TTP Tuesday: Conti (Release 3)

Gain privileges and persist

Theme Overview

25 January 2022

We're releasing the third instalment of our Conti ransomware theme with new TTPs focused on Windows service exploitation. To date, our Conti theme now contains the following kill-chains:

1. Recon and Initial Access

2. Local and Remote Discovery

3. Gain privileges and persist (Current Release)

4. Move to remote systems

5. Data collection and exfiltration

6. Deploy ransomware

Gain privileges and persist

Conti is considered Ransomware-as-a-Service (RaaS) and has an elaborate chain of events from initial access to execution of the ransomware. For this week, we are focusing on privilege escalation and persistence techniques leaked in the Conti affiliate manual. This chain starts with information gathered from last week’s chain, specifically the AD domain name and Domain Controller hostnames, and proceeds to attain local and domain admin credentials via two exploits and a dcsync attack. The first exploit in the chain is PrintNightmare for escalation to a local Administrator. This technique, when successful, will create a new local admin account for use in subsequent chains. Next is ZeroLogon, which allows an unauthenticated user to set the machine account password on a Windows Domain Controller. From there, we leverage the new DC credentials to execute a dcsync attack via mimkatz and obtain the DC’s krbtgt NTLM hash. With this hash we’re now positioned to create golden tickets granting ourselves unrestricted access to the domain.

Check it out on the Prelude chains website.

Watch a demonstration:

Next week, we will be releasing the next step in the Conti adversary, move to remote systems.

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/channel/UCZyx-PDZ_k7Vuzyqr4-qK9A

Follow our team

David: https://twitter.com/privateducky
Alex: https://twitter.com/khyberspache
Kris: https://twitter.com/Xanthonus
Octavia: https://twitter.com/VV_X_7
Sam: https://twitter.com/wasupwithuman