6. Persistence
Group Membership
Special Groups
Adding to Admin group
Adding to Backup Operators group. Users in this group won't have administrative privileges but will be allowed to read/write any file or registry key on the system, ignoring any configured DACL.
This would allow us to copy the content of the SAM and SYSTEM registry hives, which we can then use to recover the password hashes for all the users, enabling us to escalate to any administrative account
After logging in via Backup Operators, you have to change your local account token filter
Using Evil-WinRM to download the SAM and SYSTEM files
Cracking it with impacket
PTH
Nested Groups
Although Domain Admin and Enterprise Admin groups are all powerful, we should not always aim for high privileged groups as they are closely monitored
Creating Nested Groups for obfuscation
Adding nest_group2 to nestgroup1
Repeat it a couple of times
Add the whole nested group into Domain Admins
Add our account to nestgroup1. Because it’s now a child of Domain Admins, it will inherit those privileges
AdminSDHolder
Group memberships can be removed, but AD group templates can persist and update our persistence once it refreshes, even if our membership was removed.
One such template is the AdminSDHolder container which exists in every AD domain. Its Access Control List (ACL) is used as a template to copy permissions to all protected groups such as Domain Admins, Administrators, Enterprise Admins, and Schema Admins
A process called SDProp takes the ACL of the AdminSDHolder container and applies it to all protected groups every 60 minutes.
If we modify AdminSDHolder and add our account, we will have consistent admin privileges.
Open mmc, and add the Users and Groups Snap-in (File->Add Snap-In->Active Directory Users and Computers). Make sure to enable Advanced Features (View->Advanced Features). We can find the AdminSDHolder group under Domain->System:
Navigate to the Security of the group (Right-click->Properties->Security):
Click Add.
Search for your low-privileged username and click Check Names.
Click OK.
Click Allow on Full Control.
Click Apply.
Click OK.
Now we just need to wait 60 minutes, and our user will have full control over all Protected Groups, or we can invoke the process manually using PowerShell
Persistence through GPOs
Create a script on the victim machine persist.bat with the contents:
This copies the payload from SYSVOL to the localhost and executes it
Copy the shell and the script to SYSVOL
Create a new GPO that will be applied to all admins, so we get an admin that executes the script on login to get an admin shell
In your runas-spawned terminal, type MMC and press enter.
Click on File>Add/Remove Snap-in...
Select the Group Policy Management snap-in and click Add
Click OK
Right-click on the Admins OU and select Create a GPO in this domain
Right-click on your policy and select Enforced.
In the Group Policy Management Editor:
Under User Configuration, expand Policies->Windows Settings.
Select Scripts (Logon/Logoff).
Right-click on Logon->Properties
Select the Scripts tab.
Click Add->Browse.
Add our
persist.bat
Persistence Through SID History
SIDs are used to track the security principal and the account's access when connecting to resources
We require Domain Admin privileges for this attack
Checking SID history
Patching SID History
Rerun to check SID history
Scheduled Task
Creating a task
Deleting the task
sc.exe
Ports:
135/TCP, 49152-65535/TCP (DCE/RPC)
445/TCP (RPC over SMB Named Pipes)
139/TCP (RPC over SMB Named Pipes)
Required Group Memberships: Administrators
Create a service on the remote machine using sc.exe
%windir%\myservice.exe will be executed when the service is started
To stop and delete the service, we can then execute the following commands:
Startup Apps
Applications which has shortcuts in
C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startupwill be started when any user logs in to the machine.If we write our payload here and an admin logs in, our payload will be executed with admin privileges
They have to be shortcuts!
Script for creating shortcuts in C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup (if it’s writable)
Sticky Keys
After pressing SHIFT 5 times, Windows will execute the binary in C:\\Windows\\System32\\sethc.exe
If we replace the binary with our payload, it will execute
Utilman
Login Triggered
Startup programs
C:\\Users\\<your_username>\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup stores executables to be run whenever the user logs in
If we want to force all users to run a payload while logging in, we can use the folder under C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp
Run / RunOnce
Force a user to execute a program on logon via the registry by using the following registry entries to specify applications to run at logon:
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunHKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceHKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunHKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce
Any program specified under the Run keys will run every time the user logs on. Programs specified under the RunOnce keys will only be executed a single time.
Winlogon
Winlogon uses some registry keys under
HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\
Userinitpoints touserinit.exe, which is in charge of restoring your user profile preferences.shellpoints to the system's shell, which is usuallyexplorer.exe.
If we'd replace any of the executables, we would break the logon sequence, but you can append commands separated by a comma and Winlogon will process them all.
Logon Scripts
One of the things userinit.exe does while loading your user profile is to check for an environment variable called UserInitMprLogonScript and executes any commands there
File Associations
The default operating system file associations are kept inside the registry, where a key is stored for every single file type under HKLM\\Software\\Classes\\.
Checking which program is used to open .txt files; we can check for the .txt subkey and find which Programmatic ID (ProgID) is associated with it.
A ProgID is an identifier to a program installed on the system. For .txt files, we will have a ProgID of txtfile
After getting txtfile we find which Program is used to run txtfile in shell\\open\\command
We can change the value of shell\\open\\command to specify any program we want to run
RID Hijacking
When a user is created, an identifier called Relative ID (RID) is assigned to them.
When a user logs on, the LSASS process gets its RID from the SAM registry hive and creates an access token associated with that RID.
If we can tamper with the registry value, we can make windows assign an Administrator access token to an unprivileged user by associating the same RID to both accounts.
In any Windows system, the default Administrator account is assigned the RID = 500, and regular users usually have RID >= 1000.
Getting all RIDs
Edit the SAM in Regedit. You need to use SYSTEM account for this, and not just an Administrator account
Go to HKLM\\SAM\\SAM\\Domains\\Account\\Users\\
Since we want to modify thmuser3, we need to search for a key with its RID in hex (1010 = 0x3F2)
Under the corresponding key, there will be a value called F, which holds the user's effective RID at position 0x30:
The RID is stored using little-endian notation, so its bytes appear reversed.
Replace those two bytes with the RID of Administrator in hex (500 = 0x01F4), switching around the bytes (F401):
Last updated
