Cyberstudy
PDF p.356 In progress

Credential Replay Attacks

Open PDF at p.356 21 flashcards

Summary

PDF p.356

Credential replay attacks involve using stolen credentials to gain unauthorized access to network resources. These attacks often target Windows Active Directory networks and exploit cached credentials to perform lateral movement and privilege escalation.

Detailed explanation

PDF p.356
  • Initial Foothold
    • Compromise: Via malware or password attack on a single workstation.
    • Objective: Identify data assets, perform lateral movement, and escalate privileges.
  • Target
    • Windows Active Directory Networks: Primary target for credential replay attacks.
    • Web Applications: Also targeted, discussed separately.
  • Cached Secrets
    • LSASS: Caches secrets in memory and SAM registry database.
    • Secrets Include
      • Kerberos TGT and Session Key: Requests service tickets for applications.
      • Service Tickets: For active sessions.
      • NT Hash: For local and domain user accounts, used in NTLM and Kerberos.
  • Credential Replay Mechanisms
    • Pass the Hash (PtH): Uses NT hash to start sessions on other hosts.
    • Golden Ticket Attack: Forges a ticket granting ticket for unrestricted domain access.
    • Silver Ticket Attack: Forges service tickets (Pass the Ticket - PtT).
  • Mitigations
    • Credential Guard: Protects secrets from malicious processes.
    • Patching and Configuration: Ensures hosts are secure.
    • Detection Systems: Correlate security log events, detect malware code.

Important terms

taken from the text above
Compromise
Via malware or password attack on a single workstation.
Windows Active Directory Networks
Primary target for credential replay attacks.
Web Applications
Also targeted, discussed separately.
LSASS
Caches secrets in memory and SAM registry database.
Kerberos TGT and Session Key
Requests service tickets for applications.
Service Tickets
For active sessions.
NT Hash
For local and domain user accounts, used in NTLM and Kerberos.
Pass the Hash (PtH)
Uses NT hash to start sessions on other hosts.
Golden Ticket Attack
Forges a ticket granting ticket for unrestricted domain access.
Silver Ticket Attack
Forges service tickets (Pass the Ticket - PtT).
Credential Guard
Protects secrets from malicious processes.
Patching and Configuration
Ensures hosts are secure.
Detection Systems
Correlate security log events, detect malware code.
PtH Pass the Hash

What I should remember

Key Points PDF p.356
  • Initial Foothold
    • Compromise: Single workstation.
    • Objective: Data assets, lateral movement, privilege escalation.
  • Target
    • Windows AD Networks: Primary target.
    • Web Applications: Also targeted.
  • Cached Secrets
    • LSASS: Memory and SAM registry.
    • Secrets: Kerberos TGT, service tickets, NT hash.
  • Credential Replay Mechanisms
    • PtH: Uses NT hash.
    • Golden Ticket: Forges TGT.
    • Silver Ticket: Forges service tickets.
  • Mitigations
    • Credential Guard: Protects secrets.
    • Patching: Secure hosts.
    • Detection Systems: Correlate logs, detect malware.