-: Lateral movement. 2 2
Now, we talked about lateral movement already 3 3
and I already provided a couple of examples 4 4
or techniques that we can use 5 5
for lateral movement as an attacker 6 6
if you're working as a pen tester, 7 7
things like pass the hash or a golden ticket attack, 8 8
but there are other ones out there too. 9 9
And the idea is that an attacker 10 10
can use any remote access protocol 11 11
to move from host to host. 12 12
One of the most common ways they do this 13 13
is by relying on people using poor passwords. 14 14
If you have employees in your organization, 15 15
you can have employees 16 16
that don't follow good password practices. 17 17
And the larger your organization, 18 18
the more often this is going to be true. 19 19
For example, if we go forward 20 20
and look at the top 30 passwords that are compromised, 21 21
you'll see that a lot of them are really kind of silly. 22 22
For instance, who would set their password to 12345? 23 23
Well, the reason that's the number one 24 24
most commonly hacked password 25 25
is because a lot of people actually do it. 26 26
And so if you have those people working 27 27
in your organization, 28 28
this can actually be something that can be a way 29 29
that an attacker can laterally move 30 30
throughout your organization 31 31
by using different accounts on different machines 32 32
by going through some of these common passwords. 33 33
For example, if you look there over on the third column, 34 34
you'll see one that looks pretty secure: QWERTYUIOP. 35 35
Now, this one doesn't look bad at first glance, 36 36
but as you start looking at it, 37 37
you see those letters look kind of familiar 38 38
even though they're random. 39 39
Well, they're actually the first line 40 40
going across the top of your keyboard 41 41
and that's why it's a commonly used password, 42 42
and so this is not secure 43 43
even though it doesn't look like a standard dictionary word. 44 44
Now let's take a look at a couple more examples. 45 45
As I went down the top 100 most commonly used passwords, 46 46
I found two more that look pretty secure. 47 47
Number 42 and number 62. 48 48
Number 42 looks pretty secure: Q1W2E3R4T5Y6. 49 49
Now at first glance, that looks pretty secure, 50 50
but if you look at your keyboard again, 51 51
all they're doing is what's known as keyboard walking. 52 52
They're alternating between the Q row and the number row 53 53
and going Q1W2E3 all the way across. 54 54
And if you look at number 62, 55 55
this one is doing the same thing but in reverse. 56 56
So again, just because it looks randomized 57 57
doesn't mean it is. 58 58
And so you have to make sure 59 59
that the passwords your employees are using are secure 60 60
because if they're not using secure passwords, 61 61
it's a common way for an attacker 62 62
to laterally move throughout your system. 63 63
Now, insecure passwords are going to make our networks weak 64 64
and much more susceptible to this lateral movement. 65 65
So we want to make sure we're doing frequent checks 66 66
of our employee's passwords using good tools 67 67
as part of our security procedures. 68 68
So again, remember, 69 69
most systems rely on usernames 70 70
and passwords for authentication, 71 71
and if you're using weak passwords 72 72
people are going to be able to break in. 73 73
And when this is done with an administrator account, 74 74
it's really bad. 75 75
Alright, so let's keep in mind 76 76
that we need those secure passwords 77 77
and we want to make sure they're safe and secure. 78 78
Now, if we move beyond that, 79 79
what are some of the other lateral movement techniques 80 80
that an attacker can use? 81 81
Well, they can use the same things 82 82
that system administrators use. 83 83
That includes things like remote access services, 84 84
WMIC, PsExec, and Windows PowerShell. 85 85
Now, these are tools 86 86
that an assistant administrator uses to do their job, 87 87
but an attacker can use them 88 88
for their nefarious purposes as well. 89 89
First, let's talk about remote access services. 90 90
This is any combination of hardware and software 91 91
that enables the remote access tools or information 92 92
that typically reside on a network of IT devices. 93 93
Now, it's a complicated way of saying 94 94
this allows somebody to access a computer from a distance. 95 95
Now this can be really useful if you're at home 96 96
and you need to access your computer 97 97
to able to run something from the office 98 98
even though you don't have access to all the things. 99 99
This might be something like a VPN or SSH or Telnet 100 100
or other services like that. 101 101
When you're using things like SSH and Telnet 102 102
and RDP and VNC, 103 103
this can provide an attacker the ability 104 104
to laterally move across the network, 105 105
but they're also useful 106 106
for our users who need remote access. 107 107
There is a lot more people working from home 108 108
and so remote access services are really needed right now. 109 109
But again, this becomes a major area of vulnerability 110 110
that attackers will use against you 111 111
and be able to laterally move around your network with. 112 112
The second area we want to talk about is WMIC, 113 113
which is the Windows Management 114 114
Instrumentation Command-Line. 115 115
This provides users with a terminal interface 116 116
and enables administrators to run scripts 117 117
to manage those computers. 118 118
Now, the great thing about WMIC as a system administrator 119 119
is it gives you a lot of power. 120 120
You can go forward and run scripts 121 121
and run all sorts of different commands 122 122
and perform tasks that require a higher level 123 123
of privilege than normal. 124 124
But again, if an attacker can get access to it, 125 125
this becomes a great lateral movement tool for them 126 126
because they can run processes 127 127
at higher levels of privilege than normal. 128 128
They can also do crucial reconnaissance 129 129
from a remote host using WMIC. 130 130
They can do everything from looking at processes 131 131
to dispartitions to BIOS data. 132 132
All of this can be done through WMIC, 133 133
and so it is a way that attackers use 134 134
to laterally move throughout your network. 135 135
Because of this, WMIC can be a vector 136 136
in a post-attack lateral movement. 137 137
The next one we want to talk about is PsExec. 138 138
This is a tool that's developed as an alternative to Telnet 139 139
and other remote access services, 140 140
which utilizes the Windows SYSTEM account 141 141
for privilege escalation. 142 142
Again, this is a tool that was developed 143 143
for system administrators. 144 144
It is actually part of the sys internals tool suite 145 145
that was developed by Mark Russinovich. 146 146
Now again, this is something that was developed 147 147
for system administrators, 148 148
but attackers use it for their own benefit as well. 149 149
This allows them to be able to open back doors, 150 150
run processes, and elevate permissions across the network 151 151
on remote systems and run things there. 152 152
The final thing we want to talk about is Windows PowerShell. 153 153
Now, Windows PowerShell is a task automation 154 154
and configuration management framework from Microsoft 155 155
and it comes by default embedded in your Windows system. 156 156
It consists of a command line shell 157 157
and an associated scripting language. 158 158
Because of that, 159 159
it gives a lot of powered assistant administrators 160 160
and in turn, attackers. 161 161
Attackers also have developed their own exploit kits. 162 162
One of the most popular ones is known 163 163
as the PowerShell Empire. 164 164
This toolkit contains numerous pre-built attack modules 165 165
and it allows an attacker with ease to go forward 166 166
and run lots of different programs against your systems 167 167
with pre-written modules and pre-written exploits. 168 168
So once you've exploited a system, 169 169
you can then run PowerShell Empire on it 170 170
and you'll be able to run all these different modules. 171 171
For example, here, 172 172
you can see there are 91 currently loaded modules 173 173
that I could run against the victim system. 174 174
Because of the way PowerShell was developed, 175 175
it has native commandlets as well as the ability 176 176
to run all sorts of different remote access, 177 177
WMIC and PsExec tools inside of them as well 178 178
through those PowerShell scripts 179 179
and you can even use these pre-built modules 180 180
from Empire as well.