trustedsec/cs-remote-ops-bof

Remote Operations BOF

This repo serves as an addition to our previously released SA repo. Our original stance was that we would not release our tooling that modified other systems, and we would only provide information gathering tooling in a ready to go format.

Over time, we have seen many other public security companies release their offensive facing tooling, and we now feel it is appropriate for us to release a portion of our offensive tooling.

Nothing in this repo is particularly special, it is basic Microsoft Windows operations in BOF form. These primitives can be used for a large variety of operations.

Injection BOF

We have decided to include the injection BOFs that we use when doing EDR detection testing. These BOFs are provided as is and will not be supported (everything under src/Injection and Injection/*)

You are welcome to use these, but issues opened related to these will be closed without review.

Available Remote Operations commands

Command	Notes
adcs_request	Request an enrollment certificate
adduser	Add specified user to a machine
addusertogroup	Add specified user to a group
chromeKey	Decrypt the provided base64 encoded Chrome key
enableuser	Enable and unlock the specified user account
get_priv	Activate the specified token privledge, more for non-cobalt strike users
lastpass	Search Chrome, brave memory for LastPass passwords and data
office_tokens	Collect Office JWT Tokens from any Office process
procdump	Dump the specified process to the specified output file
ProcessDestroy	Close handle(s) in a process
ProcessListHandles	List all open handles in a specified process
reg_delete	Delete a registry key
reg_save	Save a registry hive to disk
reg_set	Set / create a registry key
sc_config	Configure an existing service
sc_create	Create a new service
sc_delete	Delete an existing service
sc_failure	Configures the actions upon failure of an existing service
sc_description	Modify an existing services description
sc_start	Start an existing service
sc_stop	Stop an existing service
schtaskscreate	Create a new scheduled task (via xml definition)
schtasksdelete	Delete an existing scheduled task
schtasksrun	Start a scheduled task
schtasksstop	Stop a running scheduled task
setuserpass	Set a user's password
shspawnas	A misguided attempt at injecting code into a newly spawned process
shutdown	Shutdown or reboot a local or remote computer, with or without a warning/message
slack_cookie	Collect the Slack authentication cookie from a Slack process
unexpireuser	Set a user account to never expire
ghost_task	Add/Delete a ghost task.

Contributing

This repo is intended for single task Windows primitives. That is to say, even if it takes multiple calls, creating a scheduled task is appropriate.

A command that would attempt to pre-generate an implant and perform automated movement using the BOFs in this repo would be awesome. But is not appropriate for submission to this repo directly.

Code expectations

• Your code should compile without errors when using the default makefile
• Any new BOF defines for resolving functions will be placed in src/common/bofdefs.h
• Code will compile together using the default Makefile (single entry.c file)
• Code will likewise be compatible with the existing toolchain (mingw)
• Code will be written in C. This is to standardize and my personal confidence in validating the code.

What to expect as a contributor

After a pull request is received, it will receive an in-depth code review and testing.
After testing is completed, we will have zero or more rounds of change requests based on findings until there are no issues in the code. At that point it will be accepted into the repository, and your GitHub username will be added to our credit list. If you would prefer not to be added or some other handle to be used, just let me know.

cs-remote-ops-bof's Issues

how can i use schtaskscreate command ?

it looks like whatever i input,it returns xml malform error

xml content,the xml i use is copy from tasks dir btw.:

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2023-04-20T14:40:18</Date>
    <Author>Administrator</Author>
  </RegistrationInfo>
  <Triggers>
    <TimeTrigger>
      <Repetition>
        <Interval>PT30M</Interval>
        <StopAtDurationEnd>false</StopAtDurationEnd>
      </Repetition>
      <StartBoundary>2023-04-20T14:40:00</StartBoundary>
      <Enabled>true</Enabled>
    </TimeTrigger>
  </Triggers>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>false</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <Duration>PT10M</Duration>
      <WaitTimeout>PT1H</WaitTimeout>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>C:\Users\administrator\desktop\calc.exe</Command>
    </Exec>
  </Actions>
  <Principals>
    <Principal id="Author">
      <UserId>WIN-MHCC9K07ED3\Administrator</UserId>
      <LogonType>InteractiveToken</LogonType>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
</Task>

A stupid issues

please delete me

adcs_request fails when spaces in SUBJECT name

SUBJECTs are getting truncated when there are spaces in the name.

sc_create bug

When I use

sc_create TermleService "Remote Desktop Termle Services" "c:\windows\System32\svchost.exe -k netsvcs" "Allows users to connect interactively to a remote computer. Remote Desktop and Remote Desktop Session Host Server depend on this service. To prevent remote use of this computer, clear the checkboxes on the Remote tab of the System properties control panel item." 0 2

the result I get is

create_service:
hostname:
servicename: TermleService
displayname: Rmt eko emeSrie
binpath: c\idw\ytm2scotee- esc
newdesc: Alw sr ocnetitrcieyt eoecmue.Rmt eko n eoeDstpSsinHs evrdpn nti evc. opeetrmt s fti optr la h hcbxso h eoetbo h ytmpoete oto ae tm
desclen: 132
ignoremode: 0
startmode: 2
SUCCESS.

killit_end() leaks duplicated handle

Issue 1 correctness issue when checking to close handle

killit_end iterates through the handle table. The iteration loop closes duplicated handles. This works as expected though there is a logic issue with it checking the wrong parameter before closing.

    for (i = 0; i < handleInfo->Count; i++) {
        SYSTEM_HANDLE_ENTRY handle = handleInfo->Handle[i];
        UNICODE_STRING objectName;
        ULONG returnLength = 0;

...
-        if (processHandle) {    <<< because processHandle is valid, this code does actually close the dup'd handles, but I think the code intents to check dupHandle
+         if (dupHandle) {
            KERNEL32$CloseHandle(dupHandle); 
            dupHandle = NULL;
        }

Issue 2 Duplicated handle leak at function exit

A second issue is that after the last iteration of the loop, the function cleanup must close the last duplicated handle. It fails to do this due to a logic issue in the cleanup code:

 killit_end:
    if (handleInfo) {
        intFree(handleInfo);
        handleInfo = NULL;
    }

    if (processHandle) {
        KERNEL32$CloseHandle(processHandle);
!        processHandle = NULL;  <<< processHandle set to NULL
    }

    if (objectTypeInfo) {
        intFree(objectTypeInfo);
        objectTypeInfo = NULL;
    }

    if (objectNameInfo) {
        intFree(objectNameInfo);
        objectNameInfo = NULL;
    }

-    if (processHandle) {   <<< processHandle is guaranteed to be NULL here so this branch never executes
+    if (dupHandle) {
        KERNEL32$CloseHandle(dupHandle);
        dupHandle = NULL;
    }

These may be due to copy/paste errors.

CS-Remote-OPs-BOF/src/Remote/ProcessListHandles/entry.c

Line 295 in 1f00c7b

if (processHandle) {

Handle leak in suspendresume BOF due to failure to close token handle

The suspendresume BOF calls OpenProcessToken in go but fails to release the returned handled stored in currentTokenHandle at function exit. Suggested fix below:

VOID go( 
	IN PCHAR Buffer, 
	IN ULONG Length 
) 
{

...
	HANDLE currentTokenHandle = NULL;
!	BOOL getCurrentToken = ADVAPI32$OpenProcessToken(KERNEL32$GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &currentTokenHandle);   <<< must close currentTokenHandle
...
	if(getCurrentToken)
	{
		if (!SetPrivilege(currentTokenHandle, "SeDebugPrivilege", FALSE))
		{
			internal_printf("[+] SeDebugPrivilege Disabled!\n");
		}
+		KERNEL32$CloseHandle(currentTokenHandle);
	}
...
};

CS-Remote-OPs-BOF/src/Remote/suspendresume/entry.c

Line 193 in b6b6a5a

}

Wrong usage of CreateProcess

https://github.com/trustedsec/CS-Remote-OPs-BOF/blob/main/src/Remote/shspawnas/entry.c#L108-L125

If wspawnbin is C:\a.exe test, then the lpApplicationName should be C:\a.exe and lpCommandline should be C:\a.exe test

But in current code, lpApplicationName is C:\a.exe test and lpCommandline is test

To fix, just pass wspawnbin to lpCommandline and set lpApplicationName NULL

security bug: createTask calls VariantInit on uninitialized VARIANT in error cases

There is a small security bug in createTask where, in an error branch, several VARIANTs will be uninitialized and the code calls VariantClear on them. Recommend moving the variant initialization before the gotos.

DWORD createTask(const wchar_t * server, wchar_t * taskpath, const wchar_t* xmldef, int mode, BOOL force)
{
	HRESULT hr = S_OK;
	VARIANT Vserver;
	VARIANT VNull;
	VARIANT Vsddl;
	VARIANT Vthisuser;
@@ NOTE: VARIANTs are uninitialized at this point @@
...


	// Initialize COM
	hr = OLE32$CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
	if(FAILED(hr))
	{
		internal_printf("Failed to initialize COM (%lX)\n", hr);
!		goto createTask_end;  <<< jumps to cleanup before initializing variants
	}

	// Create System user string
	BSTRsystem = OLEAUT32$SysAllocString(USER_SYSTEM_STRING);
	if (NULL == BSTRsystem)
	{
		hr = ERROR_OUTOFMEMORY;
		internal_printf("SysAllocString failed (%lX)\n", hr);
!		goto createTask_end;     <<< jumps to cleanup before initializing variants
	}

	// Initialize variants
	OLEAUT32$VariantInit(&Vserver);
	OLEAUT32$VariantInit(&VNull);
	OLEAUT32$VariantInit(&Vsddl);
	OLEAUT32$VariantInit(&Vthisuser); // we don't clear this because we free both possible OLE strings
@@ NOTE: NOW VARIANTs are initialized @@
...


createTask_end:
...

!	OLEAUT32$VariantClear(&Vsddl);   <<<  security bug from calling VariantClear on uninitialized variant 💥
!	OLEAUT32$VariantClear(&Vserver); <<<  security bug from calling VariantClear on uninitialized variant 💥
 	//OLEAUT32$VariantInit(&Vthisuser); // we don't clear this because we free both possible OLE strings
	OLE32$CoUninitialize();

	return (DWORD)hr;
}

See (https://docs.microsoft.com/en-us/windows/win32/api/oleauto/nf-oleauto-variantclear)

Do not use VariantClear on uninitialized variants; use VariantInit to initialize a new VARIANTARG or VARIANT.

CS-Remote-OPs-BOF/src/Remote/schtaskscreate/entry.c

Line 523 in 37735ae

OLEAUT32$VariantClear(&Vsddl);

Similar issue in deleteTask():

CS-Remote-OPs-BOF/src/Remote/schtasksdelete/entry.c

Line 173 in 37735ae

OLEAUT32$VariantClear(&Vserver);

Similar issue in stopTask():

CS-Remote-OPs-BOF/src/Remote/schtasksstop/entry.c

Line 153 in 37735ae

OLEAUT32$VariantClear(&Vserver);

delete_regkey() closes the wrong handle in function cleanup resulting in a leaked registry handle

delete_regkey closes the wrong handle in function cleanup resulting in a leaked registry handle.

This looks like a copy/paste error. RemoteKey is not closed.

delete_regkey_end:
	if(RemoteKey)
	{
-		ADVAPI32$RegCloseKey(rootkey);
+		ADVAPI32$RegCloseKey(RemoteKey);
-		rootkey = NULL;
+		RemoteKey = NULL;
	}

	if(rootkey)
	{
		ADVAPI32$RegCloseKey(rootkey);
		rootkey = NULL;
	}
	
	if(targetkey)
	{
		ADVAPI32$RegCloseKey(targetkey);
		targetkey = NULL;
	}

CS-Remote-OPs-BOF/src/Remote/reg_delete/entry.c

Line 65 in 1f00c7b

ADVAPI32$RegCloseKey(rootkey);