![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/01/1-RTC.png\")
T’was a Monday morning. A new assessment was about to begin.
\n\n\n\nI am no fan of Monday mornings, but assessment mornings are pure adrenaline. I woke up a little early that day to double-check if all the assessment infrastructure was up and running. Tea and r/netsec are my morning rituals before leaving home.
\n\n\n\nOn my way to the assessment, I had my Amazon Music (yeah, I know, sue me) tuned to System of a Down radio. It helps me get into the zone. I recommend Aerials; there is something weirdly poetic about that song.
\n\n\n\nMy goal was straightforward – break into the customer database server without getting caught. I had five days. It was showtime.
\n\n\n\nIt had been a good year. Red teams live and die by their outcomes. And up until then, I had hit nothing but net. There is comfort in the mindset that there is always a way in. I had no reason to believe today would be any different. I was about to learn otherwise.
\n\n\n\nWithin an hour, I could remotely control a machine within the organization over the Internet. I had a tried and tested payload that had worked well in the prior months against most perimeter detection solutions.
\n\n\n\nExcel DDE → Starts CMD → Starts a download lolbin (like bitsadmin) → fetches encrypted payload → load in memory → decrypt payload → execute → Call back.
\n\n\n\nI was able to cross the first hurdle with ease.
\n\n\n\nI had access to an account that did not have administrative privileges on my machine or, for that matter, anywhere else. I also had no idea where the database server was.
\n\n\n\nThe obvious strategy was to try and compromise the domain. If I could get the keys to the kingdom, then accessing the database server would only be a matter of time, patience, and persistence.
\n\n\n\nRight off the bat, I executed what many of us consider a lucky charm these days – Kerberoasting
\n\n\n\nA kerberoastable domain admin meant I had a high likelihood of owning the domain by lunchtime.
\n\n\n\nSo thanks to HarmJ0y’s Powerview script, I had the list of kerberoastable accounts and hashes. Unfortunately, none of them were Domain Admins, Enterprise Admins, or accounts that would allow a possibility to compromise the domain.
\n\n\n\nMy heart sank when I got the list of domain admins – just one.
\n\n\n\nOne domain admin is a rarity. The least I had seen before was five. And five is any day better than one (for a red teamer, that is). I ran a quick check of the domain admin properties, and my heart sank further.
\n\n\n\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/01/2-RTC.png\")
Logon restrictions to the domain controllers only! This meant that there was no chance of finding domain admin exposed credentials anywhere else.
\n\n\n\nThis was going to be more difficult than I thought.
\n\n\n\nOf the seven kerberoastable accounts, I only managed to crack one.
\n\n\n\nAnd as far as I could analyze based on its group memberships and properties, it did not appear to have anything of value. In fact, I could not even reach the machine on which the service was supposedly configured.
\n\n\n\nI decided to park this route for the time being as it was already past lunchtime on day 1.
\n\n\n\nCandidly writing, I was both annoyed and impressed at how the accounts with the tasty privileges were locked down. So next up was my trusty quick hit list:
\n\n\n\nNothing. Zilch. Zippo. Nada.
\n\n\n\nNo LLMNR struck me as especially weird. Was I on a sparsely populated subnet? A quick local segment scan showed that Port 135 and 445 were locked down. I could only see the RDP port. And there were about 100 hosts that were live. Maybe I just had to be patient. I decided to keep it running for a while.
\n\n\n\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/01/3-RTC.png\")
It was already day 2, and I had nothing to show for my time there.
\n\n\n\nThough it was time to switch gears and try something else, I could not just go waltzing through the network as it could trip a SIEM rule or the EDR, and I certainly did not want to get caught. Normally, I would take the risk, but experience told me that if someone had locked down the network so well, they knew what they were defending against.
\n\n\n\nI needed a clear plan of action and have multiple tasks going on at the same time. Here’s what I decided to do:
\n\n\n\nLots to do!
\n\n\n\nWhile hunting in Active Directory, I did pick up some interesting targets – Users who could change passwords, modify attributes, create policies, RDP to the server, possible workstation and server administrators, and possible DB administrators.
\n\n\n\nI also found computers that could potentially be my target customer database servers, thanks to SPN scanning and hostname keyword searches for “db”, “sql” etc.
\n\n\n\nI decided to hunt for these users on the network and see if there was a way to compromise them. I ran user hunting and session enumeration scripts, but I could not enumerate any sessions on the DC.
\n\n\n\nNetCease? No way. Just no way. The one thing I had counted on, they took from me.
\n\n\n\nFile servers were always a good target for session enumeration. Everyone connects there. But it was a NAS device that everyone was mapped to. No session enumeration was possible.
\n\n\n\nI felt like I was facing Gandalf.
\n\n\n\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/01/4-RTC.png\")
Just so you know, if someone kills session enumeration on their network, finding user targets becomes a matter of luck, chance, and brute force. It increases your chances of being detected because you have to expand the footprint of your search.
\n\n\n\nI was suffering because I did not have rights.
\n\n\n\nYou can still enumerate sessions if you are an administrator on the target machine, but I had no admin privileges.
\n\n\n\nAnd to top it off, most of the workstations had blocked WMI and SMB. So even BloodHound would come back empty from workstations.
\n\n\n\nI also found that the workstation computers had LAPS attributes! Local administrator password reuse was out of the question now.
\n\n\n\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/01/5-RTC.png\")
This meant that even if I serendipitously managed to get local admin access on my machine, the local administrator password was useless to me as I couldn’t use it anywhere else!
\n\n\n\nLast day of the assessment and I was staring at a bunch of dead ends
\n\n\n\nI did manage to get administrative access to three UAT servers that had “Domain Users” in the administrator’s group. It seemed like the UAT segment did not have the same rigorous blocks as compared to the production segment.
\n\n\n\nThis story is about all the stuff that was done right.
\n\n\n\nUltimately, I was up against someone who knew how people like me operate. They didn’t do anything too fancy. They just meticulously removed options from my arsenal. And that’s half of what Active Defense is all about.
2:30 PM on an overcast Tuesday in August. You can smell the earth from the coming monsoon deluge even twelve stories up in our quiet conference room, where, for some reason, the power is flickering. Over the next six hours, we will hack into one of the world’s largest banks. Thrice.
\n\n\n\nThis is a cautionary tale of why you can’t prevent a motivated hacker from ‘getting in’, no matter how much of your cybersecurity budget is spent on sleek blinking boxes and Zegna-clad consultants.
\n\n\n\nIt’s why you never gamble against human resolve and ingenuity, but bet big on smart people consistently making bad decisions. For, as hackers say;
\n\n\n\n\n\n\n\n“There is no patch for human stupidity”
\n\n\n\n“These guys are no helpless newbies.”
J, one of our red-teamers, takes a long drag from a clove cigarette and watches the rain obscure the distant railway tracks. He’s right. The bank has state of the art security systems, manned by one of the most skilled infosec teams in the business.
\n\n\n\nThe bank hires us to do this breach readiness assessment / red-team /penetration test stuff regularly, but this time the mission is different.
\n\n\n\nWe’re trying to dispel the myth that it is even possible to defend against an initial intrusion. Our success (or failure) will decide how much effort they now put into prevention (locking the door), as opposed to detection and response (spot the burglar early and take them down fast).
\n\n\n\nThere’s a nuanced difference between an intrusion and a breach, and once you see it, you’ll never interchange the words again.
\n\n\n\nMost importantly, you can (and will) have intrusions, without necessarily experiencing breaches. How so?
\n\n\n\nJust like The Simpsons, the wonderful Richard Bejtlich already did it (and put it rather well):
\n\n\n\nAn intrusion is unauthorized access to a computing resource. A breach is the theft, alteration, or destruction of that computing resource, following an intrusion.
\n\n\n\nOne can avoid a breach following an intrusion if the security team can stop the adversary before he accomplishes his mission.
\n\n\n\nThere is no point at which any network is intrusion-proof. It is more likely one could operate a breach-proof network, but that is not completely attainable, either.
\n\n\n\nBack to the hack.
\n\n\n\nWe must consistently and repeatedly subvert the banks security. It’s Moscow rules: Once is luck, twice is a coincidence, thrice is a pattern.
\n\n\n\nOh, and anything is fair game. In fact, we’re expected to play as dirty as possible.
\n\n\n\nHere are just some of the preventive controls getting in the way:
\n\n\n\nOur first target is a small branch. Extensive reconnaissance (a.k.a a couple of phone calls) reveals that they have an on-site IT manager named Todd.
\n\n\n\nWe’re going to hack Todd using a cell-phone…
\n\n\n\nRoadblock 1:
USB devices are blocked, but we find out that Todd in particular has access to a CD-ROM for some long-forgotten business requirement. Code execution is even easier — We’re going with PowerShell, expecting that the IT manager will be allowed to use it.
We print up brochures asking Todd to attend an IT event (by invitation only, as these things often claim). We’ve also printed 25 lucky draw scratch cards, but the dice is loaded and the deck is stacked:
\n\n\n\nBeneath the inviting silver foil, every scratch card has the same prize — an iPhone 7s.
\n\n\n\n![\"Planting](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/09/Screenshot-2020-09-10-at-3.05.53-PM-1024x784.png\")
Our forward team, Myra and J, head over with the newly minted material and a CD containing our PowerShell malware. If executed, it will give us external access to the bank from our command and control server. J is wearing a hidden camera.
\n\n\n\n![\"Good](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/09/Screenshot-2020-09-10-at-3.31.44-PM-1024x537.png\")
![\"Playing](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/09/Screenshot-2020-09-10-at-3.34.18-PM-1024x536.png\")
![\"Gotcha\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/09/Screenshot-2020-09-10-at-3.38.57-PM-1024x548.png\")
<click> <click>
\n\n\n\nRoadblock 2:
The bank blocks all sites except for an approved list of categories on their proxy. If our command and control server isn’t in the ‘banking websites’ category, we won’t gain access. Our solution? Ask the proxy vendor nicely. Yes, this worked.
With remote access to their branch network, we move laterally, escalate privileges, and gain access to a bunch of critical servers.
\n\n\n\nHack #1 complete.
\n\n\n\n“There are only two departments nobody messes with — the first is payroll, and the second is H.R.”, Corvus, our finance manager proclaims unsolicited.
\n\n\n\nLightbulbs go off at the same time as the power comes back on.
\n\n\n\nIt’s true, our experiments show that employees have an almost Pavlovian response to acquiescing to H.R. queries.
\n\n\n\n![\"The](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/09/Screenshot-2020-09-10-at-6.13.40-PM-972x1024.png\")
The email went out to a selection of employees on LinkedIn that deal with
ATMs, cardholder data, and transaction processing systems such as SWIFT. We threw in some digital marketing folks, as they’re notoriously click-happy.
Roadblock 3:
The email link scanning and quarantine system wouldn’t allow a link in an email but also wouldn’t care about them inside documents. The PDF link leads to a customized phishing page and an actual survey to submit, because, why not?
![\"Survey\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/09/Screenshot-2020-09-10-at-6.23.36-PM-852x1024.png\")
Two hours later we have over 40 phished credentials and an 84% success rate.
\n\n\n\nHack #2 complete.
\n\n\n\nThe success of the first two hacks has the team getting cocky. Myra is the first to broach the idea of physically getting to the trading floor systems.
Perhaps it’s the cups of coffee, or the desire to get out of the office again.
Why not? The weather’s perfect!
\n\n\n\nRoadblock 4:
The. Trading. Floor. Where separate lifts are manned by the aforementioned security staff who lift heavy objects for fun. The domain of the traders, with their special orange lanyards, who eat at the more upscale eateries down the street, because well, that’s what traders do.
J’s a hardware guy. The traders have RFID badges. Identifiable orange lanyards that they leave at their tables in the restaurant. 45 minutes and much ProxMox configuration in the back of a car later, we have a clone of one of their RFID cards (HID Prox II).
\n\n\n\nWe’re still not sure it will work though. A guard eyeballs J as he walks toward the door. The guard’s hand moves to his revolver (okay, the gun never happened, but J tells it like that for the ladies). He approaches the RFID scanner.
\n\n\n\n<blink and beep> We’re in.
\n\n\n\nJ’s got three brand new keyboards under his arm (the nifty ones with LEDs and integrated trackball). He walks into the cabins of three staffers and says;
\n\n\n\n“Hey I’m from I.T., I’m here to install your keyboard upgrade.”
\n\n\n\nEach of the keyboards has a Wi-fi keylogger attached to the end. Nobody refuses the upgrade. However, one manager makes J spend half an hour debugging Outlook and yells at him when he can’t fix it. J uses Mutt.
\n\n\n\n![\"Hacking](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/09/Screenshot-2020-09-10-at-6.30.08-PM-1024x409.png\")
We sit in the parking lot with a wireless antenna, watching them type in trades and send emails full of in-jokes until the sun goes down. It’s still raining.
\n\n\n\nHack #3 complete.
\n\n\n\nThe notion that initial intrusions can be reliably prevented is extremely flawed, especially when you don’t know what lengths the attacker will go to win.
\n\n\n\nThis is not to say that we abandon the idea of prevention and leave the doors wide open. Prevention systems can stop a lot of the low hanging fruit — commodity malware, regular phishing, Internet scans. Just don’t expect it to thwart the highly targeted attacks.
\n\n\n\nThe cybersecurity industry is moving towards ‘assume breach’, shifting
resources from ‘prevent’, to ‘detect and respond’, however it’s moving way too slowly.
Far too many defenders still don’t viscerally understand that this is the way it should be. Worse, this paradigm is often not communicated or well-received by the board, leading to mismatched expectations when intrusions inevitably occur.
\n\n\n\nIf this sounds familiar to you, help move things along by sharing this story, as well as your own.
\n\n\n\nIt’s about time we got out from under this cloud.
\n","excerpt":"2:30 PM on an overcast Tuesday in August. You can smell the earth from the coming monsoon deluge even twelve stories up in our quiet conference room, where, for some reason, the power is flickering. Over the next six hours, we will hack into one of the world’s largest banks. Thrice. This is a cautionary […]\n","status":"publish","wordpress_id":18544,"featured_media":{"id":"c1c0f980-d711-5599-9a1f-02543556ac52","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/09/Breaking-into-a-bank-Smokescreen-3.png","alt_text":"Red teaming for a bank","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAAAsTAAALEwEAmpwYAAADKklEQVQ4y4WS3U+bZRjGX1ygtNAWaEtbKDDKVymlrVDqtgiZTLbxvXWMBcNE2GZG1CVkylgGMYsnmv0T6jww2YwmbsjHwXAfnmxxajLdPPLIgHxNtw5bHT/v5yEunvkmV977eXM/v+d6rvs1vpsY4t65YX4S3Z/c0oPJER5MHftf/dt/f2qEH2X/D2eHMBYXrrB8fZr1b+Z4fPuaaEHqeVZvzjzTmmj91tyWpG/t1iwrN77S/ck7C7pWfUtfX8VILv3K0z/W2VhZ5Pz4W8xc/pinv6/Ak0eQFG0k2Xz0kNTqb6TXlvlzdYm/Hq7C32l+ufc9P9+9DekNniwvaoaRSqXY3NxkYnyMhkgVXe0tvHtujC8uf8KlTz/k+sIcK8tL/PdJp1Nc/fJzRl8/ytBggrvf3tn6LixDFfPzs9TVlnN+8k1OjQ4y8mqC/sQ+Tgz3iw5z9p1Rpq98RjL5mJs3rvH22EkSPS9z5vRJPnjvDO17m5mdmdZQ4+LFjzjQ20VxkYsdTWENOtLXTlvrLno693DoQDvHh49wbKiP8dNvMHC4i+Ov9TN8tE9rauKU9LQRb6zjwoX3MTIzMzAMg0JXAeVlRdhtuVhzzUTDAXY3x+VdS6iuioisG6JBiWQPJ0ZeoXP/S+xva3lWN0Zr8Ykpw2q1YDJlYbXmUFLsxlFgJz/PSonPQ32ohh3xKJH6AGWlXrweF0VeF7t2NtLd0UZv9z4GBxIM9PfK7SJUlPswnI487PZcgoEKOaGQHEs2WVmZeqNyXpBvp76umngsIgpTXVmmwbtbdnLoYKeORAEPdu/lhVg9hsuZj0+cxWVR4S8RgI2yEi+hYJUGKscZGRn6Bv7tJcQaQlo11eU0NYYl6xfpE2hPRyutzU0YNlsOpQKorfHjLnSgDggG/FT6SyVLi0B8bNv2nHaqwBZztvQ5tetKMRAKVtIhU449HyQWDWBYLCYBemTKW9d1OfN0o8ftpNTnFmCxHpTX48ScbdLxqMzVN3W4x+0gHKqSPT62S86GOTtL56XcKHieHohbAxwOu0w/Xw/JXViA6lW1upX6K2wyULPZpLNXQAX/B8znISPzXkyUAAAAAElFTkSuQmCC","aspectRatio":1.5037593984962405,"src":"/static/80d58b3ab3dbdc1c5ab5556ab7b00251/bc8e0/Breaking-into-a-bank-Smokescreen-3.png","srcSet":"/static/80d58b3ab3dbdc1c5ab5556ab7b00251/8ac63/Breaking-into-a-bank-Smokescreen-3.png 200w,\n/static/80d58b3ab3dbdc1c5ab5556ab7b00251/3891b/Breaking-into-a-bank-Smokescreen-3.png 400w,\n/static/80d58b3ab3dbdc1c5ab5556ab7b00251/bc8e0/Breaking-into-a-bank-Smokescreen-3.png 800w,\n/static/80d58b3ab3dbdc1c5ab5556ab7b00251/6050d/Breaking-into-a-bank-Smokescreen-3.png 1200w,\n/static/80d58b3ab3dbdc1c5ab5556ab7b00251/00405/Breaking-into-a-bank-Smokescreen-3.png 1600w,\n/static/80d58b3ab3dbdc1c5ab5556ab7b00251/9b570/Breaking-into-a-bank-Smokescreen-3.png 3300w","srcWebp":"/static/80d58b3ab3dbdc1c5ab5556ab7b00251/ccdb5/Breaking-into-a-bank-Smokescreen-3.webp","srcSetWebp":"/static/80d58b3ab3dbdc1c5ab5556ab7b00251/6b183/Breaking-into-a-bank-Smokescreen-3.webp 200w,\n/static/80d58b3ab3dbdc1c5ab5556ab7b00251/fc32b/Breaking-into-a-bank-Smokescreen-3.webp 400w,\n/static/80d58b3ab3dbdc1c5ab5556ab7b00251/ccdb5/Breaking-into-a-bank-Smokescreen-3.webp 800w,\n/static/80d58b3ab3dbdc1c5ab5556ab7b00251/9000d/Breaking-into-a-bank-Smokescreen-3.webp 1200w,\n/static/80d58b3ab3dbdc1c5ab5556ab7b00251/e0075/Breaking-into-a-bank-Smokescreen-3.webp 1600w,\n/static/80d58b3ab3dbdc1c5ab5556ab7b00251/34742/Breaking-into-a-bank-Smokescreen-3.webp 3300w","sizes":"(max-width: 800px) 100vw, 800px"}}}},"author":{"name":"Sahir Hidayatullah"}}},{"node":{"id":"535367e8-f2f6-543a-ba9c-07ebdb0dea47","slug":"the-one-where-i-pulled-an-oceans-11","title":"The one where I pulled an Ocean’s 11, without a crew","content":"\nAs a red teamer, I have the distinct privilege of dealing with some of the most exciting security challenges. There’s never a dull moment. Every time I think it can’t get any better, I run into something that I’ve never encountered before.
\n\n\n\nThis is one of those stories – an experience that has had a profound impact on me. It is hacking the way I had never thought of before.
\n\n\n\nIt starts back in the day when I was a consultant hacker in the US of A and was relentlessly jumping from state to state. I had built somewhat of a reputation in a niche doing internal pen tests, which meant I was traveling a lot.
\n\n\n\nAfter racking up nearly 230 days of travel that year, I was jaded and had asked my boss for some much-needed downtime. For a couple of days, I wanted to sleep somewhere that was not a hotel room.
\n\n\n\nI was just hanging out at the office, catching up on the industry and pending reports, when the bossman walked up to me – he had this way, where he’d stroll up to your desk and say:
\n\n\n\n\n\n\n\n“Hey, you got a minute?”
Whenever I had been at the receiving end of this question, it had always been followed up with something interesting.
\n\n\n\n“Sure, boss, what’s up?” I asked.
\n\n\n\n\n\n\n\n“A client has just reached out to me. Interesting work. You up for it?”
\n\n\n\n“I’ll take that as a rhetorical question, boss.”
\n\n\n\n“Well, this company has an office in a business complex shared with many others. A couple of weeks ago, one of the other companies in the complex had an incident. They caught a random person walking around their office premise. They’ve asked if we can do something similar, as a test.”
It couldn’t be that easy, so I asked, “You mean, I go to their office and just stroll around?”
\n\n\n\n\n\n\n\n“Well, it’s not that simple. We’ve worked out a scenario and a goal. The client has sanctioned a laptop and labeled it. They have a section in their office that’s only partially occupied. That’s where they’ll place it in one of the empty cubicles. “
\n\n\n\n“Ok.”
\n\n\n\n“You’ll have to break into the office and steal the laptop.”
\n\n\n\n“Ok.”
\n\n\n\n“You also have to get into the laptop, connect to their network, and get domain admin access. Once you get the access, take the laptop and walk out of the premises.”
\n\n\n\n“…”
\n\n\n\n“That’s it.”
After an awkwardly long but understandable pause, I attempted to sum up the ask to make sure I had got it right.
\n\n\n\n\n\n\n\n“So let me get this straight. You need me to get into the business complex, get on an elevator, find the floor where the company is located, get through their access-controlled doors, find a labeled laptop in a partially occupied section, plug it into a power source, break into it, spend hours hunting for domain admin, do all of this without getting caught, and then just walk out of there with the laptop?”
\n\n\n\n“Yep.”
\n\n\n\n“That sounds crazy, boss.”
\n\n\n\n“It is.”
\n\n\n\n“Really crazy.”
\n\n\n\n“I know.”
\n\n\n\n“Who’s working with me on this?” I asked, looking at the empty seats of my on-the-road colleagues.
\n\n\n\n“You’re it.”
\n\n\n\n“How much time do I have?”
\n\n\n\n“Well, on paper, you’ve got two weeks. Based on my experience, however, you pretty much only have one shot to execute your plan, unless you are really, really lucky.”
I spent the rest of that day talking to seniors on the team who had prior experience with similar assignments. The common thread in all of those conversations was to never underestimate the value of thorough reconnaissance. I would understand the real meaning of their advice later that week.
\n\n\n\nThe stuff that happens in movies makes it look so easy, but recon is a tedious job. Though I did motivate myself by thinking of this mission as breaking into the Ministry of Magic with Harry, Ron, and Hermione to steal a Horcrux.
\n\n\n\nI looked for anything and everything that could be interesting or valuable on the internet first. In fact, I spent 16 hours just doing internet recon.
\n\n\n\nI felt I had found everything I could, but ultimately I had to get out of the comfort of my chair and go out into the real world.
\n\n\n\nThe building was located in a busy business district. It had about 23 floors. Lots of foot traffic in the morning, lunchtime, and the end of the day. There was a coffee shop a block away, where people would walk to in groups to grab a cup of joe.
\n\n\n\nI had learned to recognize the logo of the company, and ever so often, I’d see people from the company walking along with their entry badges attached to their belts or strung around their neck. I also noticed a few people wearing visitor badges (“V”).
\n\n\n\nI considered cloning one of the badges, which would mean I would have to get real close to a target. Somehow, the thought of doing that made me want to run away and lock myself in a house somewhere in the icy isolation of Nova Scotia. So, I decided to designate that Plan B.
\n\n\n\nIt was a creepy experience, but I managed to get a picture of both those badges by zooming in with the phone cam. I went back to the office and got replicas created.
\n\n\n\nI scoped out the lobby of the building. There were lots of people sitting on couches and chairs laid out, so I fit right in. One thing that made me really happy – No turnstiles.
\n\n\n\nI confirmed from the directory that I had the right floors for the company. I eavesdropped on conversations at the information desk, and thankfully, it seemed like just that, an information desk. There was no one checking the badges, but there was a security guard.
\n\n\n\nI didn’t want to hang around for too long and get on the guard’s radar. I managed to sit there for about 30 minutes, taking in as much information as I could.
\n\n\n\nAnd then I left – Big mistake. You see, I’d missed scoping out the elevator itself. I just didn’t think it was important enough, and that was poor judgment. I didn’t even consider going up to the floor, fearing that the receptionist will notice me. I would later pay dearly for this mistake.
\n\n\n\nI put all the information I had gathered together. Finally, after running several scenarios in my head, one which included applying for a job at the company, I decided to keep it simple. I would just walk into the building at around 9:30 am when the traffic was just about dwindling and tailgate someone. I had seen the fire escape plan, but that didn’t tell me where the cubicles were. I would have to just wing it from that point on until I got hold of the laptop. Then I’d find myself an empty conference room, get connected, and blitz through the network. I was the most confident about this part. If someone was to ask me questions, I’d just say I am waiting for a meeting to start.
\n\n\n\nThe night before, I couldn’t sleep. The following day would be one of only 4 times in my life that I got into the office at 6:30 am off my own accord. I just wanted to be in a comfort zone, have a chat with the bossman, and grab my favorite coffee from the cafeteria.
\n\n\n\nAt around 8:45 am, I walked into his office.
\n\n\n\n\n\n\n\n“Boss, it’s time.”
\n\n\n\n“Nice. Good luck. Do you have a copy of the letter?”
\n\n\n\n“What letter?”
\n\n\n\n“The letter that says this is an authorized activity in case you get caught. Unless you want to be rugby tackled.”
\n\n\n\n“No, I don’t have the letter.”
\n\n\n\n“Just shared it with you. Take a print out. Keep it with you in your pocket. Not in your bag.”
That letter. The best way I can describe that letter is that it was not one you should read if you need confidence. It had the details of the assignment, who authorized it, phone numbers, blah blah. But I was fixated on one sentence – ‘Do not attempt to detain or physically subdue the person in possession of this letter.’
\n\n\n\n\n\n\n\n“Physically subdue? Boss, is this a possibility?”
\n\n\n\n“No. Because you won’t get caught.”
\n\n\n\n“Thanks, Boss.”
It was showtime.
\n\n\n\nEveryone has a plan until they get punched in the face. And I got punched pretty early.
\n\n\n\nRemember the elevator? The one I hadn’t scoped out? Turns out, the floors I needed access to were restricted. The employee badges were configured to give access to the floor. My fake badge was as good as paper.
\n\n\n\nI rode the elevator back to the lobby and calmed my nerves by grabbing a cup of coffee. I ended up buying 4 of them. I decided to go with the old “Hands full, can you help me with the floor, please?” trick.
\n\n\n\nI got back into the elevator carrying the 4 coffees when the second problem I hadn’t anticipated unfolded – no one riding the elevator with me was going to the floor I wanted.
\n\n\n\nI think I was in the elevator for at least 15 minutes, but it felt like years. Writing this reminds me of the nervousness, uncertainty, and fear I was feeling. And I was really, really nervous. I suddenly became very, very aware of the camera in the elevator. Imagine being a security guard monitoring the camera, watching a dude with 4 coffees ride up and down in the elevator multiple times. I was running a risk, but I couldn’t get myself to think of another plan. Tailgating was still the best option.
\n\n\n\nAnd finally, on probably the 8th iteration, someone walked in and hit the floor that I had to get off on. The dude walked out, and I almost spilled the coffee while sticking my feet between the closing doors to get out.
\n\n\n\nAlmost immediately, I noticed that there was no receptionist on the floor. The dude had opened the access-controlled door, turned into the hallway, and was out of sight. I sprinted towards the closing door, propped it open again with my leg, and got in.
\n\n\n\nI had made it.
\n\n\n\nI was now the random dude walking around the office. Once in, I had to take photos to prove that I was actually on the premises. I had ditched the coffee because my hands were shaking. I was relieved and also mortified that I had made it this far. I took a bunch of photos, but thanks to the fact that I was so full of adrenaline, nearly all of them were grainy. I would later present those photos in the report I shared with the customer where I told them: “You now have a record of the exact time and location I almost wet myself.”
\n\n\n\nA few minutes later, I ran into a lady in the hallway.
\n\n\n\n\n\n\n\n“Can I help you with something?”
\n\n\n\n“Could you point me in the direction of the restroom?”
\n\n\n\n“Down the hall, to the right.”
\n\n\n\n“Thanks! “
I scoped out the floor and found the space with the mostly empty cubicles. It was easy to spot the labeled laptop. For a moment there, I felt relieved – finally, a situation that wasn’t a curveball.
\n\n\n\nI couldn’t find an empty conference room, but I did find the coffee room with a printer and two ports. I would later connect the laptop and also get an IP. It was still only 10:55 am. I had gotten this far in under 90 minutes.
\n\n\n\nI had decided I’d pretend to be the guy troubleshooting the printer if anyone asked.
\n\n\n\nFor the duration I was there, I built up tremendous amounts of confidence. I even had a chat with a couple of folks, exchanging niceties about the weather and what a pain printer technology was.
\n\n\n\nMy friends, the rest of the story is about how I owned a domain while standing in a coffee room pretending to troubleshoot a printer.
\n\n\n\nListen, in those days, it wasn’t that difficult.
\n\n\n\nThere was no MITRE ATT&CK, security awareness was just building up, and stopping threats at the perimeter (or at least trying to) was where the money was being made. No one cared about internal detection. In most cases, you could do a Nmap scan with 1000 ports and aggressive OS guessing, and you would still not be detected. There was minimal awareness about Active Directory attacks and how shared local admin passwords were a bad thing. You could even authenticate using null sessions and didn’t need domain credentials to enumerate the network.
\n\n\n\nBut there was also no Mimikatz, no BloodHound, and no PowerShell. Windows XP and 7 were the most prevalent systems. I don’t even think there was Kali. It used to be BackTrack.
\n\n\n\nThe laptop wasn’t encrypted. That was normal in 2011-12. It was also the days of LM hashes, the less secure version of current-day NTLM. If you got an LM hash, you could crack 8 character passwords of any complexity thanks to rainbow tables.
\n\n\n\nI booted BackTrack to the laptop, obtained and cracked the local admin password, and was able to log in. I could have zeroed out the password too, but this was cooler. Another objective was achieved.
\n\n\n\nI loaded my favorite tool of the time, SQLPing. It would look for SQL servers and could even be used for password guessing. It searched the master browser for SQL servers.
\n\n\n\nI popped about 5 SQL 2003 servers with sa/{blank} combinations.
\n\n\n\nI used xp_cmdshell and gsecdump to get hashes from memory, SAM, and LSA secrets.
\n\n\n\nLSA secrets had a clear-text password for a sqladmin account.
\n\n\n\nI verified the group membership of sqladmin account. It was a domain admin.
\n\n\n\nA quick “net use” to the admin$ share of the domain controller confirmed my access as did the secondary verification using “runas”.
\n\n\n\nScreenshots. Closed the laptop. Shoved it into my bag. And walked right out without getting caught.
\n\n\n\n