AD Vulnerable Lab — Abusing Active Directory Misconfigurations

GitHub - safebuffer/vulnerable-AD: Create a vulnerable active directory that's allowing you to test… Create a vulnerable active directory that's allowing you to test most of the active directory attacks in a local lab …

Kerberoasting
AS-REP Roasting
SMB Signing Disabled
Password Spraying
Pass-the-Hash
Password in Object Description
User Objects With Default password (Changeme123!)
Abusing ACLs/ACEs
Abuse DnsAdmins
DCSync
Silver Ticket
Golden Ticket
Pass-the-Ticket

First: Build Lab Enviroment.

1. Windows Server

In my case i used windows server 2022

2. Windows Workstation

I used windows 10

3. Kali Linux

This machine is optional but it's making things easier

See tutorials about how to setup Active Directory enviroment, make sure that the virtual machines are connectd on the same network interface card or host-only, give every machine an static ip .. 192.168.1.2 was my Domain Controller IP, then try to ping from each machine to another just to make sure that everything works well, after that let's start!

4. Runing script

From DC "Windows Server" Powershell run this script to setup the vulnerable lab, on my lab I just changed the domain from cs.org to test.local, you can go as you like!

# if you didn't install Active Directory yet , you can try
Install-windowsfeature AD-domain-services
Import-Module ADDSDeployment
Install-ADDSForest -CreateDnsDelegation:$false -DatabasePath "C:\\Windows\\NTDS" -DomainMode "7" -DomainName "cs.org" -DomainNetbiosName "cs" -ForestMode "7" -InstallDns:$true -LogPath "C:\\Windows\\NTDS" -NoRebootOnCompletion:$false -SysvolPath "C:\\Windows\\SYSVOL" -Force:$true
# if you already installed Active Directory, just run the script !
IEX((new-object net.webclient).downloadstring("https://raw.githubusercontent.com/wazehell/vulnerable-AD/master/vulnad.ps1"));
Invoke-VulnAD -UsersLimit 100 -DomainName "cs.org"

# if you didn't install Active Directory yet , you can try
Install-windowsfeature AD-domain-services
Import-Module ADDSDeployment
Install-ADDSForest -CreateDnsDelegation:$false -DatabasePath "C:\\Windows\\NTDS" -DomainMode "7" -DomainName "cs.org" -DomainNetbiosName "cs" -ForestMode "7" -InstallDns:$true -LogPath "C:\\Windows\\NTDS" -NoRebootOnCompletion:$false -SysvolPath "C:\\Windows\\SYSVOL" -Force:$true
# if you already installed Active Directory, just run the script !
IEX((new-object net.webclient).downloadstring("https://raw.githubusercontent.com/wazehell/vulnerable-AD/master/vulnad.ps1"));
Invoke-VulnAD -UsersLimit 100 -DomainName "cs.org"

To make sure the script worked, run this command to list all users that the script configured.

Now that everything is ready, let's begin working with the vulnerable lab.

Second: Enumeration Phase.

From kali let's run this commands:

1. Service Enumeration

Take notes about the open ports, we gonna try to see what we can do!

2. SMB Enumeration

3. LDAP Enumeration

4. RPC Enumeration

If access denied, that's normal.

RPC Enumeration is asking Windows services for information about Active Directory objects (users, groups, policies, etc.) through the RPC protocol.

5. Kerberos Enumeration

Suppose we know usernames or we can guess them or the combination like andraw, michael.angelo and so on.

In our lab we know the actual usersnames, I saved them in users.txt

Now lets's try kerbrute, make sure it's installed on ur machine.

After we found active username (acutaly we got them), now let's try to obtain credentials!

6. AS-REP Roasting

We gonna run this command to see if some users have Kerberos preauthentication disabled!

impacket-GetNPUsers test.local/ -dc-ip 192.168.1.2 -usersfile users.txt -request

Kerberos Auth is disabled on user irena.romy,that mean irenais vulnerable to AS-REP roasting and we got the password hash!

7. Crack the Hash

I save irena hash into asrep_hash.text, now let's crack this hash with hashcat tool, but make sure you put only the hash with the correct formt, without breaking or new lines.

AS-REP hashes use mode 18200

We can also try password spraying but be careful not to lock accounts.

8. BloodHound Collection

9. NetExec Enumeration

With NetExec we got an amazing findings!!!! Now let's enumerate sessions, shares and groups!

At this point, we have gathered enough valuable information and identified several interesting attack paths. So, let's stop here with the enumeration phase and start leveraging these findings against the Active Directory environment.

That's all for this stage, in part two we will move beyond basic enumeration and begin exploiting Active Directory misconfigurations. In the next phases we gonna try to:

Analyze BloodHound
Attack the Weakest Link
Hunt for Credentials
RDP
Privilege Escalation
Domain Dominance / Domain Admin
Persistence

Thank you for taking the time to read this walkthrough. I hope you found it informative and useful. Stay tuned for more content . Happy hacking!

Contents