search

🕵️Active Directory Cheat Sheet

hashtag
1. 📜 Active Directory Theory

hashtag
1.1 Overview

  • Active Directory (AD) manages objects (e.g., computers, users) in a domain, such as domain.com, and organizes them into Organizational Units (OUs).

  • Domain Controllers (DCs) store all the password hashes for domain users.

  • To control AD fully, target the Domain Admins group or a Domain Controller.

  • Services like Exchange or IIS integrate with AD using Service Principal Names (SPNs), which identify services and link them to service accounts.

  • Kerberos is used to authenticate users and services using tickets, and if I have an user's ticket I can impersonate that user.

hashtag
1.2 Authentication

  • NTLM: Uses a challenge/response protocol to authenticate users without transmitting passwords.

  • Kerberos: Relies on a Key Distribution Center (KDC) to issue Ticket Granting Tickets (TGTs) and Service Tickets (TGSs) for user authentication.

  • TGT: Provides authentication validity for up to 10 hours, and a session key for accessing domain resources.

  • TGS: Allows users to access services using SPNs, with permissions granted based on group membership.

hashtag
1.3 Credential Storage & Hash Dumping

  • LSASS stores password hashes for single sign-on (SSO). With admin access, tools like Mimikatz can dump:

    • Password hashes.

    • TGTs and TGSs (for Kerberoasting or forgery).

  • Kerberoasting: Crack the service account’s password hash from TGS tickets to reveal the clear-text password.

  • Silver/Golden Tickets: Forging TGS tickets using cracked SPN password hashes to impersonate users.

hashtag
1.4 Common Attack Vectors

  • AS-REP Roasting: Target accounts without Kerberos Pre-Authentication (indicated by the DONT_REQ_PREAUTH flag), extract AS-REP responses, and attempt to crack the encrypted part offline.

  • Kerberoasting: Target SPNs, extract TGS tickets, crack the passwords offline.

  • Pass-the-Hash (PtH): Reuse NTLM hashes to authenticate to services without cracking the password.

  • Pass-the-Ticket (PtT): Use stolen Kerberos tickets to move laterally or maintain persistence.

  • Silver Ticket: Enables attackers to forge a TGS ticket for a specific service using the NTLM hash of the service account. This allows unauthorized access to that service without needing user credentials.

  • Golden Ticket: Allows attackers to forge a TGT using the KRBTGT account hash, enabling them to impersonate any user in the domain, including privileged accounts, and gain extensive access across the network.

  • Kerberos Delegation Abuse:

    • Unconstrained Delegation: Allows attackers to impersonate any user, including privileged ones, by using a high-privileged TGT.

    • Constrained Delegation: Allows impersonation of specific users for services where delegation has been configured; so restricts the impersonation capabilities to specific services.

  • DC Sync: Allows attackers with certain privileges (e.g., Replicating Directory Changes) to impersonate a Domain Controller and request password hashes, including NTLM hashes, from the AD; the user needs the permissions DC-Replication-Get-Changes along with the privilege GetChangesAll.

hashtag
1.5 Lateral Movement

  • Pass the Hash (PtH): Use NTLM hashes to authenticate to remote systems without needing the plaintext password.

  • Overpass the Hash: Use an NTLM hash to request a TGT for Kerberos-based services, enabling domain-wide movement without the need for the actual password.

hashtag
1.6 Persistence

  • Golden Ticket Attack: By obtaining the krbtgt password hash, an attacker can forge TGTs and impersonate any user.

  • DCSync Attack: Request replication updates from DCs to retrieve password hashes of every AD user.

hashtag
12. 🕵️‍♂️ Active Directory Enumeration

hashtag
12.1 Initial Recon with Nmap

Start by scanning the target with Nmap to identify potential services and domain controllers (DC):

Common Active Directory ports:

  • 53: DNS

  • 88: Kerberos

  • 135: RPC

  • 139/445: SMB

  • 389/636: LDAP/LDAPS

  • 464: Kerberos Password Change

  • 5985: WinRM

Recommended Strategy:

  1. Perform LDAP Search: retrieve potential user and password information.

  1. Enumerate DNS: gather information about key servers within the domain.

  1. Enumerate LDAP Services:

  1. Find Valid Users:

  1. Enumerate All AD Users: this has to be done after having valid credentials.

2.1.1 DNS Enumeration (Port 53)

Nmap Scripting Scan

Enumerating AD Domain via DNS

Zone Transfer: test for DNS zone transfer to retrieve a list of domain records.

DNS Record Lookup: query specific domain records, such as domain controllers and mail servers.

Basic DNS Enumeration

Zone Transfer

Reverse Lookup

DNS Cache Snooping

Enumerate DNS with PowerShell (Windows)

2.1.2 Kerberos Enumeration (Port 88)

Nmap Scripting Scan

AS-REP Roasting: extract accounts with pre-authentication disabled using GetNPUsers.py (impacket-GetNPUsers); keep in mind that should also use kerbrute to find possible valid usernames, commands for this are in the Section 1.4.7.

Kerberoasting: use GetUserSPNs.py to extract SPNs.

Enumerate Kerberos Principal Names: use kerbrute to enumerate valid user accounts by attempting to authenticate with a list of usernames.

Perform Kerberos Ticket Extraction (AS-REP Roasting): request non-preauthenticated Kerberos tickets for a list of users.

Perform Kerberos Ticket Request with AS-REP Roasting: request a Ticket Granting Ticket (TGT) for a specific user.

Crack Kerberos Tickets

Kerberos Ticket Extraction: request a TGT or Service Ticket (TGS) using specified credentials.

Kerberoasting: extract and crack service tickets to gain access to service accounts.

Kerberos Brute Forcing: perform brute force attacks on Kerberos tickets.

Kerberos Ticket Manipulation: use tools to request, manipulate, and renew Kerberos tickets for privilege escalation or impersonation.

Kerberos Ticket Dumping: extract Kerberos tickets from memory for offline analysis.

Kerberos Pre-Authentication: identify weak configurations that might allow attackers to perform brute force attacks.

Kerberos Silver Ticket Attacks: forge high-value Kerberos tickets for access and privilege escalation.

Steps to Perform Silver Ticket Attack

Kerberos Golden Ticket Attacks: forge high-value Kerberos tickets for access and privilege escalation.

Steps to Perform Golden Ticket Attack

Additional Reference: https://www.tarlogic.com/blog/how-to-attack-kerberos/arrow-up-right

2.1.3 LDAP Enumeration (Port 389/636)

Nmap Scripting Scan

Basic LDAP Search: query the LDAP service for domain information

Extract AD Users and Groups

Ldapsearch Basic Enumeration

Check Pre-Authentication for Users

Useful Search Terms

2.1.4 SMB/NetBIOS Enumeration (Port 445)

Host Enumeration

Nmap Scripting Scan

SMB Shares Enumeration

Enumerate Users

Advanced Enumeration

SMB Enumeration with smbmap

SMB Enumeration with crackmapexec

User Enumeration with enum4linux

SMB Client Operations

Brute Force Credentials

Mounting Shares

Execute Remote Commands

Exploitation (EternalBlue - MS17-010): https://github.com/3ndG4me/AutoBlue-MS17-010arrow-up-right

PsExec

WMIExec

2.1.5 WinRM Enumeration and Access (Port 5985)

Nmap Scripting Scan

Test WinRM Access: use CME to test if WinRM is enabled:

WinRM Login with Evil-WinRM: if valid credentials are found, log in via Evil-WinRM:

Crackmapexec

Loggin In

hashtag
2.2 Basic Enumeration

  • Recommended Methodology:

Descripción de la imagen
Active Directory Methodology

  • Find my Domain SID:

  • Find the name of my domain controller server:

  • Find Service Account Names:

  • Finding SPNs:

  • Check users of the domain:

  • Check groups of the domain:

  • Script to get the full LDAP path:

  • Script to get full information for SAM account types:

  • Enumerate nested groups with custom LDAP query:

  • Encapsulate LDAP search into a function:

  • Perform user search using LDAP query:

  • Search for all possible groups in AD:

  • Iterate through objects in $group variable:

hashtag
2.3 PowerView

Download PowerView.ps1arrow-up-right

  • Import PowerView (ensure it is downloaded first):

  • Domain information:

  • Find Domain Name

  • Get Domain User

  • Users information:

  • Groups information:

  • Operating System information:

  • Get Domain Admins

  • Find Kerberoastable Accounts

  • Enumerate Domain Controllers

  • Find Shares

  • Check for Delegation

hashtag
2.4 Service Principal Names (SPN) Enumeration

  • List SPN linked to a user:

  • List SPN accounts in the domain:

hashtag
2.5 Object Permissions Enumeration

  • Active Directory permission types:

    • GenericAll: Full permissions

    • GenericWrite: Edit certain attributes

    • WriteOwner: Change ownership

    • WriteDACL: Edit ACEs applied

    • AllExtendedRights: Change/reset password, etc.

    • ForceChangePassword: Force password change

    • Self: Add self to groups

  • Run Get-ObjectAcl (PowerView) to specify user:

  • Convert Object SID to a name:

  • Enumerate ACLs for a group:

  • Convert SIDs with GenericAll permission to names:

  • Add yourself to a domain group:

  • Verify group membership:

hashtag
2.6 Domain Shares Enumeration

  • Find domain shares (PowerView):

  • Decrypt GPP password using gpp-decrypt:

hashtag
2.7 BloodHound & SharpHound

BloodHound is a tool for Active Directory (AD) enumeration and privilege escalation, designed to help visualize AD relationships and identify paths for lateral movement and privilege escalation.

Resources:

  1. Download and Transfer SharpHound:

  1. Running SharpHound

    • Find your Domain Name:

    • Using the PowerShell Script:

    • Collect Specific Methods: run only specific collection tasks instead of All to limit the data gathered.

  3. Transfer Collected Data to Kali: once SharpHound finishes collecting, transfer the output .zip file from C:\Temp back to your Kali machine. You can use one of the methods below or check Section 15 for additional transfer methods.

  1. Running BloodHound on Kali: access the Neo4j interface at https://localhost:7474 and log in with default credentials neo4j:neo4j or neo4j:Neo4j.

  1. Start BloodHound:

  1. Import the .zip files collected from the victim machine into BloodHound for analysis.

  2. Analyze the domain data:

    • Use queries like Find all Domain Admins or Find Shortest Paths to Domain Admins.

    • Find computers vulnerable to Unconstrained Delegation.

    • Mark nodes as owned to find potential escalation paths.

    • Set Node Label Display to Always Display in the settings for better visibility.

    • Identify Kerberoastable accounts.

    • Find potential GPOs to abuse: if BloodHound indicates that a user or group has WriteGPO, OwnsGPO, or GPO control over a GPO linked to important OUs (especially those affecting privileged accounts), this is a strong indicator to use SharpGPOAbuse to escalate privileges or perform lateral movement.

  3. Manual Commands:

    • Format for cypher: (NODES)-[:RELATIONSHIP]->(NODES)

    • All computers in domain: MATCH (m:Computer) RETURN m

    • All Users in domain: MATCH (m:User) RETURN m

    • Get active sessions: MATCH p = (c:Computer)-[:HasSession]->(m:User) RETURN p

    • Enumerate users with SQLAdmin: MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:SQLAdmin*1..]->(c:Computer) RETURN p2

    • Enumerate users with CanPSRemote: MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:CanPSRemote*1..]->(c:Computer) RETURN p2

hashtag
2.8 Extracting and Cracking Password Hashes

  1. Dump Hashes with SecretsDump: use SecretsDump to extract NTDS.dit or password hashes.

  1. Crack NTLM Hashes: once you have the hashes, crack them with Hashcat or John the Ripper.

  1. Password Spraying: involves testing common passwords across many accounts to avoid account lockouts. CrackMapExec is ideal for this.

hashtag
2.9 MS-RPRN Print Spooler Service Exploitation

The Print Spooler service has been linked to critical vulnerabilities, notably CVE-2021-34527 (PrintNightmare). This vulnerability allows attackers to execute arbitrary code remotely with SYSTEM privileges due to improper handling of requests.

Enumerate Printers: if Print Spooler service is enabled, enumerate available printers.

hashtag
2.10 Common SPNs for Service Accounts

SPN
Name

cifs

Common Internet File System

dcom

Distributed Component Object Model

exchange

Microsoft Exchange Server

ftp

File Transfer Protocol

http

Hypertext Transfer Protocol

imap

Internet Message Access Protocol

krbtgt

Kerberos Ticket Granting Ticket

ldap

Lightweight Directory Access Protocol

mssql

Microsoft SQL Server

mysql

MySQL Database

nfs

Network File System

oracle

Oracle Database

pgsq

PostgreSQL Database

pop3

Post Office Protocol 3

rpc

Remote Procedure Call

smtp

Simple Mail Transfer Protocol

svc

Service

termsrv

Terminal Server

wsman

Windows Remote Management

hashtag
2.11 GPP Passwords Abuse (Group Policy Preferences)

2.11.1 GPP Main Method for Extraction

Search for GPP Passwords in SYSVOL: access SYSVOL share and search for Group Policy Preferences (GPP) files; this happens because a common useful misconfiguration found in modern domain environments is unprotected Windows GPP settings files

  1. Map the DC SYSVOL share:

  1. Find the GPP file: usually the one called Groups.xml: the file is usually located in a path similar to this one \hostname.domain\Policies\{00000000–0000–0000–0000–00000000000}\MACHINE\Preferences\Groups\Groups.xml.

  1. Decrypt the Found Hash / cpassword:

  1. (Optional) Alternative Method:

2.11.2 Impacket-Get-GPPPassword

Impacket-Get-GPPPassword (Get-GPPPassword.py) is an Impacket script for retrieving GPP passwords. There are several methods for using this script depending on the level of access you have:

  • NULL Session: this command attempts to retrieve GPP passwords without providing any credentials (NULL session). Useful if anonymous access is allowed on the target Domain Controller (DC).

  • With Cleartext Credentials: uses cleartext credentials (username and password) to access and retrieve stored GPP passwords from the DC.

  • Pass-the-Hash (with NT hash): executes a pass-the-hash attack with the user’s NTLM hash instead of a password, allowing retrieval of GPP passwords.

  • Parsing a Local File: this command parses a local Policy XML file for stored passwords. Useful if you have a downloaded or extracted policy file on your machine.

2.11.3 SMB Share-SYSVOL

SYSVOL is a shared folder on the DC where Group Policy objects (GPOs) and scripts are stored. This folder is often accessible to any domain user, allowing attackers to potentially access configuration files with stored passwords (GPP).

  1. Download the Entire Share: you can use a tool or script to download the entire SYSVOL share for offline analysis.

  1. Navigate to Downloaded Files: this command searches through the downloaded files for instances of cpassword (encrypted passwords stored in the XML files), helping identify where passwords are stored.

2.11.4 CrackMapExec

CrackMapExec is a popular tool for SMB enumeration and exploitation. Here, it is used to locate GPP passwords.

  • With Username and Password: this command scans one or multiple targets to identify stored GPP passwords using cleartext credentials.

  • With NTLM Hash: this variant allows pass-the-hash authentication with NT and LM hashes instead of a password.

hashtag
2.12 Scripts (adPEAS)

2.12.1 Importing the Module

Download from https://github.com/61106960/adPEAS?tab=readme-ov-file#important-note-about-the-bloodhound-modulearrow-up-right.

2.12.2 Basic Usage

  • Enumerate Current Domain: start adPEAS and enumerate the domain for the logged-on user and computer.

  • Specify Domain and Output: to specify a domain and save output without ANSI color codes.

  • Specify Domain Controller: to enumerate using a specific domain controller.

  • Using PSCredential: to use a PSCredential object for enumeration.

  • Force Enumeration with Username and Password: to specify username and password for enumeration while ignoring DNS issues.

2.12.3 Module-Specific Usage

  • Basic Active Directory Information

  • Active Directory Rights and Permissions

  • Group Policy Information

  • Active Directory Certificate Services Information

  • Credential Exposure Issues

  • Delegation Issues

  • High Privileged Groups Enumeration

  • Domain Controller and Service Enumeration

  • BloodHound Enumeration (DCOnly)

  • BloodHound Enumeration (All)

hashtag
2.13 Group Managed Service Accounts (gMSAs) Abuse

2.13.1 Identifying Group Managed Service Accounts (gMSAs)

2.13.1.1 Manual Discovery of gMSAs

You can manually search for gMSA accounts in Active Directory using PowerShell or LDAP queries.

Using PowerShell PowerShell’s Get-ADServiceAccount cmdlet can help identify gMSA accounts, assuming you have sufficient permissions. This command lists all gMSAs in the domain with their properties, including msDS-ManagedPassword, if you have permissions to view it.

Using LDAP Query You can also search for gMSAs directly by filtering based on their object class. This approach is useful if you don’t have access to Get-ADServiceAccount but can execute LDAP queries. You can inspect the properties of each returned object for further information, like the account's service name.

Identify Accessible gMSA Passwords: Once gMSAs are identified, check if you can read the msDS-ManagedPassword attribute. This attribute contains the encrypted password and is often readable by specific privileged accounts or groups.

2.13.1.2 Automated Discovery with BloodHound

BloodHound can map out relationships and permissions in Active Directory, making it ideal for identifying exploitable accounts, including gMSAs.

  1. Run BloodHound Collection: use BloodHound’s SharpHound collector to gather data from the domain.

  1. Analyze in BloodHound GUI: open the BloodHound GUI, upload the collected data, and search for accounts with privileges to read gMSA passwords:

    • Use the "Find Principals with DCSync Rights" query, which might help indirectly as gMSA permissions are often linked to elevated roles.

    • Search for any objects where specific user groups have ReadProperty rights on the msDS-ManagedPassword attribute.

  2. (Optional) Query Examples in BloodHound:

    • Use the query Find Principals with Unusual Rights on Password Attributes, as this often includes gMSA password attributes.

    • BloodHound may highlight gMSA accounts that are configured with permissions for non-admin users or groups, indicating potential targets for exploitation.

2.13.2 GMSA Password Retrieval with GMSAPasswordReader

GMSAPasswordReader.exearrow-up-right can be used to retrieve the plaintext password for Group Managed Service Accounts (gMSAs). This tool requires specific permissions, usually access to read the msDS-ManagedPassword attribute of the gMSA object.

2.13.2.1 Usage

  1. Run GMSAPasswordReader.exe with Proper Privileges: ensure you have sufficient permissions to read gMSA password attributes in Active Directory. Typically, Domain Admin or specific permissions on the gMSA object are required.

  2. Command Syntax: the tool can be run from the command line to retrieve gMSA passwords.

2.13.2.2 Additional Notes

  • Permissions: Ensure that you have necessary read permissions on the msDS-ManagedPassword attribute.

  • Privileged Access: Typically, this tool is most useful on systems where you already have Domain Admin or specific delegated permissions on gMSA objects.

  • Security Considerations: Use this tool carefully, as improper handling of retrieved passwords can expose sensitive credentials.

2.13.3 Alternative Commands

If you don’t have access to GMSAPasswordReader.exe, you might consider using PowerShell or other Active Directory enumeration techniques if you have appropriate permissions to query gMSA accounts and their attributes.

  1. Using PowerShell with Active Directory Module: if you have the Active Directory PowerShell module installed, you can use it to query for gMSAs and their msDS-ManagedPassword attribute. This command lists all gMSAs and attempts to retrieve their msDS-ManagedPassword attribute. You need permissions to read this attribute.

  1. Using Get-ADObject to Directly Query LDAP Attributes: if Get-ADServiceAccount isn’t available, Get-ADObject can directly query Active Directory for objects with msDS-ManagedPassword. This command retrieves all gMSA objects, showing their attributes, including the managed password (if accessible).

  1. Retrieving gMSA Passwords with Get-ADAttributeEditor: if you have permissions and access to the Active Directory UI on a Windows machine; if you have read permissions, you should be able to view or export the password attribute here.

    1. Open the Active Directory Users and Computers console.

    2. Enable Advanced Features (under View).

    3. Locate the gMSA account, right-click, and select Properties.

    4. Navigate to the Attribute Editor tab and search for msDS-ManagedPassword.

  2. Using LDAP Queries with ldapsearch (Linux): if you’re on a Linux system with ldapsearch installed, you can use it to query Active Directory for gMSA accounts. This approach requires credentials with LDAP access. This command fetches gMSA objects and tries to access the msDS-ManagedPassword attribute.

  1. PowerView: if you’re using PowerView, an enumeration tool in PowerShell Empire, you can search for gMSA accounts and attempt to view password attributes; PowerView’s Get-DomainGMSA command can enumerate gMSA accounts and potentially view msDS-ManagedPassword if you have the necessary permissions.

hashtag
2.12 Group Policy Object (GPO) Abuse

Group Policy Objects (GPOs) allow administrators to enforce policies and configurations across all domain-connected machines. By modifying a GPO with malicious commands, attackers can achieve privilege escalation or persistence. The effectiveness of this attack lies in the fact that when GPOs are updated—either manually or during regular system updates—these policies are executed on all systems within their scope, including those used by privileged users like administrators. This means that any added malicious task or script will be run with the permissions of all users in that scope, enabling an attacker to execute code as an administrator without direct admin rights.

Guides:

Resources:

  1. Import PowerView

  1. List All GPOs: use PowerView to list all GPOs and check if there are write permissions for any.

    • Basic GPO Listing

  • Manual Permission Check: this checks if you have any write permissions on GPOs, which could allow for privilege escalation.

  • BloodHound Alternative: use BloodHound to check for WriteGPO, OwnsGPO, or GPO control privileges, as they indicate possible GPO manipulation for escalation.

  1. Enumerate a Specific GPO

    • Identify GPO by Display Name

  • Convert GPO ID to Name

  1. Check Permissions on Specific GPO: verify if you have edit permissions or ownership on a particular GPO.

  1. Execute the Attack (If Permissions Allow): se SharpGPOAbuse to manipulate GPOs.

    • Create a Reverse Shell Task

  • Add User to Administrators Group

  1. Force Policy Update: apply the GPO changes immediately across the domain.

hashtag
3. 👾 Active Directory Attacking

hashtag
3.1 AS-REP Roasting

AS-REP Roasting targets accounts that do not require pre-authentication, allowing attackers to request an AS-REP (Authentication Service Response) message containing the encrypted password hash, which can then be brute-forced offline.

How it works:

  • Attackers request an AS-REP message for accounts that do not enforce Kerberos pre-authentication.

  • The AS-REP response contains an encrypted portion that uses the user's password hash as a key.

  • Attackers can extract this hash and crack it offline using tools like hashcat or John the Ripper.

Steps:

  1. Find users without pre-authentication:

  1. AS-REP Roasting using Rubeus:

  1. AS-REP Hash extraction using Impacket:

  1. Crack the AS-REP hash:

hashtag
3.2 Kerberoasting

Kerberoasting involves attacking Service Principal Names (SPNs) that are configured in Active Directory. Attackers request a Kerberos Ticket-Granting Service (TGS) ticket for these SPNs, extract the service account hash from the ticket, and brute-force the password offline.

How it works:

  1. The attacker requests a TGS for a service account (SPN) that has a valid ticket.

  2. The service's TGS is encrypted with the service account's password hash.

  3. The attacker can extract the TGS ticket and crack it offline using tools like hashcat.

Steps:

  1. Enumerate Service Principal Names (SPNs):

  1. Request a TGS ticket for SPNs:

  1. Extract TGS ticket from memory using Rubeus:

  1. Crack the TGS hash:

hashtag
3.3 Silver Tickets

Silver Tickets allow attackers to forge a Ticket-Granting Service (TGS) for specific services like CIFS (file sharing) or HTTP, enabling access to those services without needing a valid TGT from a domain controller.

How it works:

  1. The attacker obtains the NTLM hash or Kerberos hash of a service account.

  2. The attacker uses this hash to create a forged TGS ticket, allowing them to authenticate to specific services (e.g., CIFS, HTTP).

  3. Since Silver Tickets bypass domain controllers, they are harder to detect in logs.

Steps:

  1. Extract NTLM hash of the service account (e.g., CIFS):

  1. Create a Silver Ticket using Mimikatz:

  1. Inject the Silver Ticket into the session:

  1. Access the target service (e.g., CIFS):

hashtag
3.4 Golden Tickets

Golden Tickets are forged Ticket-Granting Tickets (TGT) that allow attackers to impersonate any user, including Domain Admins, by creating a TGT valid for the entire domain. Golden Tickets are one of the most powerful attacks as they grant persistent, high-level access.

How it works:

  1. The attacker dumps the KRBTGT account hash (using tools like Mimikatz).

  2. Using this hash, they can create a forged TGT for any user.

  3. The forged TGT can be used to authenticate as any user across the domain, including Domain Admins.

Steps:

  1. Dump KRBTGT account hash:

  1. Create Golden Ticket using Mimikatz:

  1. Inject Golden Ticket:

  1. Access domain resources:

hashtag
3.5 Domain Controller Synchronization (DC Sync)

The DC Sync attack involves mimicking a Domain Controller (DC) to request credentials from another DC, effectively obtaining password hashes (including KRBTGT, Admins) without triggering alarms.

How it works:

  1. Permissions: The attacker needs to have the Replicating Directory Changes or Replicating Directory Changes All permissions, which are often granted to Domain Admins and other high-privilege accounts.

  2. Replication Request: By sending a replication request, the attacker can pull user account data, including password hashes, directly from a Domain Controller.

  3. Credential Theft: Once the attacker obtains these hashes, they can use them for further attacks (like Pass-the-Hash or Pass-the-Ticket) or crack them to obtain plaintext passwords.

Steps:

  1. Identify Domain Admins: ensure you have the required permissions.

  1. Perform DC Sync using Mimikatz:

  1. Extracting all accounts and hashes:

  1. Output to a file:

  1. Crack dumped hashes:

hashtag
3.6 Cached AD Credentials

Cached credentials allow users to log in to their machines even if the domain controller is unavailable. Attackers can extract these cached credentials from compromised systems.

How it works:

  1. When users log in, the NTLM hash of their password is cached locally.

  2. Attackers can use tools to extract and crack these cached hashes offline.

Steps:

  1. Dump cached credentials using Mimikatz:

  1. Crack cached credentials:

hashtag
3.7 NTLM Authentication

NTLM (NT LAN Manager) is a challenge-response authentication protocol used in older Windows systems or when Kerberos is unavailable.

How it works:

  1. The client sends a NTLM negotiation message.

  2. The server sends back a challenge (random data).

  3. The client uses the challenge, combined with the user's NTLM hash, to create a response.

  4. The server checks the response using the stored NTLM hash of the user.

Descripción de la imagen
NTLM Authentication Protocol

Vulnerabilities:

  • Pass-the-Hash: Attackers can reuse NTLM hashes without knowing the plaintext password.

  • NTLM Relay: Attackers can relay NTLM authentication to another server.

Steps to do Pass-the-Hash for AD services:

  1. Dump NTLM hash using Mimikatz:

  1. Pass the NTLM hash using Mimikatz:

  1. Access remote resources:

hashtag
3.8 Kerberos Authentication

Kerberos is the default authentication protocol in modern Windows domains, offering mutual authentication via tickets.

How it works:

  1. AS-REQ: The client requests a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC) using their credentials.

  2. AS-REP: The KDC responds with a TGT, encrypted with the user's password hash.

  3. TGS-REQ: The client presents the TGT to the KDC to request access to a service.

  4. TGS-REP: The KDC issues a Ticket Granting Service (TGS) ticket for the requested service.

  5. Service Authentication: The client uses the TGS to authenticate with the target service.

Descripción de la imagen
Kerberos Authentication Protocol

Vulnerabilities:

  • Pass-the-Ticket: Attackers can steal and reuse Kerberos tickets (TGT or TGS).

  • Kerberoasting: Attackers extract and crack service account hashes from TGS tickets.

Steps for Pass-the-Ticket Attack:

  1. Dump the TGT ticket using Mimikatz:

  1. Pass the Kerberos TGT ticket:

  1. Access resources:

hashtag
3.9 Password Attacks

3.9.1 Spraying Creds with Script

3.9.1.1 Running the Script

3.9.1.2 Source Code of the Script

3.9.2. Authenticating using DirectoryEntry

To authenticate against Active Directory using a specific username and password, you can utilize the System.DirectoryServices namespace in PowerShell. Below is an example of how to set this up:

3.9.3 Using CrackMapExec

3.9.3.1 Basic Commands

  • Basic Check for User Authentication:

  • Using Kerberos for Authentication:

  • Domain and SMB Signing Check: checks for SMB signing requirements along with user authentication.

  • Continue on Error: using the --continue-on-error flag will allow the command to run even if some accounts fail.

3.9.3.2 Additional Commands

  • Attempting to Enumerate Shares on the Target: you can enumerate shared folders on the target machine while testing user credentials.

  • Testing for SMBv1: to check if the target supports SMBv1.

  • Getting Session Information: you can obtain active sessions on the target machine.

  • Dumping SAM Hashes: if you have admin rights, you can attempt to dump the SAM database:

  • Running Commands Remotely:

3.9.3.3 Possible Services to Test

  1. SMB (Server Message Block) - Port 445

  1. RDP (Remote Desktop Protocol) - Port 3389

  1. WinRM (Windows Remote Management) - Port 5985/5986

  1. HTTP/HTTPS (Web Services) - Ports 80/443

  1. FTP (File Transfer Protocol) - Port 21

  1. Telnet - Port 23

  1. SMTP (Simple Mail Transfer Protocol) - Port 25

  1. DNS (Domain Name System) - Port 53

  1. LDAP (Lightweight Directory Access Protocol) - Ports 389/636

  1. NetBIOS - Ports 137-139

  1. MySQL - Port 3306

  1. PostgreSQL - Port 5432

  1. MS SQL Server - Port 1433

  1. Oracle Database - Port 1521

  1. Redis - Port 6379

  1. Docker Remote API - Port 2375

  1. SNMP (Simple Network Management Protocol) - Port 161

  1. NTP (Network Time Protocol) - Port 123

3.9.4 Using kerbrute

hashtag
3.10 Shadow Copies

Shadow Copies, also known as Volume Shadow Copy Service (VSS), is a Windows feature that creates backup copies or snapshots of computer files or volumes, even when they are in use. Attackers can exploit Shadow Copies to retrieve sensitive information, including previous versions of files and credentials.

How It Works:

  1. Creation of Shadow Copies: Shadow Copies are created automatically or can be manually initiated. They allow for data recovery and backup without disrupting active processes.

  2. Accessing Shadow Copies: The shadow copies can be accessed through the file system, often found in a hidden directory. This feature can be used to recover deleted files or view past versions of files.

Steps to Attack Shadow Copies:

  1. Create a Shadow Copy of the Entire Disk: this action requires local administrator privileges.

  1. Copy the NTDS Database to the Specified Destination Copying the NTDS Database to the C: Drive: to back up the NTDS database from the shadow copy, use the following command.

  1. Save the System Registry to the Specified Destination:

  1. Download the Files to the Kali: use strategies from Section 17.

  2. Extract the Data from the NTDS Database using Kali: this command retrieves user credentials and hash values from the NTDS database backup, enabling further security assessments.

  1. (Optional): use Mimikatz to extract the credentials if it is not possible to bring the files to the Kali.

Steps to Access Shadow Copies:

  1. List Shadow Copies: use the following command to view existing shadow copies on a system.

  1. Access a Shadow Copy:

    • Find the shadow copy you want to access and note its shadow copy ID.

    • Mount the shadow copy using the following command:

  1. Explore the Mounted Shadow Copy: navigate to the new folder (C:\ShadowCopy) to explore and extract files.

  1. Recover Sensitive Data: look for sensitive files, such as password files, documents, or configuration files that may contain credentials or sensitive information.

hashtag
3.11 Constrained Delegation Attack

Constrained Delegation allows specific accounts to impersonate other users and access resources on their behalf, but only for certain services. Attackers can exploit misconfigured constrained delegation to escalate privileges or access sensitive data.

How It Works:

  1. Understanding Delegation: When a service account is set up with constrained delegation, it can request service tickets to access other resources using the identity of the user who authenticated to it.

  2. Exploitation: If an attacker can obtain the service account’s credentials or exploit a misconfiguration, they can impersonate users and access services that the account is permitted to use.

Steps to Exploit a Constrained Delegation Attack:

  1. Identify Delegated Accounts: use the following command to identify accounts with delegated permissions.

  1. Check Constrained Delegation Settings: use the PowerShell command to check for delegated permissions.

  1. Perform Kerberos Ticket Granting: if you have the service account credentials, use them to request service tickets.

  1. Access Resources as a Delegated User: once you have the ticket, access the resources using the identity of the impersonated user.

hashtag
4. ↔️ Active Directory Lateral Movement

hashtag
4.1 Techniques and Preparation

  • PowerShell Execution Policy Bypass:

  • Having valid credentials: in this case we can use any tools from either Windows or Kali to connect to the system from an internal server, keep in mind the other possibilities of impersonations using Silver and Golden Tickets, they are very important and are in the Section 3, as well as password spraying with crackmapexec from the Section 6.2 and accessing the Shadow Copies (Section 3.10).

  • Pass-the-Ticket: we use a Kerberos ticket to impersonate users, this is done using Silver or Golden Tickets, for that check the Sections 3.3(Silver Ticket) and 3.4 (Golden Ticket).

  • Overpass-the-Hash: uses an NTLM hash to request a Kerberos ticket (TGT), allowing attacks like pass-the-ticket.

hashtag
4.2 From Kali

4.2.1 Evil-WinRM

  • Password:

  • NTLM Hash:

4.2.2 PsExec

  • Password:

  • NTLM Hash:

4.2.3 VMIExec

  • Password:

  • NTLM Hash:

hashtag
4.3 From Windows

4.3.1 DCOM (Distributed Component Object Model)

This technique uses PowerShell's built-in capabilities to execute commands on remote systems via DCOM.

  1. Verify if DCOM is enabled on the target machine.

  1. Use the Invoke-Command to Execute Commands via DCOM

  1. (Optional) We can also try to use DCOM via vmiexec

4.3.2 PsExec

Tool for executing processes on remote systems, particularly useful for obtaining interactive shells.

4.3.3 WinRM

Service that allows remote management of Windows systems through the WS-Management protocol; this is how to establish a remote session:

4.3.4 WinRS

Command-line tool that allows you to run commands on remote systems.

4.3.5 WMIC

Command-line tool to perform Windows Management Instrumentation (WMI) operations, including executing commands remotely.

PreviousPage 2NextOSCP+ Cheat Sheet

Last updated