- [Narrator] All versions of Windows
store passwords as hashes.
And basically they do that in a file called
the Security Accounts Manager or the SAM file.
The operating system does not know
what actual passwords because basically
it stores only a hash of the password.
So instead of using a well known hashing algorithm,
Microsoft created their own implementation
that actually have developed over years.
Now in the legacy implementations,
Microsoft had a suite of security protocols
called the NTLM or the NT LAN manager.
and basically they had two versions NTLM v1 and NTLM v2.
Since Windows 2000, basically Microsoft shifted
to Kerberos and basically for Windows
domains authentication.
Now, however, NTLM may still be used whenever
the client is actually authenticated to a server
via an IP address or if actually
the client is authenticating to a server
in a different Active Directory forest,
configure for NTLs instead of actually doing a transitive,
inter forest at trust using Kerberos.
In addition, NTLM may also be used
if the client is actually authenticated
to a server that doesn't belong to a domain
or if the Kerberos communication
is actually blocked by a firewall.
Now, you may ask, so what is the Pass-the-hash attack?
So basically, because password hashes cannot be reversed,
instead of actually trying to figure out
what is actually the user's password,
then the attacker can just use the hash
that you can actually collect from a compromised system
and then use the same hash
to login to another client or another system.
So in short, basically the Windows operating system
and Windows applications ask users
to enter there passwords whenever they log in
then the system converts the password into hashes
and in most cases, use an action API call,
the Lsa Logon User.
And then a Pass-the-hash attack, you know,
goes around this process and just sends
the hash to the system to authenticate.
Now in the past, many of these attackers
have used a tool called mimikatz
and even malware actually has used a tool
for quite some time
and basically, what the tool is useful for
is to retrieve password hashes from memory
and that is actually very useful
in a post exploitation activity.
I'm actually even including the link
where you can actually download the mimikatz tool
from the GitHub repository that I'm actually showing here.
Now, a metasploit also uses mimikatz
as a meterpreter script to facilitate exploitation,
without the need for you to upload any files
to the compromised host as well.
So you can actually also obtain
more information about mimikatz
and the metasploit integration
from the link that I'm showing in the screen.
Now, as I mentioned to you before,
modern Windows systems use Kerberos
and LDAP for authentication.
And to define Kerberos,
Kerberos is an authentication protocol
that is defined in RFC 4120.
And that actually has been used by Windows for many years
and it's also actually used in many different applications
and other operating systems as well.
Now talking about implementation,
the Kerberos implementation contains three basic elements,
the client, the server
and the Key Distribution Center or KDC.
And that actually includes the authentication server,
and another server called the Ticket Granting Server.
And here I'm showing the steps
in the Kerberos authentication.
The first step is actually that the client sends
a request to the authentication server within the KDC
then the authentication server sends
a session key and a Ticket Granting Ticket,
or TGT that is actually used to verify the clients identity.
Then the third step is that the client actually sends
the TGT to the Ticket Granting Server
then the Ticket Granting Server generates
and sends a ticket to the client.
Then the client presents the ticket to the server,
and the server grants access to the client.
Now Active Directory uses LDAP as the Access Protocol
and by the way, LDAP stands
for Lightweight Directory Access Protocol.
The Windows LDAP implementation supports Kerberos
authentication and also LDAP uses
an inverted tree hierarchical structure
called the Directory Information Tree or DIT.
Now one of the most common attacks
is the Kerberos Golden Ticket attack.
An attacker can manipulate Kerberos tickets
based on available hashes by actually compromising
a vulnerable system and obtaining
the local user credentials some password hashes.
Now, if the system is actually connected to a domain,
the attacker can identify a Kerberos TGT
or KRB-TGT a password hash
to get the golden ticket.
Now, there's a very popular tool
that can be used to perform the golden ticket attack
and many other types of attacks
and it's actually used in post exploitation activities
and that tool or framework is called Empire.
Empire is basically a post exploitation framework
that includes a pure PowerShell,
Windows agent and a Python agent.
And basically it's a whole bunch of
different PowerShell scripts
that you can launch against a system
to perform many of the false exploitation activities.
Of course, golden ticket is one of them
but there are many other activities
and many other things that you can actually
do within a compromised system
to maintain persistence, to compromise other systems
to move laterally and to potentially
provide a way to do ex-iltration of data.
Now, we mentioned the golden ticket attack.
However, there's a similar attack
that you probably gonna guess
is called the Silver Ticket Attack
and silver tickets are actually forge service tickets
for a given service on a particular server.
The windows Common Internet File System or CIFS
basically allows you to access files
on a particular server and the host service
allows you to execute scheduled tasks
or the SCH task.exc
Also can allow you to execute
the Windows Management Instrumentation
or WMI on basically any given server.
Now in order to create a silver ticket,
you need the system account,
which is actually the one that is ending on $ sign.
Now the Security Identifier for the domain is also needed.
So the SID or the Security Identifier for that domain.
You also need the fully qualified domain name
and the given access service for example,
you know, CIFS, HOST and so on.
Now let's shift gears and let's actually
go over what are Man-in-the-middle attacks.
Basically in a Man-in-the-middle attack,
an attacker places himself or herself
in line between two devices or two individuals
that are communicating with each other
and basically does that to each step or manipulate
the data that is being transferred.
Now a Man-in-the-middle attack
can happen at layer 2 or at layer 3.
Now attackers can actually perform
Man-in-the-middle attacks by using techniques
like ARP spoofing and ARP cache poisoning.
And basically that's the same thing, right?
So ARP cache poisoning, also known as ARP spoofing
is an example of an attack
that actually can lead in Man-in-the-middle scenario.
Now an ARP spoofing attack can target host,
can target switches, can target routers
that are connected to a layer 2 network
by actually poisoning the ARP caches of the systems
that are connected to the subnet
and then intercepting traffic
that is actually intended for other hosts on that subnet.
Now in this example, the attacker
is actually spoofing a layer 2 MAC address
to make the victim believe that the layer 2 address
of the attacker is the layer 2 address
of its default gateways.
Now the packets that are actually supposed to go
to the default gateway are actually forwarded
by the switch to the layer 2 address
or the MAC address of the attacker on the same network.
And then of course, intercept packets, or, you know,
look at packets that are in the clear.
You can also potentially modify,
you know, some of the transactions as well.
Now, what common mitigation for ARP cache poisoning attacks
that have been going on for many years,
it's actually to use the dynamic ARP inspection.
And that's actually a feature
that can be enabled in many different switches
to prevent spoofing of the layer two addresses.