1
00:00:00,000 --> 00:00:02,000
X-Force Red.

2
00:00:02,000 --> 00:00:08,780
I'm here to talk to you all about a fantastic chain of vulnerabilities that leads to domain admin.

3
00:00:08,780 --> 00:00:11,100
I call this Printers to Domain Admin.

4
00:00:11,100 --> 00:00:21,140
So, first off, what we're going to be exploiting is this wonderful feature that Tifkin from SpectreOps discovered called the MSRPRN Print Spoolerbug.

5
00:00:21,140 --> 00:00:29,560
Basically what it does is it's a feature to have a domain controller tell a client where its printers are.

6
00:00:29,600 --> 00:00:34,280
Now, any user can request this packet to be sent to them.

7
00:00:34,500 --> 00:00:37,980
And what it can also do is try and force authentication.

8
00:00:38,660 --> 00:00:48,420
Now, if the client says, hey, I only support NTLM version 1, and the domain controller is trying to authenticate to them, it will authenticate using its machine account.

9
00:00:48,420 --> 00:00:53,140
That machine account can then be reversed from NTLM version 1 to NTLM.

10
00:00:54,540 --> 00:01:00,700
And once reversed to NTLM, we can create a silver ticket and then DC sync the server.

11
00:01:01,080 --> 00:01:02,600
So, with that, let's begin.

12
00:01:02,600 --> 00:01:08,260
The first thing we're going to need to do is find out the domain SID of the machine we're going to attack.

13
00:01:08,260 --> 00:01:12,340
Now, we're going to specify that we start off with domain user credentials.

14
00:01:13,420 --> 00:01:15,940
And so, we are already a regular domain user.

15
00:01:15,940 --> 00:01:20,000
We would have gotten this through Responder, some other method, or being a legit user on the network.

16
00:01:20,560 --> 00:01:31,900
So, we'll run enum for Linux on 192.168.1.3 on my mog.local domain.

17
00:01:31,900 --> 00:01:33,620
Now, we're going to see a whole bunch of stuff.

18
00:01:33,620 --> 00:01:40,440
So, we have to scroll up, and we're going to see the domain SID is right here.

19
00:01:41,200 --> 00:01:46,360
This is the security identifier for the domain, and it did not require any credentials to pull.

20
00:01:46,360 --> 00:01:50,520
So, we're going to go export SID equals domain.

21
00:01:51,740 --> 00:01:58,780
And quotes, even though these aren't required, I put them around just out of my own safety sake because I've been burned once or twice.

22
00:01:58,900 --> 00:02:00,940
So, we now have the SID.

23
00:02:01,760 --> 00:02:02,640
Fantastic.

24
00:02:03,040 --> 00:02:10,400
Next thing we're going to need is we're going to need to go use our credentials on the net NTLM server ticket repo with a tool called Dementor.

25
00:02:12,220 --> 00:02:14,000
So,

26
00:02:17,380 --> 00:02:19,780
we're now in the repo.

27
00:02:19,780 --> 00:02:25,160
So, we're going to go dot slash our Python Dementor dot py.

28
00:02:27,420 --> 00:02:28,380
Help.

29
00:02:28,740 --> 00:02:34,780
So, in order to use Dementor, we need a domain username, which is going to be evilmog.

30
00:02:36,200 --> 00:02:37,720
We need a password.

31
00:02:38,080 --> 00:02:41,880
In this case, password is password with an exclamation mark.

32
00:02:42,320 --> 00:02:43,440
Yes, this is a demo.

33
00:02:43,440 --> 00:02:44,320
Yes, it's junk.

34
00:02:44,320 --> 00:02:45,740
I'm okay with this.

35
00:02:46,120 --> 00:02:47,800
Now, we're going to use a domain.

36
00:02:47,800 --> 00:02:48,960
evilmog.

37
00:02:50,920 --> 00:02:53,220
Next thing we're going to do is go into another window.

38
00:02:53,340 --> 00:02:54,360
We're going to set up Responder.

39
00:02:54,360 --> 00:02:58,360
So, Responder interface of eth0.

40
00:03:02,180 --> 00:03:04,160
Yeah, let's go with that.

41
00:03:06,320 --> 00:03:10,520
And now we're going to fire over to Dementor and fire off the authentication back at us.

42
00:03:10,780 --> 00:03:13,140
Next thing we're going to need is the listener IP.

43
00:03:13,300 --> 00:03:20,060
So, $attacker IP.

44
00:03:20,320 --> 00:03:23,300
I pre-exported mine because I can't remember what it was.

45
00:03:23,580 --> 00:03:26,060
And we're going to go with the target IP.

46
00:03:29,810 --> 00:03:31,170
It's going to send the attack.

47
00:03:31,170 --> 00:03:32,550
We're seeing access denied.

48
00:03:32,930 --> 00:03:36,210
Here, we'll see an NTLM version 1 SSP hash.

49
00:03:37,010 --> 00:03:47,950
Now, we'll see I attempted to go set this as 112233455667788 for the client challenge, but it zeroed out these.

50
00:03:47,950 --> 00:03:52,430
I could have specified $attack LM and it would have gotten me a better result.

51
00:03:52,430 --> 00:03:57,630
But in this case, I wanted to demonstrate NTLM version 1 with SSP on video because it's fun.

52
00:03:57,630 --> 00:03:59,430
So, we're going to copy this.

53
00:04:01,170 --> 00:04:04,570
I'm now going to go into my NTLM version 1 multi-tool.

54
00:04:07,930 --> 00:04:10,730
Python ntlmv1.py.

55
00:04:10,990 --> 00:04:15,090
We're going to specify NTLM and our hash.

56
00:04:16,670 --> 00:04:20,590
Now, if you want to use crack.sh and pay $200, you absolutely can.

57
00:04:20,590 --> 00:04:22,930
The other option is we're going to do this with hashcat.

58
00:04:23,010 --> 00:04:33,050
Now, this will normally take you about three to five days with anywhere from 16 to 32 GPUs, or cost you about $1,000 in AWS time.

59
00:04:33,050 --> 00:04:35,730
I haven't timed this up for a while, so my numbers might be inaccurate.

60
00:04:36,250 --> 00:04:40,570
But on 16 GTX 1080s, it takes about four days, five.

61
00:04:40,790 --> 00:04:42,630
So, what we're going to do is we're going to copy this.

62
00:04:42,630 --> 00:04:44,910
We're going to copy the 14,000 hash.

63
00:04:45,090 --> 00:04:46,690
It's already ready to go into hashcat.

64
00:04:47,210 --> 00:04:51,030
We're going to go into my hashcat directory, paste that.

65
00:04:52,670 --> 00:04:57,290
Just make sure it's a fresh file, nothing in my slave.

66
00:04:58,630 --> 00:05:11,770
Now, we're going to take the command it told us to crack it with hashcat, telling us to use mode 14,000, attack mode 3, which is a brute force, using the DES character set, and our attack type.

67
00:05:11,770 --> 00:05:13,230
I'll already do it for you.

68
00:05:13,770 --> 00:05:17,370
Now, because I have a time machine, it's going to crack instantly.

69
00:05:22,650 --> 00:05:23,310
Perfect.

70
00:05:23,310 --> 00:05:25,090
See, it's already cracked instantly.

71
00:05:25,290 --> 00:05:27,270
So, let's go show these hashes right now.

72
00:05:29,010 --> 00:05:34,230
So, here we have the portion of the NTLM, but it's actually being returned as a DES key.

73
00:05:34,450 --> 00:05:41,370
We need to convert these DES keys into a portion of an NTLM.

74
00:05:41,370 --> 00:05:42,570
So, we're going to go to git.

75
00:05:42,570 --> 00:05:53,770
We're going to throw up my hashcat, utils, src, and we're going to want the DES key to NTLM portion.

76
00:05:54,490 --> 00:05:56,810
So, here is part one.

77
00:05:59,990 --> 00:06:03,050
We are then going to do part two

78
00:06:07,300 --> 00:06:07,800
.

79
00:06:08,180 --> 00:06:12,100
Back over here, part two.

80
00:06:15,520 --> 00:06:25,000
Now, the most important part, we're also going to have to calculate the last four characters of the NTLM.

81
00:06:25,480 --> 00:06:27,540
Again, there's already a hashcat utility for that.

82
00:06:27,540 --> 00:06:41,220
So, we're going to go into git slash hashcat, utils, src, and then we are going to use a profile CT3 to NTLM.

83
00:06:43,360 --> 00:06:50,560
But it already tells us that, because we do the paste, and there we are.

84
00:06:50,560 --> 00:06:51,380
We have our NTLM.

85
00:06:51,380 --> 00:07:01,840
So, the NTLM is going to be part one, part two, part three.

86
00:07:05,940 --> 00:07:07,180
Fantastic.

87
00:07:07,400 --> 00:07:11,560
So, now we're going back into our handy-dandy utility.

88
00:07:13,820 --> 00:07:16,560
Export NTLM equals.

89
00:07:19,030 --> 00:07:27,730
Now, to prove there's nothing up my sleeve on this one, crack map exec SMB 192.168.1.3.

90
00:07:28,450 --> 00:07:34,630
Username is going to be DC1$, because that means it's a machine account.

91
00:07:34,630 --> 00:07:38,850
We're going to use the hash of $NTLM.

92
00:07:41,610 --> 00:07:43,230
And there we are.

93
00:07:43,230 --> 00:07:45,890
We've authenticated as the domain machine account.

94
00:07:46,290 --> 00:07:48,010
Now,

95
00:07:52,260 --> 00:07:57,620
we're going to do a grep.

96
00:08:01,780 --> 00:08:02,600
There we are.

97
00:08:02,600 --> 00:08:03,780
So, we're going to run ticketer.

98
00:08:03,860 --> 00:08:06,440
Now, this command is a little bit complex.

99
00:08:06,440 --> 00:08:07,680
So, first we're going to run Python.

100
00:08:07,900 --> 00:08:10,120
We're going to select where our ticketer location is.

101
00:08:10,120 --> 00:08:14,440
We're going to use the NTLM hash, which we'll see here is 1D.

102
00:08:14,560 --> 00:08:18,340
Matches right up with what we have here ending in 904C.

103
00:08:18,340 --> 00:08:20,440
So, there's your NTLM hash for the machine account.

104
00:08:21,060 --> 00:08:29,020
There is the domain SID that we captured earlier, that is this S121 here using enum for Linux.

105
00:08:29,240 --> 00:08:31,140
The domain name here is mog.local.

106
00:08:31,140 --> 00:08:34,320
Now, the important part is the SPN.

107
00:08:34,340 --> 00:08:36,380
SPN is a service principle name.

108
00:08:36,700 --> 00:08:38,880
So, in this case, we know it's a machine.

109
00:08:38,880 --> 00:08:40,340
So, we know it's DC1.

110
00:08:40,340 --> 00:08:42,060
We know it's in mog.local.

111
00:08:42,580 --> 00:08:49,320
All domain controllers by default will or should in most cases have a host slash DC or a host slash for their SPN.

112
00:08:49,320 --> 00:08:58,420
So, we can guess that this machine's SPN or look at it in Bloodhound, but in this case, we guessed host slash DC1.mog.local.

113
00:08:58,420 --> 00:09:02,640
And then the administrator, guessing it's administrator, probably is.

114
00:09:02,640 --> 00:09:06,240
A lot of people change it, but that is how we create our silver ticket.

115
00:09:06,320 --> 00:09:07,660
Now, I'm going to hit enter.

116
00:09:08,480 --> 00:09:13,480
It's going to create this Kerberos cache file for you.

117
00:09:13,480 --> 00:09:14,920
Now, you need to go run an export.

118
00:09:14,920 --> 00:09:25,780
So, because I keep forgetting the syntax, history, grep export, grep ccache, head dash n1.

119
00:09:25,880 --> 00:09:26,780
There we go.

120
00:09:26,780 --> 00:09:27,660
Export.

121
00:09:35,680 --> 00:09:39,620
So, we've specified here's where our cache file is.

122
00:09:39,620 --> 00:09:43,180
Now, we're to proceed to SecretsDump, the domain controller.

123
00:09:43,900 --> 00:09:54,980
grep SecretsDump, grep .k, head dash n1.

124
00:09:56,880 --> 00:09:58,080
Now,

125
00:10:02,330 --> 00:10:04,050
there we go.

126
00:10:04,050 --> 00:10:06,010
So, we're going to run SecretsDump.

127
00:10:06,890 --> 00:10:11,710
The syntax for this one is going to be, you know, Python 3 SecretsDump.

128
00:10:11,710 --> 00:10:14,090
Dash k means use Kerberos.

129
00:10:14,130 --> 00:10:17,230
Tack no, tack pass means don't ask for a password.

130
00:10:17,330 --> 00:10:22,930
We're to specify mog at domain mog administrator at dc1 at mog.local.

131
00:10:22,930 --> 00:10:24,750
And we're going to dc sync the...

132
00:10:35,310 --> 00:10:36,350
Interesting.

133
00:10:37,410 --> 00:10:38,450
This happens.

134
00:10:38,450 --> 00:10:39,730
Let's go take a look.

135
00:10:48,060 --> 00:10:49,100
There we go.

136
00:10:49,100 --> 00:10:50,380
We just used the right tool.

137
00:10:50,860 --> 00:10:56,940
So, we've used our... So, the syntax for this one was Python running SecretsDump.

138
00:10:57,180 --> 00:11:00,800
Our target was administrator at dc1.mog.local.

139
00:11:01,080 --> 00:11:02,620
Dash k was use Kerberos.

140
00:11:02,620 --> 00:11:06,480
Tack no, tack pass was don't ask for us for the password.

141
00:11:06,480 --> 00:11:14,880
And here we see our administrator hash, our guest hash, and our machine account, which we just finished extracting.

142
00:11:17,290 --> 00:11:22,850
So, that is how you silver ticket a domain controller and dc sync it with just a regular domain user.

143
00:11:22,990 --> 00:11:30,750
Now, for mitigations on this, what you're going to wind up doing is there's a setting called the landman compatibility level.

144
00:11:30,750 --> 00:11:36,130
I'll include a link to it in the slides for this.

145
00:11:38,050 --> 00:11:42,610
There's a setting set for two or lower, which basically means allow NTLM.

146
00:11:42,930 --> 00:11:46,690
That's what... If you increase that setting to five, that will completely block this.

147
00:11:46,690 --> 00:11:52,050
The other mitigations are disable the print spooler service on any sensitive servers, such as domain controllers.

148
00:11:52,330 --> 00:12:02,370
Now, this will cause an impact on some environments, as clients will no longer be able to update their printer list, but hopefully you have a better way of pushing printers, such as SCCM.

149
00:12:02,650 --> 00:12:07,050
So, that is the one downside, but it will prevent domain controllers from reaching out.

150
00:12:07,130 --> 00:12:09,690
This works up until server 2016.

151
00:12:10,610 --> 00:12:16,350
I have not seen it work in server 2019, and it, again, depends on your landman compatibility level.

152
00:12:16,790 --> 00:12:18,370
Thank you very much for tuning in.

153
00:12:18,370 --> 00:12:22,170
This has been Evil Mog from X-Force Red and Team Hashcat.