Exercise: Enumerating and exploiting AD on Forest
Running an nmap scan we find:
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos
(server time: 2021-01-12 01:10:07Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds
(workgroup: HTB)
464/tcp open kpasswd5?
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP
(Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49671/tcp open msrpc Microsoft Windows RPC
49676/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49677/tcp open msrpc Microsoft Windows RPC
49681/tcp open msrpc Microsoft Windows RPC
49697/tcp open msrpc Microsoft Windows RPC
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 2h49m33s, deviation: 4h37m11s, median: 9m31s
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: FOREST
| NetBIOS computer name: FOREST\x00
| Domain name: htb.local
| Forest name: htb.local
| FQDN: FOREST.htb.local
|_ System time: 2021-01-11T17:11:05-08:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: required
| smb2-security-mode:
| 2.02:
|_ Message signing enabled and required
| smb2-time:
| date: 2021-01-12T01:11:03
|_ start_date: 2021-01-12T01:05:12The machine is likely running Windows Server 2016 Standard 6.3 and is likely an Active Directory domain controller as it is running DNS, Kerberos, LDAP. smbmap and crackmapexec do not return any information on shares. If we explore LDAP, we can first confirm the namingContexts:
If we now do a general query we get a great deal of output. We can filter this to see what classes of objects we are getting back and we see:
We are interested in the users and so we can customize our search to just return those:
I have only shown the first record here to give you an idea of what the record looks like. We can extract the sAMAccountNames to create a user list by using grep for the sAMAccountName and we get a list:
One thing that is missed potentially here is that there is a Service Account svc-alfredo that does not come up as a user through the LDAP query. What does display is:
At this point, if we search the internet for svc-alfresco, we find that it is likely that it belongs to a product called Alfresco which is a content management system. If you dig through the documentation, there is a section about configuring Alfresco with Active Directory and in particular, it mentions the requirement that the service account needs to have the "Do not require Kerberos preauthentication" enabled (https://docs.alfresco.com/5.1/tasks/auth-kerberos-ADconfig.html). However, if you didn't see this then the next step would be potentially something you could try in any event. What we saw earlier, is that if preauthentication is not required, then any client can request a TGT from the KDC for any user. When the KDC responds, the TGT is encrypted using the users password hash and so it is then a matter of extracting the TGT and brute forcing it to reveal the password. This is known as AS-REP Roasting as the TGT is sent as part of an AS-REP message from the KDC to the user.
We can run Impacket's GetNPUsers.py script to check each user in the user list we have:
Note that htb.local is the domain name and for this to work, it needs to be in the hosts file. We get a hit with svc-alfresco and we can take the returned result and crack it with John The Ripper giving us a password s3rvice:
AS-REP Roasting is related to another attack called Kerberoasting. Kerberoasting requires a username and password of a user on the domain. With the credentials, the user can request a service ticket from any service. It doesn't matter whether the user is supposed to have access to this service because the KDC does not decide this, it is the role of the service to decide if the user is allowed to access it or not. Kerberoasting depends on being able to look up the service principal names (SPNs) of the service and requesting service tickets for them. We are going to be looking at this shortly but first we can use evil-winrm with this account to get onto the machine and find the user flag file user.txt in the svc-alfresco Desktop directory.
Back on our machine, we are going to run a tool called Bloodhound to map the relationships of the users on the domain graphically. There are a number of tools that will do the ingesting of data from the domain. On Windows, you can use SharpHound (https://github.com/BloodHoundAD/SharpHound3) but as we are on Parrot OS, we can simply install a Python version using pip:
To run this, we specify the domain local.htb and point to forest.htb (using its IP address) as the name server:
To install the visual component is slightly more complicated and there are full instructions in the docs page (https://bloodhound.readthedocs.io/en/latest/installation/linux.html). When you have Bloodhound running, you can drop the .json files generated in the previous step onto the main window and it will import them. In the search box, type [email protected] and select it from the item that appears. In the node info tab below, you can click on the number 9 next to the unrolled group membership to get the layout shown in Figure 8-1
Graph of group memberships of svc-alfresco account in htb.local domain on Forest
You can right click the node with svc-alfresco and mark it as "owned". From the graph, we can see that svc-alfresco is a member of the "Service Accounts" group which in turn is a member of "Privileged IT Accounts" which is part of "Account Operators". The last group has a diamond icon on it which shows that it is a high value group. According to the documentation (https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-security-groups#bkmk-accountoperators) this account can create and manage accounts but cannot manage the Administrator account or membership of groups such as Administrators, Server Operators, Account Operators, Backup Operators, or Print Operators.
In the Analysis tab in Bloodhound, there are a number of pre-built queries that we can run. If we run the query "Shortest Path to High Vale Targets" we find a link between the group "Account Operators" to the group "Exchange Windows Permissions" which has WriteDacl permissions over the htb.local domain (Figure 8-2).
The WriteDACL permission means that we can change the permissions (Access Control List ACL) of a user to give them permissions that will allow us to exploit AD. The main path to do this is a DCSync attack which involves creating a user and then give the user Active Directory Replication rights (Replicating Directory Changes All and Replicating Directory Changes). Normally, replication is responsible for keeping backup copies of the domain synchronized.
To carry out this attack, we are going to use PowerView which can be obtained by cloning the PowerSploit repository from GitHub (https://github.com/PowerShellMafia/PowerSploit.git). We first create a user and then add them to the Exchange Windows Permissions group.
We can now download PowerView.ps1 and add the DCSync ACLs:
Once that is done, we can use the Impacket tool secretsdump.py to do the AD replication and obtain all of the password hashes:
With the hash, we can again use evil-winrm to remote onto the machine as Administrator and use their hash
Before we leave this box, as part of the DCSync attack, we obtained the golden ticket, namely the hash for the user krbtgt. We can use this to create TGT tickets for any user using the Impacket tools ticketer.py. This tool requires the domain SID which we can get using the Get-ADDomain PowerShell command.
With that, we can create a TGT for the user administrator (it can be any valid user or servie account) using ticketer.py as follows:
We then set the environment variable KRB5CCNAME to the administrator.ccache file and use wmiexec.py to remote onto the box:
Although we used secretsdump.py, an alternative would have been to use mimikatz to do the same thing. Uploading mimikatz.exe to the machine as rin and then running:
Last updated
Was this helpful?