Last updated
Last updated
Web Distributed Authoring and Versioning (aka WebDAV) is an extension that allows for basic file operations (create/copy/move/delete) over the HTTP protocol. Windows supports the use of WebDAV via Explorer where users can enter a URI or map a drive to a WebDAV server. The WebClient service facilitates Explorer's ability to use WebDAV. This is set to DEMAND_START by default, so is generally only running if a user has actively used a WebDAV resource. Some Windows technologies, such as SharePoint, use WebDAV fairly heavily.
As by Lee Christensen, the WebClient exposes a named pipe called DAV RPC SERVICE, which makes it fairly easy to enumerate remote targets to establish whether the WebClient service is running or not. The repo by provides C# and BOF projects that check for the presence of this named pipe.
This output shows that the service is running WKSTN-1, which makes it a viable target for this attack. The steps are to coerce the service into authenticating to a malicious WebDAV server that we control and then relay the authentication. A nice aspect of this attack is that we can force authentication to occur over any port, so we don't have to worry about needing PortBender (I can hear you all cheering). All we need to ensure is that whatever port we choose is allowed inbound on the host firewall we're reverse port forwarding from.
The incoming authentication material will be that of the machine account. ntlmrelayx can relay this to LDAP on a domain controller to abuse either RBCD (using the --delegate-access flag) or shadow creds (using the --shadow-credentials flag). In either case, ensure you run the HTTP server on a port that will not clash with any of your HTTP listeners. In this example, I've used port 8888.
Once that's up and running, punch a hole in the firewall and set the reverse port forward.
Then use SharpSystemTriggers to trigger the authentication. The WebDAV URL needs to point to the reverse port forward.
Once the traffic hits ntlmrelayx, it will relay to the domain controller.
As indicated by the output above, a new machine account PVWUMPYT$ was created with password 4!t1}}I_CGJ}0OJ, which now has delegation rights to WKSTN-1$. To complete the attack chain, calculate the AES256 hash from the password.
Then perform the S4U2Proxy to request service tickets of your choosing.
Don't forget to remove the fake computer account.
The shadow credentials option will automatically dump a certificate file for you.
It can be converted to ccache format to use with Impacket, or base64 encoded to use with Rubeus.
Since this is a certificate, we use it to request a TGT first which can then be used for S4U2Self.
Ensure the keys are deleted after the attack.