Yes we are a nation of television watchers and expect everything to be solved quickly, since all TV shows end in 1 hour.
In the online book (in books.google) of “Television and Politics”
The problems solved in our shows apparently are remembered with ‘calls for action’ are the ones solved by individuals.
So maybe after a lifetime of watching these shows we have a predisposed subconscious notion to assume 1 person can solve most problems in a reasonable amount of time (1 hour or 2 hours).
So when a complex issue is placed in front of us such as
Red vs Blue teams attackers vs defenders where a series of steps breach a server and then use more tools to keep access of the system without the defending teams knowledge. The solution to this issue is not obvious.
So Why am I beating this horse again? Because the principle will not go away. The attackers will find ways and use the systems we have to attack us.
For example… we want to defend our SQL servers, maybe by hiding them. But this will not work, as there are tools to ask our systems “what are the SQL servers”? And our computers dutifully answer this request.
Technical Example: Do you have a domain controller? Which is automatically running Active Directory? The program that runs your network and username and password authentication.
Then how do you defend against a user asking various questions to your DC(Domain Controller) with some commands?
You can access Powershell from a command line, and then ask various questions (execute commands) like get-service or get-process to find out what services and processes are running on the system.
Why is this important? Because you can pick a service running on the system and then try to see what users have access to this service with another tool PowerMemory for example (as the tool(RWMC) in this article is no longer supported)
Here is PowerMemory definition:
Exploit the credentials present in files and memory
PowerMemory levers Microsoft signed binaries to hack Microsoft operating systems.
So! you might say, how does one get command line access on a server?
Let’s say that you got the user to click on phishing malware and now a command line shell was opened, and connects back to one of the Command and Control servers. techtarget.com explains this phenomena
Once the hacker has a command line opened (however they did it). Now they will try and get more access – by obtaining the passwords for administrator accounts.
How to do that? Sean Metcalf in DEFCON 23 video discusses several methods.
Including using powershell tools created by hackers, tools like
PowerMemory Exploit the credentials present in files and memory
kerberoast a series of tools for attacking MS Kerberos implementations. Below is a brief overview of what each tool does.
The method of obtaining passwords from places on the Microsoft server is also useful: “Finding Passwords in SYSVOL & exploiting Group Policy preferences” is a good article discussing the same topics as in the video.
The credentials can be taken from .xml files on any windows systems. If the system is in a domain then it will have a local user account and whoever logged into that particular system.
All domain Group Policies are stored here: \\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\
So the hacker knows where to look and what to find… the .xml files with CPassword variable, which has the password stored in an encrypted format.
So now it only depends on how strong your password is…
What are your password schema characteristics? Do you require long passwords? more than 14 digits? Because if you have less than 14 digits the hackers will have an even easier time to get your passwords.
So is it still easy? Can you depend on only your defense team (Blue team) to keep all of your assets without unauthorized access? It will take more than a single episode, a season of episodes. It will take a marathon of binge watching to keep the hackers away. It will take red teams (ethical hackers) to attack.
we can help you with a plan of security policies and red team attacks.