Thursday, June 1, 2023

Thousand Ways To Backdoor A Windows Domain (Forest)

When the Kerberos elevation of privilege (CVE-2014-6324 / MS14-068) vulnerability has been made public, the remediation paragraph of the following blog post made some waves:
http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx

"The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of the domain."

Personally, I agree with this, but .... But whether this is the real solution, I'm not sure. And the same applies to compromised computers. When it has been identified that malware was able to run on the computer (e.g. scheduled scan found the malware), there is no easy way to determine with 100% certainty that there is no rootkit on the computer. Thus rebuilding the computer might be a good thing to consider. For paranoids, use new hardware ;)

But rebuilding a single workstation and rebuilding a whole domain is not on the same complexity level. Rebuilding a domain can take weeks or months (or years, which will never happen, as the business will close before that).

There are countless documented methods to backdoor a computer, but I have never seen a post where someone collects all the methods to backdoor a domain. In the following, I will refer to domain admin, but in reality, I mean Domain Admins, Enterprise Admins, and Schema Admins.


Ways to backdoor a domain

So here you go, an incomplete list to backdoor a domain:

  • Create a new domain admin user. Easy to do, easy to detect, easy to remediate
  • Dump password hashes. The attacker can either crack those or just pass-the-hash. Since KB2871997, pass-the-hash might be trickier (https://technet.microsoft.com/library/security/2871997), but not impossible. Easy to do, hard to detect, hard to remediate - just think about service user passwords. And during remediation, consider all passwords compromised, even strong ones.
  • Logon scripts - modify the logon scripts and add something malicious in it. Almost anything detailed in this post can be added :D
  • Use an already available account, and add domain admin privileges to that. Reset its password. Mess with current group memberships - e.g. http://www.exploit-db.com/papers/17167/
  • Backdoor any workstation where domain admins login. While remediating workstations, don't forget to clean the roaming profile. The type of backdoor can use different forms: malware, local admin, password (hidden admin with 500 RID), sticky keys, etc.
  • Backdoor any domain controller server. For advanced attacks, see Skeleton keys 
  • Backdoor files on network shares which are commonly used by domain admins by adding malware to commonly used executables - Backdoor factory
  • Change ownership/permissions on AD partitions - if you have particular details on how to do this specifically, please comment
  • Create a new domain user. Hide admin privileges with SID history. Easy to do, hard to detect, easy to remediate - check Mimikatz experimental for addsid
  • Golden tickets - easy to do, hard to detect, medium remediation
  • Silver tickets - easy to do, hard to detect, medium/hard remediation
  • Backdoor workstations/servers via group policy
    • HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ RunOnce,
    • scheduled tasks (run task 2 years later),
    • sticky-keys with debug
  • Backdoor patch management tool, see slides here
[Update 2017.01.10]


Other tricks

The following list does not fit in the previous "instant admin" tips, but still, it can make the attackers life easier if their primary foothold has been disabled:

  • Backdoor recent backups - and when the backdoor is needed, destroy the files, so the files will be restored from the backdoored backup
  • Backdoor the Exchange server - get a copy of emails
  • Backdoor workstation/server golden image
  • Change permission of logon scripts to allow modification later
  • Place malicious symlinks to file shares, collect hashes via SMB auth tries on specified IP address, grab password hashes later
  • Backdoor remote admin management e.g. HP iLO - e.g. create new user or steal current password
  • Backdoor files e.g. on shares to use in SMB relay
  • Backdoor source code of in-house-developed software
  • Use any type of sniffed or reused passwords in new attacks, e.g. network admin, firewall admin, VPN admin, AV admin, etc.
  • Change the content of the proxy pac file (change browser configuration if necessary), including special exception(s) for a chosen domain(s)  to use proxy on malicious IP. Redirect the traffic, enforce authentication, grab password hashes, ???, profit.
  • Create high privileged users in applications running with high privileges, e.g. MSSQL, Tomcat, and own the machine, impersonate users, grab their credentials, etc. The typical pentest path made easy.
  • Remove patches from servers, change patch policy not to install those patches.
  • Steal Windows root/intermediate CA keys
  • Weaken AD security by changing group policy (e.g. re-enabling LM-hashes)
Update [2015-09-27]: I found this great presentation from Jakob Heidelberg. It mentions (at least) the following techniques, it is worth to check these:
  • Microsoft Local Administrator Password Solution
  • Enroll virtual smart card certificates for domain admins

Forensics

If you have been chosen to remediate a network where attackers gained domain admin privileges, well, you have a lot of things to look for :)

I can recommend two tools which can help you during your investigation:

Lessons learned

But guess what, not all of these problems are solved by rebuilding the AD. One has to rebuild all the computers from scratch as well. Which seems quite impossible. When someone is creating a new AD, it is impossible not to migrate some configuration/data/files from the old domain. And whenever this happens, there is a risk that the new AD will be backdoored as well.

Ok, we are doomed, but what can we do? I recommend proper log analysis, analyze trends, and detect strange patterns in your network. Better spend money on these, than on the domain rebuild. And when you find something, do a proper incident response. And good luck!

Ps: Thanks to Andrew, EQ, and Tileo for adding new ideas to this post.

Check out the host backdooring post as well! :)
Related links
  1. Hacker Tools Apk Download
  2. Hacking Tools Windows 10
  3. Pentest Recon Tools
  4. Hacker Tools 2019
  5. Underground Hacker Sites
  6. Nsa Hack Tools Download
  7. Hack Tools For Pc
  8. Hacking Tools For Mac
  9. Hacker Security Tools
  10. Hack And Tools
  11. Pentest Tools Framework
  12. Hacker Tools Free
  13. Pentest Tools Free
  14. Hacker Search Tools
  15. Termux Hacking Tools 2019
  16. What Is Hacking Tools
  17. Pentest Tools Find Subdomains
  18. Pentest Tools Android
  19. Hacker Tools Free
  20. Hacking Tools Kit
  21. Github Hacking Tools
  22. Top Pentest Tools
  23. New Hack Tools
  24. Hacker Tools
  25. Nsa Hacker Tools
  26. Hacks And Tools
  27. Hacker Tools For Pc
  28. Pentest Tools Online
  29. Hack Tools For Windows
  30. Pentest Tools Android
  31. Free Pentest Tools For Windows
  32. Hacker Tools Linux
  33. Hacker Tools For Windows
  34. Pentest Box Tools Download
  35. Hacker Tools Free Download
  36. Hacker
  37. Pentest Reporting Tools
  38. Hack Tools Github
  39. Blackhat Hacker Tools
  40. Hack Tools For Games
  41. Pentest Box Tools Download
  42. Bluetooth Hacking Tools Kali
  43. Hack Tools
  44. Hack Tools Pc
  45. Hacking Tools Pc
  46. Pentest Tools Alternative
  47. Kik Hack Tools
  48. Pentest Tools Kali Linux
  49. Hak5 Tools
  50. Pentest Tools Tcp Port Scanner
  51. Android Hack Tools Github
  52. New Hack Tools
  53. Hacking Tools And Software
  54. Hacker Tools Free Download
  55. Hacker Tools For Ios
  56. Hacker Tools 2020
  57. Wifi Hacker Tools For Windows
  58. Hack Tools For Pc
  59. Game Hacking
  60. Hacker Tools Online
  61. Hackers Toolbox
  62. Pentest Tools Framework
  63. Wifi Hacker Tools For Windows
  64. Hacker
  65. Hack Tools Download
  66. New Hack Tools
  67. Hacker Tools Hardware
  68. Kik Hack Tools
  69. Hacking Tools For Kali Linux
  70. Hacker Tools Mac
  71. Pentest Tools For Ubuntu
  72. Hacking Tools Usb
  73. Hack Tools For Games
  74. Hacking Tools 2020
  75. Hacker Tools For Windows
  76. Wifi Hacker Tools For Windows
  77. Hacker Tools Free
  78. Github Hacking Tools
  79. Best Hacking Tools 2020
  80. Hack Tools Download
  81. Hacker Tools 2019
  82. Hack Tools 2019
  83. How To Hack
  84. Hacking Tools Name
  85. Hacker Tools Online
  86. Pentest Tools Website
  87. Nsa Hack Tools
  88. Pentest Tools Tcp Port Scanner
  89. Pentest Tools Bluekeep
  90. Pentest Tools Website Vulnerability
  91. Hacking Tools
  92. Github Hacking Tools
  93. Best Pentesting Tools 2018
  94. Hacker Tools Github
  95. Pentest Tools For Mac
  96. Hacker Techniques Tools And Incident Handling
  97. Hacker Tools For Pc
  98. Pentest Tools Apk
  99. Pentest Tools Tcp Port Scanner
  100. Hack Apps
  101. Pentest Tools Apk
  102. Pentest Tools For Ubuntu
  103. Usb Pentest Tools
  104. Pentest Tools Subdomain
  105. Pentest Tools Url Fuzzer
  106. Hacker Tools Software
  107. Android Hack Tools Github
  108. What Are Hacking Tools
  109. Hack Tools For Mac
  110. Pentest Tools For Windows
  111. Hack Apps
  112. Hack Tools For Games
  113. Tools 4 Hack
  114. Hacking Tools Online
  115. Nsa Hacker Tools
  116. Hacking Tools Github
  117. Hack Tools
  118. Best Pentesting Tools 2018
  119. Hacking Tools
  120. Hacking Tools For Windows 7
  121. Pentest Tools Website Vulnerability
  122. Underground Hacker Sites
  123. Pentest Reporting Tools
  124. Pentest Tools Alternative
  125. Pentest Tools
  126. Underground Hacker Sites
  127. Hacker Tools Hardware
  128. Hacking Tools Online
  129. Pentest Tools Nmap
  130. Hacker Tools Linux
  131. Hack Tools Download
  132. New Hack Tools
  133. Best Hacking Tools 2019
  134. Hacking Tools For Beginners
  135. Pentest Tools Github
  136. World No 1 Hacker Software
  137. Pentest Tools Nmap
  138. Hackers Toolbox
  139. Hacker Tools Mac
  140. Hacking Tools Windows 10
  141. Hackrf Tools
  142. Nsa Hack Tools
  143. Pentest Tools Download
  144. Pentest Reporting Tools
  145. Hack Tools For Windows
  146. Pentest Box Tools Download
  147. Pentest Tools Tcp Port Scanner
  148. Hacker Security Tools
  149. Hack Tools Online
  150. Pentest Tools Alternative
  151. Hacks And Tools
  152. Hacker
  153. Hacker Tools 2019
  154. Pentest Tools For Android
  155. Hacking Tools Hardware
  156. Hacker
  157. Hack Rom Tools
  158. Hacking Tools And Software
  159. What Are Hacking Tools
  160. Hacks And Tools
  161. Hacking Tools For Mac
  162. New Hack Tools
  163. Easy Hack Tools
  164. Tools Used For Hacking
  165. Pentest Tools Github
  166. Pentest Tools For Android
  167. Pentest Tools Online
  168. Nsa Hacker Tools
  169. Hacker Tools For Windows
  170. Pentest Tools For Ubuntu
  171. Hacker Tools Online
  172. Hacker Search Tools
  173. Pentest Tools Android
  174. Pentest Tools Download

No comments:

Post a Comment