Post-Exploitation with WCE v1.2
|
|
|
- Allen Wilkerson
- 6 years ago
- Views:
Transcription
1 Post-Exploitation with WCE v1.2 Pass-the-Hash. Pass-the-ticket & more Date: Author: Hernan Ochoa
2 Windows Authentication h1 = LMHash( pwd1 ) h2 = NTHash( pwd1 ) SAM Database User Hash LM Hash NT cgarcia A6BCD.. B0FD1.. ajuarez B90DF.. CCDF.. Network The cleartext password is not sent The NTLM protocol is used
3 NTLM Authentication lmhash = LMHash( pwd1 ) nthash = NTHash( pwd1 ) Init connection Sends cgarcia, R Responds C = challenge random R = f(lmhash/nthash, C) R = f(sam[lmhash/nthash], C) R == R => Access Granted R <> R => Access Denied SAM Database User Hash LM Hash NT cgarcia A6BCD.. B0FD1.. ajuarez B90DF.. CCDF..
4 pre-pass-the-hash Attacks After compromising a Windows box Dump the SAM pwdump3/3e/4/5/6/7,fgdump,etc Administrator:500: A0B0C0D0E0F10: A0B0C0D0E0F10 Crack/Brute-Force hashes to obtain cleartext password Takes time.. (e.g.: pentest time is limited) No guarantee the password will be obtained Rainbow tables were not widely used Less computing power, storage, etc Still, not the answer to everything
5 Pass-The-Hash Technique Published by Paul Ashton in
6 Pass-the-hash Technique lmhash = LMHash( pwd1 ) nthash = NTHash( pwd1 ) Init connection Sends cgarcia, R Responds C = challenge random R = f(lmhash/nthash, C) Cleartext password is not needed for NTLM auth Only lmhash/nthash are needed No need to crack/brute-force Just use the hashes directly SAM Database User Hash LM Hash NT cgarcia A6BCD.. B0FD1.. ajuarez B90DF.. CCDF.. R = f(sam[lmhash/nthash], C) R == R => Access Granted R <> R => Access Denied
7 Pass-the-hash: exploitation Modified Smbclient (SAMBA) smbclient // /c$ -U Administrator -p 4ECC0E B7EAAD3B435B51404EE:551E3B3 215FFD87F5E037B3E3523D5F6 Samba-TNG Many 3 rd -party SMB+NTLM stacks Python, Ruby, Java, etc
8 3 rd- party SMB+NTLM stacks: Limitations Limited and partial functionality Always running behind Windows New functionality has to be implemented, some by reverse engineering Complex, requires time and effort Cannot use native Windows applications They ask for username and cleartext password, not hashes
9 Enter, Windows Credentials Editor...
10 What is WCE? Tool to manipulate Windows logon sessions Add, list, delete, modify Obtain credentials associated with logon sessions Pass-the-hash (NTLM) Pass-the-ticket (Kerberos)
11 Pre-WCE/Pass-the-hash attacks Without WCE.. Crack/Brute-force hashes to obtain cleartext password Crack/Brute-force encrypted hashes (C,R->NTLM) to obtain cleartext password Use 3 rd -party SMB+NTLM stacks, w/limited and partial functionality More difficult/not possible to do pass-the-hash while pivoting among Windows boxes
12 Post-WCE/Pass-the-hash attacks With WCE Do Pass-the-hash directly with the hashes No need to attempt to crack/brute-force hashes Will be able to use them even if you cannot crack them 3 rd -party SMB+NTLM stacks problems eliminated Easier to do Pass-the-hash while pivoting among Windows boxes
13 Demo #1 WCE: Pass-the-hash
14 New attack implemented by WCE It is not Pass-the-hash, it s another technique.. Sometimes the two are confused, but they are not the same.. Allows you to obtain usernames and NTLM hashes stored in memory
15 Why are they in memory? NTLM auth package SSO cgarcia pwd1 Network
16 When are they stored in memory? Interactive logon sessions at the console Remote logon sessions via RDP RunAs Windows Services running under specific user accounts Windows APIs used by applications Etc.
17 When are they stored in memory? Interactive logon sessions at the console cgarcia pwd1
18 When are they stored in memory? Remote logon sessions via RDP Network
19 RunAs When are they stored in memory?
20 When are they stored in memory? Windows Services
21 When are they stored in memory? Windows APIs used by applications Example:
22 WCE can obtain the LM Hash.. By default, nowadays, Windows does not store the LM hash in the SAM It is weak; easy to crack
23 WCE can obtain the LM Hash from memory Windows generates and stores the hashes in memory, including the LM hash Interactive sessions Others previously mentioned Possible to crack it and obtain cleartext password to use in places where NTLM is not the auth method
24 Example: The LM Hash is not in the SAM Pwdump output The LM Hash is in memory WCE output
25 When are they NOT stored in memory? Network Logons The hashes never reach the remote server Init Connection Sends cgarcia, R Responds C = challenge random
26 Post-explotation attack scenario Attacker compromises remote Windows box Run WCE to obtain credentials stored in memory Use those hashes to do Pass-The-Hash with WCE
27 Demo #2 WCE: Steal credentials from memory
28 Especially interesting in Windows Environments Controller (DC) SAM User Hash LM Hash NT cgarcia A6BCD.. B0FD1.. ajuarez B90DF.. CCDF.. User User Backups Server User
29 WITHOUT WCE.. SAM User Hash LM Hash NT Administ rador FDDE.. CCDH1.. Guest AABCD.. FFD4F.. Controller (DC) SAM User Hash LM Hash NT cgarcia A6BCD.. B0FD1.. ajuarez B90DF.. CCDF.. User User Backups Server Attacker Attacker owns remote Windows box Only has access to local SAM.. No Users there, not very useful
30 WITH WCE.. :Admi nistrator:cdb 70D9EDA812 DBF:C9DF712 D09D7DF1C Controller (DC) SAM User Hash LM Hash NT cgarcia A6BCD.. B0FD1.. ajuarez B90DF.. CCDF.. User User Backups Server Attacker owns Backups server Obtains credentials from memory.. Probably will find Users there.. Can possibly compromise the whole domain! Attacker
31 Typical Scenario Controller (DC) Administrator User Backups Server Attacker
32 Typical Scenario :Admi nistrator:cdb 70D9EDA812 DBF:C9DF712 D09D7DF1C Controller (DC) Administrator User Backups Server Attacker
33 Typical Scenario :Admi nistrator:cdb 70D9EDA812 DBF:C9DF712 D09D7DF1C Controller(DC) Administrator User Backups Server Attacker WCE steals the Administrator Credentials!
34 RDP exposes credentials When you RDP to a remote box, you leave the NTLM hashes of your password in the remote server s memory NTLM hashes are equivalent to the cleartext password (pass-the-hash+wce) So, we could say you are leaving there your password
35 RDP exposes credentials Even when using pass-through authentication Credentials (user+domain+hashes) are stored in Controller But when you use RDP, they are also left in the memory of the remote Windows box you are RDPing to! Be careful where you are RDPing to
36 RDP exposes credentials Attacker on the remote Windows box can obtain credentials from memory Local Administrator Regular User w/local admin privs Attacker that owns less secured box, regular users are more vulnerable Etc.
37 RDP exposes credentials: Example Controller (DC) SAM User Hash LM Hash NT cgarcia A6BCD.. B0FD1.. ajuarez B90DF.. CCDF.. Administrator User User Workstation Attacker
38 RDP exposes credentials: Example Controller (DC) SAM User Hash LM Hash NT cgarcia A6BCD.. B0FD1.. ajuarez B90DF.. CCDF.. Administrator User User Workstation Attacker
39 RDP exposes credentials: Example Controller (DC) SAM User Hash LM Hash NT cgarcia A6BCD.. B0FD1.. ajuarez B90DF.. CCDF.. :Admi nistrator:cdb 70D9EDA812 DBF:C9DF712 D09D7DF1C Administrator User User Workstation Attacker
40 RDP exposes credentials: Example Controller (DC) SAM User Hash LM Hash NT cgarcia A6BCD.. B0FD1.. ajuarez B90DF.. CCDF.. Administrator User Workstation :Admi nistrator:cdb 70D9EDA812 DBF:C9DF712 D09D7DF1C User Attacker
41 RDP exposes credentials: Example Controller (DC) SAM User Hash LM Hash NT cgarcia A6BCD.. B0FD1.. ajuarez B90DF.. CCDF.. Administrator User Workstation :Admi nistrator:cdb 70D9EDA812 DBF:C9DF712 D09D7DF1C User Attacker
42 RDP: Disconnect!= Log Off
43 RDP: Disconnect!= Log Off
44 RDP: Disconnect!= Log Off
45 RDP: Disconnect!= Log Off Disconnect leaves NTLM hashes in memory The Logon session is not terminated Log Off terminates the logon session Hashes are erased from memory Always Log Off! Users tend to just Disconnect Including Administrators..
46 Zombie Logon Sessions
47 Bug: Zombie Logon Sessions! Controller (DC) Administrator User Backups Server Day 1 Attacker
48 Bug: Zombie Logon Sessions! :Admi nistrator:cdb 70D9EDA812 DBF:C9DF712 D09D7DF1C Controller (DC) Administrator User Backups Server Day 1 Attacker
49 Bug: Zombie Logon Sessions! :Admi nistrator:cdb 70D9EDA812 DBF:C9DF712 D09D7DF1C Controller (DC) Administrator User Backups Server Administrator logs off, disconnects, finished what he/she was doing.. Day 1 Attacker
50 Bug: Zombie Logon Sessions! :Admi nistrator:cdb 70D9EDA812 DBF:C9DF712 D09D7DF1C Controller (DC) Administrator Backups Server BUG! Windows does not erase from memory NTLM hashes! Day 1 User Attacker
51 Bug: Zombie Logon Sessions! :Admi nistrator:cdb 70D9EDA812 DBF:C9DF712 D09D7DF1C Controller (DC) Administrator User Backups Server Attacker Day 31.. ~ A month later..
52 WCE: Pass-the-Ticket (Kerberos) New attack implemented by WCE v1.2 First and only tool that implements this AFAIK Post-exploitation Equivalent to Pass-The-Hash for NTLM You can steal Kerberos TGT/tickets & use them in other Windows and *Unix boxes
53 WCE: Pass-the-Ticket (Kerberos) Stolen tickets can be used to access remote services Example: SMB shares The TGT (Ticket Granting Ticket) can be used to create new tickets Gain access to more services / computers
54 Conclusions WCE brings new post-exploitation techniques Pass-the-Hash (NTLM) Steal NTLM from memory Pass-the-ticket (Kerberos) Useful for pentests You need to know them to defend yourself Not just to attack..
55 More information WCE Internals Presentation RootedCon 2011; Madrid, España More technical details about implementation Internals_RootedCon2011_ampliasecurity.pdf
56 Questions?
Computers Gone Rogue. Abusing Computer Accounts to Gain Control in an Active Directory Environment. Marina Simakov & Itai Grady
Computers Gone Rogue Abusing Computer Accounts to Gain Control in an Active Directory Environment Marina Simakov & Itai Grady Motivation Credentials are a high value target for attackers No need for 0-day
Windows authentication methods and pitfalls
Windows authentication methods and pitfalls hashes and protocols vulnerabilities attacks 1996-2013 - P. Veríssimo All rights reserved. Reproduction only by permission 1 EXAMPLE: Windows authentication
Active Directory Attacks and Detection
Active Directory Attacks and Detection #Whoami Working as an Information Security Executive Blog : www.akijosberryblog.wordpress.com You can follow me on Twitter: @AkiJos This talk is Based on Tim Madin
Pentesting Windows Domains
Pentesting Windows Domains Active Directory security model and weaknesses 2017-01-09 Jean MARSAULT AGENDA / 01 Introduction / 02 The Active Directory model & Windows domains / 03 Pentesting Windows domains
Hunting Lateral Movement with Windows Events Logs. SANS Threat Hunting Summit 2018 Mauricio
Hunting Lateral Movement with Windows Events Logs SANS Threat Hunting Summit 2018 Mauricio Velazco @mvelazco $whoami Peruvian Recovering pentester, threat management lead @mvelazco Derbycon, Bsides, Defcon
Radius, LDAP, Radius, Kerberos used in Authenticating Users
CSCD 303 Lecture 5 Fall 2018 Radius, LDAP, Radius, Kerberos used in Authenticating Users Kerberos Authentication and Authorization Previously Said that identification, authentication and authorization
Keywords: Pass the Hash, PtH, NTLM hash, Windows authentication, credential security
Pass the Hash Defense: Analysis of Strategies to Mitigate Weaknesses in Microsoft NTLM Authentication Andrew Coates and Stephanie Sanders Department of Computer Science and Electrical Engineering University
Useful Hacking Series
Useful Hacking Series Welcome to the Useful Hacking Series, in this series of 20 Episodes our world-renowned penetration tester/international speaker will share with you the top useful tips used during
Windows Hash Reinjection Using GSECDUMP and MSVCTL By Deron Grzetich
Windows Hash Reinjection Using GSECDUMP and MSVCTL By Deron Grzetich Intro The objective of this exercise is to prove that gsecdump and msvctl actually work as prescribed. These tools can be used to reinject
Pass-the-Hash Attacks. Michael Grafnetter
Pass-the-Hash Attacks Michael Grafnetter www.dsinternals.com Agenda PtH Attack Anatomy Mitigation Proactive Reactive Windows 10 + Windows Server 2016 PtH History and Future 1988 Microsoft releases Lan
Bojan Ždrnja, CISSP, GCIA, GCIH, GWAPT INFIGO IS
Laterally pwning Windows Bojan Ždrnja, CISSP, GCIA, GCIH, GWAPT Bojan.Zdrnja@infigo.hr INFIGO IS http://www.infigo.hr Who am I? Senior information security consultant at INFIGO IS Penetration testing (all
Mike Pilkington. SANS Forensics and IR Summit June, 2011
Mike Pilkington SANS Forensics and IR Summit June, 2011 Since graduating from UT- for a large oil and gas services company Systems Admin, Network Admin, and Security Analyst My current role focuses on
Pass-the-Hash Attacks
Pass-the-Hash Attacks Mgr. Michael Grafnetter www.dsinternals.com Agenda PtH Attack Anatomy Mitigation Proactive Reactive Windows 10 + Windows Server 2016 Microsoft Advanced Threat Analytics PtH Attack
n Describe the CEH hacking methodology and system hacking steps n Describe methods used to gain access to systems
Outline n Describe the CEH hacking methodology and system hacking steps n Describe methods used to gain access to systems n Describe methods used to escalate privileges Chapter #5: n Describe methods used
IMPLEMENTING MICROSOFT CREDENTIAL GUARD FOR ISO 27001, PCI, AND FEDRAMP
IMPLEMENTING MICROSOFT CREDENTIAL GUARD FOR ISO 27001, PCI, AND FEDRAMP North America Latin America Europe 877.224.8077 info@coalfire.com coalfire.com Coalfire sm and CoalfireOne sm are registered service
When the admin fails on security Christoph Falta ITSECX
When the admin fails on security Christoph Falta ITSECX 2012 09.11.2012 What s this all about? Point out common vulnerabilities in a windows environmnet Point out attack scenarios that leverage these vulnerabilities
Attacking and Defending Active Directory July, 2017
Attacking and Defending Active Directory July, 2017 About: Adam Steed - @aboy 20 years of experience in IAM, working for financial, websites, and healthcare organizations Associate Director Protiviti Security
Configuring Request Authentication and Authorization
CHAPTER 15 Configuring Request Authentication and Authorization Request authentication and authorization is a means to manage employee use of the Internet and restrict access to online content. This chapter
Man-In-The-Browser Attacks. Daniel Tomescu
Man-In-The-Browser Attacks Daniel Tomescu 1 About me Work and education: Pentester @ KPMG Romania Moderator @ Romanian Security Team MSc. Eng. @ University Politehnica of Bucharest OSCP, CREST CRT Interests:
ALL ROADS LEAD TO DOMAIN ADMIN BREACH TO CDE A SECTOR CONFERENCE PRESENTATION OCTOBER 2016
BREACH TO CDE ALL ROADS LEAD TO DOMAIN ADMIN A SECTOR CONFERENCE PRESENTATION OCTOBER 2016 Introduction Yannick Bedard Security Consultant Network Penetration Testing SpiderLabs, Trustwave email: ybedard.infosec@gmail.com
Active Directory Attacks and Detection Part -II
Active Directory Attacks and Detection Part -II #Whoami Working as an Information Security Executive Blog : www.akijosberryblog.wordpress.com You can follow me on Twitter: @AkiJos Key Takeaways How to
KERBEROS PARTY TRICKS
KERBEROS PARTY TRICKS Weaponizing Kerberos Protocol Flaws Geoffrey Janjua Who is Exumbra Operations Group? Security services and consulting Specialized services: Full scope red-team testing, digital and
Detecting Lateral Movement in APTs ~Analysis Approach on Windows Event Logs~ June 17, 2016 Shingo ABE ICS security Response Group JPCERT/CC
Detecting Lateral Movement in APTs ~Analysis Approach on Windows Event Logs~ June 17, 2016 Shingo ABE ICS security Response Group JPCERT/CC Agenda Introduction to JPCERT/CC About system-wide intrusions
10 Active Directory Misconfigurations That Lead to Total Compromise Austin, TX 201 W 5th St.
10 Active Directory Misconfigurations That Lead to Total Compromise hello@javelin-networks.com +1-888-867-5179 Austin, TX 201 W 5th St. 1. Group Policy Preferences Visible Passwords Group Policy Preferences
WHITEPAPER ATTIVO NETWORKS THREATDEFEND PLATFORM AND THE MITRE ATT&CK MATRIX
WHITEPAPER ATTIVO NETWORKS THREATDEFEND PLATFORM AND THE MITRE ATT&CK MATRIX 1 INTRODUCTION The MITRE Corporation Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK ) Matrix provides a model
CSCI 667: Concepts of Computer Security. Lecture 9. Prof. Adwait Nadkarni
CSCI 667: Concepts of Computer Security Lecture 9 Prof. Adwait Nadkarni 1 Derived from slides by William Enck, Micah Sherr, Patrick McDaniel, Peng Ning, and Vitaly Shmatikov Authentication Alice? Bob?
The return of the vampires
The return of the vampires Günther Deschner (Red Hat / Samba Team) Windows replication protocols Windows NT 4 Single Master replication Per Domain: One primary (PDC) and many Backup Domain
Authentication System
A Biologically Inspired Password Authentication System Dipankar Dasgupta and Sudip Saha Center for Information Assurance University of Memphis Memphis, TN 38152 Outline Motivation Position Authentication
User Authentication. Modified By: Dr. Ramzi Saifan
User Authentication Modified By: Dr. Ramzi Saifan Authentication Verifying the identity of another entity Computer authenticating to another computer Person authenticating to a local/remote computer Important
Radius, LDAP, Radius used in Authenticating Users
CSCD 303 Lecture 5 Fall 2017 Kerberos Radius, LDAP, Radius used in Authenticating Users Introduction to Centralized Authentication Kerberos is for authentication only and provides Single Sign-on (SSO)
PASSWORDS & ENCRYPTION
PASSWORDS & ENCRYPTION Villanova University Department of Computing Sciences D. Justin Price Fall 2014 CRYPTOGRAPHY Hiding the meaning of a message from unintended recipients. Open source algorithms are
CompTIA. PT0-001 EXAM CompTIA PenTest+ Certification Exam Product: Demo. m/
Page No 1 https://www.dumpsplanet.com m/ CompTIA PT0-001 EXAM CompTIA PenTest+ Certification Exam Product: Demo For More Information: PT0-001-dumps Page No 2 Question: 1 During a penetration test, a tester
AUTHENTICATION. Do You Know Who You're Dealing With? How Authentication Affects Prevention, Detection, and Response
AUTHENTICATION Do You Know Who You're Dealing With? How Authentication Affects Prevention, Detection, and Response Who we are Eric Scales Mandiant Director IR, Red Team, Strategic Services Scott Koller
Configuring Content Authentication and Authorization on Standalone Content Engines
CHAPTER 10 Configuring Content Authentication and Authorization on Standalone Content Engines This chapter describes how to configure content authentication and authorization on standalone Content Engines
Event Log 101. What is Event Log? Windows version of syslog.
Event Log Analysis Event Log 101 What is Event Log? Windows version of syslog. Where are these artifacts located in? %SystemRoot%\System32\winevt\Logs %SystemRoot% is C:\Windows typically. 2 Event Log
Becoming the Adversary
SESSION ID: CIN-R06 Becoming the Adversary Tyrone Erasmus Managing Security Consultant MWR InfoSecurity @metall0id /usr/bin/whoami Most public research == Android Something different today 2 Overview Introduction
Optimized Attack for NTLM2 Session Response
Optimized Attack for NTLM2 Session Response Daiji Sanai & Hidenobu Seki SecurityFriday.com 2004.10.15 Topics of Discussion Is Windows authentication really weak? Learn more about Windows authentications.
The Common Access Card The problems it solves (and the ones it doesn t) Quest Software/One Identity Dan Conrad Federal CTO
The Common Access Card The problems it solves (and the ones it doesn t) Quest Software/One Identity Dan Conrad Federal CTO 1 Disclaimer The views expressed in this presentation are those of the author(s)
Hacking in the Attack Kill Chain
Hacking in the Attack Kill Chain Håkan Nohre, Consulting Systems Engineer, GIAC GPEN #9666, CISSP #76731 Erkan Djafer, Consulting Systems Engineer, CISSP #535930 Chung-wai Lee, Cyber Security Partner Account
Configuring Remote Access using the RDS Gateway
Configuring Remote Access using the RDS Gateway Author: AC, SNE Contents Introduction... 3 Pre-requisites... 3 Supported Operating Systems... 3 Installing the I.T. Services Certificate Authority Root Certificate...
Network Security: Kerberos. Tuomas Aura
Network Security: Kerberos Tuomas Aura Kerberos authentication Outline Kerberos in Windows domains 2 Kerberos authentication 3 Kerberos Shared-key protocol for user login authentication Uses passwords
CS 290 Host-based Security and Malware. Christopher Kruegel
CS 290 Host-based Security and Malware Christopher Kruegel chris@cs.ucsb.edu Windows Windows > 90 % of all computers run Windows when dealing with security issues, it is important to have (some) knowledge
Server. Client LSA. Winlogon LSA. Library SAM SAM. Local logon NTLM. NTLM/Kerberos. EIT060 - Computer Security 2
Local and Domain Logon User accounts and groups Access tokens Objects and security descriptors The Register Some features in Windows 7 and Windows 8 Windows XP evolved from Windows 2000 Windows 10, 8,
MCSM:Directory2012 MCM:Directory2008 MVP:Enterprise Security Certified Ethical Hacker CISA.
NTLM Ing. Ondřej Ševeček GOPAS a.s. MCSM:Directory2012 MCM:Directory2008 MVP:Enterprise Security Certified Ethical Hacker CISA ondrej@sevecek.com www.sevecek.com GOPAS: info@gopas,cz www.gopas.cz www.facebook.com/p.s.gopas
The workstation account, netlogon schannel and credentials. SambaXP Volker Lendecke Samba Team / SerNet
The workstation account, netlogon schannel and credentials SambaXP 2018 Göttingen Volker Lendecke Samba Team / SerNet 2018-06-06 Volker Lendecke Samba Status (2 / 10) Why this talk? To me, NETLOGON and
ETHICAL HACKING LAB SERIES. Lab 7: Breaking Windows Passwords
ETHICAL HACKING LAB SERIES Lab 7: Breaking Windows Passwords Certified Ethical Hacking Domain: System Hacking Document Version: 2015-08-14 otherwise noted, is licensed under the Creative Commons Attribution
From Public Key to Exploitation: Exploiting the Authentication in MS-RDP [CVE ]
![From Public Key to Exploitation: Exploiting the Authentication in MS-RDP [CVE ]](/thumbs/78/78528823.jpg "From Public Key to Exploitation: Exploiting the Authentication in MS-RDP [CVE ]")
From Public Key to Exploitation: Exploiting the Authentication in MS-RDP [CVE-2018-0886] Eyal Karni, Preempt Research Team Contents 1. Introduction...3 2. Vulnerability...4 2.1 Issue #1...4 2.2 Toward
Remote Administration
Windows Remote Desktop, on page 1 pcanywhere, on page VNC, on page 6 Windows Remote Desktop Remote Desktop permits users to remotely execute applications on Windows Server 2012 R2 from a range of devices
Active Directory Attacks and Detection
Active Directory Attacks and Detection #Whoami Working as an Information Security Executive Blog : www.akijosberryblog.wordpress.com You can follow me on Twitter: @AkiJos Lab Setup AJLAB.COM: 2 Domain
Penetration from application down to OS
April 8, 2009 Penetration from application down to OS Getting OS access using Oracle Database unprivileged user Digitаl Security Research Group (DSecRG) Alexandr Polyakov research@dsecrg.com www.dsecrg.com
Single Sign-On Showdown
Single Sign-On Showdown ADFS vs Pass-Through Authentication Max Fritz Solutions Architect SADA Systems #ITDEVCONNECTIONS Azure AD Identity Sync & Auth Timeline 2009 2012 DirSync becomes Azure AD Sync 2013
PxM Proof of Concept Configuration. June 2018 Version 3.1
PxM Proof of Concept Configuration June 2018 Version 3.1 Table of Contents PxM Architecture, Installation & Configuration... 3 PxM Proof of Concept (POC) Guide... 4 Introduction... 4 Prerequisites... 4
A Process is No One: Hunting for Token Manipulation. Jared Atkinson & Robby Winchester
Jared Atkinson Robert Winchester A Process is No One: Hunting for Token Manipulation Jared Atkinson & Robby Winchester @jaredcatkinson Adversary Detection Technical Lead @ SpecterOps Developer: PowerForensics
RID HIJACKING Maintaining Access on Windows Machines.
RID HIJACKING Maintaining Access on Windows Machines. Security Conference Bogotá, Colombia. 2018 Agenda 0x01. Exposing the RID Hijacking Attack. 0x02. Windows Logon in a nutshell. 0x03. Hijacking the RID.
Holistic Database Security
Holistic Database Security 1 Important Terms Exploit: Take advantage of a flaw or feature Attack Surface: Any node on the network that can be attacked. That can be the UI, People, anything that touches
Joe Stocker, CISSP, MCITP, VTSP Patriot Consulting
Joe Stocker, CISSP, MCITP, VTSP Patriot Consulting Microsoft Cloud Evangelist at Patriot Consulting Principal Systems Architect with 17 Years of experience Technical certifications: MCSE, MCITP Office
Password policy settings control the complexity and lifetime for passwords. This section discusses each specific password policy setting
Windows Security Reference This document is a checklist of the security options with reference material (provided by Microsoft) for a Windows server implementation. The options are based on Windows 2003
TLS Client Certificate and Smart Card Logon
TLS and Smart Card Logon Ing. Ondřej Ševeček GOPAS a.s. MCSM:Directory2012 MCM:Directory2008 MVP:Enterprise Security CEH: Certified Ethical Hacker CHFI: Computer Hacking Forensic Investigator CISA ondrej@sevecek.com
CNIT 124: Advanced Ethical Hacking. Ch 9: Password Attacks
CNIT 124: Advanced Ethical Hacking Ch 9: Password Attacks Topics Password Management Online Password Attacks Offline Password Attacks Dumping Passwords from RAM Password Management Password Alternatives
Deploy and Configure Microsoft LAPS. Step by step guide and useful tips
Deploy and Configure Microsoft LAPS Step by step guide and useful tips 2 Table of Contents Challenges today... 3 What is LAPS... 4 Emphasis and Tips... 5 How LAPS Work... 6 Components... 6 Prepare, Deploy
[MS-SAMR]: Security Account Manager (SAM) Remote Protocol (Clientto-Server)
![[MS-SAMR]: Security Account Manager (SAM) Remote Protocol (Clientto-Server)](/thumbs/78/77739548.jpg "[MS-SAMR]: Security Account Manager (SAM) Remote Protocol (Clientto-Server)")
[MS-SAMR]: Security Account Manager (SAM) Remote Protocol (Clientto-Server) This topic lists the Errata found in [MS-SAMR] since it was last published. Since this topic is updated frequently, we recommend
Rootkits and Trojans on Your SAP Landscape
Rootkits and Trojans on Your SAP Landscape SAP Security and the Enterprise Ertunga Arsal SAP systems are the heart of many enterprises. Most critical business functions run on SAP Applications and the
Modern Realities of Securing Active Directory & the Need for AI
Modern Realities of Securing Active Directory & the Need for AI Our Mission: Hacking Anything to Secure Everything 7 Feb 2019 Presenters: Dustin Heywood (EvilMog), Senior Managing Consultant, X-Force Red
Security and Authentication
Security and Authentication Authentication and Security A major problem with computer communication Trust Who is sending you those bits What they allow to do in your system 2 Authentication In distributed
Authentication, Authorization, and Accounting
Authentication, Authorization, and Accounting LESSON 2 OBJECTIVE DOMAIN MATRIX SKILLS/CONCEPTS MTA EXAM OBJECTIVE MTA EXAM OBJECTIVE NUMBER Starting Security with Understand user authentication. 2.1 Authentication
Use offense to inform defense. Find flaws before the bad guys do.
Use offense to inform defense. Find flaws before the bad guys do. Copyright SANS Institute Author Retains Full Rights This paper is from the SANS Penetration Testing site. Reposting is not permited without
User Authentication. Modified By: Dr. Ramzi Saifan
User Authentication Modified By: Dr. Ramzi Saifan Authentication Verifying the identity of another entity Computer authenticating to another computer Person authenticating to a local/remote computer Important
Kerberos V Security: Replay Attacks
Abstract Kerberos V Security: Replay Attacks Kerberos V is a trusted third-party authentication mechanism designed for TCP/IP networks. It uses strong symmetric cryptography to enable secure authentication
Evolution Of Cyber Threats & Defense Approaches
Evolution Of Cyber Threats & Defense Approaches Antony Abraham IT Architect, Information Security, State Farm Kevin McIntyre Tech Lead, Information Security, State Farm Agenda About State Farm Evolution
Security Course. WebGoat Lab sessions
Security Course WebGoat Lab sessions WebGoat Lab sessions overview Initial Setup Tamper Data Web Goat Lab Session 4 Access Control, session information stealing Lab Session 2 HTTP Basics Sniffing Parameter
29 March 2017 SECURITY SERVER INSTALLATION GUIDE
29 March 2017 SECURITY SERVER INSTALLATION GUIDE Contents 1. Introduction... 2 1.1 Assumptions... 2 1.2 Prerequisites... 2 2. Required setups prior the Security Server Installation... 3 1.1 Create domain
Pass-the-hash attacks: Tools and Mitigation
Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Pass-the-hash
Windows Authentication With Multiple Domains and Forests
Windows Authentication With Multiple Domains and Forests Stefan Metzmacher Samba Team / SerNet 2017-09-13 Check for updates: https://samba.org/~metze/presentations/2017/sdc/ Update from
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 24 April 16, 2012 CPSC 467b, Lecture 24 1/33 Kerberos Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management
CNIT 125: Information Security Professional (CISSP Preparation) Ch 6. Identity and Access Management
CNIT 125: Information Security Professional (CISSP Preparation) Ch 6. Identity and Access Management Authentication Methods Authentication Methods Type 1: Something you know Easiest and weakest method
OS Security. Authentication. Radboud University Nijmegen, The Netherlands. Winter 2014/2015
OS Security Authentication Radboud University Nijmegen, The Netherlands Winter 2014/2015 What does an OS do? Definition An operating system (OS) is a computer program that manages access of processes (programs)
Facebook API Breach. Jake Williams Rendition Infosec
Facebook API Breach Jake Williams (@MalwareJake) Rendition Infosec www.rsec.us @RenditionSec Facebook View As Facebook allows users/developers to see what a profile page looks like from another user s
Rick Redman, Title, KoreLogic Governance, Risk & Compliance G24
Succe What Audits Miss & How Penetration Testers Abuse Those Gaps Rick Redman, Title, KoreLogic Governance, Risk & Compliance G24 CRISC CGEIT CISM CISA Intro Rick Redman / Minga / @CrackMeIfYouCan KoreLogic.com
The of Passw0rds: Notes from the field
The L@m3ne55 of Passw0rds: Notes from the field Ben Williams Senior Security Consultant Previously Presented at various conferences including BlackHat and other smaller conferences in Europe Exploitable
Connect-2-Everything SAML SSO (client documentation)
Connect-2-Everything SAML SSO (client documentation) Table of Contents Summary Overview Refined tags Summary The Connect-2-Everything landing page by Refined Data allows Adobe Connect account holders to
Cross-realm trusts with FreeIPA v3
Cross-realm trusts with FreeIPA v3 Alexander Bokovoy, Andreas Scheider Alexander Bokovoy about:me Member of Samba Team since 2003 Principal Software Engineer, Red Hat FreeIPA project Andreas Schneider
Security Handshake Pitfalls
Security Handshake Pitfalls 1 Authentication Handshakes Secure communication almost always includes an initial authentication handshake: Authenticate each other Establish sessions keys This process may
IT Governance Committee Review and Recommendation
IT Governance Committee Review and Recommendation Desired Change: Approval of this policy will establish Security Standards for the UCLA Logon Identity for anyone assigned a UCLA Logon ID/password and
An Analysis of Local Security Authority Subsystem
An Analysis of Local Security Authority Subsystem Shailendra Nigam Computer Science & Engineering Department DIET, Kharar Mohali(Punjab) India. Sandeep Kaur Computer Science & Engineering Department BBSBEC,
Stamp Out Hash Corrup/on, Crack All the Things!
Stamp Out Hash Corrup/on, Crack All the Things! Ryan Reynolds Manager, Crowe Horwath Pentester TwiAer: @reynoldsrb Jonathan Claudius SpiderLabs Security Researcher, Trustwave Vulnerability Research TwiAer:
Kerberos MIT protocol
Kerberos MIT protocol December 11 th 2009 Amit Shinde Kerberos MIT protocol Motivation behind the design Overview of Kerberos Protocol Kerberized applications Attacks and Security analysis Q & A Motivations
Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 7 Access Control Fundamentals
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 7 Access Control Fundamentals Objectives Define access control and list the four access control models Describe logical access control
HP 2012 Cyber Security Risk Report Overview
HP 2012 Cyber Security Risk Report Overview September 2013 Paras Shah Software Security Assurance - Canada Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject
Configure advanced audit policies
7 LESSON Configuring Advanced Audit Policies 70-411 EXAM OBJECTIVE Objective 2.4 Configure advanced audit policies. This objective may include but is not limited to: implement auditing using Group Policy
OS Security. Authentication. Radboud University Nijmegen, The Netherlands. Winter 2014/2015
OS Security Authentication Radboud University Nijmegen, The Netherlands Winter 2014/2015 What does an OS do? Definition An operating system (OS) is a computer program that manages access of processes (programs)
Kerberos and Active Directory symmetric cryptography in practice COSC412
Kerberos and Active Directory symmetric cryptography in practice COSC412 Learning objectives Understand the function of Kerberos Explain how symmetric cryptography supports the operation of Kerberos Summarise
MASSACHUSETTS INSTITUTE OF TECHNOLOGY Fall Quiz II
Department of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY 6.893 Fall 2009 Quiz II All problems are open-ended questions. In order to receive credit you must answer
the SWIFT Customer Security
TECH BRIEF Mapping BeyondTrust Solutions to the SWIFT Customer Security Controls Framework Privileged Access Management and Vulnerability Management Table of ContentsTable of Contents... 2 Purpose of This
What You Need to Use this Book
What You Need to Use this Book The following is the list of recommended system requirements for running the code in this book: Windows 2000 Professional or Windows XP Professional with IIS installed Visual
Kerberos. Pehr Söderman Natsak08/DD2495 CSC KTH 2008
Kerberos Pehr Söderman Pehrs@kth.se Natsak08/DD2495 CSC KTH 2008 Project Athena Started 1983 at MIT 10 000 workstations 1000 servers Unified enviroment Any user, any workstation, any server, anywhere...
Cloud Access Manager Overview
Cloud Access Manager 8.1.3 Overview Copyright 2017 One Identity LLC. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished
Protecting Against Modern Attacks. Protection Against Modern Attack Vectors
Protecting Against Modern Attacks Protection Against Modern Attack Vectors CYBER SECURITY IS A CEO ISSUE. - M C K I N S E Y $4.0M 81% >300K 87% is the average cost of a data breach per incident. of breaches
Global Information Assurance Certification Paper. Copyright SANS Institute Author Retains Full Rights
Global Information Assurance Certification Paper Copyright SANS Institute Author Retains Full Rights This paper is taken from the GIAC directory of certified professionals. Reposting is not permited without
1 About Web Security. What is application security? So what can happen? see [?]
![1 About Web Security. What is application security? So what can happen? see [?]](/thumbs/85/92997588.jpg "1 About Web Security. What is application security? So what can happen? see [?]")
1 About Web Security What is application security? see [?] So what can happen? 1 taken from [?] first half of 2013 Let s focus on application security risks Risk = vulnerability + impact New App: http://www-03.ibm.com/security/xforce/xfisi
Unified CCE Security Compliance for Windows Server 2012 R2
Unified CCE Security Compliance for Windows Server 2012 R2 This topic contains the security baseline for hardening Windows Server 2012 R2 Servers running Unified CCE. This baseline is essentially a collection