OpenSSL

openssl enc -d -in Urlaubsphoto2.png.crypt.headerless -out Urlaubsphoto2.png.crypt.decrypted -iv ... -K ... -aes-128-cbc -nosalt -nopad

it’s pretty easy to hijack the code before it’s crypted and after it’s decrypted

I was about to hijack the OpenSSL library because the first versions of the Mac client were linked against the external OpenSSL library, so it was trivial for example to recompile OpenSSL with a printf dumping everything.

“By default, there is one and only one attribute that is written from an Entra user to an Active Directory user and that is the searchableDeviceKey -> msDS-KeyCredentialLink attribute flow… an abuse primitive known as ‘Shadow Credentials’… if we can add a public key to the msDS-KeyCredentialLink attribute of a user, we can obtain a TGT for that user with the private key.”

The choice to use the system's openssl binary rather than a Python cryptography library... The final bundle... is exfiltrated via a raw HTTP POST to the C2's root endpoint, using curl.

it’s pretty easy to hijack the code before it’s crypted and after it’s decrypted

I was about to hijack the OpenSSL library because the first versions of the Mac client were linked against the external OpenSSL library, so it was trivial for example to recompile OpenSSL with a printf dumping everything.

“By default, there is one and only one attribute that is written from an Entra user to an Active Directory user and that is the searchableDeviceKey -> msDS-KeyCredentialLink attribute flow… an abuse primitive known as ‘Shadow Credentials’… if we can add a public key to the msDS-KeyCredentialLink attribute of a user, we can obtain a TGT for that user with the private key.”

“By default, there is one and only one attribute that is written from an Entra user to an Active Directory user and that is the searchableDeviceKey -> msDS-KeyCredentialLink attribute flow… an abuse primitive known as ‘Shadow Credentials’… if we can add a public key to the msDS-KeyCredentialLink attribute of a user, we can obtain a TGT for that user with the private key.”

It connects to the device, changes the PSK to all zero if needed, sets up a TLS connection... To work around this, I simply open my own socket and proxy the TLS communication through it.

We can use this authkey.key to generate PVEAuthCookie... modifying the script to generate signed ticket using the found authkey.key... Running the script generates PVEAuthCookie.

Now we can request a certificate to impersonate another user like a DA, by specifying their User Principal Name (UPN)... certipy -debug req ... -upn administrator@lab.local ... Got the administrator.pfx certificate

What if we use the Spy to monitor which cache sets are being accessed by OpenSSL? The cache usage observed by the Spy reveals information about the exponent.

“We need to… obtain a TGT… bundle it in a PCKS12 file… use the PFX file with common tools like Rubeus… Rubeus.exe asktgt /user:jack.burton /certificate:… /getcredentials”

It connects to the device, changes the PSK to all zero if needed, sets up a TLS connection... To work around this, I simply open my own socket and proxy the TLS communication through it.

Microsoft’s schannel TLS implementation doesn’t exactly follow the standards and modifying the OpenSSL binaries to just stuff the client certificate down the servers throat, will result in it being processed anyway

Below is an example screenshot where we connect to a bind shell using OpenSSL on a remote windows virtual machine through an SSH tunnel