Lateral Movement and Pass-the-Hash in Windows 10— Am I Still Vulnerable? Darren Mar-Elia Head of Product Semperis, Inc., Founder-SDM Software/GPOGuy

Agenda Level Set—What are Lateral Movement Attacks? Credential Theft and Pass-the-Hash Tools and techniques for moving laterally in Windows What’s new to protect against this in Windows 10? Questions

Credential theft Credential theft is a broad category Pass-the-hash (PtH) is a Windows-specific instance of credential theft Involves stealing the LAN Manager Hash or Kerberos keys of a user from LSASS memory on a Windows System Requires you to have administrative access to read the memory Credential theft is a common way to facilitate moving laterally

Lateral Movement attacks Compromise user on one machine Find credentials of “interesting” users Use creds to move to higher value users and machines

Typical lateral movement scenario Domain Controller

Tools and techniques for moving laterally

Tools of the trade While not the only way to grab credentials, Mimikatz is probably the most widely used and the most versatile https://github.com/gentilkiwi/mimikatz Provides a variety of methods for grabbing LM Hashes, Kerberos tickets, etc.

Finding Targets Once you have a credential, the trick is to find out where you can use it Lots of tools now to help attackers with that And…your own environment can help!

Bloodhound https://wald0.com

Powershell empire and PowerSploit https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon https://github.com/EmpireProject/Empire

Using your own information Many of these “red team” tools use information in your infrastructure against you Group Policy security related information to find privileged accounts AD ACL mis-configuration to take over AD objects AD group memberships to privileged accounts Once they get a credential foothold, finding “high- value targets” to move towards becomes easier

Demo—passing the hash and other Information gathering nastiness

Enter Windows 10 Credential guard

What is Windows 10 credential guard? Instead of storing hashes and keys in LSASS memory, they are stored in a virtualization partition—isolated completely from the OS Credit: https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard-how-it-works

REQUIREMENTS FOR Credential guard Windows 10 Enterprise x64 (or Server 2016) UEFI and Secure Boot TPM 2.0 Virtualization Support Don’t Enable on Domain Controllers—will crash them!

Enabling credential guard NOTE: NTLM v1 support is disabled when credential guard is enabled (GOOD!) Using Group Policy

What Does credential guard protect? Logon Session NTLM Hash Logon Session Kerberos User name and password until user gets Ticket Granting Ticket (TGT) Any long-lived keys TGT session keys Any credentials that have been saved to Credential Manager

What does credential guard not protect? Local account credentials Microsoft accounts Azure AD accounts Service account passwords Application-specific credentials And of course… Passwords stored in clear-text in scripts or GP Preferences Passwords

Demo: Enabling credential guard—how things change

Questions?