WEBVTT 00:00.000 --> 00:02.000 X-Force Red. 00:02.000 --> 00:08.780 I'm here to talk to you all about a fantastic chain of vulnerabilities that leads to domain admin. 00:08.780 --> 00:11.100 I call this Printers to Domain Admin. 00:11.100 --> 00:21.140 So, first off, what we're going to be exploiting is this wonderful feature that Tifkin from SpectreOps discovered called the MSRPRN Print Spoolerbug. 00:21.140 --> 00:29.560 Basically what it does is it's a feature to have a domain controller tell a client where its printers are. 00:29.600 --> 00:34.280 Now, any user can request this packet to be sent to them. 00:34.500 --> 00:37.980 And what it can also do is try and force authentication. 00:38.660 --> 00:48.420 Now, if the client says, hey, I only support NTLM version 1, and the domain controller is trying to authenticate to them, it will authenticate using its machine account. 00:48.420 --> 00:53.140 That machine account can then be reversed from NTLM version 1 to NTLM. 00:54.540 --> 01:00.700 And once reversed to NTLM, we can create a silver ticket and then DC sync the server. 01:01.080 --> 01:02.600 So, with that, let's begin. 01:02.600 --> 01:08.260 The first thing we're going to need to do is find out the domain SID of the machine we're going to attack. 01:08.260 --> 01:12.340 Now, we're going to specify that we start off with domain user credentials. 01:13.420 --> 01:15.940 And so, we are already a regular domain user. 01:15.940 --> 01:20.000 We would have gotten this through Responder, some other method, or being a legit user on the network. 01:20.560 --> 01:31.900 So, we'll run enum for Linux on 192.168.1.3 on my mog.local domain. 01:31.900 --> 01:33.620 Now, we're going to see a whole bunch of stuff. 01:33.620 --> 01:40.440 So, we have to scroll up, and we're going to see the domain SID is right here. 01:41.200 --> 01:46.360 This is the security identifier for the domain, and it did not require any credentials to pull. 01:46.360 --> 01:50.520 So, we're going to go export SID equals domain. 01:51.740 --> 01:58.780 And quotes, even though these aren't required, I put them around just out of my own safety sake because I've been burned once or twice. 01:58.900 --> 02:00.940 So, we now have the SID. 02:01.760 --> 02:02.640 Fantastic. 02:03.040 --> 02:10.400 Next thing we're going to need is we're going to need to go use our credentials on the net NTLM server ticket repo with a tool called Dementor. 02:12.220 --> 02:14.000 So, 02:17.380 --> 02:19.780 we're now in the repo. 02:19.780 --> 02:25.160 So, we're going to go dot slash our Python Dementor dot py. 02:27.420 --> 02:28.380 Help. 02:28.740 --> 02:34.780 So, in order to use Dementor, we need a domain username, which is going to be evilmog. 02:36.200 --> 02:37.720 We need a password. 02:38.080 --> 02:41.880 In this case, password is password with an exclamation mark. 02:42.320 --> 02:43.440 Yes, this is a demo. 02:43.440 --> 02:44.320 Yes, it's junk. 02:44.320 --> 02:45.740 I'm okay with this. 02:46.120 --> 02:47.800 Now, we're going to use a domain. 02:47.800 --> 02:48.960 evilmog. 02:50.920 --> 02:53.220 Next thing we're going to do is go into another window. 02:53.340 --> 02:54.360 We're going to set up Responder. 02:54.360 --> 02:58.360 So, Responder interface of eth0. 03:02.180 --> 03:04.160 Yeah, let's go with that. 03:06.320 --> 03:10.520 And now we're going to fire over to Dementor and fire off the authentication back at us. 03:10.780 --> 03:13.140 Next thing we're going to need is the listener IP. 03:13.300 --> 03:20.060 So, $attacker IP. 03:20.320 --> 03:23.300 I pre-exported mine because I can't remember what it was. 03:23.580 --> 03:26.060 And we're going to go with the target IP. 03:29.810 --> 03:31.170 It's going to send the attack. 03:31.170 --> 03:32.550 We're seeing access denied. 03:32.930 --> 03:36.210 Here, we'll see an NTLM version 1 SSP hash. 03:37.010 --> 03:47.950 Now, we'll see I attempted to go set this as 112233455667788 for the client challenge, but it zeroed out these. 03:47.950 --> 03:52.430 I could have specified $attack LM and it would have gotten me a better result. 03:52.430 --> 03:57.630 But in this case, I wanted to demonstrate NTLM version 1 with SSP on video because it's fun. 03:57.630 --> 03:59.430 So, we're going to copy this. 04:01.170 --> 04:04.570 I'm now going to go into my NTLM version 1 multi-tool. 04:07.930 --> 04:10.730 Python ntlmv1.py. 04:10.990 --> 04:15.090 We're going to specify NTLM and our hash. 04:16.670 --> 04:20.590 Now, if you want to use crack.sh and pay $200, you absolutely can. 04:20.590 --> 04:22.930 The other option is we're going to do this with hashcat. 04:23.010 --> 04:33.050 Now, this will normally take you about three to five days with anywhere from 16 to 32 GPUs, or cost you about $1,000 in AWS time. 04:33.050 --> 04:35.730 I haven't timed this up for a while, so my numbers might be inaccurate. 04:36.250 --> 04:40.570 But on 16 GTX 1080s, it takes about four days, five. 04:40.790 --> 04:42.630 So, what we're going to do is we're going to copy this. 04:42.630 --> 04:44.910 We're going to copy the 14,000 hash. 04:45.090 --> 04:46.690 It's already ready to go into hashcat. 04:47.210 --> 04:51.030 We're going to go into my hashcat directory, paste that. 04:52.670 --> 04:57.290 Just make sure it's a fresh file, nothing in my slave. 04:58.630 --> 05:11.770 Now, we're going to take the command it told us to crack it with hashcat, telling us to use mode 14,000, attack mode 3, which is a brute force, using the DES character set, and our attack type. 05:11.770 --> 05:13.230 I'll already do it for you. 05:13.770 --> 05:17.370 Now, because I have a time machine, it's going to crack instantly. 05:22.650 --> 05:23.310 Perfect. 05:23.310 --> 05:25.090 See, it's already cracked instantly. 05:25.290 --> 05:27.270 So, let's go show these hashes right now. 05:29.010 --> 05:34.230 So, here we have the portion of the NTLM, but it's actually being returned as a DES key. 05:34.450 --> 05:41.370 We need to convert these DES keys into a portion of an NTLM. 05:41.370 --> 05:42.570 So, we're going to go to git. 05:42.570 --> 05:53.770 We're going to throw up my hashcat, utils, src, and we're going to want the DES key to NTLM portion. 05:54.490 --> 05:56.810 So, here is part one. 05:59.990 --> 06:03.050 We are then going to do part two 06:07.300 --> 06:07.800 . 06:08.180 --> 06:12.100 Back over here, part two. 06:15.520 --> 06:25.000 Now, the most important part, we're also going to have to calculate the last four characters of the NTLM. 06:25.480 --> 06:27.540 Again, there's already a hashcat utility for that. 06:27.540 --> 06:41.220 So, we're going to go into git slash hashcat, utils, src, and then we are going to use a profile CT3 to NTLM. 06:43.360 --> 06:50.560 But it already tells us that, because we do the paste, and there we are. 06:50.560 --> 06:51.380 We have our NTLM. 06:51.380 --> 07:01.840 So, the NTLM is going to be part one, part two, part three. 07:05.940 --> 07:07.180 Fantastic. 07:07.400 --> 07:11.560 So, now we're going back into our handy-dandy utility. 07:13.820 --> 07:16.560 Export NTLM equals. 07:19.030 --> 07:27.730 Now, to prove there's nothing up my sleeve on this one, crack map exec SMB 192.168.1.3. 07:28.450 --> 07:34.630 Username is going to be DC1$, because that means it's a machine account. 07:34.630 --> 07:38.850 We're going to use the hash of $NTLM. 07:41.610 --> 07:43.230 And there we are. 07:43.230 --> 07:45.890 We've authenticated as the domain machine account. 07:46.290 --> 07:48.010 Now, 07:52.260 --> 07:57.620 we're going to do a grep. 08:01.780 --> 08:02.600 There we are. 08:02.600 --> 08:03.780 So, we're going to run ticketer. 08:03.860 --> 08:06.440 Now, this command is a little bit complex. 08:06.440 --> 08:07.680 So, first we're going to run Python. 08:07.900 --> 08:10.120 We're going to select where our ticketer location is. 08:10.120 --> 08:14.440 We're going to use the NTLM hash, which we'll see here is 1D. 08:14.560 --> 08:18.340 Matches right up with what we have here ending in 904C. 08:18.340 --> 08:20.440 So, there's your NTLM hash for the machine account. 08:21.060 --> 08:29.020 There is the domain SID that we captured earlier, that is this S121 here using enum for Linux. 08:29.240 --> 08:31.140 The domain name here is mog.local. 08:31.140 --> 08:34.320 Now, the important part is the SPN. 08:34.340 --> 08:36.380 SPN is a service principle name. 08:36.700 --> 08:38.880 So, in this case, we know it's a machine. 08:38.880 --> 08:40.340 So, we know it's DC1. 08:40.340 --> 08:42.060 We know it's in mog.local. 08:42.580 --> 08:49.320 All domain controllers by default will or should in most cases have a host slash DC or a host slash for their SPN. 08:49.320 --> 08:58.420 So, we can guess that this machine's SPN or look at it in Bloodhound, but in this case, we guessed host slash DC1.mog.local. 08:58.420 --> 09:02.640 And then the administrator, guessing it's administrator, probably is. 09:02.640 --> 09:06.240 A lot of people change it, but that is how we create our silver ticket. 09:06.320 --> 09:07.660 Now, I'm going to hit enter. 09:08.480 --> 09:13.480 It's going to create this Kerberos cache file for you. 09:13.480 --> 09:14.920 Now, you need to go run an export. 09:14.920 --> 09:25.780 So, because I keep forgetting the syntax, history, grep export, grep ccache, head dash n1. 09:25.880 --> 09:26.780 There we go. 09:26.780 --> 09:27.660 Export. 09:35.680 --> 09:39.620 So, we've specified here's where our cache file is. 09:39.620 --> 09:43.180 Now, we're to proceed to SecretsDump, the domain controller. 09:43.900 --> 09:54.980 grep SecretsDump, grep .k, head dash n1. 09:56.880 --> 09:58.080 Now, 10:02.330 --> 10:04.050 there we go. 10:04.050 --> 10:06.010 So, we're going to run SecretsDump. 10:06.890 --> 10:11.710 The syntax for this one is going to be, you know, Python 3 SecretsDump. 10:11.710 --> 10:14.090 Dash k means use Kerberos. 10:14.130 --> 10:17.230 Tack no, tack pass means don't ask for a password. 10:17.330 --> 10:22.930 We're to specify mog at domain mog administrator at dc1 at mog.local. 10:22.930 --> 10:24.750 And we're going to dc sync the... 10:35.310 --> 10:36.350 Interesting. 10:37.410 --> 10:38.450 This happens. 10:38.450 --> 10:39.730 Let's go take a look. 10:48.060 --> 10:49.100 There we go. 10:49.100 --> 10:50.380 We just used the right tool. 10:50.860 --> 10:56.940 So, we've used our... So, the syntax for this one was Python running SecretsDump. 10:57.180 --> 11:00.800 Our target was administrator at dc1.mog.local. 11:01.080 --> 11:02.620 Dash k was use Kerberos. 11:02.620 --> 11:06.480 Tack no, tack pass was don't ask for us for the password. 11:06.480 --> 11:14.880 And here we see our administrator hash, our guest hash, and our machine account, which we just finished extracting. 11:17.290 --> 11:22.850 So, that is how you silver ticket a domain controller and dc sync it with just a regular domain user. 11:22.990 --> 11:30.750 Now, for mitigations on this, what you're going to wind up doing is there's a setting called the landman compatibility level. 11:30.750 --> 11:36.130 I'll include a link to it in the slides for this. 11:38.050 --> 11:42.610 There's a setting set for two or lower, which basically means allow NTLM. 11:42.930 --> 11:46.690 That's what... If you increase that setting to five, that will completely block this. 11:46.690 --> 11:52.050 The other mitigations are disable the print spooler service on any sensitive servers, such as domain controllers. 11:52.330 --> 12:02.370 Now, this will cause an impact on some environments, as clients will no longer be able to update their printer list, but hopefully you have a better way of pushing printers, such as SCCM. 12:02.650 --> 12:07.050 So, that is the one downside, but it will prevent domain controllers from reaching out. 12:07.130 --> 12:09.690 This works up until server 2016. 12:10.610 --> 12:16.350 I have not seen it work in server 2019, and it, again, depends on your landman compatibility level. 12:16.790 --> 12:18.370 Thank you very much for tuning in. 12:18.370 --> 12:22.170 This has been Evil Mog from X-Force Red and Team Hashcat.