RPC绕过EDR的研究与落地

1、前言

2、RPC结构相关概念

3、相关攻击面

1、IOXID Resolver探测内网多网卡主机

05000b03100000004800000001000000b810b810000000000100000000000100c4fefc9960521b10bbcb00aa0021347a00000000045d888aeb1cc9119fe808002b10486002000000

050000031000000018000000010000000000000000000500

2、RPC SMB

3、MS-SAMR的那些事

1）添加本地用户

long SamrCreateUser2InDomain(
   [in] SAMPR_HANDLE DomainHandle,
   [in] PRPC_UNICODE_STRING Name,
   [in] unsigned long AccountType,
   [in] unsigned long DesiredAccess,
   [out] SAMPR_HANDLE* UserHandle,
   [out] unsigned long* GrantedAccess,
   [out] unsigned long* RelativeId
 );

long SamrSetInformationUser(
   [in] SAMPR_HANDLE UserHandle,
   [in] USER_INFORMATION_CLASS UserInformationClass,
   [in, switch_is(UserInformationClass)] 
     PSAMPR_USER_INFO_BUFFER Buffer
 );

long SamrAddMemberToAlias(
   [in] SAMPR_HANDLE AliasHandle,
   [in] PRPC_SID MemberId
 );

2) Change Ntlm

long SamrChangePasswordUser(
   [in] SAMPR_HANDLE UserHandle,
   [in] unsigned char LmPresent,
   [in, unique] PENCRYPTED_LM_OWF_PASSWORD OldLmEncryptedWithNewLm,
   [in, unique] PENCRYPTED_LM_OWF_PASSWORD NewLmEncryptedWithOldLm,
   [in] unsigned char NtPresent,
   [in, unique] PENCRYPTED_NT_OWF_PASSWORD OldNtEncryptedWithNewNt,
   [in, unique] PENCRYPTED_NT_OWF_PASSWORD NewNtEncryptedWithOldNt,
   [in] unsigned char NtCrossEncryptionPresent,
   [in, unique] PENCRYPTED_NT_OWF_PASSWORD NewNtEncryptedWithNewLm,
   [in] unsigned char LmCrossEncryptionPresent,
   [in, unique] PENCRYPTED_LM_OWF_PASSWORD NewLmEncryptedWithNewNt
 );

RPC_STATUS RpcStringBindingComposeW(
  RPC_WSTR ObjUuid,
  RPC_WSTR ProtSeq,
  RPC_WSTR NetworkAddr,
  RPC_WSTR Endpoint,
  RPC_WSTR Options,
  RPC_WSTR *StringBinding
);

 
long SamrChangePasswordUser(
   [in] SAMPR_HANDLE UserHandle,
   [in] unsigned char LmPresent,
   [in, unique] PENCRYPTED_LM_OWF_PASSWORD OldLmEncryptedWithNewLm,
   [in, unique] PENCRYPTED_LM_OWF_PASSWORD NewLmEncryptedWithOldLm,
   [in] unsigned char NtPresent,
   [in, unique] PENCRYPTED_NT_OWF_PASSWORD OldNtEncryptedWithNewNt,
   [in, unique] PENCRYPTED_NT_OWF_PASSWORD NewNtEncryptedWithOldNt,
   [in] unsigned char NtCrossEncryptionPresent,
   [in, unique] PENCRYPTED_NT_OWF_PASSWORD NewNtEncryptedWithNewLm,
   [in] unsigned char LmCrossEncryptionPresent,
   [in, unique] PENCRYPTED_LM_OWF_PASSWORD NewLmEncryptedWithNewNt
 );

long SamrOpenUser(
   [in] SAMPR_HANDLE DomainHandle,
   [in] unsigned long DesiredAccess,
   [in] unsigned long UserId,
   [out] SAMPR_HANDLE* UserHandle
 );

long SamrLookupNamesInDomain(
   [in] SAMPR_HANDLE DomainHandle,
   [in, range(0,1000)] unsigned long Count,
   [in, size_is(1000), length_is(Count)] 
     RPC_UNICODE_STRING Names<li>,
   [out] PSAMPR_ULONG_ARRAY RelativeIds,
   [out] PSAMPR_ULONG_ARRAY Use
 );

 
long SamrOpenDomain(
   [in] SAMPR_HANDLE ServerHandle,
   [in] unsigned long DesiredAccess,
   [in] PRPC_SID DomainId,
   [out] SAMPR_HANDLE* DomainHandle
 );

long SamrLookupDomainInSamServer(
   [in] SAMPR_HANDLE ServerHandle,
   [in] PRPC_UNICODE_STRING Name,
   [out] PRPC_SID* DomainId
 );

 
long SamrConnect5(
   [in, unique, string] PSAMPR_SERVER_NAME ServerName,
   [in] unsigned long DesiredAccess,
   [in] unsigned long InVersion,
   [in] [switch_is(InVersion)] SAMPR_REVISION_INFO* InRevisionInfo,
   [out] unsigned long* OutVersion,
   [out, switch_is(*OutVersion)] SAMPR_REVISION_INFO* OutRevisionInfo,
   [out] SAMPR_HANDLE* ServerHandle
 );

import hashlib,binascii
print binascii.hexlify(hashlib.new("md4", "123456".encode("utf-16le")).digest())

4、MS-TSCH

 
HRESULT SchRpcRegisterTask(
   [in, string, unique] const wchar_t* path,
   [in, string] const wchar_t* xml,
   [in] DWORD flags,
   [in, string, unique] const wchar_t* sddl,
   [in] DWORD logonType,
   [in] DWORD cCreds,
   [in, size_is(cCreds), unique] const TASK_USER_CRED* pCreds,
   [out, string] wchar_t** pActualPath,
   [out] PTASK_XML_ERROR_INFO* pErrorInfo
 );

RPC_STATUS RpcBindingSetAuthInfoExA(
  RPC_BINDING_HANDLE       Binding,
  RPC_CSTR                 ServerPrincName,
  unsigned long            AuthnLevel,
  unsigned long            AuthnSvc,
  RPC_AUTH_IDENTITY_HANDLE AuthIdentity,
  unsigned long            AuthzSvc,
  RPC_SECURITY_QOS         *SecurityQos
);

5、MS-SCMR

 
DWORD ROpenSCManagerA(
   [in, string, unique, range(0, SC_MAX_COMPUTER_NAME_LENGTH)] 
     SVCCTL_HANDLEA lpMachineName,
   [in, string, unique, range(0, SC_MAX_NAME_LENGTH)] 
     LPSTR lpDatabaseName,
   [in] DWORD dwDesiredAccess,
   [out] LPSC_RPC_HANDLE lpScHandle
 );

DWORD RCreateServiceA(
   [in] SC_RPC_HANDLE hSCManager,
   [in, string, range(0, SC_MAX_NAME_LENGTH)] 
     LPSTR lpServiceName,
   [in, string, unique, range(0, SC_MAX_NAME_LENGTH)] 
     LPSTR lpDisplayName,
   [in] DWORD dwDesiredAccess,
   [in] DWORD dwServiceType,
   [in] DWORD dwStartType,
   [in] DWORD dwErrorControl,
   [in, string, range(0, SC_MAX_PATH_LENGTH)] 
     LPSTR lpBinaryPathName,
   [in, string, unique, range(0, SC_MAX_NAME_LENGTH)] 
     LPSTR lpLoadOrderGroup,
   [in, out, unique] LPDWORD lpdwTagId,
   [in, unique, size_is(dwDependSize)] 
     LPBYTE lpDependencies,
   [in, range(0, SC_MAX_DEPEND_SIZE)] 
     DWORD dwDependSize,
   [in, string, unique, range(0, SC_MAX_ACCOUNT_NAME_LENGTH)] 
     LPSTR lpServiceStartName,
   [in, unique, size_is(dwPwSize)] 
     LPBYTE lpPassword,
   [in, range(0, SC_MAX_PWD_SIZE)] 
     DWORD dwPwSize,
   [out] LPSC_RPC_HANDLE lpServiceHandle
 );

reg add HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesServiceNameParameters /v AppDirectory /t REG_SZ /d "c:" /f

reg add HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesServiceNameParameters /v Application /t REG_SZ /d "c:xxx.exe" /f

reg add HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesServiceNameParameters /v AppParameters /t REG_SZ /d "如果程序需要参数则填在这里，如果不需要，清空这段文字或者整行" /f

6、Seclogon Dump Lsass

参考

https://www.t00ls.com/articles-68609.html

原文始发于微信公众号（T00ls安全）：RPC绕过EDR的研究与落地