👾AD Exploitation
Golden Ticket Attacks:
KRBTGT hashes are needed for this attack and allows to impersonate any damn user. POWERFUL!
How it's done:
Stealing the NTDS.DIT file — The NTDS.DIT file is a database that stores Active Directory data, including the password hashes for all users in the domain. A copy of the file is stored on every domain controller, in C:\Windows\NTDS\ by default.
Compromising a workstation — There can be credential artifacts in memory or on disk drive from the admin’s password.
Using Mimikatz
Running a DCSync attack — Active Directory environments typically include multiple domain controllers, which have to remain in sync by updating each other about changes, such as updates to user credentials. In addition, some applications, including Azure Active Directory Connect, need replication permissions. In a DCSync attack, a hacker who has gained access to a privileged account with domain replication rights subverts this AD functionality by pretending to be a DC and requesting password hashes from a legitimate DC. DCSync is a capability of the Mimikatz tool.
If users don't have kerberos pre-authentication enabled
🐶BloodhoundBloodhound
getTGT.py absolute.htb/d.klayKRB5CCNAME=d.klay.ccache ./bloodhound.py -k -dc dc.absolute.htb -ns 10.10.11.181 -c All -d absolute.htb -u d.klay@absolute.htbBruteforcing
With kerbrute.py:
With Rubeus version with brute module:
ASREPRoast
With Impacket example GetNPUsers.py:
With Rubeus:
Cracking with dictionary of passwords:
Kerberoasting
With Impacket example GetUserSPNs.py:
With Rubeus:
With Powershell:
Cracking with dictionary of passwords:
Overpass The Hash/Pass The Key (PTK)
By using Impacket examples:
Pass The Ticket (PTT)
Harvest tickets from Linux
Check type and location of tickets:
If none return, default is FILE:/tmp/krb5cc_%{uid}.
In case of file tickets, you can copy-paste (if you have permissions) for use them.
In case of being KEYRING tickets, you can use tickey to get them:
Harvest tickets from Windows
With Mimikatz:
With Rubeus in Powershell:
To convert tickets between Linux/Windows format with ticket_converter.py:
Using ticket in Linux:
With Impacket examples:
Using ticket in Windows
Inject ticket with Mimikatz:
Inject ticket with Rubeus:
Execute a cmd in the remote machine with PsExec:
Silver ticket
With Impacket examples:
With Mimikatz:
Inject ticket with Rubeus:
Execute a cmd in the remote machine with PsExec:
Golden ticket
With Impacket examples:
With Mimikatz:
Inject ticket with Rubeus:
Execute a cmd in the remote machine with PsExec:
Misc
To get NTLM from password:
Password Spraying
From windows
From linux
Last updated
Was this helpful?