alfarom256

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

	./Cutter-v1.4-x86_64.AppImage
	Setting r2 prefix = "/tmp/.mount_CutterW0QrH6/usr" for AppImage.
	Setting PYTHONHOME = "/tmp/.mount_CutterW0QrH6/usr" for AppImage.
	PYTHONHOME = "/tmp/.mount_CutterW0QrH6/usr"
	Exception in thread Thread-1:
	Traceback (most recent call last):
	File "/tmp/.mount_CutterW0QrH6/usr/lib/python3.6/threading.py", line 916, in _bootstrap_inner
	self.run()
	File "/tmp/.mount_CutterW0QrH6/usr/lib/python3.6/threading.py", line 864, in run
	self._target(self._args, *self._kwargs)

	netstat -tulpn
	Active Internet connections (only servers)
	Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
	tcp 0 0 127.0.0.1:2015 0.0.0.0:* LISTEN 503/expressvpnd
	tcp 0 0 127.0.0.1:38629 0.0.0.0:* LISTEN 1389/expressvpn-age
	tcp 0 0 127.0.0.1:43569 0.0.0.0:* LISTEN 1800/openvpn-expres
	udp 0 0 0.0.0.0:68 0.0.0.0:* 697/dhclient
	udp 0 0 0.0.0.0:43381 0.0.0.0:* 1800/openvpn-expres

	#include <Windows.h>
	#include <jobapi2.h>
	#include <stdlib.h>
	// something something don't use iostream
	#include <iostream>
	#define IF_ERR(x,y) if(x == y) {std::cout<<"Error! : " << GetLastError() << std::endl; exit(-1);}

	int main() {
	int x;
	std::cout << "Enter PID: ";

	#include <windows.h>
	#include <stdio.h>
	#include <threadpoolapiset.h>

	#define LEN 277

	// run calc
	unsigned char op[] =
	"\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52"
	"\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48"

	#[repr(C)]
	pub struct LDR_DATA_TABLE_ENTRY<'ldte> {
	pub _reserved0: [PVOID; 2],
	pub in_initialize_order_links: LIST_ENTRY<'ldte>,
	// removed PVOID[2]
	pub dll_base: PVOID,
	pub entry_point: PVOID,
	pub _reserved1: [PVOID; 3], // Additional 2 PVOID's go here
	pub full_dll_name: UNICODE_STRING,
	pub _reserved3: [u8; 8],

	#include <Windows.h>

	#define OFFSET_InstrumentationCallbackSp 0x2d0
	#define OFFSET_InstrumentationCallbackPreviousPc 0x2d8
	#define OFFSET_InstrumentationCallbackPreviousSp 0x2e0
	#define OFFSET_InstrumentationCallbackDisabled 0x2ec
	#define OFFSET_Instrumentation 0x16b8

	typedef struct SyscallInstrumentation {
	BYTE InstrumentationCallbackDisabled;

	#pragma once
	#include <Windows.h>
	#include <winnt.h>
	#include <winternl.h>

	static BYTE prelude1[7]{
	0x4D, 0x8d, 0x4b, 0xf0, // lea r9, [r11-10h]
	0x45, 0x33, 0xc0 // xor r8d, r8d
	};