Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit 1503375

Browse files
clymb3rclymb3r
committed
Adding Inject-LogonCredentials
1 parent 5af0589 commit 1503375

18 files changed

+4428
-1
lines changed

‎Exfiltration/Exfiltration.psd1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ ModuleList = @(@{ModuleName = 'Exfiltration'; ModuleVersion = '1.0.0.0'; GUID =
7575
# List of all files packaged with this module
7676
FileList = 'Exfiltration.psm1', 'Exfiltration.psd1', 'Get-TimedScreenshot.ps1', 'Out-Minidump.ps1',
7777
'Get-Keystrokes.ps1', 'Get-GPPPassword.ps1', 'Usage.md', 'Invoke-Mimikatz.ps1',
78-
'Invoke-NinjaCopy.ps1', 'Invoke-TokenManipulation.ps1'
78+
'Invoke-NinjaCopy.ps1', 'Invoke-TokenManipulation.ps1', 'Inject-LogonCredentials.ps1'
7979

8080
# Private data to pass to the module specified in RootModule/ModuleToProcess
8181
# PrivateData = ''

‎Exfiltration/Inject-LogonCredentials.ps1

Lines changed: 3413 additions & 0 deletions
Large diffs are not rendered by default.

‎Exfiltration/LogonUser/LogonUser/LogonUser.sln

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio 2012
4+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "logon", "logon\logon.vcxproj", "{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}"
5+
EndProject
6+
Global
7+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
8+
Debug|Win32 = Debug|Win32
9+
Debug|x64 = Debug|x64
10+
Release|Win32 = Release|Win32
11+
Release|x64 = Release|x64
12+
EndGlobalSection
13+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
14+
{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Debug|Win32.ActiveCfg = Debug|Win32
15+
{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Debug|Win32.Build.0 = Debug|Win32
16+
{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Debug|x64.ActiveCfg = Debug|x64
17+
{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Debug|x64.Build.0 = Debug|x64
18+
{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Release|Win32.ActiveCfg = Release|Win32
19+
{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Release|Win32.Build.0 = Release|Win32
20+
{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Release|x64.ActiveCfg = Release|x64
21+
{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Release|x64.Build.0 = Release|x64
22+
EndGlobalSection
23+
GlobalSection(SolutionProperties) = preSolution
24+
HideSolutionNode = FALSE
25+
EndGlobalSection
26+
EndGlobal

‎Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.cpp

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
// LogonUser.cpp : Defines the entry point for the console application.
2+
//
3+
4+
#include "stdafx.h"
5+
6+
using namespace std;
7+
8+
size_t wcsByteLen( const wchar_t* str );
9+
void InitUnicodeString( UNICODE_STRING& str, const wchar_t* value, BYTE* buffer, size_t& offset );
10+
PVOID CreateNtlmLogonStructure(wstring domain, wstring username, wstring password, DWORD* size);
11+
size_t WriteUnicodeString(wstring str, UNICODE_STRING* uniStr, PVOID baseAddress, size_t offset);
12+
13+
int _tmain(int argc, _TCHAR* argv[])
14+
{
15+
//Get a handle to LSA
16+
HANDLE hLSA = NULL;
17+
NTSTATUS status = LsaConnectUntrusted(&hLSA);
18+
if (status != 0)
19+
{
20+
cout << "Error calling LsaConnectUntrusted. Error code: " << status << endl;
21+
return -1;
22+
}
23+
if (hLSA == NULL)
24+
{
25+
cout << "hLSA is NULL, this shouldn't ever happen" << endl;
26+
return -1;
27+
}
28+
29+
//Build LsaLogonUser parameters
30+
LSA_STRING originName = {};
31+
char originNameStr[] = "qpqp";
32+
originName.Buffer = originNameStr;
33+
originName.Length = (USHORT)strlen(originNameStr);
34+
originName.MaximumLength = originName.Length;
35+
36+
ULONG authPackage = 0;
37+
PLSA_STRING authPackageName = new LSA_STRING();
38+
char authPackageBuf[] = MSV1_0_PACKAGE_NAME;
39+
authPackageName->Buffer = authPackageBuf;
40+
authPackageName->Length = (USHORT)strlen(authPackageBuf);
41+
authPackageName->MaximumLength = (USHORT)strlen(authPackageBuf);
42+
status = LsaLookupAuthenticationPackage(hLSA, authPackageName, &authPackage);
43+
if (status != 0)
44+
{
45+
int winError = LsaNtStatusToWinError(status);
46+
cout << "Call to LsaLookupAuthenticationPackage failed. Error code: " << winError;
47+
return -1;
48+
}
49+
50+
DWORD authBufferSize = 0;
51+
PVOID authBuffer = CreateNtlmLogonStructure(L"VMWORKSTATION", L"testuser", L"Password1", &authBufferSize);
52+
cout << "authBufferSize: " << authBufferSize << endl;
53+
54+
//Get TokenSource
55+
HANDLE hProcess = GetCurrentProcess();//todo
56+
HANDLE procToken = NULL;
57+
BOOL success = OpenProcessToken(hProcess, TOKEN_ALL_ACCESS, &procToken);
58+
if (!success)
59+
{
60+
DWORD errorCode = GetLastError();
61+
cout << "Call to OpenProcessToken failed. Errorcode: " << errorCode << endl;
62+
return -1;
63+
}
64+
65+
TOKEN_SOURCE tokenSource = {};
66+
DWORD realSize = 0;
67+
success = GetTokenInformation(procToken, TokenSource, &tokenSource, sizeof(tokenSource), &realSize);
68+
if (!success)
69+
{
70+
cout << "Call to GetTokenInformation failed." << endl;
71+
return -1;
72+
}
73+
74+
75+
//Misc
76+
PVOID profileBuffer = NULL;
77+
ULONG profileBufferSize = 0;
78+
LUID loginId;
79+
HANDLE token = NULL;
80+
QUOTA_LIMITS quotaLimits;
81+
NTSTATUS subStatus = 0;
82+
83+
status = LsaLogonUser(hLSA,
84+
&originName,
85+
RemoteInteractive,
86+
authPackage,
87+
authBuffer,
88+
authBufferSize,
89+
0,
90+
&tokenSource,
91+
&profileBuffer,
92+
&profileBufferSize,
93+
&loginId,
94+
&token,
95+
&quotaLimits,
96+
&subStatus);
97+
98+
if (status != 0)
99+
{
100+
NTSTATUS winError = LsaNtStatusToWinError(status);
101+
cout << "Error calling LsaLogonUser. Error code: " << winError << endl;
102+
return -1;
103+
}
104+
105+
cout << "Success!" << endl;
106+
107+
return 1;
108+
}
109+
110+
//size will be set to the size of the structure created
111+
PVOID CreateNtlmLogonStructure(wstring domain, wstring username, wstring password, DWORD* size)
112+
{
113+
size_t wcharSize = sizeof(wchar_t);
114+
115+
size_t totalSize = sizeof(MSV1_0_INTERACTIVE_LOGON) + ((domain.length() + username.length() + password.length()) * wcharSize);
116+
MSV1_0_INTERACTIVE_LOGON* ntlmLogon = (PMSV1_0_INTERACTIVE_LOGON)(new BYTE[totalSize]);
117+
size_t offset = sizeof(MSV1_0_INTERACTIVE_LOGON);
118+
119+
ntlmLogon->MessageType = MsV1_0InteractiveLogon;
120+
offset += WriteUnicodeString(domain, &(ntlmLogon->LogonDomainName), ntlmLogon, offset);
121+
offset += WriteUnicodeString(username, &(ntlmLogon->UserName), ntlmLogon, offset);
122+
offset += WriteUnicodeString(password, &(ntlmLogon->Password), ntlmLogon, offset);
123+
124+
*size = (DWORD)totalSize; //If the size is bigger than a DWORD, there is a gigantic bug somewhere.
125+
return ntlmLogon;
126+
}
127+
128+
size_t WriteUnicodeString(wstring str, UNICODE_STRING* uniStr, PVOID baseAddress, size_t offset)
129+
{
130+
const wchar_t* buffer = str.c_str();
131+
size_t size = str.length() * sizeof(wchar_t);
132+
uniStr->Length = (USHORT)size;
133+
uniStr->MaximumLength = (USHORT)size;
134+
uniStr->Buffer = (PWSTR)((UINT_PTR)baseAddress + offset);
135+
memcpy((PVOID)((UINT_PTR)baseAddress + offset), str.c_str(), size);
136+
return size;
137+
}

‎Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Debug|x64">
9+
<Configuration>Debug</Configuration>
10+
<Platform>x64</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Release|Win32">
13+
<Configuration>Release</Configuration>
14+
<Platform>Win32</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<ProjectGuid>{F9DC2AAF-2213-4D87-9F52-283DA1CC6E18}</ProjectGuid>
23+
<Keyword>Win32Proj</Keyword>
24+
<RootNamespace>LogonUser</RootNamespace>
25+
</PropertyGroup>
26+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
27+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
28+
<ConfigurationType>Application</ConfigurationType>
29+
<UseDebugLibraries>true</UseDebugLibraries>
30+
<PlatformToolset>v110</PlatformToolset>
31+
<CharacterSet>Unicode</CharacterSet>
32+
</PropertyGroup>
33+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
34+
<ConfigurationType>Application</ConfigurationType>
35+
<UseDebugLibraries>true</UseDebugLibraries>
36+
<PlatformToolset>v110</PlatformToolset>
37+
<CharacterSet>Unicode</CharacterSet>
38+
</PropertyGroup>
39+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
40+
<ConfigurationType>Application</ConfigurationType>
41+
<UseDebugLibraries>false</UseDebugLibraries>
42+
<PlatformToolset>v110</PlatformToolset>
43+
<WholeProgramOptimization>true</WholeProgramOptimization>
44+
<CharacterSet>Unicode</CharacterSet>
45+
</PropertyGroup>
46+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
47+
<ConfigurationType>Application</ConfigurationType>
48+
<UseDebugLibraries>false</UseDebugLibraries>
49+
<PlatformToolset>v110</PlatformToolset>
50+
<WholeProgramOptimization>true</WholeProgramOptimization>
51+
<CharacterSet>Unicode</CharacterSet>
52+
</PropertyGroup>
53+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
54+
<ImportGroup Label="ExtensionSettings">
55+
</ImportGroup>
56+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
57+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
58+
</ImportGroup>
59+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
60+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
61+
</ImportGroup>
62+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
63+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
64+
</ImportGroup>
65+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
66+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
67+
</ImportGroup>
68+
<PropertyGroup Label="UserMacros" />
69+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
70+
<LinkIncremental>true</LinkIncremental>
71+
</PropertyGroup>
72+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
73+
<LinkIncremental>true</LinkIncremental>
74+
</PropertyGroup>
75+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
76+
<LinkIncremental>false</LinkIncremental>
77+
</PropertyGroup>
78+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
79+
<LinkIncremental>false</LinkIncremental>
80+
</PropertyGroup>
81+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
82+
<ClCompile>
83+
<PrecompiledHeader>Use</PrecompiledHeader>
84+
<WarningLevel>Level3</WarningLevel>
85+
<Optimization>Disabled</Optimization>
86+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
87+
</ClCompile>
88+
<Link>
89+
<SubSystem>Console</SubSystem>
90+
<GenerateDebugInformation>true</GenerateDebugInformation>
91+
<AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies>
92+
</Link>
93+
</ItemDefinitionGroup>
94+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
95+
<ClCompile>
96+
<PrecompiledHeader>Use</PrecompiledHeader>
97+
<WarningLevel>Level3</WarningLevel>
98+
<Optimization>Disabled</Optimization>
99+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
100+
</ClCompile>
101+
<Link>
102+
<SubSystem>Console</SubSystem>
103+
<GenerateDebugInformation>true</GenerateDebugInformation>
104+
<AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies>
105+
</Link>
106+
</ItemDefinitionGroup>
107+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
108+
<ClCompile>
109+
<WarningLevel>Level3</WarningLevel>
110+
<PrecompiledHeader>Use</PrecompiledHeader>
111+
<Optimization>MaxSpeed</Optimization>
112+
<FunctionLevelLinking>true</FunctionLevelLinking>
113+
<IntrinsicFunctions>true</IntrinsicFunctions>
114+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
115+
</ClCompile>
116+
<Link>
117+
<SubSystem>Console</SubSystem>
118+
<GenerateDebugInformation>true</GenerateDebugInformation>
119+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
120+
<OptimizeReferences>true</OptimizeReferences>
121+
</Link>
122+
</ItemDefinitionGroup>
123+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
124+
<ClCompile>
125+
<WarningLevel>Level3</WarningLevel>
126+
<PrecompiledHeader>Use</PrecompiledHeader>
127+
<Optimization>MaxSpeed</Optimization>
128+
<FunctionLevelLinking>true</FunctionLevelLinking>
129+
<IntrinsicFunctions>true</IntrinsicFunctions>
130+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
131+
</ClCompile>
132+
<Link>
133+
<SubSystem>Console</SubSystem>
134+
<GenerateDebugInformation>true</GenerateDebugInformation>
135+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
136+
<OptimizeReferences>true</OptimizeReferences>
137+
</Link>
138+
</ItemDefinitionGroup>
139+
<ItemGroup>
140+
<Text Include="ReadMe.txt" />
141+
</ItemGroup>
142+
<ItemGroup>
143+
<ClInclude Include="stdafx.h" />
144+
<ClInclude Include="targetver.h" />
145+
</ItemGroup>
146+
<ItemGroup>
147+
<ClCompile Include="LogonUser.cpp" />
148+
<ClCompile Include="stdafx.cpp">
149+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
150+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
151+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
152+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
153+
</ClCompile>
154+
</ItemGroup>
155+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
156+
<ImportGroup Label="ExtensionTargets">
157+
</ImportGroup>
158+
</Project>

‎Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj.filters

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup>
4+
<Filter Include="Source Files">
5+
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
6+
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
7+
</Filter>
8+
<Filter Include="Header Files">
9+
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10+
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
11+
</Filter>
12+
<Filter Include="Resource Files">
13+
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14+
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15+
</Filter>
16+
</ItemGroup>
17+
<ItemGroup>
18+
<Text Include="ReadMe.txt" />
19+
</ItemGroup>
20+
<ItemGroup>
21+
<ClInclude Include="stdafx.h">
22+
<Filter>Header Files</Filter>
23+
</ClInclude>
24+
<ClInclude Include="targetver.h">
25+
<Filter>Header Files</Filter>
26+
</ClInclude>
27+
</ItemGroup>
28+
<ItemGroup>
29+
<ClCompile Include="stdafx.cpp">
30+
<Filter>Source Files</Filter>
31+
</ClCompile>
32+
<ClCompile Include="LogonUser.cpp">
33+
<Filter>Source Files</Filter>
34+
</ClCompile>
35+
</ItemGroup>
36+
</Project>

0 commit comments

Comments
 (0)