How We Own Your World

How We Own Your World

Speakers: Sam Moses, Security Consultant, Penetration Tester, Rapid7

Conference: SAINTCON

YouTube: https://www.youtube.com/watch?v=KW9RLaPIN7s

Overview

In his SAINTCON presentation, "How We Own Your World," Sam Moses, a seasoned security consultant and penetration tester from Rapid7, offers a candid look into the most prevalent internal network attack paths leveraged by red teams and malicious actors. The talk provides a practical, attacker-centric perspective on gaining initial access, establishing a foothold, and escalating privileges to Domain Admin (DA) within enterprise environments. Moses emphasizes that while many attack vectors exist, his focus is on the techniques that consistently yield success against clients in current engagements, highlighting how these methods have evolved as organizations improve their security postures.

Moses, drawing on over five years of penetration testing experience complemented by a strong background in blue team operations (including building out the BYU security team into a full Security Operations Center), uniquely bridges the gap between offensive and defensive security. His insights are particularly valuable for defenders seeking to understand contemporary threats and fortify their networks against sophisticated, yet common, attack chains. The presentation serves as a critical guide for security professionals looking to move beyond outdated mitigation strategies and implement robust, layered defenses that address the latest adversarial tactics.

The talk is not merely a catalogue of vulnerabilities but a strategic overview of how attackers think, adapt, and combine weaknesses to achieve their objectives. By dissecting two primary initial access methods—one involving network relays and another exploiting weak password hygiene—and culminating in the pervasive Active Directory Certificate Services (ADCS) escalation path, Moses demystifies complex attack scenarios. He then translates these offensive techniques into actionable defensive implications, underscoring the importance of defense-in-depth and collaborative red/blue team efforts.

Background

▶ Watch: Introduction and overview of common attack paths (0:00)

The landscape of internal penetration testing has continually evolved, driven by both advancements in attacker methodologies and improvements in organizational security. Historically, an internal penetration test often involved gaining initial network access and quickly escalating to Domain Admin (DA) status by exploiting relatively straightforward misconfigurations. For instance, the combination of disabled Server Message Block (SMB) signing and users with local administrator privileges on workstations, coupled with vulnerable auxiliary protocols, frequently allowed attackers to achieve DA rapidly through SMB relay attacks. The goal of an internal penetration test, as Moses defines it at Rapid7, is not stealth (which is reserved for red teams) but rather a time-boxed effort to identify as many exploitable vulnerabilities as possible that lead to sensitive information or DA. While DA is often considered the "fruit" due to its control over the entire environment, Moses stresses that access to sensitive data, even without DA, is the ultimate objective for clients.

However, over the past two years, Moses observes a positive trend: clients are improving. Organizations are increasingly adopting the principle of least privilege, reducing the prevalence of users with local admin rights. Furthermore, SMB signing is being enabled and, more critically, required on a greater number of hosts. These improvements have shifted the attacker's approach. What was once a direct path to DA has now often become merely an initial foothold. Attackers must adapt, finding new methods for initial access and more complex chains for privilege escalation. This adaptation has led to a greater reliance on less secure auxiliary protocols for initial credential capture and, significantly, the exploitation of Active Directory Certificate Services (ADCS) for privilege escalation, a vector that has become remarkably consistent in recent years.

The persistence of weak password practices also remains a fundamental vulnerability. Despite widespread awareness, simple, guessable, or easily sprayable passwords continue to provide attackers with initial access. While older enumeration techniques like Windows null sessions have become less effective due to improved hardening, new methods like Kerbrute allow for stealthier user enumeration, bypassing immediate lockout policies. This constant arms race necessitates a defense-in-depth strategy, where multiple layers of security are deployed to slow down, detect, and ultimately prevent attackers from achieving their objectives.

Key Findings

▶ Watch: Traditional SMB relay attack leading to Domain Admin (3:30)

Sam Moses's presentation unveils several critical findings regarding the current state of internal network penetration testing and the most effective attack paths:

• Evolving Initial Access Methods: Traditional SMB relay attacks, which once commonly led directly to Domain Admin by exploiting local administrator privileges and disabled SMB signing, are becoming less prevalent. Clients are improving their security postures by implementing least privilege and requiring SMB signing. As a result, relay attacks (often targeting LDAP signing now) more frequently provide only initial user access rather than immediate DA.
• Auxiliary Protocols Remain a Weak Point: Protocols like LMR, NBNS, and MDNS are still commonly enabled, creating opportunities for attackers to perform man-in-the-middle attacks and capture hashes. These protocols are often unnecessary and can be safely disabled.
• Kerbrute as the Go-To User Enumeration Tool: Windows null sessions, a former staple for user enumeration, are largely ineffective. Instead, Kerbrute has emerged as the preferred method for efficiently and stealthily identifying valid domain usernames without sending passwords, thus avoiding account lockouts and making detection more challenging.
• Weak Passwords Persist as a Primary Entry Point: Despite advancements in security, weak passwords, coupled with effective user enumeration and password spraying techniques (e.g., using NetExec), remain one of the most common ways attackers gain initial access to networks.
• Active Directory Certificate Services (ADCS) is the Dominant Escalation Path: Moses unequivocally states that ADCS misconfigurations are currently the most common and reliable method for escalating privileges to Domain Admin once an attacker has even a single domain credential. He refers to it as the "one cred to escalate to rule them all" vector.
• Importance of "Require" vs. "Enable" for Security Controls: Simply enabling security features like SMB or LDAP signing is often insufficient if they are not required. Attackers can bypass merely "enabled" settings by routing traffic to non-signing hosts.
• Defense in Depth and Monitoring are Paramount: No single security control is foolproof. A layered approach (defense in depth) is essential. Crucially, robust monitoring capabilities are needed to detect subtle attack patterns (like Kerbrute or slow password sprays) that might bypass preventative controls.
• The Value of Purple Teaming: Collaborative efforts between red and blue teams (purple teaming) are highlighted as the most effective way for organizations to fine-tune their monitoring, identify gaps, and improve overall security posture.

Technical Deep Dive

▶ Watch: How clients improved and attack methods adapted (4:10)

Sam Moses meticulously details the technical underpinnings of two common initial access paths and the predominant escalation method, providing insights into the tools, protocols, and misconfigurations exploited by attackers.

Attack Path 1: Relays for Initial Access

This attack vector hinges on performing a man-in-the-middle (MITM) attack within the internal network, leveraging vulnerable auxiliary protocols.

1. Auxiliary Protocol Poisoning: The initial step involves poisoning auxiliary name resolution protocols such as Link-Local Multicast Name Resolution (LMR), NetBIOS Name Service (NBNS), and Multicast DNS (MDNS). These protocols are often enabled by default or for legacy compatibility, but they are inherently less secure than DNS. When a system fails to resolve a hostname via DNS, it may fall back to these protocols, broadcasting queries across the local network.

• Tool: Attackers use tools like Responder to listen for and respond to these broadcast queries, impersonating the legitimate target and tricking the victim machine into attempting authentication.
• Vulnerability: The core issue is that these protocols transmit authentication hashes (often NTLMv2 hashes) that can be captured.

1. SMB/LDAP Relay: Once a hash is captured, it can be relayed to another service that doesn't require message signing.

• Tool: NlMrelayX (part of the Impacket suite) is a common tool for this purpose. It takes the captured hash and relays it to a target system, attempting to authenticate as the victim user.
• Evolution:
• Old Way: If SMB signing was disabled and the victim user had local administrator rights on the target (e.g., a domain controller or another critical server), the relayed authentication could immediately dump the Security Account Manager (SAM) database or Local Security Authority (LSA) secrets, often containing plain-text credentials or easily crackable hashes, leading directly to DA.
• New Way: With improved least privilege and more widespread SMB signing requirements, direct DA via this method is less common. Instead, the relay often grants initial access to the target system as the authenticated user, albeit potentially with lower privileges. Moses notes that LDAP signing relay is becoming a more frequent alternative for initial access, as similar misconfigurations (LDAP signing enabled but not required) exist.

Defensive Measures:

• Disable Auxiliary Protocols: LMR, NBNS, and MDNS should be disabled via Group Policy (LMR) or registry (MDNS), and by turning off NetBIOS over TCP/IP (NBNS), as they are rarely essential in modern, well-configured networks.
• Require SMB Signing: Crucially, SMB signing must be required, not just enabled. If it's merely enabled, an attacker can still relay to a system where it's disabled or negotiate a non-signed connection.
• Require LDAP Signing: Similarly, LDAP signing should be required to prevent LDAP relay attacks.
• Due Diligence: Before implementing signing requirements, organizations should test their environment to ensure all critical services and applications support it to avoid breaking legitimate functionality.

Attack Path 2: Weak Passwords and User Enumeration

This path exploits human factors and insufficient password policies.

1. User Enumeration:

• Old Way: Windows null sessions (using tools like enum4linux) were previously used to enumerate users. However, these are less common and often blocked or limited now.
• New Way: Kerbrute is the preferred tool. It queries the Domain Controller (DC) for valid usernames by sending Kerberos AS-REQ requests without a password. The DC's response (either a Kerberos error code indicating "user does not exist" or a different error code for "pre-authentication required") allows the attacker to distinguish valid users from invalid ones.
• Advantages: This method does not send a password, so it doesn't trigger account lockouts, making it stealthy and difficult to detect via typical failed login alerts (Event ID 4625).
• OSINT: Moses emphasizes combining Kerbrute with Open-Source Intelligence (OSINT) to gather potential usernames from LinkedIn, public directories, or generate lists based on common naming conventions (e.g., firstname.lastname, firstinitiallastname).

1. Password Spraying: Once a list of valid usernames is obtained, attackers perform password spraying.

• Tool: NetExec (the successor to CrackMapExec) is commonly used. It attempts a small number of common or estimated passwords against a large list of users.
• Lockout Policies: While lockout policies (e.g., 3-5 failed logins per 30 minutes) can slow down an attacker, they don't prevent the attack entirely. Attackers will simply space out their attempts to avoid triggering lockouts.
• Goal: The aim is to find just one valid credential, which serves as the initial foothold.

Defensive Measures:

• Strong Password Policy: Implement and enforce robust password policies, recommending a minimum length of 12 characters for general users and 16+ for administrators. Moses advises against mandatory periodic password rotation, citing studies that show it leads to weaker, more predictable passwords.
• Password Managers: Encourage or provide password managers to users to facilitate the use of long, complex, and unique passwords.
• Monitoring for User Enumeration: Monitor for unusual patterns of Kerberos pre-authentication failures (though difficult to tune without false positives) or unusual login patterns from single source IPs attempting multiple unique usernames.
• Monitoring for Password Spraying: Set up alerts for a single source IP attempting to authenticate as multiple different users within a short timeframe. Whitelist expected behavior (e.g., SSH bastion hosts) to reduce false positives.

Common Escalation Path: Active Directory Certificate Services (ADCS)

Moses states unequivocally that ADCS misconfigurations are the most reliable and common path to Domain Admin today, given even a single valid domain credential.

1. ADCS Overview: ADCS is a Windows server role that provides Public Key Infrastructure (PKI) and Certificate Authority (CA) functionality within a private network. It allows for the issuance and management of digital certificates.
2. Misconfigurations: Attackers exploit various misconfigurations in ADCS templates and services. Moses highlights five common ADCS attack types (from a known list of at least 11): ESC1, ESC2, ESC3, ESC4, and ESC8.
3. ESC8 Attack Chain (Detailed Example): This is a relay-type attack that allows for privilege escalation.

• Prerequisites: Requires at least one valid domain credential.
• Elicit DC Authentication:
• Tool: PetitePotam is used to trigger a Domain Controller (DC) to authenticate back to the attacker's machine. PetitePotam exploits a vulnerability (or misconfiguration) to force a machine account (typically a DC) to initiate an authentication attempt.
• Result: The attacker receives the DC's NTLM hash.
• ADCS Enumeration:
• Tools: Certify (a Python tool) or Metasploit modules are used to enumerate the ADCS environment.
• Key Checks for ESC8:
• Web Enrollment Enabled: The ADCS server must have the web enrollment feature enabled.
• Request Disposition: The certificate template must have its request disposition set to issue (meaning certificates are automatically issued without management approval).
• Template Identification: The attacker then identifies vulnerable certificate templates.
• Template Requirements:
• Enabled: The template must be active.
• Enrollment Rights: The template must grant enrollment rights to Domain Controllers (or a group that includes DCs, like "Authenticated Users" or "Domain Computers"). This is critical because the attacker is relaying the DC's hash.
• Certificate Request & Impersonation:
• Tool: Using Certify or similar tools, the attacker crafts a request for a certificate, using the relayed DC hash and specifying an impersonated user, typically "Administrator."
• Result: The ADCS server, believing the request comes from a legitimate DC, issues a PFX certificate for the "Administrator" user.
• NT Hash Extraction & Pass the Hash:
• The PFX certificate contains the NT hash of the impersonated Administrator.
• Pass the Hash: This NT hash can then be used directly with Pass the Hash techniques to gain Domain Admin access without ever needing to crack the password. Moses notes one client had disabled NTLM pass the hash on DCs, which is a strong defense but rarely encountered.

Defensive Measures:

• Disable Unused ADCS Components: If web enrollment is not used, disable it. If ADCS is not used at all, disable or decommission it.
• Require Administrative Authentication/Manager Approval: For certificate requests, require administrative authentication or manager approval, especially for sensitive templates. Ensure that managers actually review these approvals.
• Disable NTLM Authentication for Domain Controllers: This is a highly effective control that prevents Pass the Hash attacks against DCs, making ADCS exploitation significantly harder.

Demo / Proof of Concept

▶ Watch: Explaining LMR, MDNS, NBNS and their exploitation (5:30)

The presentation did not feature a live, interactive demonstration in the traditional sense. Instead, Sam Moses walked the audience through the technical steps of each attack path using screenshots of command-line tool output and configuration settings. These visuals served as a proof-of-concept for the described methodologies, illustrating how tools like Responder, NlMrelayX, Kerbrute, NetExec, Certify, and PetitePotam function in a real-world penetration test scenario.

For instance, Moses showed screenshots demonstrating:

• Responder catching NTLMv2 hashes from auxiliary protocol poisoning.
• NlMrelayX output, indicating a successful relay attack and the dumping of SAM/LSA secrets (in the "old way" scenario) or initial access (in current scenarios).
• Certify output, enumerating ADCS certificate authorities and templates, highlighting vulnerable configurations like enabled web enrollment and templates with request disposition set to issue.
• Command-line output from requesting a certificate impersonating "Administrator" via a vulnerable ADCS template, and the subsequent extraction of the PFX ticket and NT hash.

While not a live "demo," this approach effectively conveyed the practical application of the techniques, allowing the audience to visualize the attacker's workflow and the evidence of successful exploitation at each stage of the attack chain.

Defensive Implications

▶ Watch: SMB message signing: enabled vs. required (7:00)

The detailed attack paths presented by Sam Moses underscore the critical need for a multi-layered and adaptive defensive strategy, often referred to as defense in depth. Relying on any single control is insufficient, as attackers are constantly innovating to find new ways around obstacles.

1. Disable Unnecessary Services and Protocols:

• Auxiliary Name Resolution: Proactively disable LMR, NBNS, and MDNS protocols. These are often legacy or auxiliary services that provide little value in modern networks but introduce significant risk by exposing NTLM hashes.
• ADCS Web Enrollment: If the Active Directory Certificate Services (ADCS) web enrollment feature is not actively used, it should be disabled. Similarly, if ADCS itself is not required, it should be decommissioned. Moses points out that unused services are often unmonitored and unpatched, making them prime targets.
• IPv6: If IPv6 is not actively used and managed, consider disabling it or ensuring rogue DHCP servers for IPv6 are blocked, as attackers can leverage it for MITM attacks.

1. Enforce Strong Authentication Mechanisms:

• Require SMB and LDAP Signing: It is crucial to require SMB and LDAP signing across the network, not just enable it. If signing is merely enabled, attackers can still force non-signed connections. This prevents NTLM relay attacks that rely on capturing and relaying authentication hashes.
• Strong Password Policies: Implement and strictly enforce strong password policies. Moses recommends a minimum length of 12 characters for general users and at least 16 characters for administrators. He strongly advises against mandatory periodic password rotations, as evidence suggests this practice leads to weaker, more predictable passwords. Instead, focus on length and complexity, potentially encouraging the use of password managers.
• Account Lockout Policies: Implement effective account lockout policies (e.g., 3-5 failed login attempts within 30 minutes). While attackers can bypass these by slowing down their sprays, it significantly increases their time and noise, making detection easier.
• Disable NTLM Authentication for Domain Controllers: This is a highly impactful control. Disabling NTLM authentication on Domain Controllers prevents Pass the Hash attacks against these critical assets, significantly hindering ADCS escalation techniques that rely on relaying DC hashes.

1. Implement Robust Monitoring and Detection:

• Behavioral Monitoring: Since attackers are becoming stealthier (e.g., Kerbrute avoids typical failed login alerts), focus on behavioral monitoring. Look for unusual patterns such as a single host attempting to authenticate as multiple different users (password spraying) or unusual Kerberos pre-authentication requests (Kerbrute).
• Alert Tuning: Proactively tune security information and event management (SIEM) systems to reduce false positives. This involves whitelisting expected behaviors (e.g., SSH bastion hosts) and prioritizing alerts based on known attack signatures or unusual activity.
• ADCS Monitoring: Monitor for unusual certificate requests, especially for highly privileged accounts or from unexpected sources. Look for template modifications or requests that bypass management approval.

1. Adopt a Defense-in-Depth Strategy:

• Combine preventative controls (disabling services, strong policies) with detective controls (monitoring). Each layer that an attacker has to overcome increases their effort, time, and likelihood of detection.

1. Embrace Purple Teaming:

• Moses strongly advocates for purple teaming, where internal red and blue teams collaborate. Red teams can actively test defenses and provide feedback on what was (or wasn't) detected, allowing blue teams to fine-tune their monitoring and response capabilities. This iterative process is crucial for continuous improvement. External penetration testers can also play this role, providing valuable insights to improve client security.

Key Takeaways

• ADCS is the Primary Escalation Vector: Active Directory Certificate Services (ADCS) misconfigurations are currently the most common and effective path for attackers to escalate privileges to Domain Admin, even with a single low-privileged credential.
• Require, Don't Just Enable, Security Features: For critical security controls like SMB and LDAP signing, ensure they are required across the network, not merely enabled, to prevent attackers from negotiating less secure connections.
• Strong Passwords and Smart Monitoring are Crucial: Implement robust password policies (12+ characters, 16+ for admins) and discourage mandatory rotations. Combine this with intelligent monitoring for user enumeration (e.g., Kerbrute patterns) and password spraying attempts to detect initial access.
• Disable Unnecessary Services and Protocols: Proactively identify and disable auxiliary protocols (LMR, NBNS, MDNS) and unused ADCS components (like web enrollment) to reduce the attack surface.
• Defense in Depth is Essential: No single security control is sufficient. A layered approach, combining preventative measures with comprehensive, well-tuned monitoring, is vital to slow down and detect determined attackers.
• Red and Blue Teams Must Collaborate: Foster a purple teaming environment where offensive and defensive security teams work together to test, identify gaps, and continuously improve detection and response capabilities.

About the Speaker(s)

Sam Moses, who often goes by "Moses," is a Security Consultant and Penetration Tester at Rapid7, a leading cybersecurity company. With over five years of experience in the field, Moses specializes in uncovering exploitable vulnerabilities within client networks.

Before joining Rapid7, Moses played a pivotal role at BYU, where he was part of the team that built out their security operations center (SOC), which later expanded to become the CES Security Operations Center, handling incidents for multiple institutions. During his time there, he served as an acting SOC manager and senior security analyst, gaining invaluable blue team experience. This background provides him with a unique perspective, allowing him to understand both the offensive tactics of attackers and the defensive challenges faced by organizations, informing his consultations and red team engagements. Moses emphasizes his commitment to helping clients strengthen their defenses, viewing penetration testing as a collaborative effort to secure systems rather than an antagonistic one.