One Day SecOne Day Sec

Penetration Techniques - RID Hijacking of Windows Accounts

Onedaysec
4 min read
0 views
docx image 1770017331423 0 6c99d3caf1

0x00 Preface

---

In the previous article "Penetration Techniques - Account Hiding in Windows Systems", we introduced the technique of creating hidden accounts through account cloning by copying the F key value from the target account's corresponding registry entry, allowing the hidden account to gain identical permissions.

If we consider an alternative approach—overwriting part of the content of the F key in the target account's corresponding registry entry onto an existing account—can the existing account then acquire the target account's permissions?

This is the method to be introduced in this article—RID Hijacking.

Note:

This method was first publicly disclosed in December 2017 at the following address:

http://csl.com.co/rid-hijacking/

0x01 Introduction

---

This article will cover the following:

  • Methods of RID Hijacking
  • Implementation approach for script writing
  • Exploitation analysis
  • Defense Detection

0x02 Related Concepts

---

SID

Full name: Security Identifiers, a variable-length structure used by the Windows system to uniquely identify users or groups

Official documentation address:

https://msdn.microsoft.com/en-us//library/windows/desktop/aa379594(v=vs.85).aspx

SID contains the following information:

  • The revision level of the SID structure
  • 48-bit identifier authority value
  • relative identifier (RID)

Example

Execute 'whoami /all' in the Windows command line to obtain the current user's SID, as shown in the figure below

Example — technical illustration 1

SID is: S-1-5-21-2752016420-1571072424-526487797-1001

S indicates that the string is an SID

1 indicates the version number of the SID

5-21-2752016420-1571072424-526487797 corresponds to the ID authority

1001 indicates the RID

RID

Windows system accounts correspond to fixed RIDs:

  • 500: ADMINISTRATOR
  • 501: GUEST
  • 502: krbtgt (domain environment)
  • 512: Domain Admins (domain environment)
  • 513: Domain Users (domain environment)
  • 514: Domain Guests (domain environment)
  • 515: Domain Computers (domain environment)
  • 516: Domain Controllers (domain environment)

0x03 RID hijacking method

---

For Windows systems, the registry key HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names contains a list of all accounts in the current system. The default value of each account corresponds to the registry location of that account's detailed information (i.e., the hexadecimal representation of the RID).

Note:

System privileges are required to read this information.

Example as shown in the figure:

0x03 RID hijacking method — technical illustration 2

The default registry value for account a is 0x3e9.

Note:

Account a has standard user privileges.

The registry location for detailed information is HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000003E9.

Detailed information is shown in the figure below:

0x03 RID hijacking method — technical illustration 3

The content of the F key is shown in the figure below:

0x03 RID hijacking method — technical illustration 4

Offset positions 0x30f and 0x31f correspond to the RID.

Due to little-endian byte storage, the RID value obtained from the F key in the above figure is 0x03E9, which converts to decimal 1001.

Log in with account a, execute whoami /all to obtain the SID of account a, as shown below.

0x03 RID hijacking method — technical illustration 5

Same content

Test 1: Impersonating the built-in administrator account ADMINISTRATOR

Modify the RID of account a to 500 (fixed value, representing the Windows system built-in administrator ADMINISTRATOR), corresponding to hexadecimal 01F4, as shown below.

Test 1: Impersonating the built-in administrator account ADMINISTRATOR — technical illustration 6

Note:

Account a needs to log in again to take effect.

Log in to account a, account a inherits the permissions of ADMINISTRATOR and becomes an administrator.

The login username is: original username.machine name, as shown below.

Test 1: Impersonating the built-in administrator account ADMINISTRATOR — technical illustration 7

The user folder also changes accordingly, as shown below.

Test 1: Impersonating the built-in administrator account ADMINISTRATOR — technical illustration 8

Intuitive understanding:

Account a changed to new account a.WIN-BH7SVRRDGVA, inheriting ADMINISTRATOR privileges

Test 2: Impersonating administrator account 1

Created new administrator account 1 with RID 1000 (0x03e8), as shown below

Test 2: Impersonating administrator account 1 — technical illustration 9

Modified the RID of account a to 1000 (0x03e8)

After modification, as shown below

Test 2: Impersonating administrator account 1 — technical illustration 10

Logged back into account a

Account a inherited the privileges of account 1 and became an administrator

The login username changed to 1, while executing whoami /all shows the username as a, but with RID 1000 (account 1's RID), as shown below

Test 2: Impersonating administrator account 1 — technical illustration 11

Environment variables correspond to user 1, as shown below

Test 2: Impersonating administrator account 1 — technical illustration 12

Intuitive understanding:

Account a transformed into the original account 1, inheriting its privileges, but retains the display of account a in some functions

0x04 Implementation Approach for Script Writing

---

Implementation Approach

  1. Obtain SYSTEM privileges
  2. Read registry information of the specified account
  3. Modify the fixed offset address, specifying it as the new RID
  4. Import the registry to complete the modification

For specific implementation details, refer to the instructions in the article 'Penetration Techniques – Account Hiding in Windows Systems'

Reference code:

An open-source project

Since the functionality is relatively simple, the implementation code is left for the reader to complete

Corresponding Metasploit module: windows/manage/rid_hijack

0x05 Exploitation Analysis

---

For RID Hijacking, the implementation principle is straightforward:Locate the registry file of the account and modify the location representing the RID information.

However, the following shortcomings exist in its exploitation:

  • The account must be logged in again to take effect.
  • Environment variables are modified, affecting normal usage.
  • The display of the username has issues and is easily detectable.
  • Simulating ADMINISTRATOR privileges will create a new user folder.

Exploitation Scenarios

  1. Enable the guest account, modify the RID, log in to the guest account to obtain high privileges.
  2. Modify the RID of a low-privilege user and log in to gain high privileges.

0x06 Defense and Detection

---

From a defensive perspective, the attacker first needs to obtain system privileges on the current system.

Detection Approach:

  • Check if there are any anomalies in the information under the registry key HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\.
  • Check if the guest account has been enabled.

0x07 Summary

---

This article introduces the implementation method of RID Hijacking, analyzes the exploitation conditions, and provides defense recommendations

Related Questions & Answers

What are typical exploitation scenarios where RID hijacking is used?

Common scenarios include enabling the Guest account (RID 501) and modifying its RID to 500 (Administrator), then logging in to gain full administrative privileges. Another approach is to find an existing low-privilege user, change the user's RID to that of a high-privilege domain or local account (e.g., Domain Admins RID 512 in a domain environment), and log in to inherit those permissions. The technique can also combine with [remote registry access](/news/penetration-techniques-remote-registry-in-windows) for targeting other machines on the network.

What are the limitations and detection risks of using RID hijacking in a penetration test?

RID hijacking has several shortcomings: the modified account must log in again to take effect, environment variables point to the impersonated user (causing profile confusion), the username display may show as `username.machine` or the original account name in some functions, and impersonating the Administrator creates a new user folder. These anomalies make the technique easily detectable. Defenders should regularly audit the registry under `HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account` for unexpected RID changes and check if the [guest account](/news/penetration-techniques-enabling-anonymous-access-shares-on-windows-systems-via-command-line) has been enabled without authorization.

How can an attacker perform RID hijacking on a Windows system?

First, the attacker must obtain SYSTEM privileges. Then they navigate to `HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users` and locate the registry key corresponding to the low-privilege account (e.g., `000003E9` for RID 1001). They edit the F key, setting the little-endian values at offsets 0x30f and 0x31f to the hexadecimal representation of the target RID (e.g., `01F4` for the built-in Administrator RID 500). After logging out and back in, the account inherits the target's privileges. The [Metasploit module `windows/manage/rid_hijack`](https://www.rapid7.com/db/modules/post/windows/manage/rid_hijack/) automates this process.

What is RID hijacking and how does it differ from account cloning?

RID hijacking is a privilege escalation technique that modifies the Relative Identifier (RID) portion of an account's Security Identifier (SID) in the Windows registry, allowing a low-privilege account to inherit the permissions of another account. Unlike [account cloning](/news/penetration-techniques-account-hiding-in-windows-systems), which copies the entire F key registry entry, RID hijacking overwrites only the RID values at offsets 0x30f and 0x31f in the target account's F key, granting the same privileges upon next login.

Continue Reading