urbanesec/zackattack

Unveiled at DEF CON 20, NTLM Relaying to ALL THE THINGS!

===== ZackAttack! - Realying NTLM Like Nobody's Business

======= WTF Is This?

tl;dr version - ZackAttack! is a new Tool Set to do NTLM Authentication relaying unlike any other tool currently out there.

= So how is ZackAttack! different / better? Compared to other tools...

• Supports NTLMv2 :)
• Brings up external impact for NTLM by relaying to external Exchange Web Services servers ( think mobile phone users :) )
• Custom Rogue HTTP and SMB Server funneling into a single pooled source and knows who the user is and keeps them authenticating without closing the socket
• Rule based logic to auto-perform actions upon seing a user belonging to a group. When no rule exists, the rogue server holds on to the auth session as long as possible until a rule or api request comes in.
• Auto / Guided generation to creating methods to get users to auto-authenticate without interaction
• New methods for client auto authentication including geting FF/Chrome to auto-auth via UNC SMB shares (similar to IE)
• Relaying to LDAP (critical for relaying to Domain Controllers), Exchange Web Services, and soon mssql.
• SOCKS proxy to allow NTLM relay attacks with your favorite tools (proxychains smbclient....etc)
• Focuses on not just poping the shells that traditional relays do, but leveraging dumb users as well and getting data through them.

So much for tl;dr ;) The goal? A Firesheep esque tool for relaying NTLM auths

= How do I Get Started

1. ruby zackattack.rb

2. open your favorite browser to http://zf:zf@localhost:4531/

3. .....

4. PROFIT! Or not. It's alpha still.

Code is written for ruby1.9 but should work with 1.8. Requires net/http(s) and webrick rubygems

= So What Are the Components

The Rogue Servers - HTTP and SMB. These get the auth requests and keep recycling them

The Clients - These connect to target servers and request NTLM creds from the Rogue Servers

The Rules - Define auto actions to perform upon seeing a user.

The Payloads - Methods to get users to autoauth with Integrated Windows Auth ergo not prompting the user for auth.

= XYZ Doesn't work

I'm sure it doesn't ;) I don't always code in ruby, but when i do, i make sure to introduce as many bugs as possible :)

Submit as much info as you can (comfortably) to the issues page. Please try to get a wireshark / pcap capture if it's a client issue. If it contains sensitive data (i.e. ntlm creds of a client) let me know and we can work around that if possible.

Feature request? I want to hear it! Check the todo file and see if i already mentioned it in there, otherwise submit!

I'll fill in more details later....

zackattack's Issues

Client - "Connection Refused Bug"

No clue. In my notes, need to test.

"Database Is Locked"

Need to switch to single database connection instead of one/thread

Maintain client connections from rules in background

After a rule executes, determine way to keep a thread of that connection open and perform additional actions against it. Long dev cycle ahead on this one....

Clients - MSSQL Library

PoC written. Need to implement. more issues to come as it builds

DNS Forward/Reverse Lookups

Not currently supported. add dns support and detection if target is an ip or DNS entry.

Clients - Log and Display Log of Success / Failure Connections

Needs DB structure. Also detect if auth was successful, but just didn't have enough permissions.

Client LDAP - Referrals and Sub DC in DNs

In environments with multiple DC trees, need to work on which server has which and follow referrals

Ignore / Exclude IP list

Workaround for now is an IPTables rule ;)

Client/Rules - LDAP Enumeration to populate local rules engine

Client LDAP - Change user password

GUI - Cli

Not sure what to include in the CLI, but basic options that don't require full on http access. Such as:

• Currently Authenticated Users
• Create a rule
• View Rules
• Generate Payload

Payload - Host HTML File self-contained

Instead of just offering html file for download, host the HTML file in /$folder/

Modify DB to include enumerated RID/SID and DN

SMB Server - Detect One-off connections by IP that won't re-auth

Instances such as a vuln scanner or *nix system that won't respect the smb reauth and automatically perform it. Need to

• Detect if user doesn't support reauth command
• If IP is in the "internal range" (config option in future?) then mark that source IP as not supporting reauth
• Use the auth from the detection that it doesnt work to say "this source IP is this user"

XProto: SMB -> LDAP does not work with v2

Needs further investigation. Placeholder for now

HTTP Server - Detect if client does not support NTLM autoauth (i.e. *nix/osx) and determine subsequent payload (i.e. wpad.dat for mitming)

Instances where client won't auto-auth (i.e. *nix/mac systems), provide a wpad.dat or other payload.

HTTP Proxy

HTTP(s) Proxy with keep-alive to use only one auth and provide access to a website.

Detect and prevent occurrences when NTLM relaying can not be done

Need to detect and prevent the following occurrences.

• relaying back to original targeted client
• targeted service does not support relaying due to signing enabled

SMB Server - Null User "\" Fix

Need to dig back in old code as to how to respond to reject null users and get actual auth.

Clients - Store Target hostname / sid

Upon connection, info on client (i.e. the client sid and hostname) is obtained. Should store this in a db for further info beyond just rdns

Client EWS - Issue with Folder not being substituted for CHANGEME

for some reason CHANGEME in Ews_id_query is not being subed. Not sure issue.

Store type1 request into database for API access

Log Requested Paths to initial requests

For tracking of SE campaigns, logging should include the path requested for both HTTP and SMB servers!

Payloads - Write up Howto do MITM with ettercap and inject UNC to http

Rules - Does not get proper userID for rule logic (gets 0) for first auth time

Webrick DoNotReverseLookup / avahi-daemon issue with http

Not sure what this is, but it was in my notes. Needs further investigatoin

Left Bar Does Not Clear InActive Users

Left bar does not remove users after they go away. SMB shouldn't be hard, http might have minor issues with keep-alive being preserved.

Clients - Restructure to specify port and if ssl

Allow different ports for clients to connect to and flag if target is ssl.

Payload - SQLi

Payload for when access to sql is obtained or sqli is present to determine the connect to smb with the system account hosting the DB, write to a file (desktop.inis etc.)

Client LDAP - Enumeration

Dropdown Menu on left bar does not work

Known issue. Need to create menu options and pages.

Client SMB - Enum Function does not work against local accounts or certain IPs

Current guess is SID is not using local sid and odd WCTs of IP addys require extra \x00\x00

Payload - Javascript

Create javascript payload for injection either MITM or persistent XSS. Provide for download or locally hosted.

EWS - More than pull emails

Add the following:

• add email rules to fwd a copy to someone else
• view / modify calendar
• Send as user
• pull contacts
• access other folders other than their own

New issues to be created basd on which one of these get finished in time for derby

Alerts when new user detected

Either meta-refresh of iframe, ajax-ify, flash of window, or something to notify user that a wild new user has appeared!

Payload - Quicktime Playlist Auto Generation

to be added to payload page

Clients - Pass The Hash Functionality

Fake server connection that always has the response since the hash is known. Requires further ntlm library dev for challenge generation.

Rules - Status page for rule execution and ability to retry

Show if rule was executed, what time, what user, and response - provide ability to retry again.

EWS - Output Format?

Instead of dumping straight to xml file, should it go into a different file format for opening up in outlook/thunderbird/other or stay in xml file format and make a searchable/gui front end webmail?

API - Request Driven vs "wait for"

Currently API is only "wait for" with a timeout. Generate second API page to pass back a request ID and third to take requestid as param and spit back status. Should include another api request for deleting the requestid from actionlist.

Client SMB - Execute Commands

Walkthrough Demo How-To Video

'nuff said.

Client - Sharepoint

Not sure how to integrate into rules. Possibly just rely on http proxy development.

Rule Logic for $DOMAIN\<anyuser>

Create rule logic to allow any user. Needs to do the following

1. Perform API Actions First, then Other Rules, then rules.
2. user domain == $DOMAIN
3. User has not failed connecting to $TARGET before, else find another user.

Client LDAP - SMB Server -> LDAP does not work with NTLMv2

Needs much more investigation. For some reason SMB -> LDAP does not work. Auth goes ok but subsequent transmission fails. Current theory is NTLMv2 signing flag is setting LDAP signing.

base64 use of gsub("\n")

Testing in API reveals that some messages containing \x0a are getting the bytes removed as gsub is picking them up as \n.

HTTP Server option to respond with a proper wpad.dat file and proxy all traffic

Very Low on feature request list. Add option to respond with a valid wpad.dat and mitm all their http traffic (ssl untampered) or relay to another mitm toolset for http traffic.

Priority Ranking / Sorting

Add ability to specify priority for Rules and Subactions.

Client LDAP - Create New User

EWS - Webdav Support for 2000/2003