start	end	text
0	7440	X-Force Red. I'm here to talk to you all about a fantastic chain of vulnerabilities that leads to
7440	13640	domain admin. I call this Printers to Domain Admin. So, first off, what we're going to be
13640	19620	exploiting is this wonderful feature that Tifkin from SpectreOps discovered called the MSRPRN
19620	27460	Print Spoolerbug. Basically what it does is it's a feature to have a domain controller tell a
27460	34280	client where its printers are. Now, any user can request this packet to be sent to them.
34500	40780	And what it can also do is try and force authentication. Now, if the client says,
40780	45180	hey, I only support NTLM version 1, and the domain controller is trying to authenticate to them,
45180	50600	it will authenticate using its machine account. That machine account can then be reversed from
50600	57480	NTLM version 1 to NTLM. And once reversed to NTLM, we can create a silver ticket
58380	63940	and then DC sync the server. So, with that, let's begin. The first thing we're going to need to do
63940	69200	is find out the domain SID of the machine we're going to attack. Now, we're going to specify that
69200	76120	we start off with domain user credentials. And so, we are already a regular domain user. We
76120	80000	would have gotten this through Responder, some other method, or being a legit user on the network.
80560	92940	So, we'll run enum for Linux on 192.168.1.3 on my mog.local domain. Now, we're going to see a
92940	99300	whole bunch of stuff. So, we have to scroll up, and we're going to see the domain SID
99300	104640	is right here. This is the security identifier for the domain,
104640	109600	and it did not require any credentials to pull. So, we're going to go export SID equals
110080	115500	domain. And quotes, even though these aren't required, I put them around just out of my own
115500	122640	safety sake because I've been burned once or twice. So, we now have the SID. Fantastic.
123040	127480	Next thing we're going to need is we're going to need to go use our credentials on the net
127480	139960	NTLM server ticket repo with a tool called Dementor. So, we're now in the repo. So,
139960	145160	we're going to go dot slash our Python Dementor dot py.
147420	152980	Help. So, in order to use Dementor, we need a domain username, which is going to be
153820	161880	evilmog. We need a password. In this case, password is password with an exclamation mark.
162320	167800	Yes, this is a demo. Yes, it's junk. I'm okay with this. Now, we're going to use a domain.
167800	173740	evilmog. Next thing we're going to do is go into another window. We're going to set up
173740	184160	Responder. So, Responder interface of eth0. Yeah, let's go with that.
186320	190520	And now we're going to fire over to Dementor and fire off the authentication back at us.
190780	197780	Next thing we're going to need is the listener IP. So,
198960	203300	$attacker IP. I pre-exported mine because I can't remember what it was.
203580	211730	And we're going to go with the target IP. It's going to send the attack. We're seeing access
211730	219390	denied. Here, we'll see an NTLM version 1 SSP hash. Now, we'll see I attempted to go set this
219390	228910	as 112233455667788 for the client challenge, but it zeroed out these. I could have specified
228910	234150	$attack LM and it would have gotten me a better result. But in this case, I wanted to demonstrate
234150	239430	NTLM version 1 with SSP on video because it's fun. So, we're going to copy this.
241170	244570	I'm now going to go into my NTLM version 1 multi-tool.
247930	255090	Python ntlmv1.py. We're going to specify NTLM and our hash.
256670	261610	Now, if you want to use crack.sh and pay $200, you absolutely can. The other option is we're going
261610	267250	to do this with hashcat. Now, this will normally take you about three to five days with anywhere
267250	274150	from 16 to 32 GPUs, or cost you about $1,000 in AWS time. I haven't timed this up for a while,
274150	280570	so my numbers might be inaccurate. But on 16 GTX 1080s, it takes about four days, five.
280790	284910	So, what we're going to do is we're going to copy this. We're going to copy the 14,000 hash.
285090	291030	It's already ready to go into hashcat. We're going to go into my hashcat directory, paste that.
292670	297290	Just make sure it's a fresh file, nothing in my slave.
298630	302790	Now, we're going to take the command it told us to crack it with hashcat,
302790	307710	telling us to use mode 14,000, attack mode 3, which is a brute force,
307710	313230	using the DES character set, and our attack type. I'll already do it for you.
313770	317370	Now, because I have a time machine, it's going to crack instantly.
322650	327270	Perfect. See, it's already cracked instantly. So, let's go show these hashes right now.
329010	334230	So, here we have the portion of the NTLM, but it's actually being returned as a DES key.
334450	342570	We need to convert these DES keys into a portion of an NTLM. So, we're going to go to git.
342570	351830	We're going to throw up my hashcat, utils, src, and we're going to want the DES key to NTLM
352490	367800	portion. So, here is part one. We are then going to do part two.
368180	378760	Back over here, part two. Now, the most important part, we're also going to have to calculate
378760	387680	the last four characters of the NTLM. Again, there's already a hashcat utility for that. So,
387680	395880	we're going to go into git slash hashcat, utils, src, and then we are going to use a profile
398460	408720	CT3 to NTLM. But it already tells us that, because we do the paste,
409460	419100	and there we are. We have our NTLM. So, the NTLM is going to be part one, part two,
420220	431560	part three. Fantastic. So, now we're going back into our handy-dandy utility.
433820	442730	Export NTLM equals. Now, to prove there's nothing up my sleeve on this one, crack map exec
444030	454630	SMB 192.168.1.3. Username is going to be DC1$, because that means it's a machine account.
454630	464690	We're going to use the hash of $NTLM. And there we are. We've authenticated as the domain
464690	483780	machine account. Now, we're going to do a grep. There we are. So, we're going to run ticketer.
483860	487980	Now, this command is a little bit complex. So, first we're going to run Python. We're
487980	493000	going to select where our ticketer location is. We're going to use the NTLM hash, which we'll
493000	499160	see here is 1D. Matches right up with what we have here ending in 904C. So, there's your NTLM
499160	503830	hash for the machine account. There is the domain SID that we captured earlier,
505380	511660	that is this S121 here using enum for Linux. The domain name here is mog.local. Now, the important
511660	518880	part is the SPN. SPN is a service principle name. So, in this case, we know it's a machine.
518880	524620	So, we know it's DC1. We know it's in mog.local. All domain controllers by default will or should
524620	531540	in most cases have a host slash DC or a host slash for their SPN. So, we can guess that this
531540	538420	machine's SPN or look at it in Bloodhound, but in this case, we guessed host slash DC1.mog.local.
538420	543120	And then the administrator, guessing it's administrator, probably is. A lot of people
543120	547660	change it, but that is how we create our silver ticket. Now, I'm going to hit enter.
548480	555020	It's going to create this Kerberos cache file for you. Now, you need to go run an export. So,
555020	565780	because I keep forgetting the syntax, history, grep export, grep ccache, head dash n1.
565880	580340	There we go. Export. So, we've specified here's where our cache file is. Now, we're to proceed
580340	594980	to SecretsDump, the domain controller. grep SecretsDump, grep .k, head dash n1.
596880	606010	Now, there we go. So, we're going to run SecretsDump.
606890	611710	The syntax for this one is going to be, you know, Python 3 SecretsDump.
611710	618050	Dash k means use Kerberos. Tack no, tack pass means don't ask for a password. We're to specify
618050	624750	mog at domain mog administrator at dc1 at mog.local. And we're going to dc sync the...
635310	639730	Interesting. This happens. Let's go take a look.
648060	654100	There we go. We just used the right tool. So, we've used our... So, the syntax for this one
654100	660800	was Python running SecretsDump. Our target was administrator at dc1.mog.local.
661080	666840	Dash k was use Kerberos. Tack no, tack pass was don't ask for us for the password. And here we
666840	673920	see our administrator hash, our guest hash, and our machine account, which we just finished
673920	681650	extracting. So, that is how you silver ticket a domain controller and dc sync it with just a
681650	687430	regular domain user. Now, for mitigations on this, what you're going to wind up doing is
687430	695070	there's a setting called the landman compatibility level. I'll include a link to it in the slides
695070	702610	for this. There's a setting set for two or lower, which basically means allow NTLM.
702930	706930	That's what... If you increase that setting to five, that will completely block this. The other
706930	711230	mitigations are disable the print spooler service on any sensitive servers, such as domain
711230	717490	controllers. Now, this will cause an impact on some environments, as clients will no longer be
717490	720950	able to update their printer list, but hopefully you have a better way of pushing printers, such
720950	727050	as SCCM. So, that is the one downside, but it will prevent domain controllers from reaching out.
727130	733850	This works up until server 2016. I have not seen it work in server 2019, and it, again,
733850	738370	depends on your landman compatibility level. Thank you very much for tuning in.
738370	742170	This has been Evil Mog from X-Force Red and Team Hashcat.