Evasion
Lab 7 Scenario:
Attack Path 1:
Student -> dcorp-ci via Jenkins
dcorp-ci is local admin on -> dcorp-mgmt
Using local admin privileges on dcorp-mgmt, we extracted domain admin credentials and use them to access dcorp-dc from Student.
Attack Path 2 (Derivative Local Admin or shortest path to DA):
Student has local admin privilges on dcorp-adminsrv.
To extract credentials, we evaded AppLocker.
dcorp-adminsrv has derivative local admin privileges on dcorp-mgmt.
We extracted domain admin credentials from dcorp-mgmt and used to access dcorp-dc from Student.
Student machine (student372) has exploited Jenkins to get a reverse shell on "dcorp\ciadmin"
From dcorp\ciadmin, we disable SB Logging to run AMSI bypass script. This is done to avoid PowerView detection.
We transfer PowerView to ciadmin to check domain sessions using
Find-DomainUserLocationand find that there is a domain admin session on dcorp-mgmt server.We can abuse this using WinRS or PSRemoting.
Abuse using WinRS
We first check if we can execute commands on dcorp-mgmt and if WinRM port is open.
Since we can run commands, we want to run SafetyKatz.exe on dcorp-mgmt.
We want SafetyKatz.exe to run on memory without touching disk. For this, we download NetLoader and use xcopy (since we have admin on ciadmin) to copy Loader to dcorp-mgmt.
We also want to avoid detection on dcorp-mgmt by calling remote IP to download SafeteKatz. So instead of directly calling attacker IP, we port forward localhost to attacker IP.
Since Defender would detect SafetyKatz even with NetLoader, we encode arguments using ArgSplit.bat, copy the output to Safety.bat which runs SafetyKatz.exe through loader with the encoded Arguments.
We download the Safety.bat on ciadmin and xcopy it to dcorp-mgmt.
Finally, we use WinRS to run Safety.bat which uses Loader.exe to download and execute SafetyKatz.exe in-memory on dcorp-mgmt.
We get credentials of svcadmin - a domain administrator.
Abuse using PSRemoting
Check if we can execute commands on dcorp-mgmt using PSRemoting
Download InvokeMimi.ps1 on dcorp-mgmt to dump hashes.
Disable AMSI either using the conventional method or using Set-MpPreference (since we have admin access on dcorp-mgmt.
After disabling, we run Invoke-command to call the Invoke-Mimi on the session objected we created while disabling AMSI.
We finally get the hashes.
Using Over-Pass-The-Hash
We can use O-PTH to use svcadmin's credentials.
From an elevated shell, we can use Rubeus, SafetyKatz, Invoke-Mimi to get a process from hash we obtained earlier as domain controller.
Derivative Local Admin
We are trying to find the machines on which student372 has admin privileges using Find-PSRemotingLocalAdminAccess
We find student372 has local admin access to dcorp-adminsrv. We use Enter-PSSession to get a shell on dcorp-adminsrv as student372.
When we try to turn of script logging or bypass AMSI, it does not work because PSRemoting uses Constrained Language Mode (CLM).
We can check this using
$ExecutionContext.SessionState.LanguageModeThis is either because of AppLocker of WDAC (Windows Defender Application Control). Both of these are application allow listing solutions from Microsoft. We can check AppLocker Policy using:
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollectionsccWe find that everyone can run scripts from Program Files directory.
We can disable Defender and run any script in ProgramFiles.
We cannot use dot sourcing because of CLM, so we use Invoke-MimiEx.ps1 which adds "Invoke-Mimi -Command sekurlsa::ekeys" at the end of the Invoke-Mimi.ps1 file.
From student machine, we copy Invoke-MimiEx.ps1 to dcorp-adminsrv's ProgramFiles.
AMSI Bypass
First disable Enhanced Script Block Logging so that AMSI is not logged.
Then run the below command to bypass AMSI
NetLoader
Download and xcopy.
Port Forward Localhost:80 to Attacker Machine
Running SafetyKatz.bat
Use Loader without Encoding
Use Loader after Encoding (Safety.bat)
Encode SafetyKatz arguments using Argsplit.bat
Include Argsplit output in Safety.bat
Download & Execute SafetyKatz.exe in-memory
PowerShell Remoting
Check if we can run cmds on dcorp-mgmt using PSRemoting
Use Invoke-Mimi to dump hashes of domain admin svcadmin:
Disable AMSI using Set-MpPreference
Run Invoke-Mimi and get hashes
Last updated