X-Force Red. I'm here to talk to you all about a fantastic chain of vulnerabilities that leads to
domain admin. I call this Printers to Domain Admin. So, first off, what we're going to be
exploiting is this wonderful feature that Tifkin from SpectreOps discovered called the MSRPRN
Print Spoolerbug. Basically what it does is it's a feature to have a domain controller tell a
client where its printers are. Now, any user can request this packet to be sent to them.
And what it can also do is try and force authentication. Now, if the client says,
hey, I only support NTLM version 1, and the domain controller is trying to authenticate to them,
it will authenticate using its machine account. That machine account can then be reversed from
NTLM version 1 to NTLM. And once reversed to NTLM, we can create a silver ticket
and then DC sync the server. So, with that, let's begin. The first thing we're going to need to do
is find out the domain SID of the machine we're going to attack. Now, we're going to specify that
we start off with domain user credentials. And so, we are already a regular domain user. We
would have gotten this through Responder, some other method, or being a legit user on the network.
So, we'll run enum for Linux on 192.168.1.3 on my mog.local domain. Now, we're going to see a
whole bunch of stuff. So, we have to scroll up, and we're going to see the domain SID
is right here. This is the security identifier for the domain,
and it did not require any credentials to pull. So, we're going to go export SID equals
domain. And quotes, even though these aren't required, I put them around just out of my own
safety sake because I've been burned once or twice. So, we now have the SID. Fantastic.
Next thing we're going to need is we're going to need to go use our credentials on the net
NTLM server ticket repo with a tool called Dementor. So, we're now in the repo. So,
we're going to go dot slash our Python Dementor dot py.
Help. So, in order to use Dementor, we need a domain username, which is going to be
evilmog. We need a password. In this case, password is password with an exclamation mark.
Yes, this is a demo. Yes, it's junk. I'm okay with this. Now, we're going to use a domain.
evilmog. Next thing we're going to do is go into another window. We're going to set up
Responder. So, Responder interface of eth0. Yeah, let's go with that.
And now we're going to fire over to Dementor and fire off the authentication back at us.
Next thing we're going to need is the listener IP. So,
$attacker IP. I pre-exported mine because I can't remember what it was.
And we're going to go with the target IP. It's going to send the attack. We're seeing access
denied. Here, we'll see an NTLM version 1 SSP hash. Now, we'll see I attempted to go set this
as 112233455667788 for the client challenge, but it zeroed out these. I could have specified
$attack LM and it would have gotten me a better result. But in this case, I wanted to demonstrate
NTLM version 1 with SSP on video because it's fun. So, we're going to copy this.
I'm now going to go into my NTLM version 1 multi-tool.
Python ntlmv1.py. We're going to specify NTLM and our hash.
Now, if you want to use crack.sh and pay $200, you absolutely can. The other option is we're going
to do this with hashcat. Now, this will normally take you about three to five days with anywhere
from 16 to 32 GPUs, or cost you about $1,000 in AWS time. I haven't timed this up for a while,
so my numbers might be inaccurate. But on 16 GTX 1080s, it takes about four days, five.
So, what we're going to do is we're going to copy this. We're going to copy the 14,000 hash.
It's already ready to go into hashcat. We're going to go into my hashcat directory, paste that.
Just make sure it's a fresh file, nothing in my slave.
Now, we're going to take the command it told us to crack it with hashcat,
telling us to use mode 14,000, attack mode 3, which is a brute force,
using the DES character set, and our attack type. I'll already do it for you.
Now, because I have a time machine, it's going to crack instantly.
Perfect. See, it's already cracked instantly. So, let's go show these hashes right now.
So, here we have the portion of the NTLM, but it's actually being returned as a DES key.
We need to convert these DES keys into a portion of an NTLM. So, we're going to go to git.
We're going to throw up my hashcat, utils, src, and we're going to want the DES key to NTLM
portion. So, here is part one. We are then going to do part two.
Back over here, part two. Now, the most important part, we're also going to have to calculate
the last four characters of the NTLM. Again, there's already a hashcat utility for that. So,
we're going to go into git slash hashcat, utils, src, and then we are going to use a profile
CT3 to NTLM. But it already tells us that, because we do the paste,
and there we are. We have our NTLM. So, the NTLM is going to be part one, part two,
part three. Fantastic. So, now we're going back into our handy-dandy utility.
Export NTLM equals. Now, to prove there's nothing up my sleeve on this one, crack map exec
SMB 192.168.1.3. Username is going to be DC1$, because that means it's a machine account.
We're going to use the hash of $NTLM. And there we are. We've authenticated as the domain
machine account. Now, we're going to do a grep. There we are. So, we're going to run ticketer.
Now, this command is a little bit complex. So, first we're going to run Python. We're
going to select where our ticketer location is. We're going to use the NTLM hash, which we'll
see here is 1D. Matches right up with what we have here ending in 904C. So, there's your NTLM
hash for the machine account. There is the domain SID that we captured earlier,
that is this S121 here using enum for Linux. The domain name here is mog.local. Now, the important
part is the SPN. SPN is a service principle name. So, in this case, we know it's a machine.
So, we know it's DC1. We know it's in mog.local. All domain controllers by default will or should
in most cases have a host slash DC or a host slash for their SPN. So, we can guess that this
machine's SPN or look at it in Bloodhound, but in this case, we guessed host slash DC1.mog.local.
And then the administrator, guessing it's administrator, probably is. A lot of people
change it, but that is how we create our silver ticket. Now, I'm going to hit enter.
It's going to create this Kerberos cache file for you. Now, you need to go run an export. So,
because I keep forgetting the syntax, history, grep export, grep ccache, head dash n1.
There we go. Export. So, we've specified here's where our cache file is. Now, we're to proceed
to SecretsDump, the domain controller. grep SecretsDump, grep .k, head dash n1.
Now, there we go. So, we're going to run SecretsDump.
The syntax for this one is going to be, you know, Python 3 SecretsDump.
Dash k means use Kerberos. Tack no, tack pass means don't ask for a password. We're to specify
mog at domain mog administrator at dc1 at mog.local. And we're going to dc sync the...
Interesting. This happens. Let's go take a look.
There we go. We just used the right tool. So, we've used our... So, the syntax for this one
was Python running SecretsDump. Our target was administrator at dc1.mog.local.
Dash k was use Kerberos. Tack no, tack pass was don't ask for us for the password. And here we
see our administrator hash, our guest hash, and our machine account, which we just finished
extracting. So, that is how you silver ticket a domain controller and dc sync it with just a
regular domain user. Now, for mitigations on this, what you're going to wind up doing is
there's a setting called the landman compatibility level. I'll include a link to it in the slides
for this. There's a setting set for two or lower, which basically means allow NTLM.
That's what... If you increase that setting to five, that will completely block this. The other
mitigations are disable the print spooler service on any sensitive servers, such as domain
controllers. Now, this will cause an impact on some environments, as clients will no longer be
able to update their printer list, but hopefully you have a better way of pushing printers, such
as SCCM. So, that is the one downside, but it will prevent domain controllers from reaching out.
This works up until server 2016. I have not seen it work in server 2019, and it, again,
depends on your landman compatibility level. Thank you very much for tuning in.
This has been Evil Mog from X-Force Red and Team Hashcat.