mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
201 lines
18 KiB
Markdown
201 lines
18 KiB
Markdown
# Zaštite Windows kredencijala
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|
||
|
||
## WDigest
|
||
|
||
The [WDigest](<https://technet.microsoft.com/pt-pt/library/cc778868(v=ws.10).aspx?f=255&MSPPError=-2147217396>) protocol, introduced with Windows XP, is designed for authentication via the HTTP Protocol and is **enabled by default on Windows XP through Windows 8.0 and Windows Server 2003 to Windows Server 2012**. This default setting results in **plain-text password storage in LSASS** (Local Security Authority Subsystem Service). Napadač može koristiti Mimikatz da **izvuče ove kredencijale** izvršavanjem:
|
||
```bash
|
||
sekurlsa::wdigest
|
||
```
|
||
Da biste **isključili ili uključili ovu funkciju**, _**UseLogonCredential**_ i _**Negotiate**_ ključevi registra unutar _**HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\WDigest**_ moraju biti postavljeni na "1". Ako ovi ključevi **nedostaju ili su postavljeni na "0"**, WDigest je **onemogućen**:
|
||
```bash
|
||
reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential
|
||
```
|
||
## Zaštita LSA (PP i PPL zaštićeni procesi)
|
||
|
||
**Protected Process (PP)** i **Protected Process Light (PPL)** su **Windows zaštite na nivou kernela** dizajnirane da spreče neovlašćeni pristup osetljivim procesima kao što je **LSASS**. Uveden u **Windows Vista**, **PP model** je prvobitno napravljen za **DRM** i omogućavao je zaštitu samo binarnim fajlovima potpisanim posebnim medija sertifikatom. Proces označen kao **PP** može se pristupiti samo od strane drugih procesa koji su **takođe PP** i imaju **jednak ili viši nivo zaštite**, i čak tada, **samo sa ograničenim pristupnim pravima** osim ako nije posebno dozvoljeno.
|
||
|
||
**PPL**, uveden u **Windows 8.1**, predstavlja fleksibilniju verziju PP. Omogućava **šire slučajeve upotrebe** (npr. LSASS, Defender) uvodeći **"protection levels"** zasnovane na polju **digitalnog potpisa EKU (Enhanced Key Usage)**. Nivo zaštite se čuva u polju `EPROCESS.Protection`, koje je `PS_PROTECTION` struktura sa:
|
||
- **Type** (`Protected` or `ProtectedLight`)
|
||
- **Signer** (npr. `WinTcb`, `Lsa`, `Antimalware`, itd.)
|
||
|
||
Ova struktura je upakovana u jedan bajt i određuje **ko kome može pristupiti**:
|
||
- **Više signer vrednosti mogu pristupati nižim**
|
||
- **PPL ne mogu pristupati PP**
|
||
- **Nezaštićeni procesi ne mogu pristupiti nijednom PPL/PP**
|
||
|
||
### Šta treba da znate iz ofanzivne perspektive
|
||
|
||
- Kada **LSASS radi kao PPL**, pokušaji da se otvori korišćenjem `OpenProcess(PROCESS_VM_READ | QUERY_INFORMATION)` iz običnog administratorskog konteksta **ne uspevaju i vraćaju `0x5 (Access Denied)`**, čak i ako je `SeDebugPrivilege` omogućen.
|
||
- Možete **proveriti nivo zaštite LSASS-a** koristeći alate poput Process Hacker ili programatski čitanjem vrednosti `EPROCESS.Protection`.
|
||
- LSASS obično ima `PsProtectedSignerLsa-Light` (`0x41`), kojem mogu pristupiti **samo procesi potpisani signerom višeg nivoa**, kao što je `WinTcb` (`0x61` ili `0x62`).
|
||
- PPL je **ograničenje samo u userland-u**; **kod na nivou kernela ga može u potpunosti zaobići**.
|
||
- To što je LSASS PPL **ne sprečava credential dumping ako možete izvršiti kernel shellcode** ili **iskoristiti visokoprivilegovani proces sa odgovarajućim pristupom**.
|
||
- **Podesavanje ili uklanjanje PPL** zahteva restart ili **Secure Boot/UEFI podešavanja**, koja mogu sačuvati PPL podešavanje čak i nakon što su promene u registru poništene.
|
||
|
||
### Create a PPL process at launch (documented API)
|
||
|
||
Windows pruža dokumentovan način da se zatraži Protected Process Light nivo za child process tokom kreiranja koristeći extended startup attribute list. Ovo ne zaobilazi zahteve za potpisivanjem — ciljna slika mora biti potpisana za traženu signer klasu.
|
||
|
||
Minimalan tok u C/C++:
|
||
```c
|
||
// Request a PPL protection level for the child process at creation time
|
||
// Requires Windows 8.1+ and a properly signed image for the selected level
|
||
#include <windows.h>
|
||
|
||
int wmain(int argc, wchar_t **argv) {
|
||
STARTUPINFOEXW si = {0};
|
||
PROCESS_INFORMATION pi = {0};
|
||
si.StartupInfo.cb = sizeof(si);
|
||
|
||
SIZE_T attrSize = 0;
|
||
InitializeProcThreadAttributeList(NULL, 1, 0, &attrSize);
|
||
si.lpAttributeList = (PPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), 0, attrSize);
|
||
if (!si.lpAttributeList) return 1;
|
||
|
||
if (!InitializeProcThreadAttributeList(si.lpAttributeList, 1, 0, &attrSize)) return 1;
|
||
|
||
DWORD level = PROTECTION_LEVEL_ANTIMALWARE_LIGHT; // or WINDOWS_LIGHT/LSA_LIGHT/WINTCB_LIGHT
|
||
if (!UpdateProcThreadAttribute(
|
||
si.lpAttributeList, 0,
|
||
PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL,
|
||
&level, sizeof(level), NULL, NULL)) {
|
||
return 1;
|
||
}
|
||
|
||
DWORD flags = EXTENDED_STARTUPINFO_PRESENT;
|
||
if (!CreateProcessW(L"C\\Windows\\System32\\notepad.exe", NULL, NULL, NULL, FALSE,
|
||
flags, NULL, NULL, &si.StartupInfo, &pi)) {
|
||
// If the image isn't signed appropriately for the requested level,
|
||
// CreateProcess will fail with ERROR_INVALID_IMAGE_HASH (577).
|
||
return 1;
|
||
}
|
||
|
||
// cleanup
|
||
DeleteProcThreadAttributeList(si.lpAttributeList);
|
||
HeapFree(GetProcessHeap(), 0, si.lpAttributeList);
|
||
CloseHandle(pi.hThread);
|
||
CloseHandle(pi.hProcess);
|
||
return 0;
|
||
}
|
||
```
|
||
Napomene i ograničenja:
|
||
- Koristite `STARTUPINFOEX` sa `InitializeProcThreadAttributeList` i `UpdateProcThreadAttribute(PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL, ...)`, zatim prosledite `EXTENDED_STARTUPINFO_PRESENT` funkcijama `CreateProcess*`.
|
||
- Zaštitni `DWORD` može biti postavljen na konstante kao što su `PROTECTION_LEVEL_WINTCB_LIGHT`, `PROTECTION_LEVEL_WINDOWS`, `PROTECTION_LEVEL_WINDOWS_LIGHT`, `PROTECTION_LEVEL_ANTIMALWARE_LIGHT`, ili `PROTECTION_LEVEL_LSA_LIGHT`.
|
||
- Child proces počinje kao PPL samo ako je njegova image potpisana za tu signer klasu; u protivnom kreiranje procesa pada, obično sa `ERROR_INVALID_IMAGE_HASH (577)` / `STATUS_INVALID_IMAGE_HASH (0xC0000428)`.
|
||
- Ovo nije bypass — to je podržani API namenjen odgovarajuće potpisanim image-ima. Korisno za ojačavanje alata ili validaciju PPL-zaštićenih konfiguracija.
|
||
|
||
Example CLI using a minimal loader:
|
||
- Antimalware signer: `CreateProcessAsPPL.exe 3 C:\Tools\agent.exe --svc`
|
||
- LSA-light signer: `CreateProcessAsPPL.exe 4 C:\Windows\System32\notepad.exe`
|
||
|
||
**Bypass PPL protections options:**
|
||
|
||
Ako želite da dump-ujete LSASS uprkos PPL, imate 3 glavne opcije:
|
||
1. **Use a signed kernel driver (e.g., Mimikatz + mimidrv.sys)** to **remove LSASS’s protection flag**:
|
||
|
||
|
||
|
||
2. **Bring Your Own Vulnerable Driver (BYOVD)** to run custom kernel code and disable the protection. Tools like **PPLKiller**, **gdrv-loader**, or **kdmapper** make this feasible.
|
||
3. **Steal an existing LSASS handle** from another process that has it open (e.g., an AV process), then **duplicate it** into your process. This is the basis of the `pypykatz live lsa --method handledup` technique.
|
||
4. **Abuse some privileged process** that will allow you to load arbitrary code into its address space or inside another privileged process, effectively bypassing the PPL restrictions. You can check an example of this in [bypassing-lsa-protection-in-userland](https://blog.scrt.ch/2021/04/22/bypassing-lsa-protection-in-userland/) or [https://github.com/itm4n/PPLdump](https://github.com/itm4n/PPLdump).
|
||
|
||
**Check current status of LSA protection (PPL/PP) for LSASS**:
|
||
```bash
|
||
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL
|
||
```
|
||
Kada pokrenete **`mimikatz privilege::debug sekurlsa::logonpasswords`** verovatno će se završiti greškom sa kodom `0x00000005` zbog ovoga.
|
||
|
||
- Za više informacija o ovoj proveri [https://itm4n.github.io/lsass-runasppl/](https://itm4n.github.io/lsass-runasppl/)
|
||
|
||
|
||
## Credential Guard
|
||
|
||
**Credential Guard**, funkcija ekskluzivna za **Windows 10 (Enterprise and Education editions)**, pojačava bezbednost mašinskih kredencijala koristeći **Virtual Secure Mode (VSM)** i **Virtualization Based Security (VBS)**. Ona koristi CPU ekstenzije za virtualizaciju da izoluje ključne procese u zaštićenom prostoru memorije, van dometa glavnog operativnog sistema. Ova izolacija obezbeđuje da čak i kernel ne može pristupiti memoriji u VSM, efikasno štiteći kredencijale od napada poput **pass-the-hash**. **Local Security Authority (LSA)** radi u ovom sigurnom okruženju kao trustlet, dok proces **LSASS** u glavnom OS-u deluje samo kao posrednik koji komunicira sa LSA u VSM.
|
||
|
||
Po defaultu, **Credential Guard** nije aktiviran i zahteva ručnu aktivaciju u organizaciji. On je značajan za poboljšanje sigurnosti protiv alata poput **Mimikatz**, koji su ograničeni u mogućnosti izvlačenja kredencijala. Ipak, ranjivosti se i dalje mogu iskoristiti dodavanjem prilagođenih **Security Support Providers (SSP)** koji mogu uhvatiti kredencijale u čistom tekstu tokom pokušaja prijave.
|
||
|
||
Da biste proverili status aktivacije **Credential Guard**, možete pregledati registry ključ _**LsaCfgFlags**_ pod _**HKLM\System\CurrentControlSet\Control\LSA**_. Vrednost "**1**" označava aktivaciju sa **UEFI lock**, "**2**" bez lock-a, a "**0**" označava da nije omogućeno. Ova provera u registry-u, iako dobar indikator, nije jedini korak za omogućavanje Credential Guard. Detaljna uputstva i PowerShell skripta za omogućavanje ove funkcije dostupni su online.
|
||
```bash
|
||
reg query HKLM\System\CurrentControlSet\Control\LSA /v LsaCfgFlags
|
||
```
|
||
For a comprehensive understanding and instructions on enabling **Credential Guard** in Windows 10 and its automatic activation in compatible systems of **Windows 11 Enterprise and Education (version 22H2)**, visit [Microsoft's documentation](https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage).
|
||
|
||
Further details on implementing custom SSPs for credential capture are provided in [this guide](../active-directory-methodology/custom-ssp.md).
|
||
|
||
## RDP RestrictedAdmin Mode
|
||
|
||
**Windows 8.1 and Windows Server 2012 R2** introduced several new security features, including the _**Restricted Admin mode for RDP**_. This mode was designed to enhance security by mitigating the risks associated with [**pass the hash**](https://blog.ahasayen.com/pass-the-hash/) attacks.
|
||
|
||
Traditionally, when connecting to a remote computer via RDP, your credentials are stored on the target machine. This poses a significant security risk, especially when using accounts with elevated privileges. However, with the introduction of _**Restricted Admin mode**_, this risk is substantially reduced.
|
||
|
||
When initiating an RDP connection using the command **mstsc.exe /RestrictedAdmin**, authentication to the remote computer is performed without storing your credentials on it. This approach ensures that, in the event of a malware infection or if a malicious user gains access to the remote server, your credentials are not compromised, as they are not stored on the server.
|
||
|
||
It's important to note that in **Restricted Admin mode**, attempts to access network resources from the RDP session will not use your personal credentials; instead, the **machine's identity** is used.
|
||
|
||
This feature marks a significant step forward in securing remote desktop connections and protecting sensitive information from being exposed in case of a security breach.
|
||
|
||
|
||
|
||
For more detailed information on visit [this resource](https://blog.ahasayen.com/restricted-admin-mode-for-rdp/).
|
||
|
||
## Keširani kredencijali
|
||
|
||
Windows secures **domain credentials** through the **Local Security Authority (LSA)**, supporting logon processes with security protocols like **Kerberos** and **NTLM**. A key feature of Windows is its capability to cache the **last ten domain logins** to ensure users can still access their computers even if the **domain controller is offline**—a boon for laptop users often away from their company's network.
|
||
|
||
The number of cached logins is adjustable via a specific **registry key or group policy**. To view or change this setting, the following command is utilized:
|
||
```bash
|
||
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON" /v CACHEDLOGONSCOUNT
|
||
```
|
||
Pristup ovim keširanim akreditivima je strogo kontrolisan, i samo nalog **SYSTEM** ima potrebna ovlašćenja da ih pregleda. Administratori kojima je potreban pristup ovim informacijama moraju to učiniti sa privilegijama korisnika SYSTEM. Akreditivi se čuvaju na: `HKEY_LOCAL_MACHINE\SECURITY\Cache`
|
||
|
||
**Mimikatz** se može koristiti za izdvajanje ovih keširanih akreditiva koristeći komandu `lsadump::cache`.
|
||
|
||
Za više detalja, originalni [izvor](http://juggernaut.wikidot.com/cached-credentials) sadrži detaljne informacije.
|
||
|
||
## Protected Users
|
||
|
||
Članstvo u **Protected Users group** uvodi nekoliko poboljšanja bezbednosti za korisnike, obezbeđujući viši nivo zaštite protiv krađe i zloupotrebe akreditiva:
|
||
|
||
- **Credential Delegation (CredSSP)**: Čak i ako je Group Policy podešavanje za **Allow delegating default credentials** omogućeno, akreditivi Protected Users u plain-text formatu neće biti keširani.
|
||
- **Windows Digest**: Počevši od **Windows 8.1 and Windows Server 2012 R2**, sistem neće keširati akreditive Protected Users u plain-text formatu, bez obzira na status Windows Digest.
|
||
- **NTLM**: Sistem neće keširati akreditive Protected Users u plain-text obliku niti NT one-way functions (NTOWF).
|
||
- **Kerberos**: Za Protected Users, Kerberos autentifikacija neće generisati **DES** ili **RC4 keys**, niti će keširati akreditive u plain-text formatu ili dugoročne ključeve nakon inicijalnog dobijanja Ticket-Granting Ticket (TGT).
|
||
- **Offline Sign-In**: Za Protected Users se neće kreirati keširani verifikator pri prijavi ili otključavanju, što znači da offline prijava nije podržana za ove naloge.
|
||
|
||
Ove zaštite se aktiviraju u trenutku kada se korisnik koji je član **Protected Users group** prijavi na uređaj. To osigurava da su ključne mere bezbednosti na mestu kako bi se zaštitilo od različitih metoda kompromitovanja akreditiva.
|
||
|
||
Za detaljnije informacije, konsultujte zvaničnu [dokumentaciju](https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group).
|
||
|
||
**Tabela iz** [**the docs**](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory)**.**
|
||
|
||
| Windows Server 2003 RTM | Windows Server 2003 SP1+ | <p>Windows Server 2012,<br>Windows Server 2008 R2,<br>Windows Server 2008</p> | Windows Server 2016 |
|
||
| ----------------------- | ------------------------ | ----------------------------------------------------------------------------- | ---------------------------- |
|
||
| Account Operators | Account Operators | Account Operators | Account Operators |
|
||
| Administrator | Administrator | Administrator | Administrator |
|
||
| Administrators | Administrators | Administrators | Administrators |
|
||
| Backup Operators | Backup Operators | Backup Operators | Backup Operators |
|
||
| Cert Publishers | | | |
|
||
| Domain Admins | Domain Admins | Domain Admins | Domain Admins |
|
||
| Domain Controllers | Domain Controllers | Domain Controllers | Domain Controllers |
|
||
| Enterprise Admins | Enterprise Admins | Enterprise Admins | Enterprise Admins |
|
||
| | | | Enterprise Key Admins |
|
||
| | | | Key Admins |
|
||
| Krbtgt | Krbtgt | Krbtgt | Krbtgt |
|
||
| Print Operators | Print Operators | Print Operators | Print Operators |
|
||
| | | Read-only Domain Controllers | Read-only Domain Controllers |
|
||
| Replicator | Replicator | Replicator | Replicator |
|
||
| Schema Admins | Schema Admins | Schema Admins | Schema Admins |
|
||
| Server Operators | Server Operators | Server Operators | Server Operators |
|
||
|
||
## References
|
||
|
||
- [CreateProcessAsPPL – minimal PPL process launcher](https://github.com/2x7EQ13/CreateProcessAsPPL)
|
||
- [STARTUPINFOEX structure (Win32 API)](https://learn.microsoft.com/en-us/windows/win32/api/winbase/ns-winbase-startupinfoexw)
|
||
- [InitializeProcThreadAttributeList (Win32 API)](https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-initializeprocthreadattributelist)
|
||
- [UpdateProcThreadAttribute (Win32 API)](https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-updateprocthreadattribute)
|
||
- [LSASS RunAsPPL – background and internals](https://itm4n.github.io/lsass-runasppl/)
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|