Task 1: Macro Creation and Delivery

After installing Microsoft Word on the Windows 10 VM, open Word.

Making a RAT

Generating the payload through the Kali Attack VM.

Host it as usual with

python3 -m http.server 80 On another terminal.

Set up a session with msf.

Navigate to View -> Macros -> View Macros

Enter "AutoOpen" as the Macro name and click create.

Within VBA editor, you will be met with the default content. Paste the macro code provided within the assignment document.

Replace the line bolded within the document with your IP and port in use.

After pasting the code, press the green "run" button shown in the picture. Once successful, a meterpreter session will start.

This is a successful session. You can use getuid or sysinfo for confirmation.

How the macro achieves code execution

The macro can be executed by absuing the Word's ability to run VBA automatically when a document is open. When the document opens and macros are eanbled, Word looks for a subroutine named AutoOpen and executes it without any more interactions. While the document itself is no exploit, it can weaponize trusted and already built-in Windows scripting component to run a second stafe payload.

MITRE ATT&CK Technique IDs

• T1566: Phishing
• T1294.002: User Execution: Malicious File
• T1105: Ingress Tool Transfer

Questions

#1: Why is the "AutoOpen" macro name significant?

AutoOpen is a reserved macro name in Microsoft Word. Word automatically executes any macro named AutoOpen the moment a document is opened, with no menu required for the user.

#2: What defensive measures can organizations implement to block macro-based attacks?

• Disable macros by default

System administrators can configure office with GPO, (Group Policy Object)to disable all macros.

• Only Allow Signed macros

Require that macros be digitally signed by a trusted publisher, and block all unsigned macros. Unsigned macros can be flagged by Antivirus.

Video

Backdoor an Executable

Lab setup

Download PuTTY to use to backdoor.

Start sudo systemctl start ssh. This is so you can prove backdoored PuTTY still connects later.

Build the backdoored exe with msfvenom. The -x flag sets the template, and -k keeps the original app working

It will confirm saying that it was saved.

Host it as usual on the web server on port 80.

When you go onto your Windows 10 VM, navigate to 10.0.17.67:80/putty_backdoored.exe. It will give you a download, just double click it to have it downloaded.

Once double clicked, a pop up is likely going to ask if you are sure you want to run the file. Choose yes

You will get a normal PuTTY menu. To prove it works normally, you can SSH into the kali server using port 22.

Use PuTTY as normal within the victim Windows 10 to show that it is working as normal.

Video

Credential-Based Lateral Movement with PSExec

Configure the Windows 10 VM to allow PSExec by adding the required registry key

REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

Disable all Windows Firewall on the Windows 10 VM.

Go to Kali, and set up an msf exploit with psexec this time.

This is what your payload should look like. Double check if everything was input correctly with show options

Once you hit run, it will look a little different.

Confirmation with common commands

5 enumeration commands of my choice

Explanation of PSExec and how it achieves lateral movement.

The PSExec module authenticates to the target system over SMB using stolen credentials. Once it is authenticated it uploads a service binary to the Admin share, which creates a Windows service pointing to that binary and starts it. Windows services run as NT AUTHORITY\SYSTEM by default, which is why the session had the highest possible privledge level on the Windows machine. The reverse_https technique blends in with normal HTTPS web traffic which is why it makes detection harder.

MITRE ATT&CK Techniques

• T1021.002 - Remote Services: SMB/Windows Admin Shares

• T1078 - Valid accounts

• T1071.001 Application Layer Protocol: Web Protocols

Questions

1. Why use reverse_https instead of reverse_tcp?

HTTPS traffic blends with normal web browsing, is encrypted which prevents payload inspections, and avoids the more well known Meterpreter TCP signatures that are usually flags. HTTPS callbacks survive longer in monitored environments

2. Why is using a non default port important?

The port 4444 is Metasploit's default and is explicitly signature in almost all firewall ruleset. A port such as 8443 is not default and avoid the detection rules and blends in which expected traffic, as 8443 is a common HTTPS alternate port.

3. Which enumeration command revealed the most valuable information for lateral movement?

hashdump revealed the moist information for lateral movement. The hashes it showed can be used in the pass=-the-hash attacks against other systems on the network without making it harder for the attacker.

4. How does getuid confirm the stolen credential attack was successful?

getuid returned NT AUTHORITY\SYSTEM confirms the attack was successful. Although the output showed system instead of champuser, this is PSExec behavior. It authenticates over SMB using the stolen credentials, then deploys a service than runs as system.

Video

RDP as Initial Access

Head to Windows VM to turn on RDP.

Press Win + R for run, and type sysdm.cpl and enter. You will be met with this screen.

Head to the remote tab.

Hit "Allow remote connections to this computer"

Then hit Apply -> Okay.

Check if port 3389 is listening on port 3389.

Download remmina through the Kali terminal

Open Remmina with just remmina

Once open, you'll be met with a new terminal. Press on the + Sign.

Use the IP and credentials to remote into the Windows VM

Continue to "connect". Now you will be in the Windows VM successfully.

How RDP is used for initial access and lateral movement

RDP gives full access to a remote Windows system. Threat actors can use RDP in different ways. For initial access, they can obtain credentials through phishing, credential dumps, and brute force and then authenticate over port 3389 from the internet. Groups such as Scattered Spider have used this technique. For lateral movement, attackers who already have a foothold use harvested internal credentials to RDP between machines inside the network, and move towards higher priority targets.

MITRE ATT&CK Techniques

• T1021.001 Remote Services: RDP

• T1078 - Valid accounts

• T1133 External Remote services

Questions to answer

1. How does RDP session differ from a MeterPreter session in terms of attacker capabilities?

• RDP gives a full desktop, and the attacker can see and interact with the computer fully as if they are actually there. They can open anything deemed as useful. Meterpreter is a command interface, that can process inject, hashdump, and pivot- but does not have graphical interface. RDP can be used better for situational awareness and manual interaction while Meterpreter is better for more "sneaky" and scripted attacks.

2. Why is RDP a preferred method for attackers who want to interact with a graphical environment?

RDP gives the attackers full interactive desktop which is the same what a real user sees. They can use this to access different applications with web portals, database management tools, and more. You can also grab credentials if they are stored within a password manager like Google's ability to remember passwords.

3. What network monitoring indicators would suggest unauthorized RDP access?

One of them would be if a user that usually would not use RDP, like an insider IP, a sales person for example, be using RDP sessions would likely be flagged. Also RDP sessions outside of business hours would likely be flagged and investigated as well. Multiple failed attempts that could be followed with a successful login can be brute force, which would also be flagged.

4. How can organizations restrict RDP access to reduce the attack surface?

Disabling RDP on systems that do not need it would be a big way to avoid attacks like this. They can also restrict access with firewall rules so only specific trusted IPs (like a system administrator) would be able to RDP into other work stations.

Video