RID Hijacking: Maintaining Access on Windows Machines

Sebastián Castro

Location: Business Hall (Oceanside), Arsenal Station 3

Date: Thursday, August 9 | 11:30am-12:50pm

Track: Exploitation and Ethical Hacking

Session Type: Arsenal

The art of persistence is (and will be…) a matter of concern when successfully exploitation is achieved. Sometimes it is pretty tricky to maintain access on certain environments, especially when it is not possible to execute common vectors like creating or adding users to privileged groups, dumping credentials or hashes, deploying a persistent shell, or anything that could trigger an alert on the victim. This statement ratifies why it's necessary to use discrete and stealthy techniques to keep an open door right after obtaining a high privilege access on the target.

What could be more convenient that only use OS resources in order to persist an access? This presentation will provide a new post-exploitation hook applicable to all Windows versions called RID Hijacking, which allows setting desired privileges to an existent account in a stealthy manner by modifying some security attributes. To show its effectiveness, the attack will be demonstrated by using a module which was recently added by Rapid7 to their Metasploit Framework, and developed by the security researcher Sebastián Castro.

https://www.blackhat.com/us-18/arsenal/schedule/#rid-hijacking-maintaining-access-on-windows-machines-12079