- 浏览: 278674 次
文章分类
- 全部博客 (276)
- burp+hydra暴力破解 (1)
- kali linux工具集 (6)
- kali (59)
- linux (54)
- password (14)
- web (63)
- 渗透测试 (50)
- windows (40)
- metasploit (9)
- 信息收集 (32)
- burp suit (4)
- 安全审计 (9)
- https://github.com/secretsquirrel/the-backdoor-factory (0)
- nmap (4)
- arachni (2)
- 工具 (5)
- sql (3)
- 网络 (2)
- 后渗透测试 (10)
- 内网 (5)
- 无线 (2)
- C (3)
- bios (1)
- RoR (12)
- mongodb (1)
- linxu (1)
- gdb (1)
- linux,虚拟化 (1)
- python (4)
最新评论
原文地址:http://jumpespjump.blogspot.com/2015/03/thousand-ways-to-backdoor-windows.html
When the Kerberos elevation of privilege (CVE-2014-6324 / MS14-068) vulnerability has been made public, the remediation paragraph of following blog post made some waves:
http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx
"The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of the domain."
Personally, I agree with this, but .... But whether this is the real solution, I'm not sure. And the same applies to compromised computers. When it has been identified that malware was able to run on the computer (e.g. scheduled scan found the malware), there is no easy way to determine with 100% certainty that there is no rootkit on the computer. Thus rebuilding the computer might be a good thing to consider. For paranoids, use a new hardware ;)
But rebuilding a single workstation and rebuilding a whole domain is not on the same complexity level. Rebuilding a domain can take weeks or months (or years, which will never happen, as the business will close before that).
There are countless of documented methods to backdoor a computer, but I have never seen a post where someone collects all the methods to backdoor a domain. In the following, I will refer to domain admin, but in reality, I mean Domain Admins, Enterprise Admins, and Schema Admins.
Ways to backdoor a domain
So here you go, a incomplete list to backdoor a domain:
Create a new domain admin user. Easy to do, easy to detect, easy to remediate
Dump password hashes. The attacker can either crack those, or just pass-the-hash. Since KB2871997, pass-the-hash might be trickier (https://technet.microsoft.com/library/security/2871997), but not impossible. Easy to do, hard to detect, hard to remediate - just think about service user passwords. And during remediation, consider all passwords compromised, even strong ones.
Logon scripts - modify the logon scripts and add something malicious in it. Almost anything detailed in this post can be added
Use an already available account, and add domain admin privileges to that. Reset it's password. Mess with current group memberships - e.g. http://www.exploit-db.com/papers/17167/
Backdoor any workstation where domain admins log in. While remediating workstations, don't forget to clean the roaming profile. The type of the backdoor can use different forms: malware, local admin, password (hidden admin with 500 RID), sticky keys, etc.
Backdoor any domain controller server. For advanced attacks, see Skeleton keys(Skeleton keys: http://adsecurity.org/?p=1255)
Backdoor files on network shares which are commonly used by domain admins by adding malware to commonly used executables - Backdoor factory(Backdoor factory: https://github.com/secretsquirrel/the-backdoor-factory)
Change ownership/permissions on AD partitions - if you have particular details on how to do this specifically, please comment
Create a new domain user. Hide admin privileges with SID history. Easy to do, hard to detect, easy to remediate - check Mimikatz(Mimikatz:https://github.com/gentilkiwi/mimikatz) experimental for addsid
Golden tickets(http://rycon.hu/papers/goldenticket.html) - easy to do, hard to detect, medium remediation
Silver tickets(http://www.beneaththewaves.net/Projects/Mimikatz_20_-_Silver_Ticket_Walkthrough.html) - easy to do, hard to detect, medium/hard remediation
Backdoor workstations/servers via group policy
HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ RunOnce,
scheduled tasks (run task 2 years later),
sticky-keys with debug(http://www.labofapenetrationtester.com/2012/05/fun-with-sticky-keys-utilman-and.html)
Backdoor patch management tool, see slides here
Other tricks
The following list does not fit in the previous "instant admin" tips, but still, it can make the attackers life easier if their primary foothold has been disabled:
Backdoor recent backups - and when backdoor is needed, destroy the files, so the files will be restored from the backdoored backup
Backdoor the Exchange server - get a copy of emails
Backdoor workstation/server golden image
Change permission of logon scripts to allow modification later
Place malicious symlinks to file shares, collect hashes via SMB auth tries on specified IP address, grab password hashes later
Backdoor remote admin management e.g. HP iLO - e.g. create new user, or steal current password
Backdoor files e.g. on shares to use in SMB relay
Backdoor source code of in-house-developed software
Use any type of sniffed or reused passwords in new attacks, e.g. network admin, firewall admin, VPN admin, AV admin, etc.
Change the content of the proxy pac file (change browser configuration if necessary), include special exception(s) for a chosen domain(s) to use proxy on malicious IP. Redirect the traffic, enforce authentication, grab password hashes, ???, profit.
Create high privileged users in applications running with high privileges, e.g. MSSQL, Tomcat, and own the machine, impersonate users, grab their credentials, etc. The typical pentest path made easy.
Remove patches from servers, change patch policy not to install those patches.
Steal Windows root/intermediate CA keys
Weaken AD security by changing group policy (e.g. re-enabling LM-hashes)
Forensics
If you have been choosen to remediate a network where attackers gained domain admin privileges, well, you have a lot of things to look for
I can recommend two tools which can help you during your investigation:
AD explorer tool to diff AD
NTDS forensics
BTAhttps://bitbucket.org/iwseclabs/bta (thx to Sn0rkY)
Lessons learned
But guess what, not all of these problems are solved by rebuilding the AD. One have to rebuild all the computers from scratch as well. Which seems quite impossible. When someone is creating a new AD, it is impossible not to migrate some configuration/data/files from the old domain. And whenever this happens, there is a risk that the new AD will be backdoored as well.
Ok, we are doomed, but what can we do? I recommend proper log analysis, analyse trends, and detect strange patterns in your network. Better spend money on these, than on the domain rebuild. And when you find something, do a proper incident response. And good luck!
When the Kerberos elevation of privilege (CVE-2014-6324 / MS14-068) vulnerability has been made public, the remediation paragraph of following blog post made some waves:
http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx
"The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of the domain."
Personally, I agree with this, but .... But whether this is the real solution, I'm not sure. And the same applies to compromised computers. When it has been identified that malware was able to run on the computer (e.g. scheduled scan found the malware), there is no easy way to determine with 100% certainty that there is no rootkit on the computer. Thus rebuilding the computer might be a good thing to consider. For paranoids, use a new hardware ;)
But rebuilding a single workstation and rebuilding a whole domain is not on the same complexity level. Rebuilding a domain can take weeks or months (or years, which will never happen, as the business will close before that).
There are countless of documented methods to backdoor a computer, but I have never seen a post where someone collects all the methods to backdoor a domain. In the following, I will refer to domain admin, but in reality, I mean Domain Admins, Enterprise Admins, and Schema Admins.
Ways to backdoor a domain
So here you go, a incomplete list to backdoor a domain:
Create a new domain admin user. Easy to do, easy to detect, easy to remediate
Dump password hashes. The attacker can either crack those, or just pass-the-hash. Since KB2871997, pass-the-hash might be trickier (https://technet.microsoft.com/library/security/2871997), but not impossible. Easy to do, hard to detect, hard to remediate - just think about service user passwords. And during remediation, consider all passwords compromised, even strong ones.
Logon scripts - modify the logon scripts and add something malicious in it. Almost anything detailed in this post can be added
Use an already available account, and add domain admin privileges to that. Reset it's password. Mess with current group memberships - e.g. http://www.exploit-db.com/papers/17167/
Backdoor any workstation where domain admins log in. While remediating workstations, don't forget to clean the roaming profile. The type of the backdoor can use different forms: malware, local admin, password (hidden admin with 500 RID), sticky keys, etc.
Backdoor any domain controller server. For advanced attacks, see Skeleton keys(Skeleton keys: http://adsecurity.org/?p=1255)
Backdoor files on network shares which are commonly used by domain admins by adding malware to commonly used executables - Backdoor factory(Backdoor factory: https://github.com/secretsquirrel/the-backdoor-factory)
Change ownership/permissions on AD partitions - if you have particular details on how to do this specifically, please comment
Create a new domain user. Hide admin privileges with SID history. Easy to do, hard to detect, easy to remediate - check Mimikatz(Mimikatz:https://github.com/gentilkiwi/mimikatz) experimental for addsid
Golden tickets(http://rycon.hu/papers/goldenticket.html) - easy to do, hard to detect, medium remediation
Silver tickets(http://www.beneaththewaves.net/Projects/Mimikatz_20_-_Silver_Ticket_Walkthrough.html) - easy to do, hard to detect, medium/hard remediation
Backdoor workstations/servers via group policy
HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ RunOnce,
scheduled tasks (run task 2 years later),
sticky-keys with debug(http://www.labofapenetrationtester.com/2012/05/fun-with-sticky-keys-utilman-and.html)
Backdoor patch management tool, see slides here
Other tricks
The following list does not fit in the previous "instant admin" tips, but still, it can make the attackers life easier if their primary foothold has been disabled:
Backdoor recent backups - and when backdoor is needed, destroy the files, so the files will be restored from the backdoored backup
Backdoor the Exchange server - get a copy of emails
Backdoor workstation/server golden image
Change permission of logon scripts to allow modification later
Place malicious symlinks to file shares, collect hashes via SMB auth tries on specified IP address, grab password hashes later
Backdoor remote admin management e.g. HP iLO - e.g. create new user, or steal current password
Backdoor files e.g. on shares to use in SMB relay
Backdoor source code of in-house-developed software
Use any type of sniffed or reused passwords in new attacks, e.g. network admin, firewall admin, VPN admin, AV admin, etc.
Change the content of the proxy pac file (change browser configuration if necessary), include special exception(s) for a chosen domain(s) to use proxy on malicious IP. Redirect the traffic, enforce authentication, grab password hashes, ???, profit.
Create high privileged users in applications running with high privileges, e.g. MSSQL, Tomcat, and own the machine, impersonate users, grab their credentials, etc. The typical pentest path made easy.
Remove patches from servers, change patch policy not to install those patches.
Steal Windows root/intermediate CA keys
Weaken AD security by changing group policy (e.g. re-enabling LM-hashes)
Forensics
If you have been choosen to remediate a network where attackers gained domain admin privileges, well, you have a lot of things to look for
I can recommend two tools which can help you during your investigation:
AD explorer tool to diff AD
NTDS forensics
BTAhttps://bitbucket.org/iwseclabs/bta (thx to Sn0rkY)
Lessons learned
But guess what, not all of these problems are solved by rebuilding the AD. One have to rebuild all the computers from scratch as well. Which seems quite impossible. When someone is creating a new AD, it is impossible not to migrate some configuration/data/files from the old domain. And whenever this happens, there is a risk that the new AD will be backdoored as well.
Ok, we are doomed, but what can we do? I recommend proper log analysis, analyse trends, and detect strange patterns in your network. Better spend money on these, than on the domain rebuild. And when you find something, do a proper incident response. And good luck!
发表评论
-
[图] windows 10
2015-08-18 20:37 284网上下载的图片,忘了来源 -
windows提权集合
2015-06-30 00:23 541https://blog.netspi.com/5-ways- ... -
[转]Access to every PC and become local Admin
2015-06-29 21:50 509原文地址:http://www.gosecure.it/blo ... -
[转]Top Five Ways SpiderLabs Got Domain Admin on Your Internal Network
2015-06-29 21:46 1476原文地址:https://www.trustwave.com/ ... -
[转]如何获得window管理员权限
2015-06-29 21:21 448引用A tutorial on how to get into ... -
Window提权基本步骤
2015-06-03 22:00 754原文地址: http://www.fuzzysecurity. ... -
[转]malware persistence
2015-05-06 23:46 384原文地址:http://jumpespjump.blogspo ... -
[译]解密MSSQL密码
2015-03-26 00:43 2821原文地址: https://blog.ne ... -
[转]badsamba
2015-03-20 00:55 301原文地址:http://blog.gdssecurity.co ... -
window增加硬盘性能方法
2015-02-05 01:03 337参考地址:http://way2h.blogspot.com/ ... -
[译]Skeleton Key Malware & Mimikatz
2015-01-28 20:29 771原文地址: http://adsecurity.org/?p= ... -
绕过PowerShell执行策略的15种方法
2015-01-28 02:27 847https://blog.netspi.com/15-ways ... -
[译]Veil-Pillage
2015-01-23 03:09 800原文地址:http://resources.infosecin ... -
[翻译]oledump: Extracting Embedded EXE From DOC
2015-01-04 22:40 915原文地址:http://blog.didierstevens. ... -
[工具]volatility----Windows内存取证
2015-01-04 22:01 1518下载地址:https://github.com/volatil ... -
[译]Windows提权:ahcache.sys/NtApphelpCacheControl
2015-01-03 21:12 1006原文地址:https://code.google.com/p/ ... -
[译]使用Volatility从memory dump获得密码
2014-12-30 12:27 3740原文地址:https://cyberarms.wordpres ... -
vmss2core将VMware镜像转换成memory dump
2014-12-26 23:59 0参考:http://kb.vmware.com/selfser ... -
Windows工具集
2014-12-25 00:54 502参考:https://community.rapid7.com ... -
Kerberos攻击
2014-12-18 01:39 595参考: 1. http://securityweekly.co ...
相关推荐
backdoor后门backdoor后门
A PoC backdoor that uses Gmail as a C&C server
php backdoor, very good to use
rootkit,backdoor,系统调用劫持,ps进程隐藏,ls文件隐藏,代码
backdoor_for_windows -您需要linux和Windows机器来执行此操作 在“ sock.bind(your_ip,your_port)”上为您自己的IP和端口号编辑server.py。 在“ s.connect(your_ip,your_port)”上为您自己的IP和端口号...
delphi Backdoor.Metarage
Backdoor.Win32.Delf.aws 病毒样本。
ident_backdoor
account_backdoor
【病毒名称】:Backdoor.Win32.Hupigon.dsx 【病毒类型】:后门 【危害程度】:中 【传播方式】:网络 【受影响系统】:windows 98以上 病毒行为: 病毒运行后,首先修改该系统时间,致使一些杀软安软因系统时间不符...
[Paper] Exploring Backdoor Attacks on Deep Reinforcement Learning-based Traffic Congestion Control Systems
生产使用的Linux.BackDoor.Gates.5木马处理文档!
Backdoor-CTF-Crypto-400.rar
工具介绍-the-backdoor-factory(第九课).docx
Diffie-Hellman_Backdoor, 如何后门 Diffie Hellman 如何后门 diffie白皮书:白皮书是在ePrint上。这里 repo 包含关于如何后门 diffie hellman的研究:backdoor_generator/ 包含为 diffie hellman后门生成和导出参数...
大马文件
backdoor-pyc, 带代码的修补程序文件 相当 lame 后门沉淀物用恶意代码文件替换pmbus文件。更改日志#### 11/10/2015不再向tmp写入,直接编辑pyc文件Bug 修复以前的工作https://www.virusbtn.com/virusbulletin
The Backdoor Factory是一款安全测试工具,可以轻松的生成win32PE后门测试程序,ELF文件后门程序等。本工具仅用于安全实验和信息安全实验教学使用,禁止任何非法用途!
ident_backdoor2
TGA_Backdoor_3.0汉化版TGA_Backdoor_3.0汉化版