[Music]
how do youall I'm Sam Moses and
hopefully you are here for the easy ways
to make my job harder um I'm a pentester
so this is a pentesters perspective on
internal network
security as I said I'm Sam Moses um I
work at rapid 7 I'm a cyber security
consultant there focused on penetration
testing um been doing that for about 4
years also did pen testing in my
previous positions where I worked at BYU
and also as a student um I presented
both nationally and internationally on
different variety of cyber security
topics um and yeah as I said before
rapid 7 I worked at BYU and noticed some
BYU people in the audience oh hey even
more BYU people in the audience than I
noticed before um and yeah so I'm a nerd
all the way through sci-fi fantasy
got my dog play D and D currently I am a
dragon born monk which is pretty
sweet um so yeah that's basically
me um so for this talk I'm going to be
talking about um go through and kind of
talk about what the first Common path
that I use to exploit internal networks
and then I'm going to individually break
it out into pieces and talk about the
recommendations or remediation
recommendations for that and then I'm
going to do the same thing with another
common attack vector and then talk about
some variations with security and depth
and how that would
work so diving in first Common attack
Vector Man in-the-middle attack where I
llm Nar is enabled on the network so LMR
or link local multicast name resolution
I always have to read it and make sure
it's in my notes because I never
actually remember it I always just call
llm Nar um it's a leg Legacy um
auxiliary name res resolution service
for Windows and um it's used to resolve
host names um before DNS and so that's
part of the reason why it's Legacy um
systems configure to use it it actually
broadcasts out name resolution
requests um and so using that we can
sniff and then poison those requests and
actually catch credentials um then I
take those credentials and I use that in
an SB relay attack SNB is servers server
message block um it's widely used for
sharing files S&B shares printers
various Port Services and stuff so it's
used in a lot of different ways
especially on Windows Active Directory
domains and everything and so it's a
common in architecture that we use and
so once I have the creds with man ofthe
middle attack I can then use the SB
relay to then relay those credentials
and more often than not I use just the
default settings because I'm curious
what'll happen and one of the times on
one of the machines the creds that I
relay has local admin access at that
point in time I have control over that
box and having control over that box
gives me also access to multiple
different things and so having control
of that box allows me to dump the
LSA um which then allows me to check to
see if there's potentially plain text
creds and more than once actually
multiple times this year I found PL
plain Tex domain admin credal IAL and at
that point in time it's all over that
simple um one of the times this year I
had da in less than an hour and that was
because I had to let my dog out and she
took a long time probably could have
been
faster anyways um so first step man in
the middle um so the tool that I
normally use for this is
responder um if you don't know it it's
fun tool look it up it's great uh so as
I mentioned lmar there's also if you
notice there mbns mbns is another Legacy
system I feel like I see llmnr more
that's the reason why I used LMR as the
main focus of this because like I said
this is the common attack vectors but
mbns or net bios name service same exact
thing it's a legacy auxiliary name
resolution service before gns so being
able to run responder I'm literally just
poisoning the network looking for those
requests and once they sniffing and
hitting those requests it's sending a
response back and so that way I can get
them to send those credentials that they
are trying to find to my
system um and so by doing this I can
catch
credentials I hit too many buttons where
am I right spot
yeah yeah so um catch ler credentials
the most common one that I end up
catching is SNB credentials because SNB
is used a ton on the network for logging
on machines connecting to services use
connecting to file shares
and so it focuses on setting up various
rope servers to connect to SMB it also
does uh structured query language I
actually had one that I actually got um
SQL crads for this last year um but
normally it's S&B creds that I'm seeing
and being able to use um and so once I
have the creds well start
off remediation for LMR turn it off it's
Legacy don't need it there's no reason
to really have it running same thing
with mbns I have notes there on how to
turn it off you can also Google that but
I made sure to put these the remediation
steps are we going to be a little more
text Heavy in case when anyone wants to
take pictures or anything also if you
ask me for I will just email you these
slides um so this is something that will
stop me from being able to get hashes um
while I'm saying hashes and before I was
saying creds part of the reason for for
that is sometimes if things aren't
configured properly you can catch plain
text credentials too which is makes it
real nice and real sweet generally
speaking though it is configured right
and so it is hashes you're catching
so a gotcha warning so before disabling
L RN mbns make sure all your systems are
configured to run DNS other and LMR mbns
is not being relied on chances are that
is the case but double check because
otherwise you're going to do this and
it's going to break everything and you
don't want
that so double check that before you
start turning things off right away and
make sure that everything is properly
configured to run DNS before you start
turning things off um but the moment you
do this from my perspective it makes my
job
harder so now that we're running the
poisoning attack we catching credential
hashes and things like that I set up an
SMB relay attack so so SMB relay like I
said it's connecting and doing
everything um there are lots of ways to
find whether a system has SMB signing or
not turned
off um so most systems SMB signing is
default
disabled that makes it great for me um
there other message that I have
highlighted here uh message signing
enabled but not required as a hacker
that is the same thing that's disabled
to me if it's not required I'm just
going to skip the requirement there's no
reason for me to go through a
requirement if it's not
required so those are basically the same
thing to me when I see them and I can go
and find those by running it's an inmap
script for that one um there's two SMB
security modes again Google Fair friend
um I think it's literally sb- security
mode and then SB security 2- security
mode but anyways Google friend um I
actually generally speaking use crap map
exact instead to do it um responder also
has a good tool with it called run
finger um makes it sound a little dirty
but basically it fingers the host and
lets you know information about it um so
uh but yeah SMB signing as long as it is
disabled or not required I can then use
ntml relay it's in the impacket another
great tool to set it up so that when
responder captur poison hashes I can
then forward it to those services that
do not have SMB signing required and I
can catch hashes you will notice that
the hashes are not blurred all the ones
that are not blurred I pulled from
proper sources online the ones that are
blurred I could not find and made those
myself so if you're wondering about that
those are fine they're
kosher um so yeah in tml relay I'm
relaying those and I gain access to the
machine it's great um if it's set up
properly then I would not be able to do
that because S&B signing would be
required
which leads me
to the way to fix it um configure your
Windows system so that it it is enabled
and
required um I've seen companies have
like all their systems enabled but not
required again it's basically the same
thing to me and so if it needs to be
enabled and required um you can actually
do it through group policy which makes
it nice can push it all out
um there are look it up because these
are just some of the basic notes but
there are more in-depth notes of walking
you through the steps and everything of
course
um another gotcha warning though make
sure that enabling digitally signed SB
requests won't break anything check all
your SMB servers to make sure they
support SB signing they should um SAS
servers as well you can have them
enforce SNB signing as well so it's not
purely Windows if you got some Linux
system system is working with S&B as
well you can enforce it through
SBA um so yeah as long as it is enabled
and required I can't forward creds I
can't use them that
way and then yeah user has local admin
access so once I default imp packets um
inl relay it will try to dump the Sam um
and so often if I'm seeing enough creds
passing through I will instead of trying
to set up a proxy and everything be like
curiously just let it run and see like
okay are any of these going to hit and
be able to dump the S I am surprised how
many times I actually get a Sam and then
I got and the nice thing about those
type of hashes are they are passable
hashes and
so it's goes back to the basic
principles uh review your roles and your
organization and principal lease
privilege um which sometimes can be
difficult especially like you know you
if you haven't done lece privilege
principle for a while you might need to
audit a bunch of user roles which
sucks um but it is very important to get
done and actually secure the network and
keep everything
proper um also if you can requiring two
Factor authentication on some of the
more secure stuff can definitely help
with that
too um so yeah I think that's it for
this one I don't think there's another
one yeah so yeah review access controls
um sign privileges based on those roles
all the basic same least privilege stuff
I really should check my notes more but
I just keep going that's fine
okay um
so once I do that I so as you saw
before on this one um great
administrator hash there for the local
admin so I can take that and more often
than not also on this one see this is
why I don't look my notes because I know
more than my not notes um so with the
local admin hash something else I
probably should have included in here
but I didn't include in my screenshots
or anything is do not use the local same
local admin on multiple hosts more often
than not if I get local admin on one
host I take those admin CR test it
against all the other hosts maybe some
that even don't have SMB signing
disabled and maybe do require it it
doesn't matter then I got a pable ad
admin hash I can start popping those
boxes that have the same local admin and
so specifically a test that's coming to
mind right now um they only had like
eight hosts that did not require SMB
signing I got forwarded one of them was
local admin hash and then I used that
local admin hash to then pop 12 more
boxes pop pone take control of have
abmin rout
AIS um and so I was able to then from
those so sometimes there's a little bit
of steps in between some this is not the
same box you're getting all that stuff
but in those 12 additional ones I dumped
the LSA and I got plain text credentials
for a domain admin and at that point in
time it's game over so LSA local
security Authority uh Secrets um it's in
the Windows registry it's where uh
sensitive security policy and
information is stored um and it does
Store Plain text
passwords so how do you fix that um
there might be a way out there to kind
of resolve the plain Tex LSA honestly
I'm not sure um but again goes back to
leas privilege do you need that type of
account logging in that way um so the
first recommendation is limit local
admin access if they can't access it
then it's not really a problem the other
recommendation is to limit the impact of
the
compromise um Windows does weird stuff
sometimes that you either have to break
it or do other things to make it be more
proper um and so one of the things to do
is to limit that um you can limit domain
accounts in local Services there's
probably not a local Services you need
to use and then when you do need to
connect to those local Services create
specific domain accounts for that local
service and remove all unnecessary pages
so they're only connecting with that
service and so that means that yeah you
can maybe go hit services with it with
other things but you won't actually be
able to get any more access you won't be
able to look up anything else it limits
the ability to actually be able to do
anything with it
okay so um review of this is the attack
path we just went through man in the
middle attack LMR enabled um or
mbns uh with that being poisoned it
gives me the SM SMB relay being able to
relay that then gets me local admin
access and if I have local admin access
and then plain Tex da in the LSA which
again limiting Services there should not
be a domain admin account in the LSA
connecting through that um but through
that we've been compromising we as in
company Rapid 7 multiple companies by
doing the same exact attack path which
very quickly sometimes there's little
steps in between trying to figure out
how to work make it work for their
Network and different things but more
often than not using this attack Vector
we can get da within the first day of
the
engagement
um okay
second attack
path um so uh Windows n sessions you
numerate users so you get a bunch of
users um n sessions is when you're
logging in with a blank username and a
blank password so by using both of those
um and you're going through and doing a
old session with Windows you can
enumerate a lot of information including
users the nice thing is normally you can
also got the password policy which makes
it a lot easier to password spray and do
things with that too um which then you
password spray with all those usernames
and if the user has a weak password then
you then all of a sudden gain access to
the domain and once you have access to
the domain one of the popular attack
vectors we've been using lately is actor
directory certificate Services adcs
attack um which I'll be going into more
detail later down but basically by doing
an adcs attack um you get back uh domain
hash that is a passible hash and then
you have sorry domain admin hash which
is a passible hash and then you have
access to the whole entire domain
again
so Windows n session enumerating what I
normally use for this is en for Linux um
great tool makes it easy and you can
enumerate a bunch of users there are
other ways numerate users I will talk
more on that in the when I'm talking
about variations of things um I used
this example because again going through
the most of common at least a handful um
of internals I did this year had at
least one system that allowed null
sessions and gave me even if it's not
all the usernames enough usernames that
I could start doing things with it and
get further
access and password policy very nice
very clear um shows a lot of the
information and everything in there it's
fantastic
so n sessions you can disable Anonymous
and N sessions in your window servers
especially your domain controllers who
has all the information in the domain
which means that someone won't be able
to enumerate all the users in the domain
and then be able to start passwords
bringing against them and get further
access um again for those of you who
want to screenshot there or talk to me
after and I can send these to
you um but you can do that in group
policy as well to disable there's
multiple different settings you have to
do it's not just a simple one to make
sure you're disabling all the different
features and everything um because
sometimes I've gone in and there's been
more than once that I go in and they've
disabled some stuff with null sessions
but they haven't disabled everything and
so it's
um limits some of the information I can
get but it's still enough that I can
start proceeding going forward and
continue getting more and more
information and enumerating more in the
network password spraying so one of the
things that we do in our kickoff
engagements when we're talking to
clients is I ask them what their uh
lockout policy is the reason for this is
not just so I can be malicious and
password spray and you know not causing
and be able to get more information the
main reason is if I don't know I will
attempt and potentially lock out lots of
people on your network we don't want to
do that we are red team we are your
friends we want to work with you and
help you find these things that help you
secure you more down the line um so we
always ask what the lockout policy is so
we can stay below that and not cause A
disruption of services um we're human if
we do like accidentally forget to remove
duplicates in a name don't get too upset
cough cough never happened to me um so
yeah and if they have a weak password
policy or even if they have a good
password policy but their users aren't
taught how to do good passwords and so
they kill still can sleep slip in Weak
passwords then we can spray and we can
easily get a password especially if we
if you have a large organization with
over 2,000 people and let's say your
lockout policy is pretty good and you
only allow three uh incorrect attempts
until it's locked out if I got 2,000
people I can run one password against or
two if I'm feeling gutsy um that's 2,000
guesses on people's accounts whether
there the password or not that's still a
lot and that's the difference between a
spray versus a brute force a brute force
is one account and I'm hitting it all
the time with all these different
passwords spray one 2 three attempts
depending on the password policy and I
can hit those 2,000 200 whatever it is
employees and then that's still multiple
guesses that I'm making giving me closer
and closer to getting a potential right
one so while I mention the lockout
policy and I say under it lockup policy
does help um whether it's five three
obviously the smaller the better
um but you want to stay usability too
you don't want someone to one incorrect
attempt it locks you out people are
going to get frustrated you need to make
sure you're pairing usability with your
security um three I'd say is a pretty
reasonable amount I've seen five five
just makes it easier for me to do more
guesses um but have a good lockout
policy it does limit it otherwise I just
be spraying all day long and give me
more and more chance of being able to
get proper
credits but alerting is the most proper
way way to go for catching these types
of attacks if you see a single IP
attempting multiple login attempts
across multiple different accounts in a
short period of time that's something
you need to start setting up alerts
around um and so that's the best way to
catch this and then you can know and
then respond rather than locking people
out too much too potentially and causing
issues that way um so alerting really is
the best way to go for this type of ATT
Vector with password
sprays so password spray this kind of
ties into the last one L
momento I feel like in both yeah in both
common attack
factors part of it boils down to the
basics like the other one was um
principal Le privilege this one is weak
password um I'm not going to harp on
this too much we're all I feel like I'm
preaching the choir on this one um
password strength is if depends on how
easy it is to guess um season and the
date is still very very common
um but a good 12 character length
password including uppercase lowercase
digits special characters it's all the
same stuff admins at least 16 creds just
to be a little more secure not 16 creds
sorry 16 characters um the other thing
with this too which I don't know which
one's the best one to bring this up with
but I'll just say it now separating your
regular account from your domain admin
account is also a recommendation that we
have too I don't think I included that
one in the slides um if you are a domain
user not everything you need to I mean
sorry if you are a domain admin not
everything you need to do is as a domain
admin when I was a system admin I had
two different accounts one when I would
need to do admin work one that I needed
to do more regular work maybe with a
little bit more privileges because you
know you are doing working things but I
kept those accounts separate with
different passwords to help avoid
because if you're using the one that
isn't domain admin for most your work
even if they get it yes they will have
access to more stuff and you want them
to have access to but they won't have
access to the full domain yet
separations like that can really help
secure your
network um but yeah forgot to include
that one in the
slides the other one is use an
Enterprise password database um users
are lazy and honestly I can't blame them
how many of us have written a short
little script or something to make our
job easier because we are
lazy um I call it efficient but you know
different
people um so Enterprise password
database if you make that they can have
one really good strong password with
really strong requirements and then you
can have them autogenerate all the their
other passwords and random secure I mean
you can have good technical controls
over that to make sure that they're
having good passwords and everything
like that and so by doing that it goes
beyond just the training it's like make
sure you have a good password you can
type in on this and then you can have a
password database so they don't have to
remember 20 million passwords because if
I had to remember 20 passwords I would
be trying to find easy ways to remember
them which is going to decrease the
security we need to pair usability with
security when we're doing these things
and the password database is a good way
to do
that and so at this point we've
enumerated users we've password sprayed
and because there was we passwords we
are able to guess a user's password so
now comes the adcs attack um so the nice
thing about adcs tech from my side is
that it's a non-privileged domain user
um they don't really need any extra
privileg or anything um and then I can
run a petite poome that's another great
attack vector and um great tool to use
and you can send that attack to the main
controller and it will return an inlm
hash
moment sticking introverts up here and
talking is way too
much um so uh active directory
certificate services for those you who
don't know what it is it provides um pki
or a public key infrastructure uh for
private networks and um it can be issued
to trusted certificates and managed
devices and things like that
um and then uh it gets can get tied into
to active directory domain
Services um which is where comes active
directory certificate of services it's
the combination of those
two um and so when it does that uh these
on um authentication method it can be
enter Enterprise ca ca certificate
Authority um but the misconfiguration of
that which lots and lots of
misconfigured adcs out there in the
world um can allow a malicious actor to
gain uh domain wide privilege
escalation so
um the next step of the attack after I
do the whole peti Pome and this is me
confirming that the ntml hash is
actually properly coming back that's
responder that I showed you guys
before um we then send that and
enumerate the ATT
directories um the certificate Authority
certificates and I'm looking for
information the main one that I've used
again there's lots of different ones but
the main one that's being exploited most
that I've seen today is
esc8 um it's web enrollments enabled and
it requests a certain dispositions so
I'm looking for one running esc8 the
nice thing is with these tools um
certifi is the one that I'm forwarding
the intermach with um to get the
information
um you can it will print out which ones
are vulnerable like there at the bottom
but also if you have to do it a more
manual way as well you could just check
for web enrollment being enabled and
request disposition is issue and so
looking through and finding all the
information
um is basically what you're looking
for trying to make
sure
yeah um and so at this point now we know
the petite panum command works we got
the ca configuration and we found one
that should be vulnerable and so next we
need to actually exploit
it um oh yeah one more step actually so
once you know that it is exploitable I'm
going to look through all the ones that
are exploitable and I'm looking for it
to be enabled but also for the
enrollment rights there at the bottom
because I want one that is enrolled on
domain
controllers the reason for that is is
because the certificate Authority and
the thing that we're trying to get from
that is going to be a private key which
when it's set up with adcs can be used
to actually log into things um as an
alternative way to actually using like
an nml hash or you know passing the hash
or credentials or anything like that and
so that's what we're trying to
do um so as long as I find one that's
enabled and one that's tied to domain
controllers
um using a certifi command I can go and
get a
certificate um which then I again re
with the PT to and responder I'm
relaying that nml hash
again
um and I am getting that certificate
information and once I have the
certificate then I can use that and the
private key because it is is integrated
in an act active directory um domain
Services as an alternative
authentication
method so once I actually have that then
I can just take that key and forward it
over and now I have all the pieces the r
a certify the pfx key and I can get the
inh um which instead of having to relay
I can just pass the hash and as you can
see here I'm getting the Nash for the
administrator on the domain corp. loc
and so at this point in time I actually
was the domain admin hash and so I had
domain access to
everything so this is the remediation
stuff that attack is much more involved
so I went a little bit more into it with
everything
um yeah so certificate Authority web
enrollment and certificate enrollment
web services
um if they aren't needed in your
organization you can uninstall them they
aren't needed in a lot of
situations um if you can't uninstall
them and maybe it's needed but it's only
needed for limited things use an allow
list and a deny list and limit the
access to those
Services um there's also an Extended
protection of authentication for
adcs and there's different ways to do
that so the steps to actually do these
things are much more involved if you
want to screenshot or picture of that
this searching this type of information
we'll get you closer to finding the full
list I was not going to put full list of
information in the slides for these ones
um Additionally you can disable ntml
authentication on window domain
controllers and adcs services so if you
remember everything we started with was
just getting an inl hash and then be
able to relay it so as an alternative
method the other steps would be good to
take care of too but this would make it
harder because I'd have to find a
different way to get that ntml hash to
do these things and so the whole thing
is trying to make my job harder we're
hackers we're inventive as we talked
about this morning and everything we
will try to find a different solution to
the
problem but the more ways you make it
harder and the more ways you make it
secure the better it is for you guys and
hopefully it'll reach the point where
it's hard enough that the hacker is just
like this isn't worth my time and leave
um but yeah so that is
adcs so um common attack path this is
the review of the second one um Windows
n sessions we were able to enumerate
users with that and then we performed a
password spray with the password spray
we were able to find some user with weak
passwords and then because the user had
weak passwords we were able to perform
an adcs attack which was the whole
attack factor that we talked about using
the getting the administrator into hash
for into to the certificate Authority
and then back and then we are able to
actually get domain access to the whole
entire
domain so that is the two most common
attack vectors that I've seen a lot used
by me and
my co-workers colleagues colleagues
right because it's not just in Rapid
7
um and one of them adcs I feel like has
become a lot more popular over the last
year and so um the other one has been
popular since I was in college so that's
one that's still existing out there that
um if we could do better at that'd be
great so next thing we're talk about is
a little bit of security and depth so
everyone should be pretty used to this
security and depth you need to have
layers of security blah blah blah you're
used to this I'm not going to do the
whole Spiel for you guys there but we
will talk about a little bit of
variations and why security depth is
important so let's say that you get
approval and you get to turn LMR in mbns
off and then you also make sure you have
SMB signing turned on for all your
machines great that is fantastic if I
can still enumerate users and then
password spray and your users have weak
passwords and then one of those users
have local admin access you haven't
really stopped anything yet um or let's
say that you made sure all your users
have very limited access and everything
you can go vice versa if I can man in
the middle because you didn't fix that
cach LMR and then do an SMB relay and
then I can potentially connect that
through and use that users hash and
credentials or anything to be able to
start connecting and doing an adcs
attack um and other option two is if you
get S SMB relay fixed because you made
sure all the signing was required if you
but you have LMR there and weak
passwords if I have LMR and I'm
poisoning I'm getting hashes I can take
those offline crack them and then start
using them in all the different ways as
well too security and depth is important
you need those layers to be able to help
against these variety of different
scenarios these were the two most common
scenarios that I used but there's
multiple variations of them too um
Windows n session is the one I use for
this but OS in people find people's
usernames then use Cur root um to test
the usernames against ceros and confirm
which ones are valid I mean I have a
file that I use that
has I think it's like 49,000 usernames
which are literally just generated from
first letter and they think it's like
the 100 most common first names and 100
most common last names because using
that and using Kos I get at least a
handful of accounts every single time
I've Ed that because
because maybe the company does have
pretty good OSN protection and various
other things um and then if they do that
but they and they have bad passwords
then I spray I get some creds and again
it escalates and starts spiraling and
going down there so Security in depth we
honestly have an easier job than you
guys um we don't have to I mean we try
to think of all these scenarios to try
to help you guys as much as we can but
you guys have the multiple layers to put
in protection I mean I did blue hat
security and instant response for years
and so that job is a lot harder because
we can find a different way to wiggle
here and wiggle there and that's why
we're trying to help with being able to
find these ways and let you know where
some of those key points are um so
that's why I'm trying to relay the two
most common attack
vectors um so blue team red team while
we are pentest in we are quote unquote
opposite sides but really we're all on
the same side here um more often than
not if I'm pentesting a company that has
really good security um I'll let them
know like yeah when I have red team hat
on I am frustrated as hell because you
did all this security here security here
or like there's you block this step here
so I had to like figure out a way to go
around here and like it is so
frustrating but the moment I'm done it's
just like put on my blue team house just
like you guys did a really good job here
you guys did a really good job there and
it's great to see when those things are
happening with my red team hat on it
could be frustrating as heck but we're
all really on the same team here as long
as you're not black hat if you are go
away um but we're all really on the same
team here and we're all trying to help
each other out so during the engagement
yeah we maybe are on other sides and
everything but we're really just
Partners trying to help each other out
here um okay so if I remember right I
got like 10 minutes left
right yeah okay perfect that's where I
tried to hit it cool um so I don't know
if I'll be able to answer him but if
anyone has questions red teaming
engagements various variations or
anything like that I did try to leave
around 10 minutes of questions so people
could
ask yes and I'll repeat the
question and if not we can also get out
here early and change so it's up to you
guys yep you a test for you come back
and find out you're not
um it depends on lot on upper
Management's view which you try to do
your best to
change um so like in our reports or like
in our um debrief calls sometimes like
if I see ELR mbns and the whole entire
time I'm there I don't catch any hashes
right um because I'm just I while I see
the traffic none of the traffic's
running creds or anything like that so I
can't really poison and catch that
because there's not those type of
connections being made um I will
highlight in the debrief College like
while I did put this in as low risk
because no credentials were found if
creds were found this is what could have
happened and to let them know because
the other thing is while we are in a
time box test as pen testers so we're
limited on time resources and things
like that like I've done a 3-day
internal where I was really frustrated
because I got creds no I didn't have
creds I got hashes through
LMR and I was relaying but the relaying
was having some issues and so finally
when I got to relay the creds that I C
kept catching didn't have the access
which could be great and fantastic and
maybe they actually had it set up where
like it was a legacy system so so it
couldn't um have the access at need of
rest andb relay to be able to do a
proper connect and everything like that
if that's proper great if it just
happened to be no one was in the office
this week and then everyone else had
creds then potentially it's a huge
vulnerability for him still so we
include those in the report we also do
an assessment storyboard to try to
highlight like these are the things that
we found and potentially could go and
you discuss that in the debrief call to
let them know like because we're in a
time box test but if I'm a hacker I'll
just let that stuff run the whole time
in the background and see and eventually
like if I get one domain admin on there
that's running at that time oh do I need
to move over here for a camera or
something
sorry um
then yeah if the one domain admin once
is enough to be able to get creds and
everything so I mean there was one
company that I spent the whole entire
time not getting domain user or anything
like that domain admin trying to get
credits which was super frustrating for
me and then I think it was the next year
I had them again expecting slightly the
same results domain admin happened to
get on because they didn't really change
everything even though we recommended it
and domain and admin happened to get on
the first day and I had completely pwned
them at the end of it so it's like just
because Legacy things are there and we
don't catch during the pen test we're
limited on time doesn't mean that the
vulnerability and the way to spiral down
isn't
there
generally speaking if we do catch it and
stuff they at least try to put some
safeguards and everything like that
we'll try to find ways around it or
maybe a different way in but generally
speaking from what I've seen they do do
try to do what they can to fix
it um any other questions I think we got
yeah we still got
time
yeah
laps okay how effective is laps laps um
local admin Protection Service right um
at mitigating the uh local admin rights
um honestly I'm not used that very much
on my blue teaming side so I can't
really answer on that one
um my guess would be that if it's there
and it's a tool hopefully it helps helps
but people find ways around things so
it's always got to be careful with that
and sometimes exceptions are put in and
if exceptions are put in maybe those
exceptions don't need to exist down the
line so that's one of the reasons why
auditing um user controls fairly
regularly is important
too um any other
questions I keep looking down because
the lights they have there are so bright
not trying to avoid looking at you guys
um um
okay I'm not seeing any hands so if you
have a hand Hoot and
Holler sweet I think we'll get out five
minutes early because I don't like
holding people beyond what they're
needed so if you guys have more
questions you don't want to raise your
hand I'll be here so feel free to come
up
[Applause]
thanks