We often write about how hackers frequently rely on the use of , in order to avoid detection. They literally , utilizing standard Windows tools, thus bypassing antivirus programs and other utilities designed to detect malicious activity. We, as defenders, are now forced to deal with the unfortunate consequences of such cunning hacking techniques: a well-placed employee can use the same approach for covert data theft (company intellectual property, credit card numbers). And if they don't rush, but instead work slowly and discreetly, it will be extremely difficultâbut still possibleâif the right approach and appropriate , are applied to identify such activity.
On the other hand, I would not like to demonize employees, as no one wants to work in a business environment straight out of Orwell's "1984." Fortunately, there are practical steps and hacks that can significantly complicate life for insiders. We will examine covert attack methods, used by hackers who are employees with some technical background. Later, we will discuss ways to mitigate such risksâinvestigating both technical and organizational actions.
What's wrong with PsExec?
Edward Snowden has, rightly or wrongly, become synonymous with insider data theft. By the way, don't forget to check out about other insiders who also deserve some notoriety. One important point to highlight about the methods used by Snowden is that, as far as we know, he did not install any external malicious software!
On the contrary, Snowden employed a bit of social engineering and used his position as a system administrator to collect passwords and create credentials. Nothing complicatedâno , attacks or .
Employees of organizations may not always be in the unique position as Snowden, but from the concept of "surviving on scraps," several lessons can be learnedânamely, not to engage in any malicious actions that can be detected and, particularly, to use credentials very carefully. Keep this thought in mind.
and his cousin have impressed countless pentesters, hackers, and information security bloggers. In combination with Mimikatz, Psexec allows attackers to move within a network without needing to know the password in plaintext.
Mimikatz intercepts the NTLM hash from the LSASS process and then passes the token or credentials â known as the "pass the hash" attack â in Psexec, allowing the attacker to log into another server as another user. With each subsequent move to a new server, the attacker collects additional credentials, broadening their capabilities in search of accessible content.
When I first started working with Psexec, it seemed almost magical â thanks to , the genius behind Psexec â but I also know about its noisy components. Itâs not subtle at all!
The first interesting fact about Psexec is that it uses an extremely complex network file sharing protocol SMB from Microsoft. Using SMB, Psexec transmits small binary files to the target system, placing them in the C:Windows folder.
Next, Psexec creates a Windows service using the copied binary and runs it under a rather "unexpected" name, PSEXECSVC. You can actually see all this, just as I did, by observing the remote machine (see below).
Psexecâs calling card: the service "PSEXECSVC". It runs the binary that was placed via SMB in the C:Windows folder.
As a final stage, the copied binary opens an RPC connection to the target server and then accepts control commands (by default, through the Windows command shell), executing them and redirecting input and output to the attacker's home machine. Thus, the attacker sees the basic command line â just as if they were connected directly.
Many components and a very noisy process!
The complex mechanism of Psexecâs internal processes explains the message that puzzled me during my initial tests a few years ago: "Starting PSEXECSVC âŠ" and the subsequent pause before the command line appeared.
Psexec from Impacket actually shows what happens "under the hood".
It's no surprise: psexec was doing a lot of work 'under the hood.' If you're interested in a more detailed explanation, check out wonderful description.
Clearly, when used as a systems administration tool, which was its original purpose psexec, there's nothing wrong with the 'buzzing' of all these Windows mechanisms. For an attacker, however, psexec creates complications, and for a cautious and clever insider, like Snowden, psexec or a similar utility would be too great a risk.
And here comes Smbexec
SMB is a clever and stealthy way to transfer files between servers, and hackers have been embedding themselves directly into SMB forever. I assume everyone already knows not to SMB ports 445 and 139 to the internet, right?
In 2013 at Defcon, Eric Millman () introduced , so pentesters could try out stealthy SMB exploitation. I don't know the whole story, but then Impacket further refined smbexec. In fact, for my testing, I downloaded the scripts from Impacket in Python from .
Unlike psexec, smbexec avoids transmitting potentially detectable binary files to the target machine. Instead, the utility fully thrives on 'foraged' resources by executing local Windows command lines.
Here's what it does: it sends a command from the attacking machine through SMB to a special incoming file, then creates and executes a complex command line (like a Windows service) that will look familiar to Linux users. In short: it launches the native Windows shell cmd, redirects the output to another file, and then sends it back over SMB to the attacker's machine.
The best way to understand this is to examine the command line I was able to obtain from the event log (see below).
Isn't this the greatest way to redirect input/output? By the way, creating a service has an event ID of 7045.
Like psexec, it also creates a service that does all the work, but the service after that is removed is only used once to execute the command and then disappears! A security employee monitoring the victim's machine wouldn't be able to spot obvious signs. attack indicators: there is no malicious executable file, no persistent service is installed, and there is no evidence of RPC usage, as SMB is the only means of data transfer. Brilliant!
From the attacker's perspective, a 'pseudo-shell' is available, with delays between sending commands and receiving responses. But this is enough for the attackerâwhether an insider or an external hacker who already has a footholdâto start looking for interesting content.
To send data back from the target machine to the attacker's machine, the . Yes, this is the same Samba , but repurposed into a Python script by Impacket. In fact, smbclient allows you to discreetly conduct FTP transfers over SMB.
Let's take a step back and think about what this could mean for an employee. In my fictional scenario, let's say a blogger, financial analyst, or high-paid security consultant is allowed to use their personal laptop for work. As a result of some magical process, she feels offended by the company and 'goes on a rampage'. Depending on the operating system of the laptop, she uses either the Python version from Impact or the Windows version of smbexec or smbclient as an .exe file.
Like Snowden, she learns another user's password either by looking over their shoulder, or she gets lucky and stumbles upon a text file containing the password. Using these credentials, she begins to explore the system at a new level of privileges.
DCC hacking: we don't need any 'silly' Mimikatz
In my previous posts dedicated to pentesting, I often used mimikatz. It's a wonderful tool for intercepting credentialsâNTLM hashes and even plaintext passwords lurking on laptops, just waiting to be exploited.
Times have changed. Monitoring tools have become better at detecting and blocking mimikatz. Information security administrators also have more options to mitigate the risks associated with 'pass the hash' type attacks (hereafter PtH).
So what should a smart employee do to collect additional credentials without using mimikatz?
Included in the Impacket toolkit is a utility called , which extracts credentials from the Domain Credential Cache, or DCC for short. As I understand it, if a domain user logs onto the server and the domain controller is not available, the DCC allows the server to authenticate the user. Either way, secretsdump lets you dump all these hashes if they are available.
DCC hashes are not NTLM hashes and their cannot be used for PtH attacks.
Well, you could try to crack them to get the original password. However, Microsoft has become smarter with DCC, and cracking DCC hashes has become extraordinarily difficult. Yes, there is , 'the fastest password cracker in the world,' but it requires a GPU to work efficiently.
Instead, let's try to think like Snowden. An insider could perform some in-person social engineering and possibly learn some information about the person whose password they want to crack. For example, they might find out if that person's online account has ever been hacked and examine their password in plaintext for any clues.
And that's the scenario I'm going to follow. Let's assume that an insider found out that their manager, Cruella, has been hacked several times across different websites. After analyzing several of these passwords, they realize that Cruella tends to use a baseball team name format 'Yankees' followed by the current year â 'Yankees2015.'
If you're currently trying to reproduce this at home, you might download a small 'C' , implementing the DCC hashing algorithm, and compile it. , by the way, has added DCC support, so it can be used as well. Let's assume that the insider doesn't want to deal with studying John the Ripper and likes to run 'gcc' on legacy C code.
Playing the role of the insider, I ran several different combinations and eventually discovered that Cruella's password is 'Yankees2019' (see below). Mission accomplished!
A little social engineering, a bit of guessing, and a pinch of Maltego â and you're already on your way to cracking a DCC hash.
I propose we wrap this up for now. We will return to this issue in other publications and explore more slow and stealthy attack methods, continuing to rely on the fantastic toolkit from Impacket.
Source: habr.com
