Hi.
My name is Gavin Johnson‑Lynn, and in this course,
we're going to look at a RedTeam tool called LaZagne.
This is a tool that retrieves credentials from a computer.
Those credentials could then give you access to various software and
systems that are linked with that computer and its users.
So what is the LaZagne project?
Bang Bang!
It was created by Alessandro Zanni, and in his words,
it's an open‑source application used to retrieve lots
of passwords stored on a computer,
and it was developed for the purpose of finding passwords
for the most commonly‑used software.
As it's an open‑source project,
you are of course free to view the code and help maintain it.
I'm really grateful to Alessandro and everyone else who
creates and maintains projects like this.
Let's look a little more closely.
LaZagne is a post exploitation tool aimed at
retrieving credentials from a system.
It's written in Python and works on Windows, Linux, and Mac.
There is a GitHub repository for LaZagne.
In there,
you'll be able to access the code and a copy of the Windows
executable The repository is available here.
As the spelling is fairly unique, an Internet search should get you there.
The exercise files for this course do contain a PDF of the slides,
where you'll be able to find all of the links we use.
As we've already heard, LaZagne targets a variety of software.
In Windows, it can retrieve credentials from over 60 pieces of software,
including browsers, local administration tools,
and operating system components.
While its primary focus is the Windows operating system,
it's still effective on Linux and Mac.
Various threat groups have been known to use LaZagne while
targeting organizations and governments.
They include APT3, APT33, MuddyWater, and Leafminer,
which are a selection of cyber espionage and
potentially government‑backed organizations.
On the RedTeam kill chain, LaZagne is a post exploitation tool,
so it comes in after we've already exploited a
weakness and gained access to a machine.
Once there, we'll gather credentials,
which will hopefully give us greater privileges and allow us to move laterally.
Within the Mitre ATT&CK framework, LaZagne focuses on a
single tactic, which is credential access.
We're going to look at two techniques under this.
The first one is T1552, unsecured credentials, and we're
specifically looking at credentials in files.
The second is T1555, credentials from password stores, where we'll
target getting credentials from web browsers.
An important point before we go further is that accessing
and using computers without the owner's consent is against
the law in most countries,
Using LaZagne on someone else's computer is therefore going
to be illegal. Once you've got permission, and you're certain
that it covers running LaZagne, you should be good to go.
Alternatively, you could always set up a computer of your own and test it out,
but always be familiar with the laws around this before you start.
Looking at the type of scenario LaZagne might be useful in, we start
with the company's network. On the outside, we have an attacker They're
scanning the internet and find a vulnerable machine that gives them
access to the company's network. From there, they try to find
interesting machines to access.
There are of course plenty of other routes to a
machine that an attacker could use,
such as phishing or downloaded malware. When they find a machine
and gain access to it, they start to run LaZagne.
The code scans for common credential storage locations. It
might find some related to cloud operations,
such as AWS or Azure. If the user doesn't have protection
like multifactor authentication in use,
then those systems could be accessed, and they might house
live infrastructure for the business.
Accessing the user's browser could reveal credentials for a variety of websites.
This might allow access to web‑based systems and the data they store,
perhaps CRM systems or access to code repositories.
It could also grant access to logging solutions used by the business's
software, the content of which could leak private information or even
passwords and locations of services. Credentials for email software could
allow a wealth of company information to be exposed.
Just imagine the detail that's often stored for years in email accounts.
LaZagne can get credentials from common VPN solutions.
A VPN will often grant access to areas like a company's private
network or virtual private cloud infrastructure that's used to house
live services. There could also be credentials to grant access to
other machines such as through remote desktop connections or direct
access to database servers.
The places on our machines that are storing our
passwords are surely secure, right?
The truth is often very different.
So what software can we potentially get credentials from when
we use LaZagne? On Windows, Linux, and Mac,
both Chrome and Firefox can be targeted, so if someone
stores their passwords in the browser, there's a good chance we can get at them.
These are two of only four modules currently available on a Mac.
Linux currently has 34 LaZagne modules. Some of the software
you're likely to get credentials from includes SSH, FileZilla,
AWS, KeePass version 1 and 2, and Thunderbird email client.
Windows has 69 LaZagne modules.
Popular ones include Outlook,
VNC, RDPManager, OpenSSH, and OpenVPN. It can get passwords used for wireless
networks, and if you're running with admin credentials,
it can also get Windows password hashes. Before we get into demos,
it's worth talking about the environment we're using.
The environment is an up‑to‑date copy of Windows 10,
and Python is at version 3.9.1, which is current.
We're also targeting up‑to‑date versions of software unless otherwise
stated, so things like Chrome are the current versions.
Lastly, we've added the LaZagne executable to an allow list in Windows Defender.
The executable does get picked up by antivirus, and evasion
techniques aren't covered in this course.
Antivirus typically allows either specific files or directories to
be ignored, so that's helpful to try LaZagne out.