{"id":38057,"date":"2019-10-31T22:21:26","date_gmt":"2019-10-31T19:21:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/dnevnik-toma-hantera-sobaka-baskervilevyh\/"},"modified":"2019-10-31T22:21:26","modified_gmt":"2019-10-31T19:21:26","slug":"dnevnik-toma-hantera-sobaka-baskervilevyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/dnevnik-toma-hantera-sobaka-baskervilevyh","title":{"rendered":"Tom Hunter's Diary: 'The Hound of the Baskervilles'","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Delaying the signing is a common practice for any large company. The contract between Tom Hunter and an online pet store for a comprehensive penetration test was no exception. It was necessary to check both the website and the internal network, and even the working Wi-Fi.<\/p>\n

It\u2019s no surprise that he was eager to get started even before all the formalities were settled. Just a quick scan of the website \u2014 it\u2019s unlikely that such a renowned store as 'Baskerville\u2019s Dog' would allow mistakes at this stage. A couple of days later, Tom finally received the signed original of the contract \u2014 by that time, with his third cup of coffee, Tom was keenly evaluating the state of the inventory from the internal CMS...<\/p>\n

\"TomSource: Ehsan Taebloo<\/a><\/noindex><\/i>
\n<\/a><\/noindex>
\nHowever, he couldn't do much wandering in the CMS as Tom Hunter's IP had been banned by the site's administrators. Although he could have generated some store credits and fed his beloved cat cheaply for months... 'Not this time, Darth Sidious,' Tom thought with a smile. It would have been just as amusing to navigate from the website zone to the client\u2019s local network, but apparently, these segments aren't interconnected at large corporations, which is often the case.<\/p>\n

After all the formalities, Tom Hunter armed himself with the provided VPN credentials and headed into the client's local network. The account was within the Active Directory domain, so it was simple to dump the AD \u2014 consolidating all publicly available information about users and workstations.<\/p>\n

Tom launched the adfind tool and began sending LDAP queries to the domain controller. He applied a filter based on the objectCategory class, specifying 'person' as the attribute. The response came back with the following structure:<\/p>\n

dn:CN=Guest,CN=Users,DC=domain,DC=local\n>objectClass: top\n>objectClass: person\n>objectClass: organizationalPerson\n>objectClass: user\n>cn: Guest\n>description: Built-in account for guest access to the computer or domain\n>distinguishedName: CN=Guest,CN=Users,DC=domain,DC=local\n>instanceType: 4\n>whenCreated: 20120228104456.0Z\n>whenChanged: 20120228104456.0Z<\/code><\/pre>\n
\nIn addition, there was a lot of useful information, but the most interesting part lay in the field >description: >description. This is a comment on the account \u2014 essentially, a convenient place to store insignificant notes. However, the client's administrators thought that passwords could safely reside here too. After all, who would be interested in all these insignificant service accounts? Therefore, the comments that Tom received looked like this:<\/p>\n
Created by Administrator, 2018.11.16 7po!*Vqn<\/code><\/pre>\n
\nYou don't need to be exceptionally clever to understand the use of the combination at the end. It was just a matter of parsing a large response file from the KD by the field >description: and there it was \u2014 20 login-password pairs. Moreover, almost half of them had RDP access rights. Not a bad foothold, time to divide the attacking forces.<\/p>\n
Network Environment<\/h2>\n
\nThe available shares of 'The Hound of the Baskervilles' resembled a big city in all its chaos and unpredictability. With user and RDP profiles, Tom Hunter was a poor boy in this city, but even he managed to observe a lot through the shining windows of security policy.<\/p>\n
Parts of file servers, accounting accounts, and even related scripts \u2014 all of this was publicly accessible. In the settings of one such script, Tom found the MS SQL hash of a user. A little brute-force magic, and the user's hash turned into plain text password. Thanks to John The Ripper and Hashcat.<\/p>\n
\"Tom
\n
\nThis key had to fit some kind of chest. The chest was found, and moreover \u2014 it was linked to ten more 'chests'. Inside six of them lay... superuser rights, nt authority system! On two, it was possible to run the stored procedure xp_cmdshell and send cmd commands in Windows. What else could one wish for?<\/p>\n
Domain Controllers<\/h2>\n
\nTom Hunter prepared his second strike for the domain controllers. In the network of 'The Hound of the Baskervilles,' there were three \u2014 corresponding to the number of geographically remote servers. Each domain controller has a public folder, like an open display in a store, where the same poor boy Tom hangs around.<\/p>\n
And this time the boy was lucky again \u2014 they forgot to remove the script from the display, where the local server admin's password was hardcoded. Thus, the way to the domain controller was open. Come in, Tom!<\/p>\n
Here, from the magical hat was pulled out mimikatz<\/a><\/noindex>, which was fed by several domain administrators. Tom Hunter accessed all machines on the local network, and a devilish laugh startled the cat from the neighboring chair. This path was shorter than expected.<\/p>\n
EternalBlue<\/h2>\n
\nThe memory of WannaCry and Petya still lingers in the minds of pentesters, but some admins seem to have forgotten about ransomware amidst the stream of other evening news. Tom discovered three nodes vulnerable in the SMB protocol\u2014CVE-2017-0144 or EternalBlue. This is the very vulnerability that allowed WannaCry and Petya ransomware to spread, a vulnerability that enables arbitrary code execution on a node. One of the vulnerable nodes had a domain admin session\u2014'exploit and gain.' What can you do, time hasn\u2019t taught everyone.<\/p>\n
\"Tom
\n<\/p>\n
The Hound of the Baskervilles<\/h2>\n
\nInformation security classics often repeat that the weakest link in any system is the human. Did you notice that the header above doesn\u2019t match the store name? Perhaps not everyone is that attentive.<\/p>\n
In the best traditions of phishing blockbusters, Tom Hunter registered a domain that differed by just one letter from the domain of 'The Hound of the Baskervilles.' The email address on this domain mimicked the information security service\u2019s address of the store. Over 4 days, between 4:00 PM and 5:00 PM, an email like this was sent uniformly to 360 addresses from the fake address:<\/p>\n
\"Tom
\n
\nPerhaps only the employees\u2019 own laziness saved them from a massive password leak. Of the 360 emails, only 61 were opened\u2014security isn\u2019t very popular. But it got easier from there.<\/p>\n
\"Tom
\nPhishing Page<\/i><\/p>\n
46 people clicked the link, and nearly half\u201421 employees\u2014didn\u2019t look at the address bar and calmly entered their usernames and passwords. A good catch, Tom.<\/p>\n
\"Tom
\n<\/p>\n
Wi-Fi Network<\/h2>\n
\nNow there was no hope of the cat's assistance. Tom Hunter tossed a few gadgets into his old sedan and headed to the office of 'The Hound of the Baskervilles.' His visit wasn\u2019t scheduled: Tom planned to test the client's Wi-Fi. Several free spots were found in the business center's parking lot, conveniently positioned within the target network's perimeter. Clearly, no one had particularly thought about its limitation\u2014it was as if the administrators were randomly throwing in additional access points in response to any complaint about weak Wi-Fi.<\/p>\n
How does WPA\/WPA2 PSK protection work? Encryption between the access point and clients is ensured by the Pairwise Transient Key (PTK). PTK uses the Pre-Shared Key and five other parameters \u2014 SSID, Authenticator Nounce (ANounce), Supplicant Nounce (SNounce), and the MAC addresses of the access point and client. Tom intercepted all five parameters, and now he was only missing the Pre-Shared Key.<\/p>\n
\"Tom
\n
\nThe Hashcat utility cracked this missing link in about 50 minutes \u2014 and our hero found himself on the guest network. From there, he could already see the work network \u2014 surprisingly, Tom managed to handle the password in just nine minutes. And all this without leaving the parking lot, without any VPNs. The work network opened up a vast landscape for monstrous activities, but he\u2026 never added bonuses to the store card.<\/p>\n
Tom paused, glanced at his watch, tossed a few bills on the table, and, bidding farewell, left the caf\u00e9. Maybe it was time for another pentest, or perhaps he had something else in mind... Telegram Channel<\/a><\/noindex> I thought about writing...
\n<\/i>
\n
Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0417\u0430\u0442\u044f\u043d\u0443\u0442\u044c \u0441 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u0438\u0435\u043c \u2014 \u043e\u0431\u044b\u0447\u043d\u043e\u0435 \u0434\u0435\u043b\u043e \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438. \u0418\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043d\u0435 \u0441\u0442\u0430\u043b \u0434\u043e\u0433\u043e\u0432\u043e\u0440 \u043c\u0435\u0436\u0434\u0443 \u0422\u043e\u043c\u043e\u043c \u0425\u0430\u043d\u0442\u0435\u0440\u043e\u043c \u0438 \u043e\u0434\u043d\u0438\u043c \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0437\u043e\u043e\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u043c \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0438\u043d\u0433. \u041f\u0440\u0435\u0434\u0441\u0442\u043e\u044f\u043b\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0438 \u0441\u0430\u0439\u0442, \u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c, \u0438 \u0434\u0430\u0436\u0435 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 Wi-Fi. \u041d\u0435\u0443\u0434\u0438\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0440\u0443\u043a\u0438 \u0437\u0430\u0447\u0435\u0441\u0430\u043b\u0438\u0441\u044c \u0435\u0449\u0435 \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0431\u044b\u043b\u0438 \u0443\u043b\u0430\u0436\u0435\u043d\u044b \u0432\u0441\u0435 \u0444\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438. \u041d\u0443 \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0430\u0439\u0442 \u043d\u0430 \u0432\u0441\u044f\u043a\u0438\u0439 \u0441\u043b\u0443\u0447\u0430\u0439, \u0432\u0440\u044f\u0434 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-38057","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tom Hunter's Diary: 'The Hound of the Baskervilles' | ProHoster","description":"Delaying the signing is a common occurrence for any large company. The contract between Tom Hunter and a certain network pet store for a thorough pentesting was no exception.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/dnevnik-toma-hantera-sobaka-baskervilevyh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0422\u043e\u043c\u0430 \u0425\u0430\u043d\u0442\u0435\u0440\u0430: \u00ab\u0421\u043e\u0431\u0430\u043a\u0430 \u0411\u0430\u0441\u043a\u0435\u0440\u0432\u0438\u043b\u0435\u0432\u044b\u0445\u00bb | ProHoster","og:description":"\u0417\u0430\u0442\u044f\u043d\u0443\u0442\u044c \u0441 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u0438\u0435\u043c \u2014 \u043e\u0431\u044b\u0447\u043d\u043e\u0435 \u0434\u0435\u043b\u043e \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438. \u0418\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043d\u0435 \u0441\u0442\u0430\u043b \u0434\u043e\u0433\u043e\u0432\u043e\u0440 \u043c\u0435\u0436\u0434\u0443 \u0422\u043e\u043c\u043e\u043c \u0425\u0430\u043d\u0442\u0435\u0440\u043e\u043c \u0438 \u043e\u0434\u043d\u0438\u043c \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0437\u043e\u043e\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u043c \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0438\u043d\u0433.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/dnevnik-toma-hantera-sobaka-baskervilevyh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:21:26+00:00","article:modified_time":"2019-10-31T19:21:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38057","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 20:17:37","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:16:22","updated":"2026-01-23 20:17:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/38057","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=38057"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/38057\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=38057"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=38057"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=38057"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}