Alex Flores audibleblink

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

HOWTO: Create Your Own Self-Signed Certificate with Subject Alternative Names Using OpenSSL in Ubuntu Bash for Window

Overview

My main development workstation is a Windows 10 machine, so we'll approach this from that viewpoint.

Recently, Google Chrome started giving me a warning when I open a site that uses https and self-signed certificate on my local development machine due to some SSL certificate issues like the one below:

	package main

	import (
	"fmt"
	"net"
	"io"
	)

	func main() {
	//http.HandleFunc("/", handler)

	// Dll Hijacking via Thread Creation
	// Author - Vivek Ramachandran
	// Learn Pentesting Online -- http://PentesterAcademy.com/topics and http://SecurityTube-Training.com
	// Free Infosec Videos -- http://SecurityTube.net



	#include <windows.h>
	#define SHELLCODELEN 2048

	[*] - C:\Windows\System32\1028\VsGraphicsResources.dll

	[?] 64-bit Image!

	[>] Time Stamp: 12/31/1969 19:00:00
	[>] Function Count:
	[>] Named Functions:
	[>] Ordinal Base:
	[>] Function Array RVA: 0x
	[>] Name Array RVA: 0x

	package main

	import (
	"io/ioutil"
	"log"
	"net/http"
	"os"
	"runtime"
	"syscall"
	"unsafe"

	package main

	/*
	*
	* This is just a Go implementation of https://github.com/monoxgas/sRDI/
	* Useful if you're trying to generate shellcode for reflective DLL
	* injection in Go, otherwise probably not much use :)
	*
	* The project, shellcode, most comments within this project
	* are all from the original project by @SilentBreakSec's Nick Landers (@monoxgas)

	Document infos:
	- Author = Peter Kim
	- CreationDate = D:20180505020009+00'00'
	- Creator = calibre 2.69.0 [https://calibre-ebook.com]
	- Pages = 308
	- Producer = calibre 2.69.0 [https://calibre-ebook.com]
	- Title = The Hacker Playbook 3: Practical Guide To Penetration Testing
	- dc = {'publisher': ['Secure Planet'], 'description': {'x-default': None}, 'language': ['en'], 'creator': ['Peter Kim'], 'title': {'x-default': 'The Hacker Playbook 3: Practical Guide To Penetration Testing'}, 'date': ['2018-05-01T00:00:00+02:00'], 'subject': []}
	- http://calibre-ebook.com/xmp-namespace = {'timestamp': '2018-05-03T18:05:43.134685+02:00', 'author_sort': 'Kim, Peter'}
	- xap = {'Identifier': ['\n '], 'MetadataDate': '2018-05-05T04:00:09.811485+02:00'}

	package main

	//#include "dllmain.h"
	import "C"