WEBVTT

00:00:01.140 --> 00:00:02.340
In our next demo,

00:00:02.350 --> 00:00:05.760
we're going to look at getting credentials from files using LaZagne.

00:00:06.540 --> 00:00:11.360
That's entry T1552.001 from the MITRE ATT&CK framework.

00:00:12.340 --> 00:00:15.880
We're going to look at some of the sysadmin programs that LaZagne can

00:00:15.880 --> 00:00:19.960
target where files are often used for password storage.

00:00:20.940 --> 00:00:21.820
In some cases,

00:00:21.830 --> 00:00:25.460
we'll see the files that LaZagne is looking in to find the passwords.

00:00:26.440 --> 00:00:28.420
Starting with our LaZagne executable,

00:00:28.420 --> 00:00:31.970
we're going to look at the modules available under sysadmin.

00:00:31.970 --> 00:00:33.420
From the list,

00:00:33.480 --> 00:00:36.050
we can see a good selection of tools that people

00:00:36.050 --> 00:00:40.290
commonly use for things like FTP, SSH, RDP,

00:00:40.300 --> 00:00:41.360
and VNC.

00:00:42.240 --> 00:00:46.160
That's potentially going to get us credentials for access to other machines

00:00:46.250 --> 00:00:49.760
that this user performs some level of administration on.

00:00:50.740 --> 00:00:52.890
Instead of choosing a specific tool,

00:00:52.900 --> 00:00:57.040
we're just going to target all of the tools under sysadmin and see

00:00:57.040 --> 00:00:59.400
which of them have credentials on this machine.

00:00:59.400 --> 00:01:02.120
And we can see we've got a couple of hits.

00:01:02.940 --> 00:01:04.790
The first is from Filezilla,

00:01:04.830 --> 00:01:08.760
which is an FTP client that's capable of storing passwords.

00:01:09.540 --> 00:01:12.120
The second is a KeePass database.

00:01:12.120 --> 00:01:16.350
KeePass is a tool designed specifically to store passwords.

00:01:17.240 --> 00:01:19.840
So while LaZagne hasn't given us a password,

00:01:19.850 --> 00:01:24.560
it has pointed us to a file which could contain a database of passwords.

00:01:25.440 --> 00:01:27.940
If there is some password reuse going on,

00:01:27.950 --> 00:01:31.760
then maybe one of the other passwords we find could grant access to that.

00:01:32.640 --> 00:01:36.110
Now running that again with Python just to confirm, we've

00:01:36.110 --> 00:01:39.350
got the same results, and there we go.

00:01:40.240 --> 00:01:44.530
Something that may be of use is the option to get verbose output with ‑v.

00:01:45.840 --> 00:01:49.990
It's the same in Python and executable options, so we'll just run it

00:01:49.990 --> 00:01:55.890
from Python. We're using two vs for extra verbosity. Scrolling up, we

00:01:55.890 --> 00:02:00.280
can see we've got a few errors under VNC and a list of file and

00:02:00.280 --> 00:02:02.900
registry locations being searched.

00:02:02.900 --> 00:02:06.160
This is perhaps useful. But if you really want detail,

00:02:06.160 --> 00:02:07.650
you can always look at the code.