[MUSIC PLAYING]
Welcome to the Hacker House hands-on hacking Windows
module theory.
We're now going to introduce all the theoretical concepts
necessary to complete the practical elements
of the 11th module in our course.
This module, now, we're going to switch our perspective back
from the external internet facing attacker back
to a perhaps internal facing attacker,
as we are going to look at Windows Enterprise, Windows
Enterprise architecture, and how that
relates back to an attacker who is already perhaps
in the environment and is able to see
some of these internal systems.
The reason we do this at the end is
because the previous modules chain some of the knowledge
together to be able to conduct that breach,
and that this module requires a little bit
of a new way of thinking and a slight adjustment
of your mindset when approaching Windows Enterprise
because there are some nuances and specifics when targeting
these kinds of systems that you'll
need to take into account.
[MUSIC PLAYING]
Hopefully, we are all familiar with Microsoft Windows.
Microsoft Windows exists in various several versions.
It's a multi-user desktop window environment,
although originally, it wasn't very good at doing multi-user
at all.
Headless versions for data centers and server farms,
so you can run this without a monitor as a server
without a graphical interface.
And it exists in various different flavors
and revisions, from NT4, 2000, XP, up to 2016, and 2012, 8.1,
et cetera.
So all these different versions of Windows.
You know, if you were to NT4 or you came across 2000 or XP
in the wild today, I would feel very sorry for those system
administrators.
And in fact, what you should do is inform them
that they need to take it outside like a lame horse
and put it down, because it is well past its shelf life
at this point in time.
But you do still sometimes see it in industrial systems
and places where they're unable to remove it
because the equipment was too expensive.
So if you do come across it, it does
need to go because there are so many ways
to breach it that it's never going to get fixed.
So you might as well get rid of that.
[MUSIC PLAYING]
Microsoft networking, you have--
the concept in Microsoft is slightly
different to how a lot of other hacking
takes place because this is concepts of lateral movement.
A lot of Windows hacking, a lot of moving around a Windows
environment involves lateral movement.
It involves stealing information from one computer system
and pivoting from that computer to access information
on another computer.
So by exploiting trust relationships
and architectural design, we can go
from one computer to the next computer to the next computer,
picking up different bits of administrative privileges
and tokens on the way until we get
to a sufficient level of rights, usually
something that's strong and high privileged enough.
So the Microsoft network architecture
follows a forest and domain model.
The forest and domain model we'll review now,
and there's a lot of security mistakes that can be made.
There's excessive user permissions,
users being added inadvertently, things like that.
But it's different enough from Windows
that it will frustrate you at first.
[MUSIC PLAYING]
So forest and domains.
If we look at the charts here, it's
an example of a forest and a domain.
The domain controllers are responsible for managing
the resources, the computers joined to the domain,
and all of the various responsibilities and tasks
that might be needed.
So let's say they're application servers or whatever.
So if you imagine domain A, let's say
that that's my company, and I'll call my company Acme Inc.
So I've got my Acme Inc. company here at domain A.
And we've expanded now and we acquired
perhaps some other companies.
We acquired Skillshot and something else,
and these became domains.
And perhaps we joined those domains
so that people who worked at Skillshot
could come up to the head office and they could
log into that head office.
So there was a trust relationship
between this domain and that domain,
meaning some users in this domain can log in here,
and vise versa.
And usually, at the top of the pyramid,
the top of the hierarchy is where the ultimate trust
lies, the person at the top, so the top of the forest here.
And like you have these forests that
encompass these different domains,
you also have these extra forests here like forest B,
and you could have two forests that trust each other.
So let's say Acme Inc. eventually
gets acquired by another mothership company and the two
of them share information or share trust, or perhaps
they work with the same suppliers
or they are using the same suppliers or similar,
and there's some trust relations between the two companies.
So the forest A could trust the forest B as well.
So you could have these kind of trust relations, forest trusts
and domain trusts, so interesting concept to explore.
[MUSIC PLAYING]
Users and groups and permissions.
So users have rights that are defined by groups,
and these local groups are different to domain groups.
So the goal is often to find local administrator
or local admin on a workstation.
If I get access to a workstation and I'm a low privileged user,
I want to be administrator on that workstation.
I want to be able to control everything
on that system to disable software or do whatever
I want to it.
And likewise, domain admin or enterprise admin
is a trusted administrator for the network.
So domains refer to logging into resources and tools
on a domain.
So I would be looking for enterprise admin.
Enterprise admin would give me that higher level
of trust between different trust relations in domains
and forests.
Access tokens can also identify processes and users,
so these can be stolen too.
So there are tokens inside of Windows, access tokens,
and these tokens, you can steal those
and, subsequently, you can use those
to access those permissions that those tokens relate to.
There's also file permissions like we saw file
permissions problems with Unix.
And again, similar to Unix, but different enough to be
annoying.
So we would do CACLS, check access control lists,
to be able to review some of the file permissions
depending on the filing system in use.
So again, filing systems can introduce different permissions
and behaviors.
So we'll look at some of those problems.
[MUSIC PLAYING]
Windows administration, so lots of useful tools.
There's lots of ways of running commands on Windows hosts,
a lot of it out of the box.
So you know, WMIC, Task Scheduler, PsExec,
being able to run remote scheduled services.
PsExec is a tool you can use to run commands
on another computer.
WMIC is a tool you can use to, again,
do a similar kind of thing in query patches.
Remote desktop and terminal services
are a very widely used way of administrating
these kinds of systems.
And remember, a lot of hacking is just
being an unauthorized system administrator,
so you're going to do a lot of the same things
that a system administrator does.
In fact, unlike the system administrator,
some hackers aren't being paid to be in the network,
yet they're doing the same tasks.
So yeah, there's probably an arbitrage opportunity there.
Maybe you could recruit these hackers to do some system
administration for you.
Who knows?
All jokes aside, terminal services
is the way in which you would mainly
tend to manage these systems in a Windows environment.
[MUSIC PLAYING]
During your career, you're going to come
across personal security products or PSPs.
These are antivirus products.
They are solutions that are installed
to identify malicious threats, binaries, executables,
and exploits that are designed for stopping or preventing
hackers and malware.
There was a big problem with malware.
When Windows systems started to get breached,
people bought malware with it.
And due to its market dominance, there
was a lot of financial motivation for that.
And subsequently, antivirus products sprung up
and became more advanced.
But in your career, you are, at some point,
going to need to bypass antivirus.
So at some point in your hacking career,
you're going to need to get around antivirus.
And you'll find that a lot of people
do research in this space and keep it to themselves
or have some variance on it.
And I like to use the CIA's research.
Because if you go onto Wikileaks,
you can download Vault7 documents which
contain very detailed analysis of all the various
personal security products that you might find out there,
and different steps and procedures
that they took to bypass them for their own tools.
So perhaps you can just take some of those documents
and use them yourself as well.
Alternatively, I like a tool called SHELLTER.
SHELLTER is an excellent project that
allows me to wrap meterpreter.
And we'll explore meterpreter in a little bit,
look at how to use SHELLTER to antivirus as well.
So I tend to use SHELLTER to get around my antivirus products
because it's quite effective at doing its job.
And again, this is an open source tool
that you can use to bypass antivirus, so SHELLTER.
[MUSIC PLAYING]
Equally, you'll need to come across something
called UAC, user account controls.
So as I mentioned earlier, Windows
wasn't very good at being a multi-user environment,
and in fact, certain changes were
introduced to try to make it a better multi-user experience.
So a prompt was created because so much malware started
happening around XP and 2003 and 2000
because a published group of researchers
called The Last Stage of Delirium,
who were four individuals working at a supercomputer
sensor in Poland.
They discovered they could exploit RPC vulnerabilities
in Windows, and they made an announcement
to the hacking community that hacking Windows was just
like hacking Unix.
And lots of people then started.
A lot of these Unix hackers and attacks
then started migrating towards the enterprise,
and hackers were no longer hacking
into scientific and research establishment establishments.
They'd now got into enterprise environments,
and they were moving throughout organizations
and it was causing a lot of damage.
So they introduced user account control to try and stop
everything running as admin rights,
and this basically meant that you
had to confirm on the screen.
When something run as admin, you would confirm it
and say, yes, I want that to run as admin.
And unfortunately, that adds a little hurdle to us,
but it's a very simple hurdle to get around.
So you often need to bypass user account control
if you need admin rights or similar, so that's
something to be aware of.
[MUSIC PLAYING]
Passing the hash.
This isn't something that you would
do on a barbecue on a Saturday night.
This is, instead, allowing authentication via hashes.
It allows you to authenticate to a Windows system,
instead of using a password, you can use the hash representation
of the password.
So you can take an NTLM hash of a domain account
and use it to execute commands on other hosts joined
in that domain.
So it's just by knowing the hash.
You don't actually need to know the password,
so having admin rights to one system
will usually get you some hashes that you can then
use on other systems as well.
So using these hashes, you can hop from machine to machine
without knowing the password and gain
access to the resources on it.
There's a tool called Responder which does a net NTLM.
It will actually do poisoning.
It does a LLMNR and NBT-NS poisoning to cause computers
to root through the responder just
like a man in the middle attack, and then
it gets net NTLM, which is slightly different to NTLM
hashes, but it can replace some of those
and try to run commands as well.
So Responder's a useful tool.
It only tends to work with Server Message Block version 1,
but you can try Responder on some networks as well.
But the goal is to remember here that you can pass the hash.
And as I say, not something you do on a barbecue on a Saturday.
Instead, it is passing the authentication hash
to a Windows system.
[MUSIC PLAYING]
Golden tickets.
Golden tickets are a way that was pioneered
by Chinese computer hackers.
The Chinese computer hackers were really sneaky.
Around sort of 2014, there was various vulnerabilities--
2013, 2014-- and a group of Chinese espionage
actors, an APT group, were found breaching different systems.
And after the forensics teams had come in
and changed all the passwords, removed all the malware,
kicked the attackers out the network,
they were convinced they were gone,
they'd cleaned everything up, the attackers just
logged right back in.
And it baffled them as to how they were doing this.
And it turned out that they had found
a new way of backdooring Windows domains by generating something
call a golden ticket.
So what they would do is they would
use Kerberos ticket, this Kerberos service,
to generate a ticket that has an expiration of never expiring.
It's a feature of Windows to generate a ticket that says,
I'll never expire.
And providing you have this Kerberos ticket user
account, krbtgt, you could effectively
request a ticket that would never expire.
And if somebody changed the password of that account,
you could re-access that account using that ticket
without knowing the password.
And that would allow you to do that
for the lifetime of the ticket.
So they set these golden tickets so
that even if all the passwords were changed,
even if all the access was changed,
whenever they got re-access to the network,
they could just re-obtain those admin privileges,
and they were using it as a backdoor.
So this was unearthed, and it was known as golden tickets,
and since then, there's been various variants
of that attack, such as silver tickets or MS14-068
for privilege escalation and various all those
that we could maybe use.
So golden tickets is a concept to be aware of.
[MUSIC PLAYING]
So other the tools.
The National Security Agency have their own framework
called FUZZBUNCH, which is a Python and DLL based framework
that allowed them to launch exploits.
It's kind of like the NSA's version of Metasploit
for interacting with compromised systems and systems
you're going to target.
And they also had a tool called DanderSpritz.
DanderSpritz is a remote access tool designed for espionage.
And it's got some very powerful features in there,
sort of anti-forensics, log cleaning,
things that just go way beyond the extent and scope of what
you would need to do as an authorized system penetration
tester or hacker.
But it's still an interesting tool to study.
It's interesting to see how these espionage attacks take
place in the wild.
So DanderSpritz and FUZZBUNCH, two tools
from the National Security Agency
that you could download and look at in a VM.
They have loads of powerful features
and some very powerful exploits, some of them
you should be aware of, things like ETERNALBLUE,
ETERNALROMANCE, ETERNALCHAMPION, and ETERNALSYNERGY
which were attacks that we used to power the WannaCry
ransomware and were used to cause global cyber incidents.
And we'll talk about more of that,
but lots of powerful features, lots of exploits,
had had an interesting payload, so there's
been a lot of analysis out there on how these tools worked,
and it really was an interesting treasure
trove of data from the National Security Agency.
Here's an example of that tool being run.
We can see DanderSpritz running here in the background.
This is the implant tool that would be used.
And then you have this FUZZBUNCH which
would be used to deliver these implants
and to move around the network and to install the attacks,
install and drop these implants onto the network.
And indeed, there are numerous scripts.
In fact, this was so well designed
that, if an operator screwed up, the tool actually
would prevent them screwing up.
So it was designed to take advantage
of these vulnerabilities for moving through systems
and gathering information for various reasons, for whatever
the criminals at the NSA were doing it with.
[MUSIC PLAYING]
Here, we've got the Windows exploits.
You've got Windows exploits that are in things like Metasploit.
So again, going back to MS03-026, RPC-DCOM.
So yeah, you've got this RPC-DCOM
attach which was found in 2003.
This is that same vulnerability I mentioned
from The Last Stage of Delirium, these Polish researchers, that
says remote procedure called DCOM.
And then you've got MS05-039, 9, which is Microsoft Plug&Play,
06-040.
All of these vulnerabilities do exactly the same sort of thing,
more or less.
They'll give you a remote system shell
on those impacted systems that are
missing one of these patches.
And whilst the exploits are significantly more complicated
than they just give you system, they certainly
have, every couple of years, reared their heads.
From time to time, a new kind of vulnerability
is found in a Windows system, and these things kind of
tend to surface.
And there's been a push through the RPC services
and various service services, and then, indeed, there
was this Server Message Block version 1 multiple kernel pool
vulnerability.
So multiple vulnerabilities here, MS17-010.
This was the patch that powered WannaCry.
And for each of these missing patches,
you'll find there's probably a corresponding network
worm or a corresponding cyber incident.
So for instance, Mydoom, then there
was things like FatBot and various others.
And I forget the names of some of these other tools,
but Conficker being a very well-known piece of malware
that you still see in installations, that
hasn't quite yet gone away.
So these are some of the exploits that power these kinds
of attacks.
[MUSIC PLAYING]
Again, privilege escalation attacks.
You could exploit one of the numerous Windows
local privilege escalation, which could include MS11-046,
you know, the exploits leaked from the hacking team,
logon services.
And there are tools, things like Sharelock and others,
which can actually suggest to you exploits to use.
And you would exploit system misconfigurations.
You could use a tool like PowerUp,
which is an auto-pwning tool.
And indeed, privilege escalation,
you could just simply steal passwords from one system
and use them on another.
So they're missing patches, missing misconfigurations,
missing file permissions, very similar to the Windows stuff,
but different enough that we have
to introduce it differently.
[MUSIC PLAYING]
So Windows tool box.
What goes in my Windows tool box?
Well, standard tools like Metasploit, NBTscan
for scanning these NetBIOS services and Windows server
services.
Pass the hash tool kit, PsExec, mimikatz various tools
for interacting with the Windows server,
password dumping utilities, mimikatz, PWDumpX, FGdump,
enum5linux, perhaps, Empire, Cain, utilities for recovering
passwords, and then various Powershell utilities,
Powershell gaining a lot of prominence
now, being used by a lot of, you know, pen testers
these days to try and target Windows based environments.
So that concludes the Windows theoretical for this module.
We're now going to download a virtual box appliance which
you need to install in a similar way to the Unix module.
So please ensure that you import this appliance, set
the re-initialized Mac address, and we'll
go through the practical in just a moment.
But be sure to keep your resource guide and others
on hand.
So thank you very much for listening,
and I'll look forward to seeing you
later on in the next practical demonstration.