Learning Active Directory Pentesting
[TOC]
During a penetration test, we often run into a scenario like this: a server in the domain exposes a web service through a port mapping on the router. We exploit a web script vulnerability and gain system privileges on that host. If the client wants us to go further and test the internal network to demonstrate the serious risks facing the company, this is where internal Active Directory penetration comes in. Our usual goal is to gain control of the domain controller, because once the DC falls, the entire internal network is effectively in our hands.
1. Lab Setup
Before we begin, we need to set up a domain environment. Since this is only for teaching and testing, one domain controller and one domain-joined host are enough. I use windows server 2012 and windows 7 here. By compromising windows 7, or simply controlling it directly, we can simulate a compromised host and use it to study Active Directory penetration.
The windows server 2012 machine has an Administrator user (the domain controller’s super-administrator account). Windows7 has a dada user (a member of the Administrators group) and a xiao user (a standard domain user).
2. Information Gathering in the Domain
The first step in every penetration test is information gathering, and a domain is no exception.
① Identify the Environment
Inside the domain, first identify the compromised host’s current internal-network environment, including details such as the topology. The following commands can help you quickly get your bearings.
| |
- During a penetration test, remember to save the data you collect. Do not just glance at it and lose it, and try not to query the same information repeatedly. Every action should be clean and efficient.
② Domain Information
Besides learning about the internal-network environment, we can query domain-related information directly with commands.
1. net view
View devices in the local workgroup/domain environment.
View online hosts in the domain. At this point, we can see the two machines in the domain: the compromised XZM-PC and the domain controller AD.
If error 6118 appears =>
- Disable the firewall; 2. enable the services (Computer Browser, Server, and Workstation); 3. reopen CMD.
2. net view /domain
See how many domains currently exist. Here, we can see one domain named MAO.
3. net user /domain
View users in the domain. Besides the usual administrator and guest accounts, we can see a krbtgt user. This account is extremely important, and we will come back to it later.
4. net group /domain
View information about the domain’s groups.
There are quite a few groups here, so I will list a few of the key ones.
*Domain Admins — administrators group
*Domain Computers — hostnames
*Domain Controllers — domain controllers group
*Enterprise Admins — enterprise-level administrators
You can use net group group_name /domain to view the users in a group.
5. whoami /user
Determine your current privileges.
- 500: administrator
- 501: guest
- 1000+: standard user
6. net group “domain controllers” /domain
View the members of the domain controller administrators group (a high-privilege group in the domain).
- Domain Admins — domain administrators group (high privilege)
- Domain Computers — hosts joined to the domain
- Domain Controllers — domain controllers (high privilege)
- Domain Users — standard domain users
- Enterprise Admins — enterprise administrators (high privilege)
8. systeminfo | findstr “KB”
View patch information.
7. Locate the Domain Controller
The domain controller has the highest privileges in the domain, so it is naturally our primary target. We can locate it using some of the commands introduced above.
Use net user /domain to view accounts in the domain and net group "domain controllers" /domain to view the domain controllers. You can quickly check your own privileges with whoami /user.
3. Local Authentication
① Windows Local Authentication
Before we start attacking, we need to understand how windows authentication works.
From studying the operating system, we know that C:\Windows\System32\config\SAM is the database file that stores host account passwords.
The windows login process is actually quite simple. winlogin.exe starts, and when the user enters an account name and password, they are sent to lsass.exe. lsass.exe converts the plaintext entered by the user into an NTLM hash and compares it with the data stored in the SAM file. If they match, the login succeeds.
Windows Logon is the user login program in the Windows operating system. It manages user login and logout and provides the interface where users enter their account names and passwords, also known as the login page or login screen.
lsass is part of the Microsoft windows security mechanism. It is a critical Windows operating-system process responsible for local security and login policies. It starts automatically when Windows boots and continues running in the background.
② NTLM hash
Of course, windows itself does not store plaintext passwords. The SAM file stores password hashes. During login, the user’s input is first converted into a hash before the comparison is performed.
Hashes are generally stored in two places:
- The SAM file, stored on the local machine => corresponds to local users
- The NTDS.DIT file, stored on the domain controller => corresponds to domain users
1. Hashing Process
The plaintext password entered by the user => hexadecimal => unicode => md4 algorithm => NTLM hash. As you can see, the entire process is fairly simple.
2. Stored Password Format
Example: administrator:500:LM hash:NTLM hash
The username comes first, followed by the user’s SID, then the LM hash and NTLM hash.
If the LM Hash begins with AAD3B, the password is empty or has not been set.
LM Hash stands for “LAN Manager Hash.” It is a hashing algorithm Microsoft adopted to improve the security of the Windows operating system, and it is essentially based on DES encryption. Although LM Hash is relatively easy to crack, Windows only disabled it to maintain system compatibility (starting with Windows Vista and Windows Server 2008, Windows disables LM Hash by default). LM Hash plaintext passwords are limited to 14 characters, so if you want to stop using LM Hash, simply set the user’s password to more than 14 characters.
3. lsass.exe
During lateral movement and privilege escalation on an internal network, the most common approach is to dump the lsass.exe process to obtain plaintext passwords or hashes. lsass.exe (Local Security Authority SubsystemService) is a system process used by the Microsoft Windows security mechanism for local security and login policies. Its process space contains important information such as the machine’s domain, local usernames, and passwords. However, you must first obtain high privileges before you can access it.
4. Extracting Passwords from lsass.exe
① Procdump
procdump is a command-line tool mainly used to monitor abnormal CPU activity in applications and create memory dumps. As mentioned above, plaintext and encrypted passwords are both stored in lsass, so procdump can dump lsass’s memory resources. Here are some of its parameters.
1. Relevant Parameters
- -ma: Writes a “full” dump file. [Includes all memory (images, mappings, and private memory), as well as all metadata for processes, threads, modules, handles, address spaces, and so on.]
- -accepteula: Automatically accepts the Sysinternals license agreement when this command-line option is used.
2. Basic Usage
It is very straightforward: specify the options and the process whose memory you want to dump, then provide an output filename. You immediately get a memory dump file with the .dmp extension. (This requires a command-line window running with administrator privileges.)
| |
Normally, we cannot open passwd.dmp directly; opening it in Notepad only shows garbled text. This is where another small tool, Mimikatz, comes in to read passwd.dmp.
② Mimikatz
Mimikatz is a powerful, lightweight debugging tool developed by the French researcher benjamin. It was originally intended for personal testing, but its powerful ability to read plaintext passwords directly from operating systems such as WindowsXP-2012 made it famous in penetration testing. You could call it an essential penetration-testing tool.
1. Relevant Parameters
Mimikatz has many parameters, so I will only cover the commonly used ones here.
| |
- privilege module
(This requires a command-line window running with administrator privileges.)
| |
- sekurlsa module
| |
- lsadump module
| |
- kerberos module
| |
- process module
| |
Mimikatz works so well that antivirus software will flag it. If you plan to run Mimikatz on a target machine, first consider whether you need to make it evade detection.
2. Basic Usage
Mimikatz can extract plaintext passwords from memory. After loading the dmp file obtained with procdump using sekurlsa::minidump, you can read passwords with commands such as sekurlsa::logonpasswords full. The result looks like this:
| |
Here, we can see administrator information in the screenshot. Getting this information in a real environment basically means the engagement is over.
3. Advanced Usage
① Use Mimikatz with a dump file created by procdump to extract credentials.
| |
② Use Mimikatz directly to extract credentials (administrative privileges required).
| |
With Local Administrator Privileges
Extract Passwords
| |
Bypass the LSA Protection Policy to Read Passwords
| |
Workflow summary:
- Obtain the NTLM hash
- Use procdump/PPLdump to dump the lsass process
- Use mimikatz to analyze the dump file and extract the hash
- Choose a path using the NTLM hash:
- Crack the hash to obtain the plaintext password
- Use the hash directly in a PTH attack (when it cannot be cracked)
Key points:
- NTLM hashes are generated the same way on all Windows systems (MD4)
- The same password produces the same hash on different machines
- PTH can authenticate without the plaintext password
- A dump of lsass contains credential information for every logged-in user
In particular:
- The hash of the administrator who is currently logged in
- Hashes of other logged-in users
- Hashes of system service accounts
But keep in mind:
- You can only obtain hashes for users who have logged in
- Information for users who have never logged in will not be present in lsass
In practice, cracking md4 can also recover the plaintext password.
5. Lab: PTH (pass-the-hash)
① Introduction
Pass-the-hash is a hacker technique in which an attacker uses the hash of a user’s password to authenticate to a remote server and expand their foothold. It is essentially a form of credential stuffing. Once we have an NTLM hash, we can very easily launch a PTH attempt with Mimikatz’s sekurlsa::pth.
- Limitation: the hash must remain static (the password must not be changed)
- Applicable to: domains/workgroups where a hash can be obtained but not cracked, and where machines on the internal network share the same password.
- KB2871997: fixed PTH for standard users, but not administrators. On systems >= win server 2012, plaintext passwords cannot be captured from the lsass process.
Because KB2871997 fixed PTH for standard users, privilege::debug is needed to elevate privileges (from a high-privilege terminal).
② Prerequisites
To use Mimikatz’s sekurlsa::pth module, you need to know at least the following:
- PTH target: use commands such as
net user /domainto view domain-user information - Domain name: use commands such as
net view /domainto view the domain name - NTLM hash: obtain it with procdump and Mimikatz
| |
③ When It Applies
This applies when you do not need the user’s password, only have the domain controller’s NTLM Hash, and cannot crack it.
④ Information Gathering
Find the PTH target => Administrator
View members of the administrators group => choose Administrator as the target
Domain name => MAO
Obtain the administrator’s ntml hash => 570a9a65db8fba761c1008a51d4c95ab
| |
⑤ Launch the Attack
Method 1: Direct PTH with Mimikatz
| |
This gives us control of the domain controller. (If all parameters are correct but the attack still fails, try closing the Mimikatz window, start cmd.exe again as administrator, elevate privileges again, and rerun the attack. The command after run is optional; by default, it opens cmd.exe on the domain controller.)
Method 2: Use Credential-Passing Scripts to Obtain a Shell
| |
| |
6. Kerberos Authentication Protocol
Kerberos is a third-party authentication protocol that uses symmetric encryption to provide strong authentication for client/server applications. In Greek mythology, Kerberos is the three-headed hound guarding the gates of Hades. Its three heads represent the three roles in the protocol, as shown below:
The Client accessing the service (the party sending the request)
The Server providing the service (the party receiving the request)
The KDC, or Key Distribution Center, which contains the following two services:
- AS, the authentication service (Authentication Server) [dedicated to authenticating the client and issuing the TGT the client uses to access the TGS]
- TGS, the ticket authorization service (Ticket Granting Server) [issues the tickets needed throughout authentication and the service ticket the client needs to access the server]
- DC (Domain Controller): domain controller
- KDC (Key Distribution Center): key distribution center
- AS (Authentication Server): authentication server
- TGS (Ticket Granting Server): ticket-granting server
- TGT (Ticket Granting Ticket): ticket-granting ticket
Authentication Overview
First, the client sends a request to the AS and obtains a TGT.
The client uses the TGT obtained from the AS to send a request to the TGS. After successfully decrypting the TGT, the TGS generates a new ticket and returns it to the client.
The client uses the new ticket returned by the TGS to send a request to the server for authorization.
7. Lab: PTC (pass-the-cache)
If we can obtain a user’s TGT and import it into memory, we can impersonate that user and gain their access privileges.
① MS14-068 Vulnerability
MS14-068 is a Windows vulnerability in the Key Distribution Center (KDC) service. It allows an authenticated user to insert an arbitrary PAC (the structure representing all user privileges) into a Kerberos ticket (TGT). The vulnerability is located in kdcsvc.dll in the domain controller’s Key Distribution Center. A user can obtain a ticket by presenting a kerberos TGT with a modified PAC.
High privileges are required.
Affected Versions
- Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2
- Windows Vista, Windows 7, Windows 8, and Windows 8.1
Patch Number and Exploitation Requirements
Patch number: KB3011780
Exploitation requirements:
- Obtain access to a host (a domain-joined host)
- Collect the account name, password, SID, and domain information for any user in the computer domain
- The MS14-068 patch is not installed
#There is a problem with this tutorial. If you have an administrator account and password, you can probably use PTH. The defining feature of MS14-068 is that a standard domain account can escalate to domain administrator, which is why the vulnerability is so severe. Any standard domain user is enough here.
② Information Gathering
| |
Windows is case-insensitive, so both mao.com and MAO.COM work.
③ Exploitation
1. Generate a Domain Administrator Key
| |
2. Import the Generated Ticket into Memory
Then use Mimikatz’s kerberos::ptc module to load the ticket.
| |
3. Open an Administrator Terminal with the Current Privileges
Use Mimikatz’s misc::cmd module to open a new window and verify our current privileges.
| |
4. Use PsExec.exe to Obtain an Interactive Shell
From the administrator terminal we just created, use PsExec.exe to obtain an interactive shell and create a user belonging to the administrators group.
| |
PTC on linux
- Find ticket cache files:
| |
- Import the ticket:
| |
- Use the ticket:
| |
Main use cases:
- Linux joined to a domain environment
- Penetration testing inside a domain
- Cross-platform attacks
8. Lab: PTT (pass-the-ticket) Golden Ticket
① Introduction
The KDC’s job is to generate a TGT for any user. That raises a question: what would let someone generate a TGT for an arbitrary user? We need to look back at the kerberos authentication process. During windows authentication, the client sends its own information to the KDC. The KDC then uses the NTLM hash of the krbtgt user's password as the encryption key and generates a TGT.
In one sentence: the TGT is generated by the KDC using the hash of the krbtgt user’s password as the key, together with the client’s own information.
So if we obtain the hash of the krbtgt password, can we forge any TGT? Absolutely. However, because krbtgt exists only on the domain controller, using a Golden Ticket (a pass-the-ticket attack) means we must already have compromised the domain controller. A Golden Ticket can therefore be understood as a backdoor.
The Krbtgt user is generated automatically when the domain controller is created.
As long as the krbtgt user’s password is not changed, a Golden Ticket can be used to create ticket information for any user and inject it into memory.
Using a Golden Ticket requires communication with the domain controller.
② Prerequisites
- Domain name and domain SID (with the rid removed): obtain them with
whoami /user - Username to forge (the target): obtain it using methods such as
net user /domain - Hash of the krbtgt user: obtain it using methods such as Mimikatz
③ Information Gathering
Use mimkatz to obtain the krbtgt hash (only this step must be performed on the domain controller) => e798fdc7ba810c372ef7bffcdc8f2d13
Mimkatz can be finicky, and because of issues with the software, directly pasting Mimikatz content into the command line may fail or even crash the program. We can work around that by generating a log.
| |
Domain SID (no privileges are required to retrieve it): whoami /user => S-1-5-21-863777703-696496247-1862912240 (the portion after the last hyphen represents the user’s privileges, so we only need the first part)
Username to forge (target): net user /domain => Administrator
Domain name (full domain name): ipconfig /all => mao.com
③ Exploitation
Run these operations from an administrator window.
1. Clear Existing Tickets
Existing tickets must be cleared before generating a ticket. As a result, if ticket generation fails, the host will no longer be able to access information in the domain (it effectively leaves the domain).
After clearing the tickets with kerberos::purge, you can use kerberos::golden to generate a ticket.
| |
2. Generate a Ticket
| |
3. Inject the Ticket
| |
4. Create a Domain Controller Session
| |
https://blog.csdn.net/m0_55751267/article/details/127990619 explains the principles behind Silver and Golden Tickets.
This blog post: https://xz.aliyun.com/t/13435?time__1311=Gqmxu7G%3D5mq05DK5YK0%3DIouDfxiT277GbD
Mimikatz antivirus bypass: https://github.com/wangfly-me/mimikatz_bypass/releases/tag/v1.0
References: