Security Verification and Offensive-Defensive Practice
Blue Team Manual ⑦ [Lateral Movement] In-depth Analysis of Intranet Lateral Movement and Defensive Strategies
With the rapid development of information technology, corporate intranets have become the core pillar of business operations, carrying a large amount of sensitive data and critical business logic. However, at the same time, network attack techniques are also continuously evolving. In particular, lateral movement attacks have become a necessary means for advanced threat actors to penetrate and achieve remote control. This article aims to explore in depth the various stages, attack methods, and defensive strategies of lateral movement attacks, providing enterprises with a comprehensive and in-depth guide to building a defensive system to cope with increasingly complex intranet security threats.
▌In-Depth Analysis of Lateral Movement Attacks
Definition and Characteristics
Lateral movement attack refers to the process in which an attacker, after successfully compromising a system within the intranet, does not directly perform destructive actions, but instead gradually penetrates and controls more hosts and resources through further information gathering, credential theft, vulnerability exploitation, and other means. This attack method is highly stealthy, has a long duration, and has a wide scope of impact, making it difficult for defenders to detect and respond to.
Goals and Motivation
The main goals of attackers performing lateral movement are to expand their scope of control, obtain sensitive data, and achieve persistent control. By controlling more hosts and resources, attackers can steal sensitive data such as user credentials, financial information, and trade secrets; meanwhile, by deploying backdoor programs, tampering with configurations, or clearing logs, they ensure they can regain access even if discovered, continuously threatening intranet security.
Nmap Scan Results
Analysis of Attack Stages
Lateral movement attacks are generally divided into the following five stages:
Information Gathering Stage: Attackers obtain key data such as intranet topology, host information, and service ports through active scanning and passive sniffing.
Credential Theft Stage: Tools such as Mimikatz are used to extract cleartext passwords, hashes, or Kerberos tickets from the system, and identity forgery is performed using techniques like Pass-the-Hash and Pass-the-Ticket.
Privilege Escalation Stage: Privileges are escalated by exploiting system vulnerabilities or service misconfigurations to gain administrative access to more hosts.
Lateral Movement Stage: Remote protocols such as RDP, SMB, SSH, as well as proxy forwarding tools, are used to expand the scope of control within the intranet and penetrate more hosts.
Persistent Control and Hiding Stage: Backdoor programs are deployed in the target systems, configurations are tampered with, or logs are cleared to ensure long-term retention of access to the system while hiding traces of activity.
Cyber Security Attack and Penetration Testing Flowchart
▌Defensive Strategies in the Information Gathering Stage
As the starting step of lateral movement attacks, information gathering is crucial for attackers. They need to deeply understand the hosts, services, ports, credentials, and overall topology within the target network to meticulously plan subsequent attack paths. This article will analyze in detail how attackers gradually accumulate the required information in an intranet environment from two dimensions: passive information gathering and active information gathering, and propose targeted defensive strategies.
Passive Information Gathering: The Art of Silent Snooping
Passive information gathering, as the name implies, refers to the process where an attacker indirectly obtains critical intelligence about the intranet by analyzing existing system data, files, logs, and other information resources, without actively interacting directly with the network. This method is highly favored due to its extreme stealthiness.
Deep Mining of System Logs and Configuration Files
System Logs: Windows event logs (especially security event logs) and the /var/log/ directory under Linux systems are windows through which attackers snoop on intranet activities. These logs record system operational details, user login activities, service starts and stops, and other critical information, providing attackers with system administrators' operating patterns, service statuses, and even potential security configuration weaknesses.
O&M Topology Maps and Configuration Files: Network topology maps, network segment division details, and system configuration files maintained by corporate O&M teams are invaluable treasures for attackers. They not only visually display the structural layout of the intranet, but also record in detail the network devices, server locations, and data flow paths, providing great convenience for attackers to precisely locate high-value targets.
Silent Listening of Network Traffic
Capture of Unencrypted Traffic: Within the intranet, if unencrypted HTTP traffic exists, attackers can easily intercept sensitive information such as usernames, passwords, and session IDs. In addition, cleartext transmission protocols such as Telnet and FTP are also major targets for attackers to eavesdrop on.
Threat of Session Hijacking: By capturing unencrypted HTTP or FTP sessions, attackers can steal session tokens and subsequently impersonate legitimate users to perform session hijacking, achieving deeper penetration.
Defensive Strategies:
Fully implement encrypted communication, ensuring that all services and applications adopt secure protocols such as HTTPS, SFTP, and SSH.
Employ VLAN (Virtual Local Area Network) or micro-segmentation technology to achieve network segmentation and traffic isolation, effectively reducing the risk of attackers eavesdropping on sensitive traffic.
Active Information Gathering: Strategies for Active Exploration
Active information gathering is the process in which an attacker actively obtains detailed information about hosts, ports, services, and network configurations within the intranet through direct detection and scanning methods. This step plays a decisive role for attackers to map out the detailed structure of the intranet and lock onto potential target hosts.
Precise Implementation of Network Scanning and Host Discovery
Port Scanning: Attackers use tools like Nmap and Masscan to scan common ports of target hosts to identify running services, paying special attention to key ports such as 22 (SSH), 80/443 (HTTP/HTTPS), 445 (SMB), and 3389 (RDP).
TCP/UDP Scanning: In addition to TCP scanning, UDP scanning is also an indispensable part, used to discover services using the UDP protocol, such as DNS and SNMP, providing attackers with more details about the system and network.
In-depth Execution of Service and Protocol Detection
Service Version Detection: The -sV feature of Nmap allows attackers to identify the service versions running on the target host, thereby determining if exploitable vulnerabilities exist.
Protocol Detection: Detection aimed at protocols like SMB and RDP helps attackers identify unpatched vulnerabilities or weaknesses within the intranet, such as the famous EternalBlue vulnerability.
Targeted Detection of DevOps Platforms and Components
DevOps Tools like GitLab, Jenkins, Nexus, etc.: The wide deployment of these platforms within the intranet provides attackers with a rich attack surface. By scanning the version information of these platforms, attackers exploit known vulnerabilities (such as CVE-2018-19571, CVE-2018-1000861, etc.) to gain access, subsequently executing remote code or controlling the entire CI/CD pipeline.
Defensive Strategies:
Regularly apply security updates to DevOps tools and timely install the latest security patches to reduce opportunities for vulnerability exposure.
Implement strict access control strategies, such as Multi-Factor Authentication (MFA) and Role-Based Access Control (RBAC), ensuring that only authorized users can access DevOps platforms.
▌Vulnerability Exploitation and Defensive Strategies
Web Application Vulnerabilities
Web applications are important interaction interfaces for corporate intranets and are prone to becoming entry points for attacks. They mainly include:
CMS System Vulnerabilities: Systems like WordPress and Joomla often have vulnerabilities such as SQL injection and file upload. Defensive strategies include regularly updating the CMS and its plug-ins, and strictly restricting file uploads.
Java Component Vulnerabilities: Components like Apache Struts, Shiro, and Log4j have remote code execution vulnerabilities. Java components should be regularly checked and updated, and deserialization operations should be restricted.
OA System Vulnerabilities: Such as authentication bypass and session hijacking. It is recommended to enable multi-factor authentication and regularly audit the system.
Open Source Component Vulnerabilities: Path traversal and remote code execution vulnerabilities in components like Apache HTTP Server and Tomcat. Vulnerability advisories should be monitored in real-time, patches applied promptly, and application sandboxes used to isolate components.
Database Vulnerabilities
Databases are core corporate assets and are vulnerable to attacks like SQL injection and unauthorized access. Defensive strategies include using parameterized queries to prevent SQL injection, closing default ports of database services and external access, and ensuring they are only open to trusted hosts within the intranet.
System Vulnerabilities
System-level vulnerabilities include privilege escalation, remote code execution, and weak passwords. It is recommended to regularly update operating system patches, implement strong password policies, and enable multi-factor authentication.
Centralized Authority System Vulnerabilities
Centralized systems such as Active Directory, Kerberos, and LDAP manage identity authentication and authorization for corporate intranets, and are prone to becoming attack targets. They mainly include:
Domain Controller Vulnerabilities: Such as NTLM Relay attacks and Kerberos Golden Ticket attacks. It is recommended to disable unnecessary NTLM authentication, regularly check Kerberos tickets, and strengthen domain controller protection.
Bastion Host Vulnerabilities: Such as authentication bypass and command injection. Strong authentication mechanisms should be configured, and command inputs should be strictly validated and filtered.
Monitoring Software Vulnerabilities: Such as unauthorized access and remote code execution. It should be ensured that monitoring software has strict access controls enabled, and software should be updated promptly to fix vulnerabilities.
▌Analysis of Persistence and Stealth Strategies
Backdoor Deployment: The Bridge to Persistent Access
Common Forms:
Webshell: Attackers exploit vulnerabilities to upload malicious scripts to servers, executing system commands and manipulating files through Web interfaces. Its stealthiness lies in its ability to blend into normal Web requests, but it can be detected in Web server logs through abnormal request patterns.
Reverse Shell: Unlike traditional forward connections, a reverse shell makes the controlled system actively connect to the attacker's server, effectively bypassing intranet firewall restrictions to achieve stealthy access.
Defensive Strategies:
Strengthen the validation mechanism of file upload interfaces, restrict script execution permissions, regularly perform file system scans, and promptly detect and clear potential malicious scripts.
Implement strict access control policies, monitor Web server and system command execution logs, and immediately trigger alarms for abnormal behaviors.
System Configuration Tampering: Underhand Tactics to Weaken Defenses
Tampering Methods:
Disabling Security Logging: By modifying system settings, security events are prevented from being logged, putting a "cloak of invisibility" over attack behaviors.
Modifying Authentication Mechanisms: Tampering with identity authentication processes to create convenient channels for backdoor accounts or weak passwords, bypassing security checks.
Defensive Measures:
Regularly conduct system security configuration audits to ensure that logging and authentication mechanisms are intact, and timely discover and repair traces of tampering.
Deploy a centralized log management system to achieve remote storage and analysis of logs, preventing local logs from being tampered with, while setting up SIEM systems to automatically alert and perform real-time monitoring of configuration changes.
Log and Trace Clearing: The Art of Erasing Evidence
Clearing Behaviors:
Deleting Event Logs: Deliberately and selectively clearing login records, system error logs, or directly editing log contents to cover up attack activities.
Modifying Timestamps: Adjusting file creation and modification times to confuse and mislead, making it difficult for security teams to track the true source and time of malicious files.
Defensive Countermeasures:
Establish an untamperable log storage system to ensure that log data is saved on secure remote systems or centralized management platforms, preventing local deletion operations.
Utilize timeline analysis tools to regularly perform comprehensive reviews of logs and file systems, identifying any abnormal timestamp modification behaviors, and comprehensively analyzing them in combination with other security events to uncover potential attack activities.
▌Restricting Lateral Movement and Persistent Control
Network Segmentation and Micro-segmentation
Network Segmentation: First, isolate different systems, departments, and services into independent network areas by configuring VLANs. Set strict firewall policies for each VLAN to ensure only specific traffic can communicate across VLANs. For example, completely isolate the financial system from ordinary user systems, allowing only users with explicit permissions to access financial data. After completing network segmentation, use network monitoring tools to verify and ensure that isolation policies are executed correctly, avoiding cross-VLAN access caused by lax firewall policies.
Micro-segmentation: As a complement to network segmentation, micro-segmentation can further refine security controls. Use micro-segmentation tools to configure independent security policies for each application or container, restricting unnecessary lateral traffic. Meanwhile, continuously monitor communication between applications to ensure policy flexibility, and adjust rules timely based on actual conditions. When implementing micro-segmentation, balance security and business needs to avoid shutting down all traffic in a one-size-fits-all manner.
Example of Network Isolation and Micro-segmentation
Full Traffic Encryption and Authentication Mechanisms
Encrypted Transmission: Enable TLS encryption for all internal services, especially common protocols like HTTP, RDP, and SMB. Ensure that encryption certificates are issued by trusted CAs, and regularly update certificates to avoid expiration. Meanwhile, use network monitoring tools to regularly check network traffic, ensuring no cleartext transmission of sensitive information.
Identity Authentication: Deploy Multi-Factor Authentication (MFA) mechanisms, enabling MFA for all highly privileged users, especially forcing multi-factor authentication for remote logins and key system access. In addition, assign different access privileges to users with different roles, ensuring only necessary users can access specific systems, and approve and log all privilege changes.
Privilege Management and Principle of Least Privilege
Through the RBAC (Role-Based Access Control) system, ensure that each user and service only possesses the minimum privileges required to complete their work. Regularly perform privilege audits, clean up highly privileged users and service accounts, and promptly disable or delete accounts or privileges that are no longer in use.
Strictly manage service account privileges to prevent them from accessing core systems or possessing administrator privileges. Especially when using automated services, ensure they use separate accounts and strictly control the scope of privileges. It is recommended to use automated tools to regularly check and audit user privileges to ensure that the principle of least privilege is implemented.
Log Monitoring and Behavioral Analysis System
Establish a centralized log management system to centrally store logs of all systems and network devices in the SIEM system. Use automated analysis tools to detect abnormal activities, focusing on abnormal events such as login failures, privilege changes, and cross-host connections.
Establish baselines based on user behavior to detect abnormal behavior. For example, if an ordinary user suddenly accesses multiple highly privileged systems, this should be regarded as a potential threat. Meanwhile, use traffic monitoring tools to analyze communication between hosts in real-time, especially monitoring traffic of protocols commonly used for lateral movement, to quickly discover abnormal activities.
Vulnerability Management and Patch Management Strategies
Regularly use vulnerability scanning tools to scan all hosts and services within the intranet to identify potential high-risk vulnerabilities. The scanning scope should include operating systems, applications, and network devices.
Ensure that all hosts promptly apply the latest security patches, especially after high-risk vulnerabilities are released, remediation should be completed as soon as possible. For critical systems, verify patch compatibility in a test environment in advance to avoid affecting business operations. For legacy systems that cannot apply patches immediately, take other measures (such as restricting external access, enabling network isolation, verifying the defensive effectiveness of perimeter defense methods, etc.) to temporarily reduce the risk of vulnerability exploitation, and arrange to upgrade or replace systems as soon as possible.
▌Building a Comprehensive Defensive System
In the battle of cyber security defense, the Blue Team not only needs to construct solid defense lines to resist external threats, but also needs to master a set of efficient and meticulous lateral movement forensics and analysis skills. This capability is crucial for retracing attack paths, revealing attacker behavior patterns, and ultimately protecting intranet security.
Log Forensics: The Cornerstone of Tracking Attack Footprints
Logs are important information sources recording system activities, user behaviors, and abnormal events. In lateral movement attacks, attackers often leave traceable traces as they move between different systems.
System Log Analysis: Windows event logs and Linux logs (such as /var/log/auth.log) provide core data like user logins and privilege changes. The Blue Team should focus on abnormal events such as multiple login failures, remote login attempts, privilege escalation, and new user creation, especially operation records of highly privileged users. Through log correlation analysis, comparing log entries of different devices can reconstruct the attacker's path of movement. For example, if the same user is detected continuously logging into multiple systems in a short period, this is highly likely to be a sign of an attacker performing lateral movement.
Application Logs: Web server logs, database access logs, etc., are key evidence left by attackers when penetrating application-layer systems. When analyzing, the Blue Team should pay special attention to a large volume of or abnormal POST requests, especially those containing malicious parameters or accessing file upload interfaces, which are often precursors of attackers trying to upload malicious scripts or perform Web application penetration.
Practical Recommendations: Given the massive volume of log data, the Blue Team should combine Security Information and Event Management (SIEM) systems for centralized log management and automated analysis. Set real-time alerts for high-risk behaviors; if abnormal privilege changes or frequent cross-host logins are detected, measures should be taken immediately to respond.
Network Traffic Forensics: A Window to Insight on Attacker Movements
Lateral movement attacks are often accompanied by abnormal network traffic. By analyzing this traffic, the Blue Team can reveal the attacker's trajectory.
Full Traffic Capture and Analysis: The Blue Team should deploy professional open-source traffic analysis tools (such as Wireshark, Zeek) or commercial full-traffic products to capture and analyze all traffic within the intranet. Focus on large data transmissions between hosts and abnormal protocol usage, especially protocols commonly used for lateral movement such as RDP, SMB, and SSH.
Specific Protocol Monitoring: SMB and RDP are commonly used protocols in lateral movement. The Blue Team should focus on analyzing traffic of these protocols, especially during non-working hours or unauthorized access requests. Meanwhile, traffic patterns and behaviors are equally important; for instance, if a host suddenly initiates a large number of SMB connections to multiple servers, even if the packet content has no obvious abnormalities, it could still be a sign of lateral movement.
Traffic Correlation Analysis: By performing correlation analysis on traffic across multiple hosts, the Blue Team can discover the attacker's path of movement. For example, when a host communicates frequently with multiple servers via the SMB protocol, combining this with the host's log information can help determine if an attacker is attempting lateral penetration.
File System Forensics: Unearthing Clues Left by Attackers
When performing lateral movement, attackers often leave traces of file modification, creation, or implantation of backdoor programs in the file system.
Timeline Analysis: By analyzing file modification times, access times, and creation times in the file system, the Blue Team can reconstruct a timeline of the attacker's activities. If the modification times of certain system files coincide with the time window of the attack behavior, it can be confirmed that these files were modified by the attacker.
Critical File Analysis: The Blue Team should pay special attention to user account files, log files, and configuration files related to critical services (such as /etc/passwd and /etc/shadow). Attackers may modify these files to increase privileges or hide their operations.
Backdoor File Detection: Many attackers implant backdoor programs in the file system after compromising a system to maintain access to the system in the future. The Blue Team should detect potential backdoors by regularly scanning for newly added or modified executable files in the system.
Practical Challenges and Countermeasures: The challenge in file system forensics is that a large number of normal file operations can cover up the attacker's traces. The Blue Team should combine timeline analysis and user behavior analysis tools, finding suspicious file modifications through cross-validation. In addition, establishing a file integrity monitoring mechanism to perform real-time monitoring of critical files, and immediately alerting once abnormal modifications are found, is also an effective means to improve forensics efficiency.
▌Conclusion
In the digital era, corporate intranet security is of paramount importance. In the face of complex threats, enterprises need to adopt comprehensive defensive measures to cope with advanced attacks like lateral movement. By strengthening information gathering defense, credential protection, vulnerability management, restricting lateral movement, and employee security awareness training, an effective defensive system can be built. Regular third-party security assessments and audits can enhance security, meet regulatory requirements, and safeguard business continuity and competitive advantages.
▶▶▶For more detailed content, please download Blue Team Book VII [Lateral Movement Edition] Deep Analysis of Intranet Lateral Movement and Defensive Strategies to obtain the complete report.
