arosenmund / defcon_31_ad_good_bad_lolWut

10 stars 8 forks source link

TWORIVERS needs .NET Framework 3.5 for Rubeus #8

Open rj-chap opened 1 year ago

rj-chap commented 1 year ago

image

I can help come up with a method to install via terraform, unless you can just add via host image.

arosenmund commented 1 year ago

I'll add via host image.

rj-chap commented 1 year ago

For now I added dotNetFx35setup.exe to the GH assets. But I don't think the env will pull it until the current pull request is open. The DISM method isn't working on the box.

So to continue with verifying my commands, I'll need to get this asset to the box for the TA to install or have you add via the image like you noted above. Was trying to make it easier on ya, but perhaps not so much!

rj-chap commented 1 year ago

A few CLI-based install methods that don't seem to be working on the host:

DISM method

PS C:\Users\Public\Desktop\LAB_FILES\assets\mimikatz_trunk\x64> Dism /online /Enable-Feature /all /FeatureName:"NetFx3"

Deployment Image Servicing and Management tool
Version: 10.0.20348.681

Image Version: 10.0.20348.1850

Enabling feature(s)
[==========================100.0%==========================]

Error: 12002

DISM failed. No operation was performed.
For more information, review the log file.

The DISM log file can be found at C:\Windows\Logs\DISM\dism.log
PS C:\Users\Public\Desktop\LAB_FILES\assets\mimikatz_trunk\x64> notepad C:\Windows\Logs\DISM\dism.log

2023-08-07 19:56:31, Info                  DISM   DISM.EXE: <----- Starting Dism.exe session ----->
2023-08-07 19:56:31, Info                  DISM   DISM.EXE: 
2023-08-07 19:56:31, Info                  DISM   DISM.EXE: Host machine information: OS Version=10.0.20348, Running architecture=amd64, Number of processors=2
2023-08-07 19:56:31, Info                  DISM   DISM.EXE: Dism.exe version: 10.0.20348.681
2023-08-07 19:56:31, Info                  DISM   DISM.EXE: Executing command line: "C:\Windows\system32\Dism.exe" /online /Enable-Feature /all /FeatureName:NetFx3
2023-08-07 19:56:31, Info                  DISM   DISM Manager: PID=212 TID=6068 physical location path: C:\ - CDISMManager::CreateImageSession
2023-08-07 19:56:31, Info                  DISM   DISM Manager: PID=212 TID=6068 Event name for current DISM session is Global\{B332309B-F2CD-44D0-A834-26989DDD40EA} - CDISMManager::CheckSessionAndLock
2023-08-07 19:56:31, Info                  DISM   DISM Manager: PID=212 TID=6068 Create session event 0x228 for current DISM session and event name is Global\{B332309B-F2CD-44D0-A834-26989DDD40EA}  - CDISMManager::CheckSessionAndLock
2023-08-07 19:56:31, Info                  DISM   DISM Manager: PID=212 TID=6068 Copying DISM from "C:\Windows\System32\Dism" - CDISMManager::CreateImageSessionFromLocation
2023-08-07 19:56:31, Info                  DISM   DISM Manager: PID=212 TID=6068 Successfully loaded the ImageSession at "C:\Users\ADMINI~1.WHE\AppData\Local\Temp\4F0CD03A-06DE-4824-9EC2-76B6B73193F0" - CDISMManager::LoadRemoteImageSession
2023-08-07 19:56:31, Info                  DISM   DISM Image Session: PID=2208 TID=1696 Instantiating the Provider Store. - CDISMImageSession::get_ProviderStore
2023-08-07 19:56:31, Info                  DISM   DISM OS Provider: PID=2208 TID=1696 Defaulting SystemPath to C:\ - CDISMOSServiceManager::Final_OnConnect
2023-08-07 19:56:31, Info                  DISM   DISM OS Provider: PID=2208 TID=1696 Defaulting Windows folder to C:\Windows - CDISMOSServiceManager::Final_OnConnect
2023-08-07 19:56:31, Info                  DISM   DISM Provider Store: PID=2208 TID=1696 Attempting to initialize the logger from the Image Session. - CDISMProviderStore::Final_OnConnect
2023-08-07 19:56:31, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2023-08-07 19:56:31, Info                  DISM   DISM Provider Store: PID=2208 TID=1696 Found and Initialized the DISM Logger. - CDISMProviderStore::Internal_InitializeLogger
2023-08-07 19:56:31, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2023-08-07 19:56:31, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2023-08-07 19:56:31, Info                  DISM   DISM Manager: PID=212 TID=6068 Image session successfully loaded from the temporary location: C:\Users\ADMINI~1.WHE\AppData\Local\Temp\4F0CD03A-06DE-4824-9EC2-76B6B73193F0 - CDISMManager::CreateImageSession
2023-08-07 19:56:31, Info                  DISM   DISM.EXE: Target image information: OS Version=10.0.20348.1850, Image architecture=amd64
2023-08-07 19:56:31, Info                  DISM   DISM.EXE: Image session version: 10.0.20348.1
2023-08-07 19:56:31, Info                  DISM   DISM Transmog Provider: PID=2208 TID=1696 Current image session is [ONLINE] - CTransmogManager::GetMode
2023-08-07 19:56:31, Info                  DISM   DISM Transmog Provider: PID=2208 TID=1696 Audit Mode: [No] - CTransmogManager::Initialize
2023-08-07 19:56:31, Info                  DISM   DISM Transmog Provider: PID=2208 TID=1696 GetProductType: ProductType = [ServerNT] - CTransmogManager::GetProductType
2023-08-07 19:56:31, Info                  DISM   DISM Transmog Provider: PID=2208 TID=1696 Product Type: [ServerNT] - CTransmogManager::Initialize
2023-08-07 19:56:31, Info                  DISM   DISM Transmog Provider: PID=2208 TID=1696 Product Type ServerNT : [Yes] - CTransmogManager::Initialize
2023-08-07 19:56:31, Info                  CSI    00000001 Shim considered [l:126]'\??\C:\Windows\Servicing\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.1846_none_b1a17e62f9a88ddd\wcp.dll' : got STATUS_OBJECT_PATH_NOT_FOUND
2023-08-07 19:56:31, Info                  CSI    00000002 Shim considered [l:123]'\??\C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.1846_none_b1a17e62f9a88ddd\wcp.dll' : got STATUS_SUCCESS
2023-08-07 19:56:31, Info                  DISM   DISM Driver Manager: PID=2208 TID=1696 Further logs for driver related operations can be found in the target operating system at %WINDIR%\inf\setupapi.offline.log - CDriverManager::Initialize
2023-08-07 19:56:31, Info                  CSI    00000001 Shim considered [l:126]'\??\C:\Windows\Servicing\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.1846_none_b1a17e62f9a88ddd\wcp.dll' : got STATUS_OBJECT_PATH_NOT_FOUND
2023-08-07 19:56:31, Info                  CSI    00000002 Shim considered [l:123]'\??\C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.1846_none_b1a17e62f9a88ddd\wcp.dll' : got STATUS_SUCCESS
2023-08-07 19:56:31, Info                  DISM   DISM OS Provider: PID=2208 TID=1696 Determined System directory to be C:\Windows\System32 - CDISMOSServiceManager::get_SystemDirectory
2023-08-07 19:56:31, Info                  DISM   DISM Package Manager: PID=2208 TID=1696 Finished initializing the CbsConUI Handler. - CCbsConUIHandler::Initialize
2023-08-07 19:56:31, Info                  CSI    00000001 Shim considered [l:126]'\??\C:\Windows\Servicing\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.1846_none_b1a17e62f9a88ddd\wcp.dll' : got STATUS_OBJECT_PATH_NOT_FOUND
2023-08-07 19:56:31, Info                  CSI    00000002 Shim considered [l:123]'\??\C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.1846_none_b1a17e62f9a88ddd\wcp.dll' : got STATUS_SUCCESS
2023-08-07 19:56:31, Info                  DISM   DISM Package Manager: PID=2208 TID=1696 CBS is being initialized for online use. More information about CBS actions can be located at: %windir%\logs\cbs\cbs.log - CDISMPackageManager::Initialize
2023-08-07 19:56:31, Info                  DISM   DISM Package Manager: PID=2208 TID=1696 Loaded servicing stack for online use only. - CDISMPackageManager::CreateCbsSession
2023-08-07 19:56:31, Info                  DISM   DISM Package Manager: PID=2208 TID=1696 Processing the top level command token(enable-feature). - CPackageManagerCLIHandler::Private_ValidateCmdLine
2023-08-07 19:56:31, Info                  DISM   DISM Package Manager: PID=2208 TID=1696 Attempting to route to appropriate command handler. - CPackageManagerCLIHandler::ExecuteCmdLine
2023-08-07 19:56:31, Info                  DISM   DISM Package Manager: PID=2208 TID=1696 Routing the command... - CPackageManagerCLIHandler::ExecuteCmdLine
2023-08-07 19:56:31, Info                  DISM   DISM Package Manager: PID=2208 TID=1696 Encountered the option "featurename" with value "NetFx3" - CPackageManagerCLIHandler::Private_GetPackagesFromCommandLine
2023-08-07 19:56:31, Info                  DISM   DISM Package Manager: PID=2208 TID=1696 Encountered an unknown option "featurename" with value "NetFx3" - CPackageManagerCLIHandler::Private_GetPackagesFromCommandLine
2023-08-07 19:56:31, Info                  DISM   DISM Package Manager: PID=2208 TID=1696 Feature NetFx3ServerFeatures with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2023-08-07 19:56:31, Info                  DISM   DISM Package Manager: PID=2208 TID=1696 Initiating Changes on Package with values: 5, 7 - CDISMPackage::Internal_ChangePackageState
2023-08-07 19:56:31, Info                  DISM   DISM Package Manager: PID=2208 TID=1696 CBS session options=0x40100! - CDISMPackageManager::Internal_Finalize
2023-08-07 20:05:11, Info                  DISM   DISM Package Manager: PID=2208 TID=4712  Error in operation: (null) (CBS HRESULT=0x80072ee2) - CCbsConUIHandler::Error
2023-08-07 20:05:11, Error                 DISM   DISM Package Manager: PID=2208 TID=1696 Failed finalizing changes. - CDISMPackageManager::Internal_Finalize(hr:0x80072ee2)
2023-08-07 20:05:11, Error                 DISM   DISM Package Manager: PID=2208 TID=1696 Failed processing package changes with session options - CDISMPackageManager::ProcessChangesWithOptions(hr:0x80072ee2)
2023-08-07 20:05:11, Error                 DISM   DISM Package Manager: PID=2208 TID=1696 Failed ProcessChanges. - CPackageManagerCLIHandler::Private_ProcessFeatureChange(hr:0x80072ee2)
2023-08-07 20:05:11, Error                 DISM   DISM Package Manager: PID=2208 TID=1696 Failed while processing command enable-feature. - CPackageManagerCLIHandler::ExecuteCmdLine(hr:0x80072ee2)
2023-08-07 20:05:11, Info                  DISM   DISM Package Manager: PID=2208 TID=1696 Further logs for online package and feature related operations can be found at %WINDIR%\logs\CBS\cbs.log - CPackageManagerCLIHandler::ExecuteCmdLine
2023-08-07 20:05:11, Error                 DISM   DISM.EXE: DISM Package Manager processed the command line but failed. HRESULT=80072EE2
2023-08-07 20:05:11, Info                  DISM   DISM Package Manager: PID=2208 TID=1696 Finalizing CBS core. - CDISMPackageManager::Finalize
2023-08-07 20:05:11, Info                  DISM   DISM Manager: PID=212 TID=6068 Closing session event handle 0x228 - CDISMManager::CleanupImageSessionEntry
2023-08-07 20:05:11, Info                  DISM   DISM.EXE: Image session has been closed. Reboot required=no.
2023-08-07 20:05:11, Info                  DISM   DISM.EXE: 
2023-08-07 20:05:11, Info                  DISM   DISM.EXE: <----- Ending Dism.exe session ----->

PowerShell method

Enable-WindowsOptionalFeature -Online -FeatureName "NetFx3"