LogoLogo
  • πŸ§‡Team. WAFFLE
  • κ°œμš”
  • κ°œλ…
  • 섀계
  • κ΅¬ν˜„
    • Infrastructure
    • Breadcrumbs
  • Adversary Simulation
    • Part 1. Victim Client
    • Part 2. AD FS
  • λ‘œκΉ…Β·νƒμ§€
    • 1. lsass dump
    • 2. impacket - psexec.py
    • 3. ADFSdump.exe
    • 4. Golden SAML μ‚¬μš©
  • 의의 및 ν•œκ³„
  • 참고자료
Powered by GitBook
On this page
  • 1. AD μ„€μ •
  • 2. μ·¨μ•½ν•œ λ³΄μ•ˆ μ„€μ •
  • 3. μžμ„Έν•œ λ‘œκΉ… μ„€μ •
  • 4. μžλ™ν™” 배포 μ„€μ •
  1. κ΅¬ν˜„

Infrastructure

Previousκ΅¬ν˜„NextBreadcrumbs

Last updated 1 month ago

1. AD μ„€μ •

  1. AD Machine

    • AD DS(Domain Server 및 Main Domain Controller) ECAMAZ-6E3DNME

      • Domain은 pbl-waffle.swu (AD-WAFFLE)

      • AD CS(Certificate Services)의 역할도 겸함

    • AD FS(Fedestration Services) adfs2

    • Victim Client client

    ⚠️ λͺ¨λ“  InstanceλŠ” 같은 Subnet에 μžˆμ–΄μ•Ό ν•œλ‹€.

  2. AD Account(User)

    • DS Administrator

    • fsadmin@pbl-waffle.swu

    • aws.admin@pbl-waffle.swu

    βœ… 계정듀은 각 Hostμ—μ„œ 둜컬 κ΄€λ¦¬μž κΆŒν•œμ„ κ°–κ³ μžˆμŒ

2. μ·¨μ•½ν•œ λ³΄μ•ˆ μ„€μ •

ν•œ λ²ˆμ— λͺ¨λ“  섀정을 풀기보닀, 곡격 쀑 λ§‰νžˆλŠ” 뢀뢄이 있으면 ν’€μ–΄λ‚΄λŠ” μ‹μœΌλ‘œ μ§„ν–‰ν•˜μ˜€λ‹€. μ•„λž˜λŠ” 곡격 μˆ˜ν–‰ κ³Όμ • 쀑 ν’€μ–΄λ‚Έ λͺ¨λ“  섀정을 μ’…ν•©ν•˜μ—¬ μž‘μ„±ν•˜μ˜€λ‹€.

μ‹€μ œλ‘œ μ‚¬μš©λ˜λŠ” 인프라보닀 아무것도 μ—†λŠ” μΈν”„λΌμ—μ„œ κ³΅κ²©ν•˜λŠ” 게 더 μ–΄λ ΅λ‹€λŠ” 것을 μ²΄ν—˜ν•  수 μžˆλ‹€.

  1. [Victim] [AD FS] Windows Defender - Real-time protection Off

  2. [AD FS] WMI μ„œλΉ„μŠ€ λ°©ν™”λ²½ Open 

    Enable-NetFirewallRule -DisplayGroup "Windows Management Instrumentation (WMI)"

  3. [AD FS] WMI κ΄€λ ¨ 둜컬 λ°©ν™”λ²½ ν•΄μ œ 

    New-NetFirewallRule -DisplayName "Allow SMB (TCP 445)" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Allow
New-NetFirewallRule -DisplayName "Allow RPC (TCP 135)" -Direction Inbound -Protocol TCP -LocalPort 135 -Action Allow
New-NetFirewallRule -DisplayName "Allow DCOM High Ports" -Direction Inbound -Protocol TCP -LocalPort 49152-65535 -Action Allow
New-NetFirewallRule -DisplayName "Allow Named Pipes" -Direction Inbound -Protocol TCP -LocalPort 139 -Action Allow

  4. [AD FS] WMI κΆŒν•œ λΆ€μ—¬

    wmimgmt.msc μœ ν‹Έλ¦¬ν‹°λ₯Ό μ‹€ν–‰ν•˜κ³  WMI 도메인에 λ³΄μ•ˆ 섀정을 ν•œλ‹€.

    도메인에 λ‹€μŒ μœ„μΉ˜μ— λŒ€ν•œ μ‚¬μš© κΆŒν•œμ„ ν• λ‹Ήν•œλ‹€.

    • root/CIMv2

    • root/Default

    • root/SecurityCenter

    • root/SecurityCenter2

    각 도메인에 λ‹€μŒ μ‚¬μš© κΆŒν•œμ„ ν• λ‹Ήν•œλ‹€.

    • Execute Methods

    • Enable Account

    • Remote Enable

    • Read Security

  5. [AD FS] DCOM 원격 μ ‘κ·Ό κΆŒν•œ μΆ”κ°€

    Add-LocalGroupMember -Group "Performance Log Users" -Member "AD-WAFFLE\\fsadmin"
Add-LocalGroupMember -Group "Distributed COM Users" -Member "AD-WAFFLE\\fsadmin"

  6. [AD CS] μΈμ¦μ„œ: Private Key Exportable μ„€μ •ν•˜μ—¬ λ°œκΈ‰ [AD FS] ν•΄λ‹Ή μΈμ¦μ„œ 등둝 β†’ ADFSDump μ‹œ dkmκ³Ό tksκ°€ μ œλŒ€λ‘œ 좜λ ₯되기 μœ„ν•¨

3. μžμ„Έν•œ λ‘œκΉ… μ„€μ •

β€» μ‹€μ œλ‘œ λͺ¨λ“  Audit λ‘œκΉ…μ„ ν™œμ„±ν™”ν•˜λ©΄ μ»΄ν“¨ν„°μ˜ μ„±λŠ₯이 μ €ν•˜λ  수 μžˆμœΌλ‹ˆ ν•„μš”μ— 따라 ν™œμš©ν•΄μ•Όν•œλ‹€.

  1. [AD DS] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics λͺ¨λ“  κ°’ 5둜 λ³€κ²½

  2. [AD DS] gpmc.msc λͺ¨λ“  Categories Configure

  3. [AD DS] AD Management - Domain - Properties - Security - Auditing λͺ¨λ‘ ν™œμ„±ν™”

  4. [AD FS] SSMS(SQL Server Management Studio)μ—μ„œ Audit Log ν™œμ„±ν™”

  5. [AD FS][Victim Client] Local Security Policy - Audiot Policy 전체 ν™œμ„±ν™”

4. μžλ™ν™” 배포 μ„€μ •

νŠΉμ • BR을 λ‹€μˆ˜ ν˜ΈμŠ€νŠΈμ— ν•œλ²ˆμ— λ°°ν¬ν•˜κΈ° μœ„ν•΄μ„œ νŒŒμ›Œμ‰˜ 슀크립트λ₯Ό μ‚¬μš©ν•˜μ˜€λ‹€.

이 λ•Œ, 슀크립트λ₯Ό 배치파일 없이 μ‹€ν–‰μ‹œν‚€κΈ° μœ„ν•΄μ„œλŠ” λ³„λ„μ˜ 섀정이 ν•„μš”ν•˜λ‹€.

[컴퓨터 ꡬ성 β†’ μ •μ±… β†’ 관리 ν…œν”Œλ¦Ώ β†’ Windows κ΅¬μ„±μš”μ†Œ β†’ Windows Power Shell] κ²½λ‘œμ—μ„œ "슀크립트 μ‹€ν–‰ ν™œμ„±ν™”"λ₯Ό μ‚¬μš©μœΌλ‘œ μ„€μ •ν•˜κ³ , "λͺ¨λ“  슀크립트 ν—ˆμš©"을 μ„ νƒν•œλ‹€.

μ°Έκ³ :

https://docs.genians.com/release/ko/authentication/enabling-authentication/sso/ms-wmi.html