NTUSER.MAN

0:00Every user on your Windows computer has what's called an NT user.dat file. It's your registry. It stores your settings, your preferences, your configuration, just about everything about you, your account, and your profile on your computer. It all lives in that file. The ntuser.dat file gets loaded when you log

0:20into your computer, locked while you're actively using Windows, and then written back once you sign out. But you probably already knew all that. Here's something that you might not know. There's actually another file that can completely override nuser.dat. It's called ntuser.mman. And if a hacker drops that ntuser.mman

0:42file into your profile folder, your next login, it loads their registry, not yours. There's no API calls, no registry callbacks, something that antivirus and edr or endpoint detection response might miss. And I got to be honest, I had no idea that was a thing that existed. Let me show you something wild. If I were to

1:03go ahead and create just a new file here for our own nuser.mman file, and it's completely blank. It's empty. I'll take a look at the properties here. You can see zero bytes in size. There's nothing in it. All I'll do is put this here in the user profile. And if I try to sign out and then log

1:21back in, you'll see it's kind of broken. Let me log back in with my user password here. And it's like from a fresh clean slate. It's going to try to provision and get my account profile set up, but it's not going to work. I've been letting this run for like 10 minutes and it's still going. It's not making any

1:43progress because there's nothing for it to load. It's an empty file. It's broken. Now this sort of denial of service is neat but what's really important here is that this means you can control the registry and that might be a persistence mechanism to keep access to a victim or target computer oftentimes used for ethical hacking or

2:04red teaming or penetration testing or what shady cyber criminals threat actors and real hackers are up to. Also, hi, happy new year. It's been about a month since I've recorded a video. Took a break for the holidays. So, for those of you that are keeping up with the channel in real time, uh, I feel like I'm like

2:20coming out of hibernation here. Anyway, just before the new year, I saw this write up and blog post published and shared titled registry rights without registry callbacks from Deceptically announced that they're now a part of Thinst Canary. So, hey, congrats. And this post is by Rad Kawir. Want to give him credit where credit is due. Met him

2:42at Zecon. I'll include a link of course in the video description here, but he's talking about how registry persistence on Windows still remains one of the most reliable ways to survive a reboot. And they're discussing this ntuser.man trick and technique to establish registry persistence and registry rights against HKCU or HQ current user at medium

3:05integrity without triggering registry callbacks. And what we mean by registry callbacks are the things that like a security solution would be able to detect and uncover. They can flag. They can raise an alert on because what I showed you just previously when we opened up our file explorer to see inside of our user path and what was our

3:24ntuser.dat file looking at hidden items. You can see that here that's loaded into your Windows registry. you could open up with the registry editor and that is essentially your HQ current user or HKCU Hive. A couple of the locations in here are where malware certainly likes to try

3:45and hide. And the post linked below talks a lot about how different EDR providers or any security solution might have detectors for this or rules and things to be able to monitor what's going down in certain locations in the registry. The way they do that is that they're looking at modifications rights to the registry that go through

4:06these different registry API or function calls that trigger different callbacks and then generate telemetry that they're able to see and raise alerts, events, and signals for. But apparently there's this thing called mandatory profiles in Windows where a man extension means it's a mandatory profile. originally used for

4:28kiosks and shared workstations. But if it sees that present, it will load that first instead of the standard ntuser.dat file. And that is intended use. When nuser.mman exists, Windows does not merge it with ntuser.dat like load in other fields, properties, keys, and hive

4:49stuff. They just end up clobbering the thing entirely. it becomes the HKCU hive for that user and their session. So that's it. You just put the file there and that means that it's not going to trigger any new registry rights, but it will raise some file system events or at least like one. Now again, I didn't know

5:10this entuser. And I started to wonder, are cyber criminals and threat actors and hackers already using and abusing this? So, I found this site and forgive me I I can't say I don't know if this codeb.net website is I don't want to claim to say oh uh oh they're hackers doing shady cyber crime illegal stuff. Uh it looks

5:29just like kind of an information sharing resource and forum on infosc uh information security and cyber security. But there are some posts of course in uh Russian language that are maybe showcasing some tools that do some peculiar strange stuff. I don't know. I don't want to be throwing stones. But this post dates way back to like 2018.

5:49And I did see the original Deceptic article be shared on RAMP that is a cyber crime forum. They're pay to play. You need like however many Bitcoin to be able to create an account. So I wish I could show you here, but actually I can kind of show you because how I've been tracking these down is all thanks to

6:05Flare. Now Flare is the sponsor of this video and they do really support the channel. So you probably seen me screaming and shouting about them because they're awesome and phenomenal all the time. But if I just search for ntuser.mman, take a look. First couple results are showcasing how this has been posted on ramp with their onion link cyber crime

6:23forum the day after it was originally published on Deceptic with the exact same thread title. And you can see a lot of folks chatting in their commentary and comments on that. That's just the top result out of 41 different results. Well, I'm sort of using this as like a Google search across the dark web across cyber crime forums, communities, or even

6:43just stuff that's out on the open internet like script or okay, code by like we saw they're cataloging even Google dorks like stuff from an old mail archive that's back to 2021. A lot of folks sharing this on GitHub and probably Okay, yeah, forensic analysis. So, apparently this is known. I just didn't know it and haven't seen it

7:03before. But Flare is super cool because they're tracking these GitHub repositories or even paste bin stuff that just might be thrown out and cast to the internet. And look, chatter about this dates back to like 2010. So being able just to do that threat research is super duper cool. If you haven't heard of Flare before, they are a cyber threat

7:22exposure management solution that's tracking all this information so that you can better protect yourself, your company, your business, your employees, your team members, and realistically stop attacks by rotating credentials when they find these leaked sensitive secrets like passwords out and about on the dark web or any of the shady corners and crevices of the internet where cyber

7:43criminals are lurking. They're tracking so much information with a ginormous data set. things like info stealer malware logs, ransomware, and all these real current threats to you and your organization. Flare is staying one step ahead of it. You can define in your tenant different identifiers for things that you want to alert on whenever they're exposed like your domain name,

8:03like your email addresses, like passwords, anything they might be tracking. And you can tie this to different online identities in your Entra ID or Microsoft 365 environment so that if any of your users have their passwords, secrets or credentials exposed from a data breach and a hacker is going to try and take advantage of it at 2 in the morning on a Saturday when

8:21you're not on keyboard, hey, Flare's already gone ahead and rotated the credentials, locked that down, and mitigated the threat so that you don't have to worry about it when you come into the office on Monday. And their new collections page is incredible. You can see all of the different events that they're pulling in across different categories like info stealer malware

8:38logs, Telegram chats where shady hackers are hanging out just sharing data leaks and everything. And you can see that they're pulling in all this different information from ransomware leak sites, elicit marketplaces. So much stuff, even name data breaches, stuff that's in the news and affecting the real world and your real business. Look, I think Flare

8:59is so so cool. I'm so grateful they support the channel. And if you're willing to help support everything that we're up to here, please do show them some love. There's a link in the video description. You can get started with a free trial and protect your exposed attack surface. Big thanks to Flare for sponsoring this video. All right, now

9:14let's do a demo of this Nuser.Mman trick and technique. The article mentions that medium integrity is sufficient. So just running as a local regular lowprivilege user. The target is the user's own profile directory which they have access to. So you don't need local administrator or administrator privileges. If the profile subsystem

9:36ends up loading ntus.mman instead of the original ntuser.dat not alongside it, well realistically we don't want to doss or denial a service or break it just like we did at the very beginning of the video. We kind of want to work off of their existing profile, their original hive and what the ntuser.dat originally looked like. So

9:59that should be our starting point and then we'll just end up adding persistence keys. I'm glad they note. Yeah, replacing the hive entirely results in a visibly broken session. So anyway, the way that we can export the NTUSER.dat contents like your HKCU HQ current user is realistically in two different ways. It can be binary like the rawhive that

10:20Windows will interpret or a regge file that's just plain text. If you try to export the entire binary, you do need to be admin. But if you do it with text, then totally fine. You can be low privilege and a regular user, your user. So this does mean you're going to have another little breadcrumb writing an artifact to disk on the victim where we

10:41export the user's HKCU Hive as the regge format. And they note that some beacon object files already exist for this. We've got another video on the channel for beacon object files. We add persistence entries and then we end up reconverting it into the binary format after the original plain text version. Then we just drop it into their profile

11:01and wait for them to log back in again. So, let's get on the keyboard and try to play with this. I'm going to bounce around between a couple different perspectives as the attacker and the victim. But right now, let's put our hacker hat on and try to work through this within Kali Linux so the internet knows, oh he he haha, we are real

11:20hackers here. I'm going to go ahead and open up a terminal. I'll F11 to full screen this and then I'll start to build out the payload. what I want to use to have my original access like we've compromised and put malware on the target computer to begin with so that we have the capability to set up this new

11:39persistence mechanism as the ability to maintain access in case their computer were ever shutting off or we just lost connection anything that could go wrong that we want to make sure we still have a foothold but first let's get our initial access I'll do this with sliver cool little command and control or quick

11:59framework for us to be able to get a implant and beacon and session connected here. We will want to generate the implant itself. And I'll take a quick look at what we need to provide here. Realistically, we could build a beacon itself or a stager or just a regular implant. Actually, before I do all this, because I'm working for the sake of

12:18demonstration, right? Look, I'm going to do uh different local virtual machines in my local environment. So, I need to know my own IP address. You could use IP add or show, but I like to use IP just for a little quick shorthand. So, I am local at 192.16811.205. Now, back in our sliver server, we could

12:40go ahead and then generate with an MTLS listener, which is I think pretty well common for those. Let's end up building out something for that IP address to call back to with a Windows target and architecture that we're targeting AMD64. And we'll save this just in my home directory as like implant.exe.

13:03Now it'll start to compile this binary that is our quick and easy virus malware. How we could get a call back. I will admit, right, this is going to get flagged by Windows Defender. That's a good thing. Okay, detection, defense, all good. But for the sake of demonstration, for the sake of our education, I am going to be turning off

13:23Windows Defender. So, we let this thing fire and we can just see the fireworks cooking show magic. This will take a couple more seconds to compile and put together the binary. And there it is. Let's get a listener up and running just as well. Now, back on the Windows victim side, this is where I'm going to need a

13:39little bit of your suspended disbelief. This is where I need you to bear with me and that we are doing the cooking show magic to say, "Look, the user got fished. They fell for a social engineering scheme. They downloaded the wrong Roblox mod off of some stupid YouTube video or GTA 6 hacks, whatever. They ended up downloading and running

13:59this malware and it was still able to fire." Now, back to our attacker perspective within Kali Linux. Hey, we see a session came right through. We have neat Karen ready to hang out with us. Excellent. Thanks Karen. Remember this is just our foothold. This is how we are now able to interact with and

14:20work with the target. We could explore what is available inside of this environment. We could ls to look in the current directory. We could get the network information, get our user information, upload, download, do whatever we want. Obviously, right now I am just inside of the downloads directory on that host. If I were to

14:41move up a directory and move into their user profile path, we could actually see if I were to diir or ls, forgive me. Well, I'll zoom out so you could actually see some of that. There's a lot going on here. You see a couple of these ntuser.dat files. That's what we want. But remember, it's locked. It's active

15:00because that user is still logged in. So we need to export it and well we could handle that really well and easily enough because we have the command line access and we could just ask the registry to export it to the regge plain text file format. So I know I should be using a beacon object file. I know I

15:18should be le sexy sophisticated sweet hacker but I'm just going to use a regular shell command. I appreciate sliver giving me the nice little slap in the face. This is pretty bad OBSAC, right? That's the stuff that gets hackers caught. Are you an adult? I sure am. Now we're in a shell. And now I could use the regge export command or

15:38anything else that we might just naturally run from like command prompt cmd.exe. All right, I cleared the screen just to clean things up a little bit for us. But now we can run that regge export command. Remember, we're going to be exporting a hive from the registry to write it out into that. Regge plain text file. And we want the HKCU or the HQ

15:58current user hive. We can go ahead and put that into a little tucked away place in the file system. Maybe C Windows tasks, just something out of sight, out of mind that the user might not run into. And we can call this something silly, simple, user settings.redge. Really doesn't matter. But let's use a /redge64. So we are also tracking that rendition.

16:20And there we go. The operation completed successfully. Now we have that file written to that location. And I'm curious, can we go ahead and download it with Sliver? So I have now exited out of the interactive shell like cmd.exe. I'm still in the context of this session. Neat. Karen is still hanging out with us. So let's try and now download that.

16:40C Windows tasks user settings.redge. Might not like where I am. I don't know if the forward slashes or the backslashes might be getting in the way. We could try to do that with forward slashes. And if that doesn't work well for us, we can go ahead and just move to that directory. But cool. It looks like it just wanted those. Maybe the

16:59backslashes were escaping incorrectly. But let me open up now another terminal and we could go take a look at what we have for our user settings.redge file. This is everything that was in your HQ current user hive and registry export. Again, this is everything that might be

17:19pertinent to your profile, to hey, what your configurations and settings and properties might be for your account here on Windows. I know there's a lot of nonsense, but again, we don't really have to care about this. We're just going to end up modifying this and adding in our own key to add some persistence capabilities here. And then

17:40remember the steps, we're going to end up bundling this back up into the binary format. Now I got to say that's kind of tough to do on Linux. Transforming the plain text.redge file into the Windows specific raw binary is something I haven't been able to track down any good Linux specific tools to do that.

18:00Hivewarming that they reference in the blog is a good approach. You can see back in uh the steps here they convert to binary hive format using a tool like hivewarming. And if we take a look on GitHub they do link it. Again I'll include a link in the video description. If you haven't seen this utility before, maybe this is valuable. Convert a regge

18:19file to a registry hive uh without needing administrator privileges. And this works well, but it is something in Windows like it's compiled for an executable. The releases here do give us a.exe. If any of you know a sweet way to do that on Linux, uh please do say the word. I'd be grateful. But that means I'm going to bounce from our Kali Linux

18:39attacker perspective and actually jump to an attacker Windows perspective just cuz that would be a little bit easier to be able to show this thing off. So here's my new perspective. Still wearing my hacker hat. I got my hacker hat on, but I am going to go get Hive Swarming and run that within here. And then we'll

18:57modify and actually add in our persistence mechanism to the plain text data that we'll just use Hivewarming to clean up. I want to download this here. We can put it on our desktop for the funsies. And I'm also going to now paste in the user settings.redge file that we know we were working with. Then I can just go ahead and kind of edit this with

19:17notepad, something silly, stupid or sublime text, right? But this is just the raw plain text. So there's nothing stopping us from just adding in some entries for something else we want to have fire. Regular persistence techniques on Windows and in the registry, right? like here's persistenceinfo.github.io. Again, of course, a link in the video description, but you could see some of

19:38the specific keys where you might be able to stage potential commands to run or fire as the user logs in. So, what we can now do is go find where we have the current version run registry key to auto start some program as the user logs in. I'm going to go ahead and search for that current version backslash run and

20:01see if we can track down anything that might be here already. Looks like we do have a couple entries for one drive, but we could add in our own. Just as a simple again, haha, maybe Google Chrome updater or something stupid with the silly name. And just as a proof of concept, let's run calc.exe.

20:21Once we have that saved into the user settings.redge file, now we could use our hive swarming command to try and convert that back into binary. So I'll open up a terminal and I'll move into the desktop so we have that easily accessible for us. Let's run our hive swarming executable. And we'll need to

20:43provide the format from to what we want and the input file and output file. So we'll run hive swarming from the plain text registry format to the new binary hive format using our user settings.redrege and then calling the new one ntuser.mman

21:05as the file that we want to create and there are no errors. So we have that working for us. Now in the current directory we have our ntuser.mman file. So if this works for us, if we were able to keep track of that user profile, this is all we need to go place on the victim. We can go back to our Kali Linux

21:26attacker side with our initial access to be able to go put that there as our persistence mechanism. So back over on Linux, I've just uploaded and put in my local directory on my Kali Linux host that same ntuser.mman file. So in the directory for the user profile of our victim, I could now upload our NT

21:48user.mman and that will be placed in that directory. So now all it takes is the victim logging out and logging back in and we'll see if we can get Calc to fire. So I'm going to go back to the victim perspective back over on Windows. Let me try and cross my fingers. If I sign out, I'll sign back in and we'll

22:11see if the user profile behaves. This is kind of the moment of truth. Will we get calc? Uh, how's our registry looking? We could take a look just for our own sort of testing. Do we have in our current user software Microsoft Windows current

22:32version run? There is Google Chrome updater with calc.exe. Did it run? Is it running? Let me take a look in our details here. Calc calculator. H. Should that be an absolute path? Let me just test this and maybe we can do something simple like

22:52notepad just to validate. I know I'm just testing kind of on the fly. Let me log back out and log back in and then we can test if that is what we would need to fix up inside of our uh registry export testing. Oh, there's notepad. Okay, so it fundamentally works. Now we

23:15could trigger it to just get a new implant in callback uh and make it a real fireworks demo for us, right? I know. Cooking show magic. We just had our implant in like literally the downloads folder. That's kind of dumb and stupid. Maybe you hid that a little bit better. Maybe you had actually have it pull down stage, inject into memory,

23:33do something extra sexy. But this could be what we want to trigger. But look, we actually saw it disconnect. So our persistence is very, very necessary. We could put these side by side. And let me get another connection just so we could stage it smartly and kind of like retrace our steps. So let's get temporary access to have our first

23:55foothold. We'll see Cali have that come back, right? So we can use that new session now that we're there. Currently in the downloads, but we can move to the parent directory. And then let's go modify back inside of our attacker Windows machine. We can edit our payload

24:15to actually run C users user our implant again. Again, you could do whatever you want here. This is just our little proof of concept. This is just for the sake of demonstration. But if we build this, let's get hiveswarming back in action. Run the same conversion to get it back to binary. Have our new entuser.mman.

24:36Let's get those stage into Linux just because that's where our connection is. Got that put back in place in my directory. Let's upload again. Oh, it's cuz it's loaded already. No, now it is in place of intuser.dat. So,

24:57it's essentially locked. That is one of the constraints that we're discussing inside the blog post. See, user hives remain locked while the session is active. Windows holds a handle, so we can't really modify. It cannot be swapped once the target user is logged in. So, we should have went for our persistence mechanism first rather than a little toy trinket proof of concept

25:19that I still needed to play with and fuss with. Anyway, okay. So, I've retraced my steps. I reverted back to get to a clean slate with an original NTUSer.dat file there that we'll replace with our ntuser. Just for the last fireworks to get another call back connection. You can see I do have this new session that we can use as our

25:39initial access. And if you take a look at the current directory I'm in, just the downloads where implant lived. Let me move back up to our user profile. And all I need to do at this point is upload that ntuser.mman file that we have prepoisoned. That is now backdoored based off of their

25:59original user profile. So on the victim side all that needs to happen is they just end up logging out and once they log back in here you can see the session is disconnected that's why we want our persistence mechanisms because we will lose that access but fingers crossed if I log back in all we've done is place

26:19this file we have circumvented registry rights that would make registry callbacks because this file ntuser.mman gets loaded instead of nuser.dat that. Fingers crossed. Will we see our call back? I'm crossing my fingers. I really hope something comes through. There. There it is. There it is. Oh,

26:41that's pretty cool. Now, you can see we lost the old session, but I can just jump right back in because we have a new session. Excellent. Now, we can maintain access as the attacker. There's persistence with NTUser. A couple last things that I didn't really dig into but are included in the blog. Again, link below. I'll include

27:01the documentation and everything. The coolest thing is that this could very well be used maybe even for lateral movement because those mandatory profiles can be assigned via Active Directory. Turns out they just can be pointed at like a network share and then you could maybe modify the profile path or maybe write to an existing profile share so that these could still be kind

27:23of proliferating out. Uh the detection capability really how do you detect this? It's kind of interesting. Like I brought this to the team at Huntress and big shout out Johnny Johnson. He was willing to do some extra research on this to kind of help get it to product and engineering side of the house. Uh and I've done some videos with him

27:39before. You can check out some of our event tracing logs for ETW on Windows. That is kind of cool stuff. But we were talking about like look you could detect the file write operations if that's what you're monitoring but you got to acknowledge that okay that means that you're looking for things after you've now implemented and added the capability

28:00for you to have visibility on this uh sometimes if you want to be able to look in the past if in case I don't know you're working with some host that just got onboarded or now new in the environment um you got to be looking for just the presence of the file in case they existed beforehand. So maybe that's

28:19sometimes tough to do. I don't know if you're using some RMM remote monitoring and management manager if we're able to interrogate hosts in mass and at scale to see look does this file exist across every potential user profile on the file system. So that's its own thing. But again, it could even exist as a strange man file somewhere else. So keep an eye

28:42out for where that might be. And if you're tracking this inside of some active directory environments, yeah, take a look at that profile path and uh dig into a lot of this stuff. Uh you should not really see these. They they are very rare in modern environments outside of kiosk or shared workstation configurations. Uh definitely dig into

29:00it. Thank you so much for watching everybody. Hope you enjoyed this video. Hope you learned something new. I know I did. This was just something that I was unfamiliar with and I wanted to showcase it and I was happy to take a little bit of a break for the holidays. But it feels pretty good to be uh getting back

29:12in the saddle and hopefully getting some YouTube videos out and some content and more education for you all. So, thank you again for all your support. Hey, if you want to support even more, please do give Flare some love. They are the sponsor of this video and I'm so so grateful for all the support with the channel. Uh link in the video

29:26description, grab a free trial, see what awesome stuff they can do to protect you, your company, your business, and everything else you're up to. Make security better. Thanks for watching everybody. See you in the next video.