1. Lateral Movement and Pass-the-Hash in Windows 10— Am I Still Vulnerable?
Darren Mar-Elia
Head of Product
Semperis, Inc., Founder-SDM Software/GPOGuy

2. Agenda Level Set—What are Lateral Movement Attacks?
Credential Theft and Pass-the-Hash
Tools and techniques for moving laterally in Windows
What’s new to protect against this in Windows 10?
Questions

3. Credential theft Credential theft is a broad category
Pass-the-hash (PtH) is a Windows-specific instance of credential theft
Involves stealing the LAN Manager Hash or Kerberos keys of a user from LSASS memory on a Windows System
Requires you to have administrative access to read the memory
Credential theft is a common way to facilitate moving laterally

4. Lateral Movement attacks
Compromise user on one machine
Find credentials of “interesting” users
Use creds to move to higher value users and machines

5. Typical lateral movement scenario
Domain Controller

6. Tools and techniques for moving laterally

7. Tools of the trade
While not the only way to grab credentials, Mimikatz is probably the most widely used and the most versatile
Provides a variety of methods for grabbing LM Hashes, Kerberos tickets, etc.

8. Finding Targets
Once you have a credential, the trick is to find out where you can use it
Lots of tools now to help attackers with that
And…your own environment can help!

9. Bloodhound

10. Powershell empire and PowerSploit

11. Using your own information
Many of these “red team” tools use information in your infrastructure against you
Group Policy security related information to find privileged accounts
AD ACL mis-configuration to take over AD objects
AD group memberships to privileged accounts
Once they get a credential foothold, finding “high- value targets” to move towards becomes easier

12. Demo—passing the hash and other Information gathering nastiness

13. Enter Windows 10 Credential guard

14. What is Windows 10 credential guard?
Instead of storing hashes and keys in LSASS memory, they are stored in a virtualization partition—isolated completely from the OS
Credit:

15. REQUIREMENTS FOR Credential guard
Windows 10 Enterprise x64 (or Server 2016)
UEFI and Secure Boot
TPM 2.0
Virtualization Support
Don’t Enable on Domain Controllers—will crash them!

16. Enabling credential guard
NOTE: NTLM v1 support is disabled when credential guard is enabled (GOOD!)
Using Group Policy

17. What Does credential guard protect?
Logon Session NTLM Hash
Logon Session Kerberos
User name and password until user gets Ticket Granting Ticket (TGT)
Any long-lived keys
TGT session keys
Any credentials that have been saved to Credential Manager

18. What does credential guard not protect?
Local account credentials
Microsoft accounts
Azure AD accounts
Service account passwords
Application-specific credentials
And of course…
Passwords stored in clear-text in scripts or GP Preferences Passwords

19. Demo: Enabling credential guard—how things change

20. Questions?