sh4hin

Certifried combined with KrbRelayUp

Certifried (CVE-2022-26923) gives Domain Admin from non-privileged user with the requirement adding computer accounts or owning a computer account. Kerberos Relay targeting LDAP and Shadow Credentials gives a non-privileged domain user on a domain-joined machine local admin access on (aka owning) the machine. Combination of these two: non-privileged domain user escalating to Domain Admin without the requirement adding/owning computer accounts.

The attack below uses only Windows (no Linux tools interacting with the Domain), simulating a real-world attack scenario.

Prerequisites:

docker-in-an-hour

Welcome to docker-in-an-hour! This is a "JIT" for docker, with many explanations being just enough to defend yourself. It is highly recommended that you go and at least Google some of the stuff here after doing the workshop. Read the official docs with real explanations.

ID	Name	MitigatedByAppControl	Notes
T1001	Data Obfuscation	Not Applicable	Relevant sub-techniques addressed below
T1001.001	Junk Data	No	Technique is not necessarily related to the execution of arbitrary code on an endpoint.
T1001.002	Steganography	Limited	If custom attacker code were necessary to perform this technique, it would be prevented.
T1001.003	Protocol Impersonation	Limited	If custom attacker code were necessary to perform this technique, it would be prevented.
T1003	OS Credential Dumping	Not Applicable	Relevant sub-techniques addressed below
T1003.001	LSASS Memory	Limited	Built-in utilities exist to perform this technique. They would have to be explicitly blocked.
T1003.002	Security Account Manager	Limited	Built-in utilities exist to perform this technique. They would have to be explicitly blocked.
T1003.003	NTDS	Limited	Built-in utilities exist to perform this technique. They would have to be explicitly blocked.
T1003.004	LSA Secrets	Limited	Built-in utilities exist to perform this technique.

	import nimcrypto
	import winim/clr except `[]` # https://s3cur3th1ssh1t.github.io/Playing-with-OffensiveNim/ <-- thank you so much, 2 hours googling I almost went crazy

	#[
	All credit goes to @byt3bl33d3r (OffensiveNim) and @s3cur3th1ssh1t

	nimble install winim nimcrypto zippy
	nim c -d:danger -d:strip --opt:size rsrcDecryptAssembly.nim

	slurp = "staticRead" will read the file and store it in the variable (.rdata) on compile time.

	Add-Type -OutputAssembly hello.exe -TypeDefinition @'
	using System;

	public class Hello {
	public static void Main(string[] Args) {
	System.Console.WriteLine("Hello, world!");
	System.Console.Read();
	}
	}
	'@

	; x96 shellcode (x32+x64) by [email protected]
	; yasm -f bin -o x96shell_msgbox x96shell_msgbox.asm
	section .text
	bits 32
	_main:
	call entry
	entry:
	mov ax, cs
	sub ax, 0x23
	jz retTo32b

	#!/usr/bin/env python3

	import re
	import sys
	import base64
	from hashlib import sha256
	from binascii import hexlify, unhexlify
	from Crypto.Cipher import AES
	from xml.dom import minidom
	from pprint import pprint

	using System;
	using System.Collections.Generic;
	using System.Runtime.InteropServices;
	using System.Text;

	namespace Hollowing
	{
	public class Loader
	{
	public static byte[] target_ = Encoding.ASCII.GetBytes("calc.exe");

	#include <string.h>
	#include <stdio.h>
	#include <windows.h>
	#include <psapi.h>
	#include "beacon.h"


	DECLSPEC_IMPORT BOOL WINAPI KERNEL32$K32EnumProcesses(DWORD *, DWORD, LPDWORD);
	DECLSPEC_IMPORT WINBASEAPI HANDLE WINAPI KERNEL32$OpenProcess(DWORD, BOOL, DWORD);
	DECLSPEC_IMPORT BOOL WINAPI KERNEL32$K32EnumProcessModulesEx(HANDLE, HMODULE*, DWORD, LPDWORD, DWORD);

	using System;
	using System.Diagnostics;
	using System.IO;
	using System.Runtime.InteropServices;

	namespace DinjectorWithQUserAPC
	{


	public class Program

sh4hin

Certifried combined with KrbRelayUp

docker-in-an-hour

toc