1
00:00:05,150 --> 00:00:09,640
Hi everybody, it's Evil Mog from Team Hashcat and also X-Force Red.

2
00:00:09,640 --> 00:00:16,440
I'm here to talk to you all about a fantastic chain of vulnerabilities that leads to domain admin.

3
00:00:16,440 --> 00:00:18,780
I call this Printers to Domain Admin.

4
00:00:18,820 --> 00:00:28,880
So, first off, what we're going to be exploiting is this wonderful feature that Tifkin from SpectroOps discovered called the MSRPRN Print Spooler Bug.

5
00:00:28,880 --> 00:00:37,320
Basically what it does is it's a feature to have a domain controller tell a client where its printers are.

6
00:00:37,320 --> 00:00:41,980
Now, any user can request this packet to be sent to them.

7
00:00:42,200 --> 00:00:45,680
And what it can also do is try and enforce authentication.

8
00:00:46,380 --> 00:00:56,080
Now, if the client says, hey, I only support NTLM version 1 and the domain controller is trying to authenticate to them, it will authenticate using its machine account.

9
00:00:56,080 --> 00:01:00,980
That machine account can then be reversed from NTLM version 1 to NTLM.

10
00:01:02,120 --> 00:01:08,520
And once reversed to NTLM, we can create a silver ticket and then DC sync the server.

11
00:01:08,700 --> 00:01:10,320
So with that, let's begin.

12
00:01:10,320 --> 00:01:15,960
The first thing we're going to need to do is find out the domain SID of the machine we're going to attack.

13
00:01:15,960 --> 00:01:20,240
Now, we're going to specify that we start off with domain user credentials.

14
00:01:20,980 --> 00:01:23,700
And so we are already a regular domain user.

15
00:01:23,700 --> 00:01:28,100
We would have gotten this through Responder, some other method, or being a legit user on the network.

16
00:01:28,260 --> 00:01:39,520
So we'll run enum for Linux on 192.168.1.3 on my mog.localdomain.

17
00:01:39,640 --> 00:01:41,360
Now we're going to see a whole bunch of stuff.

18
00:01:41,360 --> 00:01:48,100
So we have to scroll up and we're going to see the domain SID is right here.

19
00:01:48,980 --> 00:01:54,100
This is the security identifier for the domain, and it did not require any credentials to pull.

20
00:01:54,100 --> 00:01:57,720
So we're going to go export SID equals.

21
00:01:59,720 --> 00:02:06,480
And quotes, even though these aren't required, I put them around just out of my own safety sake, because I've been burned once or twice.

22
00:02:06,560 --> 00:02:08,660
So we now have the SID.

23
00:02:09,460 --> 00:02:10,340
Fantastic.

24
00:02:10,800 --> 00:02:18,380
Next thing we're going to need is ready to go use our credentials on the net NTLM silver ticket repo with a tool called Dementor.

25
00:02:19,680 --> 00:02:22,520
So we're

26
00:02:25,900 --> 00:02:32,700
now in the repo, so we're going to go dot slash or Python Dementor.py.

27
00:02:36,430 --> 00:02:42,670
So in order to use Dementor, we need a domain username, which is going to be evilmog.

28
00:02:43,710 --> 00:02:45,390
We need a password.

29
00:02:45,450 --> 00:02:49,470
In this case, password is password with an exclamation mark.

30
00:02:49,970 --> 00:02:51,170
Yes, this is a demo.

31
00:02:51,170 --> 00:02:52,110
Yes, it's junk.

32
00:02:52,110 --> 00:02:53,510
I'm okay with this.

33
00:02:53,930 --> 00:02:55,230
Now we're going to use a domain.

34
00:02:55,230 --> 00:02:56,630
Domain name will be log.

35
00:02:58,690 --> 00:03:00,850
Next thing we're going to do is go into another window.

36
00:03:00,850 --> 00:03:02,090
We're going to set up Responder.

37
00:03:02,090 --> 00:03:05,890
So Responder interface at eth0.

38
00:03:09,970 --> 00:03:11,850
Yeah, let's go with that.

39
00:03:14,070 --> 00:03:18,170
And now we're going to fire over to Dementor and fire off the authentication back at us.

40
00:03:18,170 --> 00:03:20,890
Next thing we need is the listener IP.

41
00:03:21,250 --> 00:03:25,990
So the IP range on this, sorry, it was, yeah, listener and target.

42
00:03:25,990 --> 00:03:27,870
So dollars attacker IP.

43
00:03:28,050 --> 00:03:30,970
I've pre-exported mine because I can't remember what it was.

44
00:03:30,970 --> 00:03:33,810
And we're going to go with the target IP.

45
00:03:37,520 --> 00:03:38,900
It's going to send the attack.

46
00:03:38,900 --> 00:03:40,300
We're seeing access denied.

47
00:03:40,660 --> 00:03:43,940
Here we'll see an NTLM version one SSP hash.

48
00:03:44,720 --> 00:03:55,620
Now we'll see I attempted to go set this as 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8 for the client challenge, but it zeroed out these.

49
00:03:55,620 --> 00:04:00,060
I could have specified tac-tac-lm and it would have gotten me a better result.

50
00:04:00,180 --> 00:04:05,420
But in this case, I wanted to demonstrate NTLM version one with SSP on video because it's fun.

51
00:04:05,460 --> 00:04:07,040
So we're going to copy this.

52
00:04:08,900 --> 00:04:12,480
I'm now going to go into my NTLM version one multi-tool.

53
00:04:15,160 --> 00:04:18,460
Python until v1.py.

54
00:04:18,700 --> 00:04:22,840
We're supposed to find NTLM and our hash.

55
00:04:24,360 --> 00:04:28,300
Now, if you want to use crack.sh and pay $200, you absolutely can.

56
00:04:28,300 --> 00:04:30,660
The other option is we're going to do this with hashcat.

57
00:04:30,660 --> 00:04:40,720
Now this will normally take you about three to five days with from 16 to 32 GPUs or cost you about $1,000 in AWS time.

58
00:04:40,720 --> 00:04:48,260
I haven't timed this up for a while, so my numbers might be inaccurate, but on 16 GTX 1080s, it takes about four days, five.

59
00:04:48,580 --> 00:04:50,340
So what we're going to do is we're going to copy this.

60
00:04:50,340 --> 00:04:54,480
We're going to copy the 14,000 hash because it's already ready to go into hashcat.

61
00:04:54,920 --> 00:05:05,000
We're going to go into my hashcat directory, paste that, just to make sure it's a fresh file, nothing up my sleeve.

62
00:05:06,360 --> 00:05:20,540
Now we're going to take the command it told us to crack it with hashcat, telling us to use mode 14,000, attack mod 3, which is a brute force, using the DES character set, and our attack type, RDP04.

63
00:05:21,460 --> 00:05:25,120
Now, because I have a time machine, it's going to crack instantly.

64
00:05:25,300 --> 00:05:25,740
Oops.

65
00:05:30,400 --> 00:05:31,040
Perfect.

66
00:05:31,040 --> 00:05:32,840
See, it's already cracked instantly.

67
00:05:32,900 --> 00:05:35,040
So let's go show these hashes right now.

68
00:05:36,700 --> 00:05:41,980
So here we have the portion of the NTLM, but it's actually being returned as a DES key.

69
00:05:42,200 --> 00:05:49,080
We need to convert these DES keys into a portion of an NTLM.

70
00:05:49,080 --> 00:06:01,220
So we're going to throw up my hashcat, utils, src, and we're going to want the DES key to NTLM portion.

71
00:06:02,120 --> 00:06:04,640
So here is part one.

72
00:06:07,900 --> 00:06:11,000
We are then going to do part two.

73
00:06:15,860 --> 00:06:19,880
Back over here, part two.

74
00:06:22,900 --> 00:06:32,640
Now the most important part, we're also going to have to calculate the last four characters of the NTLM.

75
00:06:33,260 --> 00:06:49,020
Again, there's already a hashcat utility for that, so we're going to go into git slash hashcat utils, src, and then we are going to use a profile ct3 to NTLM.

76
00:06:51,040 --> 00:06:58,260
But it already tells us that because we do the paste, and there we are.

77
00:06:58,260 --> 00:06:59,060
We have our NTLM.

78
00:06:59,060 --> 00:07:09,580
So the NTLM is going to be part one, part two, and part three.

79
00:07:13,570 --> 00:07:14,970
Fantastic.

80
00:07:15,130 --> 00:07:19,350
So now we're going back into our handy dandy utility.

81
00:07:21,410 --> 00:07:35,550
Export NTLM equals... now to prove there's nothing up my sleeve on this one, crack map exec smb192.168.1.3.

82
00:07:36,110 --> 00:07:42,290
Username is going to be dc1$, because that means it's a machine account.

83
00:07:42,290 --> 00:07:46,550
We're going to use the hash of $NTLM.

84
00:07:49,430 --> 00:07:50,950
And there we are.

85
00:07:50,950 --> 00:07:53,790
We've authenticated as the domain machine account.

86
00:07:54,250 --> 00:07:56,270
Now we're

87
00:08:00,710 --> 00:08:05,470
going to do a grep.

88
00:08:09,320 --> 00:08:10,260
There we are.

89
00:08:10,260 --> 00:08:11,520
So we're going to run ticular.

90
00:08:11,520 --> 00:08:14,080
Now this command is a little bit complex.

91
00:08:14,080 --> 00:08:15,280
So first we're going to run Python.

92
00:08:15,280 --> 00:08:17,800
We're going to select where our ticular location is.

93
00:08:17,800 --> 00:08:22,140
We're going to use the NTLM hash, which we'll see here is 1D.

94
00:08:22,220 --> 00:08:26,040
Matches right up with what we have here ending in 904C.

95
00:08:26,040 --> 00:08:28,340
So that's your NTLM hash for the machine account.

96
00:08:28,820 --> 00:08:31,760
There is the domain SID that we captured earlier.

97
00:08:33,060 --> 00:08:36,740
That is this S121 here using enum for Linux.

98
00:08:37,080 --> 00:08:38,880
The domain name here is mog.local.

99
00:08:38,880 --> 00:08:42,020
Now the important part is the SPN.

100
00:08:42,020 --> 00:08:44,120
SPN is a service principal name.

101
00:08:44,380 --> 00:08:46,740
So in this case, we know it's a machine.

102
00:08:46,740 --> 00:08:48,000
So we know it's dc1.

103
00:08:48,000 --> 00:08:49,940
We know it's in mog.local.

104
00:08:50,240 --> 00:08:56,880
All domain controllers by default will or should in most cases have a host slash for their SPN.

105
00:08:56,880 --> 00:09:01,780
So we can guess that this machine's SPN or look at it in Bloodhound.

106
00:09:01,780 --> 00:09:07,740
But in this case, we guessed host slash dc1.mog.local and then the administrator.

107
00:09:08,020 --> 00:09:10,360
Guessing it's administrator probably is.

108
00:09:10,360 --> 00:09:14,000
A lot of people change it, but that is how we create our silver ticket.

109
00:09:14,120 --> 00:09:15,420
Now I'm going to hit enter.

110
00:09:16,220 --> 00:09:21,080
It's going to create this Kerberos cache file for you.

111
00:09:21,080 --> 00:09:22,600
Now you need to go run an export.

112
00:09:22,600 --> 00:09:24,400
So because I keep forgetting this in DAX.

113
00:09:24,720 --> 00:09:33,540
History, grep export, grep ccache, head dash n1.

114
00:09:33,940 --> 00:09:34,480
There we go.

115
00:09:34,480 --> 00:09:35,560
Export.

116
00:09:43,210 --> 00:09:47,550
So we've specified here's where our cache file is.

117
00:09:47,550 --> 00:09:51,090
Now we're to proceed to secrets dump the domain controller.

118
00:09:51,390 --> 00:10:02,830
grep secrets dump, grep .k, head dash n1.

119
00:10:04,470 --> 00:10:05,190
There

120
00:10:09,440 --> 00:10:11,780
we go.

121
00:10:11,780 --> 00:10:13,680
So we're going to run secrets dump.

122
00:10:14,640 --> 00:10:19,500
The syntax for this one is going to be, you know, our Python 3 secrets dump.

123
00:10:19,540 --> 00:10:21,820
Dash k means use Kerberos.

124
00:10:21,820 --> 00:10:25,020
Tac no, tac pass means don't ask for a password.

125
00:10:25,020 --> 00:10:30,580
We're to specify mog at the domain mog administrator at dc1.mog.local.

126
00:10:30,580 --> 00:10:32,480
And we're going to dc sync the...

127
00:10:42,980 --> 00:10:44,060
Interesting.

128
00:10:45,120 --> 00:10:46,180
This happens.

129
00:10:46,180 --> 00:10:47,440
Let's go take a look.

130
00:10:55,860 --> 00:10:56,780
There we go.

131
00:10:56,780 --> 00:10:58,120
Just used the right tool.

132
00:10:58,700 --> 00:11:04,660
So we've used our... So the syntax for this one was Python running secrets dump.

133
00:11:04,900 --> 00:11:08,580
Our target was administrator at dc1.mog.local.

134
00:11:08,820 --> 00:11:10,360
Dash k was use Kerberos.

135
00:11:10,360 --> 00:11:14,180
Tac no, tac pass was don't ask for us for the password.

136
00:11:14,180 --> 00:11:22,520
And here we see our administrator hash, our guest hash, and our machine account, which we just finished extracting.

137
00:11:25,020 --> 00:11:30,640
So that is how you silver ticket a domain controller and dc sync it with just a regular domain user.

138
00:11:30,780 --> 00:11:38,480
Now for mitigations on this, what you're going to wind up doing is there's a setting called the landman compatibility level.

139
00:11:38,480 --> 00:11:43,880
I'll include a link to it in the slides for this.

140
00:11:45,720 --> 00:11:50,360
There's a setting that we're set for two or lower, which basically means allow ntlm.

141
00:11:50,360 --> 00:11:54,440
That's what, if you increase that setting to five, that will completely block this.

142
00:11:54,440 --> 00:11:59,820
The other mitigations are disable the print spooler service on any sensitive servers such as domain controllers.

143
00:12:00,080 --> 00:12:10,040
Now this will cause an impact on some environments as clients will no longer be able to update their printer list, but hopefully you have a better way of pushing printers such as SCCM.

144
00:12:10,560 --> 00:12:14,780
So that is the one downside, but it will prevent domain controllers from reaching out.

145
00:12:14,880 --> 00:12:17,420
This works up until server 2016.

146
00:12:18,360 --> 00:12:24,020
I have not seen it work in server 2019, and it again depends on your landman compatibility level.

147
00:12:24,520 --> 00:12:26,080
Thank you very much for tuning in.

148
00:12:26,080 --> 00:12:29,940
This has been Evil Mog from X-Force Red and Team Hashcat.