RID HIJACKING: Maintaining Access on Windows Machines. Sebastin - - PowerPoint PPT Presentation

▶
rid hijacking
SMART_READER_LITE
LIVE PREVIEW

RID HIJACKING: Maintaining Access on Windows Machines. Sebastin - - PowerPoint PPT Presentation

Sep 24, 2022 203 likes •1.06k views

RID HIJACKING: Maintaining Access on Windows Machines. Sebastin Castro sebastian.castro@csl.com.co Rome, Italy @r4wd3r 2018 r4wd3r C:\> net user r4wd3r Username Username r4wd3r r4wd3r Fu Full ll Us User er na name me

slide-1
SLIDE 1

RID HIJACKING:

Maintaining Access on Windows Machines. Sebastián Castro

sebastian.castro@csl.com.co @r4wd3r r4wd3r Rome, Italy 2018

slide-2
SLIDE 2

C:\> net user r4wd3r

Username Username r4wd3r r4wd3r Fu Full ll Us User er na name me Sebastián Sebastián Castro Castro Comment Comment Infosec Infosec nerd, nerd, xpltdev xpltdev, win sec, op

  • pera si

singer User’s comment Terrible Terrible at MS Paint at MS Paint :( :( Country/region Country/region code code Colombia Colombia Account Account active active No No First lo logon 1993/05/03 1993/05/03 23:56 23:56 User pr profile Technical Technical & Research & Research Lead Lead <at> CS CSL La Labs Work di directory https://csl.com.co https://csl.com.co

slide-3
SLIDE 3

Agenda

0x01.

  • 01. Exposing the RID Hijacking Attack.

0x02.

  • 02. A Windows Logon Story.
  • 0x03. Hijacking the RID.

0x04

  • 04. Demo.

0x05.

  • 05. Conclusions.
slide-4
SLIDE 4

Agenda

0x01.

  • 01. Exposing the RID Hijacking Attack.

0x02.

  • 02. A Windows Logon Story.
  • 0x03. Hijacking the RID.

0x04

  • 04. Demo.

0x05.

  • 05. Conclusions.
slide-5
SLIDE 5

Not Not reli liable able on

  • n Doma

main Cont ntrollers rollers (yet et). ).

  • A new persist

rsistence ence technique that affects ALL LL Windows Systems since NT

  • NT. (Haven’t tried this on Windows 95 nor Phone ).
  • A stealthy way to maintain access by only

ly usi sing ng OS OS resou sources rces.

  • A method which takes advantage of imp

mporta

  • rtant

nt secur curity ity iss ssues ues found at the Windows Security Architecture.

What is RID Hijacking?

slide-6
SLIDE 6

What does it do?

This technique hij hijacks acks the the RID RID

  • f

any existing existing user user accou count nt on the victim host and assigns it to anoth

  • ther

er one

  • ne.

RID HIJACKING

SID D <Gue uest st Account count> ====== ======= ===== ======= ======= ======= ======= ======= ======= ======= ===== S-1-5-219 19665 653972 972-290 9088577 857710-50945 0945598 9845-501 501 SID D <Gue uest st hijack jacked Adm dmin inist strator ator> ====== ======= ===== ======= ======= ======= ======= ======= ======= ====== === S-1-5-219 19665 653972 972-290 9088577 857710-50945 0945598 9845-500 500

slide-7
SLIDE 7

What does it do?

0x01

  • 01. Assigns the privileges of the hijac

ijacked ked account to the hijac ijacker ker

  • ne, even if the hijacke

acked account is disable abled. 0x02 02. Allows to authenticate with the hijacker hijacker account credentials (also remotely, depending

  • n

machine’s configuration), and

  • btain

authorized access as the hijacke acked user. 0x03

  • 03. Permits to register any operation executed on the event log as

the hijacke acked user, despite of being logged on as the hijacke acker one.

slide-8
SLIDE 8

What does it do?

0x01

  • 01. Assigns the privileges of the hijac

ijacked ked account to the hijac ijacker ker

  • ne, even if the hijacke

acked account is disable abled. 0x02 02. Allows to authenticate with the hijacker hijacker account credentials (also remotely, depending

  • n

machine’s configuration), and

  • btain

authorized access as the hijacke acked user. 0x03

  • 03. Permits to register any operation executed on the event log as

the hijacke acked user, despite of being logged on as the hijacke acker one.

slide-9
SLIDE 9

What does it do?

0x01

  • 01. Assigns the privileges of the hijac

ijacked ked account to the hijac ijacker ker

  • ne, even if the hijacke

acked account is disable abled. 0x02 02. Allows to authenticate with the hijacker hijacker account credentials (also remotely, depending

  • n

machine’s configuration), and

  • btain

authorized access as the hijacke acked user. 0x03

  • 03. Permits to register any operation executed on the event log as

the hijacke acked user, despite of being logged on as the hijacke acker one.

slide-10
SLIDE 10

How does it look like?

whoami net user Guest writing on System32 folder

slide-11
SLIDE 11

Agenda

0x01.

  • 01. Exposing the RID Hijacking Attack.

0x02.

  • 02. A Windows Logon Story.
  • 0x03. Hijacking the RID.

0x04

  • 04. Demo.

0x05.

  • 05. Conclusions.
slide-12
SLIDE 12

A Windows Logon Story…

slide-13
SLIDE 13

A Windows Logon Story…

slide-14
SLIDE 14

A Windows Logon Story…

slide-15
SLIDE 15

A Windows Logon Story…

slide-16
SLIDE 16

A Windows Logon Story…

slide-17
SLIDE 17

Windows Security Architecture

Winlogon

winlogon.exe

LSA Server

lsasrv.dll

SAM Server

samsrv.dll

HKLM\SAM

AD Services

ntdsa.dll MSV1_0.dll

kerberos.dll

AD DB LSA DB

HKLM\SECURITY

KDC

Kdcsvc.dll

Others

Local Security Authority Subsystem <LSASS>

slide-18
SLIDE 18

Winlogon

winlogon.exe

LSA Server

lsasrv.dll

SAM Server

samsrv.dll

HKLM\SAM

MSV1_0.dll

Local Security Authority Subsystem <LSASS>

LSA DB

HKLM\SECURITY

Windows Security Architecture

slide-19
SLIDE 19

Quick Logon Overview

WINLOGON & LSASS

User: Administrator Pass: iamgreen

OK!

ACCESS TOKEN

User: Administrator S-1-5-…-500 Group1: Everyone S-1-1-0 Group2: Administrators S-1-5-32-544 Privileges:

  • …
  • …

File_X’s DACL

READ: Everyone S-1-1-0 WRITE: Administrators S-1-5-32-544

..... SRM SRM

slide-20
SLIDE 20

Security Identifiers <SID>

S-1-5-21-397955417-62688126-188441444-1010

Literal prefix Identifier Authority Sub Authority Indicating this class of ID Three Sub Authorities for Uniqueness

Relative ID

1010

slide-21
SLIDE 21

Authentication

Hi! ADMIN

here. Pass: ilovegreen

slide-22
SLIDE 22

Authentication Steps

  • 0x01. WINLOGON Initialization.
  • 0x02. WINLOGON calls LOGONUI (using CPs).
  • 0x03. WINLOGON creates an unique LOGON SID.
  • 0x04. WINLOGON calls LSASS and prepares a handle for an

Authentication Package.

slide-23
SLIDE 23

Authentication Packages

List: HKLM\SYSTEM\CurrentControlSet\Control\Lsa For interactive logons:

  • <MSV1_0.dll>:

Standalone Authentication.

  • <Kerberos.dll>:

Domain Kerberos Authentication.

Kerbero rberos s authen thenti ticat ation

  • n pack

ckage ge will ll be be ignore nored by by now now. .

slide-24
SLIDE 24

Authentication Steps

  • 0x05. WINLOGON sends logon info to the MSV1_0 calling

LsaLogonUser. Logon Info: Username/Password. LOGON SID.

MSV1_0 V1_0 is is also so used ed on

  • n doma

main in-mem ember er compute mputers rs when en are e disconn sconnec ected ed of

  • f the

the networ twork.

slide-25
SLIDE 25

Authentication Steps

  • 0x06. MSV1_0 sends username and hashed password to the

SAMSRV.

  • 0x07. SAMSRV queries on the SAM database with the logon

data, retrieving some security info.

MSV1_0.dll Samsrv.dll HKLM\SAM

slide-26
SLIDE 26

Authentication Steps

  • 0x08. MSV1_0 checks the information obtained from the

SAMSRV response.

  • 0x09. If OK, MSV1_0 generates a LUID for the session.
  • 0x0A. MSV1_0 sends the login information (including LUID)

to LSASS.

All All the the data ta sent nt will ll be be used ed for for the the furthe rther acce cess toke ken n creatio tion.

slide-27
SLIDE 27

Authorization

HELLO 500. Creating your

Access token

slide-28
SLIDE 28

Access Token

Object used by the SRM to identify the security context of a process. LSASS creates an initial access token for every user which logs on. Child processes inherit a copy of the token of their creator.

Proces

  • cesses

es in a user’s sessio ssion will ll be be execut ecuted using ing the the same me acce cess toke ken. n.

slide-29
SLIDE 29

Authorization Steps

  • 0x0B. LSASS checks the LSA database for

the user’s allowed access.

slide-30
SLIDE 30

Authorization Steps

  • 0x0B. LSASS checks the LSA database for

the user’s allowed access.

  • 0x0C. LSASS adds the Groups, SIDs and

privileges to the access token.

slide-31
SLIDE 31

Authorization Steps

  • 0x0B. LSASS checks the LSA database for

the user’s allowed access.

  • 0x0C. LSASS adds the Groups, SIDs and

privileges to the access token.

  • 0x0D. LSASS formally creates a primary

access token.

slide-32
SLIDE 32

Authorization

WELCOME ADMIN

Here’s your

Access token

slide-33
SLIDE 33

ACCESS GRANTED TOKEN

Authorization

slide-34
SLIDE 34

Agenda

0x01.

  • 01. Exposing the RID Hijacking Attack.

0x02.

  • 02. A Windows Authorization Story.
  • 0x03. Hijacking the RID.

0x04

  • 04. Demo.

0x05.

  • 05. Conclusions.
slide-35
SLIDE 35

Understanding the attack

How is the user identified by the system after being successfully authenticated?

slide-36
SLIDE 36

Understanding the attack

How is the user identified by the system after being successfully authenticated?

S-1-5-2196653 19665397 972-290885 908857710 7710-509 09455984 4559845-500 500

slide-37
SLIDE 37

Understanding the attack

How is the user identified by the system after being successfully authenticated? How does the system associate an username with his SID?

S-1-5-2196653 19665397 972-290885 908857710 7710-509 09455984 4559845-500 500

slide-38
SLIDE 38

Understanding the attack

How is the user identified by the system after being successfully authenticated? How does the system associate an username with his SID?

S-1-5-2196653 19665397 972-290885 908857710 7710-509 09455984 4559845-500 500 Using ing the the Sams msrv.dll rv.dll black ack magic gic :) :)

slide-39
SLIDE 39

Remembering…

  • 0x06. MSV1_0 sents username and hashed password to the

SAMSRV.

  • 0x07. SAMSRV queries on the SAM database with the logon

data, retrieving some security info.

MSV1_0.dll Samsrv.dll HKLM\SAM

slide-40
SLIDE 40

Remembering…

  • 0x06. MSV1_0 sents username and hashed password to the

SAMSRV.

  • 0x07. SAMSRV queries on the SAM database with the logon

data, retrieving some security info.

MSV1_0.dll Samsrv.dll HKLM\SAM

How is the username associated with the SID? What security info is retrieved?

slide-41
SLIDE 41

Samsrv.dll and SAM

SAMSRV looks for the username at the SAM database.

HKLM\SAM\SAM\Domains\Account\Users\Names

slide-42
SLIDE 42

Samsrv.dll and SAM

SAMSRV looks for the username at the SAM database. Each key contains a REG_BINARY value.

HKLM\SAM\SAM\Domains\Account\Users\Names

slide-43
SLIDE 43

Samsrv.dll and SAM

SAMSRV looks for the username at the SAM database. Each key contains a REG_BINARY value. The REG_BINARY has as Type the RID of the account.

HKLM\SAM\SAM\Domains\Account\Users\Names

slide-44
SLIDE 44

Samsrv.dll and MSV1_0.dll

SAMSRV looks for the key associated with the RID.

HKLM\SAM\SAM\Domains\Account\Users

slide-45
SLIDE 45

SAMSRV looks for the key associated with the RID. SAMSRV grabs all the data stored in the referenced key.

HKLM\SAM\SAM\Domains\Account\Users

Samsrv.dll and MSV1_0.dll

slide-46
SLIDE 46

Samsrv.dll and MSV1_0.dll

SAMSRV looks for the key associated with the RID. SAMSRV grabs all the data stored in the referenced key. MSV1_0.dll receives back all the data from SAMSRV.

MSV1_0.dll Samsrv.dll

slide-47
SLIDE 47

Understanding the attack

Why does the SAM store only the RID?

slide-48
SLIDE 48

Understanding the attack

Why does the SAM store only the RID?

S-1-5-219665397 196653972-290885771 908857710-509455984 094559845-500 500

Consistent sistent for for all all local al users rs SIDs SIDs Relativ ative

slide-49
SLIDE 49

Understanding the attack

S-1-5-219665397 196653972-290885771 908857710-509455984 094559845-500 500

Consistent sistent for for all all local al users rs SIDs SIDs Relativ ative

Why does the SAM store only the RID? What info is retrieved from the SAM?

slide-50
SLIDE 50

Understanding the attack

S-1-5-219665397 196653972-290885771 908857710-509455984 094559845-500 500

Consistent sistent for for all all local al users rs SIDs SIDs Relativ ative

Why does the SAM store only the RID? What info is retrieved from the SAM?

Password’s Hash. sh. Accoun

  • unt stat

atus s (Act ctive: ive: Y/N) N). Some acco count nt rest stric ictions ions.

A A copy copy of

  • f the

the user’s RID. RID.

slide-51
SLIDE 51

Login as Guest

Hi! GUEST

here. Pass: redgirl

slide-52
SLIDE 52

Login as Guest

MSV1_0.dll Samsrv.dll HKLM\SAM

Guest

A85666C6540692E19 E23AEEDAB77E108

slide-53
SLIDE 53

Login as Guest

MSV1_0.dll Samsrv.dll HKLM\SAM

Guest

A85666C6540692E19 E23AEEDAB77E108

Username:

Guest

slide-54
SLIDE 54

Login as Guest

MSV1_0.dll Samsrv.dll HKLM\SAM

Guest

A85666C6540692E19 E23AEEDAB77E108

Username:

Guest

0x1F5

slide-55
SLIDE 55

Login as Guest

MSV1_0.dll Samsrv.dll HKLM\SAM

Guest

A85666C6540692E19 E23AEEDAB77E108

Username:

Guest

0x1F5

HKLM\SAM\SAM\Domains \Account\Users\0…1F5

slide-56
SLIDE 56

Login as Guest

MSV1_0.dll Samsrv.dll HKLM\SAM

Guest

A85666C6540692E19 E23AEEDAB77E108

Username:

Guest

0x1F5

HKLM\SAM\SAM\Domains \Account\Users\0…1F5

A85666C6540692E19 E23AEEDAB77E108

Restrictions

RID Copy:

0x1F5

slide-57
SLIDE 57

Login as Guest

MSV1_0.dll Samsrv.dll HKLM\SAM

Guest

A85666C6540692E19 E23AEEDAB77E108

Username:

Guest

0x1F5

HKLM\SAM\SAM\Domains \Account\Users\0…1F5

A85666C6540692E19 E23AEEDAB77E108

Restrictions

RID Copy:

0x1F5

A85666C6540692E19 E23AEEDAB77E108

Restrictions

RID Copy:

0x1F5

slide-58
SLIDE 58

Login as Guest (Case 1)

GET OUTTA HERE!!!

slide-59
SLIDE 59

Login as Guest (Case 1)

GET OUTTA HERE!!!

GUEST Account <0x1F5> cannot log on to this machine.

slide-60
SLIDE 60

Login as Guest (Case 2)

WELCOME 501

Here’s your

Access token

slide-61
SLIDE 61

Login as Guest (Case 2)

Not but could be better!

slide-62
SLIDE 62

What if…?

What would happen if the RID COPY is changed to another value?

slide-63
SLIDE 63

What if…?

What would happen if the RID COPY is changed to another value?

RID(Administrator) = 500

500d = 0x1F4

slide-64
SLIDE 64

MSV1_0.dll Corrupted HKLM\SAM

Guest

A85666C6540692E19 E23AEEDAB77E108

Login as Guest (the comeback)

Samsrv.dll

slide-65
SLIDE 65

MSV1_0.dll Corrupted HKLM\SAM

Guest

A85666C6540692E19 E23AEEDAB77E108

Login as Guest (the comeback)

Samsrv.dll

Username:

Guest

slide-66
SLIDE 66

MSV1_0.dll Corrupted HKLM\SAM

Guest

A85666C6540692E19 E23AEEDAB77E108

Login as Guest (the comeback)

Samsrv.dll

Username:

Guest

0x1F5

slide-67
SLIDE 67

MSV1_0.dll Corrupted HKLM\SAM

Guest

A85666C6540692E19 E23AEEDAB77E108

Login as Guest (the comeback)

Samsrv.dll

Username:

Guest

0x1F5

HKLM\SAM\SAM\Domains \Account\Users\0…1F5

slide-68
SLIDE 68

MSV1_0.dll Corrupted HKLM\SAM

Guest

A85666C6540692E19 E23AEEDAB77E108

Login as Guest (the comeback)

Samsrv.dll

Username:

Guest

0x1F5

HKLM\SAM\SAM\Domains \Account\Users\0…1F5

A85666C6540692E19 E23AEEDAB77E108

Restrictions

RID Copy:

0x1F4

slide-69
SLIDE 69

MSV1_0.dll Corrupted HKLM\SAM

Guest

A85666C6540692E19 E23AEEDAB77E108

Login as Guest (the comeback)

Samsrv.dll

Username:

Guest

0x1F5

HKLM\SAM\SAM\Domains \Account\Users\0…1F5

A85666C6540692E19 E23AEEDAB77E108

Restrictions

RID Copy:

0x1F4

A85666C6540692E19 E23AEEDAB77E108

Restrictions

RID Copy:

0x1F4 Logon Process continues…

slide-70
SLIDE 70

MSV1_0.dll

MSV1_0 checks the account restrictions provided from SAMSRV. If allowed, then compares: SAMSRV response password hash VS User entered hashed password

A85666C6540692E19 E23AEEDAB77E108

Restrictions

RID Copy:

0x1F4

Login as Guest (the comeback)

slide-71
SLIDE 71

MSV1_0.dll

MSV1_0 checks the account restrictions provided from SAMSRV. If allowed, then compares: SAMSRV response password hash VS User entered hashed password

A85666C6540692E19 E23AEEDAB77E108

Restrictions

RID Copy:

0x1F4

Login as Guest (the comeback)

Hash will be the same

slide-72
SLIDE 72

LSASS MSV1_0.dll

Password: OK

RID: 0x1F4

LUID

Login as Guest (the comeback)

slide-73
SLIDE 73

LSASS MSV1_0.dll

Password: OK

RID: 0x1F4

LUID

Login as Guest (the comeback)

Token source Impersonation type Token ID Authentication ID Modified ID Expiration Time Session ID Flags Logon session (LUID) Mandatory Policy Administrators Default DACL

SID-1-5-………-500

Group 1 SID … Group n SID Restricted SID 1 … Restricted SID n Privilege 1 … Privilege n

Creates the Access Token with RID 500

slide-74
SLIDE 74

LSASS MSV1_0.dll

Password: OK

RID: 0x1F4

LUID

Login as Guest (the comeback)

Token source Impersonation type Token ID Authentication ID Modified ID Expiration Time Session ID Flags Logon session (LUID) Mandatory Policy Administrators Default DACL

SID-1-5-………-500

Group 1 SID … Group n SID Restricted SID 1 … Restricted SID n Privilege 1 … Privilege n

Creates the Access Token with RID 500

Before After

RID HIJACKING

slide-75
SLIDE 75

Login as Guest

WELCOME guest

Here’s your

Access token

slide-76
SLIDE 76

Login as Guest

ACCESS GRANTED TOKEN

slide-77
SLIDE 77

SECURITY CURITY ISSUES SUES

  • 0x01. SAMSRV does not check if the RID associated

with the user is consistent to the RID COPY.

slide-78
SLIDE 78

SECURITY CURITY ISSUES SUES

  • 0x01. SAMSRV does not check if the RID associated

with the user is consistent to the RID COPY.

  • 0x02. LSASS does not corroborate the RID with the

username before creating the access token.

slide-79
SLIDE 79

SECURITY CURITY ISSUES SUES

  • 0x01. SAMSRV does not check if the RID associated

with the user is consistent to the RID COPY.

  • 0x02. LSASS does not corroborate the RID with the

username before creating the access token.

  • 0x03. LSASS never looks for RID inconsistencies

during the user’s session.

slide-80
SLIDE 80

Agenda

0x01.

  • 01. Exposing the RID Hijacking Attack.

0x02.

  • 02. A Windows Authorization Story.
  • 0x03. Hijacking the RID.

0x04

  • 04. Demo.

0x05.

  • 05. Conclusions.
slide-81
SLIDE 81

Demonstration

Windows 10 VICTIM Kali Linux ATTACKER 192.168.68.3 192.168.68.4

Interactive PsExec RDP Guest Unprivileged

USER

slide-82
SLIDE 82

Agenda

0x01.

  • 01. Exposing the RID Hijacking Attack.

0x02.

  • 02. A Windows Authorization Story.
  • 0x03. Hijacking the RID.

0x04

  • 04. Demo.

0x05.

  • 05. Conclusions.
slide-83
SLIDE 83

Conclusions

slide-84
SLIDE 84

References

1. http://csl.com.co/rid-hijacking/ 2. Russinovich, Mark. Solomon, David A. Ionescu, Alex. “Windows Internals”. 6th Edition. 3. Scambray, Joel. McClure, Stuart. “Hacking Exposed: Windows Security Secrets & Solutions”. 3rd Edition. 4. https://technet.microsoft.com/pt-pt/library/cc780332(v=ws.10).aspx 5. https://docs.microsoft.com/en-us/windows-server/security/windows- authentication/credentials-processes-in-windows-authentication