InfoSec LAB

Omni_PSCredential

Created: 3 min read

PSCredential Object

After realizing that the OS might be nested with another, I came across a few interesting file across 2 different users home directory

Administrator

PS C:\Data\Users\Administrator> cat root.txt
<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
  <Obj RefId="0">
    <TN RefId="0">
      <T>System.Management.Automation.PSCredential</T>
      <T>System.Object</T>
    </TN>
    <ToString>System.Management.Automation.PSCredential</ToString>
    <Props>
      <S N="UserName">flag</S>
      <SS N="Password">01000000d08c9ddf0115d1118c7a00c04fc297eb0100000011d9a9af9398c648be30a7dd764d1f3a000000000200000000001066000000010000200000004f4016524600b3914d83c0f88322cbed77ed3e3477dfdc9df1a2a5822021439b000000000e8000000002000020000000dd198d09b343e3b6fcb9900b77eb64372126aea207594bbe5bb76bf6ac5b57f4500000002e94c4a2d8f0079b37b33a75c6ca83efadabe077816aa2221ff887feb2aa08500f3cf8d8c5b445ba2815c5e9424926fca73fb4462a6a706406e3fc0d148b798c71052fc82db4c4be29ca8f78f0233464400000008537cfaacb6f689ea353aa5b44592cd4963acbf5c2418c31a49bb5c0e76fcc3692adc330a85e8d8d856b62f35d8692437c2f1b40ebbf5971cd260f738dada1a7</SS>
    </Props>
  </Obj>
</Objs>

The root.txt file at the home directory of the administrator user contains an encoded PSCredential object

It would require the password of the administrator user to decrypt this PSCredential object

app

ps c:\Data\Users\app> dir
 
 
    directory: C:\Data\Users\app
 
 
Mode                LastWriteTime         Length Name                          
----                -------------         ------ ----                          
d-r---         7/4/2020   7:28 PM                3D Objects                    
d-r---         7/4/2020   7:28 PM                Documents                     
d-r---         7/4/2020   7:28 PM                Downloads                     
d-----         7/4/2020   7:28 PM                Favorites                     
d-r---         7/4/2020   7:28 PM                Music                         
d-r---         7/4/2020   7:28 PM                Pictures                      
d-r---         7/4/2020   7:28 PM                Videos                        
-ar---         7/4/2020   8:20 PM            344 hardening.txt                 
-ar---         7/4/2020   8:14 PM           1858 iot-admin.xml                 
-ar---         7/4/2020   9:53 PM           1958 user.txt

There are 3 interesting file located at the home directory of the app user

  • hardening.txt
  • iot-admin.xml
  • user.txt

hardening.txt

PS C:\Data\Users\app> cat hardening.txt
cat : Access to the path 'C:\Data\Users\app\hardening.txt' is denied.
At line:1 char:1
+ cat hardening.txt
+ ~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (C:\Data\Users\app\hardening.t 
   xt:String) [Get-Content], UnauthorizedAccessException
    + FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsof 
   t.PowerShell.Commands.GetContentCommand

I am unable to read the file although I am an administrator

PS C:\Data\Users\app> takeown /F .\hardening.txt
takeown /F .\hardening.txt
 
SUCCESS: The file (or folder): "C:\Data\Users\app\hardening.txt" now owned by user "WORKGROUP\omni$".
 
PS C:\Data\Users\app> cat hardening.txt
cat : Access to the path 'C:\Data\Users\app\hardening.txt' is denied.
At line:1 char:1
+ cat hardening.txt
+ ~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (C:\Data\Users\app\hardening.t 
   xt:String) [Get-Content], UnauthorizedAccessException
    + FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsof 
   t.PowerShell.Commands.GetContentCommand
 
PS C:\Data\Users\app> icacls hardening.txt
icacls hardening.txt
hardening.txt NT AUTHORITY\SYSTEM:(DENY)(R)
              OMNI\Administrator:(F)
              OMNI\app:(F)
 
Successfully processed 1 files; Failed processing 0 files

The takeown command doesn’t seem to work as well as I still cannot read the file.

But, it at least allowed me to see check the ACLs of the file, which wasn’t possible before. It’s interesting how it has NT AUTHORITY\SYSTEM denied from accessing the file.

Although the SYSTEM account in Windows is a high-privileged account, the SYSTEM account is STILL subjected to ACLs and cannot overthrow or overwrite the access control

In order to access the file, I would have to be either the administrator or app user.

iot-admin.xml

ps c:\Data\Users\app> cat iot-admin.xml
cat iot-admin.xml
<objs version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
  <Obj RefId="0">
    <TN RefId="0">
      <T>System.Management.Automation.PSCredential</T>
      <T>System.Object</T>
    </TN>
    <ToString>System.Management.Automation.PSCredential</ToString>
    <Props>
      <S N="UserName">omni\administrator</S>
      <SS N="Password">01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e131d78fe272140835db3caa28853640000000002000000000010660000000100002000000000855856bea37267a6f9b37f9ebad14e910d62feb252fdc98a48634d18ae4ebe000000000e80000000020000200000000648cd59a0cc43932e3382b5197a1928ce91e87321c0d3d785232371222f554830000000b6205d1abb57026bc339694e42094fd7ad366fe93cbdf1c8c8e72949f56d7e84e40b92e90df02d635088d789ae52c0d640000000403cfe531963fc59aa5e15115091f6daf994d1afb3c2643c945f2f4b8f15859703650f2747a60cf9e70b56b91cebfab773d0ca89a57553ea1040af3ea3085c27</SS>
    </Props>
  </Obj>
</Objs>

Another encoded PSCredential object

However, this seems like a PSCredential object of the administrator user, considering the UserName attribute is set to omni\administrator.

user.txt

PS C:\Data\Users\app> cat user.txt
cat user.txt
<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
  <Obj RefId="0">
    <TN RefId="0">
      <T>System.Management.Automation.PSCredential</T>
      <T>System.Object</T>
    </TN>
    <ToString>System.Management.Automation.PSCredential</ToString>
    <Props>
      <S N="UserName">flag</S>
      <SS N="Password">01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e131d78fe272140835db3caa288536400000000020000000000106600000001000020000000ca1d29ad4939e04e514d26b9706a29aa403cc131a863dc57d7d69ef398e0731a000000000e8000000002000020000000eec9b13a75b6fd2ea6fd955909f9927dc2e77d41b19adde3951ff936d4a68ed750000000c6cb131e1a37a21b8eef7c34c053d034a3bf86efebefd8ff075f4e1f8cc00ec156fe26b4303047cee7764912eb6f85ee34a386293e78226a766a0e5d7b745a84b8f839dacee4fe6ffb6bb1cb53146c6340000000e3a43dfe678e3c6fc196e434106f1207e25c3b3b0ea37bd9e779cdd92bd44be23aaea507b6cf2b614c7c2e71d211990af0986d008a36c133c36f4da2f9406ae7</SS>
    </Props>
  </Obj>
</Objs>

Same here. Another encoded PSCredential object

This PSCredential object would requires the password of the app user for decryption

Interactive Graph View

Backlinks