Casey secdev02

KrbRelay with RBCD Privilege Escalation HOWTO

Short HOWTO about one use case of the work from Cube0x0 (KrbRelay) and others.

TL;DR

No-Fix Local Privilege Escalation from low-priviliged domain user to local system on domain-joined computers.

Prerequisites:

LDAP signing not required on Domain Controller (default!)

What to debug?

Hyper-v worker process

User mode debugging (easy).
Symbols available.
Attack surface: mostly Gen-1 VMs, device emulation, x86 emulation (for MMIO accesses).

Debugging options:

Attach to running process with WinDbg.

Original report

Affected Vendor: OpenPrinting
Affected Product: Several components of the CUPS printing system: cups-browsed, libppd, libcupsfilters and cups-filters.
Affected Version: All versions <= 2.0.1 (latest release) and master.
Significant ICS/OT impact? no
Reporter: Simone Margaritelli [evilsocket@gmail.com]
Vendor contacted? yes The vendor has been notified trough Github Advisories and all bugs have been confirmed:

https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8

Introduction

If you're reading this, chances are you have some idea of eBPF and XDP. In this article, we'll write an eBPF program that will count and categorize packets based on the destination port.

eBPF

Writing low-level tracing, monitoring, or network programs in Linux is not easy. Through all the layers of the kernel, people have been squeezing every bit of performance they could get.

And that's where eBPF comes in. eBPF is basically an extended and modern variation of BPF which is like a virtual machine inside the Linux kernel. It can execute user-defined programs inside a sandbox in the kernel.

These programs can be executed in various hook points but we will focus on XDP for now.

	#!/usr/bin/env python
	# -- coding: utf-8 --
	# ---------------------------------------------------------------------------
	# This software is in the public domain, furnished "as is", without technical
	# support, and with no warranty, express or implied, as to its usefulness for
	# any purpose.
	#
	# Usage:
	# ./dump_wallet_addresses.py <wallet binary>
	#

	# import the necessary toolsets
	Import-Module .\powermad.ps1
	Import-Module .\powerview.ps1

	# we are TESTLAB\attacker, who has GenericWrite rights over the primary$ computer account
	whoami

	# the target computer object we're taking over
	$TargetComputer = "primary.testlab.local"

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003" >
	<Target Name="Hello" >

	<!-- Call ANY .NET API -->
	<!--

	Author: Casey Smith, Twitter: @subTee

	License: BSD 3-Clause

	require 'btcruby'
	require 'bitcoin'
	require 'active_support'
	require 'active_support/core_ext'
	require 'ffi'

	# Creation of Witness Script: here a 2-of-2 multisig as an example

	@public_key = "02530c548d402670b13ad8887ff99c294e67fc18097d236d57880c69261b42def7"
	@user_key = BTC::Key.new(public_key:BTC.from_hex(@public_key))

	var bitcoin = require("bitcoinjs-lib");
	var request = require("request");

	//push transaction
	function pushTX(pload, callback){
	request({
	url: "https://api.blockcypher.com/v1/btc/main/txs/push",
	method: "POST",
	json: true,
	headers: {"content-type": "application/json"},