[Music]
what's up everybody
today we're gonna be talking about pen
test story time my favorite hacks from
the past
year my name is heath adams aka the
cyber mentor and i am a husband hacker
military veteran and day to day i am the
ceo and founder of tcm security
which is an ethical hacking and
penetration testing company
on social media as you can see i am
known as a cyber mentor across the board
i do twitch streaming i have a youtube
channel i'm on twitter
and i'm a udemy instructor with over 150
000 students so quickly why this talk
well this talk is going to be about my
favorite hacks
and mostly it's going to be about
internal penetration testing because
that's my favorite thing to do
although we're going to talk a little
bit about external pen testing and
really what i want to do is i want to
talk at a high level this is going to be
for
people interested in the red team side
the blue team side
and for those who just want to hear
stories so i'm going to try to keep it
very high level so that you can
understand
and i'll provide resources if you want
to get deeper into the weeds on this
but these are going to be my stories
from the past year or so
and we're just going to kind of cover
what i thought has been
really eye-opening or educational that i
can pass on to you
so the first story i've actually told
before but this is one of my favorite
stories and it's kind of outside the
last
year but it's within the last two years
and i think it's very interesting
so i was doing a pen test against a
company and we were doing external
and internal so the goal of the external
pen test is to try to break inside the
network
once you're inside the network that is
called the internal pen test
so here's a little bit about the story
but before we start
let's talk a little bit about how we got
in
so in order to talk about how we got in
we have to talk about something called
credential stuffing
now credential stuffing takes breached
account data and you can think about all
the breaches that are out there you hear
about them all the time
and we take this user credentials so you
can see here we have
joe abc123 and this might show up in a
breach
so we'll take these credentials and
we'll try to pass them along to
web servers or anything that the company
owns
via a website or login page etc
so with that out of the way we can
utilize tools
such as a tool that i wrote actually
called breach parse
that utilizes these breach credential
lists
so for example here i'm using tesla.com
but that's just a pure example
just to show that you these accounts
come up in breaches
and what we're looking for are obviously
the usernames and passwords for these
but also any sort of patterns so are we
seeing first initial last name
are we seeing just first name last name
how are they showing up on the email
patterns
and do we see any password patterns or
repeat offenders
such as shark tesla.com you can see the
same password is used twice
just a little bit different so if i know
that maybe i'm going to try to
use this password in some format that
includes 907
814 and then some variation of dade here
in the middle
or anything else where people have been
breached on multiple occasions that can
give us
any sort of indication as to how we're
going to utilize that
so that's one part of this attack so
let's go back to the story now
so you just saw the tool that we used
called breach parse and all i did with
breach parts was
do some credential gathering i took the
credentials uncovered with breach parts
for this company
and all i did was pass them around and i
passed them around to a login form
which i found to be lotus notes which
lotus notes is very old
okay so i found lotus notes running
externally passed it around
and i did credential stuffing i took the
username
password threw it at the login form and
wouldn't you know it
i had a successful login now these
credentials did not log me into the
network this seemed to be some sort of
old credentials that were out there but
what lotus notes had on top of it was
authenticated password dumping so as
long as we had some sort of valid user
we could dump all the credentials
that were in the accounts there so
now with that password dump what i'm
able to do is i'm able to take the
credentials
and the users that we just discovered
and put them
into an even bigger list so i had the
breach price list but now i've got this
huge gigantic list
well i want to pass that new list around
too right so i'm going to go ahead and
say hey
can i log in somewhere one place of
interest is always
outlook so any sort of outlook they were
running their own outlook instance but
office 365 any sort of email
it's always good because usually it
syncs with active directory so if you
have a valid login on
outlook you're likely going to have a
valid login on a vpn
so we like to target things that would
sync with active directory
now nothing ended up working out of this
list but what did we get
from using breach parts and using
credential stuffing and dumping all
these user accounts
we got user accounts we got we can go
out to linkedin we can go out to the web
we can scrape
and gather as much information as
possible but we're not going to gather
everything
and by the time that it was all said and
done using breach partisan
using the lotus notes exploit i ended up
gathering about a thousand usernames
just for this company
so i got a thousand usernames and then i
think okay well if the passwords don't
work that are
from historical breach data well maybe i
can try something like a weak password
something that might be
reusable something like summer 2019
exclamation perhaps something about the
season the year
and a special character really gets
people going
and they love to do it so i performed
credential stuffing didn't work
found the user enumeration got some
password spraying in
and password spraying led to credentials
which led to
when on the vpn so we're able to log
into the vpn
now we're inside the network at this
point if i break in externally into a
network
i go ahead and do a hard stop i call the
manager whoever's in charge and i let
them know
so i called the manager and here's a
text message format of it but i say hey
i managed to breach your external
network and i gain access to your vpn
i'm in
he said okay well what level user are
you and i said well i'm a low-level user
right now meaning i didn't breach a
domain admin
and he said oh that's it i'm not too
worried then what can you really even do
with a low level account
that was my face exactly my face because
i he's taunting me and i wanted to show
him what i could do
so let's take this a step further shall
we so now we're in the network
and we can do something called lmnr
poisoning
so lmnr is a man in the middle type
attack or this poisoning is a
middle type attack and lmnr itself is
used to identify host when dns fails to
do so
it was previously known as mbtns and
really the key flaw
is that the lmnr uses a
username's user or user's username and
ntlm
v2 hash when it is appropriately
responded to and i'll give you an
example here in a second
so this is common this is out of the box
default
enabled on windows active directory so
we see this quite a bit unless a
company's been through a pen test before
they typically will have lmnr enabled
unless they know better or not to do so
but what it looks like from a high-level
perspective
is you have a victim and the victim is
sitting here
and they're saying hey i'm trying to
connect to a share maybe they type in a
share wrong or
they try to do something and they just
can't resolve so maybe they're trying to
connect to this hack me share
they ask the server hey do you know
where this hack m is because it's
mistyped
and they say i have no idea what you're
talking about and this is a broad
example it can be way more than just a
typed
or a typo or anything dns just a dns
any sort of dns where dns is failing
here we're going to use
lmnr so what happens is a broadcast
message
goes out on the network and it says hey
does anybody know how to connect to this
share drive that i mistyped and we're
sitting here as the hacker
man in the middle and we say you know
what i do
i'm going to go ahead and tell you how
to get to that location but first you
got to send me your hash and i'll get
you connected
and the victim's going to send over the
hash we're going to get connected
and that is what is called responding
it's waiting for some sort of response
we respond to it it sends over its hash
easy breezy so with that being said
we very easily use responder did man the
middle poisoning
and did some hash cracking now what
happened
well the same manager that i called up
and said hey i'm on your network
and said hey what can you do well we
grabbed his password hash coincidentally
had to be him
it doesn't make a better story if it
wasn't it's his password
guess what he is he's a domain admin
guess what his password was
his first name with the one after it
cannot make this up
you taunt the pen tester yet your
password is your first name with the one
after it
it cracked in a matter of minutes okay
and with that being said we logged into
the domain controller
and we won now there's a common theme
here
okay i'm going to click through these
really fast because we are going to be
short on time i'm talking as fast as
possible to get through all these slides
but
you can see that we have password as a
theme
when it comes to breach parse password
rotation and employee training is
important because the breach credentials
if you're reusing passwords
that's going to be bad password reuse
did occur and got us into lotus nodes
also patching because we were able to
dump the passwords from lotus notes
then you get over into oa and you say
password complexity because we were able
to log in
but more importantly we were able to
brute force unlimited amount of attempts
and there was no multi-factor
authentication that's the big story here
there's no multi-factor authentication
on outlook there's no multi-factor
authentication on the vpn which is even
worse
yeah you're in the email that's bad but
now you're in the network that's even
worse
and once we're in the network password
complexity again
your first name with the one after it
that's terrible
disabling the lm in our broadcast that's
important as well
but password password password passwords
all around here
and of course once you get into active
directory least privilege
so we're getting account credentials
when it comes from lnr
because we're finding them we're getting
these passwords and those
passwords are being used on the network
those accounts are being used on the
network
in theory you should only be using a
domain admin account to log into the
domain controller
and if you're using a domain admin
account elsewhere it generates network
traffic we capture that
we get a hash we crack it we log in
that's not least privilege so that is
story one
lesson learned here use multi-factor
authentication
okay use multi-factor authentication if
multi-factor was in place we never would
have been able to log into the network
we would have do some sort of social
engineering somehow get that
multi-factor
or that key from somebody but it wasn't
there so we were just able to log right
in
password complexity is important don't
use your first name with the one after
it avoid emails as usernames
user training super important as well
okay
and don't taunt your pen tester so don't
taunt your pen tester we're here to help
you don't tell us hey
what can you really do with it um just
let us let us go understand the
importance
and uh that's the big takeaways here
now the stories are gonna get more
interesting as we go so
i'm trying to save time for the the
bigger and better ones so let's really
get into the cool ones now
so story time let's talk a little bit
about ipv6
now ipv6 is one of the go-to things i'm
starting to utilize
in pen testing it's been my favorite
go-to almost for like the last two years
and what it is is we all use
ipv4 right we're very familiar with ipv4
so if we're using ipv4 in our network
that's very common
now when we have a domain or we have
something
in our environment and we want to use
dns
we're likely using dns over ipv4
okay but what we don't do and what we
don't really realize
is that ipv6 is also enabled in our
network
so we have ipv6 enabled by default
and who is really doing dns for ipv6
unless we go in here and disable ibv6
or we come in here and we have a dns
for ipv6 we can get malicious
so what we can do as an attacker is we
can say
hey we're going to sit man in the middle
and we're going to say
i'm the dns server give me your
credentials
and what i see a lot of times is
any sort of login event so say a regular
user
logs in that triggers an event if we're
doing dns over ipv6
we can take that login event and then
relay that
to the domain controller okay we can do
what's called ldap relaying
get into the domain controller this will
create a new user account or computer
account for us
this can dump a lot of information for
us this can do a lot of things which
you're going to see here in a second how
robust
this can really be by using a tool
called man in the middle 6
mitm 6 and i'll provide some resources
here in just a second on learning more
about this tool
but ipv6 by default i would say a good
majority of networks are not doing dns
for it so we can just hop
on run ipv6 or man in the middle 6
do ldap relaying and potentially take
over the domain controller in just a few
minutes
so let's go ahead and take a look at how
this works okay so i'm going to show you
a little bit of technical stuff
from my side now this is we're gonna
start with a lab environment that i
built out and then we're gonna go ahead
and talk and show some real world
examples
so we just run this tool man the middle
six and we just specify the domain
that's all we have to do
so in this one i'm running on
marvel.local
and here we run a tool called
ntlmrelay6.pi
and we just specify hey where is the
domain controller
and what are we going to do here we're
going to set up a fake wpad and we're
just going to say
hey i want to specify a loop me folder
which you're going to see here in a
second
and now we're just waiting we're waiting
for something to happen so say
for example that a non-admin user event
occurs let's say somebody logs into the
network that is a non-admin user
here we have a non-admin user of marvel
the punisher
you could see that they logged in and
succeeded here because they
authenticated
so they have valid credentials we're
sitting man in the middle we relay this
to the domain controller it succeeds
and what we can do is we can dump out
this loot directory
so i specify loot me as a loot directory
and we can get all sort of information
we haven't hacked anything per se yet
but we can get
domain computers domain users domain
policy domain trust
all sorts of things here's an example of
what that looks like
you can see here that i could see the
domain administrators
enterprise admins who the administrators
are i can see descriptions which
i see passwords and descriptions all the
time i would say 15
20 of of the time where i dump something
out like this there's a password stored
in the description so if you're a domain
admin and you're watching this
and you see or you're setting passwords
in your descriptions please stop doing
that because i will find it
or your pen tester will find it so here
we get information right we can see
passwords and descriptions we can see
when passwords last set
what the flags are when they last logged
in what their
sam name is all kinds of information
now let's say that a domain admin user
logs in
well when a domain admin user logs in we
can utilize that domain admin user
to actually create a new account on the
domain
it actually adds the user to enterprise
admins
and we log right into the domain
controller as this user
it's over okay this is over so dns
ipv6 this relaying it's very quick way
to take over a network
i've seen it happen in as little as five
minutes here's one for example here's a
hospital we were pen testing
uh got domain administrator in five
minutes i've tried to blur out
everything here you can see that we were
able to
relay a user this is up a little bit
here but we were able to authenticate as
a user
that user was a domain admin we were
able to create the user modify
a acl add the user to enterprise admin
and then here we had a username and
password all we have to do is log in
with this to the
domain controller or use something like
secret dumb and just dump out
the information this is it it's over
other stuff that you can do different
hospitals same results
we can authenticate and sometimes we
don't authenticate as the
domain admin but we can authenticate and
get some sort of delegation rights
so it doesn't give us full domain admin
rights but we actually create
a computer instead of a user so this
does it all automatically
we create that computer and we can
actually impersonate so you see a dash k
here we can actually use a ticket or
kerberos ticket to impersonate and log
in
here is an example of where i use this
ticket to log in as
a domain admin on a specific machine
i was able to also dump secrets here's a
sam dump of
a specific machine as well using a
kerberos ticket
so there's a lot of different things
that we can do just because ipv6 is
enabled
in a network again if you have no idea
what i'm talking about because of
pen testing is not your background
you're bug bounty you're just getting
started
that's okay this is very high level
that's why i just want you to take away
from this that ipv6 enabled in your
network can be
very bad here is mitigation strategies
or here are mitigation strategies where
we see that
turning off ipv6 could disable or
prevent this attack
but it could also have unwanted side
effects so this is for you domain admins
if you're curious about mitigation
here's this i'm not going to cover it it
goes way too technical in detail
so a couple things i want to point out
if you're interested in reading more
about this
if you google man in the middle 6 or mit
m6 and you google
dirk just dirk you don't have to do the
rest but dirk janum
is a great resource it covers a lot of
these attacks
how they work way more technical detail
i also have a video on my channel called
domain admin via ipv6 dns takeover
you can hear the walkthrough see the
walkthrough see how it's done
and you can even set this up on your own
if you want to try it out in your
network so i'll provide the tools and
resources in this video
if you're curious to learn more about it
okay on to the next story
so this client is also a large hospital
and they had deep pockets now they have
spent a ton
of money on security they had intrusion
detection prevention in place
they had av antivirus on all devices and
they had cyberark
so cyberark is a privileged access
management tool
if you've never heard of that basically
what it does is
it allows users to log in and check out
credentials so say you're a domain
administrator
and you want to log in you go check out
your credentials and those credentials
are only valid for
eight hours once those credentials
expire or you check them back in
those credentials rotate and they're
usually like 15 to 30 characters in
length
and really hard to crack really hard to
do anything with if cyborgs in the
environment it kind of stops us in our
tracks in a lot of places
however i've still managed to take them
down
all right so we use something called smb
relay
so if you remember earlier we utilized a
tool
called responder to do the llmr
poisoning that was the first
example now with lmnr you have the
option of taking that hash going offline
and cracking it
or you have the option to actually relay
that hash
so in order to relay a hash we can
utilize
smb but smb signing must be disabled on
the target this is smb must be disabled
sme signing must be disabled on the
target
and the relayed user credentials must be
added on the machine
for it to be of value they can be
non-admin but you don't get a lot out of
it
so what we're doing in this environment
is we're in an environment now where
smb signing is disabled if we get lmnr
which was all over the place in this
environment we are getting hashes but
remember
that cyber arc was in place if the
password is 15 to 30 characters long
we're not cracking it it's just not
happening so we needed to think outside
the box
and what came up with is hey smb relay
if we can't crack the password why not
pass the password
or relay the password and say hey we are
this user
go ahead don't verify that we are
because that's what smb signing is
smb signing says hey are you really who
you say you are
but because it's disabled uh by default
on host
not on servers just on host we can
utilize that to our advantage
so we can relay some credentials and you
see here that we did a
http relay we actually did this with
ntlm relay x
just like you saw in the other man in
the middle 6 example a lot of these
tools play well with each other
and we were able to dump out the sam so
we're able to dump out the hashes on the
machine
now look the administrator and tech
support and tech support 2
there's also user 2 user 3 user 2 user 3
have the same
hash value tech support tech support 2
and
administrator have the same hash value
okay they're reusing hashes here
if your administrator hash and your tech
support hash are all the same
guess what i'm taking these hatches and
i'm going to try to pass them around the
network
i'm going to try to crack them i'm going
to see what you're using here
so i take these i crack it by the way
it comes out to power 10 power 10.
that's it that's the password
and this password was utilized as well
on the anti-virus
so i was able to disable anti-virus on
all machines i logged into
because they utilized the same password
no bueno
not good now every time you see pwned
here is a machine in the network that is
being owned
because the password is being used or
that admin account
exists on this machine so we went from
relaying credentials and signing into
one machine
dumping password hashes and now here we
are
on this machine or we relay these across
the network
and we're just logging in to all over
the place all kinds of access
all kinds of owns okay and within a few
minutes
we come across an account on a machine
we dump the hash
we're able to log in to that using a
hash we don't even have to crack the
password the password by the way was
welcome one for a local
administrator that is used on a domain
controller
please don't do that okay so lesson
learned
smb signing should be enabled on your
network
lease privilege is important so your
users should not have
access administrative access on machines
if all the users
in that environment were utilizing
low level access they didn't have domain
admin or not domain just
regular admin local admin access on
their machine the relay would never
would have worked we never would have
been able to dump the the hashes out
account tiering as well because for
example
you should have again the domain admin
only login to the domain controllers
and bob if he's the domain admin should
have a bob account
and a bob bob-d-a account that he only
logs into his domain admin
uh with or domain controller with so
account tiering is important
and oh yeah don't reuse passwords super
bad
why do we do this i see it all the time
all right
and this is my favorite story from the
past year
which is called digging deep now we're
again at a large hospital come on you
already knew we're three for three on
hospitals here
this hospital had no llmnr
ipv6 was disabled everything was patched
looked really good from an environment
so
what options do we have in that case if
the man in the middle attacks aren't
working everything's patched we don't
really have an exploit
we have to think outside the box so we
have to dig deep
all right so what i did was i started
looking around the network
i started looking for different websites
in the environment so you can use
different tools
to do that but basically you're just
hunting port 80 port 443
seeing if there's any responses and
going to them
what happened was i was going website to
website to website and this was a large
large hospital environment they had a
lot of websites most websites did not
have default credentials
all it took was one okay all it took was
one
and we logged in and plain text
sitting here in plain text it says local
administrative password
you can see the 70 i blurred the rest
now this had nothing
to do with the environment itself this
had nothing to do with the network
this was just a local admin password
stored for something to do with this
application itself
now why it was stored in clear text i
have no idea that's on the application
that benefited us on top of that the
application had default credentials it
was just something they were testing
out it was nothing that they were even
utilizing in their environment they were
just testing it out
they used this password okay we start
there
certainly they wouldn't reuse that
password we haven't seen that in the
past right
well i don't know anything about the
environment yet at this point so i just
say hey crack map exec
which is what we used previously and
just i want to see if the user
administrator had with this password
could log in anywhere so i'm just
sweeping across the domain seeing if
there's anywhere where this user
has administrative access and wouldn't
you know it there's
one machine one machine in the entire
network where this works
okay log into that machine yeah yeah
this is how i felt by the way
log into this machine and you can see
that we have
the administrator user when we dump the
sam hashes we have the
administrative user but we also have
this other admin user
and wouldn't you know it it's the same
password hash look at that
which means what it's the same password
so now we have a little bit more
information at our disposal
there's this admin account what if we
pass it again oh we passed it again and
we
saw everything light up okay so again
just like the example you saw
guess what this is one of those other
tech support type accounts
where they were utilizing all across the
network locally
so we have this local account and we're
just passing it along
we're getting access to machines you can
see here's the authority system where we
logged in on the network
and eventually we just keep going around
dumping credentials so this
environment itself was using windows 7
windows 7
is known for having something called w
digest now w digest
provides your credentials in plain text
they are stored in plain text you can
see here's fall
2016 with three exclamations i told you
people love this password
and there's this whole other one here
which i wouldn't have guessed i don't
think we would have actually cracked
this one
but you can see it says is setup which
was actually a
service account running in the network
running as domain administrator
now you take this domain admin
credential you take it to the domain
controller you log in
and guess what you're on the domain
controller and you've owned the domain
so we took it from completely
no access seemed well patched had
no lmnr no man in the middle
capabilities and just
one configuration one default
creds that were out there if there were
no default credits on that page
we would have never owned this this
network okay
uh without the default creds wouldn't
got there default credits were stored in
plain text if they weren't stored in
plain text wouldn't have got there
if they didn't reuse that password on
the network
we wouldn't have got there if they
didn't reuse that password with a
different account we wouldn't have got
there either
and if they weren't using windows 7 we
wouldn't have got there
there's a lot of chain events here that
happen in pen testing
and it just is sometimes where you have
to dig deep and you find these weird
paths and you get there
and this is just another example of you
you have these
things on the surface where just one
little mistake or one
one tiny mistake across the board can
lead to something
bigger you take one default credential
login on an account that you weren't
even worried about
because it was just an example it was
just something you were demoing
and that went all the way up to domain
admin access in a network
it happens this is real life it happens
now i know i went through this fast and
i did that because i wanted to share a
bunch of these stories
so if you have any questions on this
feel free to at me on twitter at the
cyber mentor
you can ask questions i'll be happy to
respond i'll be available the next hour
or so
in chat as well if you want to ask more
questions about anything that you saw
and of course i'm very responsive so
please feel free to reach out to me at
any time
doesn't matter if it has to be today but
just feel free to reach out and i'll be
happy to answer questions
on this specifically hopefully this is
valuable for you
this is the end of the presentation i
really do hope you found value
again just big key takeaways
use multi-factor authentication use
strong passwords
a lot of this where we saw throughout
the whole thing had to do with passwords
right we got in
externally because of weak passwords or
reused passwords
we've owned machines internally because
of reuse passwords or because
you want to be a jerk and also use your
name
as a as a password and we saw local
admin accounts just take down networks
enterprise networks with millions of
dollars and spent in security in one of
the examples
with the cyber arc and everything else
local admin
local admin is so important everybody
forgets about it you can spend so much
money protecting your domain credentials
that you forget about the local
administrator local administrator
will kill a network as you see here will
kill a network
there are times where i don't ever
access a domain account until the very
end
and it's because of that local
administrator and in fact we never
access the domain account in the third
example
so keep that in mind local accounts can
take you down as well
so if i want to take away these big
takeaways
passwords are important utilize
multi-factor authentication
remember your local accounts exist and
do not reuse passwords on local accounts
if you're using privilege access
management store those as well
and don't taunt your pen tester
that's it for this talk i really hope
you enjoyed it again i'll be around for
the next hour or so
thank you so much
you