credential assessment - mapping privilege escalation at scale

45

Credential Assessment Mapping Privilege Escalation at Scale Matt Weeks @scriptjunkie1

Upload: scriptjunkie

Post on 16-Jul-2015

560 views

Category:

Technology

3 download

Report

Download

Tags:

Embed Size (px):

TRANSCRIPT

Page 1: Credential Assessment - Mapping Privilege Escalation at Scale

Credential AssessmentMapping Privilege Escalation at Scale

Matt Weeks

@scriptjunkie1

Page 2: Credential Assessment - Mapping Privilege Escalation at Scale

Page 3: Credential Assessment - Mapping Privilege Escalation at Scale

Page 4: Credential Assessment - Mapping Privilege Escalation at Scale

http://www.aorato.com/blog/untold-story-target-attack-step-step/

Page 5: Credential Assessment - Mapping Privilege Escalation at Scale

Page 6: Credential Assessment - Mapping Privilege Escalation at Scale

Page 7: Credential Assessment - Mapping Privilege Escalation at Scale

Page 8: Credential Assessment - Mapping Privilege Escalation at Scale

Page 9: Credential Assessment - Mapping Privilege Escalation at Scale

Page 10: Credential Assessment - Mapping Privilege Escalation at Scale

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10

Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000

1

10

100

1000

10000

Adversary access (# boxes owned)

Page 11: Credential Assessment - Mapping Privilege Escalation at Scale

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10

Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000

1

10

100

1000

10000

Adversary access (# boxes owned)

Find and fix all the

vulnerabilities, block

contractor access

Pentests, vuln

assessments

Many companies try this.

Find known malware.

The entire AV industry does this.

Hunt anomalies

Fewer do this.

Both are important parts of a security program

Page 12: Credential Assessment - Mapping Privilege Escalation at Scale

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10

Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000

1

10

100

1000

10000

Adversary access (# boxes owned)

What happened

here?!

Page 13: Credential Assessment - Mapping Privilege Escalation at Scale

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10

Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000

1

10

100

1000

10000

Adversary access (# boxes owned)

Bad guys got a DA token;

Creds left on a webserver.

Page 14: Credential Assessment - Mapping Privilege Escalation at Scale

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10

Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000

1

10

100

1000

10000

Adversary access (# boxes owned)

Malware detection and vulnerable boxes are not the biggest enterprise problem, admin creds lying

around all over the domain is.

Bad guys got a DA token;

Creds left on a webserver.

Page 15: Credential Assessment - Mapping Privilege Escalation at Scale

Page 16: Credential Assessment - Mapping Privilege Escalation at Scale

Page 17: Credential Assessment - Mapping Privilege Escalation at Scale

Page 18: Credential Assessment - Mapping Privilege Escalation at Scale

Page 19: Credential Assessment - Mapping Privilege Escalation at Scale

Page 20: Credential Assessment - Mapping Privilege Escalation at Scale

Scanners Collectors

DatabaseAnalysis UI

Page 21: Credential Assessment - Mapping Privilege Escalation at Scale

Page 22: Credential Assessment - Mapping Privilege Escalation at Scale

http://extract.ntdsd.it/

http://extract.ntdsd.it/

Page 23: Credential Assessment - Mapping Privilege Escalation at Scale

Page 24: Credential Assessment - Mapping Privilege Escalation at Scale

Uh oh!

Page 25: Credential Assessment - Mapping Privilege Escalation at Scale

https://www.facebook.com/video.php?v=775771782450420

Page 26: Credential Assessment - Mapping Privilege Escalation at Scale

Page 27: Credential Assessment - Mapping Privilege Escalation at Scale

Page 28: Credential Assessment - Mapping Privilege Escalation at Scale

Page 29: Credential Assessment - Mapping Privilege Escalation at Scale

Page 30: Credential Assessment - Mapping Privilege Escalation at Scale

Page 31: Credential Assessment - Mapping Privilege Escalation at Scale

Page 32: Credential Assessment - Mapping Privilege Escalation at Scale

Page 33: Credential Assessment - Mapping Privilege Escalation at Scale

Page 34: Credential Assessment - Mapping Privilege Escalation at Scale

Page 35: Credential Assessment - Mapping Privilege Escalation at Scale

Page 36: Credential Assessment - Mapping Privilege Escalation at Scale

Page 37: Credential Assessment - Mapping Privilege Escalation at Scale

Page 38: Credential Assessment - Mapping Privilege Escalation at Scale

It can be done!

Page 39: Credential Assessment - Mapping Privilege Escalation at Scale

Page 40: Credential Assessment - Mapping Privilege Escalation at Scale

Page 41: Credential Assessment - Mapping Privilege Escalation at Scale

Page 42: Credential Assessment - Mapping Privilege Escalation at Scale

Page 43: Credential Assessment - Mapping Privilege Escalation at Scale

Page 44: Credential Assessment - Mapping Privilege Escalation at Scale

Page 45: Credential Assessment - Mapping Privilege Escalation at Scale

Ethical Hacking and Countermeasures...Privilege Escalation Using DLL Hijacking Privilege Escalation by Exploiting Vulnerabilities Privilege Escalation Using Dylib Hijacking Privilege

Fine-grained Detection of Privilege Escalation Attacks on ...calzavara/papers/esop15-full.pdf · Privilege Escalation Attacks. Privilege escalation attacks have been extensively studied

ATTACK in 15 minutes FINAL - TaxAdmin.org · Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Execution Collection Exfiltration Command

| 1 | Using ATT&CK to Find Cyber Threats and Bolster Cyber Defense€¦ · Deconstructing the Lifecycle Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential

SIMPLE%TECHNICS%OF PRIVILEGE%ESCALATION% · Kamil Stawiarski – Simple technics of privilege escalation in Oracle Database 11.2.0.3!! 2! Environmentdescription% • OS!I!Oracle!Linux!Server!release!6.3!x64!

Upgrading Your Android, Elevating My Malware: Privilege Escalation Through Mobile OS Updating

Windows privilege escalation by Dhruv Shah

Fundamentals of Linux Privilege Escalation

Cyber Threat Intelligence: A Team Sport...ATT&CK is grounded in empirical data from cyber incidents Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral

Towards Taming Privilege-Escalation Attacks on Android

Module 7 – Gaining Access & Privilege Escalation Phase II Controls Assessment Scheduling ○ Information Gathering ○ Network Mapping ○ Vulnerability

Active Directory Privilege Escalation - Paramount Defenses€¦ · Active Directory Privilege Escalation often involves successively escalating privilege multiple times over, gaining

Extreme Privilege Escalation on Windows 8/UEFI Systems · This style of privilege escalation has been well explored by other researchers such as [6][7]. There are other, more extreme,

Hacking and Defending the Big 4 Databases€¦ · Exploiting Privilege Escalation Attack Target: –Oracle11g Release 2 Privilege Level: –CREATE PROCEDURE and EXEC on MDSYS.RESET_INPROG_INDEX

Detecting and Preventing Privilege- Escalation on Android Jiaojiao Fu 1

SIMPLE%TECHNICS%OF PRIVILEGE%ESCALATION% · PDF fileKamil Stawiarski – Simple technics of privilege escalation in Oracle Database 11.2.0.3!!! 2! Environmentdescription% • OS!B!Oracle!Linux!Server!release!6.3!x64!

Linux Privilege Escalation - FedVTE Online Training Portal … · 2015-05-03 · Linux Privilege Escalation. ... Never use the root account by default ... than they've been doing

Controlled Privilege Escalation in Linux/UNIX … · Controlled Privilege Escalation in Linux/UNIX ... or a "guest" admin might be empowered to ... In Solaris 8, Sun introduced RoleBased

Preventing Privilege Escalation Presented By Chad Frommeyer

Upgrading Your Android, Elevating My Malware: Privilege Escalation Through Mobile OS Updating

CSW2017 Privilege escalation on high-end servers due to implementation gaps in CPU Hot-Add flow

Preventing Privilege Escalation

Logging. What is a log? What gets logged? Logins / logouts Privilege escalation Security relevant events

Efﬁcient Privilege De-Escalation for Ad Libraries in ...bliu1/Bin_Liu_MobiSys2015_Efficient.pdf · Efﬁcient Privilege De-Escalation for Ad Libraries in ... Android device shipments

Using Advanced Threat Analytics to Prevent Privilege Escalation Attacks

Horizontal Privilege Escalation in Trusted Applications

Hacker Explains Privilege Escalation: How Hackers Get ... · Escalation Privilege escalation is the result of actions that allows an adversary to obtain a higher level of permissions

Security Bulletin - July 2019€¦ · Linux kernel Local Privilege Escalation Vulnerability ( CVE-2019-12817 ) Linux Kernel is prone to a local privilege-escalation vulnerability

Efficient Privilege De-Escalation for Ad Libraries in Mobile Apps

Aide 2014 - Fundamentals of Linux Privilege Escalation

Extreme Privilege Escalation on Windows 8/UEFI · PDF fileExtreme Privilege Escalation on Windows 8/UEFI Systems ... The King's Gambit, ... Extreme Privilege Escalation

PowerUp - Automating Windows Privilege Escalation

20191025 - Windows Privilege Escalation Tricks€¦ · privilege escalation –There are FAR more misconfigurations than vulns –Vulns will be detected and patched by Nessus, Nexpose,

Hunting for Privilege Escalation in Windows Environment · Privilege escalation is the result of actions that allows an adversary to obtain a higher level of permissions on a system

Stage I. Privilege escalation and information collection 1