1 1 00:00:00,570 --> 00:00:01,773 Lateral movement. 2 2 00:00:02,940 --> 00:00:05,040 Now, we talked about lateral movement already 3 3 00:00:05,040 --> 00:00:06,960 and I already provided a couple of examples 4 4 00:00:06,960 --> 00:00:08,280 or techniques that we can use 5 5 00:00:08,280 --> 00:00:10,260 for lateral movement as an attacker 6 6 00:00:10,260 --> 00:00:11,820 if you're working as a pen tester, 7 7 00:00:11,820 --> 00:00:14,670 things like pass the hash or a golden ticket attack, 8 8 00:00:14,670 --> 00:00:16,950 but there are other ones out there too. 9 9 00:00:16,950 --> 00:00:18,360 And the idea is that an attacker 10 10 00:00:18,360 --> 00:00:20,460 can use any remote access protocol 11 11 00:00:20,460 --> 00:00:22,650 to move from host to host. 12 12 00:00:22,650 --> 00:00:24,300 One of the most common ways they do this 13 13 00:00:24,300 --> 00:00:27,240 is by relying on people using poor passwords. 14 14 00:00:27,240 --> 00:00:29,280 If you have employees in your organization, 15 15 00:00:29,280 --> 00:00:30,113 you can have employees 16 16 00:00:30,113 --> 00:00:32,280 that don't follow good password practices. 17 17 00:00:32,280 --> 00:00:33,990 And the larger your organization, 18 18 00:00:33,990 --> 00:00:36,120 the more often this is going to be true. 19 19 00:00:36,120 --> 00:00:37,980 For example, if we go forward 20 20 00:00:37,980 --> 00:00:41,460 and look at the top 30 passwords that are compromised, 21 21 00:00:41,460 --> 00:00:44,220 you'll see that a lot of them are really kind of silly. 22 22 00:00:44,220 --> 00:00:47,880 For instance, who would set their password to 12345? 23 23 00:00:47,880 --> 00:00:49,500 Well, the reason that's the number one 24 24 00:00:49,500 --> 00:00:50,910 most commonly hacked password 25 25 00:00:50,910 --> 00:00:53,040 is because a lot of people actually do it. 26 26 00:00:53,040 --> 00:00:54,510 And so if you have those people working 27 27 00:00:54,510 --> 00:00:55,470 in your organization, 28 28 00:00:55,470 --> 00:00:58,530 this can actually be something that can be a way 29 29 00:00:58,530 --> 00:00:59,910 that an attacker can laterally move 30 30 00:00:59,910 --> 00:01:01,230 throughout your organization 31 31 00:01:01,230 --> 00:01:03,570 by using different accounts on different machines 32 32 00:01:03,570 --> 00:01:06,000 by going through some of these common passwords. 33 33 00:01:06,000 --> 00:01:08,850 For example, if you look there over on the third column, 34 34 00:01:08,850 --> 00:01:11,503 you'll see one that looks pretty secure: QWERTYUIOP. 35 35 00:01:13,740 --> 00:01:15,930 Now, this one doesn't look bad at first glance, 36 36 00:01:15,930 --> 00:01:17,400 but as you start looking at it, 37 37 00:01:17,400 --> 00:01:19,470 you see those letters look kind of familiar 38 38 00:01:19,470 --> 00:01:21,000 even though they're random. 39 39 00:01:21,000 --> 00:01:22,650 Well, they're actually the first line 40 40 00:01:22,650 --> 00:01:24,450 going across the top of your keyboard 41 41 00:01:24,450 --> 00:01:26,220 and that's why it's a commonly used password, 42 42 00:01:26,220 --> 00:01:27,720 and so this is not secure 43 43 00:01:27,720 --> 00:01:30,600 even though it doesn't look like a standard dictionary word. 44 44 00:01:30,600 --> 00:01:32,940 Now let's take a look at a couple more examples. 45 45 00:01:32,940 --> 00:01:35,760 As I went down the top 100 most commonly used passwords, 46 46 00:01:35,760 --> 00:01:37,740 I found two more that look pretty secure. 47 47 00:01:37,740 --> 00:01:40,170 Number 42 and number 62. 48 48 00:01:40,170 --> 00:01:45,093 Number 42 looks pretty secure: Q1W2E3R4T5Y6. 49 49 00:01:46,980 --> 00:01:48,840 Now at first glance, that looks pretty secure, 50 50 00:01:48,840 --> 00:01:50,580 but if you look at your keyboard again, 51 51 00:01:50,580 --> 00:01:53,340 all they're doing is what's known as keyboard walking. 52 52 00:01:53,340 --> 00:01:56,250 They're alternating between the Q row and the number row 53 53 00:01:56,250 --> 00:02:00,090 and going Q1W2E3 all the way across. 54 54 00:02:00,090 --> 00:02:01,740 And if you look at number 62, 55 55 00:02:01,740 --> 00:02:04,260 this one is doing the same thing but in reverse. 56 56 00:02:04,260 --> 00:02:06,240 So again, just because it looks randomized 57 57 00:02:06,240 --> 00:02:07,380 doesn't mean it is. 58 58 00:02:07,380 --> 00:02:08,580 And so you have to make sure 59 59 00:02:08,580 --> 00:02:11,370 that the passwords your employees are using are secure 60 60 00:02:11,370 --> 00:02:13,170 because if they're not using secure passwords, 61 61 00:02:13,170 --> 00:02:14,910 it's a common way for an attacker 62 62 00:02:14,910 --> 00:02:17,190 to laterally move throughout your system. 63 63 00:02:17,190 --> 00:02:20,490 Now, insecure passwords are going to make our networks weak 64 64 00:02:20,490 --> 00:02:23,370 and much more susceptible to this lateral movement. 65 65 00:02:23,370 --> 00:02:25,230 So we want to make sure we're doing frequent checks 66 66 00:02:25,230 --> 00:02:28,140 of our employee's passwords using good tools 67 67 00:02:28,140 --> 00:02:30,060 as part of our security procedures. 68 68 00:02:30,060 --> 00:02:31,080 So again, remember, 69 69 00:02:31,080 --> 00:02:32,790 most systems rely on usernames 70 70 00:02:32,790 --> 00:02:34,380 and passwords for authentication, 71 71 00:02:34,380 --> 00:02:35,820 and if you're using weak passwords 72 72 00:02:35,820 --> 00:02:37,470 people are going to be able to break in. 73 73 00:02:37,470 --> 00:02:39,150 And when this is done with an administrator account, 74 74 00:02:39,150 --> 00:02:40,920 it's really bad. 75 75 00:02:40,920 --> 00:02:42,810 Alright, so let's keep in mind 76 76 00:02:42,810 --> 00:02:44,220 that we need those secure passwords 77 77 00:02:44,220 --> 00:02:46,410 and we want to make sure they're safe and secure. 78 78 00:02:46,410 --> 00:02:48,030 Now, if we move beyond that, 79 79 00:02:48,030 --> 00:02:49,980 what are some of the other lateral movement techniques 80 80 00:02:49,980 --> 00:02:51,540 that an attacker can use? 81 81 00:02:51,540 --> 00:02:53,250 Well, they can use the same things 82 82 00:02:53,250 --> 00:02:54,780 that system administrators use. 83 83 00:02:54,780 --> 00:02:57,210 That includes things like remote access services, 84 84 00:02:57,210 --> 00:03:01,440 WMIC, PsExec, and Windows PowerShell. 85 85 00:03:01,440 --> 00:03:02,400 Now, these are tools 86 86 00:03:02,400 --> 00:03:04,860 that an assistant administrator uses to do their job, 87 87 00:03:04,860 --> 00:03:06,270 but an attacker can use them 88 88 00:03:06,270 --> 00:03:08,520 for their nefarious purposes as well. 89 89 00:03:08,520 --> 00:03:11,400 First, let's talk about remote access services. 90 90 00:03:11,400 --> 00:03:13,860 This is any combination of hardware and software 91 91 00:03:13,860 --> 00:03:16,350 that enables the remote access tools or information 92 92 00:03:16,350 --> 00:03:19,650 that typically reside on a network of IT devices. 93 93 00:03:19,650 --> 00:03:21,390 Now, it's a complicated way of saying 94 94 00:03:21,390 --> 00:03:24,900 this allows somebody to access a computer from a distance. 95 95 00:03:24,900 --> 00:03:26,910 Now this can be really useful if you're at home 96 96 00:03:26,910 --> 00:03:28,193 and you need to access your computer 97 97 00:03:28,193 --> 00:03:30,180 to able to run something from the office 98 98 00:03:30,180 --> 00:03:32,880 even though you don't have access to all the things. 99 99 00:03:32,880 --> 00:03:36,360 This might be something like a VPN or SSH or Telnet 100 100 00:03:36,360 --> 00:03:38,130 or other services like that. 101 101 00:03:38,130 --> 00:03:40,349 When you're using things like SSH and Telnet 102 102 00:03:40,349 --> 00:03:42,210 and RDP and VNC, 103 103 00:03:42,210 --> 00:03:43,980 this can provide an attacker the ability 104 104 00:03:43,980 --> 00:03:46,320 to laterally move across the network, 105 105 00:03:46,320 --> 00:03:47,490 but they're also useful 106 106 00:03:47,490 --> 00:03:50,130 for our users who need remote access. 107 107 00:03:50,130 --> 00:03:52,500 There is a lot more people working from home 108 108 00:03:52,500 --> 00:03:55,740 and so remote access services are really needed right now. 109 109 00:03:55,740 --> 00:03:58,800 But again, this becomes a major area of vulnerability 110 110 00:03:58,800 --> 00:04:00,210 that attackers will use against you 111 111 00:04:00,210 --> 00:04:03,270 and be able to laterally move around your network with. 112 112 00:04:03,270 --> 00:04:05,953 The second area we want to talk about is WMIC, 113 113 00:04:05,953 --> 00:04:07,590 which is the Windows Management 114 114 00:04:07,590 --> 00:04:09,450 Instrumentation Command-Line. 115 115 00:04:09,450 --> 00:04:11,580 This provides users with a terminal interface 116 116 00:04:11,580 --> 00:04:13,560 and enables administrators to run scripts 117 117 00:04:13,560 --> 00:04:15,420 to manage those computers. 118 118 00:04:15,420 --> 00:04:18,420 Now, the great thing about WMIC as a system administrator 119 119 00:04:18,420 --> 00:04:20,340 is it gives you a lot of power. 120 120 00:04:20,340 --> 00:04:21,870 You can go forward and run scripts 121 121 00:04:21,870 --> 00:04:23,370 and run all sorts of different commands 122 122 00:04:23,370 --> 00:04:25,590 and perform tasks that require a higher level 123 123 00:04:25,590 --> 00:04:26,910 of privilege than normal. 124 124 00:04:26,910 --> 00:04:29,610 But again, if an attacker can get access to it, 125 125 00:04:29,610 --> 00:04:32,340 this becomes a great lateral movement tool for them 126 126 00:04:32,340 --> 00:04:34,050 because they can run processes 127 127 00:04:34,050 --> 00:04:36,090 at higher levels of privilege than normal. 128 128 00:04:36,090 --> 00:04:37,710 They can also do crucial reconnaissance 129 129 00:04:37,710 --> 00:04:40,380 from a remote host using WMIC. 130 130 00:04:40,380 --> 00:04:42,330 They can do everything from looking at processes 131 131 00:04:42,330 --> 00:04:44,760 to dispartitions to BIOS data. 132 132 00:04:44,760 --> 00:04:47,310 All of this can be done through WMIC, 133 133 00:04:47,310 --> 00:04:49,050 and so it is a way that attackers use 134 134 00:04:49,050 --> 00:04:50,880 to laterally move throughout your network. 135 135 00:04:50,880 --> 00:04:53,790 Because of this, WMIC can be a vector 136 136 00:04:53,790 --> 00:04:56,220 in a post-attack lateral movement. 137 137 00:04:56,220 --> 00:04:58,920 The next one we want to talk about is PsExec. 138 138 00:04:58,920 --> 00:05:01,620 This is a tool that's developed as an alternative to Telnet 139 139 00:05:01,620 --> 00:05:03,450 and other remote access services, 140 140 00:05:03,450 --> 00:05:05,340 which utilizes the Windows SYSTEM account 141 141 00:05:05,340 --> 00:05:07,110 for privilege escalation. 142 142 00:05:07,110 --> 00:05:09,150 Again, this is a tool that was developed 143 143 00:05:09,150 --> 00:05:10,740 for system administrators. 144 144 00:05:10,740 --> 00:05:13,110 It is actually part of the sys internals tool suite 145 145 00:05:13,110 --> 00:05:15,180 that was developed by Mark Russinovich. 146 146 00:05:15,180 --> 00:05:16,950 Now again, this is something that was developed 147 147 00:05:16,950 --> 00:05:18,090 for system administrators, 148 148 00:05:18,090 --> 00:05:21,240 but attackers use it for their own benefit as well. 149 149 00:05:21,240 --> 00:05:23,460 This allows them to be able to open back doors, 150 150 00:05:23,460 --> 00:05:26,760 run processes, and elevate permissions across the network 151 151 00:05:26,760 --> 00:05:29,580 on remote systems and run things there. 152 152 00:05:29,580 --> 00:05:32,670 The final thing we want to talk about is Windows PowerShell. 153 153 00:05:32,670 --> 00:05:34,920 Now, Windows PowerShell is a task automation 154 154 00:05:34,920 --> 00:05:37,920 and configuration management framework from Microsoft 155 155 00:05:37,920 --> 00:05:41,220 and it comes by default embedded in your Windows system. 156 156 00:05:41,220 --> 00:05:42,840 It consists of a command line shell 157 157 00:05:42,840 --> 00:05:45,210 and an associated scripting language. 158 158 00:05:45,210 --> 00:05:46,080 Because of that, 159 159 00:05:46,080 --> 00:05:48,300 it gives a lot of powered assistant administrators 160 160 00:05:48,300 --> 00:05:50,520 and in turn, attackers. 161 161 00:05:50,520 --> 00:05:53,340 Attackers also have developed their own exploit kits. 162 162 00:05:53,340 --> 00:05:54,870 One of the most popular ones is known 163 163 00:05:54,870 --> 00:05:56,610 as the PowerShell Empire. 164 164 00:05:56,610 --> 00:05:59,940 This toolkit contains numerous pre-built attack modules 165 165 00:05:59,940 --> 00:06:02,490 and it allows an attacker with ease to go forward 166 166 00:06:02,490 --> 00:06:06,030 and run lots of different programs against your systems 167 167 00:06:06,030 --> 00:06:08,730 with pre-written modules and pre-written exploits. 168 168 00:06:08,730 --> 00:06:10,500 So once you've exploited a system, 169 169 00:06:10,500 --> 00:06:12,990 you can then run PowerShell Empire on it 170 170 00:06:12,990 --> 00:06:15,240 and you'll be able to run all these different modules. 171 171 00:06:15,240 --> 00:06:16,260 For example, here, 172 172 00:06:16,260 --> 00:06:18,720 you can see there are 91 currently loaded modules 173 173 00:06:18,720 --> 00:06:20,940 that I could run against the victim system. 174 174 00:06:20,940 --> 00:06:22,830 Because of the way PowerShell was developed, 175 175 00:06:22,830 --> 00:06:25,560 it has native commandlets as well as the ability 176 176 00:06:25,560 --> 00:06:27,570 to run all sorts of different remote access, 177 177 00:06:27,570 --> 00:06:31,110 WMIC and PsExec tools inside of them as well 178 178 00:06:31,110 --> 00:06:32,580 through those PowerShell scripts 179 179 00:06:32,580 --> 00:06:34,890 and you can even use these pre-built modules 180 180 00:06:34,890 --> 00:06:36,153 from Empire as well.