WEBVTT 00:00:01.640 --> 00:00:02.180 Hey there! 00:00:02.190 --> 00:00:05.520 Welcome to the course, Privilege Escalation with Rubeus. 00:00:05.520 --> 00:00:06.750 In here, 00:00:06.760 --> 00:00:09.920 we'll cover how you can get admin‑level access by 00:00:09.920 --> 00:00:12.260 attacking the Kerberos service of a domain. 00:00:13.840 --> 00:00:15.980 Imagine that you're working a red team engagement, 00:00:15.980 --> 00:00:19.590 and you're trying to compromise the Globomantics Corporation, 00:00:19.670 --> 00:00:23.150 which is composed by several laptops, an Active Directory, 00:00:23.160 --> 00:00:25.340 and a few other internal servers. 00:00:25.340 --> 00:00:30.300 Using some social engineering, you're able to compromise one user laptop, 00:00:30.300 --> 00:00:33.360 and although this is really good, we need more than that. 00:00:34.140 --> 00:00:37.600 Usually, users do not have a administrator‑level permission in the domain, 00:00:37.600 --> 00:00:40.460 and that's basically what you want in a red team exercise. 00:00:41.540 --> 00:00:44.430 So for that, we need to escalate our privileges. 00:00:44.430 --> 00:00:46.880 In here, in this course, 00:00:46.890 --> 00:00:50.460 we'll use Rubeus to retrieve hashed credentials from the Active 00:00:50.460 --> 00:00:52.490 Directory using some interesting techniques, 00:00:52.490 --> 00:00:54.360 such as the Kerberoasting attack. 00:00:55.240 --> 00:00:58.600 Then we will crack those hashes and use those credentials to 00:00:58.600 --> 00:01:00.660 compromise the other servers in the environment. 00:01:01.340 --> 00:01:04.660 In this way, we can then have full access to any system we want. 00:01:06.840 --> 00:01:08.800 If you've read about Kerberos attacks before, 00:01:08.800 --> 00:01:11.850 you might have noticed they are not that easy to perform manually. 00:01:12.440 --> 00:01:15.330 However, the good news here is that we have Rubeus. 00:01:15.330 --> 00:01:18.900 This tool allows us to interact with the Kerberos system 00:01:18.910 --> 00:01:21.360 and also automate a lot of those attacks. 00:01:22.740 --> 00:01:26.330 The Rubeus tool was primarily developed by harmj0y, 00:01:26.340 --> 00:01:28.760 which is a really famous cybersecurity researcher, 00:01:29.440 --> 00:01:32.950 and thanks to him, we can save a lot of time doing privilege escalation. 00:01:33.940 --> 00:01:35.890 If you've never heard about harmj0y before, 00:01:35.960 --> 00:01:38.620 I do recommend you checking out his Twitter and the 00:01:38.620 --> 00:01:40.150 several projects in his GitHub. 00:01:41.640 --> 00:01:42.300 Basically, 00:01:42.310 --> 00:01:46.860 Rubeus is defined by the author as a tool for raw interactions with Kerberos. 00:01:47.740 --> 00:01:48.310 However, 00:01:48.320 --> 00:01:52.150 I think the best part of Rubeus is not only the raw interactions but 00:01:52.150 --> 00:01:54.660 also the automated attacks that we can perform. 00:01:55.640 --> 00:01:59.560 For example, with just one command we can run a whole Kerberoasting attack. 00:02:01.940 --> 00:02:05.270 What I love about Rubeus is that it is an open source software, 00:02:05.280 --> 00:02:07.710 meaning that you can download it from this GitHub and 00:02:07.710 --> 00:02:10.030 modify the code as much as you want. 00:02:10.030 --> 00:02:10.860 Personally, 00:02:10.870 --> 00:02:14.160 I have customized it so I can output the data in a format that I want. 00:02:15.140 --> 00:02:15.690 Also, 00:02:15.700 --> 00:02:19.850 Rubeus is really good at facilitating the interaction with Kerberos systems. 00:02:20.440 --> 00:02:23.510 For example, if you want to list all the service accounts in a domain, 00:02:23.520 --> 00:02:25.100 Rubeus can do that for you. 00:02:25.100 --> 00:02:29.350 Or if you want to request service tickets, Rubeus can also do that for you. 00:02:30.140 --> 00:02:34.010 But as I mentioned, the beauty of this tool is not on the raw requests, 00:02:34.210 --> 00:02:38.150 but instead is on the automation of several privilege escalation attacks. 00:02:39.440 --> 00:02:42.640 For example, with Rubeus we can perform several attacks, 00:02:42.820 --> 00:02:46.750 including Kerberoasting attacks, AS‑REP roasting attacks, 00:02:47.440 --> 00:02:49.660 pass the hash and pass the ticket attacks, 00:02:50.440 --> 00:02:54.010 golden ticket attacks, and silver ticket attacks. 00:02:54.010 --> 00:02:58.270 In this course, we will focus on the first two attacks here, 00:02:58.460 --> 00:03:00.160 which are the most successful ones. 00:03:00.640 --> 00:03:03.760 But you should definitely check out everything that this tool can do for you. 00:03:05.940 --> 00:03:08.170 If you're familiar with the kill chain methodology, 00:03:08.180 --> 00:03:11.760 we can map this tool to the escalation phase of the kill chain. 00:03:12.640 --> 00:03:13.100 In here, 00:03:13.110 --> 00:03:16.740 we'll use Rubeus to get access to an admin account and use 00:03:16.740 --> 00:03:18.960 those accounts in key servers in the domain. 00:03:20.840 --> 00:03:23.600 Also, if you're familiar with the MITRE ATT&CK framework, 00:03:23.610 --> 00:03:26.360 we can map this course here to two phases, 00:03:26.840 --> 00:03:29.560 Privilege Escalation and Credential Access. 00:03:31.240 --> 00:03:35.970 Inside of Privilege Escalation, we will cover the technique T1134, 00:03:35.980 --> 00:03:38.050 which is the Access Token Manipulation. 00:03:39.240 --> 00:03:42.500 Also, we can map this course to the Credential Access phase, 00:03:42.500 --> 00:03:45.700 in which we'll cover the technique T1558, 00:03:45.700 --> 00:03:49.060 which is Steal or Forge Kerberos Tickets. 00:03:49.940 --> 00:03:53.740 And actually, to be more specific, we will cover those two sub‑techniques here, 00:03:53.870 --> 00:03:57.260 which are Kerberoasting and AS‑REP roasting. 00:03:59.440 --> 00:04:03.160 So, before I go into our lab, let's understand what we'll be doing here. 00:04:03.940 --> 00:04:07.420 So again, imagine that you're working on a red team engagement for Globomantics. 00:04:07.420 --> 00:04:10.440 As you can see in this diagram, on the left side, 00:04:10.440 --> 00:04:12.220 we have the laptops of the users. 00:04:12.220 --> 00:04:14.760 In the middle, we have our Active Directory, 00:04:15.140 --> 00:04:18.459 and on the right side we have some of the Globomantics servers. 00:04:18.459 --> 00:04:20.310 In our case here, 00:04:20.320 --> 00:04:22.840 we will assume that you already have compromised at 00:04:22.840 --> 00:04:24.460 least one machine in the environment, 00:04:24.940 --> 00:04:27.420 meaning that you have at least user‑level access to 00:04:27.420 --> 00:04:28.660 one of the machines in the domain. 00:04:29.640 --> 00:04:33.230 What we will do in our demo is leveraging our user‑level access on the 00:04:33.230 --> 00:04:36.660 Active Directory to retrieve hashed credentials from the service 00:04:36.660 --> 00:04:40.820 accounts in the Active Directory. And to retrieve those hashed 00:04:40.820 --> 00:04:43.220 credentials we'll use to famous techniques, 00:04:43.440 --> 00:04:46.760 which are the Kerberoasting and AS‑REP roasting. 00:04:47.740 --> 00:04:49.500 Once we have those hashed credentials, 00:04:49.510 --> 00:04:52.360 we can then brute force them offline using any tool. 00:04:52.940 --> 00:04:54.520 And if we are successful, 00:04:54.530 --> 00:04:58.060 we'll have the clear text passwords for some of those service accounts. 00:04:58.940 --> 00:04:59.660 Pretty cool, right? 00:05:01.640 --> 00:05:05.660 So if you want to follow the demos on your own environment, you need two things. 00:05:06.440 --> 00:05:10.000 First, you need a compromised machine that is part of a domain. 00:05:10.000 --> 00:05:14.460 In here, we'll use a Windows laptop that is part of the Globomantics domain. 00:05:16.040 --> 00:05:19.510 Also, you need a machine with Active Directory installed, 00:05:19.510 --> 00:05:22.250 and it is important that you have at least some service 00:05:22.250 --> 00:05:25.360 accounts registered in this AD so then we can try to 00:05:25.360 --> 00:05:26.760 retrieve their hashed passwords. 00:05:28.240 --> 00:05:29.790 But all right, enough of theory, 00:05:29.800 --> 00:05:32.860 let's go to our lab environment and see how it's done in real life.