to find whether the domain controller is vulnerable or not
Copy certipy find -u svc_ldap -p 'lDaP_1n_th3_cle4r!' -target 10.10.11.222 -text -stdout -vulnerable
OR
certipy find -u svc_ldap -hashes :<HASH> -target 10.10.11.222 -text -stdout -vulnerable
Copy GetNPUsers.py 'BLACKFIELD.LOCAL/' -usersfile user.txt -format hashcat -outputfile hashes.aspreroast -dc-ip 10.10.10.192
Copy impacket-GetNPUsers dante/jbercov -no-pass -dc-ip 172.16.2.5
Copy impacket-secretsdump DANTE.ADMIN/jbercov:myspace7@172.16.2.5 If we have the valid credentials, we can forge the ticket and get the shell
Check if we are the members of the Group Policy Creator Owners via whoami /groups
Now we have to use SharpGPOAbusearrow-up-right to add us to the administrator group, and for that, we need to
Link it to the DOMAIN CONTROLLERS organisational unit in the FRIZZ.HTB domain.
Make sure the link is enabled so that the GPO takes effect on all objects within the OU (ie, domain controllers).
Shadow Credential
If we have GenericAll on a target user, we can
to get the password if we have read permission
TO check and set the read permission
There is a white paper for TimeRoasting (refer to thisarrow-up-right ), and this git repoarrow-up-right
Writable Registry
We can use the below script to check for writable registry keys under HKLM:\SOFTWARE
If a non-admin user can write to a registry key under HKLM, it might allow:
Persistence (e.g., via startup or service hijacking)
Privilege escalation (e.g., by modifying how a privileged app or service behaves)
DLL hijacking or COM hijacking
Parsing DPAPI from user's home directory
DPAPI masterkeys are generally stored in the following directories:
%HOME%\AppData\Roaming\Microsoft\Protect\<UserSID>\
%HOME%\AppData\Local\Microsoft\Protect\<UserSID>\
Once we have the masterkey file, we need the encrypted blobs, generally found in the following directories:
%HOME%\AppData\Roaming\Microsoft\Credentials\
%HOME%\AppData\Local\Microsoft\Credentials\
After downloading these files, we can use impacket's dpapi.py to decrypt the masterkey and decrypt the blob:
NTLMv2 response
privilege escalation via NTLM relay using RemotePotato0 , targeting a user who is actively logged in to the system
First, we need to upgrade our evil-winrm session to an interactive session. This way, we'll obtain more enumeration capabilities(using RunasC.exe)
We can see in our groups we now are in NT AUTHORITY\INTERACTIVE
We can see the abc user is connected to the box with session ID x
We can use an universal no fix exploit allowing to retrieve the NTLMv2 response of this user called RemotePotato0.exe:
AllowedToDelegate
Backup Operators
there are two ways
iIn environments with PKI, we can use the UnPAC the hash - it lets us extract the NThash of the current user.
We need to request a certificate in the current context. The User template is usually enabled, and Domain Users can enroll on it. Certify can accomplish all that. We need to find the CA first:
When no template is specified, the User template gets used by default:
Using User template because
pkiextendedkeyusage contains Client Authentication
Enrollment Rights contains Domain Users
we need to copy out the certificate to our machine and convert it to PFX format:
Rubeus can now UnPAC the hash:
Interdomain trust - Unconstrained Delegation - Coercion
CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION should be there
Domain Controllers have unconstrained delegation enabled by default, which is also the case here.
Before 2019, it was possible to bypass forests as a security boundaryarrow-up-right with unconstrained delegation, but not anymore.
However, with the EnableTGTDelegation, this attack can be revived.
Let Rubeus.exe monitor and capture TGTs, while we coerce the DC01 in the darkzero.htb domain to connect to DC02 in the darkzero.ext domain.
We can use xp_dirtree (if MSSQL is there) or MS-RPRN.exe or any other for coercion
If the coercion was successful and DC01$'s TGT was dumped
After base64 decryption and conversion from .kirbi to .ccache, it can be used for DCSync:
Last updated 3 months ago