Duane Michael subat0mik

Encrypting Strings at Compile Time

Thank you to SpecterOps for supporting this research and to Duane and Matt for proofreading and editing! Crossposted on the SpecterOps Blog.

TLDR: You may use this header file for reliable compile time string encryption without needing any additional dependencies.

Programmers of DRM software, security products, or other sensitive code bases are commonly required to minimize the amount of human readable strings in binary output files. The goal of the minimization is to hinder others from reverse engineering their proprietary technology.

Common approaches that are taken to meet this requirement often add an additional maintenance burden to the developer and are prone to error. These approaches will be presented along with t

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

	#!/usr/bin/env python
	####################
	#
	# Copyright (c) 2022 Dirk-jan Mollema (@_dirkjan)
	#
	# Permission is hereby granted, free of charge, to any person obtaining a copy
	# of this software and associated documentation files (the "Software"), to deal
	# in the Software without restriction, including without limitation the rights
	# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	# copies of the Software, and to permit persons to whom the Software is

	// Twitter thread: https://twitter.com/_xpn_/status/1543682652066258946 (was a bit bored ;)
	// Needs to be run on the SCCM server containing the "Microsoft Systems Management Server" CSP for it to work.

	using System;
	using System.Collections.Generic;
	using System.Runtime.InteropServices;

	namespace SCCMDecryptPOC
	{
	internal class Program

	/*
	* Research by Evan McBroom and Chris Thompson (@_Mayyhem)
	* Roger Zander made security recommendations for SCCM based on the claim that NAA credentials could be recovered.
	* Source: https://rzander.azurewebsites.net/network-access-accounts-are-evil/
	* Roger stated that recover was "possible with a few lines of code" but did not provide any code. Here is working code.
	*/

	#include <Windows.h>
	#include <stdio.h>

	using System.Runtime.InteropServices;
	using System;

	/*
	* Simple C# PoC to enable WebClient Service Programmatically
	* Based on the C++ version from @tirannido (James Forshaw)
	* Twitter: https://twitter.com/tiraniddo
	* URL: https://www.tiraniddo.dev/2015/03/starting-webclient-service.html
	*
	* Compile with:

	#!/usr/bin/env python3

	"""
	# NOTE, you must change the string below for data you want.
	# This script does not take arguments in its current form. Sorry!
	"""

	from pwn import *

	string = b"foobar"

	#!/usr/bin/env python3

	"""
	# NOTE, you must change the filename below for the rp++ output you want to process.
	# This script does not take arguments in its current form. Sorry!
	"""

	import re

	from pwn import p32, u32

	0: kd> dt -b nt!_IRP
	+0x000 Type : Int2B
	+0x002 Size : Uint2B
	+0x004 AllocationProcessorNumber : Uint2B
	+0x006 Reserved : Uint2B
	+0x008 MdlAddress : Ptr64
	+0x010 Flags : Uint4B
	+0x018 AssociatedIrp : <anonymous-tag>
	+0x000 MasterIrp : Ptr64
	+0x000 IrpCount : Int4B