Active Directory

ADCS

certipy find -u svc_ldap -p 'lDaP_1n_th3_cle4r!' -target 10.10.11.222 -text -stdout -vulnerable

OR

certipy find -u svc_ldap -hashes :<HASH> -target 10.10.11.222 -text -stdout -vulnerable

ASREProast

GetNPUsers.py 'BLACKFIELD.LOCAL/' -usersfile user.txt -format hashcat -outputfile hashes.aspreroast -dc-ip 10.10.10.192
impacket-GetNPUsers dante/jbercov -no-pass -dc-ip 172.16.2.5

DCSync

impacket-secretsdump DANTE.ADMIN/jbercov:myspace7@172.16.2.5

Kerberoasting

getTGT

  • If we have the valid credentials, we can forge the ticket and get the shell

GPO Abuse

Check if we are the members of the Group Policy Creator Owners via whoami /groups

Now we have to use SharpGPOAbuse to add us to the administrator group, and for that, we need to

  • Create a GPO named pain.

  • Link it to the DOMAIN CONTROLLERS organisational unit in the FRIZZ.HTB domain.

  • Make sure the link is enabled so that the GPO takes effect on all objects within the OU (ie, domain controllers).

Shadow Credential

  • If we have GenericAll on a target user, we can

Tombstone

  • To Restore

  • via bloodyAD

GMSA

  • to get the password if we have read permission

  • TO check and set the read permission

Timeroasting

There is a white paper for TimeRoasting (refer to this), and this git repo

Writable Registry

We can use the below script to check for writable registry keys under HKLM:\SOFTWARE

If a non-admin user can write to a registry key under HKLM, it might allow:

  • Persistence (e.g., via startup or service hijacking)

  • Privilege escalation (e.g., by modifying how a privileged app or service behaves)

  • DLL hijacking or COM hijacking

Parsing DPAPI from user's home directory

DPAPI masterkeys are generally stored in the following directories:

  • %HOME%\AppData\Roaming\Microsoft\Protect\<UserSID>\

  • %HOME%\AppData\Local\Microsoft\Protect\<UserSID>\

Once we have the masterkey file, we need the encrypted blobs, generally found in the following directories:

  • %HOME%\AppData\Roaming\Microsoft\Credentials\

  • %HOME%\AppData\Local\Microsoft\Credentials\

After downloading these files, we can use impacket's dpapi.py to decrypt the masterkey and decrypt the blob:

if not able to download the key or credentials, try to base64 encode it

[Convert]::ToBase64String([IO.File]::ReadAllBytes('C:\users\c.neri\appdata\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115\4dbf04d8-529b-4b4c-b4ae-8e875e4fe847'))

NTLMv2 response

privilege escalation via NTLM relay using RemotePotato0, targeting a user who is actively logged in to the system

  • First, we need to upgrade our evil-winrm session to an interactive session. This way, we'll obtain more enumeration capabilities(using RunasC.exe)

  • We can see in our groups we now are in NT AUTHORITY\INTERACTIVE

  • We can see the abc user is connected to the box with session ID x

  • We can use an universal no fix exploit allowing to retrieve the NTLMv2 response of this user called RemotePotato0.exe:

ExecuteDCOM

AllowedToDelegate

Backup Operators

there are two ways

UnPAC-the-hash

iIn environments with PKI, we can use the UnPAC the hash - it lets us extract the NThash of the current user.

We need to request a certificate in the current context. The User template is usually enabled, and Domain Users can enroll on it. Certify can accomplish all that. We need to find the CA first:

When no template is specified, the User template gets used by default:

Using User template because

  • pkiextendedkeyusage contains Client Authentication

  • Enrollment Rights contains Domain Users

we need to copy out the certificate to our machine and convert it to PFX format:

Rubeus can now UnPAC the hash:

Interdomain trust - Unconstrained Delegation - Coercion

CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION should be there

Domain Controllers have unconstrained delegation enabled by default, which is also the case here.

Before 2019, it was possible to bypass forests as a security boundary with unconstrained delegation, but not anymore.

However, with the EnableTGTDelegation, this attack can be revived.

Let Rubeus.exe monitor and capture TGTs, while we coerce the DC01 in the darkzero.htb domain to connect to DC02 in the darkzero.ext domain.

We can use xp_dirtree (if MSSQL is there) or MS-RPRN.exe or any other for coercion

If the coercion was successful and DC01$'s TGT was dumped

After base64 decryption and conversion from .kirbi to .ccache, it can be used for DCSync:

PreviousPowerViewNextBloodyAD

Last updated