WEBVTT 00:05.150 --> 00:09.640 Hi everybody, it's Evil Mog from Team Hashcat and also X-Force Red. 00:09.640 --> 00:16.440 I'm here to talk to you all about a fantastic chain of vulnerabilities that leads to domain admin. 00:16.440 --> 00:18.780 I call this Printers to Domain Admin. 00:18.820 --> 00:28.880 So, first off, what we're going to be exploiting is this wonderful feature that Tifkin from SpectroOps discovered called the MSRPRN Print Spooler Bug. 00:28.880 --> 00:37.320 Basically what it does is it's a feature to have a domain controller tell a client where its printers are. 00:37.320 --> 00:41.980 Now, any user can request this packet to be sent to them. 00:42.200 --> 00:45.680 And what it can also do is try and enforce authentication. 00:46.380 --> 00:56.080 Now, if the client says, hey, I only support NTLM version 1 and the domain controller is trying to authenticate to them, it will authenticate using its machine account. 00:56.080 --> 01:00.980 That machine account can then be reversed from NTLM version 1 to NTLM. 01:02.120 --> 01:08.520 And once reversed to NTLM, we can create a silver ticket and then DC sync the server. 01:08.700 --> 01:10.320 So with that, let's begin. 01:10.320 --> 01:15.960 The first thing we're going to need to do is find out the domain SID of the machine we're going to attack. 01:15.960 --> 01:20.240 Now, we're going to specify that we start off with domain user credentials. 01:20.980 --> 01:23.700 And so we are already a regular domain user. 01:23.700 --> 01:28.100 We would have gotten this through Responder, some other method, or being a legit user on the network. 01:28.260 --> 01:39.520 So we'll run enum for Linux on 192.168.1.3 on my mog.localdomain. 01:39.640 --> 01:41.360 Now we're going to see a whole bunch of stuff. 01:41.360 --> 01:48.100 So we have to scroll up and we're going to see the domain SID is right here. 01:48.980 --> 01:54.100 This is the security identifier for the domain, and it did not require any credentials to pull. 01:54.100 --> 01:57.720 So we're going to go export SID equals. 01:59.720 --> 02:06.480 And quotes, even though these aren't required, I put them around just out of my own safety sake, because I've been burned once or twice. 02:06.560 --> 02:08.660 So we now have the SID. 02:09.460 --> 02:10.340 Fantastic. 02:10.800 --> 02:18.380 Next thing we're going to need is ready to go use our credentials on the net NTLM silver ticket repo with a tool called Dementor. 02:19.680 --> 02:22.520 So we're 02:25.900 --> 02:32.700 now in the repo, so we're going to go dot slash or Python Dementor.py. 02:36.430 --> 02:42.670 So in order to use Dementor, we need a domain username, which is going to be evilmog. 02:43.710 --> 02:45.390 We need a password. 02:45.450 --> 02:49.470 In this case, password is password with an exclamation mark. 02:49.970 --> 02:51.170 Yes, this is a demo. 02:51.170 --> 02:52.110 Yes, it's junk. 02:52.110 --> 02:53.510 I'm okay with this. 02:53.930 --> 02:55.230 Now we're going to use a domain. 02:55.230 --> 02:56.630 Domain name will be log. 02:58.690 --> 03:00.850 Next thing we're going to do is go into another window. 03:00.850 --> 03:02.090 We're going to set up Responder. 03:02.090 --> 03:05.890 So Responder interface at eth0. 03:09.970 --> 03:11.850 Yeah, let's go with that. 03:14.070 --> 03:18.170 And now we're going to fire over to Dementor and fire off the authentication back at us. 03:18.170 --> 03:20.890 Next thing we need is the listener IP. 03:21.250 --> 03:25.990 So the IP range on this, sorry, it was, yeah, listener and target. 03:25.990 --> 03:27.870 So dollars attacker IP. 03:28.050 --> 03:30.970 I've pre-exported mine because I can't remember what it was. 03:30.970 --> 03:33.810 And we're going to go with the target IP. 03:37.520 --> 03:38.900 It's going to send the attack. 03:38.900 --> 03:40.300 We're seeing access denied. 03:40.660 --> 03:43.940 Here we'll see an NTLM version one SSP hash. 03:44.720 --> 03:55.620 Now we'll see I attempted to go set this as 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8 for the client challenge, but it zeroed out these. 03:55.620 --> 04:00.060 I could have specified tac-tac-lm and it would have gotten me a better result. 04:00.180 --> 04:05.420 But in this case, I wanted to demonstrate NTLM version one with SSP on video because it's fun. 04:05.460 --> 04:07.040 So we're going to copy this. 04:08.900 --> 04:12.480 I'm now going to go into my NTLM version one multi-tool. 04:15.160 --> 04:18.460 Python until v1.py. 04:18.700 --> 04:22.840 We're supposed to find NTLM and our hash. 04:24.360 --> 04:28.300 Now, if you want to use crack.sh and pay $200, you absolutely can. 04:28.300 --> 04:30.660 The other option is we're going to do this with hashcat. 04:30.660 --> 04:40.720 Now this will normally take you about three to five days with from 16 to 32 GPUs or cost you about $1,000 in AWS time. 04:40.720 --> 04:48.260 I haven't timed this up for a while, so my numbers might be inaccurate, but on 16 GTX 1080s, it takes about four days, five. 04:48.580 --> 04:50.340 So what we're going to do is we're going to copy this. 04:50.340 --> 04:54.480 We're going to copy the 14,000 hash because it's already ready to go into hashcat. 04:54.920 --> 05:05.000 We're going to go into my hashcat directory, paste that, just to make sure it's a fresh file, nothing up my sleeve. 05:06.360 --> 05:20.540 Now we're going to take the command it told us to crack it with hashcat, telling us to use mode 14,000, attack mod 3, which is a brute force, using the DES character set, and our attack type, RDP04. 05:21.460 --> 05:25.120 Now, because I have a time machine, it's going to crack instantly. 05:25.300 --> 05:25.740 Oops. 05:30.400 --> 05:31.040 Perfect. 05:31.040 --> 05:32.840 See, it's already cracked instantly. 05:32.900 --> 05:35.040 So let's go show these hashes right now. 05:36.700 --> 05:41.980 So here we have the portion of the NTLM, but it's actually being returned as a DES key. 05:42.200 --> 05:49.080 We need to convert these DES keys into a portion of an NTLM. 05:49.080 --> 06:01.220 So we're going to throw up my hashcat, utils, src, and we're going to want the DES key to NTLM portion. 06:02.120 --> 06:04.640 So here is part one. 06:07.900 --> 06:11.000 We are then going to do part two. 06:15.860 --> 06:19.880 Back over here, part two. 06:22.900 --> 06:32.640 Now the most important part, we're also going to have to calculate the last four characters of the NTLM. 06:33.260 --> 06:49.020 Again, there's already a hashcat utility for that, so we're going to go into git slash hashcat utils, src, and then we are going to use a profile ct3 to NTLM. 06:51.040 --> 06:58.260 But it already tells us that because we do the paste, and there we are. 06:58.260 --> 06:59.060 We have our NTLM. 06:59.060 --> 07:09.580 So the NTLM is going to be part one, part two, and part three. 07:13.570 --> 07:14.970 Fantastic. 07:15.130 --> 07:19.350 So now we're going back into our handy dandy utility. 07:21.410 --> 07:35.550 Export NTLM equals... now to prove there's nothing up my sleeve on this one, crack map exec smb192.168.1.3. 07:36.110 --> 07:42.290 Username is going to be dc1$, because that means it's a machine account. 07:42.290 --> 07:46.550 We're going to use the hash of $NTLM. 07:49.430 --> 07:50.950 And there we are. 07:50.950 --> 07:53.790 We've authenticated as the domain machine account. 07:54.250 --> 07:56.270 Now we're 08:00.710 --> 08:05.470 going to do a grep. 08:09.320 --> 08:10.260 There we are. 08:10.260 --> 08:11.520 So we're going to run ticular. 08:11.520 --> 08:14.080 Now this command is a little bit complex. 08:14.080 --> 08:15.280 So first we're going to run Python. 08:15.280 --> 08:17.800 We're going to select where our ticular location is. 08:17.800 --> 08:22.140 We're going to use the NTLM hash, which we'll see here is 1D. 08:22.220 --> 08:26.040 Matches right up with what we have here ending in 904C. 08:26.040 --> 08:28.340 So that's your NTLM hash for the machine account. 08:28.820 --> 08:31.760 There is the domain SID that we captured earlier. 08:33.060 --> 08:36.740 That is this S121 here using enum for Linux. 08:37.080 --> 08:38.880 The domain name here is mog.local. 08:38.880 --> 08:42.020 Now the important part is the SPN. 08:42.020 --> 08:44.120 SPN is a service principal name. 08:44.380 --> 08:46.740 So in this case, we know it's a machine. 08:46.740 --> 08:48.000 So we know it's dc1. 08:48.000 --> 08:49.940 We know it's in mog.local. 08:50.240 --> 08:56.880 All domain controllers by default will or should in most cases have a host slash for their SPN. 08:56.880 --> 09:01.780 So we can guess that this machine's SPN or look at it in Bloodhound. 09:01.780 --> 09:07.740 But in this case, we guessed host slash dc1.mog.local and then the administrator. 09:08.020 --> 09:10.360 Guessing it's administrator probably is. 09:10.360 --> 09:14.000 A lot of people change it, but that is how we create our silver ticket. 09:14.120 --> 09:15.420 Now I'm going to hit enter. 09:16.220 --> 09:21.080 It's going to create this Kerberos cache file for you. 09:21.080 --> 09:22.600 Now you need to go run an export. 09:22.600 --> 09:24.400 So because I keep forgetting this in DAX. 09:24.720 --> 09:33.540 History, grep export, grep ccache, head dash n1. 09:33.940 --> 09:34.480 There we go. 09:34.480 --> 09:35.560 Export. 09:43.210 --> 09:47.550 So we've specified here's where our cache file is. 09:47.550 --> 09:51.090 Now we're to proceed to secrets dump the domain controller. 09:51.390 --> 10:02.830 grep secrets dump, grep .k, head dash n1. 10:04.470 --> 10:05.190 There 10:09.440 --> 10:11.780 we go. 10:11.780 --> 10:13.680 So we're going to run secrets dump. 10:14.640 --> 10:19.500 The syntax for this one is going to be, you know, our Python 3 secrets dump. 10:19.540 --> 10:21.820 Dash k means use Kerberos. 10:21.820 --> 10:25.020 Tac no, tac pass means don't ask for a password. 10:25.020 --> 10:30.580 We're to specify mog at the domain mog administrator at dc1.mog.local. 10:30.580 --> 10:32.480 And we're going to dc sync the... 10:42.980 --> 10:44.060 Interesting. 10:45.120 --> 10:46.180 This happens. 10:46.180 --> 10:47.440 Let's go take a look. 10:55.860 --> 10:56.780 There we go. 10:56.780 --> 10:58.120 Just used the right tool. 10:58.700 --> 11:04.660 So we've used our... So the syntax for this one was Python running secrets dump. 11:04.900 --> 11:08.580 Our target was administrator at dc1.mog.local. 11:08.820 --> 11:10.360 Dash k was use Kerberos. 11:10.360 --> 11:14.180 Tac no, tac pass was don't ask for us for the password. 11:14.180 --> 11:22.520 And here we see our administrator hash, our guest hash, and our machine account, which we just finished extracting. 11:25.020 --> 11:30.640 So that is how you silver ticket a domain controller and dc sync it with just a regular domain user. 11:30.780 --> 11:38.480 Now for mitigations on this, what you're going to wind up doing is there's a setting called the landman compatibility level. 11:38.480 --> 11:43.880 I'll include a link to it in the slides for this. 11:45.720 --> 11:50.360 There's a setting that we're set for two or lower, which basically means allow ntlm. 11:50.360 --> 11:54.440 That's what, if you increase that setting to five, that will completely block this. 11:54.440 --> 11:59.820 The other mitigations are disable the print spooler service on any sensitive servers such as domain controllers. 12:00.080 --> 12:10.040 Now this will cause an impact on some environments as clients will no longer be able to update their printer list, but hopefully you have a better way of pushing printers such as SCCM. 12:10.560 --> 12:14.780 So that is the one downside, but it will prevent domain controllers from reaching out. 12:14.880 --> 12:17.420 This works up until server 2016. 12:18.360 --> 12:24.020 I have not seen it work in server 2019, and it again depends on your landman compatibility level. 12:24.520 --> 12:26.080 Thank you very much for tuning in. 12:26.080 --> 12:29.940 This has been Evil Mog from X-Force Red and Team Hashcat.