• Email
• Facebook
• Twitter
• Google+
• Linkedin

HackTool.Python.Impacket.P

---

• マルウェアタイプ: ハッキングツール
• 破壊活動の有無: なし
• 暗号化:  
• 感染報告の有無: はい

---

  概要

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

プログラムは、ワーム活動の機能を備えていません。

プログラムは、バックドア活動の機能を備えていません。

---

  詳細

侵入方法

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

プログラムは、以下のファイルを作成します。

• {malware path}/smb.log → created to record local SMB server connection events and transaction logs

感染活動

プログラムは、ワーム活動の機能を備えていません。

バックドア活動

プログラムは、バックドア活動の機能を備えていません。

ルートキット機能

プログラムは、ルートキット機能を備えていません。

情報漏えい

プログラムは、以下の情報を収集します。

• When relaying authentication sessions against remote target systems, it gathers and steals the following information:
  • Command output (if the `-c` parameter is used)
  • Intercepted NTLM and NTLMv2 challenge-response hashes (NetNTLMv1 and NetNTLMv2), which can be saved to `{malware path}/{outputfile}.ntlm` and `{malware path}/{outputfile}.ntlmv2`
  • Local SAM database password hashes

その他

プログラムは、以下を実行します。

• Operates in one of two execution modes:
  • Relay Mode: Enabled when the `-h {Host}` parameter is specified; displays the notification message `[*] Running in relay mode` and relays all intercepted authentication credentials to the designated target server.
  • Reflection Mode: Default mode when `-h` is omitted; displays the notification message `[*] Running in reflection mode` and reflects the intercepted authentication credentials directly back to the connecting client machine.
• Acts as a Man-in-the-Middle (MitM) credential relay server by launching an HTTP server on port 80 and an SMB server on port 445 to intercept incoming authentication attempts.
• Intercepts NTLM Negotiate, Challenge, and Authenticate tokens from connecting victim clients and forwards them in real time to designated target Windows servers or reflects them back to the client.
• When an authentication attempt succeeds against the target host, it performs one of the following attack routines depending on supplied parameters:
  • If `-e {File Path}` is specified: Uploads the executable to `ADMIN$\` and executes it with `NT AUTHORITY\SYSTEM` privileges by creating, starting, and subsequently deleting a temporary Windows service via the Service Control Manager (`\PIPE\svcctl`)
  • If `-c {Command}` is specified: Executes the command remotely via remote registry and service creation (`RemoteOperations`), writes output to `%SystemRoot%\Temp\__output`, retrieves the output, and deletes the temporary output file
  • If neither `-e` nor `-c` is specified (default): Dumps local Security Account Manager (SAM) password hashes by extracting the Boot Key / Syskey from the `SYSTEM` registry hive, saving the `SAM` hive, and parsing all local user account LM/NTLM hashes via `secretsdump.py`
• Launches a background SOCKS5 proxy server to maintain and tunnel authenticated SMB sessions when the `-socks` flag is enabled.
• Intercepts and logs NTLM and NTLMv2 challenge-response hashes to a specified output file in John the Ripper / Hashcat compatible format for offline password cracking.
• Opens a read-only `IPC$` share on its local SMB server and configures its transaction log file as `{malware path}/smb.log`.
• Rejects anonymous authentication attempts to compel victim clients into submitting credentials (except for local loopback connections from `127.0.0.1`).
• Masquerades as a UNIX Samba server by transmitting `UNIX` operating system strings and `Samba` NativeLanMan identifiers to targets during SMB negotiations.
• It takes advantage of the following exploit(s):
  • CVE-2015-0005: Microsoft Windows Netlogon Security Feature Bypass Vulnerability → used to calculate, log in hexadecimal format, and apply SMB signing session keys via RPC over `\PIPE\netlogon` when SMB packet signing is enforced on target systems
• Operates as an SMB adversary-in-the-middle exploitation engine within the open-source Impacket framework, leveraging Impacket SMB server and client libraries to perform NTLM reflection and relay attacks.

マルウェアは、以下のパラメータを受け取ります。

• --help → used to show help message and exit
• -c {Command} → used to specify a command to execute on the target system If not specified, SAM password hashes are dumped
• -codec {Codec} → used to set the character encoding used for decoding command output from the target system (default: "ascii")
• -debug → used to enable diagnostic debug logging output
• -domain {Domain/IP} → used to specify the Domain FQDN or IP address to connect to using NETLOGON
• -e {File Path} → used to specify an executable file to upload and execute on the target system via a temporary Windows service
• -h {Host} → used to specify the target host to relay intercepted credentials to (runs in relay mode) If not specified, credentials are relayed back to the connecting client (runs in reflection mode)
• -machine-account {Account} → used to specify a domain machine account (domain/machine_name) to grab an SMB signing session key from NETLOGON
• -machine-hashes {LMHASH:NTHASH} → used to specify the domain machine account password hashes in LMHASH:NTHASH format
• -one-shot → used to execute the attack only once per target host following successful authentication
• -outputfile {Filename} → used to specify the base output filename to save intercepted NTLM and NTLMv2 challenge-response hashes in John the Ripper format
• -s {Status} → used to specify the status code to return to the connecting client after authentication (choices: 'success', 'denied', 'logon_failure'; default: "success")
• -socks → used to launch a background SOCKS proxy for the relayed connection
• -ts → used to prepend timestamps to console logging output

---

  対応方法

ご利用はいかがでしたか？　アンケートにご協力ください