Scribd Logo
Upload

Welcome to Scribd!

  • 59 views

    Bsidescyprus DropTheMIC

    Uploaded by

    Fernando da Costa Correa
    This document discusses the technique of credentials relaying known as "Dropping the MIC" or CVE-2019-1040. It allows an attacker to bypass NTLM message integrity checks and relay authentication between SMB and LDAP. This enables attacks like adding domain computers, creating users with DCSync rights, and modifying objects to escalate privileges. The document explains how NTLM authentication works, how the MIC check is bypassed, and how to hunt for signs of relaying attacks in event logs. It recommends patching systems and enabling defenses like SMB and LDAP signing to prevent credential relaying.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Bsidescyprus DropTheMIC

    Uploaded by

    Fernando da Costa Correa
    59 views20 pages
    This document discusses the technique of credentials relaying known as "Dropping the MIC" or CVE-2019-1040. It allows an attacker to bypass NTLM message integrity checks and relay authentication between SMB and LDAP. This enables attacks like adding domain computers, creating users with DCSync rights, and modifying objects to escalate privileges. The document explains how NTLM authentication works, how the MIC check is bypassed, and how to hunt for signs of relaying attacks in event logs. It recommends patching systems and enabling defenses like SMB and LDAP signing to prevent credential relaying.

    Original Description:

    NTLM Relay disable MIC

    Original Title

    bsidesCyprus_DropTheMIC(1)

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses the technique of credentials relaying known as "Dropping the MIC" or CVE-2019-1040. It allows an attacker to bypass NTLM message integrity checks and relay authentication between SMB and LDAP. This enables attacks like adding domain computers, creating users with DCSync rights, and modifying objects to escalate privileges. The document explains how NTLM authentication works, how the MIC check is bypassed, and how to hunt for signs of relaying attacks in event logs. It recommends patching systems and enabling defenses like SMB and LDAP signing to prevent credential relaying.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    59 views20 pages

    Bsidescyprus DropTheMIC

    Uploaded by

    Fernando da Costa Correa
    This document discusses the technique of credentials relaying known as "Dropping the MIC" or CVE-2019-1040. It allows an attacker to bypass NTLM message integrity checks and relay authentication between SMB and LDAP. This enables attacks like adding domain computers, creating users with DCSync rights, and modifying objects to escalate privileges. The document explains how NTLM authentication works, how the MIC check is bypassed, and how to hunt for signs of relaying attacks in event logs. It recommends patching systems and enabling defenses like SMB and LDAP signing to prevent credential relaying.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 20

    Lateral Movement using

    Credentials Relaying
    CVE-2019-1040 / Drop the MIC
    Background
    • Penetration Tester @Deloitte’s Risk Advisory
    • @taso_x on Twitter
    • https://github.com/tasox
    • https://pentestlibrary.blogspot.com

    2
    Why Drop The MIC?
    CVE-2019-1040

    • NTLM Relay is the most common technique used in Active Directory


    environment
    • Compromise Enterprise Network (Impact)
    • Bypass Microsoft’s security mechanisms (SMB Signing, LDAP Signing,
    MIC etc.)
    • Relay between different protocols ( SMB->LDAP(S) )
    • The missing puzzle from lately discovered vulnerabilities (Printer Bug,
    Exchange – One API)
    • Only 2 tools (Responder, NTLMRelayx)

    3
    Lateral Movement using Credentials Relaying
    CVE-2019-1040 / Drop the MIC

    How it works What is the NTLM Protocol


    “Attacker is able to modify the flags of the “Windows Challenge/Response (NTLM) is
    NTLM authentication including the signing authentication protocol used on networks
    requirement and bypass the NTLM that include systems running the Windows
    Message Integrity Code (MIC) protection.” operating system.”
    https://docs.microsoft.com/en-us/windows/win32/secauthn/microsoft-
    ntlm

    4
    More NTLM…
    • NTLM Authentication consists of 3 message types:

    • When users authenticate to target via NTLM (NTLM over SMB,


    NTLM over LDAP, NTLM over HTTP, NTLM over RPC etc), they
    are vulnerable to relay attacks.

    • In order to protect servers from relaying attacks Microsoft has


    introduced session signing (SMB Signing, LDAP Signing etc).

    • NTLM Message Integrity Code (MIC) protection of the NTLM


    authentication.

    5
    What is NTLM Message Integrity Code?
    “The Message Integrity Code (MIC) field verifies that the 3
    NTLM messages [NTLM_NEGOTIATE, NTLM_CHALLENGE,
    NTLM_AUTHENTICATE] were not modified during transit.”

    6
    Drop The MIC (Modifications)
    CVE-2019-1040 / Drop the MIC

    NTLMSSP_NEGOTIATE - Flags NTLMSSP_AUTHENTICATE - Flags


    • NTLMSSP_NEGOTIATE_ALWAYS_SIGN=0 • NTLMSSP_NEGOTIATE_ALWAYS_SIGN=0
    • NTLMSSP_NEGOTIATE_SIGN=0 • NTLMSSP_NEGOTIATE_SIGN=0
    • NEGOTIATE_KEY_EXCHANGE=0
    • NEGOTIATE_VERSION=0
    • MIC field

    https://blog.preempt.com/drop-the-mic
    7
    Drop The MIC (Modifications)
    CVE-2019-1040 / Drop the MIC

    Original NTLM_NEGOTIATE Modified NTLM_NEGOTIATE

    8
    Drop The MIC (Modifications)
    CVE-2019-1040 / Drop the MIC

    Original NTLM_AUTHENTICATE Modified NTLM_AUTHENTICATE

    9
    Why LDAP?
    “LDAP can be used to read and modify
    objects in the Active Directory. When
    authentication is relayed to LDAP,
    objects in the directory can be
    modified to grant an attacker
    privileges, including the privileges
    required for DCSync operations.”
    DCSync: An attacker can pretend to be a Domain Controller and
    request passwords from the targeted Domain Controller

    https://dirkjanm.io/abusing-exchange-one-api-call-away-
    10
    from-domain-admin/
    (NTLM over SMB) Relay to LDAP
    NTLMRelayx Syntax table

    Attack Scenarios Protocol:Port Attack Flag Elevated NTLM Bypass MIC

    Add a domain
    Ldaps:636 --add-computer (1) No --remove-mic
    computer
    Create a domain
    user & give DCSync Ldaps:636 --delegate-access Yes --remove-mic
    rights
    Give DCSync rights
    to an existing
    Ldap:389 --escalate-user Yes --remove-mic
    domain user, (2)
    domain computer

    (1) Every domain user in AD can add 10 computer accounts.


    11
    (2) Version 0.9.20-dev of ntlmrelayx can not give dcsync rights to a domain computer account.
    More (NTLM over SMB) Relay to LDAP
    NTLMRelayx Syntax table

    Attack Scenarios Syntax

    Create domain user and


    ntlmrelayx.py -t ldaps://192.168.100.236 --delegate-access -smb2support --remove-mic
    gives DCSync rights

    Create a domain
    ntlmrelayx.py -t ldaps://192.168.100.236 --add-computer -smb2support --remove-mic
    computer account
    Gives DCSync rights to an ntlmrelayx.py -t ldap://192.168.100.236 --escalate-user <domain user / computer> -
    existing domain user / smb2support --remove-mic
    computer

    *the latest version 0.9.20-dev of ntlmrelayx can not give dcsync rights to a domain computer account. 12
    Create a domain Computer

    13
    Create a domain User & Grant DCSync privileges

    14
    Grant DCSync privileges to an existing domain User

    15
    Hunting Relaying
    Drop the MIC

    Create computer account Get-Eventlog 4741


    (--add-computer) (A computer account was created)

    16
    More Hunting
    Drop the MIC

    Create User account & ACL Modification Get-Eventlog 4720


    --delegate-access (A user account was created)

    17
    More Hunting
    Drop the MIC

    Get-EventLog 5136
    (A directory service object was modified) Convert SDDL & Observe

    https://github.com/canix1/SDDL-Converter 18
    Mitigation
    Drop the MIC

    • Install Microsoft’s patches


    • Configurations
    • Enforce SMB Signing
    • LDAP Signing, LDAPS channel binding
    • Disable NTLMv1
    • Use Kerberos as much as possible
    • Enable and monitor useful Windows
    Events

    19
    Thank You

    Credits:
    • M a r i n a S i m a k o v, Ya r o n Z i n a r
    • Dirk-Jan Mollema
    • Alberto Solino

    You might also like