1 1 00:00:00,480 --> 00:00:02,310 Pass the hash. 2 2 00:00:02,310 --> 00:00:03,210 In this lesson, 3 3 00:00:03,210 --> 00:00:06,120 we're going to talk about the Pass the Hash attack. 4 4 00:00:06,120 --> 00:00:08,730 Now, pass the hash is a network-based attack 5 5 00:00:08,730 --> 00:00:11,280 where the attacker steals hashed user credentials 6 6 00:00:11,280 --> 00:00:14,340 and uses them as-is in order to try to authenticate 7 7 00:00:14,340 --> 00:00:15,510 to the same network 8 8 00:00:15,510 --> 00:00:18,000 that the hash credentials originate on. 9 9 00:00:18,000 --> 00:00:20,280 Now, this is a really complicated way of saying 10 10 00:00:20,280 --> 00:00:22,020 that somebody can steal your password 11 11 00:00:22,020 --> 00:00:23,850 without actually stealing your password, 12 12 00:00:23,850 --> 00:00:26,550 but instead they're stealing your password hash, 13 13 00:00:26,550 --> 00:00:29,220 and they're using that to authenticate to your network. 14 14 00:00:29,220 --> 00:00:31,020 Now, this allows them to have the possibility 15 15 00:00:31,020 --> 00:00:32,400 of presenting that hash 16 16 00:00:32,400 --> 00:00:34,500 without cracking the original password 17 17 00:00:34,500 --> 00:00:37,020 and still be able to authenticate to network protocols 18 18 00:00:37,020 --> 00:00:40,770 such as SMB or Kerberos on a Windows network. 19 19 00:00:40,770 --> 00:00:44,130 So how does a pass the hash attack actually work? 20 20 00:00:44,130 --> 00:00:46,050 Well, first we have a regular user, 21 21 00:00:46,050 --> 00:00:49,530 in this case our victim, who's going to log onto a machine. 22 22 00:00:49,530 --> 00:00:52,020 When they do that, the DC, the domain controller, 23 23 00:00:52,020 --> 00:00:55,140 is going to verify that user using Kerberos. 24 24 00:00:55,140 --> 00:00:57,180 This takes their username and their password, 25 25 00:00:57,180 --> 00:00:59,610 or more accurately the hash of their password, 26 26 00:00:59,610 --> 00:01:02,250 and verifies it with the domain controller. 27 27 00:01:02,250 --> 00:01:05,460 Then we have the user that logs on again a second time. 28 28 00:01:05,460 --> 00:01:07,080 And whenever they log in a second time, 29 29 00:01:07,080 --> 00:01:09,270 instead of going back to that domain controller, 30 30 00:01:09,270 --> 00:01:11,220 it just uses the actual cache 31 31 00:01:11,220 --> 00:01:14,460 that's stored inside the SAM on that workstation. 32 32 00:01:14,460 --> 00:01:16,200 This is done through Kerberos. 33 33 00:01:16,200 --> 00:01:17,460 So by having that, 34 34 00:01:17,460 --> 00:01:20,310 we don't have to go back to the domain controller each time. 35 35 00:01:20,310 --> 00:01:21,450 Now, in our third step, 36 36 00:01:21,450 --> 00:01:23,670 we have an attacker who's actually going to gain access 37 37 00:01:23,670 --> 00:01:26,400 to that workstation using some kind of exploit. 38 38 00:01:26,400 --> 00:01:28,140 Now, whatever specific exploit they're using 39 39 00:01:28,140 --> 00:01:29,190 doesn't matter here. 40 40 00:01:29,190 --> 00:01:30,870 It's just that the attacker gains access 41 41 00:01:30,870 --> 00:01:32,400 to that workstation, 42 42 00:01:32,400 --> 00:01:33,840 and that workstation, once they're on it, 43 43 00:01:33,840 --> 00:01:35,310 they can dump the SAM, 44 44 00:01:35,310 --> 00:01:36,960 which has those cached credentials 45 45 00:01:36,960 --> 00:01:38,880 stored on that victim's computer. 46 46 00:01:38,880 --> 00:01:40,950 Now, once the attacker has dumped that SAM, 47 47 00:01:40,950 --> 00:01:43,500 they can use tools to get those hashed credentials 48 48 00:01:43,500 --> 00:01:45,120 and reveal what they are. 49 49 00:01:45,120 --> 00:01:46,500 Having those hash credentials, 50 50 00:01:46,500 --> 00:01:49,350 the attacker can then use that hash on another computer 51 51 00:01:49,350 --> 00:01:51,570 by being able to log in as that user 52 52 00:01:51,570 --> 00:01:53,370 or on that same computer. 53 53 00:01:53,370 --> 00:01:55,950 If that computer happens to be part of a domain, 54 54 00:01:55,950 --> 00:01:57,720 we can also use those hashed credentials 55 55 00:01:57,720 --> 00:01:59,190 that are recognized by Kerberos 56 56 00:01:59,190 --> 00:02:01,470 on other servers within that domain. 57 57 00:02:01,470 --> 00:02:02,790 And so this is the danger here 58 58 00:02:02,790 --> 00:02:05,010 when we start dealing with pass the hash. 59 59 00:02:05,010 --> 00:02:08,400 Now, pass the hash can be used for lots of different things, 60 60 00:02:08,400 --> 00:02:10,380 but one of the most common things it's used for 61 61 00:02:10,380 --> 00:02:12,120 is to elevate privileges. 62 62 00:02:12,120 --> 00:02:14,400 This is done because a lot of times 63 63 00:02:14,400 --> 00:02:16,080 on those local workstations, 64 64 00:02:16,080 --> 00:02:18,900 the attacker is able to gain local admin privileges 65 65 00:02:18,900 --> 00:02:20,010 because at some point, 66 66 00:02:20,010 --> 00:02:23,010 some admin had logged in locally to that workstation, 67 67 00:02:23,010 --> 00:02:26,280 and those credentials are going to be stored inside the SAM 68 68 00:02:26,280 --> 00:02:27,960 that the attacker was able to dump 69 69 00:02:27,960 --> 00:02:30,030 and then gain the credentials from. 70 70 00:02:30,030 --> 00:02:31,020 Now to do this, 71 71 00:02:31,020 --> 00:02:32,820 they're usually going to use some sort of a tool 72 72 00:02:32,820 --> 00:02:34,710 because it's easier to use an automated tool 73 73 00:02:34,710 --> 00:02:35,880 to do this for you. 74 74 00:02:35,880 --> 00:02:36,840 And as an attacker, 75 75 00:02:36,840 --> 00:02:40,470 one of the most common ones we're going to use is Mimikatz. 76 76 00:02:40,470 --> 00:02:42,810 Mimikatz is an open-source application 77 77 00:02:42,810 --> 00:02:43,950 that allows users to view 78 78 00:02:43,950 --> 00:02:45,900 and save authentication credentials 79 79 00:02:45,900 --> 00:02:48,330 in order to perform pass the hash attacks 80 80 00:02:48,330 --> 00:02:50,430 and other types of attacks like that. 81 81 00:02:50,430 --> 00:02:53,550 Now, the way Mimikatz works is to scan the system memory 82 82 00:02:53,550 --> 00:02:55,380 for any cached passwords. 83 83 00:02:55,380 --> 00:02:56,940 All these passwords have been processed 84 84 00:02:56,940 --> 00:02:59,700 by the Local Security Authority Subsystem Service, 85 85 00:02:59,700 --> 00:03:02,640 or lsass.exe. 86 86 00:03:02,640 --> 00:03:05,130 Now, once they've been stored in this cached memory, 87 87 00:03:05,130 --> 00:03:07,290 Mimikatz can grab those and find those hashes, 88 88 00:03:07,290 --> 00:03:10,620 and then pass those to log you into other services. 89 89 00:03:10,620 --> 00:03:12,750 Now, Mimikatz has been incorporated 90 90 00:03:12,750 --> 00:03:15,420 into a lot of different penetration testing tools 91 91 00:03:15,420 --> 00:03:17,340 and other tools that attackers use. 92 92 00:03:17,340 --> 00:03:19,320 For example, the Metasploit Framework 93 93 00:03:19,320 --> 00:03:21,000 as shown here on the screen. 94 94 00:03:21,000 --> 00:03:23,070 Notice with one simple command, 95 95 00:03:23,070 --> 00:03:27,210 use post/windows/gather/smart_hashdump, 96 96 00:03:27,210 --> 00:03:29,850 we're able to run this command and it will go through 97 97 00:03:29,850 --> 00:03:32,670 and it will run this module against a given target. 98 98 00:03:32,670 --> 00:03:33,503 In this case, 99 99 00:03:33,503 --> 00:03:36,510 it's going against this Windows machine shown here. 100 100 00:03:36,510 --> 00:03:39,030 It's going to go through and grab any of the hashes it finds 101 101 00:03:39,030 --> 00:03:41,670 and dump those to the screen as well as into a file. 102 102 00:03:41,670 --> 00:03:42,503 And in this case, 103 103 00:03:42,503 --> 00:03:45,960 we find the administrator's hash shown here on the screen. 104 104 00:03:45,960 --> 00:03:48,690 Now using Mimikatz, we can use that hash 105 105 00:03:48,690 --> 00:03:50,760 and use that to log in as the administrator 106 106 00:03:50,760 --> 00:03:52,293 and perform further actions. 107 107 00:03:53,280 --> 00:03:55,650 Now, for the exam, it's important to remember 108 108 00:03:55,650 --> 00:03:57,043 that specific tools like Mimikatz 109 109 00:03:57,043 --> 00:03:59,640 and the Metasploit Framework are not covered 110 110 00:03:59,640 --> 00:04:02,160 by the CompTIA CySA+ exam. 111 111 00:04:02,160 --> 00:04:03,150 But if you do move 112 112 00:04:03,150 --> 00:04:06,000 into CompTIA PenTest+ certification later on, 113 113 00:04:06,000 --> 00:04:08,880 you will be expected to know them and how they operate. 114 114 00:04:08,880 --> 00:04:10,320 For this exam though, 115 115 00:04:10,320 --> 00:04:12,870 you just need to understand the concept of pass the hash 116 116 00:04:12,870 --> 00:04:14,670 and what it looks like. 117 117 00:04:14,670 --> 00:04:16,440 Now, let me give you a quick warning here 118 118 00:04:16,440 --> 00:04:17,640 for the real world. 119 119 00:04:17,640 --> 00:04:19,350 In the real world, you want to make sure 120 120 00:04:19,350 --> 00:04:22,020 that you're only using your domain administrative accounts 121 121 00:04:22,020 --> 00:04:24,270 to log into domain controllers. 122 122 00:04:24,270 --> 00:04:27,540 This will prevent pass the hash from exploiting your domain. 123 123 00:04:27,540 --> 00:04:30,180 Because if you use your domain administrative accounts 124 124 00:04:30,180 --> 00:04:32,070 and use them on a regular workstation 125 125 00:04:32,070 --> 00:04:34,620 and that workstation is compromised at some point, 126 126 00:04:34,620 --> 00:04:36,750 they can grab your credentials from that workstation 127 127 00:04:36,750 --> 00:04:39,060 and use it across the entire domain. 128 128 00:04:39,060 --> 00:04:42,180 For this reason, again, domain administrative accounts 129 129 00:04:42,180 --> 00:04:45,810 should only be used to log on to your domain controllers. 130 130 00:04:45,810 --> 00:04:46,987 Now, you may be wondering, 131 131 00:04:46,987 --> 00:04:48,690 "This sounds really bad, Jason, 132 132 00:04:48,690 --> 00:04:50,550 but how can I detect and mitigate 133 133 00:04:50,550 --> 00:04:52,740 against a pass the hash attack?" 134 134 00:04:52,740 --> 00:04:54,900 Well, there's a couple of things you can do. 135 135 00:04:54,900 --> 00:04:56,670 First, it's important to remember 136 136 00:04:56,670 --> 00:05:00,180 that detecting these types of attacks is extremely difficult 137 137 00:05:00,180 --> 00:05:01,470 because the attacker activity 138 138 00:05:01,470 --> 00:05:03,300 cannot easily be differentiated 139 139 00:05:03,300 --> 00:05:05,100 from legitimate authentication 140 140 00:05:05,100 --> 00:05:07,620 because these stolen credentials are allowing the attackers 141 141 00:05:07,620 --> 00:05:09,780 to use standard authentication mechanisms 142 142 00:05:09,780 --> 00:05:11,730 with valid credentials to log in. 143 143 00:05:11,730 --> 00:05:12,780 This creates audit logs 144 144 00:05:12,780 --> 00:05:14,970 that appear to be legitimate user activity. 145 145 00:05:14,970 --> 00:05:15,900 And so this is something 146 146 00:05:15,900 --> 00:05:18,600 that is very hard to detect in real time, 147 147 00:05:18,600 --> 00:05:21,240 and instead, is easier to find after the fact 148 148 00:05:21,240 --> 00:05:22,740 when you're trying to put together your timeline 149 149 00:05:22,740 --> 00:05:24,720 of a breach that's already occurred. 150 150 00:05:24,720 --> 00:05:26,940 The second thing is that most antivirus 151 151 00:05:26,940 --> 00:05:29,850 and antimalware software are going to help you mitigate this 152 152 00:05:29,850 --> 00:05:32,940 by blocking any tools that allow pass the hash attacks. 153 153 00:05:32,940 --> 00:05:35,880 Things like Mimikatz or the Metasploit Framework. 154 154 00:05:35,880 --> 00:05:36,840 Those will all get blocked 155 155 00:05:36,840 --> 00:05:39,690 by most antivirus and antimalware softwares. 156 156 00:05:39,690 --> 00:05:41,400 Now, even though this is true, 157 157 00:05:41,400 --> 00:05:44,220 some attackers will try to still use these tools 158 158 00:05:44,220 --> 00:05:46,170 and they'll try to evade signature detection 159 159 00:05:46,170 --> 00:05:48,780 by doing binary packing and other techniques. 160 160 00:05:48,780 --> 00:05:51,510 But again, these antivirus and antimalware tools 161 161 00:05:51,510 --> 00:05:54,360 should be able to detect most of those tools 162 162 00:05:54,360 --> 00:05:55,193 and try to prevent them 163 163 00:05:55,193 --> 00:05:57,570 from being used on your systems. 164 164 00:05:57,570 --> 00:05:58,800 The third thing to keep in mind 165 165 00:05:58,800 --> 00:06:00,330 is you want to restrict and protect 166 166 00:06:00,330 --> 00:06:02,280 high privileged domain accounts. 167 167 00:06:02,280 --> 00:06:04,140 As I said, your domain accounts 168 168 00:06:04,140 --> 00:06:06,630 should only be logging onto your domain controllers 169 169 00:06:06,630 --> 00:06:08,250 or specific workstations. 170 170 00:06:08,250 --> 00:06:10,470 By limiting the number of workstations you're logging onto 171 171 00:06:10,470 --> 00:06:11,880 with those domain accounts, 172 172 00:06:11,880 --> 00:06:13,320 you could protect those credentials 173 173 00:06:13,320 --> 00:06:14,460 and make sure they're not used 174 174 00:06:14,460 --> 00:06:16,530 in one of these types of attacks. 175 175 00:06:16,530 --> 00:06:19,350 The fourth thing is to restrict and protect local accounts 176 176 00:06:19,350 --> 00:06:21,150 that have administrative privileges. 177 177 00:06:21,150 --> 00:06:23,160 Again, by reducing the number of accounts 178 178 00:06:23,160 --> 00:06:24,540 with administrative privileges, 179 179 00:06:24,540 --> 00:06:26,940 you can end up minimizing the attack 180 180 00:06:26,940 --> 00:06:28,890 of a pass to hash attack. 181 181 00:06:28,890 --> 00:06:30,330 And our fifth thing we want to think about 182 182 00:06:30,330 --> 00:06:33,660 is to restrict inbound traffic using Windows Firewalls 183 183 00:06:33,660 --> 00:06:34,950 on all of our workstations, 184 184 00:06:34,950 --> 00:06:37,290 except for specific ones, for the help desk, 185 185 00:06:37,290 --> 00:06:38,520 security compliance scanners, 186 186 00:06:38,520 --> 00:06:40,410 and other servers in your domain. 187 187 00:06:40,410 --> 00:06:41,820 By restricting inbound traffic 188 188 00:06:41,820 --> 00:06:44,280 going towards your workstations from the outside, 189 189 00:06:44,280 --> 00:06:46,020 you can cut off a lot of these attacks 190 190 00:06:46,020 --> 00:06:48,480 before an attacker can get into your system. 191 191 00:06:48,480 --> 00:06:49,680 All right, so now that we've talked about 192 192 00:06:49,680 --> 00:06:51,000 our five mitigations, 193 193 00:06:51,000 --> 00:06:53,970 let's talk about how we can detect a pass the hash attack 194 194 00:06:53,970 --> 00:06:56,430 in real time using an IDS signature. 195 195 00:06:56,430 --> 00:06:57,450 Can we do that? 196 196 00:06:57,450 --> 00:06:58,920 Well, maybe. 197 197 00:06:58,920 --> 00:07:01,200 Let's take a look at a sample signature. 198 198 00:07:01,200 --> 00:07:04,530 Here on the screen, we have a sample IDS alert. 199 199 00:07:04,530 --> 00:07:05,640 Now, let's take a look at this rule 200 200 00:07:05,640 --> 00:07:07,770 and see if it could be effective for us. 201 201 00:07:07,770 --> 00:07:12,300 First, we see alert syslog $HOME_NET any 202 202 00:07:12,300 --> 00:07:14,310 to $EXTERNAL_NET any. 203 203 00:07:14,310 --> 00:07:15,510 What does this mean? 204 204 00:07:15,510 --> 00:07:17,550 Well, it simply says that we have an alert 205 205 00:07:17,550 --> 00:07:18,960 that's going to be used for syslog 206 206 00:07:18,960 --> 00:07:22,500 anytime traffic goes from the internal network, or HOME_NET, 207 207 00:07:22,500 --> 00:07:25,050 into an external network like the internet, 208 208 00:07:25,050 --> 00:07:26,430 and if it meets those conditions 209 209 00:07:26,430 --> 00:07:28,890 of the rule that we're going to now specify. 210 210 00:07:28,890 --> 00:07:30,210 As we move into the rule, 211 211 00:07:30,210 --> 00:07:33,030 we're going to first put out a message if this rule alerts. 212 212 00:07:33,030 --> 00:07:34,057 We're going to put the message of, 213 213 00:07:34,057 --> 00:07:36,750 "WINDOWS-AUTH Pass-The-Hash detected!" 214 214 00:07:36,750 --> 00:07:39,840 into the logs if the Pearl Compatible Regular Expression, 215 215 00:07:39,840 --> 00:07:41,310 known as PCRE, 216 216 00:07:41,310 --> 00:07:46,310 matches the Windows Event IDs of 4624 and 4625. 217 217 00:07:46,380 --> 00:07:47,670 Now, these two events 218 218 00:07:47,670 --> 00:07:49,260 are something you should be familiar with 219 219 00:07:49,260 --> 00:07:51,270 as you study through Security+ 220 220 00:07:51,270 --> 00:07:53,190 and you become a Windows administrator. 221 221 00:07:53,190 --> 00:07:55,350 Windows Event ID 4624 222 222 00:07:55,350 --> 00:07:58,200 means an account that has successfully logged on, 223 223 00:07:58,200 --> 00:08:00,210 and Windows Event 4625 224 224 00:08:00,210 --> 00:08:02,940 means an account that failed to log on. 225 225 00:08:02,940 --> 00:08:04,860 This rule will monitor for both of these 226 226 00:08:04,860 --> 00:08:06,990 in order to detect both the successful 227 227 00:08:06,990 --> 00:08:09,243 and unsuccessful pass the hash attempts. 228 228 00:08:10,110 --> 00:08:12,180 Next, we're going to look at the content. 229 229 00:08:12,180 --> 00:08:13,710 And we look at the content that we want to match. 230 230 00:08:13,710 --> 00:08:15,930 In this case, the Logon Type of 3, 231 231 00:08:15,930 --> 00:08:18,000 which is an interactive login attempt. 232 232 00:08:18,000 --> 00:08:20,190 This means somebody put in their username and password 233 233 00:08:20,190 --> 00:08:22,140 and tried to log onto the system. 234 234 00:08:22,140 --> 00:08:23,070 We're also going to monitor 235 235 00:08:23,070 --> 00:08:25,590 for the authentication package of NTLM 236 236 00:08:25,590 --> 00:08:26,700 and check that it's content 237 237 00:08:26,700 --> 00:08:29,070 isn't associated with an anonymous log on. 238 238 00:08:29,070 --> 00:08:31,560 Since we have the content exclamation mark here, 239 239 00:08:31,560 --> 00:08:34,650 which signifies a logical not match being used. 240 240 00:08:34,650 --> 00:08:36,930 Saying, "We don't want to match this condition." 241 241 00:08:36,930 --> 00:08:39,690 The next line goes on to make another not match. 242 242 00:08:39,690 --> 00:08:41,250 This time, ensuring that the domain 243 243 00:08:41,250 --> 00:08:43,110 isn't matching a real domain, 244 244 00:08:43,110 --> 00:08:44,880 which would be listed in our variable 245 245 00:08:44,880 --> 00:08:46,890 under the Windows domains 246 246 00:08:46,890 --> 00:08:49,080 for any authorized domains that we want to match 247 247 00:08:49,080 --> 00:08:52,320 inside of this rule and inside of this IDS program. 248 248 00:08:52,320 --> 00:08:54,720 Now, as we go through and we start thinking about all this, 249 249 00:08:54,720 --> 00:08:57,420 I want to give you a quick exam tip here. 250 250 00:08:57,420 --> 00:09:00,000 Now, I know the signature looks really complicated, 251 251 00:09:00,000 --> 00:09:01,110 but the good news is, 252 252 00:09:01,110 --> 00:09:03,870 for the exam, you are not going to be asked to dive deep 253 253 00:09:03,870 --> 00:09:06,540 into an IDS signature like this on the exam. 254 254 00:09:06,540 --> 00:09:07,890 I just wanted to show you this 255 255 00:09:07,890 --> 00:09:09,150 so you can see what is possible 256 256 00:09:09,150 --> 00:09:11,880 as you start looking to identify a pass the hash event 257 257 00:09:11,880 --> 00:09:14,640 using something like an IDS rule. 258 258 00:09:14,640 --> 00:09:17,550 Now, as we go through and we look at this in the real world, 259 259 00:09:17,550 --> 00:09:20,100 could you use this type of an IDS signature 260 260 00:09:20,100 --> 00:09:23,160 to go through and detect a pass the hash attack? 261 261 00:09:23,160 --> 00:09:27,150 Well, the answer is yes, but, this is a big but here, 262 262 00:09:27,150 --> 00:09:30,150 you need to be prepared for a mountain of false positives. 263 263 00:09:30,150 --> 00:09:31,200 Why? 264 264 00:09:31,200 --> 00:09:33,510 Well, if you remember back to earlier in this lesson, 265 265 00:09:33,510 --> 00:09:35,580 I said that a past the hash attack 266 266 00:09:35,580 --> 00:09:37,470 is using someone's real credentials, 267 267 00:09:37,470 --> 00:09:38,940 the hash of their password, 268 268 00:09:38,940 --> 00:09:40,770 to authenticate with the system. 269 269 00:09:40,770 --> 00:09:42,990 So as far as the system is concerned 270 270 00:09:42,990 --> 00:09:44,490 and the security logs look, 271 271 00:09:44,490 --> 00:09:46,650 they're all going to see valid authentication 272 272 00:09:46,650 --> 00:09:48,120 and nothing abnormal. 273 273 00:09:48,120 --> 00:09:50,310 Therefore, this rule is best used 274 274 00:09:50,310 --> 00:09:51,960 after an attack has occurred. 275 275 00:09:51,960 --> 00:09:53,520 In this way, you could start determining 276 276 00:09:53,520 --> 00:09:55,410 exactly how the attacker got in 277 277 00:09:55,410 --> 00:09:56,850 and build your timeline of events 278 278 00:09:56,850 --> 00:09:59,850 for further mitigation and instant response actions. 279 279 00:09:59,850 --> 00:10:01,410 So could you use this? 280 280 00:10:01,410 --> 00:10:02,243 Yes. 281 281 00:10:02,243 --> 00:10:04,290 But in real time, it's really going to bury you 282 282 00:10:04,290 --> 00:10:05,970 under a mountain of false alerts. 283 283 00:10:05,970 --> 00:10:07,320 So I wouldn't recommend it.