Instructor: Pass the hash. 2 2
In this lesson, 3 3
we're going to talk about the Pass the Hash attack. 4 4
Now, pass the hash is a network-based attack 5 5
where the attacker steals hashed user credentials 6 6
and uses them as-is in order to try to authenticate 7 7
to the same network 8 8
that the hash credentials originate on. 9 9
Now, this is a really complicated way of saying 10 10
that somebody can steal your password 11 11
without actually stealing your password, 12 12
but instead they're stealing your password hash, 13 13
and they're using that to authenticate to your network. 14 14
Now, this allows them to have the possibility 15 15
of presenting that hash 16 16
without cracking the original password 17 17
and still be able to authenticate to network protocols 18 18
such as SMB or Kerberos on a Windows network. 19 19
So how does a pass the hash attack actually work? 20 20
Well, first we have a regular user, 21 21
in this case our victim, who's going to log onto a machine. 22 22
When they do that, the DC, the domain controller, 23 23
is going to verify that user using Kerberos. 24 24
This takes their username and their password, 25 25
or more accurately the hash of their password, 26 26
and verifies it with the domain controller. 27 27
Then we have the user that logs on again a second time. 28 28
And whenever they log in a second time, 29 29
instead of going back to that domain controller, 30 30
it just uses the actual cache 31 31
that's stored inside the SAM on that workstation. 32 32
This is done through Kerberos. 33 33
So by having that, 34 34
we don't have to go back to the domain controller each time. 35 35
Now, in our third step, 36 36
we have an attacker who's actually going to gain access 37 37
to that workstation using some kind of exploit. 38 38
Now, whatever specific exploit they're using 39 39
doesn't matter here. 40 40
It's just that the attacker gains access 41 41
to that workstation, 42 42
and that workstation, once they're on it, 43 43
they can dump the SAM, 44 44
which has those cached credentials 45 45
stored on that victim's computer. 46 46
Now, once the attacker has dumped that SAM, 47 47
they can use tools to get those hashed credentials 48 48
and reveal what they are. 49 49
Having those hash credentials, 50 50
the attacker can then use that hash on another computer 51 51
by being able to log in as that user 52 52
or on that same computer. 53 53
If that computer happens to be part of a domain, 54 54
we can also use those hashed credentials 55 55
that are recognized by Kerberos 56 56
on other servers within that domain. 57 57
And so this is the danger here 58 58
when we start dealing with pass the hash. 59 59
Now, pass the hash can be used for lots of different things, 60 60
but one of the most common things it's used for 61 61
is to elevate privileges. 62 62
This is done because a lot of times 63 63
on those local workstations, 64 64
the attacker is able to gain local admin privileges 65 65
because at some point, 66 66
some admin had logged in locally to that workstation, 67 67
and those credentials are going to be stored inside the SAM 68 68
that the attacker was able to dump 69 69
and then gain the credentials from. 70 70
Now to do this, 71 71
they're usually going to use some sort of a tool 72 72
because it's easier to use an automated tool 73 73
to do this for you. 74 74
And as an attacker, 75 75
one of the most common ones we're going to use is Mimikatz. 76 76
Mimikatz is an open-source application 77 77
that allows users to view 78 78
and save authentication credentials 79 79
in order to perform pass the hash attacks 80 80
and other types of attacks like that. 81 81
Now, the way Mimikatz works is to scan the system memory 82 82
for any cached passwords. 83 83
All these passwords have been processed 84 84
by the Local Security Authority Subsystem Service, 85 85
or lsass.exe. 86 86
Now, once they've been stored in this cached memory, 87 87
Mimikatz can grab those and find those hashes, 88 88
and then pass those to log you into other services. 89 89
Now, Mimikatz has been incorporated 90 90
into a lot of different penetration testing tools 91 91
and other tools that attackers use. 92 92
For example, the Metasploit Framework 93 93
as shown here on the screen. 94 94
Notice with one simple command, 95 95
use post/windows/gather/smart_hashdump, 96 96
we're able to run this command and it will go through 97 97
and it will run this module against a given target. 98 98
In this case, 99 99
it's going against this Windows machine shown here. 100 100
It's going to go through and grab any of the hashes it finds 101 101
and dump those to the screen as well as into a file. 102 102
And in this case, 103 103
we find the administrator's hash shown here on the screen. 104 104
Now using Mimikatz, we can use that hash 105 105
and use that to log in as the administrator 106 106
and perform further actions. 107 107
Now, for the exam, it's important to remember 108 108
that specific tools like Mimikatz 109 109
and the Metasploit Framework are not covered 110 110
by the CompTIA CySA+ exam. 111 111
But if you do move 112 112
into CompTIA PenTest+ certification later on, 113 113
you will be expected to know them and how they operate. 114 114
For this exam though, 115 115
you just need to understand the concept of pass the hash 116 116
and what it looks like. 117 117
Now, let me give you a quick warning here 118 118
for the real world. 119 119
In the real world, you want to make sure 120 120
that you're only using your domain administrative accounts 121 121
to log into domain controllers. 122 122
This will prevent pass the hash from exploiting your domain. 123 123
Because if you use your domain administrative accounts 124 124
and use them on a regular workstation 125 125
and that workstation is compromised at some point, 126 126
they can grab your credentials from that workstation 127 127
and use it across the entire domain. 128 128
For this reason, again, domain administrative accounts 129 129
should only be used to log on to your domain controllers. 130 130
Now, you may be wondering, 131 131
"This sounds really bad, Jason, 132 132
but how can I detect and mitigate 133 133
against a pass the hash attack?" 134 134
Well, there's a couple of things you can do. 135 135
First, it's important to remember 136 136
that detecting these types of attacks is extremely difficult 137 137
because the attacker activity 138 138
cannot easily be differentiated 139 139
from legitimate authentication 140 140
because these stolen credentials are allowing the attackers 141 141
to use standard authentication mechanisms 142 142
with valid credentials to log in. 143 143
This creates audit logs 144 144
that appear to be legitimate user activity. 145 145
And so this is something 146 146
that is very hard to detect in real time, 147 147
and instead, is easier to find after the fact 148 148
when you're trying to put together your timeline 149 149
of a breach that's already occurred. 150 150
The second thing is that most antivirus 151 151
and antimalware software are going to help you mitigate this 152 152
by blocking any tools that allow pass the hash attacks. 153 153
Things like Mimikatz or the Metasploit Framework. 154 154
Those will all get blocked 155 155
by most antivirus and antimalware softwares. 156 156
Now, even though this is true, 157 157
some attackers will try to still use these tools 158 158
and they'll try to evade signature detection 159 159
by doing binary packing and other techniques. 160 160
But again, these antivirus and antimalware tools 161 161
should be able to detect most of those tools 162 162
and try to prevent them 163 163
from being used on your systems. 164 164
The third thing to keep in mind 165 165
is you want to restrict and protect 166 166
high privileged domain accounts. 167 167
As I said, your domain accounts 168 168
should only be logging onto your domain controllers 169 169
or specific workstations. 170 170
By limiting the number of workstations you're logging onto 171 171
with those domain accounts, 172 172
you could protect those credentials 173 173
and make sure they're not used 174 174
in one of these types of attacks. 175 175
The fourth thing is to restrict and protect local accounts 176 176
that have administrative privileges. 177 177
Again, by reducing the number of accounts 178 178
with administrative privileges, 179 179
you can end up minimizing the attack 180 180
of a pass to hash attack. 181 181
And our fifth thing we want to think about 182 182
is to restrict inbound traffic using Windows Firewalls 183 183
on all of our workstations, 184 184
except for specific ones, for the help desk, 185 185
security compliance scanners, 186 186
and other servers in your domain. 187 187
By restricting inbound traffic 188 188
going towards your workstations from the outside, 189 189
you can cut off a lot of these attacks 190 190
before an attacker can get into your system. 191 191
All right, so now that we've talked about 192 192
our five mitigations, 193 193
let's talk about how we can detect a pass the hash attack 194 194
in real time using an IDS signature. 195 195
Can we do that? 196 196
Well, maybe. 197 197
Let's take a look at a sample signature. 198 198
Here on the screen, we have a sample IDS alert. 199 199
Now, let's take a look at this rule 200 200
and see if it could be effective for us. 201 201
First, we see alert syslog $HOME_NET any 202 202
to $EXTERNAL_NET any. 203 203
What does this mean? 204 204
Well, it simply says that we have an alert 205 205
that's going to be used for syslog 206 206
anytime traffic goes from the internal network, or HOME_NET, 207 207
into an external network like the internet, 208 208
and if it meets those conditions 209 209
of the rule that we're going to now specify. 210 210
As we move into the rule, 211 211
we're going to first put out a message if this rule alerts. 212 212
We're going to put the message of, 213 213
"WINDOWS-AUTH Pass-The-Hash detected!" 214 214
into the logs if the Pearl Compatible Regular Expression, 215 215
known as PCRE, 216 216
matches the Windows Event IDs of 4624 and 4625. 217 217
Now, these two events 218 218
are something you should be familiar with 219 219
as you study through Security+ 220 220
and you become a Windows administrator. 221 221
Windows Event ID 4624 222 222
means an account that has successfully logged on, 223 223
and Windows Event 4625 224 224
means an account that failed to log on. 225 225
This rule will monitor for both of these 226 226
in order to detect both the successful 227 227
and unsuccessful pass the hash attempts. 228 228
Next, we're going to look at the content. 229 229
And we look at the content that we want to match. 230 230
In this case, the Logon Type of 3, 231 231
which is an interactive login attempt. 232 232
This means somebody put in their username and password 233 233
and tried to log onto the system. 234 234
We're also going to monitor 235 235
for the authentication package of NTLM 236 236
and check that it's content 237 237
isn't associated with an anonymous log on. 238 238
Since we have the content exclamation mark here, 239 239
which signifies a logical not match being used. 240 240
Saying, "We don't want to match this condition." 241 241
The next line goes on to make another not match. 242 242
This time, ensuring that the domain 243 243
isn't matching a real domain, 244 244
which would be listed in our variable 245 245
under the Windows domains 246 246
for any authorized domains that we want to match 247 247
inside of this rule and inside of this IDS program. 248 248
Now, as we go through and we start thinking about all this, 249 249
I want to give you a quick exam tip here. 250 250
Now, I know the signature looks really complicated, 251 251
but the good news is, 252 252
for the exam, you are not going to be asked to dive deep 253 253
into an IDS signature like this on the exam. 254 254
I just wanted to show you this 255 255
so you can see what is possible 256 256
as you start looking to identify a pass the hash event 257 257
using something like an IDS rule. 258 258
Now, as we go through and we look at this in the real world, 259 259
could you use this type of an IDS signature 260 260
to go through and detect a pass the hash attack? 261 261
Well, the answer is yes, but, this is a big but here, 262 262
you need to be prepared for a mountain of false positives. 263 263
Why? 264 264
Well, if you remember back to earlier in this lesson, 265 265
I said that a past the hash attack 266 266
is using someone's real credentials, 267 267
the hash of their password, 268 268
to authenticate with the system. 269 269
So as far as the system is concerned 270 270
and the security logs look, 271 271
they're all going to see valid authentication 272 272
and nothing abnormal. 273 273
Therefore, this rule is best used 274 274
after an attack has occurred. 275 275
In this way, you could start determining 276 276
exactly how the attacker got in 277 277
and build your timeline of events 278 278
for further mitigation and instant response actions. 279 279
So could you use this? 280 280
Yes. 281 281
But in real time, it's really going to bury you 282 282
under a mountain of false alerts. 283 283
So I wouldn't recommend it.