{"id":1976,"date":"2014-12-11T10:12:07","date_gmt":"2014-12-11T06:12:07","guid":{"rendered":"https:\/\/rakhesh.com\/?p=1976"},"modified":"2014-12-11T13:25:15","modified_gmt":"2014-12-11T09:25:15","slug":"notes-on-windows-lsa-secure-channel-ntlm-etc","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/windows\/notes-on-windows-lsa-secure-channel-ntlm-etc\/","title":{"rendered":"Notes on Windows LSA, Secure Channel, NTLM, etc."},"content":{"rendered":"<p>These are some notes to myself on the Windows security subsystem.\u00a0<\/p>\n<p>On Windows, the Local Security Authority (LSA) is a subsystem that is responsible for security of the system. The LSA runs as a process\u00a0called the LSA Subsystem Service (LSASS; you can find it as <code>c:\\Windows\\System32\\lsass.exe<\/code>) and takes care of\u00a0<a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc781283(v=ws.10).aspx\" target=\"_blank\">two tasks<\/a>: (1) <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/aa378728(v=vs.85).aspx\" target=\"_blank\">authentication<\/a> and (2)\u00a0enforcing local security policies on system.<\/p>\n<p>For authentication the LSA makes uses of\u00a0Security Support Providers (SSPs) that provide various\u00a0authentication protocols. SSPs are Dynamic Link Libraries (DLLs) that offer the authentication protocol to applications that wish to make use of it. They expose a Security Service Provider Interface (SSPI) API which applications can <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/aa380534(v=vs.85).aspx\" target=\"_blank\">make use of without knowing about the underlying protocol<\/a>. (Generic Security Service Application Program Interface (GSSAPI\u00a0or\u00a0GSS-API) is an IETF standard that defines an API for programs to access security services. SSPI is is a <a href=\"https:\/\/en.wikipedia.org\/wiki\/Security_Support_Provider_Interface#Comparison\" target=\"_blank\">proprietary variant<\/a> of GSSAPI).\u00a0<\/p>\n<p>In a way this post ties in with other things I have been reading about and posted recently. Stuff like encryption ciphers and Active Directory.\u00a0On domain joined machines for instance,\u00a0<a href=\"https:\/\/www.microsoftpressstore.com\/articles\/article.aspx?p=2217264\" target=\"_blank\">LSA uses Active Directory<\/a>, while on non-domain joined machines <a href=\"https:\/\/www.microsoftpressstore.com\/articles\/article.aspx?p=2217264\" target=\"_blank\">LSA uses Security Accounts Manager (SAM)<\/a>. Either case the LSA is a critical\u00a0component.\u00a0<\/p>\n<p>It is <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/aa378327(v=vs.85).aspx\" target=\"_blank\">possible to create custom SSPs<\/a> to support new protocols.\u00a0<a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/aa380502.aspx\" target=\"_blank\">Microsoft<\/a>\u00a0includes\u00a0the following SSPs (may not be an <a href=\"https:\/\/en.wikipedia.org\/wiki\/Security_Support_Provider_Interface#Windows_SSPs\" target=\"_blank\">exhaustive list<\/a>).<\/p>\n<h2>Kerberos (<code>Kerberos.dll<\/code>)<\/h2>\n<ul>\n<li>Provides the Kerberos authentication protocol.\u00a0This is the protocol of choice in Windows.\u00a0<\/li>\n<li>Kerberos\u00a0cannot be used with non-domain joined systems.\u00a0<\/li>\n<li>More about Kerberos in a later post. I plan to cover it as part of Active Directory.\u00a0<\/li>\n<\/ul>\n<h2>NTLM \u2014 LM, NTLM, and NTLMv2 (<code>Msv1_0.dll<\/code>)<\/h2>\n<ul>\n<li>Provides the <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/aa378749.aspx\" target=\"_blank\">NTLM<\/a>\u00a0authentication protocol.\n<ul>\n<li>LM == LAN Manager (also called as LAN MAN). It&#8217;s an <a href=\"https:\/\/en.wikipedia.org\/wiki\/LAN_Manager\" target=\"_blank\">old way of authentication<\/a> &#8211; from pre Windows NT days. Not recommended any more.\u00a0<\/li>\n<li>NTLM == NT LAN Manager. Is a successor to LM. Introduced with Windows NT. Is backward compatible to LAN MAN. It too is <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/cc236715(v=PROT.10).aspx\" target=\"_blank\">not recommended any more<\/a>. It&#8217;s worth pointing out that NTLM uses RC4 for encryption\u00a0<a title=\"Notes on Cryptography Ciphers: RSA, DSA, AES, RC4, ECC, ECDSA, SHA, and so on \u2026\" href=\"https:\/\/rakhesh.com\/infrastructure\/notes-on-cryptography-ciphers-rsa-dsa-aes-rc4-ecc-ecdsa-sha-and-so-on\/\" target=\"_blank\">(which is insecure as I previously pointed out)<\/a>.<\/li>\n<li>NTLMv2 == NT LAN Manager version 2.\u00a0Is a successor to NTLM. Introduced in Windows 2000 (and in Windows NT as part of SP4). It is the current recommended alternative to LM and NTLM and is the default since Windows Vista.<\/li>\n<\/ul>\n<\/li>\n<li>Although Kerberos is the preferred protocol NTLM is still supported by Windows.<\/li>\n<li>Also, NTLM <em>must<\/em> be used on standalone systems as these don&#8217;t support Kerberos.\u00a0<\/li>\n<li>NTLM is a challenge\/ response type of authentication protocol. Here&#8217;s how it works <em>roughly<\/em>:\n<ul>\n<li>The client sends its username to the server. This could be a domain user or a local user (i.e. stored in\u00a0the server SAM database). Notice that the password isn&#8217;t sent.\u00a0<\/li>\n<li>To authenticate, the server sends\u00a0some random data to the client\u00a0&#8211; the <em>challenge<\/em>.\u00a0<\/li>\n<li>The client encrypts this data with a hash of its password &#8211; the\u00a0<em>response<\/em>. Notice that the <em>hash<\/em> of the password is used as a key to encrypt the data.\u00a0<\/li>\n<li>If the username is stored in the server SAM database, the hash of the password will be present with the username. The server simply uses this hash to encrypt its challenge, compares the result with the response from the client, and if the two match authenticates the client.\u00a0<\/li>\n<li>If the username is not\u00a0stored in the server SAM database, it sends the username, the challenge, and response to a Domain Controller. The Domain Controller will have the password hash along with the username, so it looks these up and performs similar steps as above, compares the two results, and if they match authenticates the client. \u00a0<\/li>\n<\/ul>\n<\/li>\n<li>Here are some interesting blog posts on NTLM security:\n<ul>\n<li><a href=\"http:\/\/markgamache.blogspot.com\/2013\/01\/ntlm-challenge-response-is-100-broken.html?m=1\" target=\"_blank\">NTLM Challenge Response is 100% Broken<\/a> &#8211; talks about vulnerabilities in NTLM &amp; LM, and why it&#8217;s better to use NTLMv2.<\/li>\n<li><a href=\"http:\/\/technet.microsoft.com\/en-us\/magazine\/2006.08.securitywatch.aspx\" target=\"_blank\">The Most Misunderstood Windows Security Setting of All Time<\/a> &#8211; about the <code>HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\LmCompatibilityLevel<\/code>\u00a0registry key\u00a0(mentioned in the above blog post too) which\u00a0affects how Windows uses NTLMv2. By default Vista and above <em>only send<\/em> NTLMv2 reponses but accept LM, NTLM, and NTLMv2 challenges.\u00a0This post also goes into how NTLMv2 performs the challenge\/ response\u00a0I mention above differently.\n<ul>\n<li>NTLMv2 uses a different hash function (HMAC-MD5 instead of MD4).<\/li>\n<li>NTLMv2 also includes a challenge from the client to the server.\u00a0<\/li>\n<li>It is also possible to use NTLM\u00a0for authentication with NTLMv2 for session security.<\/li>\n<\/ul>\n<\/li>\n<li><a href=\"http:\/\/markgamache.blogspot.com\/2013\/01\/rehashing-pass-hash.html\" target=\"_blank\">Rehashing Pass the Hash<\/a> &#8211; a blog post of Pass the Hash (PtH) which is about stealing the stored password hash (in memory) from the client and using that to authenticate as the client elsewhere (since the hash is equivalent to the password, getting hold of the hash is sufficient). This post also made me realize that LM\/ NTLM\/ NTLMv2 hashes are unsalted &#8211; i.e. the password is hashed and stored, there&#8217;s no extra bit added to the password before salting just to make it difficult for attackers to guess the password. (Very briefly: if my password is &#8220;Password&#8221; and its hashed as it is to &#8220;12345&#8221;, all any attacker needs to do is try a large number of passwords and compare their hash with &#8220;12345&#8221;. Whichever one matches is what my password would be! Attackers can create &#8220;hash tables&#8221; that contain words and their hashes, so they don&#8217;t even have to compute the hash to guess my password. To work around this most systems salt the hash. That is, the add some random text &#8211; which varies for each user &#8211; to the password, so instead of hashing &#8220;Password&#8221; the system would hash &#8220;xxxPassword&#8221;. Now an attacker can&#8217;t simply reuse any existing hashtables, thus improving security).\n<ul>\n<li>A good blog post that <a href=\"http:\/\/ammarhasayen.com\/2014\/06\/04\/pass-the-hash-attack-compromise-whole-corporate-networks\/\" target=\"_blank\">illustrates<\/a> Pass the Hash.<\/li>\n<li>A PDF presentation that talks about <a href=\"http:\/\/www.rsaconference.com\/writable\/presentations\/file_upload\/hta-w03-pass-the-hash-how-attackers-spread-and-how-to-stop-them.pdf\" target=\"_blank\">Pass the Hash<\/a>.<\/li>\n<li>Windows 8.1 <a href=\"http:\/\/www.aorato.com\/blog\/windows-update-fix-pass-hash-vulnerability\/\" target=\"_blank\">makes it difficult<\/a> to do Pass-the-Hash. As the post says, you cannot eliminate Pass-the-Hash attacks as long as the hash is not in some way tied to the hardware machine.<\/li>\n<\/ul>\n<\/li>\n<li>When you login to the domain, your computer caches a hash of the password so that you can login even if your Domain Controller is down\/ unreachable. This cache stores an <a href=\"http:\/\/moyix.blogspot.com\/2008\/02\/cached-domain-credentials.html\" target=\"_blank\">MD4 hash of the &#8220;MD4 hash of the password + plus the username&#8221;<\/a>.<\/li>\n<li>If all the above isn&#8217;t enough and you want to know even more about how NTLM works look no further than <a href=\"http:\/\/davenport.sourceforge.net\/ntlm.html\" target=\"_blank\">this page<\/a>\u00a0by Eric Glass. :)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Negotiate (<code>secur32.dll<\/code>)<\/h2>\n<ul>\n<li>This is a psuedo-SSP. Also called\u00a0the Simple and Protected GSS-API Negotiation Mechanism (SPNEGO).\u00a0<\/li>\n<li>It lets clients and servers <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/aa378748(v=vs.85).aspx\" target=\"_blank\">negotiate a protocol<\/a> to use for further authentication &#8211; NTLM or Kerberos. That&#8217;s why it is a psuedo-SSP, it doesn&#8217;t provide any authentication of its own.\u00a0<\/li>\n<li>Kerberos is always selected unless one of the parties cannot use it.\u00a0<\/li>\n<li>Also, if an SPN (Service Principal Name), NetBIOS name, or UPN (User Principal Name) is not given then Kerberos will not be used. Thus if you connect to a server via IP address then NTLM will be used.\u00a0<\/li>\n<\/ul>\n<h2>CredSSP (<code>credssp.dll<\/code>)<\/h2>\n<ul>\n<li>Provides the\u00a0Credential Security Support Provider (CredSSP) protocol.\u00a0<\/li>\n<li>This allows\u00a0for user credentials from a client to be delegated to a server for remote authentication from there on. CredSSP was introduced in Windows Vista.<\/li>\n<li>Some day I&#8217;ll write a blog post on CredSSP and PowerShell :) but for now I&#8217;ll point to <a href=\"http:\/\/blogs.technet.com\/b\/heyscriptingguy\/archive\/2012\/11\/14\/enable-powershell-quot-second-hop-quot-functionality-with-credssp.aspx\" target=\"_blank\">this Scripting Guy blog post<\/a> that gives an example of how CredSSP is used.\u00a0If I connect remotely to some machine &#8211; meaning I have authenticated with it &#8211; and now I want to connect to <em>some other<\/em> machine from this machine (maybe I want to open a shared folder), there must be some way for my credentials to be passed to this first machine I am connected to so it can authenticate me with the second machine. That&#8217;s where CredSSP comes into play.\u00a0<\/li>\n<li>CredSSP uses TLS\/SSL and the Negotiate\/SPNGO SSP to delegate credentials.\u00a0<\/li>\n<li>More about CredSSP at <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/cc540483.aspx\" target=\"_blank\">this MSDN article<\/a>.\u00a0<\/li>\n<\/ul>\n<h2>Digest (<code>Wdigest.dll<\/code>)<\/h2>\n<ul>\n<li>Provides the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Digest_access_authentication\" target=\"_blank\">Digest<\/a> protocol. See these\u00a0TechNet articles\u00a0for <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc778868(v=WS.10).aspx\" target=\"_blank\">more on Digest authentication<\/a> and <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc780170(v=ws.10).aspx\" target=\"_blank\">how it works<\/a>.\u00a0<\/li>\n<li>Like NTLM, this is a challenge\/ response type of authentication protocol. Mostly used with HTTP or LDAP.\u00a0<\/li>\n<li>There is no encryption involved, only hashing. Can be used in conjunction with SSL\/TLS\u00a0for encryption.<\/li>\n<\/ul>\n<h2>SChannel (<code>Schannel.dll<\/code>)<\/h2>\n<ul>\n<li>Provides the SSL\/ TLS authentication protocols and support for Public Key Infrastructure (PKI).\u00a0<\/li>\n<li><a href=\"http:\/\/blogs.msdn.com\/b\/kaushal\/archive\/2011\/10\/02\/10218922.aspx\" target=\"_blank\">Different versions of Windows have different support<\/a> for TLS\/SSL\/ DTLS because the SChannel SSP in that version of Windows only supports certain\u00a0features. For instance:\n<ul>\n<li>DTLS support was <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/hh831771.aspx#BKMK_DTLS\" target=\"_blank\">added<\/a> with Windows Server 2012\/ Windows 8. This version also added support for <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/hh831771.aspx#BKMK_SNI\" target=\"_blank\">Server Name Indicator (SNI) extensions<\/a>.<\/li>\n<li>TLS 1.1 support was <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/hh831381.aspx\" target=\"_blank\">added<\/a> in Windows Server 2008 R2\/ Windows 7 (also see <a href=\"http:\/\/blogs.msdn.com\/b\/kaushal\/archive\/2011\/10\/02\/10218922.aspx\" target=\"_blank\">this post<\/a>).\u00a0\n<ul>\n<li>Support for TLS 1.1 and above while present are not enabled by default. They can be enabled via a <a href=\"http:\/\/www.adminhorror.com\/2011\/10\/enable-tls-11-and-tls-12-on-windows_1853.html\" target=\"_blank\">registry key<\/a>.<\/li>\n<\/ul>\n<\/li>\n<li>A list of supported cipher suites can be found at <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/aa374757.aspx\" target=\"_blank\">this MSDN link<\/a>.\u00a0<\/li>\n<\/ul>\n<\/li>\n<li>More about SChannel at <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc783349(v=ws.10).aspx\" target=\"_blank\">this TechNet page<\/a>.\u00a0<\/li>\n<li>Used when visiting websites via HTTPS.<\/li>\n<li>Used\u00a0by domain joined machines when talking to\u00a0Domain Controllers &#8211; <a href=\"http:\/\/blogs.technet.com\/b\/asiasupp\/archive\/2007\/01\/18\/typical-symptoms-when-secure-channel-is-broken.aspx\" target=\"_blank\">for validation, changing machine account password<\/a>, <a href=\"http:\/\/yadhutony.blogspot.com\/2012\/11\/resetting-secure-channel-between-dcs.html\" target=\"_blank\">NTLM authentication pass-through<\/a>, SID look-up, group policies etc.\n<ul>\n<li>Used between domain machines and Domain Controllers, as well as between Domain Controllers. In case of the latter secure channel is also <a href=\"http:\/\/blogs.technet.com\/b\/asiasupp\/archive\/2007\/01\/18\/typical-symptoms-when-secure-channel-is-broken.aspx\" target=\"_blank\">used for replication<\/a>. Secure channels also exist between DCs in different trusted domain.\u00a0<\/li>\n<li>Upon boot up every domain machine will discover a DC, authenticate its machine password with the DC, and create a secure channel to the DC. The Netlogon service maintains the secure channel.\u00a0<\/li>\n<li>Every machine account in the domain has a password. This <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc757973(v=ws.10).aspx\" target=\"_blank\">password is used to create<\/a> the secure channel with the domain.\u00a0\n<ul>\n<li>Upon boot up every domain machine will discover a DC, authenticate its machine password with the DC, and create a secure channel to the DC.\u00a0<\/li>\n<\/ul>\n<\/li>\n<li><a href=\"http:\/\/windowsitpro.com\/security\/understanding-and-detecting-secure-channel-problems\" target=\"_blank\">This is a good post<\/a> to read on how to find if secure channel is broken. It shows three methods to identify a problem &#8211; <code>NLTest<\/code>, PowerShell, WMI &#8211; and if the secure channel is broken because the machine password is different from what AD has then the <code>NLTest\u00a0\/SC_RESET:&amp;lt;DomainName&amp;gt;<\/code>\u00a0command can reset it.\n<ul>\n<li>A note on the machine password: machine account passwords do not expire in AD (unlike user account passwords). Every 30 days (configurable via a <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc785826(v=ws.10).aspx\" target=\"_blank\">registry key<\/a>) the Netlogon service of <em>the machine<\/em> will initiate a password change. Before changing the password it will test whether a secure channel exists. Only after creating a secure channel will it change the password. <a href=\"http:\/\/blogs.technet.com\/b\/askds\/archive\/2009\/02\/15\/test2.aspx\" target=\"_blank\">This post<\/a> is worth reading for more info. These password changes can be <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc785826(v=ws.10).aspx\" target=\"_blank\">disable via a registry key\/ group policy<\/a>.\u00a0<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>More on how SSL\/TLS is implemented\u00a0in SChannel can be found at <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc784149(v=ws.10).aspx\" target=\"_blank\">this TechNet page<\/a>.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>These are some notes to myself on the Windows security subsystem.\u00a0 On Windows, the Local Security Authority (LSA) is a subsystem that is responsible for security of the system. The LSA runs as a process\u00a0called the LSA Subsystem Service (LSASS; you can find it as c:\\Windows\\System32\\lsass.exe) and takes care of\u00a0two tasks: (1) authentication and (2)\u00a0enforcing &hellip; <a href=\"https:\/\/rakhesh.com\/windows\/notes-on-windows-lsa-secure-channel-ntlm-etc\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Notes on Windows LSA, Secure Channel, NTLM, etc.<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[333,85],"tags":[4,342,182,408,138,350,402,403,404,344,405,407,343,406],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/1976"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=1976"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/1976\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=1976"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=1976"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=1976"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}