techris techris45

Detecting RMM

ℹ️ This was duplicated to this blog for readability and reference

The most difficult challenge with RMM detection is contextual awareness around usage to determine if it is valid or malicious.

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

	{
	"name": "Integration Raindrop.io, OpenAI (ChatGPT, Whisper, DALL-E)",
	"flow": [
	{
	"id": 1,
	"module": "raindrop-io:watchBookmarks",
	"version": 1,
	"parameters": {
	"__IMTCONN__": 2363503,
	"collection": {

	/*
	TaskManagerSecret

	Author: @splinter_code

	This is a very ugly POC for a very unreliable UAC bypass through some UI hacks.
	The core of this hack is stealing and using a token containing the UIAccess flag set.
	A trick described by James Forshaw, so all credits to him --> https://www.tiraniddo.dev/2019/02/accessing-access-tokens-for-uiaccess.html
	From there it uses a task manager "feature" to run a new High IL cmd.exe.
	This has been developed only for fun and shouldn't be used due to its high unreliability.

	#!/usr/bin/python3

	# From DOS commandline, run this as follows:-
	# python3 ejectusb.py
	# -or- create C:\windows\ejectusb.bat to do the above in fewer characters.
	#
	# From WSL bash, run it as follows:-
	# cmd.exe /c start python3 C:\\windows\\ejectusb.py
	# -or- create /usr/local/bin/ejectusb to do the above in fewer characters.

	#!/bin/bash

	# Step 1: Obtain a list of our personal hosts.
	# Export from Bitwarden, LastPass, 1Password, or similar:

	my_passwords.txt

	# Next commands will assume the LastPass export format, which is CSV with the URL in the first field:
	# url,username,password,[... more fields]

	#!/usr/bin/env python3
	# v.0.3 \| twitter.com/si9int
	import requests, sys
	from bs4 import BeautifulSoup as bs

	domain = sys.argv[1]
	subdomains = []

	def get_csrf_params():
	csrf_params = {}

	FROM golang:1.12 as build

	WORKDIR $GOPATH/src/github.com/Irio/wohnung
	COPY scraper scraper
	COPY main.go .

	RUN go get -d -v ./...
	RUN go install

	FROM gcr.io/distroless/base

	https://github.com/search?q=BROWSER_STACK_ACCESS_KEY= OR BROWSER_STACK_USERNAME= OR browserConnectionEnabled= OR BROWSERSTACK_ACCESS_KEY=&s=indexed&type=Code
	https://github.com/search?q=CHROME_CLIENT_SECRET= OR CHROME_EXTENSION_ID= OR CHROME_REFRESH_TOKEN= OR CI_DEPLOY_PASSWORD= OR CI_DEPLOY_USER=&s=indexed&type=Code
	https://github.com/search?q=CLOUDAMQP_URL= OR CLOUDANT_APPLIANCE_DATABASE= OR CLOUDANT_ARCHIVED_DATABASE= OR CLOUDANT_AUDITED_DATABASE=&s=indexed&type=Code
	https://github.com/search?q=CLOUDANT_ORDER_DATABASE= OR CLOUDANT_PARSED_DATABASE= OR CLOUDANT_PASSWORD= OR CLOUDANT_PROCESSED_DATABASE=&s=indexed&type=Code
	https://github.com/search?q=CONTENTFUL_PHP_MANAGEMENT_TEST_TOKEN= OR CONTENTFUL_TEST_ORG_CMA_TOKEN= OR CONTENTFUL_V2_ACCESS_TOKEN=&s=indexed&type=Code
	https://github.com/search?q=-DSELION_BROWSER_RUN_HEADLESS= OR -DSELION_DOWNLOAD_DEPENDENCIES= OR -DSELION_SELENIUM_RUN_LOCALLY=&s=indexed&type=Code
	https://github.com/search?q=ELASTICSEARCH_PASSWORD= OR ELASTICSEARCH_USERNAME= OR EMAIL_NOTIFI