+ All Categories
Home > Documents > Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba...

Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba...

Date post: 02-Jun-2020
Category:
Upload: others
View: 3 times
Download: 0 times
Share this document with a friend
88
Michael Grafnetter www.dsinternals.com Pass-the-Hash Attacks
Transcript
Page 1: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Michael Grafnetter

www.dsinternals.com

Pass-the-Hash Attacks

Page 2: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Agenda

PtH Attack Anatomy

Mitigation

– Proactive

– Reactive

Windows 10 + Windows Server 2016

Page 3: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

PtH History and Future

1988 – Microsoft releases Lan Manager

1997 – Pass-the-Hash demonstrated using a modified Samba

2007 – Benjamin Delpy releases Mimikatz

2008 – Pass-the-Ticket attack demonstrated

2012 – Microsoft releases Pass-the-Hash guidance

2013 – Windows contains built-in defenses against PtH

2015 – Michael Grafnetter releases the DSInternals tools ;-)

2016 – More defense mechanisms coming to Windows

Page 4: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

PtH Attack Anatomy

Theft Use Compromise

Page 5: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Lateral and Vertical Movement

Page 6: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Metasploit Framework

Page 7: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Metasploit Framework

Page 8: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Mimikatz

Page 9: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

DEMO

Pass-the-Hash + RDP

Page 10: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

LSASS NTLM Hashes

Page 11: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Passing the Hash

Page 12: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

PtH Attack Premises

Single

Sign-On

Symmetric

Cryptography

Pass-the-Hash

Attack Surface

Page 13: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Stealing the Hash

Page 14: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Credentials Lifecycle / Attack Vectors

Page 15: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Credentials Lifecycle / Attack Vectors

Page 16: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Hashes in SAM/AD

Authentication Method Hash Function Salted

LM DES NO

NTLM, NTLMv2 MD4 NO

Kerberos (RC4) MD4 NO

Kerberos (AES) PBKDF2 (4096*HMAC_SHA1) YES

Digest MD5 YES

Page 17: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Active Directory Database - Offline Files

– C:\Windows\NTDS\ntds.dit

– C:\Windows\System32\config\SYSTEM

Acquire

– Locally: ntdsutil IFM

– Remotely: WMI (Win32_Process), psexec

– Offline: VHDs, VMDKs, Backups

Extract

– Windows: DSInternals PowerShell Module

– Linux: NTDSXtract

Page 18: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

DEMO

Extracting hashes from ntds.dit

Page 19: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

GUI Tools

Page 20: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

KRBTGT Account

Page 21: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Proactive Measures

Encryption

RODC

Backup protection

Regular password changes

Page 22: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Active Directory Database - Online

MS-DRSR/RPC

Page 23: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Go to www.dsinternals.com for demo ;-)

Page 24: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Proactive Measures

Avoid using administrative accounts

Do not run untrusted SW

Do not delegate the right to replicate directory changes

Use an application firewall / IDS ???

Page 25: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

SAM Database

Offline

– Files

• C:\Windows\System32\config\SAM

• C:\Windows\System32\config\SYSTEM

– Tools

• Windows Password Recovery

Online

– Mimikatz

Page 26: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Online SAM Dump

Page 27: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Proactive Measures

Bitlocker

Randomize local Administrator passwords

Restrict administrative access

LSA Protected Process

Page 28: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

GP Local Admin Pwd Management Solution

Page 29: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Restrict Local Admins - KB2871997

Page 30: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Credentials Lifecycle / Attack Vectors

Page 31: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Windows Integrated Authentication

Page 32: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

LSASS NTLM Hashes

Page 33: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

LSASS Kerberos Keys

Page 34: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

LSASS Kerberos Tickets

Page 35: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Memory Dump

Page 36: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Memory Dump

Page 37: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

SSP Cached Creds (SSO)

Page 38: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Proactive Measures

Enable Additional LSA Protection?

Restrict administrative access

Applocker/SRP whitelisting

Protected Users group

Restricted Admin RDP

Authentication Policies and Silos

Disable Automatic Restart Sign-On

Do not submit minidumps

Page 39: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Enabling LSA Protected Process

Page 40: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Disabling LSA Protected Process

Page 41: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Protected LSA

Page 42: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Protected LSA

Page 43: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Bypassing the LSA protection

Page 44: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Bypassing the LSA protection

Page 45: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Debug Privilege

Page 46: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

RestrictedAdmin RDP - KB2871997

Page 47: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Credential Delegation – Security vs. Comfort

Page 48: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Disable Wdigest SSO – KB2871997

Page 49: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Protected Users Group

Page 50: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Automatic Restart Sign-On

Page 51: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Blacklisting?

Page 52: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Credentials Lifecycle / Attack Vectors

Page 53: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

ARP Poisoning + NTLM Downgrade

Page 54: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Using the Hash/Key/Ticket

Page 55: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Passing the Hash

Page 56: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

PTH Firefox

Page 57: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

RDP NTLM Authentication

Page 58: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Kerberos Golden and Silver Tickets

Page 59: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Proactive Measures Disable NTLM Authentication

Disable Kerberos RC4-HMAC

Shorten Kerberos ticket lifetime

Implement Smartcard Authentication

Page 60: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Strengthening Kerberos Security

Page 61: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Kerberos Ticket Lifetime

Page 62: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

SmartCard Authentication

Page 63: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

PtH Mitigation Strategies

Page 64: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Planning for compromise

Identify all high-value assets

Protect against known and unknown threats

Detect PtH and related attacks

Respond to suspicious activity

Recover from a breach

Page 65: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

NIST Framework for Improving

Critical Infrastructure Cybersecurity

Page 66: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

NIST Framework for Improving

Critical Infrastructure Cybersecurity

Page 67: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

High-Value Accounts

Admins

– Domain Adminis

– Enterprise Admin

– Schema Adminis

– BUILTIN\Administrators

– BUILTIN\Hyper-V Adminstrators

Service Accounts

– SCCM, SCOM, DPM, Software Installation,…

BMC Accounts

Page 68: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Tier Model

Page 69: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Tier Model - Administrative logon restrictions

Page 70: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Authentication Policies and Silos

Page 71: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

PtH Detection

Page 72: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Attack Graph

Page 73: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Events

Authentication

– Success

– Failure

Replication Traffic

Group Membership Changes

Page 74: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Audit Process Creation

Page 75: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Audit Process Creation

Page 76: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Audit Process Creation

Page 77: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Reactive Measures

Change account passwords (including services!)

Reset computer account passwords

Disable+Enable smartcard-enforced accounts

Reset KRBTGT account

Implement countermeasures

Page 78: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Windows 10 + Windows Server 2016

Page 79: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Hypervisor Code Integrity protected by VSM

Page 80: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Device Guard

Page 81: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Privileged Access Management for AD

Page 82: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Microsoft Passport (FIDO) + Windows Hello

Page 83: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Endanced AD FS / DRA GUI

Page 84: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Next Steps

Page 85: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Learn more about PtH Attacks

Page 86: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Have fun with the tools

Page 87: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Secure your network

Page 88: Pass-the-Hash Attacks - DSInternals · 1997 –Pass-the-Hash demonstrated using a modified Samba ... Identify all high-value assets Protect against known and unknown threats Detect

Michael Grafnetter

www.dsinternals.com

Pass-the-Hash Attacks


Recommended