Impacket Remote Execution Tools - smbexec.py

smbexec.py is a script that comes with Impacket. It allows remote code execution through a semi-interactive shell by creating services that execute commands sent by the attacker. This blog post is a post from a series of posts to analyze Impacket remote execution tools (the previous post was the analysis of the atexec.py). In this blog post we will take a look at how this tool work, analyze it's artifacts and write Rhaegal rules to automate detection. 

Lab Environment

This lab environment does not have any kind of additional monitoring or logging (the default config) to simulate worst case scenario. The following table lists the lab environment specifications:

Analysis

You can download Impacket along with smbexec.py from HERE. Let's start by executing the following command:

After executing this command a connection will be established with the remote server and three Windows Event Logs will be recorded, The first is successful login (Security Event ID 4624) with the login type 3. The second is a service creation on the System log with the Event ID 7045. Finally an event in the System log with the Event ID 7009. The following is the service creation event in the System log (Event ID 7045):

The service name is set to BTOBTO which is a hard coded service name. The Service File Name or the binPath for the service is the command to be executed. The above command will do the following:

1. Write the command cd > \\127.0.0.1\C$\__output 2> &1 to the file %TEMP%\execute.bat which is C:\windows\temp\execute.bat because it is running as SYSTEM.
2. Execute C:\windows\temp\execute.bat.
3. Delete C:\windows\temp\execute.bat.
4. Get command results from C:\__output ( same as \\127.0.0.1\C$\__output).
5. Delete C:\__output.

When you first connect cd will be executed so it will show up as the current working directory on the semi-interactive shell (C:\windows\system32 in this case). Some time the command will fail before clean up which will result in the file execute.bat and __output not being deleted. In this example I ran the command ping -n 50 127.0.0.1 that crashed smbexec.py with the following error message:

If we go to the server we can see the file execute.bat and __output still on the system:

The file execute.bat will contain the full command executed:

And the file __output will contain the results for execute.bat:

Keep in mind all of these name BTOBTO, __output and executable.bat could be changed easily. The following is a snippet from the source code for smbexec.py:

# TRUNCATED
OUTPUT_FILENAME = '__output'
BATCH_FILENAME  = 'execute.bat'
SMBSERVER_DIR   = '__tmp'
DUMMY_SHARE     = 'TMP'
SERVICE_NAME    = 'BTOBTO'
# TRUNCATED

The service name can also be changed using the switch -service-name.

Artifacts

private SMBExecServiceCreated
{
    metadata:
      author: "AbdulRhman Alfaifi"
      reference: "internal research"
      creationDate: "10/08/2020"
      score: 200
      description: "Detected remote execution tool smbexec.py"
    Channel: "System"
    include:
      EventID: "7045"
    returns:
    - "Data.ServiceName"
    - "Data.ImagePath"
    - "Security.UserID"
    - "Channel"
}
private SMBExecServiceTimeout
{
    metadata:
      author: "AbdulRhman Alfaifi"
      reference: "internal research"
      creationDate: "10/08/2020"
      score: 200
      description: "Detected remote execution tool smbexec.py"
    Channel: "System"
    include:
      EventID: "7009"
    returns:
    - "Data.param2"
    - "Channel"
}
public SMBExecDetected
{
    metadata:
      author: "AbdulRhman Alfaifi"
      reference: "internal research"
      creationDate: "10/08/2020"
      score: 200
      description: "Detected remote execution tool smbexec.py"
    include:
      rule:
      - "SMBExecServiceCreated"
      - "SMBExecServiceTimeout"
      if:
        within: 500
}
public SMBExecSessionStarted
{
    metadata:
      author: "AbdulRhman Alfaifi"
      reference: "internal research"
      creationDate: "10/08/2020"
      score: 200
      description: "Detected remote execution tool smbexec.py"
    Channel: "System"
    include:
      EventID: "7045"
      Data.ImagePath: "*echo cd*"
    returns:
    - "Data.ServiceName"
    - "Data.ImagePath"
    - "Security.UserID"
    - "Channel"
}