Pass the hash Giacomo Lanzi

Pass the hash: how to gain access without password

Estimated reading time: 6 minutes

Since the Internet has become widespread, tremendous progress has been made in awareness of the use of passwords. By now everyone knows what best practices are for setting a password (avoid standard passwords, use letters and numbers, avoid dates of birth, etc.). However, there is not much to rest assured, because hackers have another trick that could put your accounts at risk: the pass the hash attack.

Generally, password attacks can be mitigated by enforcing strong passwords, eliminating vendor defaults, and implementing a reasonable cyclical password replacement policy . Attacks on passwords, or rather on credentials, are still very popular, actually. One such attack is the so-called pass the hash or PtH .

These attacks are seen by some as a problem with older Windows systems. A little bit true, but they are still a threat. In fact, the Pass the Hash is still the subject of a lot of material that can be recovered with a simple Google search, both to understand how to defend oneself and to learn how to attack.

pass the hash password

The hashes

Before understanding what the Pass the Hash attack is, it is best to clearly define what a Hash is.

Security researchers have known since the dawn of modern computing that memorizing passwords in the clear is a bad security practice . For this, they came up with the idea of passing the plain text string through a special 1-way encryption function to produce a hash . A hash is a mathematical code of a predetermined length that derives and uniquely represents the password , but cannot be mathematically reversed or reveal what the starting password is.

In practice, this is a string of alphanumeric characters generated starting from the password.

The key point is that on both Windows and Linux systems the hash password is stored instead of the readable one. If you think about it, the hash acts as a proxy for identity: if you can prove you have it, it’s like an entrance ticket.

On Windows, the authentication protocol NTLM involves exchanging messages to confirm that users have the hash without actually sending it in the communication . This authentication technique is at the heart of how Active Directory (the heart of the Windows Server system), supports remote logins within a domain and is also used for other Windows services, in especially remote access to files.

Pass the Hash

The operating system stores hashes in memory to implement Single Sign On or SSO , which is a essential feature of Windows corporate environments. So far, so good, it would seem.

For example, on a laptop the user initially logs in with the password, Windows hash it and stores it so that when, for example, you access a remote directory or use other services where you need to prove your identity, you don’t need to re-enter your password. Windows uses the stored hash .

This behavior is sufficient for hackers. Through the use of RAM scrapers used on devices, hackers can peek into RAM and retrieve hashes . Unsurprisingly, there are toolkits on the net that allow hackers to steal credentials from memory and log in as that user.

This is one of the weaknesses of the SSO system. Hackers must not crack hashes (i.e. try to decrypt them), but simply reuse them or pass them to an authentication server , hence the name pass the hash .

pass the hash login

Pass the Hash exploits a feature not a bug

The assumption of this attack is that the hacker gains administrator permissions for a first user’s machine. Anyone in the industry will tell you it’s not necessarily difficult to do.

In a typical exploit, the hacker will take some hashes , log into other servers and continue the process of accumulating credentials. If he manages to hit the jackpot, that is, get to a domain controller or SQL server, it may be able to get the hashes of all users on the system.

Unfortunately, pass the hash is a feature of Windows, not a bug! NTLM authentication is actually using hash to implement the SSO protocol , saving the user the trouble of entering the password. Hackers are only using this feature for their own purposes.

In order not to be too hard on Windows systems, it must be said that pass the hash is also a problem in Linux systems that implement the communication protocol Kerboros , where there is an equivalent Pass the Ticket or PtT attack.

Here’s the most important thing to keep in mind: You can’t prevent the Pass the Hash attack, you can only mitigate or greatly reduce the chance of this attack occurring .

Pass the hash

Preventing the exploit

To date, this type of attack is used by the worst ransomware software.

The attack would happen like this: Once the ransomware hits, it acquires administrator privileges and, in addition to encrypting all data on the disk, uses the hashes found to perform dei lateral movement . Having obtained access to another machine on the network, proceeds to encrypt the data present on it, spreading rapidly over a network.

The only way to eliminate the chances of pass the hash attack would be to not use the Single Sign-On system for authentication. In this case, the hashes would not exist at all and they could not be exploited for the attack. Unfortunately, it is not easy to eliminate such a convenient system that makes access management so simple and convenient for users.

The SOD solution

Another mitigation method is to implement SIEM and UEBA , and set up centralized network control with a SOC .

Thanks to the SOC as a Service service offered by SOD, in fact, the network is monitored and controlled by an artificial intelligence that reports any possible suspicious behavior. em> lateral movement is thus immediately detected and blocked, as well as dubious requests for access to computers on the corporate network.

Technology advances and new defense solutions are being implemented, but equally attackers discover new ways to exploit vulnerabilities.

To greatly reduce the risk of data loss or fraudulent access, you must always keep up with the times.

If you are interested in knowing how our SOCaaS could help your company, do not hesitate to contact us, we will be happy to answer all your questions. < / p>

Link utili:

Share


RSS

More Articles…

Categories …

Tags

RSS Dark Reading

RSS Full Disclosure

  • [CVE-2023-29459] FC Red Bull Salzburg App "at.redbullsalzburg.android.AppMode.Default.Splash.SplashActivity" Arbitrary URL Loading June 2, 2023
    Posted by Julien Ahrens (RCE Security) on Jun 02RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: FC Red Bull Salzburg App Vendor URL: https://play.google.com/store/apps/details?id=laola.redbull Type: Improper Authorization in Handler for Custom URL Scheme [CWE-939] Date found: 2023-04-06 Date published: 2023-06-01 CVSSv3 Score: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) CVE: CVE-2023-29459...
  • [RT-SA-2022-004] STARFACE: Authentication with Password Hash Possible June 1, 2023
    Posted by RedTeam Pentesting GmbH on Jun 01Advisory: STARFACE: Authentication with Password Hash Possible RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application&apos;s database […]
  • CVE-2022-48336 - Buffer Overflow in Widevine Trustlet (PRDiagParseAndStoreData @ 0x5cc8) May 30, 2023
    Posted by Cyber Intel Security on May 301. INFORMATION -------------- [+] CVE : CVE-2022-48336 [+] Title : Buffer Overflow in Widevine Trustlet (PRDiagParseAndStoreData @ 0x5cc8) [+] Vendor : Google [+] Device : Nexus 6 [+] Affected component : Widevine [+] Publication date : March 2023 [+] Credits : CyberIntel Team 2. AFFECTED VERSIONS -------------------- 5.0.0 […]
  • CVE-2022-48335 - Buffer Overflow in Widevine Trustlet (PRDiagVerifyProvisioning @ 0x5f90) May 30, 2023
    Posted by Cyber Intel Security on May 301. INFORMATION -------------- [+] CVE : CVE-2022-48335 [+] Title : Buffer Overflow in Widevine Trustlet (PRDiagVerifyProvisioning @ 0x5f90) [+] Vendor : Google [+] Device : Nexus 6 [+] Affected component : Widevine [+] Publication date : March 2023 [+] Credits : CyberIntel Team 2. AFFECTED VERSIONS -------------------- 5.0.0 […]
  • CVE-2022-48334 - Buffer Overflow in Widevine Trustlet (drm_verify_keys @ 0x7370) May 30, 2023
    Posted by Cyber Intel Security on May 301. INFORMATION -------------- [+] CVE : CVE-2022-48334 [+] Title : Buffer Overflow in Widevine Trustlet (drm_verify_keys @ 0x7370) [+] Vendor : Google [+] Device : Nexus 6 [+] Affected component : Widevine [+] Publication date : March 2023 [+] Credits : CyberIntel Team 2. AFFECTED VERSIONS -------------------- 5.0.0 […]
  • CVE-2022-48333 - Buffer Overflow in Widevine Trustlet (drm_verify_keys @ 0x730c) May 30, 2023
    Posted by Cyber Intel Security on May 301. INFORMATION -------------- [+] CVE : CVE-2022-48333 [+] Title : Buffer Overflow in Widevine Trustlet (drm_verify_keys @ 0x730c) [+] Vendor : Google [+] Device : Nexus 6 [+] Affected component : Widevine [+] Publication date : March 2023 [+] Credits : CyberIntel Team 2. AFFECTED VERSIONS -------------------- 5.0.0 […]
  • CVE-2022-48332 - Buffer Overflow in Widevine Trustlet (drm_save_keys @ 0x6a18) May 30, 2023
    Posted by Cyber Intel Security on May 301. INFORMATION -------------- [+] CVE : CVE-2022-48332 [+] Title : Buffer Overflow in Widevine Trustlet (drm_save_keys @ 0x6a18) [+] Vendor : Google [+] Device : Nexus 6 [+] Affected component : Widevine [+] Publication date : March 2023 [+] Credits : CyberIntel Team 2. AFFECTED VERSIONS -------------------- 5.0.0 […]
  • CVE-2022-48331 - Buffer Overflow in Widevine Trustlet (drm_save_keys @ 0x69b0) May 30, 2023
    Posted by Cyber Intel Security on May 301. INFORMATION -------------- [+] CVE : CVE-2022-48331 [+] Title : Buffer Overflow in Widevine Trustlet (drm_save_keys @ 0x69b0) [+] Vendor : Google [+] Device : Nexus 6 [+] Affected component : Widevine [+] Publication date : March 2023 [+] Credits : CyberIntel Team 2. AFFECTED VERSIONS -------------------- 5.0.0 […]
  • SCHUTZWERK-SA-2022-001: Cross-Site-Scripting in Papaya Medical Viewer May 30, 2023
    Posted by Lennert Preuth via Fulldisclosure on May 30Title ===== SCHUTZWERK-SA-2022-001: Cross-Site-Scripting in Papaya Medical Viewer Status ====== PUBLISHED Version ======= 1.0 CVE reference ============= CVE-2023-33255 Link ==== https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001/ Text-only version: https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001.txt Further SCHUTZWERK advisories: https://www.schutzwerk.com/blog/tags/advisories/ Affected products/vendor...
  • [RT-SA-2023-005] Pydio Cells: Server-Side Request Forgery May 30, 2023
    Posted by RedTeam Pentesting GmbH on May 30For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "remote-download" can be used to cause the backend to send a HTTP GET request to a specified URL and save the response to a new file. The response […]

Customers

Newsletter