2020 Day 1

### Overview In this presentation titled "From the Cloud to the Ground," speakers Danny (CTO of Net Alpha Financial Systems) and Mo (co-founder of BludgerOps) demonstrate a complete attack chain starting from external cloud infrastructure and pivoting into an organization's internal enterprise network to achieve full domain compromise. The talk covers offensive techniques in AWS and microservices architectures, methods for establishing persistence, perimeter exploitation to pivot internally, and fast internal lateral movement targeting Active Directory, concluding with cloud defensive recommendations.

### Key Topics - **Cloud Exploitation & Persistence:** Exploiting Python Celery serialization with pickle bombs, metadata service abuses (IMDSv1 vs. IMDSv2), HashiCorp Consul service mesh poisoning, and persistent AWS credential harvesting via malicious Lambda layers. - **Pivoting from Cloud to Internal:** Exploiting an ADFS proxy flaw that bypasses extranet account lockout policies, allowing password spraying or brute forcing to gain valid credentials and initial internal access via VPN or gateway. - **Internal Active Directory Attacks:** Exploiting SMB signing misconfigurations, relaying authentication requests (including cross-protocol SMB-to-LDAP and IPv6 attacks via mitm6), CVE-2019-1040 MIC bypass, and the ZeroLogon vulnerability. - **Rapid Post-Exploitation & Defensive Controls:** Fast weaponization using MSBuild in-memory stagers, Defender/AMSI bypasses, followed by defensive controls including Infrastructure as Code (Terraform, CloudFormation), immutable AMIs via Packer, isolated CloudTrail logging, and secret management tools like HashiCorp Vault.

### Technical Details - **Initial Cloud Foothold:** An initial shell is obtained via a Python deserialization ("pickle bomb") attack injected into an exposed Redis queue consumed by Celery workers. From the shell, querying the AWS EC2 instance metadata service yields user data scripts and temporary IAM role credentials. - **Service Mesh Poisoning:** Using HashiCorp Consul, the attackers register unauthorized services due to weak access controls or exploit Docker's Registrator agent. By registering a rogue service under existing names (e.g., `postgres`), Consul routes partial traffic to a man-in-the-middle proxy (`proxy.py`), which asks the client for plain-text credentials, intercepts user credentials, hashes them, forwards to the genuine database, and captures plain-text credentials transparently. - **Lambda Layer Backdoors:** Attackers maintain stealthy persistence by modifying shared Lambda layers. A backdoored version of the Python `requests` library sends environment variables—including AWS access keys, secret keys, and session tokens—back to an attacker-controlled listener on every outbound request. - **ADFS Lockout Bypass & Internal Pivot:** A vulnerability in Microsoft ADFS supporting Windows Integrated Authentication (WIA) allows attackers to launch brute-force and dictionary attacks without triggering account lockout policies. After obtaining valid credentials and connecting via VPN, the attackers enumerate Active Directory for null sessions, disabled SMB signing, and anonymous shares. - **Internal Relay and Privilege Escalation:** Attackers combine Responder, `ntlmrelayx`, and `mitm6` (for DNSv6 poisoning) to capture and relay authentication against hosts lacking SMB signing. With CVE-2019-1040, Message Integrity Controls (MIC) can be bypassed using the `--remove-mic` flag. They demonstrate relaying SMB authentication to LDAP to grant DCSync privileges or trigger machine account creation via printer/spool service bugs. - **ZeroLogon & Automated Execution:** Exploiting ZeroLogon (fixed 16-bit IV vulnerability in Netlogon cryptography) allows resetting a domain controller's machine account password to null in roughly 256 iterations to dump hashes via `secretsdump`. To automate rapid lateral compromise, the speakers demonstrate using MSBuild to compile and execute stagers directly in memory across dozens of hosts simultaneously, followed by AMSI suspension and Mimikatz credential dumping using Silent Trinity.

### Takeaways - Migrate to AWS IMDSv2 to mitigate metadata server extraction via SSRF. - Implement strict authentication, identity management, and token controls across service discovery/service mesh tools such as Consul and Docker Registrator. - Avoid storing secrets in environment variables or hardcoded scripts; utilize dedicated tools like HashiCorp Vault or AWS SSM Parameter Store. - Adopt Infrastructure as Code (Terraform, CloudFormation) to detect unauthorized configuration and Lambda layer drift, and enforce immutable infrastructure using Packer. - Secure internal networks by enforcing SMB signing, patching Netlogon (ZeroLogon) and NTLM MIC flaws, monitoring IPv6 traffic, and addressing legacy Active Directory relay vectors.