149: Mini-Stories: Vol 3

23:45yeah so that's how I knew we did a good thing yeah I mean how do you think you impacted his life I mean from what I've been told the The actions taken in the first couple of days after a major incident are the most critical. And I think by giving him that level of support immediately, I think I changed the guy's life way for the better. I mean, they were talking originally having to discharge the guy. From what I heard, he stuck around another five, six years before he finally released and went off and doing something. I can't even remember what he's doing now. But I think I've changed the life of the better.

24:24So I'm good with that. Yeah, I mean, it's also very possible that you saved his life. I could have. There's, you know, coming out of PTSD, or getting affected that badly by it, you can easily end your own life. Exactly. So, I mean, I like to think we saved a life there. And no matter what I do in life, I think that's the coolest thing I've ever done.

24:52To me, this right here is the quintessential Darknet Diaries story because of where I found it. I went to DEF CON and I was invited to the Microsoft party and I sat down at a table to chat with people and that's where I met Evilmog. And he was there telling us the story and I was so captivated by it that it made me cry. And my goodness, to be at some DEF CON party and to hear a story so moving that it makes me cry, that's one reason I started this show. I imagined in my head while I was listening to Evilmog tell me that story that I saw you across the room and I was like, psst, over here, you gotta hear this story.

25:27And I brought you in to eavesdrop on these inner circles to hear the untold stories that are only shared in intimate and private spaces that are all over the hacker culture, but are hard to find. I love these chance encounters. It's like finding a hidden path in a familiar landscape. I hope stories like this fill you with the same great feeling I get when I hear them in person. I have such a fun job. I'm so grateful. Okay, we're going to take an ad break here, but stay with us because we have a new guest to tell us a new story after the break.

26:10This episode is sponsored by Delete Me. Right now, the headlines are chock full of data breaches and regulatory rollbacks, making us all vulnerable. But you can do something about it. Delete Me is here to make it easy, quick, and safe to remove your personal data online. Want an easier way to deal with data breaches? Get DeleteMe. The fact is we're all at risk. How many times have you gotten an email or letter saying your data has been breached? It's unsettling. But the good news is DeleteMe can help. Once you've signed up for DeleteMe, they won't stop. It constantly monitors and removes your personal information that you don't want to have on the internet.

26:42Privacy is a super important topic for me. So a few years ago, I signed up and DeleteMe immediately got busy scouring the internet for my name and gave me reports on what they found. And then they got busy deleting things. it's great to have someone on my team when it comes to my privacy. Take control of your data and keep your private life private by signing up for Delete Me. Now at a special discount for my listeners, get 20 % off your Delete Me plan when you go to joindeleteme.com slash darknetdiaries and use promo code DD20 at checkout. The only way to get 20 % off is to go to joindeleteme.com slash darknetdiaries and enter code DD20 at checkout.

27:21That's joindeleteme.com slash darknetdiaries, code DD20.

27:29All right, so let's start out with who are you and what do you do? Yeah, my name is Joe Sarkisian. I work for Wolf and Company PC out of Boston. I do penetration testing of all kinds, internal, external, Wi-Fi, social engineering, advanced security assessments, things like that. So we have a client, not a big company, maybe like 20 people. and they had contracted us to do your average assumed breach pen test, so to speak. So we're on the inside, we're given access. What would happen if somebody gets in there? So we send them a remote Dropbox, a little Raspberry Pi that we send them. They plug it into their network and then we connect to that remotely.

28:08And it's kind of like we're sitting there in person. We've got on-the-wire access at that point on a subnet that they put us on. So I'd be in the test. Typically, and here's the funny thing, you'll look at pen test frameworks. You should start here, you should do this, you should do that. I would challenge you to find a pen tester that doesn't fire up Responder the second they get on a network and try to get creds and be off to the races as soon as humanly possible because that's what we do, quite frankly, on a lot of tests. So that's what I did there. Okay, Responder is a pretty clever hacking tool.

28:44It's free to get. It's just a Python program. And how you use it is you just start it and wait. Now, the thing about Windows computers is that they always want to try to join a domain and connect to shared drives on the network. And so if a Windows machine wants to connect to a shared drive, it will try to get to that host directly. And if it's there, it'll connect to it just fine or whatever. But what does the Windows computer do if it can't find the shared drive that it's trying to connect to? Well, it wants to connect to it very badly, and it will try another way. It might ask the DNS server, hey, do you know the IP address for the server I'm trying to get to?

29:21And the DNS server might be like, yeah, I got that. Here's the IP right here. And then the computer might be like, that's the same IP I have, and I already checked. That one's not online. So then, if the Windows machine still can't find that shared drive that it really wants to connect to, it then sends a broadcast message to all the computers on the local subnet saying, Hey, I'm looking for this shared drive If any of you are it, please respond And that's when Responder springs into action It sneakily says Why, yes, I'm that shared drive you're looking for That's me, you found me, I'm here And the Windows computer is like Oh, thank goodness, I've been looking for you everywhere I'd like to connect to you And Responder is like Sure, of course you can connect to me but you need to authenticate first, yeah.

30:12And the Windows computer is like, oh yes, of course, okay, here's my username and password. Now Microsoft takes your security seriously so it doesn't actually send your password over the network. Instead, it sends a password hash. And since Responder is this dirty little liar on your network, it snatches that username and that password hash and gives it to the penetration tester or hacker who's running the tool. Saying something like, Hey, someone just tried to connect to me using this username and this password hash. Here you go. Typically, Responder only works against computers in the same subnet as it.

30:47So if you're in the same subnet, then yeah, Responder is an amazing tool at finding usernames and password hashes. Now, a password hash is not the password. It's a gibberish set of characters that you get when your password goes through an algorithm. And the thing is, in some cases, you can crack this hash to get the password. And a common method for cracking passwords is brute force. Take the top 1 million most common passwords and hash them, and then see if any of those hashes match the password hash you just got. And if so, you found the password. Exactly. So we use something called Hashcat.

31:22We'll take that hash. We will plug it into Hashcat. Tell me about this. So to crack that, that's not on the Raspberry Pi, because the Raspberry Pi doesn't have the GPU, CPU cycles to be able to throw a billion passwords at that thing and try to figure out which one it is. What's your method for cracking it? Well, that's the scary thing. Our method is the same thing that any bad guy all around the world can do. We have an Amazon account, and we can spin up Amazon EC2 instances. So what we do is we spin up these Tesla GPUs on an instance. We have a couple of them, and we will take that GPU power to just blow through password hashes as fast as we possibly can based on that power.

32:07It's going to be a lot faster than you have a Raspberry Pi or your local PC, unless your local PC has a ton of graphics cards in it, which ours is not. So yeah, we do that all in the cloud, relatively cheap, not super expensive to get done. And usually we get results pretty quick, within the first couple of hours. Okay. Now, what's your success rate on getting one hash and being able to crack that single hash? I'm going to go 90 plus percent. It depends. If we've been there before and they took our recommendations, it's going to take a lot longer. It's going to be a lot harder. But when they don't...

32:43A different question, which is kind of in the same realm, is suppose you have the entire AD database of hashes. What percentage of passwords do you think you're going to crack out of that? So we will probably get, on average, I would say, and again, whether we've been there first or not, and they're taking recommendations, we'll probably get 50 % to 60 % within the first four hours. So he's basically trying billions of passwords to see if any of them match this hash. Of course, the longer that his Hashcat tool runs, the more passwords are tried. And so they might start with the top 1 million most used passwords and then try making slight modifications to those, like putting a 1 at the end or capitalize the first letter.

33:28maybe add in their own word list, such as the company name, or mascot, or city, or address, or person's name, or kid's name. If no luck there, then try every word in the dictionary, but add numbers to the end of it, and maybe mix it up a little bit, and see if that works. And just try tons of combinations. And pretty much all the stuff I've listed so far probably only takes like a few hours or less. Now, after the tool has tried all this, it just then starts going through every single possible character combination in the world, such as AAA, AAB, AAC, AAD. So this combination of finding a username and password hash from Responder and then trying to crack it in Hashcat could take hours or even days since it's about waiting and timing and maybe brute forcing the password.

34:18So in the meantime, he's looking around the network to see what else is there. A good place to start is Nmap. Nmap is a basic tool that you can use to quickly scan the network to see what's there. It'll basically ping every IP address in the network to see what responds. And if any do, then it'll try to see if that host has any open ports. Then Nmap will spit out a report saying, here are all the computers on the network that I found to be alive, and these are their open ports. Exactly, yeah. So we'll look for default passwords places. We'll look for null sessions on hosts, right? Can I access this host without a username or a password?

34:56Can I just get in there maybe on a domain controller? We still find this. You're able to, quote unquote, authenticate to a domain controller as nobody and start enumerating the domain. Now, if you can do that, you can get a list of users from a domain controller and then take that list of users and start password spraying against that domain controller with that list of users, common passwords. And then maybe you get a hit on password 2023 exclamation point, or a company name 2023 exclamation point. Crazier things have happened. So there's a lot of stuff going on at once. He's got these background tasks running to try to get more usernames and hashes.

35:35And he's also trying to crack the hash he's got. Yeah, I mean, to this day, I've been doing this, I don't know, about five years now. To this day, whenever I see that first hash flashing yellow across my screen, when I'm on a pen test, I still get a shot of adrenaline. and it's just like, here we go. Boom, he cracked the password, yes. But who is this user? Are they just like a low-level user or are they a system admin? He has to find out. And to do that, he logs into a computer on the network to see what his access is. And it's a normal user with no special privileges. So now we have domain access as that user.

36:13So typically what we'll do, we'll look for some basic privilege escalation opportunities. and at the same time we're looking for data, right? So let's say we're kind of poking for both of those things, right? We want to prove that risk, that this basic user maybe has access to some data that they don't need access to. And if a bad guy gets access to this account as that person, they also get access to that data, and that's something you need to work on. So as we're rooting through file shares, what does this person have access to? We find this host, and it's like a Windows 10 host. And we have access to a couple of shares on this host.

36:51And we're rooting through, typically we're looking for things that are called like password.txt or like SSH, this, that, or the other thing, or SSN, right? We're looking for data that's going to prove a problem for the company. So I'm looking through and I find this folder called, I believe it's called like MPEGs. So I'm like, that's interesting. I don't typically find something like that. just a folder called mpegs. That's different. I'm just curious what's in here. So I look in, sure enough, there's a bunch of mpeg files. I'm like, okay, that's interesting. There's like maybe four or five of them.

37:28So I download one of the mpeg files. I get it locally, and I'm like, oh man, let's watch this file. I open it, and I see a camera feed. And the camera is just on a desk facing at someone's kind of where they would sit, right? In front of the computer. And I'm like, that's weird. Why would anybody put a camera on their desk? Right? That's just strange. What are they recording? Doesn't make any sense. So, all right. Well, maybe there's something else to this. So, I download the second one because they're going in order. 1, 2, 3, 4. Download the second one. It is the same camera. It is the same desk.

38:08And this time, the camera is underneath it. And it was a a lady's desk, I found out later, the way the camera was angled was, yes, at their, you know, the front bottom half of their body, let's put it that way. Let's just say it was an inappropriate place to put a camera in an office if that lady wasn't aware of it. Joe knew that what he was looking at was potentially going to get someone fired. So he had to proceed with caution here. So I see this, and now I'm like, oh God. Every pen tester has that feeling that sooner or later, they're going to get this moment that is something like this. You find the proof that somebody's stealing from the company, or you find pictures you shouldn't, or whatever it may be.

38:59And this was the first time that I had found something like that, and I was kind of just awestruck at first. And my head starts raising like, what do I do about this? And so the first instinct was pick up the phone and call my point of contact immediately. The problem with that is this is a small company. I don't know anything more than this point of contact's name and the fact that I worked with him year over year. I don't know what he does personally. I don't know what he's into. I don't know if he's the person that put this camera there. But he's the only point of contact I have, right? So he's the one I'm calling.

39:35So I pick up the phone and I get on the phone. I tell him, hey, just so you know, I found under the desk camera footage of, and then he cuts me off completely and says, stop right there. I'm calling HR. And at that point, I had a kind of this wave of relief over me because at this point, I'm like, okay, well, he's probably not the one that put it there because he's wanting to call HR immediately. So HR gets on the phone. I explain it to them. They say, thank you very much. And that's the end of the call. It's interesting to stumble upon this as a security consultant, since it's not really a network security issue.

40:20It's more of a see something, say something issue. Like, do you even put this in the final security report? Joe went on to complete the pen test, and he found some misconfigurations in Active Directory, which gave him administrator access, which pretty much gives them keys to the kingdom. The network admin can reset anyone's passwords, see all shared drives, probably even read everyone's email. So he put all this into a report and delivered his findings on the final call. Basically, it's the typical stuff, like you said. We found this, we found that. Here's recommendations for fixing that. Okay, great.

40:52And we didn't feel like it was our place or appropriate to bring that up on that call. However, I did end up talking to that client a month later and we were going over some remediation strategies for them. And, you know, basically they're like, Hey, how's everything else going? How you been? I'm like, I'm good. You know? How about that other thing? I'm just curious about that other thing. This is a much more casual conversation. I'm just curious. Is everything okay with that other thing we found? And he kind of just gave me this look on the Zoom call. He's like, yep, yeah, that's been handled.

41:20And I knew not to push, but I knew that whatever had to be done had been done. At least it seemed like it had, and it seemed like it worked out for them. I wasn't going to get pulled into court for not to testify for anything, which I was actually kind of ready for. I'm like, oh, this might be the first time, but it just didn't happen that way. So I got lucky. Yeah. As far as like your success rate, I mean, you're always going to find something, even if it's like a CVV level three. But I mean, as far as just success rate of just like owning the whole network and gaining access to sensitive systems, getting half the users' passwords in the whole organization, that kind of thing, is that fairly high?

42:06Do you feel pretty confident like, yeah, I'll probably be able to own this network? It's, with no exaggeration, 95 % of clients that we are able to do that with year over year. And I think he can get to that point because of how many penetration tests he's done. He's gone into dozens of networks and exploited hundreds of devices. And after doing it over and over and over, you start to develop a pattern and know exactly where to look for weaknesses. And once you do develop a pattern, pen tests start to become automatic since they repeat the same steps almost every time. And so once he was done with one pen test job, he'd move right on to the next.

42:45And this time it was a bank. It was a regional bank and we We were doing some more traditional audit work as well as pen testing. And I had one of our junior pen testers on that job with me. So this person was, you know, they came with a little bit of experience in the door. They'd been with us for, I don't know, four to six months at that point. So they arrive on site and they're greeted by the on-site team. They're shown where to sit and where to plug into the network. And this was a simulated breach. So if someone got into the network who shouldn't be on it, what could they see or do while there?

43:21So the two of them get all set up in this room. And, well, you already know what tool they're going to start up first. That's going to be Responder. So, you know, started doing our thing, you know, like doing little Responder stuff, whatever. And for whatever reason, this person's having a hard time with Responder. Like their Python's not working. The tool's not working. I'm trying to help them through it. So, you know, I'm like, you know what? It's a teaching moment. I'm going to let them figure this out, right? I'm not going to give them the answer. I'm not going to coach them to it. I want to see how they handle this.

43:50Okay, so they've taught me that Responder is their go-to tool for starting a network assessment. But if that's not working for whatever reason, what do you do next? I have a 30-minute client call with another client that I need to take. So I'm going to be over here. I'm like, you know what? You take the reins on this. It's the beginning of the test. What can go wrong? So I'm on the call, and he's doing his thing. And I don't know, like five, ten minutes go by, I'm on this call. And I started noticing there's a lot of phones ringing in adjacent offices. And I started seeing a lot of shuffling, and people kind of running around.

44:27And I'm not sure what's going on. I'm like, whatever, it's probably nothing. All of a sudden, I see our point of contact come flying down the hall in a panic. He busts into the room, he goes, what are you doing to our network? And I'm like, I got to call you back. So I get off my call. I'm like, I'm sorry, what's going on? He's like, everything's down. We can't reach anything. The core, oh my God, nothing works. We're like, okay. So to the junior guy, whatever you're doing, stop. So he stops. Maybe like five, 10 minutes go by and things kind of quiet down. We check in with the point of contact.

45:05He's like, yeah, whatever that was, don't do that ever again. He's obviously upset, understandably so. So in the process of figuring out what happened, I'm talking to the junior tester, and I say, what were you doing? What kind of test were you doing? He's like, you know, I was running a responder, whatever. Okay, cool. What else are you doing? Well, you know, I figured I'd save time, and I would run, you know, like a port scan. Like, okay, what would you use for that? And he says, well, I always use mass scan. And I'm like, okay, not Nmap? He's like, no, no, no, a mass scan's faster. Okay, so Nmap is a basic tool to scan the network.

45:45It's simple and efficient and usually safe. And when you're testing a live network, you want to be as light-footed as you can. And Nmap is a gentle tool to scan the network with. It just does like a simple knock on the door. Is anyone home? And it really just stops there, which is nice since you don't want to disrupt business or wreck any systems in your process. Since after all, this is a bank which needs to continue their service to customers. but mass scan is a bit beefier of a tool compared to Nmap. It can make a map of your network, but it's designed to scan huge amounts of systems at once.

46:18Like, it shines really well when it's supposed to scan, like, millions of IPs at once, or even the whole internet. This network at most had, like, thousands of IPs. Mass scan is just too powerful of a tool for this scenario. But this junior pen tester was convinced that because it's a beefier tool, it's better for the job. I'm like, oh, I'm aware mass scans faster. show me the command you ran with MassCAN. So he shows me the command you ran with MassCAN, and when you run MassCAN, you have the option of how many packets per second you want to run that at. He had added like two or three zeros to the default, which means he was blazing across all of their submats running MassCAN and doing a port scan.

46:58And that is what brought their network to its knees for five to ten minutes, is that he was careless. and if you want to kind of step back from that, I was careless as the quote-unquote tester in the room at that point in time. Okay, so this junior pen tester was absolutely flooding the network with traffic. They weren't told what exactly they impacted, but I'm going to speculate on what happened here. He had a computer that was plugged in using an Ethernet cable. So his next hop from his laptop would have probably been a network switch or router. If he's sending massive amounts of traffic, it could easily overwhelm that next hop.

47:35Just too many packets at once going through that and opening too many sessions, it can fill up the session table. Memory or CPU on the device could just be maxed out and it just might not accept any more packets. Essentially doing a denial of service on that next hop if it was a switch or a router. And what that would do is it caused everyone who's also connected to that device to not be able to reach anything beyond it. Like the pipes are clogged kind of thing. And if there are servers also connected to that switch, then those servers would be unreachable by anyone too. The other option is if this mass scan tool was configured to scan IPs outside the network, the traffic might have traversed the firewall.

48:11And this is a device that acts as a security checkpoint between the internal network and the outside internet, which does a little bit more inspection of packets. And if every IP that mass scan was trying to hit was getting inspected by the firewall, that might be too much for the firewall to handle. It just can't accept that much stuff. Not only that, but it might have taken up all the bandwidth that that site had for internet access as well, making the whole internet go down for the site. Either scenario, Joe realized it was them who took down the network. And now they had a really big problem on their hands to deal with.

48:42So we end up with this big call. He didn't necessarily break anything. He just slowed the network down to a crawl because he was shoving so much traffic through it that nothing else could get where it needed to go. So the CIO, Chief Information Officer on the call, a lot of big muckety mucks. And basically, they're like, tell us why we shouldn't fire you from this right now, essentially. And we had to go through the whole rigmarole with them and explain like, look, you know, it was a typo on a screen. We didn't do it on purpose. We're very sorry. We won't do it again. Yada, yada, yada. And luckily, like they came around.

49:18But I'm pretty sure we don't have pen testing work at the head bank anymore. So yeah, that was not fun. We've had to change our procedures since that's happened. One thing that I thought isn't explicitly taught to pen testers, but I believe is possibly the most important skill for them to have, is communication skills. It's not entirely unusual to be put in a hot situation where there's some very stressed out people on the phone or in the room, or people that are just really difficult to work with. And the better you can speak their language, the more effective you're going to be at working with them.

49:52If you're a pen tester and you find some awful, glaring security issue in the network, how do you explain the problem to the business leaders in a way that they will prioritize it and fix it? They aren't ding-dongs. They have degrees and are highly accomplished people, but they don't understand the details of cybersecurity. So you need to have those communication skills to speak their language so they get it. and that to me is a mark of a great penetration tester.

50:31A big thank you to EvilMog for telling us about this time in Afghanistan and also thank you to Joe for telling us about his pen test story that went all wrong. They were able to keep working after that and provided value to the client despite the rough start. I've got a t-shirt shop that I really want you to check out. There are over 50 designs in there, and I am positive you will find a shirt that you'll love in the store. Please visit shop.darknetdiaries.com and treat yourself to something nice. This episode was created by me, the one-eyed jack recider. Our editor is the encrypted kid, Tristan Ledger.

51:06Mixing done by Proximity Sound, and our intro music is by the mysterious Breakmaster Cylinder. I took a trip down to the Capitol in Washington, D.C., and a little bee landed on a flower next to me. And I nodded at it and I said, that's a USB. This is Darknet Tires.