Scott Sutherland, profile picture
Uploaded byScott Sutherland
PPTX, PDF4,418 views

Secure360 - Extracting Password from Windows

The document provides a comprehensive overview of password management and security practices for Microsoft technologies, emphasizing the risks associated with cleartext password storage. It discusses various types of password storage methods, their vulnerabilities, and offers recommendations for reducing risks, including the use of proper encryption and periodic audits. Additionally, the document highlights the importance of managing privileges and using strong hashed passwords to secure sensitive information.

Embed presentation

Downloaded 93 times
Like what you hear? Tweet it using: #Sec360
INTRODUCTIONS Who are we? •Scott Sutherland •Antti Rantasaari What do we do? •Network and application penetration testing at NetSPI
GOAL Provide a basic understanding of how passwords can be exposed on Windows systems •What are the common controls? •What are their limitations? •How can we reduce risk?
OVERVIEW How to steal credentials from Microsoft technologies: • Password Storage • Cleartext passwords • Encrypted passwords • Password hashes • Authentication tokens
PASSWORD STORAGE • Hashed passwords  Used when cleartext password is not required later  No key required, hashing process can’t be reversed • Encrypted passwords  Used when cleartext password will be required later  Requires key to decrypt password  Requires key management • Encoded passwords  Should not be used to protect passwords  No key required to decode password • Cleartext passwords – Don’t do that!
CLEARTEXT PASSWORDS Why does it matter if passwords are stored or transmitted in cleartext? • Vulnerabilities can provide read-only access to:  OS files, backup files, and files shares  Network traffic • Passwords can then be used to access:  Systems  Applications / Databases  Sensitive information
CLEARTEXT PASSWORDS Why does it matter if passwords are stored or transmitted in cleartext? • Vulnerability examples:  File traversal  Local file includes  Excessive privileges on shares  ARP MITM
CLEARTEXT PASSWORDS Where can I find cleartext passwords? • Mapped network drives – User files • Configuration files • Windows Registry • Active Directory • Websites • Script files • Log files
CLEARTEXT PASSWORDS Mapped Network Drives • Users have access to a ton of files shares • File shares often have bad ACLs • Users love to store password in files  xls files  doc files  txt file  etc…
CLEARTEXT PASSWORDS Mapped Network Drives • Easy to find passwords using:  Find  Grep  Spider  Notepad++  Etc…
CLEARTEXT PASSWORDS Mapped Network Drives Recommendations • Review for password on at regular intervals • Periodic audits of access controls on shares • User awareness training • Use of proper password storage
CLEARTEXT PASSWORDS Configuration Files • Sometimes config files are only accessible to administrators • Most config files are accessible to all users  Bad ACLs  Access to backups
CLEARTEXT PASSWORDS Configuration Files – Sysprep • Files created to support the automation of large scale image roll outs • Configuration settings • Local and domain credentials
CLEARTEXT PASSWORDS Configuration Files – Sysprep • Files can be read by ANY user on the system • There are many places they can be stored and used
CLEARTEXT PASSWORDS Configuration Files – Sysprep http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx Type Location Registry HKLMSystemSetup!UnattendFile File %WINDIR%PantherUnattend File %WINDIR%Panther File Removable read/write media in order of drive letter, at the root of the drive. File Removable read-only media in order of drive letter, at the root of the drive. File windowsPE and offlineServicing passes: Sources directory in a Windows distribution All other passes: %WINDIR%System32Sysprep File %SYSTEMDRIVE%
CLEARTEXT PASSWORDS Configuration Files – Sysprep • Most of the time they are stored with no protection… http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx
CLEARTEXT PASSWORDS Unattend and Sysprep Files http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx Unattend.xml Example - Cleartext …[snip]… <OOBE> <HideEULAPage>true</HideEULAPage> <NetworkLocation>Work</NetworkLocation> <ProtectYourPC>1</ProtectYourPC> <SkipMachineOOBE>true</SkipMachineOOBE> <SkipUserOOBE>true</SkipUserOOBE> </OOBE> <UserAccounts> <AdministratorPassword> <Value>Passw0rd</Value> <PlainText>true</PlainText> </AdministratorPassword> </UserAccounts> </component> …[snip]…
CLEARTEXT PASSWORDS Configuration Files – Sysprep • Sometimes they are Base64 encoded… http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx
CLEARTEXT PASSWORDS Unattend and Sysprep Files http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx Unattend.xml Example – Base64 Encoded …[snip]… <OOBE> <HideEULAPage>true</HideEULAPage> <NetworkLocation>Work</NetworkLocation> <ProtectYourPC>1</ProtectYourPC> <SkipMachineOOBE>true</SkipMachineOOBE> <SkipUserOOBE>true</SkipUserOOBE> </OOBE> <UserAccounts> <AdministratorPassword> <Value>UGFzc3cwcmQ=</Value> <PlainText>true</PlainText> </AdministratorPassword> </UserAccounts> </component> …[snip]…
CLEARTEXT PASSWORDS Configuration Files – Sysprep • Sometimes they are Base64 encoded… Base64 Encoding != Encryption http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx
CLEARTEXT PASSWORDS Unattend and Sysprep Files http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx
CLEARTEXT PASSWORDS Configuration Files – Sysprep Recommendations • Configure roll out scripts to remove the sysprep answer files like unattend.xml • Additional notes:  Prevent remote logins by local administrators  Manage systems with domain groups
CLEARTEXT PASSWORDS Configuration Files – Web.config • Used to store IIS web application configurations • Often contain database passwords • By default passwords are cleartext
CLEARTEXT PASSWORDS Configuration Files – Web.config • Typically stored at the webroot for each IIS site • Usually can be read by all users on the system
CLEARTEXT PASSWORDS Configuration Files – Web.config Recommendations • Encrypt passwords stored in web.config aspnet_regiis.exe -pef "connectionStrings" c:webapp • Additional notes:  Configure strong ACLs on file system
CLEARTEXT PASSWORDS Configuration Files – Web.config Recommendations
CLEARTEXT PASSWORDS Basic Authentication • Simple way to implement IIS authentication • Uses Base64 encoding, NOT ENCRYPTION • Credentials can be captured from network traffic over HTTP, or via man-in-the-middle over HTTPS
CLEARTEXT PASSWORDS Basic Authentication • Basic authentication over SSL is not that bad • Very common to see it used over unencrypted HTTP connections
CLEARTEXT PASSWORDS Basic Authentication • Base64 Encoded bmV0c3BpOlZlcnlTdHJvbmdBbmRIYXJkVG9HdW Vzc1Bhc3N3b3Jk • Easily decoded Base64 netspi:VeryStrongAndHardToGuessPassword Microsoft ActiveSync (iPhone, etc.)
CLEARTEXT PASSWORDS Basic Authentication Recommendations • Basic Auth is simple, but not often necessary • Replace with Integrated Authentication to enforce authentication handshake • Additional notes:  Integrated Authentication can still be exploited, but it’s not as easy
CLEARTEXT PASSWORDS Windows Registry • Many applications store passwords in cleartext • Easy to search for common strings to find passwords • Windows also stores some passwords in cleartext  Autologin username and password
CLEARTEXT PASSWORDS Windows Registry - AutoLogin • Used by many kiosk and POS systems • Often stores autologin credentials in [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon] "AutoAdminLogon"="1" "DefaultUserName"=“autoadmin" "DefaultPassword"=“!PassW0rd!" "DefaultDomainName"=“acme"
CLEARTEXT PASSWORDS Windows Registry - AutoLogin
CLEARTEXT PASSWORDS Windows Registry - AutoLogin Recommendations • Only use autologin when necessary • If required, store credentials encrypted in LSASecrets • Additional notes:  The encrypted password can be recovered with administrative access to the system http://technet.microsoft.com/en-us/sysinternals/bb963905.aspx
CLEARTEXT PASSWORDS Active Directory • User Comments • Custom properties
CLEARTEXT PASSWORDS Active Directory Recommendations • Don’t store cleartext passwords in active directory • Audit Active Directory periodically for comments and custom objects that may contain passwords
ENCRYPTED PASSWORDS How is it possible to decrypt passwords protected by Microsoft technologies? Key Point: If an application or OS can decrypt it, so can an attacker! …sometimes administrator access is required.
ENCRYPTED PASSWORDS How is it possible to recover passwords encrypted by Microsoft technologies? • Calling native OS and application functions • Recovering encryption keys  From same system as the protected data  From external systems like HSMs • Use the keys and correct algorithm to recover protected data
ENCRYPTED PASSWORDS Groups.xml • Windows AD Group Policy Preferences allow setting passwords for local accounts on domain systems
ENCRYPTED PASSWORDS Groups.xml • For that to work the password has to be sent to the user’s system • Groups.xml is pulled down from the SYSVOL share on the DC • SYSVOL and Groups.xml are accessible to all domain users and computer accounts
ENCRYPTED PASSWORDS • Updating a user results in groups.xml file creation
ENCRYPTED PASSWORDS • Passwords in groups.xml are AES256 encrypted and base64 encoded • To apply the password locally, client has to decrypt it • To enable this, encryption key is stored on clients • But MS released the STATIC key in an MSDN article; now anyone can decrypt the password! http://msdn.microsoft.com/en-us/library/2c15cbf0-f086-4c74-8b70- 1f2fa45dd4be.aspx#endNote2
ENCRYPTED PASSWORDS • Groups.xml password decrypted with a simple PowerShell script https://github.com/mattifestation/PowerSploit/blob/master/Exfiltration/Get- GPPPassword.ps1
ENCRYPTED PASSWORDS Groups.xml Recommendations • Microsoft does not recommend setting passwords via Group Policy so it’s not a good idea to do that • Access to groups.xml cannot be prevented for domain users so it should not be used
ENCRYPTED PASSWORDS LSASecrets • Used to store all kinds of passwords  Service accounts  Autologin  Applications
ENCRYPTED PASSWORDS LSASecrets • Passwords are stored encrypted in the registry HKLM:SECURITYPolicySecrets • Only viewable by LocalSystem • But…administrators can become LocalSystem
ENCRYPTED PASSWORDS LSASecrets sdf Administrator Access LocalSystem Access
ENCRYPTED PASSWORDS LSASecrets • Additional information is also required from the subkeys of HKLM:SECURITYPolicy
ENCRYPTED PASSWORDS LSASecrets • Use native API methods to decrypt the secrets LsaRetrievePrivateData LsaStorePrivateData LsaOpenPolicy LsaNtStatusToWinError LsaClose LsaFreeMemory
ENCRYPTED PASSWORDS LSASecrets – Service Account Example
ENCRYPTED PASSWORDS WDigest • Designed for use protocols that require a cleartext password to authenticate:  Hypertext Transfer Protocol (HTTP)  Simple Authentication Security Layer (SASL) exchanges http://technet.microsoft.com/en-us/library/cc778868(v=ws.10).aspx http://www.slideshare.net/gentilkiwi
ENCRYPTED PASSWORDS WDigest • Stores passwords for interactive logins (like RDP) encrypted in the lsass.exe process • Depending on secret size and OS version RC4, DES, or AES is used http://technet.microsoft.com/en-us/library/cc778868(v=ws.10).aspx http://www.slideshare.net/gentilkiwi
ENCRYPTED PASSWORDS WDigest • After injecting into the lsass.exe process or importing initialized keys via lsasrv.dll… • Native functions from lsasrv.dll can be used to decrypt the passwords – namely… LsaUnprotectMemory http://www.slideshare.net/gentilkiwi http://msdn.microsoft.com/en-us/library/windows/desktop/ff714510(v=vs.85).aspx
ENCRYPTED PASSWORDS WDigest • Tools like Mimikatz and WCE can be used to recover cleartext passwords http://www.slideshare.net/gentilkiwi http://msdn.microsoft.com/en-us/library/windows/desktop/ff714510(v=vs.85).aspx
ENCRYPTED PASSWORDS WDigest Recommendations • Use smartcard or biometrics when possible • Use network logins instead of interactive logs when possible • Use unprivileged accounts when possible • Do not provide admin / system / debug privileges to users http://www.slideshare.net/gentilkiwi
ENCRYPTED PASSWORDS DPAPI • Windows Data Protection API (DPAPI) • Standard / easy way on Windows to encrypt and decrypt data • DPAPI used by many applications  IE, Chrome, Skype, EFS certificates, WEP / WPA keys, RDP passwords, Credential Manager • Data protection in memory or on disk
ENCRYPTED PASSWORDS DPAPI – stored data • Two protection scopes: CurrentUser or LocalMachine • Protection scope determines the encryption keys  CurrentUser scope uses keys protected by current user’s password  LocalMachine scope uses keys on the system • Additional entropy added to strengthen protection
ENCRYPTED PASSWORDS DPAPI - internals • Largely undocumented by Microsoft – just the API calls are fully documented • DPAPI has been reversed and offline decryption tools have been released http://passcape.com/index.php?section=blog&cmd=details&id=20#11 http://www.elie.net/publication/reversing-dpapi-and-stealing- windows-secrets-offline#.U3BnB_ldWDs
ENCRYPTED PASSWORDS MSSQL Links - Background • Microsoft SQL Server allows users to create links to external data sources, typically to SQL Servers • Links can be configured to use SQL server credentials • Cleartext passwords are needed to connect to linked servers – password hashing cannot be used
ENCRYPTED PASSWORDS MSSQL Links - Background
ENCRYPTED PASSWORDS MSSQL Links – Password Storage • Linked server passwords stored in the database – only accessible using DAC • Passwords stored in pwdhash column even though hashing is not used • Passwords encrypted but SQL Server must have the key
ENCRYPTED PASSWORDS MSSQL Links – Password Storage
ENCRYPTED PASSWORDS MSSQL Links – Service Master Key • SQL Server has a Service Master Key which is encrypted using DPAPI • Additional entropy is stored in the registry • Service Master Key is “the root of the SQL Server encryption hierarchy”, used to encrypt linked server passwords too
ENCRYPTED PASSWORDS MSSQL Links – Service Master Key
ENCRYPTED PASSWORDS MSSQL Links – Passwords Decryption • Decrypt Service Master Key using DPAPI • Extract encrypted password from database • Remove metadata from the password • Decrypt password using Service Master Key (either 3DES or AES depending on version)
ENCRYPTED PASSWORDS MSSQL Links – Passwords Decrypted
ENCRYPTED PASSWORDS MSSQL Links Recommendations • Best practice is to use Windows authentication only – do not enable SQL server authentication • Configure linked servers to use current execution context rather than saved credentials
ENCRYPTED PASSWORDS Credential Manager / Vault • Credential Manager is intended to be a secure way to store password • Can be used for Windows credentials, browser credentials, application credentials • Each user has their own Vault – user can store own passwords
ENCRYPTED PASSWORDS Credential Manager / Vault • Cleartext credentials needed to connect to remote systems – thus passwords in Cred Manager are encrypted, not hashed. • DPAPI used to encrypt passwords
ENCRYPTED PASSWORDS Credential Manager / Vault
ENCRYPTED PASSWORDS Credential Manager / Vault • Credential manager password decryption using Cain http://www.oxid.it/
ENCRYPTED PASSWORDS Credential Manager / Vault Recommendations • Stored passwords always a security risks • Consider disabling Credential Manager using group policies
ENCRYPTED PASSWORDS Wireless • Wireless connections with pre-shared keys have to store the passwords • Passwords encrypted using DPAPI • User or SYSTEM can access the stored passwords • Multiple tools to extract wireless credentials, including Metasploit
ENCRYPTED PASSWORDS Wireless
ENCRYPTED PASSWORDS Wireless Metasploit module: post/windows/wlan/wlan_profile
ENCRYPTED PASSWORDS Wireless Recommendations • Do not use pre-shared keys • Configure corporate wireless to use WPA2- Enterprise (integrated authentication)
ENCRYPTED PASSWORDS Web.config and ApplicationHost.config • IIS application configuration files • Web.config = application level • ApplicationHost.config = server level  Application pool credentials  Windows credentials used for directory access … but they can also be decrypted
ENCRYPTED PASSWORDS Web.config and ApplicationHost.config • Early saw this aspnet_regiis.exe -pef "connectionStrings" c:webapp
ENCRYPTED PASSWORDS Web.config and ApplicationHost.config • No surprise that local administrators can do this: aspnet_regiis.exe -pdf "connectionStrings" c:webapp
HASHED PASSWORDS Why should I care if someone is stealing my password hashes if I have complexity enabled? •#1 Reason: Password hashes can be replayed and used to authenticate without knowledge of the password
HASHED PASSWORDS Why should I care if someone is stealing my password hashes if I have complexity enabled? •#2 Reason: Password hashes can cracked at lighting speeds using modern hardware and software
HASHED PASSWORDS On the System • Local / Domain LM hashes • Local / Domain NTLM hashes • Domain MS-CACHEv2 On the Network • Local / Domain NetLM • Local / Domain NetNTLM
HASHED PASSWORDS Can be dumped with a billion different hacker tools!
DO I REALLY NEED PASSWORDS? Short answer is NO
DO I REALLY NEED PASSWORDS? • SMB relay • Pass-the-hash • Stealing authentication tokens • Crawling database links • Process migration • Generating golden tickets
CONCLUSIONS • Protecting passwords is really, really hard if an attacker has admin rights to you system • Don’t store passwords in clear text – Anywhere! • Only use encryption when the cleartext passwords need used later • Use HSM to protect keys used to encrypt data • Use strong salted hashes to protect passwords • Enforce least privilege everywhere – networks, servers, applications…EVERYWHERE
NETSPI REFERENCES • NetSPI blog: http://www.netspi.com/blog • NetSPI github: https://github.com/netspi • Scott github: https://github.com/nullbind • NetSPI slideshare: http://slideshare.com/netspi • Scott slideshare: http://slideshare.com/nullbind • Scott twitter: @_nullbind

More Related Content

PDF
Attack All the Layers: What's Working during Pentests (OWASP NYC)
byScott Sutherland
 
PDF
10 Deadly Sins of SQL Server Configuration - APPSEC CALIFORNIA 2015
byScott Sutherland
 
PPTX
Secure360 - Attack All the Layers! Again!
byScott Sutherland
 
PPTX
Hacked? Pray that the Attacker used PowerShell
byNikhil Mittal
 
PPTX
Extracting Credentials From Windows
byNetSPI
 
PPTX
Automating Post Exploitation with PowerShell
byEnclaveSecurity
 
PDF
Introduction to Windows Dictionary Attacks
byNetSPI
 
PPTX
RACE - Minimal Rights and ACE for Active Directory Dominance
byNikhil Mittal
 
Attack All the Layers: What's Working during Pentests (OWASP NYC)
byScott Sutherland
 
10 Deadly Sins of SQL Server Configuration - APPSEC CALIFORNIA 2015
byScott Sutherland
 
Secure360 - Attack All the Layers! Again!
byScott Sutherland
 
Hacked? Pray that the Attacker used PowerShell
byNikhil Mittal
 
Extracting Credentials From Windows
byNetSPI
 
Automating Post Exploitation with PowerShell
byEnclaveSecurity
 
Introduction to Windows Dictionary Attacks
byNetSPI
 
RACE - Minimal Rights and ACE for Active Directory Dominance
byNikhil Mittal
 

What's hot

PDF
Attack All the Layers - What's Working in Penetration Testing
byNetSPI
 
PPTX
PowerShell for Penetration Testers
byNikhil Mittal
 
PPTX
Forging Trusts for Deception in Active Directory
byNikhil Mittal
 
PPTX
An Introduction to PowerShell for Security Assessments
byEnclaveSecurity
 
PPTX
Lateral Movement with PowerShell
bykieranjacobsen
 
PDF
Attack all the layers secure 360
byScott Sutherland
 
PPTX
Outlook and Exchange for the bad guys
byNick Landers
 
PPTX
Sticky Keys to the Kingdom
byDennis Maldonado
 
PDF
Power on, Powershell
byRoo7break
 
PDF
aclpwn - Active Directory ACL exploitation with BloodHound
byDirkjanMollema
 
PDF
Fuzzing and You: Automating Whitebox Testing
byNetSPI
 
PPTX
Invoke-Obfuscation DerbyCon 2016
byDaniel Bohannon
 
PPTX
Client side attacks using PowerShell
byNikhil Mittal
 
PDF
The Unintended Risks of Trusting Active Directory
byWill Schroeder
 
PPTX
PowerShell for Cyber Warriors - Bsides Knoxville 2016
byRussel Van Tuyl
 
PPTX
Lateral Movement with PowerShell
bykieranjacobsen
 
PPTX
Defending Your "Gold"
byWill Schroeder
 
PPTX
Owning computers without shell access dark
byRoyce Davis
 
PDF
SANS DFIR Prague: PowerShell & WMI
byJoe Slowik
 
PPTX
Owning computers without shell access 2
byRoyce Davis
 
Attack All the Layers - What's Working in Penetration Testing
byNetSPI
 
PowerShell for Penetration Testers
byNikhil Mittal
 
Forging Trusts for Deception in Active Directory
byNikhil Mittal
 
An Introduction to PowerShell for Security Assessments
byEnclaveSecurity
 
Lateral Movement with PowerShell
bykieranjacobsen
 
Attack all the layers secure 360
byScott Sutherland
 
Outlook and Exchange for the bad guys
byNick Landers
 
Sticky Keys to the Kingdom
byDennis Maldonado
 
Power on, Powershell
byRoo7break
 
aclpwn - Active Directory ACL exploitation with BloodHound
byDirkjanMollema
 
Fuzzing and You: Automating Whitebox Testing
byNetSPI
 
Invoke-Obfuscation DerbyCon 2016
byDaniel Bohannon
 
Client side attacks using PowerShell
byNikhil Mittal
 
The Unintended Risks of Trusting Active Directory
byWill Schroeder
 
PowerShell for Cyber Warriors - Bsides Knoxville 2016
byRussel Van Tuyl
 
Lateral Movement with PowerShell
bykieranjacobsen
 
Defending Your "Gold"
byWill Schroeder
 
Owning computers without shell access dark
byRoyce Davis
 
SANS DFIR Prague: PowerShell & WMI
byJoe Slowik
 
Owning computers without shell access 2
byRoyce Davis
 

Similar to Secure360 - Extracting Password from Windows

PDF
Gartner Security & Risk Management Summit 2018
byPaula Januszkiewicz
 
PDF
Passwords: Security vs Usability
byPer Thorsheim
 
PDF
Eyes Wide Shut: What Do Your Passwords Do When No One is Watching?
byBeyondTrust
 
PPTX
Adventures in Underland: Is encryption solid as a rock or a handful of dust?
byPaula Januszkiewicz
 
PPTX
Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016
byTed Wentzel
 
PPTX
Primer on password security
bysecurityxploded
 
PPTX
P@ssw0rds
byWill Alexander
 
PPTX
Passwords & security
byPer Thorsheim
 
PDF
Tips to Remediate your Vulnerability Management Program
byBeyondTrust
 
PPTX
Securing Passwords
byMandeep Singh
 
PPT
Windows network security
byInformation Technology
 
PDF
Getting authentication right
byAndre N. Klingsheim
 
PPT
Module 8 System Hacking
byleminhvuong
 
PPT
20-security.ppt
byajajkhan16
 
PPTX
AZ-801T00A Configuring Windows Server Hybrid Advanced Services.pptx
byjoolyvivi
 
PDF
Dear Hacker: Infrastructure Security Reality Check
byPaula Januszkiewicz
 
PPT
Windows Security in Operating System
byMeghaj Mallick
 
PPTX
Creating a fortress in your active directory environment
byDavid Rowe
 
PDF
rsa_usa_2019_paula_januszkiewicz
byZuzannaKornecka
 
PPTX
TM112 Meeting12-Cryptography.pptx
byMohammedYusuf609377
 
Gartner Security & Risk Management Summit 2018
byPaula Januszkiewicz
 
Passwords: Security vs Usability
byPer Thorsheim
 
Eyes Wide Shut: What Do Your Passwords Do When No One is Watching?
byBeyondTrust
 
Adventures in Underland: Is encryption solid as a rock or a handful of dust?
byPaula Januszkiewicz
 
Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016
byTed Wentzel
 
Primer on password security
bysecurityxploded
 
P@ssw0rds
byWill Alexander
 
Passwords & security
byPer Thorsheim
 
Tips to Remediate your Vulnerability Management Program
byBeyondTrust
 
Securing Passwords
byMandeep Singh
 
Windows network security
byInformation Technology
 
Getting authentication right
byAndre N. Klingsheim
 
Module 8 System Hacking
byleminhvuong
 
20-security.ppt
byajajkhan16
 
AZ-801T00A Configuring Windows Server Hybrid Advanced Services.pptx
byjoolyvivi
 
Dear Hacker: Infrastructure Security Reality Check
byPaula Januszkiewicz
 
Windows Security in Operating System
byMeghaj Mallick
 
Creating a fortress in your active directory environment
byDavid Rowe
 
rsa_usa_2019_paula_januszkiewicz
byZuzannaKornecka
 
TM112 Meeting12-Cryptography.pptx
byMohammedYusuf609377
 

More from Scott Sutherland

PPTX
Hunting SMB Shares with Data, Graphs, Charts, and LLMs (SO-CON 2025)
byScott Sutherland
 
PPTX
Into the Abyss: Evaluating Active Directory SMB Shares on Scale (Secure360)
byScott Sutherland
 
PPTX
How to Build and Validate Ransomware Attack Detections (Secure360)
byScott Sutherland
 
PDF
TROOPERS 20 - SQL Server Hacking Tips for Active Directory Environments
byScott Sutherland
 
PPTX
2019 Blackhat Booth Presentation - PowerUpSQL
byScott Sutherland
 
PDF
PowerUpSQL - 2018 Blackhat USA Arsenal Presentation
byScott Sutherland
 
PPTX
Secure360 - Beyond xp cmdshell - Owning the Empire through SQL Server
byScott Sutherland
 
PPTX
2018 Student360 - Beyond xp_cmdshell - Owning the Empire Through SQL Server
byScott Sutherland
 
PPTX
Beyond xp_cmdshell: Owning the Empire through SQL Server
byScott Sutherland
 
PPTX
2017 Secure360 - Hacking SQL Server on Scale with PowerShell
byScott Sutherland
 
PPTX
2017 Thotcon - Hacking SQL Servers on Scale with PowerShell
byScott Sutherland
 
PPTX
2017 OWASP SanFran March Meetup - Hacking SQL Server on Scale with PowerShell
byScott Sutherland
 
PPTX
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation
byScott Sutherland
 
PPTX
2016 aRcTicCON - Hacking SQL Server on Scale with PowerShell (Slide Updates)
byScott Sutherland
 
PPTX
DerbyCon2016 - Hacking SQL Server on Scale with PowerShell
byScott Sutherland
 
PPTX
WTF is Penetration Testing v.2
byScott Sutherland
 
PDF
Declaration of malWARe
byScott Sutherland
 
PDF
Thick Application Penetration Testing: Crash Course
byScott Sutherland
 
PDF
Introduction to Windows Dictionary Attacks
byScott Sutherland
 
PDF
WTF is Penetration Testing
byScott Sutherland
 
Hunting SMB Shares with Data, Graphs, Charts, and LLMs (SO-CON 2025)
byScott Sutherland
 
Into the Abyss: Evaluating Active Directory SMB Shares on Scale (Secure360)
byScott Sutherland
 
How to Build and Validate Ransomware Attack Detections (Secure360)
byScott Sutherland
 
TROOPERS 20 - SQL Server Hacking Tips for Active Directory Environments
byScott Sutherland
 
2019 Blackhat Booth Presentation - PowerUpSQL
byScott Sutherland
 
PowerUpSQL - 2018 Blackhat USA Arsenal Presentation
byScott Sutherland
 
Secure360 - Beyond xp cmdshell - Owning the Empire through SQL Server
byScott Sutherland
 
2018 Student360 - Beyond xp_cmdshell - Owning the Empire Through SQL Server
byScott Sutherland
 
Beyond xp_cmdshell: Owning the Empire through SQL Server
byScott Sutherland
 
2017 Secure360 - Hacking SQL Server on Scale with PowerShell
byScott Sutherland
 
2017 Thotcon - Hacking SQL Servers on Scale with PowerShell
byScott Sutherland
 
2017 OWASP SanFran March Meetup - Hacking SQL Server on Scale with PowerShell
byScott Sutherland
 
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation
byScott Sutherland
 
2016 aRcTicCON - Hacking SQL Server on Scale with PowerShell (Slide Updates)
byScott Sutherland
 
DerbyCon2016 - Hacking SQL Server on Scale with PowerShell
byScott Sutherland
 
WTF is Penetration Testing v.2
byScott Sutherland
 
Declaration of malWARe
byScott Sutherland
 
Thick Application Penetration Testing: Crash Course
byScott Sutherland
 
Introduction to Windows Dictionary Attacks
byScott Sutherland
 
WTF is Penetration Testing
byScott Sutherland
 

Recently uploaded

PPTX
Combining Induction and Transduction for Abstract Reasoning.pptx
byallen578468
 
PDF
December Patch Tuesday
byIvanti
 
PDF
Incident Response Planning with a Foundation Model
byKim Hammar
 
PDF
Innovative AI Solutions for Business Growth.pdf
byVox Works
 
PDF
8 LLM Surveys https://tinyurl.com/bdz8e6fp
byBob Marcus
 
PDF
TrustArc Webinar - Assessing AI Risk with Confidence
byTrustArc
 
PDF
Guided Substation Engineering with CoMPAS: Simplifying IEC 61850
byDanBrown980551
 
PPTX
RISE with SAP for Automotive - S4 HANA Value.pptx
byAmira Jemi
 
PDF
TPPmark2025 Kenta Inoue's answer 12/04/2025
byKenta Inoue
 
PDF
Top Cybersecurity Threats 2025 Guide by Sureshdas
byPrintersassist
 
PPTX
Ethics in AI - Artificial Intelligence Fundamentals.pptx
byemenyiblessing
 
PPTX
The Future of IT Service Management AI Automation & Beyond.pptx
byChetu
 
PDF
AI Technology important knowledge ......
byutkarshj2007
 
PPTX
Basics of Identity Access Management In mordern Infrastructure
byPrinceXavier18
 
PDF
Unlocking the Power of Salesforce Architecture: Frameworks for Effective Solu...
byvarsha30tiwari
 
PDF
Session 1 - Solving Semi-Structured Documents with Document Understanding
byDianaGray10
 
PDF
DIGITAL FORENSICS - Notes for Everything.pdf
bypankajkumavatbeit
 
PDF
Recursive Self Improvement vs Continuous Learning
byBob Marcus
 
PPTX
Ritesh_kumar_Aatmanirbhar Bharat: Make in India, Make for the World.pptx
byriteshrkgs2008
 
PDF
Security Technologys: Access Control, Firewall, VPN
byShielaLasala
 
Combining Induction and Transduction for Abstract Reasoning.pptx
byallen578468
 
December Patch Tuesday
byIvanti
 
Incident Response Planning with a Foundation Model
byKim Hammar
 
Innovative AI Solutions for Business Growth.pdf
byVox Works
 
8 LLM Surveys https://tinyurl.com/bdz8e6fp
byBob Marcus
 
TrustArc Webinar - Assessing AI Risk with Confidence
byTrustArc
 
Guided Substation Engineering with CoMPAS: Simplifying IEC 61850
byDanBrown980551
 
RISE with SAP for Automotive - S4 HANA Value.pptx
byAmira Jemi
 
TPPmark2025 Kenta Inoue's answer 12/04/2025
byKenta Inoue
 
Top Cybersecurity Threats 2025 Guide by Sureshdas
byPrintersassist
 
Ethics in AI - Artificial Intelligence Fundamentals.pptx
byemenyiblessing
 
The Future of IT Service Management AI Automation & Beyond.pptx
byChetu
 
AI Technology important knowledge ......
byutkarshj2007
 
Basics of Identity Access Management In mordern Infrastructure
byPrinceXavier18
 
Unlocking the Power of Salesforce Architecture: Frameworks for Effective Solu...
byvarsha30tiwari
 
Session 1 - Solving Semi-Structured Documents with Document Understanding
byDianaGray10
 
DIGITAL FORENSICS - Notes for Everything.pdf
bypankajkumavatbeit
 
Recursive Self Improvement vs Continuous Learning
byBob Marcus
 
Ritesh_kumar_Aatmanirbhar Bharat: Make in India, Make for the World.pptx
byriteshrkgs2008
 
Security Technologys: Access Control, Firewall, VPN
byShielaLasala
 

Secure360 - Extracting Password from Windows

  • 1.
    Like what youhear? Tweet it using: #Sec360
  • 2.
    INTRODUCTIONS Who are we? •ScottSutherland •Antti Rantasaari What do we do? •Network and application penetration testing at NetSPI
  • 3.
    GOAL Provide a basicunderstanding of how passwords can be exposed on Windows systems •What are the common controls? •What are their limitations? •How can we reduce risk?
  • 4.
    OVERVIEW How to stealcredentials from Microsoft technologies: • Password Storage • Cleartext passwords • Encrypted passwords • Password hashes • Authentication tokens
  • 5.
    PASSWORD STORAGE • Hashedpasswords  Used when cleartext password is not required later  No key required, hashing process can’t be reversed • Encrypted passwords  Used when cleartext password will be required later  Requires key to decrypt password  Requires key management • Encoded passwords  Should not be used to protect passwords  No key required to decode password • Cleartext passwords – Don’t do that!
  • 6.
    CLEARTEXT PASSWORDS Why doesit matter if passwords are stored or transmitted in cleartext? • Vulnerabilities can provide read-only access to:  OS files, backup files, and files shares  Network traffic • Passwords can then be used to access:  Systems  Applications / Databases  Sensitive information
  • 7.
    CLEARTEXT PASSWORDS Why doesit matter if passwords are stored or transmitted in cleartext? • Vulnerability examples:  File traversal  Local file includes  Excessive privileges on shares  ARP MITM
  • 8.
    CLEARTEXT PASSWORDS Where canI find cleartext passwords? • Mapped network drives – User files • Configuration files • Windows Registry • Active Directory • Websites • Script files • Log files
  • 9.
    CLEARTEXT PASSWORDS Mapped NetworkDrives • Users have access to a ton of files shares • File shares often have bad ACLs • Users love to store password in files  xls files  doc files  txt file  etc…
  • 10.
    CLEARTEXT PASSWORDS Mapped NetworkDrives • Easy to find passwords using:  Find  Grep  Spider  Notepad++  Etc…
  • 11.
    CLEARTEXT PASSWORDS Mapped NetworkDrives Recommendations • Review for password on at regular intervals • Periodic audits of access controls on shares • User awareness training • Use of proper password storage
  • 12.
    CLEARTEXT PASSWORDS Configuration Files •Sometimes config files are only accessible to administrators • Most config files are accessible to all users  Bad ACLs  Access to backups
  • 13.
    CLEARTEXT PASSWORDS Configuration Files– Sysprep • Files created to support the automation of large scale image roll outs • Configuration settings • Local and domain credentials
  • 14.
    CLEARTEXT PASSWORDS Configuration Files– Sysprep • Files can be read by ANY user on the system • There are many places they can be stored and used
  • 15.
    CLEARTEXT PASSWORDS Configuration Files– Sysprep http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx Type Location Registry HKLMSystemSetup!UnattendFile File %WINDIR%PantherUnattend File %WINDIR%Panther File Removable read/write media in order of drive letter, at the root of the drive. File Removable read-only media in order of drive letter, at the root of the drive. File windowsPE and offlineServicing passes: Sources directory in a Windows distribution All other passes: %WINDIR%System32Sysprep File %SYSTEMDRIVE%
  • 16.
    CLEARTEXT PASSWORDS Configuration Files– Sysprep • Most of the time they are stored with no protection… http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx
  • 17.
    CLEARTEXT PASSWORDS Unattend andSysprep Files http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx Unattend.xml Example - Cleartext …[snip]… <OOBE> <HideEULAPage>true</HideEULAPage> <NetworkLocation>Work</NetworkLocation> <ProtectYourPC>1</ProtectYourPC> <SkipMachineOOBE>true</SkipMachineOOBE> <SkipUserOOBE>true</SkipUserOOBE> </OOBE> <UserAccounts> <AdministratorPassword> <Value>Passw0rd</Value> <PlainText>true</PlainText> </AdministratorPassword> </UserAccounts> </component> …[snip]…
  • 18.
    CLEARTEXT PASSWORDS Configuration Files– Sysprep • Sometimes they are Base64 encoded… http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx
  • 19.
    CLEARTEXT PASSWORDS Unattend andSysprep Files http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx Unattend.xml Example – Base64 Encoded …[snip]… <OOBE> <HideEULAPage>true</HideEULAPage> <NetworkLocation>Work</NetworkLocation> <ProtectYourPC>1</ProtectYourPC> <SkipMachineOOBE>true</SkipMachineOOBE> <SkipUserOOBE>true</SkipUserOOBE> </OOBE> <UserAccounts> <AdministratorPassword> <Value>UGFzc3cwcmQ=</Value> <PlainText>true</PlainText> </AdministratorPassword> </UserAccounts> </component> …[snip]…
  • 20.
    CLEARTEXT PASSWORDS Configuration Files– Sysprep • Sometimes they are Base64 encoded… Base64 Encoding != Encryption http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx
  • 21.
    CLEARTEXT PASSWORDS Unattend andSysprep Files http://technet.microsoft.com/en-us/library/cc749415%28v=ws.10%29.aspx
  • 22.
    CLEARTEXT PASSWORDS Configuration Files– Sysprep Recommendations • Configure roll out scripts to remove the sysprep answer files like unattend.xml • Additional notes:  Prevent remote logins by local administrators  Manage systems with domain groups
  • 23.
    CLEARTEXT PASSWORDS Configuration Files– Web.config • Used to store IIS web application configurations • Often contain database passwords • By default passwords are cleartext
  • 24.
    CLEARTEXT PASSWORDS Configuration Files– Web.config • Typically stored at the webroot for each IIS site • Usually can be read by all users on the system
  • 25.
    CLEARTEXT PASSWORDS Configuration Files– Web.config Recommendations • Encrypt passwords stored in web.config aspnet_regiis.exe -pef "connectionStrings" c:webapp • Additional notes:  Configure strong ACLs on file system
  • 26.
    CLEARTEXT PASSWORDS Configuration Files– Web.config Recommendations
  • 27.
    CLEARTEXT PASSWORDS Basic Authentication •Simple way to implement IIS authentication • Uses Base64 encoding, NOT ENCRYPTION • Credentials can be captured from network traffic over HTTP, or via man-in-the-middle over HTTPS
  • 28.
    CLEARTEXT PASSWORDS Basic Authentication •Basic authentication over SSL is not that bad • Very common to see it used over unencrypted HTTP connections
  • 29.
    CLEARTEXT PASSWORDS Basic Authentication •Base64 Encoded bmV0c3BpOlZlcnlTdHJvbmdBbmRIYXJkVG9HdW Vzc1Bhc3N3b3Jk • Easily decoded Base64 netspi:VeryStrongAndHardToGuessPassword Microsoft ActiveSync (iPhone, etc.)
  • 30.
    CLEARTEXT PASSWORDS Basic Authentication Recommendations •Basic Auth is simple, but not often necessary • Replace with Integrated Authentication to enforce authentication handshake • Additional notes:  Integrated Authentication can still be exploited, but it’s not as easy
  • 31.
    CLEARTEXT PASSWORDS Windows Registry •Many applications store passwords in cleartext • Easy to search for common strings to find passwords • Windows also stores some passwords in cleartext  Autologin username and password
  • 32.
    CLEARTEXT PASSWORDS Windows Registry- AutoLogin • Used by many kiosk and POS systems • Often stores autologin credentials in [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon] "AutoAdminLogon"="1" "DefaultUserName"=“autoadmin" "DefaultPassword"=“!PassW0rd!" "DefaultDomainName"=“acme"
  • 33.
  • 34.
    CLEARTEXT PASSWORDS Windows Registry- AutoLogin Recommendations • Only use autologin when necessary • If required, store credentials encrypted in LSASecrets • Additional notes:  The encrypted password can be recovered with administrative access to the system http://technet.microsoft.com/en-us/sysinternals/bb963905.aspx
  • 35.
    CLEARTEXT PASSWORDS Active Directory •User Comments • Custom properties
  • 36.
    CLEARTEXT PASSWORDS Active Directory Recommendations •Don’t store cleartext passwords in active directory • Audit Active Directory periodically for comments and custom objects that may contain passwords
  • 37.
    ENCRYPTED PASSWORDS How isit possible to decrypt passwords protected by Microsoft technologies? Key Point: If an application or OS can decrypt it, so can an attacker! …sometimes administrator access is required.
  • 38.
    ENCRYPTED PASSWORDS How isit possible to recover passwords encrypted by Microsoft technologies? • Calling native OS and application functions • Recovering encryption keys  From same system as the protected data  From external systems like HSMs • Use the keys and correct algorithm to recover protected data
  • 39.
    ENCRYPTED PASSWORDS Groups.xml • WindowsAD Group Policy Preferences allow setting passwords for local accounts on domain systems
  • 40.
    ENCRYPTED PASSWORDS Groups.xml • Forthat to work the password has to be sent to the user’s system • Groups.xml is pulled down from the SYSVOL share on the DC • SYSVOL and Groups.xml are accessible to all domain users and computer accounts
  • 41.
    ENCRYPTED PASSWORDS • Updatinga user results in groups.xml file creation
  • 42.
    ENCRYPTED PASSWORDS • Passwordsin groups.xml are AES256 encrypted and base64 encoded • To apply the password locally, client has to decrypt it • To enable this, encryption key is stored on clients • But MS released the STATIC key in an MSDN article; now anyone can decrypt the password! http://msdn.microsoft.com/en-us/library/2c15cbf0-f086-4c74-8b70- 1f2fa45dd4be.aspx#endNote2
  • 43.
    ENCRYPTED PASSWORDS • Groups.xmlpassword decrypted with a simple PowerShell script https://github.com/mattifestation/PowerSploit/blob/master/Exfiltration/Get- GPPPassword.ps1
  • 44.
    ENCRYPTED PASSWORDS Groups.xml Recommendations • Microsoftdoes not recommend setting passwords via Group Policy so it’s not a good idea to do that • Access to groups.xml cannot be prevented for domain users so it should not be used
  • 45.
    ENCRYPTED PASSWORDS LSASecrets • Usedto store all kinds of passwords  Service accounts  Autologin  Applications
  • 46.
    ENCRYPTED PASSWORDS LSASecrets • Passwordsare stored encrypted in the registry HKLM:SECURITYPolicySecrets • Only viewable by LocalSystem • But…administrators can become LocalSystem
  • 47.
  • 48.
    ENCRYPTED PASSWORDS LSASecrets • Additionalinformation is also required from the subkeys of HKLM:SECURITYPolicy
  • 49.
    ENCRYPTED PASSWORDS LSASecrets • Usenative API methods to decrypt the secrets LsaRetrievePrivateData LsaStorePrivateData LsaOpenPolicy LsaNtStatusToWinError LsaClose LsaFreeMemory
  • 50.
    ENCRYPTED PASSWORDS LSASecrets –Service Account Example
  • 51.
    ENCRYPTED PASSWORDS WDigest • Designedfor use protocols that require a cleartext password to authenticate:  Hypertext Transfer Protocol (HTTP)  Simple Authentication Security Layer (SASL) exchanges http://technet.microsoft.com/en-us/library/cc778868(v=ws.10).aspx http://www.slideshare.net/gentilkiwi
  • 52.
    ENCRYPTED PASSWORDS WDigest • Storespasswords for interactive logins (like RDP) encrypted in the lsass.exe process • Depending on secret size and OS version RC4, DES, or AES is used http://technet.microsoft.com/en-us/library/cc778868(v=ws.10).aspx http://www.slideshare.net/gentilkiwi
  • 53.
    ENCRYPTED PASSWORDS WDigest • Afterinjecting into the lsass.exe process or importing initialized keys via lsasrv.dll… • Native functions from lsasrv.dll can be used to decrypt the passwords – namely… LsaUnprotectMemory http://www.slideshare.net/gentilkiwi http://msdn.microsoft.com/en-us/library/windows/desktop/ff714510(v=vs.85).aspx
  • 54.
    ENCRYPTED PASSWORDS WDigest • Toolslike Mimikatz and WCE can be used to recover cleartext passwords http://www.slideshare.net/gentilkiwi http://msdn.microsoft.com/en-us/library/windows/desktop/ff714510(v=vs.85).aspx
  • 55.
    ENCRYPTED PASSWORDS WDigest Recommendations • Usesmartcard or biometrics when possible • Use network logins instead of interactive logs when possible • Use unprivileged accounts when possible • Do not provide admin / system / debug privileges to users http://www.slideshare.net/gentilkiwi
  • 56.
    ENCRYPTED PASSWORDS DPAPI • WindowsData Protection API (DPAPI) • Standard / easy way on Windows to encrypt and decrypt data • DPAPI used by many applications  IE, Chrome, Skype, EFS certificates, WEP / WPA keys, RDP passwords, Credential Manager • Data protection in memory or on disk
  • 57.
    ENCRYPTED PASSWORDS DPAPI –stored data • Two protection scopes: CurrentUser or LocalMachine • Protection scope determines the encryption keys  CurrentUser scope uses keys protected by current user’s password  LocalMachine scope uses keys on the system • Additional entropy added to strengthen protection
  • 58.
    ENCRYPTED PASSWORDS DPAPI -internals • Largely undocumented by Microsoft – just the API calls are fully documented • DPAPI has been reversed and offline decryption tools have been released http://passcape.com/index.php?section=blog&cmd=details&id=20#11 http://www.elie.net/publication/reversing-dpapi-and-stealing- windows-secrets-offline#.U3BnB_ldWDs
  • 59.
    ENCRYPTED PASSWORDS MSSQL Links- Background • Microsoft SQL Server allows users to create links to external data sources, typically to SQL Servers • Links can be configured to use SQL server credentials • Cleartext passwords are needed to connect to linked servers – password hashing cannot be used
  • 60.
  • 61.
    ENCRYPTED PASSWORDS MSSQL Links– Password Storage • Linked server passwords stored in the database – only accessible using DAC • Passwords stored in pwdhash column even though hashing is not used • Passwords encrypted but SQL Server must have the key
  • 62.
    ENCRYPTED PASSWORDS MSSQL Links– Password Storage
  • 63.
    ENCRYPTED PASSWORDS MSSQL Links– Service Master Key • SQL Server has a Service Master Key which is encrypted using DPAPI • Additional entropy is stored in the registry • Service Master Key is “the root of the SQL Server encryption hierarchy”, used to encrypt linked server passwords too
  • 64.
    ENCRYPTED PASSWORDS MSSQL Links– Service Master Key
  • 65.
    ENCRYPTED PASSWORDS MSSQL Links– Passwords Decryption • Decrypt Service Master Key using DPAPI • Extract encrypted password from database • Remove metadata from the password • Decrypt password using Service Master Key (either 3DES or AES depending on version)
  • 66.
    ENCRYPTED PASSWORDS MSSQL Links– Passwords Decrypted
  • 67.
    ENCRYPTED PASSWORDS MSSQL Links Recommendations •Best practice is to use Windows authentication only – do not enable SQL server authentication • Configure linked servers to use current execution context rather than saved credentials
  • 68.
    ENCRYPTED PASSWORDS Credential Manager/ Vault • Credential Manager is intended to be a secure way to store password • Can be used for Windows credentials, browser credentials, application credentials • Each user has their own Vault – user can store own passwords
  • 69.
    ENCRYPTED PASSWORDS Credential Manager/ Vault • Cleartext credentials needed to connect to remote systems – thus passwords in Cred Manager are encrypted, not hashed. • DPAPI used to encrypt passwords
  • 70.
  • 71.
    ENCRYPTED PASSWORDS Credential Manager/ Vault • Credential manager password decryption using Cain http://www.oxid.it/
  • 72.
    ENCRYPTED PASSWORDS Credential Manager/ Vault Recommendations • Stored passwords always a security risks • Consider disabling Credential Manager using group policies
  • 73.
    ENCRYPTED PASSWORDS Wireless • Wirelessconnections with pre-shared keys have to store the passwords • Passwords encrypted using DPAPI • User or SYSTEM can access the stored passwords • Multiple tools to extract wireless credentials, including Metasploit
  • 74.
  • 75.
  • 76.
    ENCRYPTED PASSWORDS Wireless Recommendations • Donot use pre-shared keys • Configure corporate wireless to use WPA2- Enterprise (integrated authentication)
  • 77.
    ENCRYPTED PASSWORDS Web.config andApplicationHost.config • IIS application configuration files • Web.config = application level • ApplicationHost.config = server level  Application pool credentials  Windows credentials used for directory access … but they can also be decrypted
  • 78.
    ENCRYPTED PASSWORDS Web.config andApplicationHost.config • Early saw this aspnet_regiis.exe -pef "connectionStrings" c:webapp
  • 79.
    ENCRYPTED PASSWORDS Web.config andApplicationHost.config • No surprise that local administrators can do this: aspnet_regiis.exe -pdf "connectionStrings" c:webapp
  • 80.
    HASHED PASSWORDS Why shouldI care if someone is stealing my password hashes if I have complexity enabled? •#1 Reason: Password hashes can be replayed and used to authenticate without knowledge of the password
  • 81.
    HASHED PASSWORDS Why shouldI care if someone is stealing my password hashes if I have complexity enabled? •#2 Reason: Password hashes can cracked at lighting speeds using modern hardware and software
  • 82.
    HASHED PASSWORDS On theSystem • Local / Domain LM hashes • Local / Domain NTLM hashes • Domain MS-CACHEv2 On the Network • Local / Domain NetLM • Local / Domain NetNTLM
  • 83.
    HASHED PASSWORDS Can bedumped with a billion different hacker tools!
  • 84.
    DO I REALLYNEED PASSWORDS? Short answer is NO
  • 85.
    DO I REALLYNEED PASSWORDS? • SMB relay • Pass-the-hash • Stealing authentication tokens • Crawling database links • Process migration • Generating golden tickets
  • 86.
    CONCLUSIONS • Protecting passwordsis really, really hard if an attacker has admin rights to you system • Don’t store passwords in clear text – Anywhere! • Only use encryption when the cleartext passwords need used later • Use HSM to protect keys used to encrypt data • Use strong salted hashes to protect passwords • Enforce least privilege everywhere – networks, servers, applications…EVERYWHERE
  • 87.
    NETSPI REFERENCES • NetSPIblog: http://www.netspi.com/blog • NetSPI github: https://github.com/netspi • Scott github: https://github.com/nullbind • NetSPI slideshare: http://slideshare.com/netspi • Scott slideshare: http://slideshare.com/nullbind • Scott twitter: @_nullbind