Total Pageviews

Sunday, 30 August 2020

Thousand Ways To Backdoor A Windows Domain (Forest)

When the Kerberos elevation of privilege (CVE-2014-6324 / MS14-068) vulnerability has been made public, the remediation paragraph of the following blog post made some waves:
http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx

"The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of the domain."

Personally, I agree with this, but .... But whether this is the real solution, I'm not sure. And the same applies to compromised computers. When it has been identified that malware was able to run on the computer (e.g. scheduled scan found the malware), there is no easy way to determine with 100% certainty that there is no rootkit on the computer. Thus rebuilding the computer might be a good thing to consider. For paranoids, use new hardware ;)

But rebuilding a single workstation and rebuilding a whole domain is not on the same complexity level. Rebuilding a domain can take weeks or months (or years, which will never happen, as the business will close before that).

There are countless documented methods to backdoor a computer, but I have never seen a post where someone collects all the methods to backdoor a domain. In the following, I will refer to domain admin, but in reality, I mean Domain Admins, Enterprise Admins, and Schema Admins.


Ways to backdoor a domain

So here you go, an incomplete list to backdoor a domain:

  • Create a new domain admin user. Easy to do, easy to detect, easy to remediate
  • Dump password hashes. The attacker can either crack those or just pass-the-hash. Since KB2871997, pass-the-hash might be trickier (https://technet.microsoft.com/library/security/2871997), but not impossible. Easy to do, hard to detect, hard to remediate - just think about service user passwords. And during remediation, consider all passwords compromised, even strong ones.
  • Logon scripts - modify the logon scripts and add something malicious in it. Almost anything detailed in this post can be added :D
  • Use an already available account, and add domain admin privileges to that. Reset its password. Mess with current group memberships - e.g. http://www.exploit-db.com/papers/17167/
  • Backdoor any workstation where domain admins login. While remediating workstations, don't forget to clean the roaming profile. The type of backdoor can use different forms: malware, local admin, password (hidden admin with 500 RID), sticky keys, etc.
  • Backdoor any domain controller server. For advanced attacks, see Skeleton keys 
  • Backdoor files on network shares which are commonly used by domain admins by adding malware to commonly used executables - Backdoor factory
  • Change ownership/permissions on AD partitions - if you have particular details on how to do this specifically, please comment
  • Create a new domain user. Hide admin privileges with SID history. Easy to do, hard to detect, easy to remediate - check Mimikatz experimental for addsid
  • Golden tickets - easy to do, hard to detect, medium remediation
  • Silver tickets - easy to do, hard to detect, medium/hard remediation
  • Backdoor workstations/servers via group policy
    • HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ RunOnce,
    • scheduled tasks (run task 2 years later),
    • sticky-keys with debug
  • Backdoor patch management tool, see slides here
[Update 2017.01.10]


Other tricks

The following list does not fit in the previous "instant admin" tips, but still, it can make the attackers life easier if their primary foothold has been disabled:

  • Backdoor recent backups - and when the backdoor is needed, destroy the files, so the files will be restored from the backdoored backup
  • Backdoor the Exchange server - get a copy of emails
  • Backdoor workstation/server golden image
  • Change permission of logon scripts to allow modification later
  • Place malicious symlinks to file shares, collect hashes via SMB auth tries on specified IP address, grab password hashes later
  • Backdoor remote admin management e.g. HP iLO - e.g. create new user or steal current password
  • Backdoor files e.g. on shares to use in SMB relay
  • Backdoor source code of in-house-developed software
  • Use any type of sniffed or reused passwords in new attacks, e.g. network admin, firewall admin, VPN admin, AV admin, etc.
  • Change the content of the proxy pac file (change browser configuration if necessary), including special exception(s) for a chosen domain(s)  to use proxy on malicious IP. Redirect the traffic, enforce authentication, grab password hashes, ???, profit.
  • Create high privileged users in applications running with high privileges, e.g. MSSQL, Tomcat, and own the machine, impersonate users, grab their credentials, etc. The typical pentest path made easy.
  • Remove patches from servers, change patch policy not to install those patches.
  • Steal Windows root/intermediate CA keys
  • Weaken AD security by changing group policy (e.g. re-enabling LM-hashes)
Update [2015-09-27]: I found this great presentation from Jakob Heidelberg. It mentions (at least) the following techniques, it is worth to check these:
  • Microsoft Local Administrator Password Solution
  • Enroll virtual smart card certificates for domain admins

Forensics

If you have been chosen to remediate a network where attackers gained domain admin privileges, well, you have a lot of things to look for :)

I can recommend two tools which can help you during your investigation:

Lessons learned

But guess what, not all of these problems are solved by rebuilding the AD. One has to rebuild all the computers from scratch as well. Which seems quite impossible. When someone is creating a new AD, it is impossible not to migrate some configuration/data/files from the old domain. And whenever this happens, there is a risk that the new AD will be backdoored as well.

Ok, we are doomed, but what can we do? I recommend proper log analysis, analyze trends, and detect strange patterns in your network. Better spend money on these, than on the domain rebuild. And when you find something, do a proper incident response. And good luck!

Ps: Thanks to Andrew, EQ, and Tileo for adding new ideas to this post.

Check out the host backdooring post as well! :)

More info


  1. Hacking Tools Name
  2. Hack Tools For Games
  3. Best Pentesting Tools 2018
  4. New Hacker Tools
  5. Hackers Toolbox
  6. Hack Apps
  7. What Is Hacking Tools
  8. Hacking Tools For Windows
  9. Hacker Tools Free Download
  10. Hacking Tools For Kali Linux
  11. Github Hacking Tools
  12. Hacking Tools For Mac
  13. Physical Pentest Tools
  14. Hacker Tools Apk Download
  15. Hacking Tools 2019
  16. New Hacker Tools
  17. Hack Tools Github
  18. Hacking Apps
  19. Best Hacking Tools 2020
  20. Pentest Tools Linux
  21. Best Hacking Tools 2020
  22. Ethical Hacker Tools
  23. Nsa Hack Tools Download
  24. Hacking Tools And Software
  25. Hacking Apps
  26. Ethical Hacker Tools
  27. Hack Tools Github
  28. Computer Hacker
  29. Hacker Tools Linux
  30. Tools Used For Hacking
  31. Hack Tools Pc
  32. Hack Tools
  33. Hacker Tools 2020
  34. Hacker Tools For Windows
  35. Best Hacking Tools 2019
  36. Hacking Tools For Mac
  37. How To Make Hacking Tools
  38. Hacker Security Tools
  39. Hack Tools For Games
  40. Hacking Tools Online
  41. Hack App
  42. Hacker Tools Free Download
  43. Hacker Tools For Ios
  44. Hacker Tools Github
  45. Black Hat Hacker Tools
  46. Beginner Hacker Tools
  47. Pentest Tools Free
  48. Hacker Tools List
  49. Pentest Tools Nmap
  50. Hack Tools For Pc
  51. Pentest Tools Port Scanner
  52. Pentest Tools Find Subdomains
  53. Hacker Tools For Mac
  54. Hak5 Tools
  55. How To Install Pentest Tools In Ubuntu
  56. Install Pentest Tools Ubuntu
  57. Hacking Tools
  58. Growth Hacker Tools
  59. Hack Tools 2019
  60. Hacking Tools Windows 10
  61. Hack Tools Online
  62. Hacking Tools Github
  63. Hacking Tools For Mac
  64. Hack Apps
  65. Hackrf Tools
  66. Pentest Tools For Mac
  67. Hack Tool Apk No Root
  68. Pentest Tools For Mac
  69. Hack Tools Pc
  70. Hacker Tools For Mac
  71. Hacker Tools For Mac
  72. Pentest Recon Tools
  73. Hacking Tools Hardware
  74. Hacker Tools Online
  75. Hacker Tools Mac
  76. Hacking Tools Software
  77. Hacker Tools Mac
  78. Hacking Tools And Software
  79. Hacking App
  80. Pentest Tools Port Scanner
  81. Best Pentesting Tools 2018
  82. Pentest Tools For Mac
  83. Pentest Tools For Ubuntu
  84. Hacks And Tools
  85. Hacker Tools Mac
  86. Pentest Tools Linux
  87. Tools 4 Hack
  88. Hacker Tools For Pc
  89. Hacking Tools Github
  90. Hacking Tools Free Download
  91. Tools Used For Hacking
  92. Hacking Tools For Windows Free Download
  93. What Are Hacking Tools
  94. Hackrf Tools
  95. Pentest Tools Tcp Port Scanner
  96. Pentest Tools Framework
  97. Pentest Tools Windows
  98. Hacker Hardware Tools
  99. Install Pentest Tools Ubuntu
  100. Pentest Tools Find Subdomains
  101. Nsa Hacker Tools
  102. Growth Hacker Tools
  103. Hack Tools Pc

No comments:

Post a Comment