Windows Lateral Movement
Last updated
Last updated
If we have gained access to clear text credentials for a domain user and that user is a local administrator of the target machine, we can simply use mstsc.exe (the native RDP application) to gain access to that machine.
When an RDP connection is created, the NTLM hashes will reside in memory for the duration of the session. If we happen to compromise a well-used server (like a jump server), we could dump any of those cached credentials as well.
rmb to turn off AV protections in prior to use impacket-psexec
Restricted admin mode (default disabled) allows system administrators to perform a network login with RDP which does not require clear text credentials and will not store them in memory, essentially disabling single sign-on. This type of login is commonly used by service accounts.
While restricted admin mode protects against credential theft on the target, it is now possible to pass the hash when doing lateral movement with mstsc.
Clicking Connect opens an RDP session on {next victim hostname} as admin, achieving lateral movement with the native RDP client in Windows with only the NTLM hash.
1) launch shell instance in admin user context
2) shell access to next victim
3) create the registry entry & quit session
Use SharpRDP to execute a PowerShell download cradle on appsrv01 that pulls the Meterpreter executable and subsequently executes it with stacked commands
PsExec authenticates to SMB on the target host and accesses the DCE/RPC interface. PsExec will use this interface to access the service control manager, create a new service, and execute it. As part of the attack, the binary that is executed by the service is copied to the target host.
We can execute our code without registering a new service by updating the binary of an existing service and start the modified service with our target binary. Since we control the service binary, we can use a PowerShell download cradle to avoid saving a file to disk.
If endpoint protections such as application whitelisting are in place, this approach may not be as straightforward and may require a bypass (such as the use of InstallUtil or an XSL transform).
