Description<\/h2>\n\nAt this point of the lab, you have successfully elevated your privileges from a regular domain user to a domain administrator by abusing a combination of different vulnerabilities and techniques. However, would the same have been possible if we did not have access to a compromised user (tmassie) and client?<\/p>\n<\/blockquote>\n
This exercise covers a different approach commonly exploited in Windows network, called NTLM Relaying.<\/p>\n
Questions to Answer<\/h2>\n
Q1:<\/em><\/strong>
\nWhat does responder actually do under the hood?<\/p>\nA1:<\/em><\/strong>
\nIf a windows client cannot resolve a hostname using DNS, it will use the Link-Local Multicast Name Resolution (LLMNR) protocol or NBT-NS to ask neighbouring computers. The responder<\/code> tool can answer LLMNR and NBT-NS queries giving its own IP address as the destination for any hostname requested.<\/p>\nReference:<\/p>\n
\n- https:\/\/www.4armed.com\/blog\/llmnr-nbtns-poisoning-using-responder\/<\/a><\/li>\n<\/ul>\n
\nQ2:<\/em><\/strong>
\nWhat does ntlmrelayx.py actually do under the hood?<\/p>\nA2:<\/em><\/strong>
\nThe ntlmrelayx.py<\/code> tool performs the following steps.<\/p>\n\n- listen to the NTLM authentication negotiation messages from victim (man-in-the-middle position between a client and a server)<\/li>\n
- send the negotiation messages to the server (acts as the client)<\/li>\n
- interacts as the legitime client with the server for the authentication<\/li>\n
- disconnects the connection with the victim<\/li>\n
- dumps the contents of the SAM file (which contains the password hashes of local users)<\/li>\n<\/ol>\n
![\"\"](\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/03\/Abusing-NTLM.png\")
<\/p>\n
Reference:<\/p>\n
\n- https:\/\/en.hackndo.com\/ntlm-relay\/<\/a><\/li>\n
- https:\/\/blog.fox-it.com\/2017\/05\/09\/relaying-credentials-everywhere-with-ntlmrelayx\/<\/a><\/li>\n<\/ul>\n
\nQ3:<\/em><\/strong>
\nWhy can we impersonate the victims and inject malicious commands into the session we\u2019re relaying?<\/p>\nA3:<\/em><\/strong> <\/p>\nMessage Relaying:<\/em>
\nAs the attacker sent this same challenge to the real client, the real client encrypted this challenge with its secret, and responded with a valid response. The attacker can therefore send this valid response to the server.<\/p>\n![\"\"](\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/03\/Message-Relaying.png\")
<\/p>\n
The attacker is authenticated on the server with the client\u2019s credentials. Therefore the attacker is allowed to inject malicious commands into this relayed session.<\/p>\n
![\"\"](\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/03\/Message-Relaying_Server.png\")
<\/p>\n
Reference:<\/p>\n
\n- https:\/\/en.hackndo.com\/ntlm-relay\/<\/a><\/li>\n<\/ul>\n
\nQ4:<\/em><\/strong>
\nHow do we prevent this attack?<\/p>\nA4:<\/em><\/strong>
\nPrevention technics<\/em>: <\/p>\n\n- Enable SMB signing<\/li>\n
- Enable LDAP signing:<\/li>\n
- Disable automatic intranet detection<\/li>\n
- Disable Windows Proxy Auto Detection<\/li>\n
- Disable LLMNR\/NBNS<\/li>\n<\/ul>\n
Note:<\/p>\n
\n- Many organizations however have legacy products or operating systems that do not support Kerberos authentication, and thus disabling NTLM would have a considerate business impact.<\/li>\n<\/ul>\n
Reference:<\/p>\n
At this point of the lab, you have successfully elevated your privileges from a regular domain user to a domain administrator by abusing a combination of different vulnerabilities and techniques. However, would the same have been possible if we did not have access to a compromised user (tmassie) and client?<\/p>\n<\/blockquote>\n
This exercise covers a different approach commonly exploited in Windows network, called NTLM Relaying.<\/p>\n
Questions to Answer<\/h2>\n
Q1:<\/em><\/strong> A1:<\/em><\/strong> Reference:<\/p>\n Q2:<\/em><\/strong> A2:<\/em><\/strong> Reference:<\/p>\n Q3:<\/em><\/strong> A3:<\/em><\/strong> <\/p>\n Message Relaying:<\/em> The attacker is authenticated on the server with the client\u2019s credentials. Therefore the attacker is allowed to inject malicious commands into this relayed session.<\/p>\n Reference:<\/p>\n Q4:<\/em><\/strong> A4:<\/em><\/strong> Note:<\/p>\n Reference:<\/p>\n
\nWhat does responder actually do under the hood?<\/p>\n
\nIf a windows client cannot resolve a hostname using DNS, it will use the Link-Local Multicast Name Resolution (LLMNR) protocol or NBT-NS to ask neighbouring computers. The responder<\/code> tool can answer LLMNR and NBT-NS queries giving its own IP address as the destination for any hostname requested.<\/p>\n\n
\n
\nWhat does ntlmrelayx.py actually do under the hood?<\/p>\n
\nThe ntlmrelayx.py<\/code> tool performs the following steps.<\/p>\n\n
<\/p>\n\n
\n
\nWhy can we impersonate the victims and inject malicious commands into the session we\u2019re relaying?<\/p>\n
\nAs the attacker sent this same challenge to the real client, the real client encrypted this challenge with its secret, and responded with a valid response. The attacker can therefore send this valid response to the server.<\/p>\n<\/p>\n<\/p>\n\n
\n
\nHow do we prevent this attack?<\/p>\n
\nPrevention technics<\/em>: <\/p>\n\n
\n
![\"\"](\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/03\/SMB_Signied.png\")
<\/p>\n