7. Active Directory

Rubeus is good

Creating TGTs

If you have the NTLM hash or AES hash of a user via mimikatz dumping, you can request for a TGT for that user

C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe asktgt /user:jking /ntlm:59fc0f884922b4ce376051134c71e22c /nowrap

C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe asktgt /user:jking /aes256:4a8a74daad837ae09e9ecc8c2f1b89f960188cb934db6d4bbebade8318ae57c6 /nowrap

Once you have the TGT, you can create a session and pass the ticket to it

C:\\Tools\\Rubeus\\Rubeus\\bin\\Release\\Rubeus.exe createnetonly /program:C:\\Windows\\System32\\cmd.exe /domain:DEV /username:jking /password:FakePass /ticket:doIFwj[...]MuSU8= /ptt

Dumping TGTs

C:\\Tools\\Rubeus\\Rubeus\\bin\\Release\\Rubeus.exe triage
 ---------------------------------------------------------------------------------------------------------------
 | LUID    | UserName                    | Service                                       | EndTime              |
 ---------------------------------------------------------------------------------------------------------------
| 0x3e4    | sql-2$ @ DEV.CYBERBOTIC.IO  | krbtgt/DEV.CYBERBOTIC.IO                      | 9/6/2022 7:06:50 PM |

Using the luid and service, dump out the TGT

C:\\Tools\\Rubeus\\Rubeus\\bin\\Release\\Rubeus.exe dump /luid:0x3e4 /service:krbtgt /nowrap

    ServiceName              :  krbtgt/DEV.CYBERBOTIC.IO
    ServiceRealm             :  DEV.CYBERBOTIC.IO
    UserName                 :  SQL-2$
    UserRealm                :  DEV.CYBERBOTIC.IO
    StartTime                :  9/6/2022 9:06:50 AM
    EndTime                  :  9/6/2022 7:06:50 PM
    RenewTill                :  9/13/2022 9:06:50 AM
    Flags                    :  name_canonicalize, pre_authent, initial, renewable, forwardable
    KeyType                  :  aes256_cts_hmac_sha1
    Base64(key)              :  pj1tbiijFCGHkM6S58ShgxxPi8FvA1UB5liBqrSWPCg=
    Base64EncodedTicket   :

doIFpD[...]MuSU8=

The TGT can then be used in a PTT attack, or depending on the scenario, used to request a TGS and the a PTT

TGS decryption

Part of the TGS returned is encrypted with a secret derived from the password of the account running the service.

Kerberoasting involves requesting a TGS and cracking the TGS to reveal the password of the account

Finding SPNs on a server

Use Rubeus to get TGS

These hashes can then be cracked

Sometimes you have to remove the SPN

ASREP Roasting

If a user does not have Kerberos enabled, an AS-REP can be requested for that user, and part of the reply can be cracked offline to recover their plaintext password.

Finding accounts that don’t have Kerberos

Roast it and crack it

Delegation

Delegation allows a user or machine to act on behalf of another user to another service.

When the user accesses the Web Server, it extracts the user's TGT from the TGS and caches it in memory. When the Web Server needs to access the DB Server on behalf of that user, it uses the user’s TGT to request a TGS for the database service.

Unconstrained Delegation

Finding UD machines

This means whenever a user interacts with DC-2$ or WEB$, the machines will cache their TGT

Listing cached TGTs

Extract the TGT

Create a new session with the TGT and pass the ticket

We can also use Rubeus to continuously monitor for new TGTs

Force dc-2 to interact with web

Rubeus will then capture the ticket.

Machine TGTs like DC-2 are use differently from user TGTs, and we need to run S4U

Using a machine TGT and S4U to get a TGS and pass the ticket

Constrained Delegation

No longer allows the server to cache the TGTs of other users, but allows it to request a TGS for another user with its own TGT.

Find CD

SQL-2 can act on behalf of any ****user to the cifs service on DC-2

Get TGT of SQL-2

Using the TGT, perform S4U request to obtain a usable TGS for CIFS on DC-2

Grab the TGS generated and pass it into a new logon session.

Resource Based Constrained Delegation

Delegation configuration set on the target rather than the source.

Need to find

  1. A target computer on which you can modify msDS-AllowedToActOnBehalfOfOtherIdentity

  2. An SPN you want to grant access to the target machine

Finding accounts with appropriate permissions to modify permissions of other machines

Using the SID, find out the name of the group that has this write permissions.

The Developers group can write, so find a way to get there, or find users in the group that we can exploit.

Finding the SID of wkstn-2

Modifying the permissions for dc-2 using the SID of wkstn-2 to grant wkstn-2access to resources on dc-2

Now wkstn-2 has access to resources on dc-2, and we can access it

Extract TGT for wkstn-2

Perform s4u to get a TGS on behalf of another user

Create a new session using the TGS and passing the ticket

Accessing RBCD via Fake Machines

Adding a fake machine to the domain

Creating a hash from the password

Get TGT for the fake machine

Find the SID of the fake machine, and add it to msDS-AllowedToActOnBehalfOfOtherIdentity of the target machine

Using TGT, get a TGS via S4U impersonating Administrator of the target machine

Using TGS to create a session and pass the ticket

Alternate Service Name

We can request a service ticket for a service, such as CIFS, but then modify the SPN to something different, such as LDAP

We can be abuse this using /altservice flag in Rubeus.

In this example, I'm using the same TGT for SQL-2 to request a TGS for LDAP instead of CIFS.

Now we had a TGS for LDAP, we can run LDAP exploits against it like DCSync

Vulnerable Certificates

Find Certificate Authorities in a domain or forest

The Cert Chain is useful to note, as this shows us that sub-ca in the DEV domain is a subordinate of ca in the CYBER domain.

Misconfigured Certificate Templates

Finding Vulnerable Certificates

  1. This template is served by sub-ca.

  2. The template is called CustomUser.

  3. ENROLLEE_SUPPLIES_SUBJECT is enabled, which allows the certificate requestor to provide any SAN (subject alternative name).

  4. The certificate usage has Client Authentication set.

  5. DEV\\Domain Users have enrollment rights, so any domain user may request a certificate from this template.

This configuration allows any domain user to request a certificate for any other domain user (including a domain admin) and use it for authentication.

Request a certificate for nlamb.

💡 CANNOT USE SYSTEM ACCOUNT TO DO THIS. You have to use a user account to request for a certificate

Download the files to the local machine and convert it to pfx format.

Convert cert.pfx into a base64 encoded string so it can be used with Rubeus

Then use asktgt to request a TGT for the user using the certificate.

The TGT can then be used in a PTT, or used to request for a TGS to a PTT

GPO Abuse

Modifying Existing GPO

Finding GPOs you can write to

Getting GPO name

Getting SID group

Finding which groups this GPO applies to

Getting machines in the group

Modify the GPO

Creating New GPO

Finding groups that can create GPOs

Finding groups that can link GPOs

Using the SID to find the group name that can link GPOs

Creating a new GPO

Apply and link the GPO to the OU

Reboot the machine

Domain Traversal

When a child domain is added to a forest, it automatically creates a transitive, two-way trust with its parent.

WITHIN_FOREST lets us know that both of these domains are part of the same forest which implies a parent/child relationship.

If we have Domain Admin privileges in the child, we can also gain Domain Admin privileges in the parent using a TGT with a special attribute called SID History.

Getting the SID of the target domain (parent domain)

Create a Golden or Diamond Ticket while passing in the SID.

You need ntlm or aes256 of krbtgt account (done by running DCSync on the Domain Controller)

/sid : SID of current domain dev.cyberbotic.io

/sids : Additional SIDs to import, in this case dc-1.cyberbotic.io

Then import it into a logon session and use it to access the domain controller in the parent.

One-way Inbound

dev.cyberbotic.io also has a one-way inbound trust with dev-studio.com

This means dev.cyberbotic.io can access resources in dev-studio.com

Finding groups in the foreign domain

This means that members of DEV\\Studio Admins are also members of the built-in Administrators group of dev-studio.com and therefore inherit local admin access to dc.dev-studio.com

Finding members in the group

So if we can impersonate nlamb , we become administrators in dev-studio.com , and by transitive properties, become administrators in dc.dev-studio.com

Get a TGT for nlamb .

Use the TGT to get an inter-realm TGS to the target domain

Use the inter-realm TGS to get a TGS for a service in the dc.dev-studio.com

Create net only and pass the TGS ticket in

DACL Exploit

As the name sugggets, finds Interesting DACL

SPN Jacking

If we see this, we get their TGS via SPN-jacking

Script Path

If we see this, we can execute code on behalf of the user

Create a .bat file witrh RCE code

Place the .bat file in

Set the script path of the victim to point to this payload

Previous6. PersistenceNext8. LAPS

Last updated