Berlin 2023 | (In)Secure Remote Operations: What Sucks, Rocks, And A Super-CLI by Yossi

### Overview In this presentation, speaker Yossi—co-founder of 10Root Cybersecurity and former co-founder of Javelin Networks—explores the mechanisms of remote administration and lateral movement across Microsoft Windows environments. The talk frames remote administration tools and attack techniques as sharing the exact same underlying APIs and protocols, emphasizing that context differentiates an administrator's task from an adversary's activity. Yossi advocates for a CLI-centric, "living off the land" philosophy for both red teams and blue teams, contrasting traditional tools like RDP, RPC, and PsExec with PowerShell Remoting (WinRM/WS-Man), detailing credential exposure realities, and demonstrating built-in Active Directory defenses.

### Key Topics - **Living off the Land:** Leveraging native operating system binaries (LOLBins), APIs, and system services (RPC, DCOM, WMI, SMB) to conduct administration or lateral movement without relying on external malware. - **Pre-Authentication & Port Analysis:** How tools establish connections prior to full authentication, observed via an object-based `netstat` loop (`Get-NetTCPConnection`). - **Inter-Process and Inter-Box Communication via Named Pipes:** Utilizing SMB (port 445) named pipes to construct stealthy, firewall-friendly reverse shells and C2 channels. - **RDP Attacks and Insecurities:** Exploiting RDP using man-in-the-middle scripts to downgrade encryption to RC4, abuse CredSSP, spoof self-signed certificates, extract NetNTLM hashes, and capture cleartext credentials when Network Level Authentication (NLA) is disabled. - **PowerShell Remoting (WinRM):** Operational advantages of WS-Management (single-port, encrypted HTTP/HTTPS traffic, background job execution, and session-based file transfer without SMB) alongside Just Enough Administration (JEA) session configurations. - **Credential Exposure & Token Duplication:** Challenging Microsoft documentation regarding remote logon types by duplicating primary process tokens from `wsmprovhost.exe` to achieve network authentication, along with using virtual accounts (`RunAsVirtualAccount`) to mitigate exposure. - **Preventing Lateral Movement with Native AD Controls:** Restricting privileged accounts using Active Directory's `logonWorkstations` attribute to block pass-the-hash, LDAP binds, and remote invocation without commercial software.

### Technical Details - **RPC Subsystem Dependencies:** Yossi demonstrates that over 200 system services depend on the Microsoft RPC subsystem service on modern Windows machines, making it impossible to harden an OS simply by shutting down RPC. - **Named Pipe C2:** Named pipe server and client streams can ride on port 445 (SMB) and pipe commands directly into `Invoke-Expression` (`IEX`), bypassing firewall restrictions and avoiding process-binding alerts. - **Fixing Clock Skew Remotely:** If Kerberos fails due to a clock discrepancy greater than five minutes, an administrator or attacker can invoke WinRM targeting an IP address (falling back to NTLM) using `$using:localTime` to remotely reset the destination clock. - **Token Duplication vs. Virtual Accounts:** While tools like Mimikatz show no Kerberos tickets or cached credentials inside LSASS during a Type 3 WinRM session, an attacker with local administrator access can duplicate the primary token from `wsmprovhost.exe` using `Invoke-TokenManipulation` or `KernelCactus`. Enabling `RunAsVirtualAccount = $true` forces the session into a local-only virtual account, causing outgoing Kerberos tickets to bind to the machine account rather than a user domain identity. - **Logon Workstations Hardening:** Configuring Active Directory user workstation restrictions restricts where authentication requests can originate. Attempts to use pass-the-hash, WMI, PsExec, WinRM, or LDAP queries from unauthorized systems immediately fail across interactive and non-interactive sessions.

### Takeaways Defenders and red teamers must understand the low-level behavior of native protocols rather than relying strictly on tool marketing or official documentation. PowerShell Remoting and JEA offer powerful, auditable alternatives to swiss-cheese firewall policies created by legacy RPC and RDP services, but default PowerShell configurations require explicit hardening. Finally, simple built-in Active Directory controls like workstation logon limitations can effectively neutralize entire classes of lateral movement without the cost of complex third-party security software.