Week 3 Lab 2 LivingOffThe Land Binaries‐ExecutionAndDocumentation - elijah-gronlund/SEC-335-01-Eth-Hacking-Pen-Testing GitHub Wiki

This lab will be focusing on exploring the LOLBINS on my machine and understanding how they work and what threat actors can gain from them.

LOLBins Table

#	Binary	Full Path	Legitimate Function	Observed Abuse	ATT&CK ID(s)
1	wmic.exe	`C:\Windows\System32\wbem\WMIC.exe`	Command-line front end for WMI, letting admins query and manage hardware, configuration, and processes on local or remote machines.	Launches `ntdsutil` through `wmic process call create` to trigger an AD database copy, and is also used to enumerate volumes and services during recon.	T1047
2	ntdsutil.exe	`C:\Windows\System32\ntdsutil.exe`	Native AD maintenance tool intended for domain controller upkeep and directory service management.	Generates an installation-media copy of `ntds.dit` plus the SYSTEM/SECURITY hives from a shadow copy, enabling offline hash extraction and cracking.	T1003.003
3	vssadmin.exe	`C:\Windows\System32\vssadmin.exe`	Built-in tool for administering the Volume Shadow Copy Service, primarily used for backup/restore operations.	Running `vssadmin create shadow /for=C:` sidesteps the OS-level file lock protecting the live `ntds.dit`, giving access to an otherwise-inaccessible file.	T1006
4	netsh.exe	`C:\Windows\System32\netsh.exe`	Native shell for configuring network interfaces, firewall rules, and related settings.	The `netsh interface portproxy add v4tov4` command sets up a hidden port-forwarding rule, effectively standing up a covert backdoor channel.	T1090.001, T1112
5	PowerShell	`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`	Microsoft's native automation and scripting environment for administrative tasks.	`Get-EventLog security -instanceid 4624` is used to surface successful logon events, and PowerShell is also the vehicle for running FRP-based proxy tooling.	T1059.001
6	reg.exe	`C:\Windows\System32\reg.exe`	Command-line interface to the Windows Registry, used for reading and modifying registry keys.	`reg query` searches out stored remote-access credentials, while `reg save hklm\sam` exports the SAM hive for offline hash extraction.	T1012, T1003.002
7	cmd.exe	`C:\Windows\System32\cmd.exe`	The default Windows command-line interpreter for running commands and scripts.	Functions as the wrapper for almost every other command in the chain, and its output redirection is used to mask what's actually being run.	T1059.003
8	net.exe	`C:\Windows\System32\net.exe`	Utility for administering user accounts, groups, shares, and network connections.	Commands such as `net localgroup administrators` and `net group "Domain Admins" /dom` are used to map out privileged accounts and groups.	T1069.002, T1087.001
9	tasklist.exe	`C:\Windows\System32\tasklist.exe`	Built-in tool that enumerates currently running processes on a system.	The verbose flag (`tasklist /v`) is run to pull a detailed process inventory before deciding on next steps.	T1057
10	whoami.exe	`C:\Windows\System32\whoami.exe`	Utility that reports the active user's account name, domain, SID, and assigned privileges.	Run to verify the current privilege level and account context immediately after moving laterally to a new host.	T1033
11	netstat.exe	`C:\Windows\System32\netstat.exe`	Native tool for displaying active TCP/UDP network connections.	`netstat -ano` is run to spot other systems already communicating with or compromised alongside the current host.	T1049
12	ping.exe	`C:\Windows\System32\ping.exe`	Basic connectivity-testing utility that sends ICMP echo requests.	`ping -n 1 <IP>` is used repeatedly to sweep the internal network and map out which hosts are reachable.	T1016.001

Questions

Which LOLBin appears in both advisories?

There are many different LOLBins that appear in both however most of them did not have command examples. There were 11 that I found in both that did in fact have command examples. Those 11 being the following. wmic, ntdsutil, netsh, PowerShell, net, cmd.exe, tasklist, whoami, netstat, ping, and ipconfig.

Why do state-sponsored actors prefer LOLBins over custom malware?

Stat Sponsored actors prefer LOLBins over custom malware because for custom malware you have to install it and find a way to execute it without being detected by security measures. Meanwhile LOLBins come already pre installed on the system and are trusted so this way a stat actor can simply run them and blend into regular computer traffic instead of sticking out like a sore thumb when using the custom malware. No fancy setup or build just run them.

What is the "living off the land" naming convention based on?

This naming convention is based off of attackers utilizing the tools and resources around them in order to survive. It is about repurposing the tools and commands around you in order to use them for malicious activity instead of what maybe was intended. It relies on what is already in the box rather then something you have to bring into it.

Discovery and Reconnaissance LOLBin Execution

Command : systeminfo

Binary syteminfo.exe

MITRE ATT&CK ID and Technique Name: T1082 System Information Discovery

Photo Evidence:

What it reveals to a threat actor: This reveals a ton of different information about the host machine and the configuration data as well as some potential security vulnerabilities that a threat actor would use to try and find an exploit. they could use the OS version, BIOS version, the information regarding domain and more.

Command: Tasklist /v

Binary: tasklist.exe

MITRE ATT&CK ID and Technique Name: T1057 Process Discovery. T1007 System Service Discovery

Photo Evidence:

What it reveals to a threat actor: This shows the threat actor all of current and running process the users has running currently. It also provides what users are running each process. This can give threat actors insight into if security software like windows defender is currently active and running.

Command: whoami

Binary: whoami.exe

MITRE ATT&CK ID and Technique Name: T1033 System Owner/User Discovery

Photo Evidence:

What it reveals to a threat actor: This is a very simple one that tells the threat actor some important but very simple information. it shows them the current user and identity they are on the machine is. It also shows current domain/computer name.

Command: netstat -ano

Binary: netstat.exe

MITRE ATT&CK ID and Technique Name: T1049 System Network Connections Discovery

Photo Evidence:

What it reveals to a threat actor: This shows the threat actor all active network connections that the machine has as well as the listening ports and PID that is on the machine. This command allows them to see what services are also exposed to the outside world and could be used and exploited.

Command: ping -n 1

Binary: ping.exe

MITRE ATT&CK ID and Technique Name: T1018 Remote System Discovery

Photo Evidence:

What it reveals to a threat actor: Even though this command is very simple it is also very powerful. It is a command that allows the threat actor to verify if the host has network connectivity, while also only creating a low amount of network traffic. The -n 1 flag is one that forces the command to run only 1 ping instead of the regular four making it much harder to detect.

Command: net group "Domain Admins" /dom | net localgroup administrators

Binary: net.exe

MITRE ATT&CK ID and Technique Name: T1069.001 Permissions Group Discovery: Local Groups, T1069.002 Permissions Group Discovery: Domain Groups

Photo Evidence:

What it reveals to a threat actor: This command is one that allows threat actors to see all current user account that hold administrative privileges on the network. It can give a threat actor a list of accounts they can target in order to escalate there permissions and gain access to more privileges. This machine however is not connected to a domain so there is no information regarding that command.

Command: curl ip-api.com/json/

Binary: curl.exe

MITRE ATT&CK ID and Technique Name: T1016 System Network Configuration

Photo Evidence:

What it reveals to a threat actor: Running this command would allow a threat actor to find out the external IP and find the actual location. the ip-api.com is a geolocation service and using it allows the threat actor to get a JSON block containing the compromised system public data.

Command: ipconfig /all

Binary: ipconfig.exe

MITRE ATT&CK ID and Technique Name: T1016 System Network Configuration

Photo Evidence:

What it reveals to a threat actor: When a threat actor runs this command it would tell them a great deal of information about the machines network environment, such as the IP address and subnet mask. This would allow the threat actor to ping other computers and identify them. It also tells the threat actor the DNS and DHCP server which are pretty important parts of the networks.

Questions

Which binary revealed the most useful information for lateral movement?

I am under the impression that netstat would be the most useful command that we have done here so far. This is because it is a command that reveals all currently established connections and ports. This gives the attacker a lot of information and many different ways that they could take in order to try and exploit this machine further. They can also see what sort of things are exposed on the machine.

Which binary's output would be most suspicious to a defender?

The Curl command is the one that would raise the most suspicion for me as a defender this is because it provides information the average user would not need and the only real useful bit of information to an average user would be the IP address however there are much easier and better ways to find that. Leading me to believe the person running this has malicious intent.

Why might a threat actor use wmic.exe instead of PowerShell for system queries?

PowerShell is a program that uses Script block logging meaning every string and command you type and execute using it are documented in Windows Event Log. However the program wmic.exe does not use this script block logging. This allows for threat actors to go undetected and the commands they run remain unlogged.

Execution, Download, and Defense Evasion

Command:

echo Harmless Certutil LOLBin test > C:\temp\certutil-origional.txt
certutil.exe -encode C:\temp\certutil-original.txt C:\temp\certutil-encoded.txt
del C:\temp\certutil-origional.txt
certutil.exe -decode C:\temp\certutil-encoded.txt C:\temp\certutil-decoded.txt
type C:\temp\certutil-decoded.txt

Binary: certutil.exe

MITRE ATT&CK ID and Technique Name: T1105 Ingress Tool Transfer, T1036.005 Masquerading: Match Legitimate Name or Location

Photo Evidence:

Why this technique evades detection: Certutil is a legitimate Microsoft certificate utility and it can do a lot of different things from downloading files from a webserver to encoding and decoding files. Using a trusted binary allows for a threat actor to encode information and decode it without installing any programs

command:

powershell.exe -Command "Invoke-WebRequest -Uri 'https://www.example.com/' -OutFile 'C:\temp\powershell-demo.html'"
dir C:\temp\powershell-demo.html

Binary: powershell.exe

MITRE ATT&CK ID: T1059.001 (related: T1105)

Photo Evidence:

Why this technique evades detection: This command uses PowerShell to retrieve files over HTTP without it requiring a separately downloaded program and since PowerShell is also a built in windows binary that is commonly used for real life administration. So malicious commands may blend in with the normal activity that windows has.

Command:

wmic process call create "cmd.exe /c echo Harmless WMIC LOLBin test > C:\temp\wmic-demo.txt"
type C:\temp\wmic-demo.txt

Binary: wmic.exe

MITRE ATT&CK ID: T1047

Photo Evidence:

Why this technique evades detection: Using WMI a threat actor can create executables with commands using built in windows management infrastructure. This is much easier for them rather then getting a whole separate execution program.

Command:

cmd.exe /c "echo Harmless CMD LOLBin test > C:\temp\cmd-demo.txt"
type C:\temp\cmd-demo.txt

Binary: cmd.exe

MITRE ATT&CK ID : T1059.003

Photo Evidence:

Why this technique evades detection: CMD is a function that is built in to windows command interpreter. This means that when you see a cmd.exe execute it does not raise any alarms of malicious intent since it is used by legitimate software and administrators.

Command: del C:\temp\cmd-demo.txt

Binary: vssadmin.exe

MITRE ATT&CK ID : T1006

Photo Evidence:

Why this technique evades detection: This is another program that evades detection because it again is a pre installed binary meaning threat actors can use it and get by detection due to it being approved by Microsoft and blending in with system traffic.

command:

netsh interface portproxy add v4tov4 listenaddress=127.0.0.1 listenport=9999 connectaddress=127.0.0.1 connectport=80
netsh interface portproxy show v4tov4

Binary: netsh.exe

MITRE ATT&CK ID: T1090 (related: T1112)

Photo Evidence:

Why this technique evades detection: Since this binary is able to redirect traffic. It allows you to direct tragic through a compromised system. Since it is a trusted windows utility this traffic seems like legitimate administrative action.

Questions

Which LOLBin can download files without triggering typical firewall alerts?

Certutil, curl.exe, bitsadmin.exe and powershell through cmdlets, all can be used in order to download files without triggering a firewall alert. This is because they are all native binary's on the system.

How can regsvr32.exe execute code without writing files to disk?

This can be used to retrieve and execute remotely hosted scriplet content through a windows component. This script can be processed without being saved first as a typical exe would need to be. This can help to reduce a bunch of file base artifacts and reduce storage consumption.

Why is msbuild.exe dangerous in environments with .NET installed?

It is a dangerous thing to have with .net installed because it does not save any files it simply runs them from the cloud allowing you to run files without seeing a paper trail. It also has the ability to process project files containing executable build logic incline .net code.

Task LOLBin Detection and Threat Report

Part A Install and Configure Sysmon

Donwload Sysmon from Microsoft as well as Sysmon XML configuration file from SwiftOnSecurity on github
Move the XML file to the unzipped sysmon folder
Run the following command to set up the config file On an administrative CMD

.\sysmon.exe -i sysmonconfig-export.xml

Photo:

Generate Sysmon process creation events

Navigate to: Event Viewer > Applications and Services Logs > Microsoft > Windows > Sysmon > Operational

`whoami`

`ipconfig`

`tasklist`

`net user`

` certutil

Questions

Which LOLBin would be hardest to detect with standard logging?

I believe that wmic.exe this is because it is a LOLBin that is used for a ton of different normal reasons which would allow malicious programs that are used with it to really go unnoticed and it makes it much harder to know if its being used improperly. Plus it logs any new processes as being started and launched by WmiPorvSE which is also used as a tool by many different system processes to complete tasks.

What is the trade-off between blocking LOLBin execution and breaking legitimate system functionality?

This is the question really, if you block LOLBins in order to keep your system safe from hackers you are also saldy blocking administrators from using a ton of the tools they need. Diagnostic scripts and software updates that all use these binaries very heavily. This is a very drastic thing to do because of how much it harms your system. So I believe that overall it is not worth it to block all of them completely.

How would you prioritize which LOLBins to monitor first?

I would prioritize any binary that is not commonly run or has no real purpose of being run. Or reason to be running on a daily basis and is only used in particular cases. Have these monitored and blocked and then have the simple normal binaries that are used again less frequently to be monitored and if they are used in a weird way flag it so that an admin may inspect it to ensure there is no malicious activity.