# Suborner | The Invisible Account Forger

**URL:** <https://onehack.st/t/suborner-the-invisible-account-forger/232699>\
**Category:** Tools & Scripts\
**Tags:** tools, freebies\
**Created:** [February 5, 2023, 7:45pm UTC](https://onehack.st/t/suborner-the-invisible-account-forger/232699 "2023-02-05T19:45:32Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [February 5, 2023, 7:45pm UTC](https://onehack.st/t/suborner-the-invisible-account-forger/232699/1 "2023-02-05T19:45:32Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/e/d/ed808a687d8b6ae6e14dee5b416063aa652f8035.png)

[![Arsenal](https://github.com/toolswatch/badges/raw/master/arsenal/usa/2022.svg)](https://www.blackhat.com/us-22/arsenal/schedule/#suborner-a-windows-bribery-for-invisible-persistence-27976)

## What’s this?

A simple program to create a Windows account you will only know about 🙂

- Create invisible local accounts without `net user` or Windows OS user management applications (e.g. `netapi32::netuseradd`)
- Works on all Windows NT Machines (Windows XP to 11, Windows Server 2003 to 2022)
- Impersonate through [RID Hijacking](https://r4wsec.com/notes/rid_hijacking/index.html) any existing account (enabled or disabled) after a successful authentication

Create an invisible machine account with administrative privileges, and without invoking that annoying Windows Event Logger to report its creation!

## Where can I see more?

Released at [Black Hat USA 2022: Suborner: A Windows Bribery for Invisible Persistence](https://www.blackhat.com/us-22/arsenal/schedule/index.html#suborner-a-windows-bribery-for-invisible-persistence-27976)

- Blogpost: [R4WSEC - Suborner: A Windows Bribery for Invisible Persistence](https://r4wsec.com/notes/the_suborner_attack/index.html)
- Demo: [YouTube - Suborner: Creation of Invisible Account on Windows 11](https://youtu.be/TKIHRhaO5tk)
- Slides - [HITB Singapore Main Track - Suborner Slides](https://conference.hitb.org/hitbsecconf2022sin/materials/D2T1%20-%20Suborner%20-%20Windows%20Bribery%20for%20Invisible%20Persistence%20-%20Sebastian%20Castro.pdf)

## How can I use this?

### Build

- Make sure you have .NET 4.0 and Visual Studio 2019
- Clone this repo: `git clone https://github.com/r4wd3r/Suborner/`
- Open the .sln with Visual Studio
- Build x86, x64 or both versions
- Bribe Windows!

### Release

Download the [latest release](https://github.com/r4wd3r/Suborner/releases) and pwn!

### Usage

```auto
 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

      88
  .d88888b. S U B O R N E R
 d88P 88"88b
 Y88b.88 The Invisible Account Forger
 "Y88888b. by @r4wd3r
      88"88b v1.0.1
 Y88b 88.88P
  "Y88888P" https://r4wsec.com
      88
 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Description:

    A stealthy tool to create invisible accounts on Windows systems.

Parameters:

    USERNAME: Username for the new suborner account. Default = <HOSTNAME>$
    Syntax: /username:[string]

    PASSWORD: Password for the new suborner account. Default = Password.1
    Syntax: /password:[string]

    RID: RID for the new suborner account. Default = Next RID available
    Syntax: /rid:[decimal int]

    RIDHIJACK: RID of the account to impersonate. Default = 500 (Administrator)
    Syntax: /ridhijack:[decimal int]

    TEMPLATE: RID of the account to use as template for the new account creation. Default = 500 (Administrator)
    Syntax: /template:[decimal int]

    MACHINEACCOUNT: Forge as machine account for extra stealthiness. Default = yes
    Syntax: /machineaccount:[yes/no]

    DEBUG: Enable debug mode for verbose logging. Default = disabled
    Syntax: /debug

```

## Thanks!

This attack would not have been possible without the great research done by:

- Benjamin Delpy ([@gentilkiwi](https://twitter.com/gentilkiwi)) and his outstanding [Mimikatz](https://github.com/gentilkiwi/mimikatz)
- The [SecureAuth](https://www.secureauth.com/) researchers behind [Impacket](https://github.com/SecureAuthCorp/impacket)
- Ben Ten [@Ben0xA](https://twitter.com/Ben0xA)
- Infosec community!

# What’s next?

~~Hack~~ Suborn the planet!

## GitHub:

> **[GitHub - r4wd3r/Suborner](https://github.com/r4wd3r/Suborner)**
>
> Contribute to r4wd3r/Suborner development by creating an account on GitHub.