WEBVTT 00:00:01.340 --> 00:00:01.860 Hi. 00:00:02.090 --> 00:00:04.640 My name is Gavin Johnson‑Lynn, and in this course, 00:00:04.640 --> 00:00:07.550 we're going to look at a RedTeam tool called LaZagne. 00:00:08.540 --> 00:00:11.750 This is a tool that retrieves credentials from a computer. 00:00:12.840 --> 00:00:16.860 Those credentials could then give you access to various software and 00:00:16.860 --> 00:00:19.860 systems that are linked with that computer and its users. 00:00:20.840 --> 00:00:23.000 So what is the LaZagne project? 00:00:23.010 --> 00:00:23.860 Bang Bang! 00:00:25.040 --> 00:00:28.440 It was created by Alessandro Zanni, and in his words, 00:00:28.450 --> 00:00:32.409 it's an open‑source application used to retrieve lots 00:00:32.409 --> 00:00:34.510 of passwords stored on a computer, 00:00:34.510 --> 00:00:37.860 and it was developed for the purpose of finding passwords 00:00:37.860 --> 00:00:39.860 for the most commonly‑used software. 00:00:40.840 --> 00:00:42.290 As it's an open‑source project, 00:00:42.290 --> 00:00:45.960 you are of course free to view the code and help maintain it. 00:00:47.040 --> 00:00:50.330 I'm really grateful to Alessandro and everyone else who 00:00:50.330 --> 00:00:52.650 creates and maintains projects like this. 00:00:53.940 --> 00:00:55.350 Let's look a little more closely. 00:00:56.140 --> 00:00:59.610 LaZagne is a post exploitation tool aimed at 00:00:59.610 --> 00:01:01.360 retrieving credentials from a system. 00:01:02.340 --> 00:01:05.960 It's written in Python and works on Windows, Linux, and Mac. 00:01:06.940 --> 00:01:09.460 There is a GitHub repository for LaZagne. 00:01:09.840 --> 00:01:10.360 In there, 00:01:10.360 --> 00:01:13.470 you'll be able to access the code and a copy of the Windows 00:01:13.470 --> 00:01:16.950 executable The repository is available here. 00:01:18.140 --> 00:01:22.160 As the spelling is fairly unique, an Internet search should get you there. 00:01:23.140 --> 00:01:27.290 The exercise files for this course do contain a PDF of the slides, 00:01:27.300 --> 00:01:30.060 where you'll be able to find all of the links we use. 00:01:31.340 --> 00:01:35.260 As we've already heard, LaZagne targets a variety of software. 00:01:36.240 --> 00:01:40.250 In Windows, it can retrieve credentials from over 60 pieces of software, 00:01:40.260 --> 00:01:43.150 including browsers, local administration tools, 00:01:43.160 --> 00:01:45.060 and operating system components. 00:01:46.140 --> 00:01:49.180 While its primary focus is the Windows operating system, 00:01:49.190 --> 00:01:51.450 it's still effective on Linux and Mac. 00:01:52.440 --> 00:01:55.560 Various threat groups have been known to use LaZagne while 00:01:55.560 --> 00:01:58.270 targeting organizations and governments. 00:01:58.270 --> 00:02:02.570 They include APT3, APT33, MuddyWater, and Leafminer, 00:02:02.570 --> 00:02:06.860 which are a selection of cyber espionage and 00:02:06.860 --> 00:02:09.259 potentially government‑backed organizations. 00:02:10.440 --> 00:02:14.530 On the RedTeam kill chain, LaZagne is a post exploitation tool, 00:02:14.530 --> 00:02:17.160 so it comes in after we've already exploited a 00:02:17.160 --> 00:02:19.560 weakness and gained access to a machine. 00:02:20.640 --> 00:02:22.670 Once there, we'll gather credentials, 00:02:22.680 --> 00:02:26.660 which will hopefully give us greater privileges and allow us to move laterally. 00:02:28.240 --> 00:02:31.520 Within the Mitre ATT&CK framework, LaZagne focuses on a 00:02:31.520 --> 00:02:34.060 single tactic, which is credential access. 00:02:35.140 --> 00:02:37.190 We're going to look at two techniques under this. 00:02:37.450 --> 00:02:42.830 The first one is T1552, unsecured credentials, and we're 00:02:42.830 --> 00:02:45.360 specifically looking at credentials in files. 00:02:46.440 --> 00:02:52.230 The second is T1555, credentials from password stores, where we'll 00:02:52.230 --> 00:02:54.560 target getting credentials from web browsers. 00:02:55.840 --> 00:02:59.600 An important point before we go further is that accessing 00:02:59.610 --> 00:03:02.840 and using computers without the owner's consent is against 00:03:02.840 --> 00:03:04.150 the law in most countries, 00:03:04.940 --> 00:03:08.410 Using LaZagne on someone else's computer is therefore going 00:03:08.410 --> 00:03:12.710 to be illegal. Once you've got permission, and you're certain 00:03:12.710 --> 00:03:15.350 that it covers running LaZagne, you should be good to go. 00:03:16.440 --> 00:03:20.660 Alternatively, you could always set up a computer of your own and test it out, 00:03:21.340 --> 00:03:25.260 but always be familiar with the laws around this before you start. 00:03:26.640 --> 00:03:30.980 Looking at the type of scenario LaZagne might be useful in, we start 00:03:30.980 --> 00:03:36.350 with the company's network. On the outside, we have an attacker They're 00:03:36.350 --> 00:03:40.190 scanning the internet and find a vulnerable machine that gives them 00:03:40.200 --> 00:03:44.450 access to the company's network. From there, they try to find 00:03:44.460 --> 00:03:46.160 interesting machines to access. 00:03:47.040 --> 00:03:49.350 There are of course plenty of other routes to a 00:03:49.350 --> 00:03:51.110 machine that an attacker could use, 00:03:51.250 --> 00:03:56.010 such as phishing or downloaded malware. When they find a machine 00:03:56.020 --> 00:03:58.850 and gain access to it, they start to run LaZagne. 00:03:59.940 --> 00:04:04.610 The code scans for common credential storage locations. It 00:04:04.610 --> 00:04:07.120 might find some related to cloud operations, 00:04:07.260 --> 00:04:12.180 such as AWS or Azure. If the user doesn't have protection 00:04:12.180 --> 00:04:14.390 like multifactor authentication in use, 00:04:14.560 --> 00:04:17.630 then those systems could be accessed, and they might house 00:04:17.630 --> 00:04:19.459 live infrastructure for the business. 00:04:20.540 --> 00:04:25.550 Accessing the user's browser could reveal credentials for a variety of websites. 00:04:26.540 --> 00:04:30.560 This might allow access to web‑based systems and the data they store, 00:04:31.140 --> 00:04:34.760 perhaps CRM systems or access to code repositories. 00:04:35.840 --> 00:04:39.750 It could also grant access to logging solutions used by the business's 00:04:39.750 --> 00:04:44.430 software, the content of which could leak private information or even 00:04:44.430 --> 00:04:50.210 passwords and locations of services. Credentials for email software could 00:04:50.220 --> 00:04:53.260 allow a wealth of company information to be exposed. 00:04:54.040 --> 00:04:58.310 Just imagine the detail that's often stored for years in email accounts. 00:04:59.340 --> 00:05:02.850 LaZagne can get credentials from common VPN solutions. 00:05:03.740 --> 00:05:07.830 A VPN will often grant access to areas like a company's private 00:05:07.830 --> 00:05:12.210 network or virtual private cloud infrastructure that's used to house 00:05:12.210 --> 00:05:17.110 live services. There could also be credentials to grant access to 00:05:17.120 --> 00:05:21.500 other machines such as through remote desktop connections or direct 00:05:21.510 --> 00:05:23.260 access to database servers. 00:05:24.340 --> 00:05:26.570 The places on our machines that are storing our 00:05:26.570 --> 00:05:28.560 passwords are surely secure, right? 00:05:29.440 --> 00:05:31.150 The truth is often very different. 00:05:32.240 --> 00:05:35.800 So what software can we potentially get credentials from when 00:05:35.800 --> 00:05:39.870 we use LaZagne? On Windows, Linux, and Mac, 00:05:39.880 --> 00:05:43.510 both Chrome and Firefox can be targeted, so if someone 00:05:43.510 --> 00:05:47.060 stores their passwords in the browser, there's a good chance we can get at them. 00:05:48.140 --> 00:05:52.060 These are two of only four modules currently available on a Mac. 00:05:53.040 --> 00:05:57.790 Linux currently has 34 LaZagne modules. Some of the software 00:05:57.790 --> 00:06:01.360 you're likely to get credentials from includes SSH, FileZilla, 00:06:01.360 --> 00:06:05.190 AWS, KeePass version 1 and 2, and Thunderbird email client. 00:06:05.190 --> 00:06:10.850 Windows has 69 LaZagne modules. 00:06:11.540 --> 00:06:13.280 Popular ones include Outlook, 00:06:13.290 --> 00:06:20.740 VNC, RDPManager, OpenSSH, and OpenVPN. It can get passwords used for wireless 00:06:20.740 --> 00:06:23.760 networks, and if you're running with admin credentials, 00:06:23.770 --> 00:06:28.570 it can also get Windows password hashes. Before we get into demos, 00:06:28.580 --> 00:06:31.260 it's worth talking about the environment we're using. 00:06:32.240 --> 00:06:35.250 The environment is an up‑to‑date copy of Windows 10, 00:06:35.250 --> 00:06:38.960 and Python is at version 3.9.1, which is current. 00:06:39.940 --> 00:06:43.380 We're also targeting up‑to‑date versions of software unless otherwise 00:06:43.380 --> 00:06:46.360 stated, so things like Chrome are the current versions. 00:06:47.440 --> 00:06:52.150 Lastly, we've added the LaZagne executable to an allow list in Windows Defender. 00:06:53.040 --> 00:06:56.520 The executable does get picked up by antivirus, and evasion 00:06:56.520 --> 00:06:58.260 techniques aren't covered in this course. 00:06:59.240 --> 00:07:03.420 Antivirus typically allows either specific files or directories to 00:07:03.420 --> 00:07:06.350 be ignored, so that's helpful to try LaZagne out.