Give Me A SYSTEM Proxy
So far, the Net.WebClient download cradle has been very versatile,
but we must consider the side-effects of using a SYSTEM integrity download cradle.
When performing privilege escalation or exploiting an application
running at SYSTEM integrity level,
we may obtain a SYSTEM integrity shell.
A PowerShell download cradle running in SYSTEM integrity level context
does not have a proxy configuration set
and may fail to call back to our C2 infrastructure.
We can verify this from a SysInternals
PsExec SYSTEM integrity
32-bit PowerShell ISE command prompt.
To demonstrate this, we’ll first open an elevated command prompt
by right-clicking on cmd.exe
and selecting Run as administrator.
In the new command prompt, we’ll navigate to the Sysinternals folder,
and execute PsExec.exe
while specifying -s to run it as SYSTEM
and -i to make it interactive with the current desktop.
While keeping the proxy settings enabled,
we’ll run the basic Net.WebClient PowerShell download cradle we used earlier
from the SYSTEM integrity PowerShell ISE prompt.
When the download cradle has completed,
we’ll inspect the latest Apache access log.
It reveals that the HTTP request
came directly from the Windows 10 victim machine.
In order to run our session through a proxy,
we must create a proxy configuration
for the built-in SYSTEM account.
One way to do this is to copy a configuration
from a standard user account on the system.
Proxy settings for each user are stored in the registry.
We can verify this by opening the registry editor
and browsing to this path.
From here, we can collect the contents
of the ProxyServer registry key
and use it to populate the proxy properties of the Net.WebClient object.
However, there is a problem in this.
When navigating the registry,
the HKEY_CURRENT_USER registry hive
is mapped according to the user trying to access it,
but for SYSTEM, no such registry hive exists.
However, the HKEY_USERS registry hive always exists
and contains the content of all user HKEY_CURRENT_USER registry hives
split by their respective SIDs.
As part of our download cradle, we can use PowerShell to resolve a registry key.
But the HKEY_USERS registry hive is not automatically mapped.
Nevertheless, we can map it with the New-PSDrive commandlet,
by specifying a name,
the PSProvider as “Registry”,
and Root as “HKEY_USERS”.
While we can now interact with and query the HKEY_USERS hive,
we must decide which user’s hive we want to copy.
The HKEY_USERS hive contains the hives of all users on the computer,
including SYSTEM
and other local service accounts,
which we want to avoid.
The registry hives are divided and named after the SIDs of existing users
and there is a specific pattern.
Any SID starting with “S-1-5-21”
is a user account exclusive of built-in accounts.