search

Learning Objtetive 7

  • dcorp-mgmt - Process using svcadmin as service account

  • dcorp-mgmt - NTLM hash of svcadmin account

  • dcorp-adminsrv - We tried to extract clear-text credentials for scheduled tasks from? Flag value is like lsass, registry, credential vault etc.

  • dcorp-adminsrv - NTLM hash of srvadmin extracted from dcorp-adminsrv

  • dcorp-adminsrv - NTLM hash of websvc extracted from dcorp-adminsrv

  • dcorp-adminsrv - NTLM hash of appadmin extracted from dcorp-adminsrv

hashtag
Identify a machine where Domain Admin session is available

We have access to two domain users - student113 and ciadmin and administrative access to dcorpadminsrv machine. User hunting has not been fruitful as studentx. We got a reverse shell on dcorp-ci as ciadmin by abusing Jenkins.

  • student113 → usuario de dominio normal

  • ciadmin → obtenido mediante reverse shell en dcorp-ci explotando Jenkins

  • admin local en dcorp-adminsrv (de ejercicios anteriores)

hashtag
Enumeration using Invoke-SessionHunter (Session Hunting - Lateral Movement)

We can use Invoke-SessionHunter.ps1 from the student VM to list sessions on all the remote machines. The script connects to Remote Registry service on remote machines that runs by default. Also, admin access is not required on the remote machines.

hashtag
Invisi-Shell

hashtag
Without target

Enumrate all computers/server of domain

To make the above enumeration more opsec friendly and avoid triggering tools like MDI, we can query specific target machines.

Now, we need to create 'servers.txt' saving the true hostnames and use the below command:

hashtag
With targets

Using unil the list of target, dont search computers/servers into domain (User PowerView)

Sweet! There is a domain admin (svcadmin) session on dcorp-mgmt server! We do not have access to the server but that comes later.

We can see if this user is domain admin comparing it to BloodHound

hashtag
Enumeration using PowerView from the Jenkins Reverse Shell - Bypassing Security Controls

We obtained a reverse shell on dcorp-ci as the user ciadmin by abusing a Jenkins job. All the following steps will be performed inside that reverse shell session.

From this shell, we start the Active Directory enumeration phase using PowerView.

The goal is to find machines where a Domain Admin has an active session, which could later allow us to steal credentials or tokens.

we first bypass some PowerShell security mechanisms to avoid detection.

hashtag
Bypass ScriptBlock Logging

Info: Bypass Windows logs of PowerShell commands.

Into (user RCE jenkings)

Upload the file sbloggingbypass.txt --->

hashtag
Bypass AMSI

Info: AMSI scans scripts before execution.

Upload the file Amsi-Byp.txt to bypass the AMS after, it contains -->

hashtag
Execute PowerView

Upload PoweView to execute commnads -->

Once we do all, Now run user hunting to find where Domain Admins are logged in -->

Great! There is a domain admin session on dcorp-mgmt server!

ahora mismo hay una sesión cargada en memoria.

Now, we can abuse this using winrs or PowerShell Remoting!

hashtag
Use winrs to access dcorp-mgmt

Let's check if we can execute commands on dcorp-mgmt server with it user (ciadmin) and if the winrm port is open:

ciadmin → tiene acceso remoto a dcorp-mgmt

ciadmin = Administrators (dcorp-mgmt) (porque para ejecutar comando debes ser local admin o pertenecer al grupo)

It`s open and we are ciadmin so... we can execute commands too into this machine

We would now run SafetyKatz.exe =(versión modificada de Mimikatz que se usa para dumpear LSASS) on dcorp-mgmt to extract credentials from it. For that, we need to copy Loader.exe =(programa que descarga y ejecuta otro binario en memoria) on dcorp-mgmt. Let's download Loader.exe on dcorp-ci and copy it from there to dcorp-mgmt. This is to avoid any downloading activity on dcorp-mgmt.

Remember upload SafetyKatz to the webshell

Run the following command on the shell of rever shell (ciadmin\dcorp-ci):

Now, copy the Loader.exe to dcorp-mgmt:

hashtag
Port Forwarding - Bypass Detections

Using winrs, add the following port forwarding on dcorp-mgmt to avoid detection on dcorp-mgmt:

Note: Please note that we have to use the $null variable to address output redirection issues.

Remeber user the same port that your web server (:280)

hashtag
SafetyKatz in-memory using

To run SafetyKatz on dcorp-mgmt, we will download and execute it in-memory using the Loader. Run the following command on the reverse shell:

Sweet! We got credentials of svcadmin - a domain administrator. Note that svcadmin is used as a service account (see “Session” in the above output), so you can even get credentials in clear-text from lsasecrets!

hashtag
Use OverPass-the-Hash to replay svcadmin credentials

Finally, use OverPass-the-Hash to use svcadmin’s credentials.

Run the commands below from an elevated shell on the student VM to use Rubeus. Note that we can use whatever tool we want (Invoke-Mimi, SafetyKatz, Rubeus etc.):

In us machine VM, run it how local admin privileges

Into it new cmd try to access at the domain controller from the new process!

Note that we did not need to have direct access to dcorp-mgmt from the student VM.

hashtag
Abuse Derivative Local Admin

Now moving on to the next task, we need to escalate to domain admin using derivative local admin. Let’s find out the machines on which we have local admin privileges

Remeber use a new invishell admin priv

We have local admin on the dcorp-adminsrv. You will notice that any attempt to run Loader.exe (to run SafetKatz from memory) results in error ‘This program is blocked by group policy. For more information, contact your system administrator’. Any attempts to run Invoke-Mimi on dcorp-adminsrv results in errors about language mode. This could be because of an application allowlist on dcorp-adminsrv and we drop into a Constrained Language Mode (CLM) when using PSRemoting.

hashtag
Gaps in Applocker Policy

Let’s check if Applocker is configured on dcorp-adminsrv by querying registry keys. Note that we are assuming that reg.exe is allowed to execute:

Looks like Applocker is configured. After going through the policies, we can understand that Microsoft Signed binaries and scripts are allowed for all the users but nothing else. However, this particular rule is overly permissive!

First search the scripts and examine its at found something -->

A default rule is enabled that allows everyone to run scripts from the C:\Program Files folder! We can also confirm this using PowerShell commands on dcrop-adminsrv. Run the below commands from a PowerShell session as studentx:

It confirm us that this ps be in restrictive mode.

Now execute this command to read the current enable rules -->

Here, Everyone can run scripts from the ‘Program Files’ directory. That means, we can drop scripts in the Program Files directory there and execute them. Also, in the Constrained Language Mode, we cannot run scripts using dot sourcing (. .\Invoke-TheKat.ps1). So, we must modify Invoke-TheKat.ps1 to include the function call in the script itself and transfer the modified script (Invoke-TheKatEx.ps1) to the target server.

hashtag
Create Invoke-TheKatEx-keys-stdX.ps1

  • Create a copy of Invoke-TheKat.ps1 and rename it to Invoke-TheKatEx-keys-stdX.ps1 (where X is your student ID).

  • Open Invoke-TheKatEx-keys-stdX.ps1 in PowerShell ISE (Right click on it and click Edit).

  • Add the below encoded value for token-evasive-elevate and sekurlsa::evasive-ekeys to the end of the file.

On student machine run the following command from a PowerShell session.

Note that it will take several minutes for the copy process to complete.

Share it to dcorp-adminsrv pc -->

Remember user administrative shell + invisihell + powerview

The file Invoke-MimiEx.ps1 is copied to the dcorp-adminsrv server.

Now, run the modified mimikatz script.

Note that there is no dot sourcing here. It may take a couple of minutes for the script execution to complete:

Here we find the credentials of the dcorp-adminsrv$, appadmin and websvc users.

hashtag
Create Invoke-TheKatEx-vault-stdx.ps1

There are other places to look for credentials. Let’s modify Invoke-TheKatEx and look for credentials from the Windows Credential Vault. On the student VM:

  • Create a copy of Invoke-TheKat.ps1 and rename it to Invoke-TheKatEx-vault-stdX.ps1 (where x is your student ID).

  • Open Invoke-TheKatEx-vault-stdX.ps1 in PowerShell ISE (Right click on it and click Edit).

  • Replace Invoke-TheKat -Command '"sekurlsa::ekeys"' that we added earlier with Invoke-Mimi -Command '"token::evasive-elevate" "vault::cred /patch"'.

Copy Invoke-MimiEx-vault-stdX.ps1 to dcorp-adminsrv and run it.

Remember that it will take several minutes for the copy process to complete.

Now, run the script. Again, it may take a couple of minutes for the script execution to complete:

Sweet! We got credentials for the srvadmin user in clear-text!

Start a cmd process using runas. Run the below command from an elevated shell:

With it we connect with the user and pass of srvadmin buuttt!! it give us a cmd with us user student and the same machine but with the red/priv of srvadmin user

"/netonly" = ✔ no cambia tu sesión ✔ no necesitas logon interactivo ✔ no crea logon tipo 2 ✔ es más OPSEC friendly

The new process that starts has srvadmin privileges. Check if srvadmin has admin privileges on any other machine.

Use invishell + seach remote admin access -->

Remember user PowerView!

We can see how we have local admin access on the dcorp-mgmt server as srvadmin and we already know a session of svcadmin is present on that machine.

Let’s use SafetyKatz to extract credentials from the machine.

Run the below commands from the process running as srvadmin terminal

Copy the Loader.exe to dcorp-mgmt:

Now extract the credentials:

Remember to have the Safetykatz.exe available in a web server to download it and exuecute in memorie at the same ttime with the command.

Remember to have too the portforwarding do, but!! for this case, we can use directly us ip and webserver

hashtag
Disable Applocker on dcorp-adminsrv by modifying GPO

Recall that we enumerated that studentx has Full Control/Generic All on the Applocked Group Policy

Let’s make changes to the Group Policy and disable Applocker on dcorp-adminsrv.

We need the Group Policy Management Console for this. As the student VM is a Server 2022 machine, we can install it using the following steps: Open Server Manager -> Add Roles and Features -> Next -> Features -> Check Group Policy Management -> Next -> Install

After the installation is completed, start the gpmc.

Start the gpmc. We need to start a process as studetntX using runas, otherwise gpmc doesn’t get the user context. Run the below command from an elevated shell:

Run the below command from an elevated shell:

Now! In the fristly shell when we execute runas, strat the gpmc -->

In gpmc, expand Forest -> Domains -> dollarcorp.moneycorp.local -> Applocked -> Right click on the Applocker policy and click on Edit

In the new window, Expand Policies -> Windows Settings -> Security Settings -> Application Control Policies -> Applocker

Start looking at each category of the Applocker policies. You will find out that there are two restrictions.

Recall that we have already enumerated this earlier.

  1. In the ‘Executable Rules’, ‘Everyone’ is allowed to run Microsoft signed binaries.

  2. In the ‘Script Rules’, ‘Everyone’ can run Microsoft signed scripts from any location and two default rules where ‘Everyone’ can run Microsoft signed scripts from C:\Windows and C:\Program Files folders.

As we already abused the default rules for Scripts, let’s go for Executable Rules. Right Click on the rule and delete it.

Now, we can either wait for the Group Policy refresh or force an update on the dcorp-adminsrv machine.

Let’s go for the later using the following commands as studentx:

Exit of the current session and copy Loader on the machine and use it to run SafetyKatz!!!

Now use a portforwarding to mask a little us ip -->

Then of it, execute -->

Sweet! We were able to disable Applocker.

Please note that modification to GPO is not OPSEC safe but still commonly abuse by threat actors.

PreviousLearning Objetive 6NextLearning Objetive 8

Last updated