1. OWASP IL, June 2015

11. waza 1234/ des_cbc_md5 f8fd987fa7153185 LSASS (kerberos) rc4_hmac_nt (NTLM/md4) cc36cf7a8514893e fccd332446158b1a aes128_hmac 8451bb37aa6d7ce3 d2a5c2d24d317af3 aes256_hmac 1a7ddce7264573ae1 f498ff41614cc7800 1cbf6e3142857cce2 566ce74a7f25b KDC TGT TGS ① AS-REQ ② AS-REP ③ TGS-REQ (Server) ④ TGS-REP ⑤ Usage User Server

13. KDC waza 1234/ User1 des_cbc_md5 f8fd987fa7153185 LSASS (kerberos) rc4_hmac_nt (NTLM/md4) cc36cf7a8514893e fccd332446158b1a aes128_hmac 8451bb37aa6d7ce3 d2a5c2d24d317af3 aes256_hmac 1a7ddce7264573ae1 f498ff41614cc7800 1cbf6e3142857cce2 566ce74a7f25b user rc4_hmac _nt aes256_ hmac Joe21321…543.. user1 cc36cf7a … 1a7ddc … Doe ① AS-REQ Name: user1 Etype: DES, RC4, AES128, AES256 ③ AS-REQ PA-ENC-TS Etype:AES TGT ② KERB-ERR Pre-auth-REQ Etype: RC4,AES Salt:user1 ④ AS-REP TGT+Enc Etype: AES

18. KDC

22. Check if newer keys exists Locate newer keys Patch newer keys Acess lsass.exe memory

23. Locate functions (to re-route) Inject patched functions Re-route Init function Re-route Decrypt function

24. KDC User1 des_cbc_md5 LSASS (kerberos) rc4_hmac_nt (NTLM/md4) aes128_hmac aes256_hmac user rc4_hmac _nt aes256_ hmac Joe21321…543.. user1 cc36cf7a … 1a7ddc … ① AS-REQ Name: user1 Etype: DES, RC4, AES128, AES256 ③ AS-REQ PA-ENC-TS Etype: RC4 TGT ② KERB-ERR Pre-auth-REQ Etype: RC4,AES Salt:user1 ④ AS-REP TGT+Enc Etype: RC4 ff687678.... Skeleton ff687678…

26. Automatically… Learn entities and their context Profile entity activities and behaviors Build the entities interaction graph Identify suspicious activities Connect suspicious activities into an Attack Timeline™ How Microsoft ATA works