With many defenders keenly focused on identifying malicious activity including lateral movement, we as attackers must adapt techniques beyond the vanilla offerings of our typical toolsets. These built pivoting in techniques, such as WMI and PSExec pivots in Cobalt Strike, are very convenient but often set off many alarms. We are sharing a few methods we have used as alternatives.
Splunk is a powerful log aggregation and search engine, but with great power comes great hackability, or was it responsibility? Either way, we like to take advantage of Splunk deployments when we can.
Splunk log collection agents, known as Universal Forwarders, are often widely deployed to collect and forward logs from workstations and servers. These Universal Forwarders contain a lot of power, including the ability to run Splunk applications. We can craft a Splunk application with a scripted input, that when run by the Universal Forwarder, will run our payload. As a bonus, this scripted input will continue to run on a periodic basis, also giving us persistence. Another win for the baddies like us, nearly all Splunk Universal Forwarder installs in the wild are running as System or root.
A Splunk application is just a collection of files/folders. Your evil splunk app should have a malicious payload/script and a inputs.conf file specifying when to run it.
start "Log Collection" "C:\Program Files\SplunkUniversalForwarder\etc\apps\TA_winesc\bin\evil.exe"
Don't forget to put your exe payload evil.exe in the bin folder as well!
This is just one example, but one we like to use because the bat wrapper gives us some nice persistence by ensuring the payload will be restarted by the Splunk Forwarder whenever the payload dies.
For lateral movement, this task is trivial as we merely need to copy our malicious application folder into <splunk_install_dir>/etc/apps on the targeted host. Thats it, the Splunk Universal Forwarder will eventually load our application and give us a callback. This file copy can be done through Cobalt Strike's file browser GUI by simply browsing to the admin share of the target host and dropping in the application folder and files. Any file copy command, such as xcopy, or using explorer.exe if you have a gui, will also work fine. Here is an example of doing it with xcopy.
run: xcopy /E "c:\temp\evil_app " "\\sql.CORP.DERUMO.COM\c$\Program Files\SplunkUniversalForwarder\etc\apps\evil_app"
Once the application file is copied over and in place, it can take a while for the app callback to occur. This can optionally sped up by asking the Splunk Service to restart. One way to do this is using WMI to restart the Splunk Universal Forwarder Service. Tevora added service control functionaility into SharpWmi to do this, but any method to control services should work.
If all goes well, you should have a SYSTEM shell (typically) on the targeted system. This lateral movement technique has let us fly under the radar in many environments, and Splunk Universal Forwarders are ubiqitous enough in the enterprise to be reliably found in most of our engagements.
Another method Tevora has used to great success is the InstallUtil binary, an execution method that allows for application whitelisting bypass and pairs well with WMI for lateral movement. While operating in a heavily restricted environemnt, Tevora settled upon this method after recalling Casey Smith's(@subTee) blogs on AppLocker bypass with InstallUtil.exe. By combining Casey Smith's code listed here with a few scripts, pivoting with Cobalt Strike was made relatively simple.
With this we will need to finish a few tasks before it is ready to be used.
A spur the moment very simple bash script to automate some of this. It will upload the binary to the remote host with Impacket's wmiexec and then execute InstallUtil.exe. Unfortunately this isn't the cleanest method due to dropping an assembly directly on the system.
These are just a few methods we have used, and are far from perfect for every engagement. The important thing is to be ready to use alternative method of pivoting than the vanilla options from toolsets like Cobalt Strike, Empire, and Metasploit. Try new things, tweak old things, and evolve your methods until you find something that best fits your current engagement. Hopefully these methods discussed here provide some inspiration for that.