In this lesson,
we're going to explore the topic of account creation
during the post-exploitation phase,
focusing on how attackers obtain valid account credentials
and add new accounts to maintain access
and control over a compromised system.
First, let's set the stage by discussing
what the post-exploitation phase is.
After attacker has successfully compromised a system,
they enter the post-exploitation phase.
This phase involves activities
that help the attacker maintain access,
gather additional data, and further infiltrate the network.
One of the primary goals during this phase
is to establish persistent access,
ensuring that the attacker can't return
to the compromised system,
even if the initial vulnerability is patched
or the system is rebooted.
The best way to do this is through account creation.
Obtaining valid account credentials
is often the first step.
Attackers use many methods to capture
or extract these credentials.
One common technique is credential dumping,
where an attacker uses a tool like Mimikatz
to extract passwords, hashes,
and other authentication tokens from the system memory.
For instance, as penetration testers,
we can use Mimikatz to extract plain text passwords
from memory on Windows machines
if we are able to elevate our privileges,
allowing us to retrieve user credentials
without having to crack encrypted hashes.
Another method to obtain valid credentials
is through keylogging.
Attackers can install keyloggers,
which capture keystrokes on the compromised system.
This includes usernames and passwords as users type them in.
For example, the Emotet malware often installs keyloggers
to capture credentials,
which can be used to access other systems within a network.
Phishing attacks are also common methods
for obtaining credentials.
Attackers craft convincing emails
or messages that trick users into entering their credentials
on fake login pages.
Once the user submits their information,
the attacker captures these credentials
and can use them to log into legitimate systems.
The 2016 phishing attack
on the chairman of Hillary Clinton's presidential campaign
is a well-known example.
The attacker sent a fake Google login page,
capturing his credentials and accessing thousands of emails.
Once attackers have valid credentials,
they can use them to add new accounts to the system.
Adding new accounts ensures the attacker has direct access
without relying on the initial compromised account.
This can be done stealthily,
often using names that blend in
with existing accounts to avoid detection.
For example, an attacker might create
a new user account named "backup_admin" on
the Windows server,
mimicking legitimate accounts to avoid raising suspicion.
To add new accounts,
attackers use built-in system utilities.
On Windows, they might use the net user command.
For instance, net user backup_admin
P@ssw0rd /add
creates a new user named "backup_admin"
with the password being
"P@ssw0rd"
To add this user to administrators group,
they would then use
the net localgroup administrators backup_admin
/add command
This gives the new account administrative privileges,
ensuring the attacker has full control over the system.
On Linux systems,
attackers can use commands like useradd
to create new accounts.
For example, sudo useradd -m -s
/bin/bash backup_admin
creates a new user named "backup_admin"
with a home directory and bash shell access.
To set the password,
they might use echo "backup_admin:
P@assw
0rd" | sudo chpasswd
Then they could add the user to the sudoers file,
granting administrative privileges,
which can be done by editing the /etc/sudoers file
or by adding the user to the sudo group
with the command sudo usermod -aG
sudo backup_admin.
Attackers might also use more sophisticated techniques
to maintain stealth.
For instance, they could modify
the system's authentication mechanism
to create hidden accounts
that do not appear in standard user listings.
On Windows, they might manipulate the registry
to hide user accounts from the login screen.
On Linux, they can modify the PAM
or Pluggable Authentication Modules configuration
to allow backdoor access.
Creating accounts with legitimate credentials
also helps attackers evade detection.
Security monitoring tools often focus
on detecting unusual activity,
such as brute-force attacks or malware execution.
However, if an attacker uses valid credentials
and creates accounts through legitimate system commands,
their actions might blend in
with the regular administrative tasks,
making it harder for the security teams
to spot the intrusion.
So, remember, during the post-exploitation phase,
obtaining valid account credentials
and adding new user accounts are a critical step
for attackers to maintain persistent access.
Techniques like credential dumping, keylogging
and phishing are commonly used to capture user credentials.
Once obtained, these credentials can be used
to create new user accounts with administrative privileges,
ensuring the attacker retains control
over the compromised system.
Understanding these methods is essential
for implementing effective security measures to detect
and prevent unauthorized account creation
and to secure your system against persistent threats.