adityatelange / adityatelange/evil-winrm-py
[FEATURE] interactive logon type execution
- 主要言語
- Python
- スター
- 396
- フォーク
- 37
- PR マージ指標
- 30日以内にマージされた PR はありません
説明
Because we are using WinRM we have a "network" logon type which has less permissions than an "interactive" logon type. "interactive" logon type is particularly useful when using COM objects to privesc as the "NT authority\Interactive" group has much more permissions on COM objects than "NT authority\Network" but "interactive" is also useful for a lot of other purposes.
To give a concrete example, in order to display all sessions on the current machine the easiest is to run it with [RunasCs.exe](https://github.com/antonioCoco/RunasCs) like this:
```evil-winrm-py PS[...]> .\RunasCs.exe x x -l 9 "qwinsta"```
Which calls CreateProcessWithLogonW with the LOGON_NETCREDENTIALS_ONLY behind the hood. Or if plaintext password has been provided to evil-winrm-py it's even better as it would allow to have an interactive session working also for network operations such as ldap, etc (I don't think a krb key, ticket or nt hash can be used to get an interactive process).
So I was thinking about having a builtin command for it like below:
```
$ evil-winrm-py -i 192.168.100.10 -u john -p 'password'
evil-winrm-py PS[...]> interactive
evil-winrm-py PS-interactive [...]> qwinsta
evil-winrm-py PS-interactive [...]> ([ADSI]"").distinguishedName
evil-winrm-py PS-interactive[...]> exit
evil-winrm-py PS [...]>
$ evil-winrm-py -i 192.168.100.10 -u john -H 'somehash'
evil-winrm-py PS[...]> interactive
[!] password plaintext not provided, network ops won't work
evil-winrm-py PS-netonly [...]> qwinsta
evil-winrm-py PS-netonly [...]> ([ADSI]"").distinguishedName
< SOME ERROR MSG CAUSE DUMMY CREDS>
evil-winrm-py PS-netonly[...]> exit
evil-winrm-py PS [...]>
```
コントリビューションガイド
このリポジトリのコントリビューションガイドは索引されていません
調査の方向性
Start by tracing the CLI's session creation and existing WinRM logon path; the issue provides no file or test names. Done should include an interactive command that changes the prompt, supports commands such as qwinsta and ADSI operations when a plaintext password is available, warns for hash-only authentication, and returns to the original session after exit.
索引モデルが issue の本文から書いたものです。
評価
- 技術スタック
- python
- 領域
- cli, security
- issue の種類
- 機能追加
- 難易度
- 5/5
- 見積もり時間
- 1週間以上
- 活発さ
- 停滞
- 明瞭さ
- おおむね明確
- 初心者へのやさしさ
- 35/100