adityatelange / adityatelange/evil-winrm-py

[FEATURE] interactive logon type execution

オープン
#19 コメント 2 件 リアクション 0 件 担当者 0 名 GitHub で見る
主要言語
Python
スター
396
フォーク
37
PR マージ指標
30日以内にマージされた PR はありません

説明

Because we are using WinRM we have a "network" logon type which has less permissions than an "interactive" logon type. "interactive" logon type is particularly useful when using COM objects to privesc as the "NT authority\Interactive" group has much more permissions on COM objects than "NT authority\Network" but "interactive" is also useful for a lot of other purposes.

To give a concrete example, in order to display all sessions on the current machine the easiest is to run it with [RunasCs.exe](https://github.com/antonioCoco/RunasCs) like this:
```evil-winrm-py PS[...]> .\RunasCs.exe x x -l 9 "qwinsta"```

Which calls CreateProcessWithLogonW with the LOGON_NETCREDENTIALS_ONLY behind the hood. Or if plaintext password has been provided to evil-winrm-py it's even better as it would allow to have an interactive session working also for network operations such as ldap, etc (I don't think a krb key, ticket or nt hash can be used to get an interactive process).

So I was thinking about having a builtin command for it like below:
```
$ evil-winrm-py -i 192.168.100.10 -u john -p 'password'
evil-winrm-py PS[...]> interactive
evil-winrm-py PS-interactive [...]> qwinsta
evil-winrm-py PS-interactive [...]> ([ADSI]"").distinguishedName
evil-winrm-py PS-interactive[...]> exit
evil-winrm-py PS [...]>

$ evil-winrm-py -i 192.168.100.10 -u john -H 'somehash'
evil-winrm-py PS[...]> interactive
[!] password plaintext not provided, network ops won't work
evil-winrm-py PS-netonly [...]> qwinsta
evil-winrm-py PS-netonly [...]> ([ADSI]"").distinguishedName
< SOME ERROR MSG CAUSE DUMMY CREDS>
evil-winrm-py PS-netonly[...]> exit
evil-winrm-py PS [...]>
```

コントリビューションガイド

このリポジトリのコントリビューションガイドは索引されていません

調査の方向性

Start by tracing the CLI's session creation and existing WinRM logon path; the issue provides no file or test names. Done should include an interactive command that changes the prompt, supports commands such as qwinsta and ADSI operations when a plaintext password is available, warns for hash-only authentication, and returns to the original session after exit.

索引モデルが issue の本文から書いたものです。

評価

技術スタック
python
領域
cli, security
issue の種類
機能追加
難易度
5/5
見積もり時間
1週間以上
活発さ
停滞
明瞭さ
おおむね明確
初心者へのやさしさ
35/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。