The document summarizes a simulated attack on an organization via compromise of a trusted third party supplier. It demonstrates how threat actors used phishing to deliver malware, abused active directory trusts to move laterally between the supplier and target networks, and extracted credentials and customer data from the target organization's systems after gaining initial access through the third party. It stresses that such trusted third party attacks are a real risk and organizations need to carefully restrict access and monitor for signs of compromise when connecting suppliers to their internal networks and assets.

1. Trusted Third Parties are
NOT Trust Worthy!
April 2019
GISEC

2. Contents
Introductions
+ Whoami / Nettitude
Overview
+ Summary of the hack
+ Why you should care as an organisation
Demonstrate a Trusted Third Party Compromise
+ Weaponisation & delivery (Phishing)
+ Abusing Active Directory trusts (Bi-Directional)
+ In Combination with Trusted Network Routing
+ Elevation of privileges in enterprise
organisations
+ Extraction of Customer data and
privileged access

3. @benpturner
+ Managing Principal Security Consultant @ Nettitude
+ Lead the Global Red Team Operation @ Nettitude
+ 8 years as a Crest Team Leader (CHECK Team Leader - Infrastructure)
+ 5 years as a Crest Simulated Attack Specialist (CCSAS - STAR/CBEST)
Training / Talks
+ Advanced Threat Actor Simulation - Red Team Training Course (Steelcon 2017/2018)
+ Workshops - Red Teaming with PoshC2 (BSides London/Manchester)
+ 21st Century War Stories (Steelcon/BSides 2016) - https://www.youtube.com/watch?v=O8Ul6QSPuo4
+ PowerShell Fu with Metasploit (Steelcon/BSides 2015) - https://www.youtube.com/watch?v=ottfZFRSsj4
Development Projects
+ Lead developer of PoshC2 - Nettitude’s Open Source Command & Control (C2) Framework
+ https://github.com/nettitude/PoshC2_Python/
+ General day to day PowerShell & C# projects

4. @BaffledJimmy
+ Security Consultant @ Nettitude
+ Work mainly on large Active Directory / infrastructure engagements and Red Teams
+ CHECK Team Leader
+ 8 years as a British Army Officer – mainly centered around cyber leadership roles
+ Enjoys both the offensive and defensive sides of red teaming, and abusing companies internal tooling against
them.

5. Team Spicy Weasel
1st Place - 2018
+ labs.nettitude.com/blog/derbycon-2018-ctf-write-up
1st Place - 2017
+ labs.nettitude.com/blog/derbycon-2017-ctf-write-up
3rd Place - 2016
+ labs.nettitude.com/blog/derbycon-2016-ctf-write-up

6. “
”
Skilled and motivated attackers are
compromising third party suppliers with
a view to pivoting into their ultimate
target organization.
FireEye, 2018

7. Disclaimer
1. All screenshots and organization names have been
fictitiously made up or cloned for this presentation
2. The attack techniques and methodologies are a true
representation of real connections with trusted third
parties
3. This is not a contrived attack scenario, the risk is very
real
4. We are enacting this scenario for many of our clients and
you would be scared at the amount of success, and the
over reliance or trust that is put in third party
organizations

8. Cyber Kill Chain

9. News Reports
1. Screenshot of The Register with 3rd party breaches etc

10. Threat Intelligence / Open
Source Intelligence Gathering
• OSINT
• Social Media / Networking Sites
• Active / Passive Reconnaissance
• HUMINT

11. Digital Solutions
Summary of the Target

12. Prowl – Hunting the Employees

13. Identifying the Target

14. Deploying C2 Infrastructure

15. Photon

16. VIDEO
Weaponising the Document

17. Deliver the Weapon
to the Target

18. VIDEO
Symantec Secure File Share

19. Attacker C2
Channel Established

20. Visual Representation

21. Situational Awareness

22. Enumerating and Abusing
Active Directory Trusts
 Active Directory trusts with suppliers or
outsourcing partners are common
 Combined with overly permissive firewall rules
between each company
 Frequently misconfigured to allow two way
authentication between organisations
 Frequently allow all accounts to authenticate,
not just the required accounts

23. Trust Enumeration & Kerberoast Attack

24. Visual Representation

25. Custom Distributed Cloud Cracking

26. Distributed Cloud Cracking
22hrs 56mins
£3220

27. Cloud Cracking has given
access into Blorebank
 Blorebank are using Jump Boxes / Bastion Hosts – a good
security practice
 AWS Cloud Cracking reveals MS SQL Service Account
password
 The attacker can now authenticate from the DS machine
using those creds, to execute an implant on the database
server

28. Post Exploitation

29. Getting into Blorebank

31. Visual Representation

32. Video of RDP into workstation, find an RDCMan file on Desktop
(one of many)
Use Photon to extract PW (complex) – RDCMan for Blore
BastionHost

33. Stealing Privileged Credentials &
Data Exfiltration

34. VIDEO
MSSQL Account is localadmin.
Mimikatz: logonpasswords.

35. Key Takeaways
 Trusted Third Party Attacks are REAL
 Separate your Active Directory environments to
minimize your attack surface
 Ensure strict firewalling between suppliers and
your assets, e.g. RDP
 Heavily monitor and audit your authentication
events
 Restrict access to critical assets to authorized
and dedicated accounts only
 Deploy password managers, 2FA & utilize
Microsoft Group Managed Service Accounts &
LAPS

36. THANK YOU
Ben Turner @benpturner
Tom MacDonald @baffledjimmy
https://www.slideshare.net/nettitude_labs/trusted-third-parties-are-not-trust-worthy