Total OSCP GuidePayloads All The Things

👾AD Exploitation

Protected users cant use NTLM hashes

Golden Ticket Attacks:

KRBTGT hashes are needed for this attack and allows to impersonate any damn user. POWERFUL!

How it's done:

  • Stealing the NTDS.DIT file — The NTDS.DIT file is a database that stores Active Directory data, including the password hashes for all users in the domain. A copy of the file is stored on every domain controller, in C:\Windows\NTDS\ by default.

  • Compromising a workstation — There can be credential artifacts in memory or on disk drive from the admin’s password.

  • Using Mimikatz

  • Running a DCSync attack — Active Directory environments typically include multiple domain controllers, which have to remain in sync by updating each other about changes, such as updates to user credentials. In addition, some applications, including Azure Active Directory Connect, need replication permissions. In a DCSync attack, a hacker who has gained access to a privileged account with domain replication rights subverts this AD functionality by pretending to be a DC and requesting password hashes from a legitimate DC. DCSync is a capability of the Mimikatz tool.

https://github.com/AdityaHebballe/Gitbook/blob/master/welcome/active-directory/ad-exploitation/broken-reference/README.md

If users don't have kerberos pre-authentication enabled

🐶Bloodhound

Bloodhound

getTGT.py absolute.htb/d.klay
KRB5CCNAME=d.klay.ccache ./bloodhound.py -k -dc dc.absolute.htb -ns 10.10.11.181 -c All -d absolute.htb -u d.klay@absolute.htb

Bruteforcing

With kerbrute.py:

With Rubeus version with brute module:

ASREPRoast

With Impacket example GetNPUsers.py:

With Rubeus:

Cracking with dictionary of passwords:

Kerberoasting

With Impacket example GetUserSPNs.py:

With Rubeus:

With Powershell:

Cracking with dictionary of passwords:

Overpass The Hash/Pass The Key (PTK)

By using Impacket examples:

With Rubeus and PsExec:

Pass The Ticket (PTT)

Harvest tickets from Linux

Check type and location of tickets:

If none return, default is FILE:/tmp/krb5cc_%{uid}.

In case of file tickets, you can copy-paste (if you have permissions) for use them.

In case of being KEYRING tickets, you can use tickey to get them:

Harvest tickets from Windows

With Mimikatz:

With Rubeus in Powershell:

To convert tickets between Linux/Windows format with ticket_converter.py:

Using ticket in Linux:

With Impacket examples:

Using ticket in Windows

Inject ticket with Mimikatz:

Inject ticket with Rubeus:

Execute a cmd in the remote machine with PsExec:

Silver ticket

With Impacket examples:

With Mimikatz:

Inject ticket with Rubeus:

Execute a cmd in the remote machine with PsExec:

Golden ticket

With Impacket examples:

With Mimikatz:

Inject ticket with Rubeus:

Execute a cmd in the remote machine with PsExec:

Misc

To get NTLM from password:

Password Spraying

From windows

From linux

PreviousAD ToolsNextPost Exploitation

Last updated

Was this helpful?