Cunning With CNG: Soliciting Secrets From Schannel

on YouTube ↗47m

" summary

Demonstrates that Schannel/CNG leaks decryptable secrets from memory so TLS sessions that use ephemeral ECDHE are recoverable by extract master keys and related blobs from LSASS and process memory; uses WinDbg, Volatility/Recall plugins, mimikatz/BCrypt artifacts, Jesse Kornblum’s scanner and a modified RDP‑replay to dump keys into Wireshark and successfully replay RDP session. Cache holds entries for 10 hours default cache and up to 20,000 entries per client/server, and DPAPI master keys are recoverable in memory so persistent private keys and session tickets can be decrypted.

AI-written summary · about

" chapters (27)

1. 0:00Intro
2. 2:08Black Hat Sound Bytes
3. 3:06Disclaimer
4. 4:00The infamous TLS Handshake
5. 7:29Perfect Forward Secrecy
6. 10:13Schannel & CNG
7. 11:32Schannel Prefered Cipher Suites
8. 12:31Microsoft's TLS/SSL Docs
9. 13:16Schannel Ops
10. 14:01CNG Key Isolation
11. 14:26Background Summary
12. 14:37What are we trying to accomplish?
13. 15:53The keys? What do they get us?
14. 17:44Session Keys
15. 20:53The Norypt SSL Provider (ncryptsslp.dll)
16. 21:48Pre-Master Secret (PMS)
17. 23:12Master Secret Mapped to Unique Identifier
18. 23:58Ephemeral & Persistent Private keys
19. 24:489 Ephemeral Private Key
20. 26:271 Persistent Private key
21. 27:337 Decrypting Persistent Key - DPAPI
22. 29:59Session Ticket key
23. 31:13Decrypting Session Tickets
24. 33:13Inherent Metadata TLS Provides
25. 35:13Schannel Caching Parameters
26. 37:21This is your Schannel Cache (x64)
27. 39:49Limitations

" related talks

• 01h 02mCQTools: The New Ultimate Hacking ToolkitPaula Januszkiewicz, Mike Jankowski-Lorek, Adrian Denkiewicz · Black Hat Asia 2019
• 54mAdventures in the Underland: The CQForensic Toolkit as a Unique Weapon Against HackersPaula Januszkiewicz · Black Hat USA 2019
• 32mExplore Adventures in the Underland: Forensic Techniques against HackersPaula Januszkiewicz · RSAC 2020 Asia Pacific & Japan
• 54mDPAPI and DPAPI-NG Decrypting All Users’ Secrets and PFX PasswordsP. Januskiewicz · Hack In Paris 2019
• 47mFinding a Needle in an Encrypted HaystackMarina Simakov, Yaron Zinar · Black Hat USA 2019
• 39mI Watched You Roll the Die: Unparalleled RDP Monitoring Reveal Attackers' TradecraftAndréanne Bergeron, Olivier Bilodeau · Black Hat USA 2023
• 40mExploiting Windows Hello for BusinessMichael Grafnetter · Black Hat Europe 2019
• 52mAdventures in Underland: Hacker Tricks to Stay Under the...Paula Januszkiewicz · Oh My H@ck 2020