How Graphs Changed The Way Hackers Attack

1. How Graphs Changed the Way Hackers Attack Andy Robbins
2. Agenda • Prior Work • How Hackers Attack Corporations • The Post-Exploitation Problem • BloodHound • Future Work • Acknowledgements and Conclusion
3. About Me • Job: Adversary Resilience Lead at SpecterOps • Background: Professional penetration tester/red teamer for 5 years • Speaker: BlackHat USA, DEF CON, ISSA International, ISC2 World Congress, ekoparty, Paranoia • Trainer: BlackHat USA, BlackHat Europe, Private Offerings
4. About Us • BloodHound Co-creators: • Rohan Vazarkar - @CptJesus • Job: Senior Red Teamer at SpecterOps • Will Schroeder - @harmj0y • Job: Offensive Capability Engineer at SpecterOps
5. Prior Work
6. http://alicezheng.org/papers/sosp2009-heatray-10pt.pdf
7. https://www.sstic.org/2014/presentation/chemins_de_controle_active_directory/
8. https://blogs.technet.microsoft.com/pfesweplat/2017/01/28/forensics-active-directory-acl- investigation/
9. “Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win.” - John Lambert, General Manager, Microsoft Threat Intelligence Center
10. How Hackers Attack Corporations
11. How Hackers Attack Corporations • Typical stages of an attack: 1. Recon 2. Initial Access 3. Post-Exploitation 4. Exfiltration
12. Recon
13. Initial Access
14. Attacker Target
15. Attacker Target
16. Attacker TargetWorkstation
17. Attacker TargetWorkstation HTTPS
18. Post Exploitation
19. Three Vital Tools • PowerView by Will Schroeder • Mimikatz by Benjamin Delpy • Beacon/Empire/Meterpreter
20. Image: https://www.adsecurity.org
21. Attacker TargetWorkstation HTTPS SMB
22. Exfiltration
23. Attacker TargetWorkstation HTTPS SMB Exfil
24. The Post-Exploitation Problem
25. The Post-Exploitation Problem • Exploits are risky • Situational awareness is time consuming • Effective privileges are complex • But a common, reliable pattern emerged…
26. DA 👤 👤👤 👤 👤 👤 👤
27. BloodHound
28. The BloodHound Graph Design • Design considerations: • Security group delegation • User credential theft • User credential availability • Design goals: • Keep it simple • Keep it flexible enough for future nodes/edges
29. The BloodHound Graph Design http://www.apcjones.com/arrows/#
30. Basic Queries
31. Basic Queries
32. Data Collection: SharpHound • Written by Rohan Vazarkar, based on original PowerShell collector by Will Schroeder • C# compiled binary (or PowerShell script) uses built-in Windows API function calls • Collects data from Domain Controllers and domain-joined workstations and servers • By default, any user can collect this information!
33. Data Analysis: The BloodHound UI • Built with Linkurious • Compiled into an Electron app • Interface with Neo4j via the Neo4j JS driver • Chunked CSV import via UI • Cypher query modal enables custom one-off queries in the BloodHound UI
34. Data Analysis: The BloodHound UI
35. Attack Path Automation • GoFetch by Tal Maor and Itai Grady https://github.com/GoFetchAD/GoFetch • AngryPuppy by Calvin Hedler and Vincent Yiu https://github.com/vysec/ANGRYPUPPY • The Industrial Revolution of Lateral Movement by Tal Be’ery and Tal Maor https://www.blackhat.com/docs/us-17/thursday/us-17- Beery-The-Industrial-Revolution-Of-Lateral- Movement.pdf
36. BloodHound 1.3 • Added 7 edge types to the graph design • This resulted in databases with 10x the number of edges as before • Some performance impact (as expected), but we have some ideas for this  • Number of attack paths exploded
37. http://www.apcjones.com/arrows/#
38. http://www.apcjones.com/arrows/#
39. For more about BloodHound 1.3, see our DerbyCon talk here: https://goo.gl/82RsjT
40. BloodHound 1.4 • Started adding much more information to each node type • This enables extremely interesting analytic queries for us • “Of all the users with a path to Domain Admin, which have the oldest passwords?” • “Find me an attack path that does NOT require going through a Windows server”
41. Future Additions
42. GPO/OU Nodes & Relationships
45. GPOs applied to an object
46. GPOs applied to an object
47. Acknowledgements • Sam Briesemeister for introducing me to graph theory! • Michael Hunger and Max De Marzi at Neo4j • David Rapin, Jean Villedieu and Sébastian Heymann at Linkurious
48. Thank you! • Andy Robbins • Twitter: @_wald0 • Co-creators: Rohan Vazarkar and Will Schroeder • Twitter: @CptJesus @harmj0y • https://www.specterops.io

Editor's Notes

Research target to build out
Gain access to the corporation’s internal network
Typically achieved through social engineering attacks like phishing
Use recon results and network access to determine security controls in place
Elevate privileges locally and in the domain
Use elevated privileges to access data objective
Use recon results and network access to determine security controls in place
Elevate privileges locally and in the domain
Use elevated privileges to access data objective
Get the juicy data out of the network 
THREE MINUTES

Now this network looks pretty similar to the last one, but with a few key differences that we’ll explore in each attack step.

First, again, is initial access. We get a Beacon or Meterpreter Session running within a domain-joined context. Unfortunately for us, we can’t manage to escalate our rights on this initial machine. No GPP. No misconfigured services. No DLL hijack opportunities. No MS08-067, no MS14-068. We can collect some NTLMv2 challenge/response pairs, but can’t crack the very strong passwords. Also, we can’t relay those creds anywhere due to the client enforcing SMB message signing everywhere.

Eventually, though, we do find an initial way to gain local admin rights. A careless admin has left plain text credentials for a service account in an SMB share that any user can read. By impersonating this user and scanning the network, we determine that this service account has admin rights to three systems. Unfortunately for us, this client heavily enforces the principle of least privilege, so this service account only has admin rights on the systems it needs admin rights on. This is where our scope of nominal admin rights begins.

Now, using PowerView, CrackMapExec, Nmap, or another tool, we determine who is logged on to those systems. We find a few more service accounts, but none of them are domain admins. Damn! One by one we compromise those accounts until eventually we gain admin rights on a system with a domain admin logged on. W00t!

By show of hands, how many folks have executed an attack path like this?
“now we have EVERY path to DA”
“now we have EVERY path to DA”

How Graphs Changed The Way Hackers Attack

You are reading a preview.

Check these out next

How Graphs Changed The Way Hackers Attack

More Related Content

Slideshows for you (20)

Similar to How Graphs Changed The Way Hackers Attack (20)

Recently uploaded (20)

How Graphs Changed The Way Hackers Attack

Editor's Notes

How Graphs Changed The Way Hackers Attack

You are reading a preview.

How Graphs Changed The Way Hackers Attack

Recommended

More Related Content

Slideshows for you (20)

Similar to How Graphs Changed The Way Hackers Attack (20)

Recently uploaded (20)

How Graphs Changed The Way Hackers Attack

Editor's Notes