SlideShare a Scribd company logo
AD, Mimikatz, ATA and
(awe)some evasion techniques
Guglielmo Scaiola
MCSE – CEI – CEH – CHFI – ECSA – GPEN - ISO 27001 L.A. – Security +
mail: gs@miproparma.com
Twitter: @S0ftwarGS
Blog: S0ftwarGS.com
Who am I?
• Security Consultant e Ethical Hacker
• Red Teamer e Penetration Tester
• Microsoft System Engineer – A.D. expert
• Incident Handling & Enterprise Forensics
• Trainer & Speaker
Guglielmo «S0ftwar» Scaiola
MCSE – CEI – CEH – CHFI – ECSA - GPEN - ISO 27001 L.A. – Security +
mail: gs@miproparma.com Twitter: @S0ftwarGS Blog: S0ftwarGS.com
AGENDA
• Intro
• Att&ck the network
• Attack & Detection
• Evading Detection and Bypassing
Countermeasures
• ???
• Q & A
Red OR Blue?
ATT&CK :
Adversarial Tactics, Techniques & Common Knowledge
https://attack.mitre.org/wiki/Main_Page
Red Team Attack Chain
• Gain Access
– Spear Phishing [Malware (trojan...) / Client Side Exploit]
• Gain Situational Awareness
– Powershell/admin tools & commands
• Escalation
– Local User/Domain User  Local Admin with UAC/Domain User
– Local Admin with UAC/Domain User  Local Admin Bypass UAC/Domain User
– Local Admin Bypass UAC/Domain User  Domain Admin
• Explore Network & Lateral Movement  (loop To Situational Awareness)
• Persistence
– Backdoor
• Access & Egress Data
• Extraction
Real Time Vs. Post Mortem
8
https://blog.barkly.com/ransomware-attacks-bypassing-antivirus
Initial Access: Bypass countermeasures
• Bypass AV isn’t a problem
• https tunneling
• + URL in allow category
• Expireddomains.net
• EV code signing
• Endpoint protection - AV
• FW port 443
• URL filtering
• URL reputation
• Smartscreen Filter
Initial Access: hunting e detection
• Search for reflective injection
• Search for RWX memory
https://www.youtube.com/watch?v=93GyP-mEUAw&t=15s - Malleable Memory Indicators with CS's Beacon Payload - Raphael Mudge
DEMO TIME
RECON...
• Net commands
– Net user /domain
• Powerview
– User hunter
...stop the recon...
But... User hunter without DC can work
Kerberos Attack
1) Emulating DC (Not real DC)
2) Tricking the KDC for a ticket
3) Forging
4) Manipulation
DcShadow
DCSync
DCSync, normal behaviour:
1) Discovery DC
2) Query replicate the user cred via GetNCChange
But:
THE SOURCE IP IS NOT FROM A REGULAR DC
Mimikatz – over-pass-the-hash
sekurlsa::pth /user:admin2 /domain:child1.newtest.lab /ntlm:a87f3a337d73085c45f9416be5787d86
Silver Ticket - Golden Ticket - Sid History
Skeleton key
19
Malicious Security Provider
HKLMSystemCurrentControlSetControlLsaSecurity Packages
AdminSDHolder
You shall not pass
The winner is….ATA
Ad, mimikatz, ata and (awe)some evasion techniques
Ad, mimikatz, ata and (awe)some evasion techniques
How to bypass...everything...
Warming up...
Some bypass
• Silver ticket if is not for the account computer
of the DC
• Malicious Security provider if the computer is
not a DC
• DCSync trusted domains
Some ATA Bypass Techniques
ATA can’t win if:
• The protocols are correctly implemented
• ATA can’t see how the ticket (or request) are built
• ATA can’t see the traffic with his agents
Bypass 1 - OverPassTheHash
sekurlsa::pth
/user:MyUser /domain:MyDomain
/aes256:aes256 /ntlm:ntlm /aes128:aes128"‘
sekurlsa::pth /user:admin2 /domain:child1.newtest.lab
/ntlm:92937945b518814341de3f726500d4ff
/aes256:cc057a204bb4aad41694a58f495b0834118599d76c7a66b0326cb250a9c46f8f
/aes128:d4a5dd3dce09a0e031c114fdd7e8094c
Bypass 2 – Golden Ticket
kerberos::golden /User:MyUser /domain:MyDomain
/sid:S-1-5-21-3270384115-3177237293-604223748
/aes256:aes256krbtgt /id:1000
/groups:512,513,518,520 /ptt"‘
Golden with AES keys can be generated from any
machine unlike restrictions in case of Over-PTH.

WPC2017 32
DEMO TIME
Q & A
Credits
• SpecterOps:@SpecterOps
– Matt Graeber: @mattifestation
– Will Schroeder: @harmj0y
– Raphael Mudge: @ArmitageHacker
– Andrew Robbins: @_wald0
– Matt Nelson: @Enigma0x3
• Benjamin Delphi: @gentilkiwi
• Sean Metcalf: @PyroTek3
Ad, mimikatz, ata and (awe)some evasion techniques

More Related Content

PDF
BSides Roma 2018 - Red team techniques
Guglielmo Scaiola
 
PDF
Attacker's Perspective of Active Directory
Sunny Neo
 
PDF
Web security for developers
Sunny Neo
 
PPTX
Detection Rules Coverage
Sunny Neo
 
PPTX
BlueHat v17 || Scaling Incident Response - 5 Keys to Successful Defense at S...
BlueHat Security Conference
 
PDF
Certified Pre-Owned
Will Schroeder
 
PDF
Carlos García - Pentesting Active Directory [rooted2018]
RootedCON
 
PDF
ReCertifying Active Directory
Will Schroeder
 
BSides Roma 2018 - Red team techniques
Guglielmo Scaiola
 
Attacker's Perspective of Active Directory
Sunny Neo
 
Web security for developers
Sunny Neo
 
Detection Rules Coverage
Sunny Neo
 
BlueHat v17 || Scaling Incident Response - 5 Keys to Successful Defense at S...
BlueHat Security Conference
 
Certified Pre-Owned
Will Schroeder
 
Carlos García - Pentesting Active Directory [rooted2018]
RootedCON
 
ReCertifying Active Directory
Will Schroeder
 

What's hot (20)

PDF
Introduction to red team operations
Sunny Neo
 
PDF
BlueHat v17 || Go Hunt: An Automated Approach for Security Alert Validation
BlueHat Security Conference
 
PPTX
BlueHat v17 || All Your Cloud Are Belong to Us; Hunting Compromise in Azure
BlueHat Security Conference
 
PPTX
BlueHat v17 || Down the Open Source Software Rabbit Hole
BlueHat Security Conference
 
PPTX
BlueHat v17 || Detecting Compromise on Windows Endpoints with Osquery
BlueHat Security Conference
 
PPTX
Lateral Movement - Phreaknik 2016
Xavier Ashe
 
PPTX
External to DA, the OS X Way
Stephan Borosh
 
PDF
Anatomy of a Cloud Hack
NotSoSecure Global Services
 
PDF
Lateral Movement: How attackers quietly traverse your Network
EC-Council
 
PPTX
Injection flaw teaser
NotSoSecure Global Services
 
PDF
[OPD 2019] Attacking JWT tokens
OWASP
 
PDF
Fantastic Red Team Attacks and How to Find Them
Ross Wolf
 
PPTX
Openssl
Adam Moravcik
 
PDF
Shamoon
Shakacon
 
PPTX
BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...
BlueHat Security Conference
 
PDF
Инциденты с использованием ransomware. Расследование
Positive Hack Days
 
PPTX
Sticky Keys to the Kingdom
Dennis Maldonado
 
PDF
Carlos García - Pentesting Active Directory Forests [rooted2019]
RootedCON
 
PDF
SWAT Style – Live Network Crypto Hacking and Exploitation by Kevin Cardwell a...
EC-Council
 
PDF
Internal Pentest: from z3r0 to h3r0
marcioalma
 
Introduction to red team operations
Sunny Neo
 
BlueHat v17 || Go Hunt: An Automated Approach for Security Alert Validation
BlueHat Security Conference
 
BlueHat v17 || All Your Cloud Are Belong to Us; Hunting Compromise in Azure
BlueHat Security Conference
 
BlueHat v17 || Down the Open Source Software Rabbit Hole
BlueHat Security Conference
 
BlueHat v17 || Detecting Compromise on Windows Endpoints with Osquery
BlueHat Security Conference
 
Lateral Movement - Phreaknik 2016
Xavier Ashe
 
External to DA, the OS X Way
Stephan Borosh
 
Anatomy of a Cloud Hack
NotSoSecure Global Services
 
Lateral Movement: How attackers quietly traverse your Network
EC-Council
 
Injection flaw teaser
NotSoSecure Global Services
 
[OPD 2019] Attacking JWT tokens
OWASP
 
Fantastic Red Team Attacks and How to Find Them
Ross Wolf
 
Openssl
Adam Moravcik
 
Shamoon
Shakacon
 
BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...
BlueHat Security Conference
 
Инциденты с использованием ransomware. Расследование
Positive Hack Days
 
Sticky Keys to the Kingdom
Dennis Maldonado
 
Carlos García - Pentesting Active Directory Forests [rooted2019]
RootedCON
 
SWAT Style – Live Network Crypto Hacking and Exploitation by Kevin Cardwell a...
EC-Council
 
Internal Pentest: from z3r0 to h3r0
marcioalma
 
Ad

Similar to Ad, mimikatz, ata and (awe)some evasion techniques (20)

PDF
0wn-premises: Bypassing Microsoft Defender for Identity
Nikhil Mittal
 
PPTX
Evading Microsoft ATA for Active Directory Domination
Nikhil Mittal
 
PPTX
Red Team Revenge - Attacking Microsoft ATA
Nikhil Mittal
 
PPTX
Adversary tactics config mgmt-&-logs-oh-my
Jesse Moore
 
PPTX
Security-Top-10-Penetration-Findings.pptx
ssuser5a0ad11
 
PDF
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
Robert Brandel
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
PDF
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
Chris Gates
 
PPTX
Enemies of the west
Neil Lines
 
PDF
Update from the MITRE ATT&CK Team
Adam Pennington
 
PDF
MITRE-Module 3 Slides.pdf
ReZa AdineH
 
PPT
Bsides-Philly-2016-Finding-A-Companys-BreakPoint
Zack Meyers
 
PPTX
Hunt for the red DA
Neil Lines
 
PDF
Advanced Threats and Lateral Movement Detection
Greg Foss
 
PPTX
Go Hack Yourself - 10 Pen Test Tactics for Blue Teamers
jasonjfrank
 
PDF
PENETRATION TESTING FROM A HOT TUB TIME MACHINE
Chris Gates
 
PPTX
BSides SG Practical Red Teaming Workshop
Ajay Choudhary
 
PDF
Internal and External threats to a corporate network : Bypassing perimeter de...
EyesOpen Association
 
PPTX
BSIDES-PR Keynote Hunting for Bad Guys
Joff Thyer
 
PDF
Hacking our chairmans inbox - Charl van der Walt - SensePost
Harry Gunns
 
0wn-premises: Bypassing Microsoft Defender for Identity
Nikhil Mittal
 
Evading Microsoft ATA for Active Directory Domination
Nikhil Mittal
 
Red Team Revenge - Attacking Microsoft ATA
Nikhil Mittal
 
Adversary tactics config mgmt-&-logs-oh-my
Jesse Moore
 
Security-Top-10-Penetration-Findings.pptx
ssuser5a0ad11
 
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
Robert Brandel
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
Chris Gates
 
Enemies of the west
Neil Lines
 
Update from the MITRE ATT&CK Team
Adam Pennington
 
MITRE-Module 3 Slides.pdf
ReZa AdineH
 
Bsides-Philly-2016-Finding-A-Companys-BreakPoint
Zack Meyers
 
Hunt for the red DA
Neil Lines
 
Advanced Threats and Lateral Movement Detection
Greg Foss
 
Go Hack Yourself - 10 Pen Test Tactics for Blue Teamers
jasonjfrank
 
PENETRATION TESTING FROM A HOT TUB TIME MACHINE
Chris Gates
 
BSides SG Practical Red Teaming Workshop
Ajay Choudhary
 
Internal and External threats to a corporate network : Bypassing perimeter de...
EyesOpen Association
 
BSIDES-PR Keynote Hunting for Bad Guys
Joff Thyer
 
Hacking our chairmans inbox - Charl van der Walt - SensePost
Harry Gunns
 
Ad

Recently uploaded (20)

PDF
NewMind AI Monthly Chronicles - July 2025
NewMind AI
 
PDF
CIFDAQ's Token Spotlight: SKY - A Forgotten Giant's Comeback?
CIFDAQ
 
PDF
CIFDAQ'S Market Insight: BTC to ETH money in motion
CIFDAQ
 
PDF
Event Presentation Google Cloud Next Extended 2025
minhtrietgect
 
PPTX
The-Ethical-Hackers-Imperative-Safeguarding-the-Digital-Frontier.pptx
sujalchauhan1305
 
PDF
Building High-Performance Oracle Teams: Strategic Staffing for Database Manag...
SMACT Works
 
PDF
SparkLabs Primer on Artificial Intelligence 2025
SparkLabs Group
 
PDF
Revolutionize Operations with Intelligent IoT Monitoring and Control
Rejig Digital
 
PPTX
ChatGPT's Deck on The Enduring Legacy of Fax Machines
Greg Swan
 
PDF
Why Your AI & Cybersecurity Hiring Still Misses the Mark in 2025
Virtual Employee Pvt. Ltd.
 
PDF
Oracle AI Vector Search- Getting Started and what's new in 2025- AIOUG Yatra ...
Sandesh Rao
 
PDF
How-Cloud-Computing-Impacts-Businesses-in-2025-and-Beyond.pdf
Artjoker Software Development Company
 
PDF
DevOps & Developer Experience Summer BBQ
AUGNYC
 
PDF
BLW VOCATIONAL TRAINING SUMMER INTERNSHIP REPORT
codernjn73
 
PDF
Cloud-Migration-Best-Practices-A-Practical-Guide-to-AWS-Azure-and-Google-Clou...
Artjoker Software Development Company
 
PDF
Orbitly Pitch Deck|A Mission-Driven Platform for Side Project Collaboration (...
zz41354899
 
PPTX
Comunidade Salesforce São Paulo - Desmistificando o Omnistudio (Vlocity)
Francisco Vieira Júnior
 
PDF
Google I/O Extended 2025 Baku - all ppts
HusseinMalikMammadli
 
PDF
Shreyas_Phanse_Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
SHREYAS PHANSE
 
PDF
Enable Enterprise-Ready Security on IBM i Systems.pdf
Precisely
 
NewMind AI Monthly Chronicles - July 2025
NewMind AI
 
CIFDAQ's Token Spotlight: SKY - A Forgotten Giant's Comeback?
CIFDAQ
 
CIFDAQ'S Market Insight: BTC to ETH money in motion
CIFDAQ
 
Event Presentation Google Cloud Next Extended 2025
minhtrietgect
 
The-Ethical-Hackers-Imperative-Safeguarding-the-Digital-Frontier.pptx
sujalchauhan1305
 
Building High-Performance Oracle Teams: Strategic Staffing for Database Manag...
SMACT Works
 
SparkLabs Primer on Artificial Intelligence 2025
SparkLabs Group
 
Revolutionize Operations with Intelligent IoT Monitoring and Control
Rejig Digital
 
ChatGPT's Deck on The Enduring Legacy of Fax Machines
Greg Swan
 
Why Your AI & Cybersecurity Hiring Still Misses the Mark in 2025
Virtual Employee Pvt. Ltd.
 
Oracle AI Vector Search- Getting Started and what's new in 2025- AIOUG Yatra ...
Sandesh Rao
 
How-Cloud-Computing-Impacts-Businesses-in-2025-and-Beyond.pdf
Artjoker Software Development Company
 
DevOps & Developer Experience Summer BBQ
AUGNYC
 
BLW VOCATIONAL TRAINING SUMMER INTERNSHIP REPORT
codernjn73
 
Cloud-Migration-Best-Practices-A-Practical-Guide-to-AWS-Azure-and-Google-Clou...
Artjoker Software Development Company
 
Orbitly Pitch Deck|A Mission-Driven Platform for Side Project Collaboration (...
zz41354899
 
Comunidade Salesforce São Paulo - Desmistificando o Omnistudio (Vlocity)
Francisco Vieira Júnior
 
Google I/O Extended 2025 Baku - all ppts
HusseinMalikMammadli
 
Shreyas_Phanse_Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
SHREYAS PHANSE
 
Enable Enterprise-Ready Security on IBM i Systems.pdf
Precisely
 

Ad, mimikatz, ata and (awe)some evasion techniques

Editor's Notes

  • #12: 1metasploit 2artifactrwx 3artifactOk 3’ tot