search

center-for-threat-informed-defense / adversary_emulation_library

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.
https://ctid.io/adversary-emulation
Apache License 2.0
1.68k stars 310 forks source link

Carbanak procedures 10.A.4 needs elevated privilege #86

Open minjimwu opened 3 years ago

minjimwu commented 3 years ago

Hi, I try to run Carbanak procedures in my lab. When I executing metasploit module "post/windows/manage/run_as" in step 10.A.3, it seems didn't have enough permission to change firewall settings.

kmitnick is a domain admin and I also confirm that domain admins group in local administrators group (cfo). As I know that metasploit run_as module didn't include feature to bypass UAC.

May I ask why kmitnick account has high privilege to change firewall setting? Should I change any policy in Windows before I run the script?