start	end	text
5150	10760	Hi everybody, it's Evil Mog from Team Hashcat and also X-Force Red. I'm here to talk to you
10760	17480	all about a fantastic chain of vulnerabilities that leads to domain admin. I call this Printers
17480	23440	to Domain Admin. So, first off, what we're going to be exploiting is this wonderful feature that
23440	29980	Tifkin from SpectroOps discovered called the MSRPRN Print Spooler Bug. Basically what it does
29980	37980	is it's a feature to have a domain controller tell a client where its printers are. Now,
38680	44440	any user can request this packet to be sent to them. And what it can also do is try and
44440	50400	enforce authentication. Now, if the client says, hey, I only support NTLM version 1
50400	54440	and the domain controller is trying to authenticate to them, it will authenticate using
54440	60980	its machine account. That machine account can then be reversed from NTLM version 1 to NTLM.
62120	69640	And once reversed to NTLM, we can create a silver ticket and then DC sync the server. So with that,
69640	75200	let's begin. The first thing we're going to need to do is find out the domain SID of the machine
75200	80240	we're going to attack. Now, we're going to specify that we start off with domain user credentials.
80980	84740	And so we are already a regular domain user. We would have gotten this through
84740	89860	Responder, some other method, or being a legit user on the network. So we'll run enum for Linux
92440	101360	on 192.168.1.3 on my mog.localdomain. Now we're going to see a whole bunch of stuff.
101360	108100	So we have to scroll up and we're going to see the domain SID is right here.
108980	111700	This is the security identifier for the domain,
111700	117720	and it did not require any credentials to pull. So we're going to go export SID equals.
119720	124600	And quotes, even though these aren't required, I put them around just out of my own safety sake,
124600	131500	because I've been burned once or twice. So we now have the SID. Fantastic. Next thing we're
131500	136980	going to need is ready to go use our credentials on the net NTLM silver ticket repo with a tool
136980	152700	called Dementor. So we're now in the repo, so we're going to go dot slash or Python Dementor.py.
156430	162670	So in order to use Dementor, we need a domain username, which is going to be evilmog.
163710	169470	We need a password. In this case, password is password with an exclamation mark.
169970	173510	Yes, this is a demo. Yes, it's junk. I'm okay with this.
173930	176630	Now we're going to use a domain. Domain name will be log.
178690	182210	Next thing we're going to do is go into another window. We're going to set up Responder. So
182210	191850	Responder interface at eth0. Yeah, let's go with that.
194070	198170	And now we're going to fire over to Dementor and fire off the authentication back at us.
198170	204770	Next thing we need is the listener IP. So the IP range on this, sorry, it was, yeah,
204770	210210	listener and target. So dollars attacker IP. I've pre-exported mine because I can't remember what
210210	219460	it was. And we're going to go with the target IP. It's going to send the attack. We're seeing access
219460	227120	denied. Here we'll see an NTLM version one SSP hash. Now we'll see I attempted to go set this
227120	235620	as 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8 for the client challenge, but it zeroed out these.
235620	240980	I could have specified tac-tac-lm and it would have gotten me a better result. But in this case,
240980	246280	I wanted to demonstrate NTLM version one with SSP on video because it's fun. So we're going to copy
246280	252480	this. I'm now going to go into my NTLM version one multi-tool.
255160	262840	Python until v1.py. We're supposed to find NTLM and our hash.
264360	269280	Now, if you want to use crack.sh and pay $200, you absolutely can. The other option is we're
269280	274360	going to do this with hashcat. Now this will normally take you about three to five days with
274780	281880	from 16 to 32 GPUs or cost you about $1,000 in AWS time. I haven't timed this up for a while,
281880	287520	so my numbers might be inaccurate, but on 16 GTX 1080s, it takes about four days,
287520	292300	five. So what we're going to do is we're going to copy this. We're going to copy the 14,000 hash
292300	297680	because it's already ready to go into hashcat. We're going to go into my hashcat directory,
297680	305000	paste that, just to make sure it's a fresh file, nothing up my sleeve.
306360	310260	Now we're going to take the command it told us to crack it with hashcat,
310260	315680	telling us to use mode 14,000, attack mod 3, which is a brute force,
315680	323220	using the DES character set, and our attack type, RDP04. Now, because I have a time machine,
323220	333320	it's going to crack instantly. Oops. Perfect. See, it's already cracked instantly. So let's
333320	340620	go show these hashes right now. So here we have the portion of the NTLM, but it's actually being
340620	349420	returned as a DES key. We need to convert these DES keys into a portion of an NTLM. So we're
349420	361220	going to throw up my hashcat, utils, src, and we're going to want the DES key to NTLM portion.
362120	379880	So here is part one. We are then going to do part two. Back over here, part two.
382900	386460	Now the most important part, we're also going to have to calculate
386460	395280	the last four characters of the NTLM. Again, there's already a hashcat utility for that,
395280	403580	so we're going to go into git slash hashcat utils, src, and then we are going to use a profile
406080	416440	ct3 to NTLM. But it already tells us that because we do the paste,
417200	426760	and there we are. We have our NTLM. So the NTLM is going to be part one, part two,
427880	439350	and part three. Fantastic. So now we're going back into our handy dandy utility.
441410	450450	Export NTLM equals... now to prove there's nothing up my sleeve on this one, crack map exec
452290	457770	smb192.168.1.3. Username is going to be
458770	466550	dc1$, because that means it's a machine account. We're going to use the hash of $NTLM.
469430	481370	And there we are. We've authenticated as the domain machine account. Now we're going to
483870	493600	do a grep. There we are. So we're going to run ticular. Now this command is a little bit
493600	497800	complex. So first we're going to run Python. We're going to select where our ticular location is.
497800	504080	We're going to use the NTLM hash, which we'll see here is 1D. Matches right up with what we have
504080	510300	here ending in 904C. So that's your NTLM hash for the machine account. There is the domain SID that
510300	518100	we captured earlier. That is this S121 here using enum for Linux. The domain name here is
518100	525380	mog.local. Now the important part is the SPN. SPN is a service principal name. So in this case,
525380	531100	we know it's a machine. So we know it's dc1. We know it's in mog.local. All domain controllers
531100	538680	by default will or should in most cases have a host slash for their SPN. So we can guess that
538680	545920	this machine's SPN or look at it in Bloodhound. But in this case, we guessed host slash dc1.mog.local
545920	550820	and then the administrator. Guessing it's administrator probably is. A lot of people
550820	555420	change it, but that is how we create our silver ticket. Now I'm going to hit enter.
556220	562640	It's going to create this Kerberos cache file for you. Now you need to go run an export. So
562640	574120	because I keep forgetting this in DAX. History, grep export, grep ccache, head dash n1. There
574120	588510	we go. Export. So we've specified here's where our cache file is. Now we're to proceed to secrets
588510	612080	dump the domain controller. grep secrets dump, grep .k, head dash n1. There we go. So we're
612080	618740	going to run secrets dump. The syntax for this one is going to be, you know, our Python 3 secrets
618740	625760	dump. Dash k means use Kerberos. Tac no, tac pass means don't ask for a password. We're to specify
625760	632480	mog at the domain mog administrator at dc1.mog.local. And we're going to dc sync the...
642980	647440	Interesting. This happens. Let's go take a look.
655860	662480	There we go. Just used the right tool. So we've used our... So the syntax for this one was Python
663140	668580	running secrets dump. Our target was administrator at dc1.mog.local.
668820	674560	Dash k was use Kerberos. Tac no, tac pass was don't ask for us for the password. And here we
674560	681640	see our administrator hash, our guest hash, and our machine account, which we just finished
681640	689540	extracting. So that is how you silver ticket a domain controller and dc sync it with just a
689540	696260	regular domain user. Now for mitigations on this, what you're going to wind up doing is there's a
696260	706200	setting called the landman compatibility level. I'll include a link to it in the slides for this.
706340	710360	There's a setting that we're set for two or lower, which basically means allow ntlm.
710360	714620	That's what, if you increase that setting to five, that will completely block this. The other
714620	719820	mitigations are disable the print spooler service on any sensitive servers such as domain controllers.
720080	725600	Now this will cause an impact on some environments as clients will no longer be able to update their
725600	731040	printer list, but hopefully you have a better way of pushing printers such as SCCM. So that is the
731040	737420	one downside, but it will prevent domain controllers from reaching out. This works up until server 2016.
738360	744020	I have not seen it work in server 2019, and it again depends on your landman compatibility level.
744520	749940	Thank you very much for tuning in. This has been Evil Mog from X-Force Red and Team Hashcat.