-
Notifications
You must be signed in to change notification settings - Fork 18
/
Setup-Secure-Autologon.ps1
203 lines (166 loc) · 8.08 KB
/
Setup-Secure-Autologon.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
# ISSUE: When Windows is configured to auto login a user, that users credentials are stored in clear text in the registry
# SOLUTION: Run this script to encrypt the password value in the registry and hide it from malicious actors using the same LSAutil object as AutoLogon from the Sysinternals Suite
# REFERENCE LINK: https://docs.microsoft.com/en-us/windows/win32/secauthn/protecting-the-automatic-logon-password
# DOWNLOAD LINK: https://docs.microsoft.com/en-us/sysinternals/downloads/autologon
Write-Output "[*] Checking to see if autologin is already configured using a clear text password"
$AutoLoginCreds = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" | Select-Object -Property "ForceAutoLogon","DefaultUserName","DefaultPassword"
If (($AutoLoginCreds).DefaultPassword) {
Write-Output "[*] Obtained autologin credentials from the registry"
$User = $AutoLoginCreds.DefaultUserName
$Password = $AutoLoginCreds.DefaultPassword
} Else {
Write-Output "[*] Credentials required for autologin"
$Credential = Get-Credential -Message "If auto login user is a member of a domain, use the UserPrincipalName for the USER field"
$User = $Credential.Username
$Password = $Credential.GetNetworkCredential().Password
} # End If Else
Switch -Wildcard ($User) {
"*@*" {
$Domain = $User.Split("@")[-1]
$User = $User.Split("@")[0]
}
"*\*" {
$Domain = $User.Split("\")[0]
$User = $User.Split("\")[-1]
}
Default {
$Domain = $env:USERDOMAIN
}
} # End Switch
Add-Type @"
using System;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Text;
namespace PInvoke.LSAUtil {
public class LSAutil {
[StructLayout (LayoutKind.Sequential)]
private struct LSA_UNICODE_STRING {
public UInt16 Length;
public UInt16 MaximumLength;
public IntPtr Buffer;
}
[StructLayout (LayoutKind.Sequential)]
private struct LSA_OBJECT_ATTRIBUTES {
public int Length;
public IntPtr RootDirectory;
public LSA_UNICODE_STRING ObjectName;
public uint Attributes;
public IntPtr SecurityDescriptor;
public IntPtr SecurityQualityOfService;
}
private enum LSA_AccessPolicy : long {
POLICY_VIEW_LOCAL_INFORMATION = 0x00000001L,
POLICY_VIEW_AUDIT_INFORMATION = 0x00000002L,
POLICY_GET_PRIVATE_INFORMATION = 0x00000004L,
POLICY_TRUST_ADMIN = 0x00000008L,
POLICY_CREATE_ACCOUNT = 0x00000010L,
POLICY_CREATE_SECRET = 0x00000020L,
POLICY_CREATE_PRIVILEGE = 0x00000040L,
POLICY_SET_DEFAULT_QUOTA_LIMITS = 0x00000080L,
POLICY_SET_AUDIT_REQUIREMENTS = 0x00000100L,
POLICY_AUDIT_LOG_ADMIN = 0x00000200L,
POLICY_SERVER_ADMIN = 0x00000400L,
POLICY_LOOKUP_NAMES = 0x00000800L,
POLICY_NOTIFICATION = 0x00001000L
}
[DllImport ("advapi32.dll", SetLastError = true, PreserveSig = true)]
private static extern uint LsaStorePrivateData (
IntPtr policyHandle,
ref LSA_UNICODE_STRING KeyName,
ref LSA_UNICODE_STRING PrivateData
);
[DllImport ("advapi32.dll", SetLastError = true, PreserveSig = true)]
private static extern uint LsaOpenPolicy (
ref LSA_UNICODE_STRING SystemName,
ref LSA_OBJECT_ATTRIBUTES ObjectAttributes,
uint DesiredAccess,
out IntPtr PolicyHandle
);
[DllImport ("advapi32.dll", SetLastError = true, PreserveSig = true)]
private static extern uint LsaNtStatusToWinError (
uint status
);
[DllImport ("advapi32.dll", SetLastError = true, PreserveSig = true)]
private static extern uint LsaClose (
IntPtr policyHandle
);
[DllImport ("advapi32.dll", SetLastError = true, PreserveSig = true)]
private static extern uint LsaFreeMemory (
IntPtr buffer
);
private LSA_OBJECT_ATTRIBUTES objectAttributes;
private LSA_UNICODE_STRING localsystem;
private LSA_UNICODE_STRING secretName;
public LSAutil (string key) {
if (key.Length == 0) {
throw new Exception ("Key lenght zero");
}
objectAttributes = new LSA_OBJECT_ATTRIBUTES ();
objectAttributes.Length = 0;
objectAttributes.RootDirectory = IntPtr.Zero;
objectAttributes.Attributes = 0;
objectAttributes.SecurityDescriptor = IntPtr.Zero;
objectAttributes.SecurityQualityOfService = IntPtr.Zero;
localsystem = new LSA_UNICODE_STRING ();
localsystem.Buffer = IntPtr.Zero;
localsystem.Length = 0;
localsystem.MaximumLength = 0;
secretName = new LSA_UNICODE_STRING ();
secretName.Buffer = Marshal.StringToHGlobalUni (key);
secretName.Length = (UInt16) (key.Length * UnicodeEncoding.CharSize);
secretName.MaximumLength = (UInt16) ((key.Length + 1) * UnicodeEncoding.CharSize);
}
private IntPtr GetLsaPolicy (LSA_AccessPolicy access) {
IntPtr LsaPolicyHandle;
uint ntsResult = LsaOpenPolicy (ref this.localsystem, ref this.objectAttributes, (uint) access, out LsaPolicyHandle);
uint winErrorCode = LsaNtStatusToWinError (ntsResult);
if (winErrorCode != 0) {
throw new Exception ("LsaOpenPolicy failed: " + winErrorCode);
}
return LsaPolicyHandle;
}
private static void ReleaseLsaPolicy (IntPtr LsaPolicyHandle) {
uint ntsResult = LsaClose (LsaPolicyHandle);
uint winErrorCode = LsaNtStatusToWinError (ntsResult);
if (winErrorCode != 0) {
throw new Exception ("LsaClose failed: " + winErrorCode);
}
}
private static void FreeMemory (IntPtr Buffer) {
uint ntsResult = LsaFreeMemory (Buffer);
uint winErrorCode = LsaNtStatusToWinError (ntsResult);
if (winErrorCode != 0) {
throw new Exception ("LsaFreeMemory failed: " + winErrorCode);
}
}
public void SetSecret (string value) {
LSA_UNICODE_STRING lusSecretData = new LSA_UNICODE_STRING ();
if (value.Length > 0) {
//Create data and key
lusSecretData.Buffer = Marshal.StringToHGlobalUni (value);
lusSecretData.Length = (UInt16) (value.Length * UnicodeEncoding.CharSize);
lusSecretData.MaximumLength = (UInt16) ((value.Length + 1) * UnicodeEncoding.CharSize);
} else {
//Delete data and key
lusSecretData.Buffer = IntPtr.Zero;
lusSecretData.Length = 0;
lusSecretData.MaximumLength = 0;
}
IntPtr LsaPolicyHandle = GetLsaPolicy (LSA_AccessPolicy.POLICY_CREATE_SECRET);
uint result = LsaStorePrivateData (LsaPolicyHandle, ref secretName, ref lusSecretData);
ReleaseLsaPolicy (LsaPolicyHandle);
uint winErrorCode = LsaNtStatusToWinError (result);
if (winErrorCode != 0) {
throw new Exception ("StorePrivateData failed: " + winErrorCode);
}
}
}
}
"@
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "DefaultUserName" -Value $User
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "DefaultDomainName" -Value $Domain
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "AutoAdminLogon" -Value "1"
[PInvoke.LSAUtil.LSAutil]::New("DefaultPassword").SetSecret("$($Password)")
Write-Output "[*] Verify the DefaultLogonPassword value below is empty"
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" | Select-Object -Property "DefaultUserName","DefaultPassword"