 00:11:49,220 execute code without it being picked up by a device. Um, so, 197 00:11:50,800 --> 00:11:54,460 MSBuild.exe, specifically, allows for, uh, inline tasks, 198 00:11:54,620 --> 00:11:57,980 which is basically, uh, allows you to compile and execute code 199 00:11:57,980 --> 00:12:01,240 and memory on the target, um, and, you know, can be used to 200 00:12:01,240 --> 00:12:04,140 effectively execute arbitrary code on the target, and Portia 201 00:12:04,140 --> 00:12:07,760 uses that as, as an AppLocker bypass, if, if necessary. And 202 00:12:07,760 --> 00:12:12,460 the final AppLocker bypass, um, is, uh, a, a script that was 203 00:12:12,460 --> 00:12:14,980 written, I don't, I'm not going to try and pronounce his GitHub 204 00:12:14,980 --> 00:12:17,860 username, um, but it was, it was written by that guy, and it was 205 00:12:17,860 --> 00:12:19,220 based on technique developed by, uh, by, uh, by, uh, by, uh, 206 00:12:19,240 --> 00:12:21,980 by a sub-team, um, and it'll actually run .NET code inside 207 00:12:21,980 --> 00:12:28,140 JScript or VBScript. Uh, so, PowerShell also, uh, Portia also 208 00:12:28,140 --> 00:12:32,180 has, uh, support for the invoke obfuscation script. Um, so, 209 00:12:32,240 --> 00:12:34,480 basically, it's a script developed by a guy called 210 00:12:34,480 --> 00:12:38,180 Daniel Bohannon, um, and it'll, it allows for, uh, obfuscation 211 00:12:38,180 --> 00:12:41,920 of your PowerShell scripts, uh, with the idea that you can 212 00:12:41,920 --> 00:12:44,820 bypass AV and other protections that might be looking for, um, 213 00:12:45,020 --> 00:12:49,220 PowerShell scripts. Um, so, I mean, it doesn't work 100% 214 00:12:49,240 --> 00:12:52,440 of the time against every AV, but it, it works well enough most 215 00:12:52,440 --> 00:12:56,620 of the time. Um, the other thing as well, again, going back to the 216 00:12:56,620 --> 00:12:59,160 context at the start, where we sort of said, you know, a lot of 217 00:12:59,160 --> 00:13:01,560 these, uh, scripts and tools that we use aren't well 218 00:13:01,560 --> 00:13:04,620 maintained, and they don't really, uh, run well against 219 00:13:04,620 --> 00:13:08,440 newer versions of Windows, um, the invoke Mimikatz script, uh, 220 00:13:08,720 --> 00:13:12,300 script, which is the one that's commonly used, um, to, to run 221 00:13:12,300 --> 00:13:15,440 Mimikatz, um, it's running an outdated version of Mimikatz, 222 00:13:15,580 --> 00:13:18,160 and it can have issues with Windows 10. So, the way that 223 00:13:18,160 --> 00:13:19,220 Portia does it, uh, it's, it's, it's, it's, it's, it's, it's 224 00:13:19,240 --> 00:13:23,120 we use the invoke reflective PE injection script, which runs the 225 00:13:23,120 --> 00:13:25,300 latest version of Mimikatz, so it can be any kind of code, it 226 00:13:25,300 --> 00:13:27,580 doesn't have to be Mimikatz, uh, in the memory of the target 227 00:13:27,580 --> 00:13:30,880 host, and it's a way more reliable version, uh, uh, way 228 00:13:30,880 --> 00:13:35,940 more reliable against recent versions of, of Windows. Um, so 229 00:13:35,940 --> 00:13:39,000 the other thing that Portia does automatically is, we've got this 230 00:13:39,000 --> 00:13:42,080 list of passwords right, we've got this database, um, we check 231 00:13:42,080 --> 00:13:45,220 it against any available, uh, SMB shares or folders just to 232 00:13:45,220 --> 00:13:48,120 see what we can access, what we can't, and which passwords work 233 00:13:48,120 --> 00:13:49,220 with which, with, with, with, with, with, with, with, with, 234 00:13:49,240 --> 00:13:55,420 which resources. Um, cool. And Portia, uh, has a bunch of, uh, 235 00:13:55,580 --> 00:13:57,720 other modules, so we, we mentioned a bunch of, like, 236 00:13:57,780 --> 00:14:01,740 convenience modules, um, and, you know, other privilege 237 00:14:01,740 --> 00:14:05,160 escalation related modules. Um, this is just a sampling, we're 238 00:14:05,160 --> 00:14:07,260 adding more all the time, so obviously it's available on 239 00:14:07,260 --> 00:14:09,740 GitHub, I'll throw up the link at the end, um, so if, if 240 00:14:09,740 --> 00:14:12,400 people want to contribute, uh, they can. So, currently, you 241 00:14:12,400 --> 00:14:14,640 know, it dumps wireless passwords, it looks for, um, 242 00:14:14,740 --> 00:14:16,960 configuration files that are known to have, you know, 243 00:14:16,960 --> 00:14:19,220 passwords in it, like VNC configurations. Um, and, and, and, 244 00:14:19,240 --> 00:14:22,040 party configurations, things like that. Uh, it dumps browser 245 00:14:22,040 --> 00:14:26,180 credentials as well, um, and, uh, you know, key pass 246 00:14:26,180 --> 00:14:29,720 credentials, um, you know, config files, things like that. 247 00:14:29,940 --> 00:14:35,820 Um, it also, it also has, uh, an, a, a recent module which is 248 00:14:35,820 --> 00:14:39,560 automatic compromise of MS SQL databases, and I'll hand over 249 00:14:39,560 --> 00:14:44,160 Keith to, to go through that. Okay, so what happens in this 250 00:14:44,160 --> 00:14:48,800 module is, um, let's say if you don't have access to the SMB 251 00:14:48,800 --> 00:14:52,080 ports, but there's a MS SQL service that's running. So, what 252 00:14:52,080 --> 00:14:55,660 this module does is, um, look for weak passwords, whether you're 253 00:14:55,660 --> 00:14:58,580 using, um, it has to go into the weak password that is, uh, 254 00:14:58,580 --> 00:15:01,060 supplied by social engineering toolkit, and then if it's 255 00:15:01,060 --> 00:15:05,240 successful, enable XP CMD shell, like, uh, as a local admin 256 00:15:05,240 --> 00:15:08,840 account on the box, and it also enables the admin share so that 257 00:15:08,840 --> 00:15:13,760 you can run SMB stuff. Uh, dump hashes and, well, I mean, dump 258 00:15:13,760 --> 00:15:17,800 hashes from the same database, um, dumps clear text credentials 259 00:15:17,800 --> 00:15:18,700 via Mimikas. 260 00:15:18,800 --> 00:15:21,920 Um, it also looks for interesting information stored in 261 00:15:21,920 --> 00:15:25,440 the database, like, uh, card information or password. Yeah. 262 00:15:25,800 --> 00:15:30,780 Um, so this is just a screenshot of what it does. So, um, as you 263 00:15:30,780 --> 00:15:33,440 see in this screenshot, it detects that, um, PowerShell is 264 00:15:33,440 --> 00:15:36,740 blocked by ad blocker, so it attempts one of the technique to 265 00:15:36,740 --> 00:15:42,080 bypass it so it can run invoke Mimikas, and then, um, it adds, 266 00:15:42,160 --> 00:15:45,140 uh, it found, it dumps the clear text credentials from memory, 267 00:15:45,800 --> 00:15:48,780 and then it dumps the same, the hashes from the same database. 268 00:15:48,780 --> 00:15:54,120 And then, um, it dumps the, sorry, where is it, the MSSQL 269 00:15:54,120 --> 00:15:58,340 credentials, and lastly, at the bottom, you can see that it 270 00:15:58,340 --> 00:16:02,540 finds all the interesting data and display in a format that is 271 00:16:02,540 --> 00:16:05,040 easy for you to see, so you don't have to look through all 272 00:16:05,040 --> 00:16:06,180 the tables and stuff. 273 00:16:06,460 --> 00:16:09,520 So currently, Portia looks for things like usernames, 274 00:16:09,580 --> 00:16:12,940 passwords, credit card numbers, emails, anything that's 275 00:16:12,940 --> 00:16:15,440 sensitive that may be useful on a, on a pen test, typically? 276 00:16:15,780 --> 00:16:15,980 Yeah. 277 00:16:17,840 --> 00:16:18,760 Um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, 278 00:16:18,780 --> 00:16:21,700 um, so, uh, Portia also looks for interesting files that could 279 00:16:21,700 --> 00:16:26,880 be like KeeBuzz database, um, unused 10.XMR, that can 280 00:16:26,880 --> 00:16:30,700 contains credentials or trav ng .ni that can also create 281 00:16:30,700 --> 00:16:36,080 credentials and, um, documents that has the name password in 282 00:16:36,080 --> 00:16:37,760 them, and so on and so forth. 283 00:16:38,920 --> 00:16:41,940 And, yep, you can use other modules, like there's a 284 00:16:41,940 --> 00:16:44,700 KeeBuzz module, or there's a Tue specific module that will 285 00:16:44,700 --> 00:16:48,680 actually unlock them on you, they can dump this on, the 286 00:16:48,680 --> 00:16:48,760 panel, or you can use, you can use Modules that, that are 287 00:16:48,780 --> 00:16:51,360 password and the keys to decrypt it offline. 288 00:16:51,780 --> 00:16:53,340 You can use any of these modules individually? 289 00:16:53,600 --> 00:16:55,160 You don't need to let it run automatically? 290 00:16:55,360 --> 00:16:57,280 If you just want to run, you know, 291 00:16:57,720 --> 00:17:01,600 just want to use it to look for any files called, you know, 292 00:17:01,640 --> 00:17:04,200 password.txt or that look like they contain passwords, 293 00:17:04,340 --> 00:17:04,960 you can just do that. 294 00:17:05,020 --> 00:17:06,100 So even if you've got access already, 295 00:17:06,640 --> 00:17:08,480 you can just run the modules individually. 296 00:17:08,800 --> 00:17:10,980 And you will automatically download them for you, 297 00:17:11,040 --> 00:17:13,380 so you don't have to pull it down individually. 298 00:17:13,700 --> 00:17:16,680 And you also display, like, the first few string of what it 299 00:17:16,680 --> 00:17:17,960 looks like as a text document. 300 00:17:22,220 --> 00:17:25,080 So the other thing that we do, another module that we have 301 00:17:25,080 --> 00:17:26,500 that's pretty common, that's very useful, 302 00:17:26,620 --> 00:17:28,500 is dumping browser creds. 303 00:17:28,780 --> 00:17:30,560 So it uses various PowerShell scripts. 304 00:17:30,720 --> 00:17:36,140 So first it checks if Firefox or Chrome is present on the system. 305 00:17:36,520 --> 00:17:40,360 It checks if the current logged in user, you know, 306 00:17:40,360 --> 00:17:42,500 what the current logged in user is and checks whether we have 307 00:17:42,500 --> 00:17:45,320 that hash or password belonging to that user in our sort of 308 00:17:45,320 --> 00:17:46,520 Portia database. 309 00:17:46,680 --> 00:17:47,060 So to speak. 310 00:17:47,300 --> 00:17:50,460 And then we have a PowerShell script that runs within that 311 00:17:50,460 --> 00:17:52,760 user session and dumps the credentials to a file. 312 00:17:53,720 --> 00:17:57,080 The other thing we do, so this is an example of, like, 313 00:17:57,120 --> 00:18:00,020 a convenience module that we have in there that's not directly 314 00:18:00,020 --> 00:18:03,980 related to privilege escalation or lateral movement or anything 315 00:18:03,980 --> 00:18:06,740 like that, but it's a common activity that we would do on a 316 00:18:06,740 --> 00:18:07,100 pen test. 317 00:18:07,300 --> 00:18:11,260 So, you know, most pen testing we do or generally is for PCI or 318 00:18:11,260 --> 00:18:13,860 we're looking for credit card information or something that's, 319 00:18:13,860 --> 00:18:15,220 you know, something of value like that. 320 00:18:15,220 --> 00:18:18,880 So we've got a module in here that searches for pen on disk and 321 00:18:18,880 --> 00:18:19,280 in memory. 322 00:18:19,620 --> 00:18:21,560 It uses a couple of scripts that are already written. 323 00:18:21,640 --> 00:18:23,420 We didn't write anything new for it. 324 00:18:24,260 --> 00:18:26,840 Basically, obviously the credit card found on the disk, 325 00:18:26,960 --> 00:18:30,220 it works through the same way as the other modules that find 326 00:18:30,220 --> 00:18:31,140 interesting files works. 327 00:18:31,460 --> 00:18:33,160 But the way that the memory scraper works, 328 00:18:33,620 --> 00:18:36,860 so Portia will enumerate a list of all applications on the host 329 00:18:36,860 --> 00:18:38,440 that we have admin access on. 330 00:18:39,040 --> 00:18:43,120 And then once we've got that list of processes running, you know, 331 00:18:43,140 --> 00:18:44,720 we have produced a table. 332 00:18:44,720 --> 00:18:48,900 That, you know, shows which programs are running on which hosts 333 00:18:48,900 --> 00:18:50,720 and what processes are common. 334 00:18:50,920 --> 00:18:53,620 And then we look for interesting processes to dump. 335 00:18:53,720 --> 00:18:54,840 So we don't dump it all, obviously. 336 00:18:55,040 --> 00:18:56,260 But this is what it looks like. 337 00:18:56,340 --> 00:18:57,280 So you've got that table there. 338 00:18:57,480 --> 00:19:00,980 So let's say you're, you know, doing a retail client or something 339 00:19:00,980 --> 00:19:02,140 like that that's got POS systems. 340 00:19:02,440 --> 00:19:06,260 It's likely their POS application potentially has credit card 341 00:19:06,260 --> 00:19:07,600 information in memory. 342 00:19:07,820 --> 00:19:11,080 So you would select that process if you've got access to that host 343 00:19:12,380 --> 00:19:14,700 and dump the memory and see if you can print that out. 344 00:19:14,700 --> 00:19:17,020 You can find anything good in the memory. 345 00:19:19,340 --> 00:19:22,060 We've also got some basic support for analyzing hashes. 346 00:19:22,280 --> 00:19:27,120 So currently we can analyze if there's a blank hash or if there 347 00:19:27,120 --> 00:19:28,440 are accounts that are using the same hash. 348 00:19:29,060 --> 00:19:31,780 But, you know, we want to build out this functionality a little 349 00:19:31,780 --> 00:19:32,220 bit further. 350 00:19:32,460 --> 00:19:35,940 So one of the things that we unfortunately commonly see on 351 00:19:35,940 --> 00:19:39,440 pen tests is password reuse between low privileged accounts 352 00:19:39,440 --> 00:19:40,480 and high privileged accounts. 353 00:19:41,080 --> 00:19:43,800 So we sort of see that all the time where they use the same 354 00:19:43,800 --> 00:19:44,620 password for both. 355 00:19:44,700 --> 00:19:47,160 So if you're able to get the low privileged account, it's very 356 00:19:47,160 --> 00:19:49,980 easy to get access to the higher privileged account. 357 00:19:50,740 --> 00:19:54,460 So we've got a, well, Portia, currently this is what Portia 358 00:19:54,460 --> 00:19:54,680 does. 359 00:19:55,020 --> 00:19:57,540 It has a list of the valid hashes and analyzes it for 360 00:19:57,540 --> 00:20:01,280 patterns, obviously blank ones, you know, reuse passwords across 361 00:20:01,280 --> 00:20:04,720 different, you know, different accounts and things like that. 362 00:20:06,240 --> 00:20:09,740 So, yeah, and as I said, we're looking to expand it and it can 363 00:20:09,740 --> 00:20:11,160 be useful on a pen test. 364 00:20:12,180 --> 00:20:14,680 So where are we looking to take Portia? 365 00:20:14,680 --> 00:20:19,140 So it's something that we're continuing to actively develop. 366 00:20:19,400 --> 00:20:23,700 The biggest area that we want to progress in is attacking targets 367 00:20:23,700 --> 00:20:26,800 in adjacent networks via proxying through trusted hosts, right? 368 00:20:26,900 --> 00:20:30,680 So if we're in a particular network segment and we don't have 369 00:20:30,680 --> 00:20:33,560 access to other hosts on another network segment, but we have a 370 00:20:33,560 --> 00:20:37,760 host that we have access to on our segment that's trusted into the 371 00:20:37,760 --> 00:20:41,400 other segment, we can proxy through that to run Portia then on those 372 00:20:41,400 --> 00:20:42,280 hosts that it can see. 373 00:20:42,560 --> 00:20:44,600 So that's something that we're working on right now. 374 00:20:44,600 --> 00:20:47,520 That we want to really improve on. 375 00:20:47,680 --> 00:20:51,560 And I think it's sort of the missing feature right now that 376 00:20:51,560 --> 00:20:53,800 will make Portia really more, a lot more robust. 377 00:20:54,000 --> 00:20:55,160 So that's what we're working on now. 378 00:20:55,520 --> 00:20:58,360 We're looking to add a bunch of data exfiltration modules as well 379 00:20:58,360 --> 00:21:01,060 because that's a common activity that we do on pen tests. 380 00:21:01,960 --> 00:21:05,840 We would like to add support for more database modules as well. 381 00:21:06,900 --> 00:21:09,580 So not just MS SQL, you know, Postgres, whatever. 382 00:21:11,000 --> 00:21:14,500 And there are a few dependencies as you may have been able to 383 00:21:14,500 --> 00:21:14,580 understand. 384 00:21:14,580 --> 00:21:14,600 But we want to make sure that we have a lot of support for those 385 00:21:14,600 --> 00:21:15,040 So that's something that we're trying to allude to. 386 00:21:15,720 --> 00:21:17,500 And they're not, it's not difficult to set up. 387 00:21:17,560 --> 00:21:19,840 It's not like trying to set up Metasploit from scratch. 388 00:21:20,580 --> 00:21:23,660 But, you know, we want to create a doc image just to make it, you 389 00:21:23,660 --> 00:21:26,180 know, easier to set up and deploy. 390 00:21:26,960 --> 00:21:28,160 So this is where it's located. 391 00:21:28,600 --> 00:21:29,720 It's on our GitHub page. 392 00:21:30,560 --> 00:21:35,680 Feel free to, oh, yeah, we'll just switch over because we're 393 00:21:35,680 --> 00:21:36,340 going to do a demo now. 394 00:21:37,960 --> 00:21:39,060 But hopefully it works. 395 00:21:39,240 --> 00:21:39,560 We'll see. 396 00:21:39,780 --> 00:21:41,340 But, yeah, so check it out. 397 00:21:41,460 --> 00:21:42,820 It's on our GitHub page. 398 00:21:44,580 --> 00:21:47,820 And if you have an idea or if you want to develop a module of 399 00:21:47,820 --> 00:21:50,140 your own, yeah, I think we're good. 400 00:21:51,940 --> 00:21:52,340 Yeah. 401 00:21:54,040 --> 00:21:54,440 No? 402 00:21:54,660 --> 00:21:55,060 Nothing? 403 00:21:55,220 --> 00:21:56,040 Yeah, there we go. 404 00:21:56,200 --> 00:21:56,600 All right. 405 00:21:56,880 --> 00:22:01,160 So, yeah, if you have ideas for modules or you have issues or 406 00:22:01,160 --> 00:22:04,620 bugs, submit an issue in GitHub or submit a pull request if you 407 00:22:04,620 --> 00:22:05,260 want to. 408 00:22:05,720 --> 00:22:06,800 And we'll go from there. 409 00:22:06,920 --> 00:22:08,720 So now we have a demo. 410 00:22:12,280 --> 00:22:12,680 Yep. 411 00:22:14,580 --> 00:22:16,400 So you can see that it's just through the normal mode where 412 00:22:16,400 --> 00:22:19,740 you find the boxes and try to compromise and get the hashes 413 00:22:19,740 --> 00:22:23,540 and password and from compromising one box to compromising the 414 00:22:23,540 --> 00:22:23,980 domain controller. 415 00:22:24,620 --> 00:22:26,360 I'll let you run first because it's going to take a while. 416 00:22:26,460 --> 00:22:27,220 But let me explain. 417 00:22:27,420 --> 00:22:28,000 I'll come back to it. 418 00:22:28,240 --> 00:22:32,360 So what happens is you get a password that you capture or 419 00:22:32,360 --> 00:22:34,800 crack from some other place. 420 00:22:35,620 --> 00:22:38,680 So you've managed to find that it has an admin access on one of 421 00:22:38,680 --> 00:22:39,040 the boxes. 422 00:22:39,180 --> 00:22:40,180 You just go to the domain. 423 00:22:40,840 --> 00:22:42,180 And this is what you see. 424 00:22:42,180 --> 00:22:45,360 So firstly it dumps MimiCats followed by dumping the hashes. 425 00:22:45,480 --> 00:22:49,000 So something interesting is one of the administrator has locked 426 00:22:49,000 --> 00:22:49,640 into the same box. 427 00:22:49,820 --> 00:22:52,260 So you do see a domain admin account here. 428 00:22:53,420 --> 00:22:56,160 Can everybody see that? 429 00:22:56,220 --> 00:22:56,940 It's a bit small, right? 430 00:22:57,720 --> 00:22:58,520 Can you? 431 00:23:00,060 --> 00:23:00,940 You go ahead. 432 00:23:01,800 --> 00:23:02,320 Sorry. 433 00:23:05,880 --> 00:23:06,400 View? 434 00:23:06,860 --> 00:23:07,380 Yeah. 435 00:23:10,380 --> 00:23:11,180 Zoom in? 436 00:23:11,640 --> 00:23:12,160 Yeah. 437 00:23:12,180 --> 00:23:13,820 Is it better? 438 00:23:14,440 --> 00:23:15,300 Is that better? 439 00:23:16,600 --> 00:23:17,080 Yeah. 440 00:23:17,280 --> 00:23:17,760 Cool. 441 00:23:18,020 --> 00:23:18,340 Okay. 442 00:23:18,540 --> 00:23:21,220 Let's move back to the start. 443 00:23:21,440 --> 00:23:21,940 Where is it? 444 00:23:23,520 --> 00:23:24,000 Okay. 445 00:23:24,100 --> 00:23:24,760 So, yeah. 446 00:23:24,880 --> 00:23:25,060 Sorry. 447 00:23:25,140 --> 00:23:27,420 Maybe just to take a step back just to remind everybody. 448 00:23:27,680 --> 00:23:29,320 This is just a really simple network. 449 00:23:29,540 --> 00:23:31,540 We've got a domain controller. 450 00:23:32,080 --> 00:23:36,720 We've got a host that's connected to the domain 451 00:23:36,720 --> 00:23:37,040 controller. 452 00:23:42,180 --> 00:23:43,240 It's a pretty simple network. 453 00:23:43,740 --> 00:23:46,200 It's just because it can take a while if you've got a large 454 00:23:46,200 --> 00:23:46,520 network. 455 00:23:48,040 --> 00:23:48,460 Yeah. 456 00:23:48,580 --> 00:23:50,960 So on this machine that's joined to a domain, 457 00:23:51,340 --> 00:23:52,940 there is a domain admin account. 458 00:23:53,300 --> 00:23:55,360 I mean, the domain administrator has locked in. 459 00:23:55,680 --> 00:24:00,100 So after it dumps the credentials by MimiCats, 460 00:24:00,180 --> 00:24:01,140 it dumps the same database. 461 00:24:01,940 --> 00:24:02,980 It analyzes that. 462 00:24:03,120 --> 00:24:07,140 It also tries to pick up the impersonation token. 463 00:24:07,360 --> 00:24:10,080 So that's an administrator impersonation token. 464 00:24:10,240 --> 00:24:12,160 So we can basically make use of either the 465 00:24:12,180 --> 00:24:13,640 clear text credential or the token. 466 00:24:13,820 --> 00:24:15,780 Since you have the past clear text credential, 467 00:24:16,000 --> 00:24:18,560 the script will just, for sure, 468 00:24:18,620 --> 00:24:20,320 will just use the clear text credential 469 00:24:20,320 --> 00:24:21,640 to compromise the domain controller. 470 00:24:23,000 --> 00:24:23,480 Yup. 471 00:24:23,540 --> 00:24:25,220 It just tests MS14068. 472 00:24:25,560 --> 00:24:27,480 Since the first account we used 473 00:24:27,480 --> 00:24:28,820 was a local user account, 474 00:24:29,080 --> 00:24:30,360 it doesn't have access to the domain, 475 00:24:30,480 --> 00:24:31,520 so it will skip this part. 476 00:24:31,820 --> 00:24:33,920 If it has a valid user account, 477 00:24:34,100 --> 00:24:36,640 it will test whether it is vulnerable to MS14068. 478 00:24:38,020 --> 00:24:39,840 So now it has moved the lateral movement 479 00:24:39,840 --> 00:24:41,720 to compromise the domain controller. 480 00:24:42,240 --> 00:24:43,840 Using the credentials that you have 481 00:24:43,840 --> 00:24:44,680 captured from memory. 482 00:24:45,300 --> 00:24:47,060 So it does the same thing. 483 00:24:48,120 --> 00:24:49,500 MimiCats, same database, 484 00:24:50,060 --> 00:24:51,420 and then tokens. 485 00:24:51,920 --> 00:24:54,220 And then it collects all these credentials 486 00:24:54,220 --> 00:24:55,820 and hashes and compromise 487 00:24:55,820 --> 00:24:56,860 the third box, which is 488 00:24:58,140 --> 00:24:59,480 host in the work group mode. 489 00:24:59,940 --> 00:25:00,600 But coincidentally, 490 00:25:01,600 --> 00:25:03,400 just as what we've spoken earlier 491 00:25:03,400 --> 00:25:04,900 about the shared local administrator password, 492 00:25:05,300 --> 00:25:07,180 so these two machines, even though one is in domain, 493 00:25:07,320 --> 00:25:07,980 one is the work group, 494 00:25:08,560 --> 00:25:10,760 both are using the same shared local administrator password. 495 00:25:12,180 --> 00:25:12,260 Using the, 496 00:25:13,420 --> 00:25:14,820 as you see here, 497 00:25:15,460 --> 00:25:16,960 it uses the hash, 498 00:25:17,480 --> 00:25:19,700 NTIA hash to compromise the third box. 499 00:25:20,560 --> 00:25:21,680 So in the end, 500 00:25:21,720 --> 00:25:23,240 it will tell you like, 501 00:25:24,040 --> 00:25:25,680 it will stop when 502 00:25:25,680 --> 00:25:27,780 it runs out of hashes or passwords to try, 503 00:25:27,920 --> 00:25:29,620 or when all hosts have been compromised. 504 00:25:30,200 --> 00:25:32,000 So what you see here is all the hashes 505 00:25:32,000 --> 00:25:33,460 that it has seen and collected so far. 506 00:25:35,280 --> 00:25:35,960 Password first, 507 00:25:36,180 --> 00:25:36,900 followed by hashes, 508 00:25:37,100 --> 00:25:39,380 and then it does an analysis of 509 00:25:39,380 --> 00:25:41,660 what accounts use what password, what hash. 510 00:25:42,180 --> 00:25:44,180 You can see that these two accounts use the same 511 00:25:44,180 --> 00:25:45,320 password hash and so on. 512 00:25:45,820 --> 00:25:47,960 And then it also 513 00:25:47,960 --> 00:25:49,400 lists down what hash and what password 514 00:25:49,400 --> 00:25:50,960 it used to get into the box. 515 00:25:51,840 --> 00:25:54,140 So, and then it ends by saying 516 00:25:54,140 --> 00:25:55,700 that you can either run post-expert module 517 00:25:55,700 --> 00:25:57,520 or it stops this way. 518 00:25:58,120 --> 00:25:59,940 So let's look at another 519 00:25:59,940 --> 00:26:01,420 thing, which is the 520 00:26:01,420 --> 00:26:02,740 MSSQL module. 521 00:26:09,720 --> 00:26:11,760 Okay, like just now I was explaining 522 00:26:12,180 --> 00:26:14,400 scenario where there's only MSSQL 523 00:26:14,400 --> 00:26:15,260 port that's open, 524 00:26:15,440 --> 00:26:16,680 SMB ports are not open. 525 00:26:16,800 --> 00:26:18,360 So how do you compromise it? 526 00:26:18,780 --> 00:26:21,240 So in this case, 527 00:26:21,300 --> 00:26:22,900 it found a default account. 528 00:26:23,220 --> 00:26:24,980 It tried to test against a weak password. 529 00:26:25,960 --> 00:26:26,700 And then, 530 00:26:27,440 --> 00:26:29,740 so it got in and then it enabled 531 00:26:29,740 --> 00:26:31,080 the XPCMD shell. 532 00:26:31,280 --> 00:26:32,600 It adds a local admin account. 533 00:26:33,420 --> 00:26:35,720 And then when it's trying to run 534 00:26:35,720 --> 00:26:36,860 other scripts, it realized that 535 00:26:38,040 --> 00:26:39,640 PowerShell is blocked by AdBlocker. 536 00:26:39,800 --> 00:26:41,340 So it attempt one of the techniques. 537 00:26:42,180 --> 00:26:43,660 And then successfully run 538 00:26:44,080 --> 00:26:45,020 on the machine. 539 00:26:45,240 --> 00:26:46,740 Done the clear text credentials. 540 00:26:47,460 --> 00:26:48,800 Done the same database. 541 00:26:49,280 --> 00:26:52,240 And then followed by things like 542 00:26:52,240 --> 00:26:53,660 the password 543 00:26:53,660 --> 00:26:54,800 and look for interesting data. 544 00:26:55,480 --> 00:26:58,020 I mean, it also enabled 545 00:26:58,020 --> 00:26:59,900 the admin folder so that you can 546 00:26:59,900 --> 00:27:01,680 access it remotely, even though 547 00:27:01,680 --> 00:27:02,860 it's blocked initially. 548 00:27:04,480 --> 00:27:06,000 In future version, I plan to do 549 00:27:06,000 --> 00:27:07,980 like, every sub-version 550 00:27:07,980 --> 00:27:09,260 that's compromised, you return shells. 551 00:27:09,500 --> 00:27:11,920 So that's more fun than just 552 00:27:12,180 --> 00:27:12,560 getting past it. 553 00:27:13,720 --> 00:27:15,920 Another thing that we're also developing 554 00:27:16,780 --> 00:27:18,080 is a tool 555 00:27:18,080 --> 00:27:19,900 one of our colleagues in Singapore 556 00:27:19,900 --> 00:27:20,820 wrote as well, 557 00:27:21,740 --> 00:27:23,000 called 2M Assassin. 558 00:27:23,400 --> 00:27:26,040 So we're adding in support where we can 559 00:27:26,040 --> 00:27:28,180 to, well, the purpose of 560 00:27:28,180 --> 00:27:29,840 that tool is to automatically attack 561 00:27:29,840 --> 00:27:31,140 some 2FA implementations. 562 00:27:31,280 --> 00:27:32,980 So we feel like it's a good fit for 563 00:27:32,980 --> 00:27:34,080 PowerShell as well. 564 00:27:34,240 --> 00:27:36,680 So we're going to probably integrate the two. 565 00:27:36,940 --> 00:27:39,780 That's not on our Spiral Labs GitHub just yet. 566 00:27:39,880 --> 00:27:41,600 But it will be soon. 567 00:27:43,780 --> 00:27:45,820 So this is another module about 568 00:27:45,820 --> 00:27:46,820 scanning for vulnerability. 569 00:27:47,060 --> 00:27:48,180 So it scans for MS08067 570 00:27:50,740 --> 00:27:51,700 or MS17010. 571 00:27:55,560 --> 00:27:57,480 It doesn't exploit at this point, 572 00:27:57,600 --> 00:27:59,020 but as time goes on, 573 00:27:59,080 --> 00:27:59,700 we plan to add in, 574 00:27:59,820 --> 00:28:01,560 because we want to add in other 575 00:28:01,560 --> 00:28:02,840 common techniques to get from 576 00:28:02,840 --> 00:28:04,320 zero to domain admin. 577 00:28:05,300 --> 00:28:07,080 Or as easy as possible. 578 00:28:08,300 --> 00:28:10,280 So let's go on to the next module. 579 00:28:10,360 --> 00:28:12,160 It's about files. 580 00:28:12,180 --> 00:28:13,360 Finding interesting files. 581 00:28:13,640 --> 00:28:16,300 So same as usual, 582 00:28:16,580 --> 00:28:17,220 it checks whether 583 00:28:17,220 --> 00:28:18,780 PowerShell is blocked or not. 584 00:28:18,840 --> 00:28:20,260 Because it's easier to run 585 00:28:20,260 --> 00:28:21,620 with PowerShell. 586 00:28:21,780 --> 00:28:24,840 And after that, it finds all the interesting files 587 00:28:24,840 --> 00:28:25,940 that could contain passwords 588 00:28:25,940 --> 00:28:27,340 or other sensitive data. 589 00:28:27,860 --> 00:28:28,780 Because previously, 590 00:28:29,540 --> 00:28:31,720 might be storing password using text document. 591 00:28:31,980 --> 00:28:33,200 Then it migrated to Excel. 592 00:28:33,500 --> 00:28:34,980 Then now they upgraded to KeePass. 593 00:28:35,240 --> 00:28:37,920 So might as well download the KeePass file. 594 00:28:37,920 --> 00:28:39,860 It downloads all the interesting files 595 00:28:39,860 --> 00:28:41,500 for you as well as the location. 596 00:28:43,680 --> 00:28:44,980 This one is 597 00:28:45,700 --> 00:28:46,940 to show that 598 00:28:46,940 --> 00:28:48,620 it's the same as just show 599 00:28:48,620 --> 00:28:51,380 Give me a second. 600 00:28:51,720 --> 00:28:51,920 Okay. 601 00:28:53,860 --> 00:28:55,700 If the administrator 602 00:28:55,700 --> 00:28:57,660 or the user has the KeePass 603 00:28:58,660 --> 00:29:00,140 open on his computer, 604 00:29:00,740 --> 00:29:01,800 it's able to 605 00:29:01,800 --> 00:29:02,800 dump the clear text credentials. 606 00:29:03,660 --> 00:29:05,220 So it's just using a common script, 607 00:29:05,320 --> 00:29:07,720 but it detects which user 608 00:29:07,920 --> 00:29:09,440 is logged on 609 00:29:09,440 --> 00:29:12,020 and using the KeePass software. 610 00:29:12,240 --> 00:29:13,920 And it has to run it in a context 611 00:29:13,920 --> 00:29:15,640 so that it can dump the credentials. 612 00:29:15,880 --> 00:29:16,880 If not, it doesn't work at all. 613 00:29:18,540 --> 00:29:19,520 This is just 614 00:29:19,520 --> 00:29:21,620 another screenshot 615 00:29:21,620 --> 00:29:23,420 to show that it dumps the 616 00:29:24,420 --> 00:29:25,200 TrueCrypt keys 617 00:29:25,200 --> 00:29:27,260 so that you can decrypt it offline. 618 00:29:29,000 --> 00:29:29,620 There's also 619 00:29:29,620 --> 00:29:31,080 module that we are working on. 620 00:29:31,160 --> 00:29:32,820 Just now we've been speaking about 621 00:29:32,820 --> 00:29:36,080 finding alternative route to attack adjacent network. 622 00:29:36,280 --> 00:29:37,740 So if you provide 623 00:29:37,920 --> 00:29:39,020 it with a list of IP address 624 00:29:39,020 --> 00:29:41,020 and it can't access those IP address 625 00:29:42,080 --> 00:29:43,600 initially by ping or 626 00:29:43,600 --> 00:29:45,840 whatever, but it found a route 627 00:29:45,840 --> 00:29:47,560 in an alternate 628 00:29:47,560 --> 00:29:49,340 host, it will highlight 629 00:29:49,920 --> 00:29:51,820 it doesn't show here because I don't have an example 630 00:29:51,820 --> 00:29:53,220 but it will highlight here that it says that 631 00:29:53,760 --> 00:29:55,540 this host has an alternative route to 632 00:29:55,540 --> 00:29:56,720 what you might be interested in. 633 00:29:57,260 --> 00:29:59,360 So this is just a small step to 634 00:29:59,360 --> 00:30:00,920 where we are going next. 635 00:30:06,020 --> 00:30:07,360 Last, second last. 636 00:30:07,920 --> 00:30:09,300 It finds clear text 637 00:30:09,840 --> 00:30:11,760 I mean documents that 638 00:30:11,760 --> 00:30:12,640 contains credit cards. 639 00:30:13,020 --> 00:30:15,440 And as well, this is same as what we see just now 640 00:30:15,440 --> 00:30:17,220 but it displays the card number. 641 00:30:17,960 --> 00:30:18,980 Not my card number. 642 00:30:20,780 --> 00:30:21,460 And then 643 00:30:21,460 --> 00:30:23,280 this is just what we run just now 644 00:30:23,280 --> 00:30:24,640 but as it takes some time 645 00:30:24,640 --> 00:30:25,880 now it has finished running 646 00:30:25,880 --> 00:30:27,200 to show that it works. 647 00:30:35,900 --> 00:30:37,320 Just a comment. 648 00:30:37,920 --> 00:30:38,900 I should check out Cloakify 649 00:30:38,900 --> 00:30:40,960 done by Joe Gervais last year. 650 00:30:41,580 --> 00:30:43,200 Python 2.7 651 00:30:43,200 --> 00:30:45,460 I made, I upgraded to 3.5 652 00:30:45,460 --> 00:30:46,380 and did the PowerShell version. 653 00:30:46,720 --> 00:30:49,100 But it takes any exe file, image file, 654 00:30:49,280 --> 00:30:51,620 binary file and turns it into a list 655 00:30:51,620 --> 00:30:53,380 set of lists that you define. 656 00:30:53,760 --> 00:30:55,620 A list of Pokemon with latitude 657 00:30:55,620 --> 00:30:56,860 and longitude in front of it. 658 00:30:56,980 --> 00:30:59,740 Clear text, whatever. It's pretty powerful. 659 00:30:59,920 --> 00:31:00,620 It's awesome. 660 00:31:00,940 --> 00:31:02,620 Yeah, thanks man. We'll check it out. 661 00:31:03,260 --> 00:31:04,360 You had a question there? 662 00:31:07,920 --> 00:31:09,580 So in talking about sensitive data 663 00:31:09,580 --> 00:31:11,360 you mentioned credit cards. 664 00:31:11,520 --> 00:31:13,660 How about PII 665 00:31:13,660 --> 00:31:15,700 and PHI which is a little more 666 00:31:15,700 --> 00:31:16,460 complicated. 667 00:31:17,440 --> 00:31:19,160 Yeah, so at the moment 668 00:31:19,920 --> 00:31:21,440 it's relatively limited 669 00:31:21,440 --> 00:31:24,060 in terms of what it looks for. 670 00:31:24,220 --> 00:31:26,040 But that said, we are expanding that. 671 00:31:26,140 --> 00:31:27,440 And that's on the list to do. 672 00:31:27,640 --> 00:31:29,680 We're trying to get the routing 673 00:31:29,680 --> 00:31:30,480 stuff in first. 674 00:31:30,840 --> 00:31:31,960 But expanding 675 00:31:33,620 --> 00:31:35,100 our searches for 676 00:31:35,100 --> 00:31:37,900 broader categories of sensitive information is definitely 677 00:31:37,920 --> 00:31:38,340 on the radar. 678 00:31:38,560 --> 00:31:40,280 And obviously if anybody wants to contribute 679 00:31:40,280 --> 00:31:41,400 then feel free. 680 00:31:44,440 --> 00:31:51,780 No, you can define 681 00:31:51,780 --> 00:31:53,560 the limits of the scope. 682 00:31:54,060 --> 00:31:55,320 Or you can just let it run. 683 00:31:55,900 --> 00:31:56,640 It depends. 684 00:31:56,960 --> 00:31:59,540 We tried to make it as 685 00:31:59,540 --> 00:32:01,280 modular and as progressive as possible. 686 00:32:01,500 --> 00:32:03,920 So you can have it run as much as possible 687 00:32:03,920 --> 00:32:05,580 against whatever it can do. 688 00:32:06,040 --> 00:32:07,520 Or you can either run 689 00:32:07,920 --> 00:32:08,260 individual modules 690 00:32:08,260 --> 00:32:09,180 or you can limit 691 00:32:09,180 --> 00:32:10,520 certain modules have certain 692 00:32:11,740 --> 00:32:13,140 options to limit 693 00:32:13,140 --> 00:32:14,900 what gets run. 694 00:32:17,520 --> 00:32:19,160 Yep, another question. 695 00:32:21,260 --> 00:32:21,900 . 696 00:32:24,400 --> 00:32:25,040 . 697 00:32:26,580 --> 00:32:27,220 . 698 00:32:31,040 --> 00:32:32,160 It's now on screen. 699 00:32:32,320 --> 00:32:33,240 But that's a good idea. 700 00:32:33,240 --> 00:32:35,040 We should probably be able to add an option 701 00:32:35,040 --> 00:32:35,960 to dump it to a file. 702 00:32:36,540 --> 00:32:36,940 Cool. 703 00:32:38,600 --> 00:32:39,440 Any other questions? 704 00:32:39,760 --> 00:32:40,700 I think we're out of time. 705 00:32:41,360 --> 00:32:41,760 . 706 00:32:43,140 --> 00:32:43,540 . 707 00:32:45,100 --> 00:32:45,500 . 708 00:32:45,500 --> 00:32:46,140 .