Thread by @domchell

As auth coercion is blowing up due to #cve-2023-23397, I've put together a quick thread about how we at @MDSecLabs have been leveraging these techniques in our red team engagements for quite some time. Its timely, but I presented much of this at @FiestaCon_RT last week 🧵

Traditionally if you wanted to abuse SMB auth coercion during a red team & over a c2, you were somewhat limited. It was however achievable using a mix of portbender, rportfwd and socks though. The main limitations were admin rights, dropping a driver and opsec of increased c2

Just over two years ago, we evolved the tradecraft around this by documenting an alternate approach using WebDAV and a number of file primitives to coerce auth mdsec.co.uk/2021/02/farmin…

We have since considerably evolved this concept, building in relaying to our tools with help from @breakfix and @_batsec_. This approach has yielded considerable success during our RT ops. Use cases include, downgrading to netNTLMv1 for easy cracking and NTLM recovery:

Relaying to LDAP, allowing you to add shadow credentials or perform RBCD. In this video a domain admin opens a folder on a share and a searchConnector triggers authentication which we relay to LDAP to obtain a shadow cred
vimeo.com/808300501

Relaying to Exchange EWS. In this video, our domain again opens a folder on a file share and a searchConnector relays his auth to EWS to delegate access to the bob user which we control
vimeo.com/808300586

Relaying to ADCS. In this video, we use our relaytoolkit to scan for the presence of MS_PRN and DAV services on a remote host, trigger authentication via MS_PRN and relay it to ADCS to obtain a certificate for the machine account
vimeo.com/808300642

And last but not least, relaying to SCCM. In this video we trigger MS_PRN locally and relay the local machine account to SCCM to perform a new device enrolment, this is then used to recover policies and extract the often privileged NAA creds:
vimeo.com/808300696

In summary, auth coercion is a powerful escalation primitive for red teams and NTLM needs to die. We've likely only scratched the surface of what can be done and there's likely many more services that can be abused; CyberArk? Citrix? SAP? All spring to mind as good targets

Again massive credits to @breakfix who did most of the heavy lifting on a lot of this 🙏

If you're looking to replicate these attacks, we'd highly recommend looking at SharpSCCM (github.com/Mayyhem/SharpS…) by @_Mayyhem and SharpLdapRelayScan (github.com/klezVirus/Shar…) by @KlezVirus which were both instrumental in our informing out tooling