Okay, thank you so much. Welcome to the Packet Hacking Village and the Speaker Workshops.
It is now 4.10. We're going to kick it right off. We're not going to waste any time.
And now it is my pleasure to introduce the next talk, Release the Hound.
I mean, no, sorry, not Release the Hound. Hunting the Hound. No, that's not good.
Oh, sorry, sorry. Fooling the Hound by Tom Sella.
Thank you very much.
Hear me okay? Yeah? Cool. Okay.
Hello, everybody. We're going to talk about fooling the Hound, deceiving domain admin hunters.
So in the next 35 minutes or so, we're going to cover letter of movement and deception.
And I hope it will be fun.
My name is Tom Sella. I'm an head of security research in Elusive Networks.
And I want to thank Elusive for giving me the opportunity to stand here in front of you
and all of the friendly faces.
And also I want to share a story with you.
About one year ago, I was sitting in the audience exactly as you're sitting today.
And I attended a talk that changed the way I see letter of movement.
The talk was Six Degrees to Domain Admin, given by Andy, Will, and Ron, who are sitting in the audience today.
And that talk, they showed a great tool, Bloodhound,
that shows how to fool the Hound.
It shifted the bonds between defenders and attackers and gave the attackers a significant
amount of power.
And from that talk, I set a path to see how, as defenders, we can use the same tool.
So the talk will cover the journey of the last year, seeing how Bloodhound can be used
in order to help blue teams.
So if you're expecting this Hound, I'm sorry to disappoint you.
It's not a game from the talk.
It will be on Bloodhound.
What are we going to cover?
We're going to have a crash course on deceptions and letter of movement.
Sorry, letter of movement and graphs.
Then we'll move to deceptions.
And then we'll full down.
We'll combine deceptions and letter of movement.
And we'll wrap up.
Our goal throughout the entire talk will be to detect attackers hunting domain admin credentials in the network.
And we'll wrap up.
Our goal is to detect.
And the method will be to plant and monitor deceptive users and computers through the network.
So those two slides will follow us throughout the presentation.
When we look on the kill chain, an attack usually starts when a computer is being compromised.
Either by phishing mail.
An attacker will get full control of the computer.
Start moving laterally in the network to obtain domain admin credentials.
The credentials that gives him full power on the network.
And only after that we'll continue to achieve the goal.
This talk focuses on the first part.
From the initial breach to obtaining domain admin credentials.
Let's look at a generic attack scenario.
We'll cover how an attacker in only just six stages from the initial breach gets full control of the network.
Let's say in our network we have a receptionist named Liz.
An attacker sent a phishing mail to Liz.
Liz opened the email, clicked on the link, downloaded a malware on a computer.
From that point an attacker has control of Liz's PC.
And tries to move laterally in order to get domain admin credentials.
In our example, you will run Mimikatz or other credential dumping tool.
Get the credentials of Liz.
And then see what else you can do with them.
In our case, Liz is a member of a domain group.
And that group is an admin on another PC.
So using Liz's credentials, you can move laterally.
You can use them and connect into room 2 PC.
There, all over again.
You'll dump credentials.
See what else.
With which additonals.
The additional user is connected to that machine.
In this case, we'll have Clark.
Which is connected.
We'll dump the credentials.
And once again, see what else you can do with them.
Clark is admin on the CFO PC.
The attacker used the credentials just compromised.
And moved to the CFO PC.
And luckily for him, a day before.
Elbdesk connected to that machine.
In order to help with a problem.
Didn't log out correctly.
And the credentials of the Elbdesk.
Stayed on that machine.
Elbdesk is domain admin.
So an attacker in 6 steps.
Were able to move from the reception PC.
Into getting a domain admin credentials.
It just shows us the significance.
Also computers that are not seemingly significant.
That are not high privileged.
How important are them in a tech kill chain.
Or how they can be used.
In order to get complete control of the network.
If we take the graph that we just covered.
And try to make it a little bit more formalized.
We'll see that we had 3 node types.
We had users.
We had computers.
And we had groups.
All of that information.
Can be obtained by any domain user.
You don't have to have any special privileges.
To get the information of the network.
So also, Liz in our example.
Can get the information of all the users.
Computers and groups.
And we had edges.
The attacker had to know.
In order to follow the path we just covered.
Which user is logged into where.
Which user is admin into each machine.
And the group membership.
Surprisingly.
Also that those edges.
Or that information.
Can be obtained by any domain user.
No special privileges.
Need to be.
In order to obtain that information.
So.
If we formalized that.
And we know what edges.
And what nodes.
Are part of a lateral movement.
Why won't we just make a graph?
So it's a great idea.
And we didn't just think about it.
Actually the blood out guys.
Thought about it before us.
And they did exactly that.
They created a tool.
That maps the entire network.
Gets the information of the nodes.
And provides a great UI.
For red teamers.
To see what path do they need to take.
In order to get to the domain admins.
So.
This is a picture.
From blood out.
And what we see.
All possible shortest path.
To get to the domain admin group.
So.
Take a little pause.
With lateral movement.
And blood out.
And move to another subject.
Cover deceptions.
What is a deception?
Deception is the act.
Of causing someone to accept.
As truth or valid.
Something that is not true.
I'll show.
Two examples.
From real world.
Real warfare.
The first one.
As you see.
Are tripsters.
In medieval ages.
The most terrifying thing for defenders.
To storm into the castle.
And take over it.
What they did.
They create a seemingly insignificant change.
In their infrastructure.
In their staircase.
That will be insignificant for defenders.
Will be devastating for attackers.
They took every tenth stair.
And made it a little bit higher.
Defenders living in the castle all their life.
Knew which stairs.
Do they need to skip over.
Because they live there all their life.
When you are going into the castle.
For the first time.
Not noticing this insignificant change.
You will trip on the stair.
Fall.
And it will block the entire attack.
So this is one example from real world.
The second one.
What you see.
It's a tank.
It's being lifted by four people.
Strange right?
It's from the second world war.
The allied forces had an army unit.
Called the ghost army.
To retrieve the German forces.
What we see in the picture.
It's an inflatable tank.
It's not a real tank.
And what the allied forces did.
They deployed tens of those tanks.
In a specific field.
Making the Germans think.
That they are getting to attack.
Where in reality.
It was not just a deception.
They were able to cause the Germans.
To shift their defenses.
To a certain location.
Without using any real force.
Those are two examples.
From real world.
We cover Bloodhound.
And we cover Deceptions.
Let's combine the two.
What Bloodhound showed us.
That an attacker.
Can get.
The precise path.
It needs to go.
In order to get domain admin credentials.
As defenders.
We can use the same tool.
In order to participate.
To.
Know in advance.
Where the attacker will go.
We can know.
That it will take the most efficient path.
But we can do even better.
We control the environment.
We control the information.
They are using.
In order to create the graph.
So as defenders.
We can control the path they will take.
We will create the right manipulations.
In our network.
In order to control.
Where they will go.
And that's exactly.
What we are going to cover from this point on.
So.
This is the network.
How it looks like before planting Deceptions.
And this is.
How it will look after Deceptions.
What you are looking is an extension to Bloodhound.
All the orange nodes.
Are Deceptive nodes.
This means.
That the network is exactly the same.
It's exactly the same network.
The only difference.
That we created manipulations.
That.
If a tracker try to follow them.
The first one.
It will detect him.
And the second.
It will not be able to reach his target.
There are two places.
That Deceptions can be planted.
Either on existing endpoints.
We call it ANI tokens.
Or by adding.
An additional server.
To the network.
The ANI token resembles.
The STR example.
That creating a.
Insignificant change.
To the defender.
That will be devastating for an attacker.
So it resembles ANI tokens.
And.
The example with the tanks.
Resembles ANI pot.
Will create.
Will make an attacker believe.
That something is true.
Although it is just a trap.
Let's start creating.
Deceptive user sessions.
We covered.
In the beginning.
What will happen.
If we do the following.
If we add.
A deceptive user session.
On room 2 PC.
That points.
Into a domain admin user.
An attacker running.
We will see that he has.
It can take only four steps.
In order to get a domain admin.
Four steps is better than six.
So it is a more efficient.
Way to get domain admin.
That is the way.
You will see on bloodhound.
Let's see.
How we can create.
Make an attacker believe.
That superman.
Is logged into room 2 PC.
Although in reality he is not.
And the only real user on room 2 PC.
Is Clark.
We will start.
With ANI tokens.
We will cover.
Four examples.
For each example.
I will describe.
What attackers are doing.
Afterwards I will describe.
What.
How the deception is implemented.
The first example will cover.
Registry key.
For an attacker to know.
Which user is logged in.
Into a specific machine.
He can.
Start otherwise.
When a user logged into a machine.
Is automatically.
Is profile loaded.
A part of it.
A specific key is generated.
In the registry.
The key's name.
Matches the user seed.
The seed is a unique number.
For each user.
Surprisingly by default.
Windows allows.
Read access for everybody.
For that specific key.
That means.
Any domain user.
Can come to any domain machine.
And just get the list.
Of seeds.
And that's exactly.
What attackers are doing.
They get the list of seeds.
Convert them to user name.
And know remotely.
Which users are connected.
To that machine.
Exactly as I described.
An attacker will use.
RPC command.
To ask all the keys.
In the specific location.
The endpoint will return the keys.
Again.
As defenders.
What we can do.
The answer is quite simple.
We can add an additional key.
In that location.
The key will be matching.
The user we want the attacker to believe.
Is logged into that machine.
Let's see a demo of it.
On the right.
We have the attacker machine.
We'll run a command.
That extracts all the logged in users.
By the registry.
At the beginning.
We can see that.
Clark is logged into that machine.
Which is true.
What we'll do now.
It will plant the deception.
On room 2 PC.
I remind you that we want to make.
The attacker think.
That superman is logged into that machine.
So we'll check.
The seed of superman.
We can do it by either powershell.
This example.
I'm using this internal tool.
We got the seed of superman.
And now.
We'll add the specific key.
To the registry.
The key was added.
We see that.
We have additional key.
In the registry.
And.
The attacker.
Will run the same command again.
Previously.
He got.
Only Clark in return.
But now.
He believes.
That superman is logged into that machine.
Exactly what we want to achieve.
Whenever you see the.
Wolf ship thing.
It's an indication that we succeeded.
So.
We cover the first example.
Let's see an additional example.
Again.
We want the attacker to think.
That superman is logged into room 2 PC.
And not only Clark.
That example.
Involves an API.
To remotely query.
Your sessions.
The.
API.
Does require admin privileges.
But the deception.
Is relevant.
Also for other tools.
Such as Mimikatz.
So the deception that we're going to cover.
Will influence an attacker.
That after you've got.
Control of the endpoint.
And will try to run Mimikatz.
To dump the credentials.
We're using this deception.
So.
We want to add an additional deceptive session.
The problem that.
Each time that you want to authenticate.
Or add a session.
You have to authenticate the credentials.
Against active directory.
And we want to plant deceptive credentials.
We want to plant the deceptive credentials.
That if they will be used.
By the attacker.
It will not be able to actually move laterally.
Luckily for us.
There is a method to do that.
That method involves.
Run as net only.
The run as command creates an additional process.
When passing the flag net only.
You can pass.
Any credentials that you want.
Without them actually authenticating.
Against active directory.
But the credentials are still.
Added to the windows memory.
And will do exactly that.
So.
An attacker remotely queries.
All the sessions.
And the computer.
Returns the response.
The attacker will know.
Which users are connected to that machine.
Let's see it in action.
So again.
We have our attacker.
First we will run the command.
And we will see.
We got only the computer account.
And Clark connected to that machine.
And of course.
That's the reality.
In reality only Clark is connected.
Now.
We will.
Create the reception.
Or edit the reception.
We will run run as.
With any random password.
It's not the real password of the user.
The command executed.
And now.
The attacker once again.
Will run the same command.
And this time.
He also sees superman.
Exactly what I wanted to achieve.
This is the second method to create.
Deceptive user sessions.
We are going to cover the last.
Example of creating user sessions.
Again.
We want to create.
Make the attacker believe.
That superman is logged into PC2.
For this example.
We will use our trap server.
Or any pot.
Any.
Windows machine.
Is by default.
Also SMB server.
It's a file server.
But also.
Active directory.
Or your organizational file server.
Those file servers.
For each machine that connects to them.
All the name of the user.
And the machine that connected to them.
What attackers are doing.
Again.
Instead of going machine one by one.
They connect.
They quarry a file server.
Ask them for all the machines.
And users that connected to them.
So.
In our example.
Clark.
Connected to a file server.
Our attacker.
Will quarry the file server.
For all of the.
The users and machines.
That has active sessions to it.
The files are returned response.
Saying that Clark.
Is connected from computer.
Room to PC.
And our attacker would know.
That Clark is on room to PC.
When adding an.
To the network.
We control.
All the responses it will generate.
We can control.
Whatever it will return to the attacker.
And we will do exactly that.
We added.
A server.
And when our attacker.
Will quarry it for all the remote.
All the active sessions.
Will just let him know.
Superman is connected on room to PC.
And I'm going to show you.
And the example we have.
Deceptive file server.
With our own implementation.
Of an SMB server.
And the implementation with a file.
That holds the response.
It will return for attacker.
So on the right.
We have the attacker.
And on the left.
Our deceptive server.
What we see in the background.
Is the file that will hold.
The responses.
The file is empty.
So when attacker quarries.
Of all the active sessions.
He got nothing in response.
But once we added.
Superman and room to PC.
The same request.
Now gives the attacker.
The notion.
That Superman is connected to that machine.
And we can do anything we want.
We can add an additional like.
Random PC or whatever we want.
And an attacker will believe.
That those users.
Are connected to those machines.
So that was the third example.
Of how we can deceive attackers.
And make them think.
That a user is connected.
To a specific machine.
Although in reality.
It is not that.
I will give one last example.
But not for deceptive user sessions.
But deceptive local admin privileges.
Taking the same graph.
If you create the following manipulation.
Will make an attacker believe.
That user leads.
Is admin.
Into our trap server.
And there is a domain admin.
Connected to that machine.
Will provide an attacker.
A shorter path.
To a domain admin.
That path is only three steps.
Even better.
Than deception using.
User sessions.
Let's see.
How we can do that.
As with previous examples.
Quering.
Remotely quarrying.
Group membership.
Does not require special privileges.
Any user.
Can just come to any machine.
And ask it.
For all the local members.
Of the administrative group.
What we do.
Is similar to the previous example.
We have our trap server.
And we control all the response.
It generates.
Return response.
That leads.
Is an admin.
On our trap server.
And for this example.
We use even a name.
That matches the convention.
Of the organization.
Matches the convention.
Of other computers.
I will skip the example.
The demo for that one.
It's similar to the previous one.
So enough technique for now.
Let's see.
We detect attackers.
Hunting domain admin credentials in the network.
And we want to do it by placing.
And monitoring deceptive users.
And machines.
We got the piece of the puzzle.
We know we can create or add deceptive users.
And deceptive machines.
To make sure.
We detect attackers.
We have a specific goal.
The goal is that.
Any shortest path.
To a domain admin.
Will contain at least.
One edge.
Or one node.
That is deceptive.
And those nodes and edges.
Will provide us a detection mechanism.
If an attacker uses a deceptive user.
Or connects.
To our trap server.
We can alert.
We'll do it in three steps.
It's a native implementation.
There are even more interesting implementations.
Using graph theory.
I deliberately chose to.
Use something native.
To explain.
So the steps are as follows.
First.
We want to add a deceptive user session.
For all the computers.
That are closest to the domain admin group.
Second.
We'll add deceptive computers.
To the top groups.
In the network.
And lastly.
We'll take clicks.
Or end points.
That in reality does not have.
A clear path to domain admin.
And we'll make an attacker think.
That they can lead him to domain admin.
So for an organization.
With 10,000 nodes.
The blood and graph.
Will show approximately.
Maybe 100 nodes.
Because not all computers.
Can lead to domain admin.
But using the third option.
We can create a graph.
That for an attacker will see 500 nodes.
Or even more.
Because we can take computers from the network.
And create a deceptive connection.
That will lead to domain admin.
So.
This is again.
The blood and UI.
The blood and graph.
And this is our.
Domain admin group.
Let's see.
Those three steps in action.
Step number one.
We just added.
Users to all the closest computers.
If we just stop.
Right here.
We already achieved our goal.
All the path.
That lead to domain admin group.
Already contain at least one.
One node.
But we want to create.
Even more complex picture for the attacker.
So the second stage.
Will add.
Deceptive computers.
To the top groups.
Once again.
All of the.
Those nodes.
And new path that you are seeing.
Are not real path.
An attacker that will follow them.
Will not be able to get.
Domain admin credentials.
It will only trigger an alert.
So we added.
Additional.
Machines to the top groups.
And.
Lastly.
We took additional machines in the network.
And connected them to the blood and graph.
So.
All of those.
Are either deceptive computers.
Or users.
Are added to the graph.
And one result.
You can see over here.
This user.
Is the antivirus.
Service user.
Before.
It would not lead.
To the domain admin group.
But using deceptions.
We added all of those machines.
That if an attacker will compromise them.
It will think.
That he has a valid path.
That will lead to the domain admin group.
Wrapping up.
What we covered.
We covered lateral movement.
And graphs.
I showed four methods.
To deceive attackers.
We showed.
How we can control.
The path an attacker will take.
And we showed an algorithm.
That will make sure.
That every shortest path.
Will contain at least.
One deceptive edge.
To conclude.
What we can take from that.
Deceptions.
Bring doubt.
And uncertainty.
To the operations of the attacker.
An attacker.
That tries to move laterally.
In an organization.
That employs deception.
Will doubt any piece of information.
He finds.
Because he will no longer be able.
To be sure.
That this information.
And our current security.
Strategy.
Is mostly built on walls.
And walls are good.
They keep the bad things out.
But we also understand.
That we live in an assumed bridge era.
That any wall.
Will eventually be bypassed.
What I wanted to show you.
And if we will take only one thing.
From this talk.
Is that using deceptions.
We can make attackers.
Fear of what awaits them.
Behind those walls.
And one last game of thrones.
That's it.
Thank you very much.
If you have any questions.
Okay.
So.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
will monitor them, and if you place honeypots, you will monitor them.
That's separate. That's an extension that I created with
the deceptive nodes and edge.
Yeah, as I said, I work for a company named Elusive Networks, and we can talk afterwards.
Can you repeat the question?
The examples that you use are mostly for workstations, but I'm assuming you can also
use deceptive technology for web servers, which are also highly attacked, and capture
movement from the web servers.
That's completely true. I deliberately showed only a small amount
of what possibilities there are for deception, so we're also relevant for servers and endpoints
and for other services, and not just Active Directory-related services.
Yeah.
We'll help you to cover it if you want afterwards.
There is a vast options for creating deceptions, and I'll be happy to cover it.
Thank you very much, everybody.