rapid7/metasploit-framework — pull request #1989 by salcho (2013-06-19 23:51:09+00:00)
Title: Adding admin_me.rb win/post/manage module

The admin_me module's objective is to trojanize windows servers and workstations using only OS capabilities (i.e. registry and built-in user accounts). It'll try to read from privileged registry keys (SAM\SAM\Domains\Account\Users\Names, among others) in order 'spoof' the support_388945a0 user's RID while activating it and setting a given password.

As far as I know this technique hasn't been widely documented but has proven great success in a number of pentests. As a result the support_388945a0 account will have the administrator's RID, this has a number of advantages like enforcing administrative access to servers/workstations with protected groups and containers, having access to the administrator's desktop, files and settings without knowing it's password while all events logged from this account will be seen in the event manager as made from the administrator account. Additionally, the support account won't be shown in the administrators group as an additional user to other administrators in the server/workstation.

Other built-in accounts can also be used for the same task such as HelpAssistant, KRBTGT though I haven't tested them yet (keep in mind sometimes this users behave differently, for example by setting Remote Assistance sessions). The script has been tested and confirmed on Windows XP (x86/x64) and Windows Server 2003 (x86/x64) while I've got different results on Windows Server 2008.

Ongoing (and perhaps community) research on other built-in accounts should provide for future development in OS versions and features for this module.