An novel post-intrusion attack technique allows hackers to hijack a Windows system component called RID, allowing the adversaries to assign administrative privileges to “guest” and other low-level accounts.
The technique is simple and does not require a lot of sophistication, security researcher Sebastian Castro, who discovered the hack, told Threatpost. Microsoft was notified of the attack technique when it was discovered almost a year ago – and has yet to offer a fix, the researcher said.
“We have discovered and created a new post-exploitation technique called RID Hijacking,” Castro said in a recent blog post. “By using only OS resources, it is possible to hijack the RID of any existing account on the victim (even the 500 Administrator Built-in Account), and assign it to another user account.”
The attack starts in the Relative Identifier (RID), a component in Windows user accounts. RIDs are a label as part of Security Account Managers (SAMs), which describe a user’s varying permissions. SAMs typically have RID code at the end to define user permissions.
Two common RIDs in particular are the focus of the attack: the number 500 is commonly used at the end of SAMs for an Admin account, while 501 is used for a Guest Account.
The hijacking technique effectively manipulates the registry keys storing this information, and modifies the RID with accounts. So, the 501 labeling a guest account would be changed to 500, indicating permissions of an administrator.
“After compromising a machine, it is possible to automatize this attack remotely via PSExec, Remote Desktop, Powershell and also by using offensive tools like Metasploit,” Castro told Threatpost. “Since this is a persistence technique and not a privilege escalation vector, it is necessary to have elevated privileges already to deploy the attack.”
The Metasploit software to automatize the attack requires a meterpreter session against the victim – the module for this can be found at the latest official release of the MSF framework at post/windows/manage/rid_hijack, Castro said.
The attack was tested on Windows XP, Windows Server 2003, Windows 8.1 and Windows 10.
The attack does come with drawbacks – it cannot be done remotely (unless the computer is left unprotected on the internet). However, once a system has been exploited, it is difficult to detect.
“It is possible to find out if a computer has been victim of the RID Hijacking attack by looking inside the registry and checking for inconsistencies on the SAM,” he told us. “On the other hand, it is not so easy to detect right when exploited, because this attack could be deployed by using OS resources without triggering any alert on the victim.”
Castro said he reached out Microsoft as soon as the module was developed in December 2017, but did not receive any kind of response from them.
Microsoft, for its part, told Threatpost that it is looking into the report.
“Microsoft has a strong commitment to security and a demonstrated track record of investigating and resolving reported vulnerabilities,” Jeff Jones, senior director at Microsoft, told Threatpost. “We’re looking into this report, and if we determine we need to take further action to help keep customers protected, we will.”
