wget mirror

wget
  --directory-prefix=/root/Desktop/
  --header="Accept: text/html"
  --user-agent="(Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
  --domains test.com
  -e robots=off
  --recursive
  --no-clobber
  --page-requisites
  --html-extension
  --convert-links
  -R gif,jpg,png,css,pdf,mp3,wmv 

http://<domain>.com

New CTF images

Still catching up on things after taking a vacation with the family.

One of these things is the latest additions to vulnhub.
Quite a few of these to post today.
Let;s get started.

Tr0ll: 3
https://www.vulnhub.com/entry/tr0ll_3,340/
beginner++ it says in the description

The whole series can be see here now:
https://www.vulnhub.com/series/tr0ll,49/

WMI Commands

• Get-WmiObject -class Win32_Product
  • Gets a listing of all the installed software on a machine.
• Get-WmiObject - class Win32_Account
  • Gets a listing of all the user accounts
• Get-WmiObject - class Win32_BIOS
  
  • Many times used by malware to determine if the host is a virtual machine or not.
• Set up a remote windows command
  • $command =  "ipconfig /all >> c:\users\all users\desktop\results.txt"
  • $cmd = "cmd.exe /c $command"
  • Invoke-Method -class Win32_Process -name Create -ArgumentList $cmd -ComputerName \\Desktopname\
• wmic /node:172.16.27.38 process call create "cmd.exe /c /net user dude /add"
• uses WMIC to add a user on a remote machine

Powershell Fun

•  Link Ref
  
• Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList cmd.exe 
• Invoke-CimMethod -ClassName Win32_Process -MethodName create -Arguments @{commandline="notepad.exe"}
  

 

One Attack Example

1. From a powershell command prompt, attacker launches WMIC with the intent of creating a process on the remote machine and adding a user to that remote machine.
   1. wmic /node:172.16.27.38 process call create "cmd.exe /c /net user dude /add"
2. On the remote machine wmiprvse.exe gets the call and will run the commands. To find this attack in Carbon Black, check out this search:
   1. process_name:cmd.exe AND parent_name:wmiprvse.exe AND childproc_name:net.exe cmdline:user
   2. Event IDs on the remote machine are:
      1. 4720; 4722; 4738; 4732
       
      

Authenticated WMI Exec Via Powershell

https://packetstormsecurity.com/files/139762/Authenticated-WMI-Exec-Via-Powershell.html

This Metasploit module uses WMI execution to launch a payload instance on a remote machine. In order to avoid AV detection, all execution is performed in memory via psh-net encoded payload. Persistence option can be set to keep the payload looping while a handler is present to receive it. By default the module runs as the current process owner. The module can be configured with credentials for the remote host with which to launch the process.

3 new VMs to test with

https://www.vulnhub.com/entry/readme_1,336/

https://www.vulnhub.com/entry/jigsaw_2,337/

https://www.vulnhub.com/entry/sunset_1,339/

fierce

Basic running of the program:
./fierce.pl -dns <domain>

Search all class C ranges found for PTR records that match the domain
./fierce.pl -wide -dns <company>

Some reverse DNS looking
./fierce.pl  -dnsserver <target_dns> -range <ipNet_range>


Some other flags:
-search -- search list. When fierce attempts to traverse up and down ipspace it may encounter other servers within other domains that may belong to the same company. If you supply a comma delimited list to fierce it will report anything found.

-threads <number> -- The number of threads to use when running the scan.

-wordlist <list.txt> -- Use an alternate word list to the default one for the application.

-file <filename.out> -- write the results of the scan to the file specified in the cmdline.

-delay <number> -- This specifies a delay, in seconds, to wait between queries.

symfonos: 3

https://www.vulnhub.com/entry/symfonos_3,332/

MinU: v2

https://www.vulnhub.com/entry/minu_v2,333/

A Collection of Fun WMI Things

Playing with MOF files on Windows, for fun & profit
http://poppopret.blogspot.com/2011/09/playing-with-mof-files-on-windows-for.html
"""
What is really interesting with WMI is that it permits to execute some code when the notification of an event occurs. The event might be a program start, an user authentication, ... or any other Windows event. A MOF file needs to be registered into the CIM/WMI repository in order to be taken into account by WMI. When registering a MOF file, the CIM class(es) it describes are indeed added into the repository.
"""
MOF files are compiled into the WMI repository using mofcomp.exe. Moreover, a MOF file that is put in the %SystemRoot%\System32\wbem\mof\ directory is automatically compiled and registered into the WMI repository. It is defined in the registry key HKLM\SOFTWARE\Microsoft\WBEM\CIMOM\.
"""

https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor.pdf

https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf

https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html

https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf

https://files.sans.org/summit/Digital_Forensics_and_Incident_Response_Summit_2015/PDFs/TheresSomethingAboutWMIDevonKerr.pdf

https://www.youtube.com/watch?v=Ldzr0bfGtHc

Koadic

Choose your stager.
    regsrvr and mshta seem to work well.
   
After you have a zombie, run other toys
    implant/elevate/bypassuac_
        set payload to 0 on this
   
    Once you have an admin session you can dump the hashes:
        implant/gather/hashdump_sam
       
    You can scan the internal network:
        implant/scan/tcp

Mimikatz works well for me, as long as you have an admin session. You can tell that buy running zombies by itself. Under the ID column, if it has an asterisk (*) that means admin session.


Binary files are stored here: /pentest/post-exploitation/koadic/data/bin
Note: I installed my version through the PTF tool by Dave K.

Nice collection of things

interesting collection of things to use/ do during your tests. This post is more of a placeholder for me to find it later.

Explain 'getsystem'

https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/

https://www.offensive-security.com/metasploit-unleashed/privilege-escalation/

http://carnal0wnage.attackresearch.com/2010/01/metasploit-getsystem-command.html?m=1

http://www.khromozome.com/windows-privilege-escalation-bypassuac/

https://www.redspin.com/it-security-blog/2010/02/getsystem-privilege-escalation-via-metasploit/

ICMP shells

ICMP Shell Fun https://www.commonexploits.com/icmp-shell-fun/

AV0id – Anti-Virus Bypass Metasploit Payload Generator Script

https://www.commonexploits.com/av0id-anti-virus-bypass-metasploit-payload-generator-script/

Microsoft AD hacking tricks

Sneaky Persistence Active Directory Trick #18: Dropping SPNs on Admin Accounts for Later Kerberoasting https://adsecurity.org/?p=3466

Microsoft Office Word Malicious Macro Execution

https://packetstormsecurity.com/files/140972/office_word_macro.rb.txt