adityatelange / adityatelange/evil-winrm-py

[FEATURE] interactive logon type execution

未关闭
#19 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Python
星标
396
派生
37
PR 合并指标
30 天内没有已合并 PR

描述

Because we are using WinRM we have a "network" logon type which has less permissions than an "interactive" logon type. "interactive" logon type is particularly useful when using COM objects to privesc as the "NT authority\Interactive" group has much more permissions on COM objects than "NT authority\Network" but "interactive" is also useful for a lot of other purposes.

To give a concrete example, in order to display all sessions on the current machine the easiest is to run it with [RunasCs.exe](https://github.com/antonioCoco/RunasCs) like this:
```evil-winrm-py PS[...]> .\RunasCs.exe x x -l 9 "qwinsta"```

Which calls CreateProcessWithLogonW with the LOGON_NETCREDENTIALS_ONLY behind the hood. Or if plaintext password has been provided to evil-winrm-py it's even better as it would allow to have an interactive session working also for network operations such as ldap, etc (I don't think a krb key, ticket or nt hash can be used to get an interactive process).

So I was thinking about having a builtin command for it like below:
```
$ evil-winrm-py -i 192.168.100.10 -u john -p 'password'
evil-winrm-py PS[...]> interactive
evil-winrm-py PS-interactive [...]> qwinsta
evil-winrm-py PS-interactive [...]> ([ADSI]"").distinguishedName
evil-winrm-py PS-interactive[...]> exit
evil-winrm-py PS [...]>

$ evil-winrm-py -i 192.168.100.10 -u john -H 'somehash'
evil-winrm-py PS[...]> interactive
[!] password plaintext not provided, network ops won't work
evil-winrm-py PS-netonly [...]> qwinsta
evil-winrm-py PS-netonly [...]> ([ADSI]"").distinguishedName
< SOME ERROR MSG CAUSE DUMMY CREDS>
evil-winrm-py PS-netonly[...]> exit
evil-winrm-py PS [...]>
```

贡献指南

这个仓库没有索引到贡献指南

调研方向

Start by tracing the CLI's session creation and existing WinRM logon path; the issue provides no file or test names. Done should include an interactive command that changes the prompt, supports commands such as qwinsta and ADSI operations when a plaintext password is available, warns for hash-only authentication, and returns to the original session after exit.

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
cli, security
Issue 类型
功能
难度
5/5
预计耗时
一周以上
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。