An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.

Execution Flow

1) Explore

[Acquire known Windows administrator credentials] The adversary must obtain known Windows administrator credentials in order to access the administrative network shares.

Technique

• An adversary purchases breached Windows administrator credentials from the dark web.
• An adversary leverages a key logger or phishing attack to steal administrator credentials as they are provided.
• An adversary conducts a sniffing attack to steal Windows administrator credentials as they are transmitted.
• An adversary gains access to a Windows domain system/files and exfiltrates Windows administrator password hashes.
• An adversary examines outward-facing configuration and properties files to discover hardcoded Windows administrator credentials.

2) Experiment

[Attempt domain authentication] Try each Windows administrator credential against the hidden network shares until the target grants access.

Technique

• Manually or automatically enter each administrator credential through the target's interface.

3) Exploit

[Malware Execution] An adversary can remotely execute malware within the administrative network shares to infect other systems within the domain.

4) Exploit

[Data Exfiltration] The adversary can remotely obtain sensitive data contained within the administrative network shares.

Prerequisites

The system/application is connected to the Windows domain.
The target administrative share allows remote use of local admin credentials to log into domain systems.
The adversary possesses a list of known Windows administrator credentials that exist on the target domain.

Skills Required

Once an adversary obtains a known Windows credential, leveraging it is trivial.

Resources Required

A list of known Windows administrator credentials for the targeted domain.

Mitigations

Do not reuse local administrator account credentials across systems.
Deny remote use of local admin credentials to log into domain systems.
Do not allow accounts to be a local administrator on more than one system.

Faiblesses connexes

References

REF-577

Overview of problems that may occur when administrative shares are missing
https://support.microsoft.com/en-us/help/842715/overview-of-problems-that-may-occur-when-administrative-shares-are-mis

REF-578

HAPT15 is alive and strong: An analysis of RoyalCli and RoyalDNS
Rob Smallridge.
https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/

REF-579

Operation Cobalt Kitty: Cybereason Labs Analysis
Assaf Dahan.
https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf

Submission

Modifications