Penetration Techniques - Exploitation of net session in Windows

0x00 Preface

---

In Windows systems, using the net use command enables remote connections to shared resources on other computers in the network. After establishing a connection, a net session is created.

During penetration testing, if we gain access to a Windows host and discover a net session, we can exploit this net session by using its token to create a process.

0x01 Introduction

---

This article will cover the following topics:

• Methods to view net sessions
• Exploitation of net sessions
• Clearing net sessions
• Exploitation strategies
• Defense recommendations

0x02 Test Environment

---

COMPUTER01:

• Win7 x64
• A host within the domain
• 192.168.10.2
• Logged in with account test1

DC:

• Server2008 R2 x64
• Domain controller server
• 192.168.10.1

On the DC, using the domain administrator account Administrator to remotely connect to COMPUTER01 via net use, as shown below

0x03 Method for viewing net session

---

1. cmd command

As shown in the figure below

2. LogonSessions

Download link:

https://docs.microsoft.com/en-us/sysinternals/downloads/logonsessions

As shown in the figure below

It can be observed that the Logon type for net session is Network

3. C++ Implementation

First, enumerate the current Logon Sessions using the Windows API LsaEnumerateLogonSessions()

Then, use LsaGetLogonSessionData() to obtain detailed information for each Logon Session

In programming, note that SID and time cannot be displayed directly; format conversion is required

Open-source code address:

An open-source project

The code outputs results in the format of LogonSessions

4. mimikatz

as shown in the figure below

The ID corresponding to TEST\Administrator is 6919466

Supplement mimikatz commands

View current token:

Restore process token:

Impersonate as system:

Impersonate as domain admin:

Impersonate as enterprise admin:

Impersonate as admin:

Impersonate as token with ID 123456:

Exploitation of 0x04 net session

---

The token of net session is stored in the lsass process, as shown in the figure below

In terms of exploitation, net session is equivalent to exploiting its token

1、mimikatz

Impersonate as token with ID 6919466:

As shown in the figure below

Note:

The above operation only changed the Thread Token

There are two types of tokens in Windows: Primary Token and Impersonation Token

Primary Token corresponds to Process Token, each process has a unique Primary Token

Impersonation Token corresponds to Thread Token, which can be modified

Next, use this token to create a process cmd.exe:

However, this command does not use the new Thread Token, meaning the process cmd.exe is not launched as TEST\Administrator

The reason is as follows:

https://github.com/gentilkiwi/mimikatz/blob/110a831ebe7b529c5dd3010f9e7fced0d3e3a46c/mimikatz/modules/kuhl_m_process.c#L38

As shown in the figure below

https://github.com/gentilkiwi/mimikatz/blob/110a831ebe7b529c5dd3010f9e7fced0d3e3a46c/modules/kull_m_process.c#L490

As shown in the figure below

When mimikatz executes the process::start command, it uses CreateProcess to create the process without passing a token

Solution:

Modify the source code of mimikatz to use CreateProcessAsUser() for process creation, which allows passing a Token

Of course, we can also use other tools to achieve this process

2、Using incognito

Open-source code address:

https://github.com/fdiskyou/incognito2

Note:

In a previous article titled 'Penetration Techniques – Token Theft and Exploitation,' the usage of incognito was introduced

List current tokens:

Start cmd.exe as "TEST\Administrator":

As shown in the figure below

net session exploitation succeeded, process cmd.exe launched with user "TEST\Administrator", as shown in the figure below

0x05 Clearing net session

---

1. cmd command

2. Delete net use connections

Initiator deletes net use connections:

0x06 Exploitation ideas

---

1. Local privilege escalation

If local administrator privileges have not been obtained yet, but SeImpersonate or SeAssignPrimaryToken privileges have been acquired, the token in net session can be used to create new processes, achieving privilege escalation

Note:

As mentioned in previous articles 'Analysis of Windows Local Privilege Escalation Tool Juicy Potato' and 'Penetration Techniques – Exploitation of Nine Windows Privileges', this method has been discussed.

2. Domain Penetration

Depending on the permissions of the net session, the newly created process can inherit the token of the net session.

0x07 Defense Recommendations

---

1. Restrict user permissions within the domain environment and avoid using domain administrator accounts for remote connections whenever possible.

2. Remember to clear net use remote connections promptly after use.

0x08 Summary

---

This article introduces the method of creating processes using the token from net sessions, analyzes the exploitation approach, and provides defense recommendations.