Gaining Access In Internal Network (RedTeam)

Will be updated

Transcript

1. GAINING ACCESS IN INTERNAL NETWORK SecureBinary
2. @aidenpearce369 ABOUT ME Monish Kumar Security Consultant, Red Teamer FOLLOW ME aidenpearce369.github.io
3. PWNING AD INTERNAL NETWORK !! AD Environment in Enterprises Lots of Windows Machines to pivot More CVEs & 0-Days Poor Security Misconfiguration Human Errors MOST IMPORTANT: Recon & Patience...
4. COMMON TECHNIQUES ? 0-Days & CVEs Spear Phishing Attack Malwares PII Info Leaks Inside Threat Actor
5. POSSIBLE SCENARIOS: Walk In, Get 'Guest' credentials and Pivot KeyLogger on Victim, Dump creds, Connect Finding secrets from Dorking & etc.. Dropping payloads through phishing & pwn Application related attack vectors (Eg: MS-SQL DB pwned via SQL Injection)
6. WHAT AFTER INITIAL ACCESS???
7. AD
8. More legitimacy, More the chance ! Chaining proxies and redirectors Good domain reputation E-Mail spoofing via poor SPF, DMARC records Frameworks to manage phishing campaigns Using Open Redirection Vulnerability SPEAR PHISHING (INTERNAL) GoPhish + Evilginx2 =
9. THE NTLM PROBLEM !! NO KERBEROS AUTH.. NO PROBLEM
10. NTLMv1, NTLMv2 doesn't matter HASH VALUE
11. LLMNR NBT-NS POISONING ATTACK SCENARIO
12. LLMNR & NBT-NS POISONING RESPONDER TO THE RESCUE *Responder *RedTeamer
13. GOT THE NTLMV2 HASH.. COOL !! *CRACK IT RELAY*
14. NTLM RELAY ATTACK SCENARIO ATTACKER VICTIM TARGET mNR Poisoning 1. 2. Get NTLM hash 3. Relay NTLM hash 4. Get privs
15. RELAYING OVER IPv6 IPv6 enabled by default From Windows Vista ManuallyConfigure IPv6 ? IPv6 DNS >> IPv4 DNS *mitm6 *ntlmrelayx
16. WPAD - Windows Proxy Auto Discovery Phase 1 : Abusing default IPv6 configuration to spoof DNS servers Phase 2: Relay credentials over WPAD to access other services WPAD server has wpad.dat file which contains proxy configuration The PAC (Proxy Auto Configuration) file is responsible for enabling proxy in machines to connect to the internet
17. Windows machine requesting IPv6 config via DHCPv6 protocol mitm6 assigns IPv6 address mitm6 acts as DHCP Attackers IPv6 becomes DNS server mitm6 listens for target domains needed to be spoofed IPv6 DNS will be preferred rather than IPv4 Client starts to request WPAD at the moment it gets connected to IPv6 mitm6 serves wpad.dat through spoofed WPAD server and asks authentication NTLM RELAY
18. THANK THANK YOU YOU