5. Lateral Movement

Process Spawning

WinRM

  • Ports: 5985/TCP (WinRM HTTP) or 5986/TCP (WinRM HTTPS)

  • Required Group Memberships: Remote Management Users

Using winrs.exe

winrs.exe -u:Administrator -p:Mypass123 -r:target cmd

Using PowerShell

$username = 'Administrator';

$password = 'Mypass123';

$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;

$credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;

Enter-PSSession -Computername TARGET -Credential $credential

Running command remotely

PsExec

  • Ports: 445/TCP (SMB)

  • Required Group Memberships: Administrators

The way psexec works is as follows:

  1. Connect to Admin$ share and upload a service binary psexesvc.exe on the victim machine

  2. Connect to the service control manager to create and run a service named PSEXESVC and associate the service binary with C:\\Windows\\psexesvc.exe.

  3. Create some named pipes to handle stdin/stdout/stderr.

On the attacker machine, we can execute commands on the victim machine with

WMI

To interact with WMI, we need to create a session object. This session object will be used for all exploits

Remote Process Creation Using WMI

  • Ports:

    • 135/TCP, 49152-65535/TCP (DCERPC)

    • 5985/TCP (WinRM HTTP) or 5986/TCP (WinRM HTTPS)

  • Required Group Memberships: Administrators

RCE using WMI

Creating Services Remotely with WMI

  • Ports:

    • 135/TCP, 49152-65535/TCP (DCERPC)

    • 5985/TCP (WinRM HTTP) or 5986/TCP (WinRM HTTPS)

  • Required Group Memberships: Administrators

Create a service on the victim machine using WMI

Start the service on the victim machine

Stop and remove the service on the victim machine

Installing MSI packages through WMI

  • Ports:

    • 135/TCP, 49152-65535/TCP (DCERPC)

    • 5985/TCP (WinRM HTTP) or 5986/TCP (WinRM HTTPS)

  • Required Group Memberships: Administrators

Once we create an msi reverse shell payload with msfvenom and uploaded it to the victim, we can use WMI to remote trigger the payload

Create the payload

Upload the payload to the victim machine

Trigger the MSI install via WMI using the session object

Pass The Hash

Extract hashes from SAM

Extract hashes from LSASS

Once we have the hash, we execute PTT to execute commands on the server

RDP using the hash

PsExec using the hash

WinRM using the hash

Pass the Ticket

Getting tickets using mimikatz

Injecting the ticket in our current session

Pass the Key

Getting the keys using mimikatz

If we have the RC4 hash:

If we have the AES128 hash:

If we have the AES256 hash:

RDP Hijacking

Open up cmd.exe as administrator and execute psexec

From there, query existing sessions on the server

Any session with a Disc state has been left open by the user and isn't being used at the moment. While you can take over active sessions as well, the legitimate user will be forced out of his session when you do, which could be noticed by them.

Connect to a session via

Permission Delegation

Active Directory can delegate permissions and privileges through a feature called Permission Delegation

Examples of potentially exploitable permissions

  • ForceChangePassword: We have the ability to set the user's current password without knowing their current password.

  • AddMembers: We have the ability to add users (including our own account), groups or computers to the target group.

  • GenericAll: We have complete control over the object

  • GenericWrite: We can update any non-protected parameters of our target object.

  • WriteOwner: We have the ability to update the owner of the target object. We could make ourselves the owner, allowing us to gain additional permissions over the object.

  • WriteDACL: We have the ability to write new ACEs to the target object's DACL. We could, for example, write an ACE that grants our account full control over the target object.

  • AllExtendedRights: We have the ability to perform any action associated with extended AD rights against the target object.

For example, given this Bloodhound graph, users in Domain Users group have GenericWrite permissions to IT SUPPORT group.

Users in IT SUPPORT group have ForceChangePassword permissions over a number of users.

To exploit this, we leverage on GenericWrite permissions to write ourselves into IT SUPPORT group, then we force change a password

Kerberos Delegation

There are three types of Kerberos Delegation:

  1. Constrained Delegation (CD) - Can access only certain services

  2. Unconstrained Delegation (UD) - Can access any service

  3. Resource-Based Constrained Delegation (RCD) - Service specifies who can delegate to it

We can see which accounts are allowed to delegate to which services using this command

The account svcIIS can delegate to HTTP and WSMAN services on THMSERVER1

Once we compromise the account svcIIS we can create a TGT and TGS to access those services

Using GPOs

Using this graph from Bloodhound, we see that account SVCSERVMAN can write to policies under MANAGEMENT SERVER PUSHES.

The polices in MANAGEMENT SERVER PUSHES is linked to MANAGEMENT SERVER, which will be applied to the THMSERVER2 machine.

We can update the policy MANAGEMENT SERVER PUSHES to add our malicious account to RDP and Admin groups of THMSERVER2

Opening MMC and adding the Group Policy Management snap-in

Editing the Management Server Pushes policy

  1. Expand Computer Configuration

  2. Expand Policies

  3. Expand Windows Settings

  4. Expand Security Settings

  5. Right Click on Restricted Groups and select Add Group

  6. Click Browse, enter IT Support and click Check Names

  7. Click Okay twice

  8. Add Administrators and Remote Desktop Users to the group membership

Golden/Silver Ticket

In a Golden Ticket attack we attempt to forge a TGT. To do that, we need the following information:

  • The FQDN of the domain

  • The Security Identifier (SID) of the domain

  • The username of the account we want to impersonate

  • The KRBTGT account password hash

We use mimikatz with DC Sync to get the password hash of KRBTGT account

We recover two SIDs:

  • The SID of the child domain controller (THMDC), which we will impersonate in our forged TGT

  • The SID of the Enterprise Admins in the parent domain, which we will add as an extra SID to our forged TGT

Forging the Golden Ticket using mimikatz and loading it in our session.

If we only have the hash of the local machine and not the hash of krbtgt, we can forge a silver ticket instead

We can now access machines in the parent Domain.

Previous4. Dumping CredentialsNext6. Persistence

Last updated