{"id":1760,"date":"2015-09-16T15:17:11","date_gmt":"2015-09-16T19:17:11","guid":{"rendered":"https:\/\/adsecurity.org\/?p=1760"},"modified":"2015-12-16T15:30:26","modified_gmt":"2015-12-16T20:30:26","slug":"sneaky-active-directory-persistence-12-malicious-security-support-provider-ssp","status":"publish","type":"post","link":"https:\/\/adsecurity.org\/?p=1760","title":{"rendered":"Sneaky Active Directory Persistence #12: Malicious Security Support Provider (SSP)"},"content":{"rendered":"<p>The content in this post describes a method by which an attacker could persist administrative access to Active Directory after having Domain Admin level rights for 5 minutes.<\/p>\n<p><a href=\"https:\/\/adsecurity.org\/?p=1632\">I presented on this AD persistence method in Las Vegas at DEF CON 23 (2015).<\/a><\/p>\n<p><a href=\"https:\/\/adsecurity.org\/?p=1929\">Complete list of Sneaky Active Directory Persistence Tricks posts <\/a><\/p>\n<p>&nbsp;<\/p>\n<p>The Security Support Provider Interface (SSPI) enables Windows authentication methods to be easily extended allowing new Security Support Providers (SSPs) to be added without additional coding.<\/p>\n<p>Some of the <a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/Aa380502%28v=VS.85%29.aspx\">standard Windows authentication SSPs<\/a>:<\/p>\n<ul>\n<li><a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/aa378749%28v=vs.85%29.aspx\">NTLM<\/a><\/li>\n<li><a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/aa378747%28v=vs.85%29.aspx\">Kerberos<\/a><\/li>\n<li><a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/aa378748%28v=vs.85%29.aspx\">Negotiate<\/a><\/li>\n<li><a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/aa380123%28v=vs.85%29.aspx\">Secure Channel (Schannel)<\/a><\/li>\n<li><a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/aa378745%28v=vs.85%29.aspx\">Digest<\/a><\/li>\n<li><a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/bb931352%28v=vs.85%29.aspx\">Credential (CredSSP)<\/a><\/li>\n<\/ul>\n<p>Mimikatz supports DLL\/registry (scenario 1) &amp; in-memory updating of SSPs (scenario 2).<\/p>\n<p><!--more--><\/p>\n<p><strong>Scenario 1:<\/strong> Copy mimilib.dll to the same location as LSASS (c:\\windows\\system32) &amp; Update Security Packages registry key (HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\Security Packages\\) with the SSP DLL name.<\/p>\n<p><a href=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-PowerShellScript-01.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1764\" src=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-PowerShellScript-01.png\" alt=\"SneakyPersistence-EnableMimiSSP-PowerShellScript-01\" width=\"422\" height=\"257\" srcset=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-PowerShellScript-01.png 422w, https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-PowerShellScript-01-300x183.png 300w\" sizes=\"auto, (max-width: 422px) 100vw, 422px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-MimilibDll-02.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1763\" src=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-MimilibDll-02.png\" alt=\"SneakyPersistence-EnableMimiSSP-MimilibDll-02\" width=\"463\" height=\"165\" srcset=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-MimilibDll-02.png 463w, https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-MimilibDll-02-300x107.png 300w\" sizes=\"auto, (max-width: 463px) 100vw, 463px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-RegKey-01.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1766\" src=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-RegKey-01.png\" alt=\"SneakyPersistence-EnableMimiSSP-RegKey-01\" width=\"764\" height=\"422\" srcset=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-RegKey-01.png 764w, https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-RegKey-01-300x166.png 300w\" sizes=\"auto, (max-width: 764px) 100vw, 764px\" \/><\/a><\/p>\n<p><strong>Scenario 2:<\/strong> Use mimikatz to patch LSASS in memory with new SSP with no reboot required (rebooting clears the memssp Mimikatz injects).<\/p>\n<p><a href=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-MemSSP-01.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1761\" src=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-MemSSP-01.png\" alt=\"SneakyPersistence-EnableMimiSSP-MemSSP-01\" width=\"639\" height=\"191\" srcset=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-MemSSP-01.png 639w, https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-MemSSP-01-300x90.png 300w\" sizes=\"auto, (max-width: 639px) 100vw, 639px\" \/><\/a><\/p>\n<p>Either of these scenarios enable adding a new SSP to a Windows system. The SSP included with mimikatz provides automatic logging of locally authenticated credentials. This includes the computer account password, running service credentials, and any accounts that logon.<\/p>\n<p>This data is logged by default in the same location as the dll file to a log file, though it&#8217;s possible to log this data elsewhere on the system. The alternate log location could be in SYSVOL if the Windows system is a Domain Controller which provides access to Authenticated Users.<\/p>\n<p>This is what a typical Group Policy template file might look like.<\/p>\n<p><a href=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-SaveToSYSVOL-02.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1768\" src=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-SaveToSYSVOL-02.png\" alt=\"SneakyPersistence-EnableMimiSSP-SaveToSYSVOL-02\" width=\"796\" height=\"562\" srcset=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-SaveToSYSVOL-02.png 796w, https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-SaveToSYSVOL-02-300x212.png 300w\" sizes=\"auto, (max-width: 796px) 100vw, 796px\" \/><\/a><\/p>\n<p>This is what a fake Group Policy template file might look like when as the Mimikatz SSP log file location.<\/p>\n<p><a href=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-SaveToSYSVOL.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1767\" src=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-SaveToSYSVOL.png\" alt=\"SneakyPersistence-EnableMimiSSP-SaveToSYSVOL\" width=\"799\" height=\"565\" srcset=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-SaveToSYSVOL.png 799w, https:\/\/adsecurity.org\/wp-content\/uploads\/2015\/09\/SneakyPersistence-EnableMimiSSP-SaveToSYSVOL-300x212.png 300w\" sizes=\"auto, (max-width: 799px) 100vw, 799px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p><strong>Detection<\/strong><\/p>\n<ul>\n<li>Monitor the LSA registry key that controls security packages: HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\Security Packages\\<\/li>\n<li>Monitor commands run on Domain Controllers in cmd.exe<\/li>\n<li>Monitor commands run on Domain Controllers in PowerShell.<\/li>\n<\/ul>\n<p><strong><br \/>\nMitigation<\/strong><\/p>\n<ul>\n<li>Protect Active Directory admins.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The content in this post describes a method by which an attacker could persist administrative access to Active Directory after having Domain Admin level rights for 5 minutes. I presented on this AD persistence method in Las Vegas at DEF CON 23 (2015). Complete list of Sneaky Active Directory Persistence Tricks posts &nbsp; The Security &hellip; <\/p>\n<p><a class=\"more-link btn\" href=\"https:\/\/adsecurity.org\/?p=1760\">Continue reading<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[565,11,234,2],"tags":[518,619,207,620,575,618,617,621],"class_list":["post-1760","post","type-post","status-publish","format-standard","hentry","category-activedirectorysecurity","category-microsoft-security","category-security-conference-presentationvideo","category-technical-reference","tag-defcon","tag-maliciousssp","tag-mimikatz","tag-mimilib-dll","tag-powershell","tag-security-packages","tag-ssp","tag-sysvol","item-wrap"],"_links":{"self":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/1760","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1760"}],"version-history":[{"count":6,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/1760\/revisions"}],"predecessor-version":[{"id":2263,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/1760\/revisions\/2263"}],"wp:attachment":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1760"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1760"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1760"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}