SlideShare ist ein Scribd-Unternehmen logo
1 von 14
Protecting the keys to the castle
– Restricted Admin Credential Exposure

Marcus Murray & Hasain Alshakarti
Truesec Security Team, MVP-Enterprise Security
x2
Marcus Murray   Hasain Alshakarti
Who doesn’t want to be domain admin?
Passing the dutchie


   Web Srv   Mail Srv




   DC        File Srv




                        Client   Client



                        Admin     User
Mitigating Passing the dutchie
• SMB Signing! On domain controllers!
mimikatz
• privilege::debug
• inject::process lsass.exe sekurlsa.dll
• @getLogonPasswords

• Passwords in CLEAR TEXT!!!
The ”Mandiant report”
Local account depencencies


   Web Srv   Mail Srv




   DC        File Srv   Mail Srv



             SrvAdm      SrvAdm
                                   Client   Client



                                   CliAdm    CliAdm
Logged on account depencencies


  Web Srv   Mail Srv




   DC       File Srv    Mail Srv



            Marcus_DA    Marcus_DA
                                       Client      Client



                                     Marcus_DA   Marcus_DA
Complete mission


   Web Srv   Mail Srv




   DC        File Srv   Mail Srv




                                   Client   Client



                                   Admin     User
Microsoft PtH Mitigations
Protecting!
•   Local firewalls
•   Non-admin
•   Cutting dependencies
•   Managed service accounts
•   AMA
Marcus Murray   Hasain Alshakarti
Thank you for listening! 

Weitere ähnliche Inhalte

Andere mochten auch

Cơ bản về tủ lạnh
Cơ bản về tủ lạnhCơ bản về tủ lạnh
Cơ bản về tủ lạnhmachupilani
 
Federmanager bo convegno impermanenza_27_03_13
Federmanager bo  convegno impermanenza_27_03_13Federmanager bo  convegno impermanenza_27_03_13
Federmanager bo convegno impermanenza_27_03_13Marco Frullanti
 
De stress fest2013slideshow
De stress fest2013slideshowDe stress fest2013slideshow
De stress fest2013slideshowCheckIt Out
 
What Is Async, How Does It Work, And When Should I Use It?
What Is Async, How Does It Work, And When Should I Use It?What Is Async, How Does It Work, And When Should I Use It?
What Is Async, How Does It Work, And When Should I Use It?emptysquare
 
SME Estudio Marcas que Marcan 2012
SME Estudio Marcas que Marcan 2012SME Estudio Marcas que Marcan 2012
SME Estudio Marcas que Marcan 2012SME Puerto Rico
 
EMC Hybrid Cloud for SAP - Enhanced Security and Compliance
EMC Hybrid Cloud for SAP - Enhanced Security and ComplianceEMC Hybrid Cloud for SAP - Enhanced Security and Compliance
EMC Hybrid Cloud for SAP - Enhanced Security and ComplianceEMC
 
Stalking the Kill Chain
Stalking the Kill ChainStalking the Kill Chain
Stalking the Kill ChainEMC
 
Tues wed reformation plays
Tues wed reformation playsTues wed reformation plays
Tues wed reformation playsTravis Klein
 
Creative examples of origami logo design for inspiration
Creative examples of origami logo design for inspirationCreative examples of origami logo design for inspiration
Creative examples of origami logo design for inspirationMaxim Logoswish
 
TechBook: IMS on z/OS Using EMC Symmetrix Storage Systems
TechBook: IMS on z/OS Using EMC Symmetrix Storage SystemsTechBook: IMS on z/OS Using EMC Symmetrix Storage Systems
TechBook: IMS on z/OS Using EMC Symmetrix Storage SystemsEMC
 
Pastís de xocolata rita i judit
Pastís de xocolata rita i juditPastís de xocolata rita i judit
Pastís de xocolata rita i juditmgonellgomez
 
Provisioning 2.0: The Future of Provisioning
Provisioning 2.0: The Future of ProvisioningProvisioning 2.0: The Future of Provisioning
Provisioning 2.0: The Future of ProvisioningEMC
 
Media Evaluation
Media EvaluationMedia Evaluation
Media Evaluationloousmith
 

Andere mochten auch (17)

Cơ bản về tủ lạnh
Cơ bản về tủ lạnhCơ bản về tủ lạnh
Cơ bản về tủ lạnh
 
Goedgekleed
GoedgekleedGoedgekleed
Goedgekleed
 
My evalutauion question 1
My evalutauion question 1My evalutauion question 1
My evalutauion question 1
 
Mat lab
Mat labMat lab
Mat lab
 
Federmanager bo convegno impermanenza_27_03_13
Federmanager bo  convegno impermanenza_27_03_13Federmanager bo  convegno impermanenza_27_03_13
Federmanager bo convegno impermanenza_27_03_13
 
De stress fest2013slideshow
De stress fest2013slideshowDe stress fest2013slideshow
De stress fest2013slideshow
 
What Is Async, How Does It Work, And When Should I Use It?
What Is Async, How Does It Work, And When Should I Use It?What Is Async, How Does It Work, And When Should I Use It?
What Is Async, How Does It Work, And When Should I Use It?
 
види таблиць конструктор
види таблиць конструкторвиди таблиць конструктор
види таблиць конструктор
 
SME Estudio Marcas que Marcan 2012
SME Estudio Marcas que Marcan 2012SME Estudio Marcas que Marcan 2012
SME Estudio Marcas que Marcan 2012
 
EMC Hybrid Cloud for SAP - Enhanced Security and Compliance
EMC Hybrid Cloud for SAP - Enhanced Security and ComplianceEMC Hybrid Cloud for SAP - Enhanced Security and Compliance
EMC Hybrid Cloud for SAP - Enhanced Security and Compliance
 
Stalking the Kill Chain
Stalking the Kill ChainStalking the Kill Chain
Stalking the Kill Chain
 
Tues wed reformation plays
Tues wed reformation playsTues wed reformation plays
Tues wed reformation plays
 
Creative examples of origami logo design for inspiration
Creative examples of origami logo design for inspirationCreative examples of origami logo design for inspiration
Creative examples of origami logo design for inspiration
 
TechBook: IMS on z/OS Using EMC Symmetrix Storage Systems
TechBook: IMS on z/OS Using EMC Symmetrix Storage SystemsTechBook: IMS on z/OS Using EMC Symmetrix Storage Systems
TechBook: IMS on z/OS Using EMC Symmetrix Storage Systems
 
Pastís de xocolata rita i judit
Pastís de xocolata rita i juditPastís de xocolata rita i judit
Pastís de xocolata rita i judit
 
Provisioning 2.0: The Future of Provisioning
Provisioning 2.0: The Future of ProvisioningProvisioning 2.0: The Future of Provisioning
Provisioning 2.0: The Future of Provisioning
 
Media Evaluation
Media EvaluationMedia Evaluation
Media Evaluation
 

Ähnlich wie Protecting the keys to the castle! - Restricted Admin Credential Exposure

Delivering Javascript to World+Dog
Delivering Javascript to World+DogDelivering Javascript to World+Dog
Delivering Javascript to World+DogKyle Randolph
 
The service mesh: resilient communication for microservice applications
The service mesh: resilient communication for microservice applicationsThe service mesh: resilient communication for microservice applications
The service mesh: resilient communication for microservice applicationsOutlyer
 
Exploiting Active Directory Administrator Insecurities
Exploiting Active Directory Administrator InsecuritiesExploiting Active Directory Administrator Insecurities
Exploiting Active Directory Administrator InsecuritiesPriyanka Aash
 
Case Study: Privileged Access in a World on Time
Case Study: Privileged Access in a World on TimeCase Study: Privileged Access in a World on Time
Case Study: Privileged Access in a World on TimeCA Technologies
 
DEF CON 23 - Sean - metcalf - red vs blue ad attack and defense
DEF CON 23 - Sean - metcalf - red vs blue ad attack and defenseDEF CON 23 - Sean - metcalf - red vs blue ad attack and defense
DEF CON 23 - Sean - metcalf - red vs blue ad attack and defenseFelipe Prado
 
Azure Services Platform
Azure Services PlatformAzure Services Platform
Azure Services PlatformDavid Chou
 
MSP360 Cybersecurity Master Class part 2
MSP360 Cybersecurity Master Class part 2MSP360 Cybersecurity Master Class part 2
MSP360 Cybersecurity Master Class part 2MSP360
 
Best ofmms mikeresseler
Best ofmms mikeresselerBest ofmms mikeresseler
Best ofmms mikeresselerKenny Buntinx
 
Escalation defenses ad guardrails every company should deploy
Escalation defenses ad guardrails every company should deployEscalation defenses ad guardrails every company should deploy
Escalation defenses ad guardrails every company should deployDavid Rowe
 
Topic 2 - Ransomware Techniques.pptx
Topic 2 - Ransomware Techniques.pptxTopic 2 - Ransomware Techniques.pptx
Topic 2 - Ransomware Techniques.pptxMorningstar90
 
MongoDB World 2019: MongoDB Atlas Security 101 for Developers
MongoDB World 2019: MongoDB Atlas Security 101 for DevelopersMongoDB World 2019: MongoDB Atlas Security 101 for Developers
MongoDB World 2019: MongoDB Atlas Security 101 for DevelopersMongoDB
 
Reducing Your Attack Surface & Your Role in Cloud Workload Protection
Reducing Your Attack Surface & Your Role in Cloud Workload ProtectionReducing Your Attack Surface & Your Role in Cloud Workload Protection
Reducing Your Attack Surface & Your Role in Cloud Workload ProtectionAlert Logic
 
Design patterns for microservice architecture
Design patterns for microservice architectureDesign patterns for microservice architecture
Design patterns for microservice architectureThe Software House
 
RSA Secur id for windows
RSA Secur id for windowsRSA Secur id for windows
RSA Secur id for windowsarpit06055
 
Database Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best PracticesDatabase Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best PracticesMariaDB plc
 
QualysGuard InfoDay 2012 - Malware Detection Service – Enterprise Edition
QualysGuard InfoDay 2012 - Malware Detection Service – Enterprise EditionQualysGuard InfoDay 2012 - Malware Detection Service – Enterprise Edition
QualysGuard InfoDay 2012 - Malware Detection Service – Enterprise EditionRisk Analysis Consultants, s.r.o.
 
Understanding Azure Networking Services
Understanding Azure Networking ServicesUnderstanding Azure Networking Services
Understanding Azure Networking ServicesInCycleSoftware
 
Hackers versus Developers and Secure Web Programming
Hackers versus Developers and Secure Web ProgrammingHackers versus Developers and Secure Web Programming
Hackers versus Developers and Secure Web ProgrammingAkash Mahajan
 

Ähnlich wie Protecting the keys to the castle! - Restricted Admin Credential Exposure (20)

Delivering Javascript to World+Dog
Delivering Javascript to World+DogDelivering Javascript to World+Dog
Delivering Javascript to World+Dog
 
The service mesh: resilient communication for microservice applications
The service mesh: resilient communication for microservice applicationsThe service mesh: resilient communication for microservice applications
The service mesh: resilient communication for microservice applications
 
Exploiting Active Directory Administrator Insecurities
Exploiting Active Directory Administrator InsecuritiesExploiting Active Directory Administrator Insecurities
Exploiting Active Directory Administrator Insecurities
 
Case Study: Privileged Access in a World on Time
Case Study: Privileged Access in a World on TimeCase Study: Privileged Access in a World on Time
Case Study: Privileged Access in a World on Time
 
DEF CON 23 - Sean - metcalf - red vs blue ad attack and defense
DEF CON 23 - Sean - metcalf - red vs blue ad attack and defenseDEF CON 23 - Sean - metcalf - red vs blue ad attack and defense
DEF CON 23 - Sean - metcalf - red vs blue ad attack and defense
 
Azure Services Platform
Azure Services PlatformAzure Services Platform
Azure Services Platform
 
MSP360 Cybersecurity Master Class part 2
MSP360 Cybersecurity Master Class part 2MSP360 Cybersecurity Master Class part 2
MSP360 Cybersecurity Master Class part 2
 
Best ofmms mikeresseler
Best ofmms mikeresselerBest ofmms mikeresseler
Best ofmms mikeresseler
 
Best ofmms mikeresseler
Best ofmms mikeresselerBest ofmms mikeresseler
Best ofmms mikeresseler
 
Escalation defenses ad guardrails every company should deploy
Escalation defenses ad guardrails every company should deployEscalation defenses ad guardrails every company should deploy
Escalation defenses ad guardrails every company should deploy
 
Topic 2 - Ransomware Techniques.pptx
Topic 2 - Ransomware Techniques.pptxTopic 2 - Ransomware Techniques.pptx
Topic 2 - Ransomware Techniques.pptx
 
MongoDB World 2019: MongoDB Atlas Security 101 for Developers
MongoDB World 2019: MongoDB Atlas Security 101 for DevelopersMongoDB World 2019: MongoDB Atlas Security 101 for Developers
MongoDB World 2019: MongoDB Atlas Security 101 for Developers
 
Reducing Your Attack Surface & Your Role in Cloud Workload Protection
Reducing Your Attack Surface & Your Role in Cloud Workload ProtectionReducing Your Attack Surface & Your Role in Cloud Workload Protection
Reducing Your Attack Surface & Your Role in Cloud Workload Protection
 
Design patterns for microservice architecture
Design patterns for microservice architectureDesign patterns for microservice architecture
Design patterns for microservice architecture
 
RSA Secur id for windows
RSA Secur id for windowsRSA Secur id for windows
RSA Secur id for windows
 
Database Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best PracticesDatabase Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best Practices
 
QualysGuard InfoDay 2012 - Malware Detection Service – Enterprise Edition
QualysGuard InfoDay 2012 - Malware Detection Service – Enterprise EditionQualysGuard InfoDay 2012 - Malware Detection Service – Enterprise Edition
QualysGuard InfoDay 2012 - Malware Detection Service – Enterprise Edition
 
Understanding Azure Networking Services
Understanding Azure Networking ServicesUnderstanding Azure Networking Services
Understanding Azure Networking Services
 
Hackers versus Developers and Secure Web Programming
Hackers versus Developers and Secure Web ProgrammingHackers versus Developers and Secure Web Programming
Hackers versus Developers and Secure Web Programming
 
Sql dba training in india
Sql dba training in indiaSql dba training in india
Sql dba training in india
 

Mehr von Microsoft TechNet - Belgium and Luxembourg

Mehr von Microsoft TechNet - Belgium and Luxembourg (20)

Windows 10: all you need to know!
Windows 10: all you need to know!Windows 10: all you need to know!
Windows 10: all you need to know!
 
Configuration Manager 2012 – Compliance Settings 101 - Tim de Keukelaere
Configuration Manager 2012 – Compliance Settings 101 - Tim de KeukelaereConfiguration Manager 2012 – Compliance Settings 101 - Tim de Keukelaere
Configuration Manager 2012 – Compliance Settings 101 - Tim de Keukelaere
 
Windows 8.1 a closer look
Windows 8.1 a closer lookWindows 8.1 a closer look
Windows 8.1 a closer look
 
So you’ve successfully installed SCOM… Now what.
So you’ve successfully installed SCOM… Now what.So you’ve successfully installed SCOM… Now what.
So you’ve successfully installed SCOM… Now what.
 
Data Leakage Prevention
Data Leakage PreventionData Leakage Prevention
Data Leakage Prevention
 
Deploying and managing ConfigMgr Clients
Deploying and managing ConfigMgr ClientsDeploying and managing ConfigMgr Clients
Deploying and managing ConfigMgr Clients
 
Self Service BI anno 2013 – Where Do We Come From and Where Are We Going?
Self Service BI anno 2013 – Where Do We Come From and Where Are We Going?Self Service BI anno 2013 – Where Do We Come From and Where Are We Going?
Self Service BI anno 2013 – Where Do We Come From and Where Are We Going?
 
Hands on with Hyper-V Clustering Maintenance Mode & Cluster Aware Updating
Hands on with Hyper-V Clustering Maintenance Mode & Cluster Aware UpdatingHands on with Hyper-V Clustering Maintenance Mode & Cluster Aware Updating
Hands on with Hyper-V Clustering Maintenance Mode & Cluster Aware Updating
 
SCEP 2012 inside SCCM 2012
SCEP 2012 inside SCCM 2012SCEP 2012 inside SCCM 2012
SCEP 2012 inside SCCM 2012
 
Jump start your application monitoring with APM
Jump start your application monitoring with APMJump start your application monitoring with APM
Jump start your application monitoring with APM
 
What’s new in Lync Server 2013: Persistent Chat
What’s new in Lync Server 2013: Persistent ChatWhat’s new in Lync Server 2013: Persistent Chat
What’s new in Lync Server 2013: Persistent Chat
 
What's new for Lync 2013 Clients & Devices
What's new for Lync 2013 Clients & DevicesWhat's new for Lync 2013 Clients & Devices
What's new for Lync 2013 Clients & Devices
 
Office 365 ProPlus: Click-to-run deployment and management
Office 365 ProPlus: Click-to-run deployment and managementOffice 365 ProPlus: Click-to-run deployment and management
Office 365 ProPlus: Click-to-run deployment and management
 
Office 365 Identity Management options
Office 365 Identity Management options Office 365 Identity Management options
Office 365 Identity Management options
 
SharePoint Installation and Upgrade: Untangling Your Options
SharePoint Installation and Upgrade: Untangling Your Options SharePoint Installation and Upgrade: Untangling Your Options
SharePoint Installation and Upgrade: Untangling Your Options
 
The application model in real life
The application model in real lifeThe application model in real life
The application model in real life
 
Microsoft private cloud with Cisco and Netapp - Flexpod solution
Microsoft private cloud with Cisco and Netapp -  Flexpod solutionMicrosoft private cloud with Cisco and Netapp -  Flexpod solution
Microsoft private cloud with Cisco and Netapp - Flexpod solution
 
Managing Windows RT devices in the Enterprise
Managing Windows RT devices in the Enterprise Managing Windows RT devices in the Enterprise
Managing Windows RT devices in the Enterprise
 
Moving from Device Centric to a User Centric Management
Moving from Device Centric to a User Centric Management Moving from Device Centric to a User Centric Management
Moving from Device Centric to a User Centric Management
 
Network Management in System Center 2012 SP1 - VMM
Network Management in System Center 2012  SP1 - VMM Network Management in System Center 2012  SP1 - VMM
Network Management in System Center 2012 SP1 - VMM
 

Protecting the keys to the castle! - Restricted Admin Credential Exposure