Active Directory Authentication Attacks

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

• Mark Password Spraying as done
  Guide 3 min read

  Password Spraying

  Focus on #Build a username list #Spray over SMB #Spray over LDAP #Spray timing #Interpret results
• Mark Credential Capture with Responder as done
  Guide 4 min read

  Credential Capture with Responder

  Focus on #Responder capture mode #Relay mode: disable built-in servers #Crack captured hashes #Capture from a Windows host: Inveigh
• Mark AD Password Cracking Strategies as done
  Guide 5 min read

  AD Password Cracking Strategies

  Focus on #Username as password #Extract domain context from LDAP #Hashcat modes for AD hash types #Rules and masks
• Mark Password Attacks and Credential Abuse as done
  Guide 5 min read

  Password Attacks and Credential Abuse

  Focus on #Force password change: ForceChangePassword #gMSA password extraction #LAPS password extraction #Enable disabled accounts #DCSync: dump all domain hashes
• Mark Kerberoasting as done
  Guide 4 min read

  Kerberoasting

  Focus on #Find Kerberoastable accounts #Request TGS hashes #Crack the hashes #Targeted Kerberoasting via GenericWrite
• Mark AS-REP Roasting as done
  Guide 4 min read

  AS-REP Roasting

  Focus on #Find AS-REP Roastable accounts #Request the AS-REP hashes #Crack the AS-REP hashes #Force AS-REP Roasting with GenericWrite
• Mark Kerberos Abuse Privilege Escalation as done
  Guide 5 min read

  Kerberos Abuse Privilege Escalation

  Focus on #AS-REP Roasting #Kerberoasting #Unconstrained delegation abuse #Constrained delegation abuse
• Mark Delegation Misconfiguration Discovery as done
  Guide 3 min read

  Delegation Misconfiguration Discovery

  Focus on #Unconstrained delegation #Constrained delegation #Resource-based constrained delegation (RBCD)
• Mark Unconstrained Delegation Abuse – TGT Capture as done
  Guide 3 min read

  Unconstrained Delegation Abuse – TGT Capture

  Focus on #Identifying Unconstrained Delegation Hosts #Capturing TGTs with Rubeus Monitor Mode #Coercing DC Authentication with SpoolSample #Using the Captured TGT #Cross-Domain Escalation
• Mark Constrained Delegation Abuse – S4U Impersonation as done
  Guide 3 min read

  Constrained Delegation Abuse – S4U Impersonation

  Focus on #Finding Constrained Delegation Accounts #Abusing Constrained Delegation with Rubeus #Substituting the Service Class #Abusing Constrained Delegation from Linux with Impacket
• Mark RBCD – Resource-Based Constrained Delegation Abuse as done
  Guide 4 min read

  RBCD – Resource-Based Constrained Delegation Abuse

  Focus on #Step 1: Create a Controlled Machine Account #Step 2: Write the Delegation Attribute #Step 4: Request a Service Ticket via S4U #Targeting a Domain Controller #From Windows with Rubeus
• Mark ADCS Misconfiguration Discovery as done
  Guide 7 min read

  ADCS Misconfiguration Discovery

  Focus on #Confirm ADCS is deployed #Certipy: full ADCS enumeration #ESC1: enrollee supplies subject #ESC4: write access on template #ESC8: NTLM relay to AD CS HTTP endpoint #ESC9: CT_FLAG_NO_SECURITY_EXTENSION #ESC10: weak certificate mapping
• Mark ADCS Exploitation: ESC1, ESC4, ESC6, ESC8 as done
  Guide 5 min read

  ADCS Exploitation: ESC1, ESC4, ESC6, ESC8

  Focus on #ESC1: certificate for arbitrary UPN #ESC4: modify template then exploit as ESC1 #ESC8: NTLM relay to AD CS web enrollment #ESC6: EDITF_ATTRIBUTESUBJECTALTNAME2
• Mark ADCS Exploitation: ESC2, ESC3, ESC5, ESC7 as done
  Guide 6 min read

  ADCS Exploitation: ESC2, ESC3, ESC5, ESC7

  Focus on #ESC2: Any Purpose EKU #ESC3: Enrollment Agent #ESC5: CA object ACL misconfiguration #ESC7: CA management rights
• Mark ESC8 — NTLM Relay to AD CS Web Enrollment as done
  Guide 4 min read

  ESC8 — NTLM Relay to AD CS Web Enrollment

  Focus on #Checking for ESC8 #Certipy relay (all-in-one) #Using the DC NT hash
• Mark ADCS Exploitation: ESC9 and ESC10 as done
  Guide 5 min read

  ADCS Exploitation: ESC9 and ESC10

  Focus on #ESC9: UPN swap via NO_SECURITY_EXTENSION template #ESC10a: weak binding enforcement, any template #ESC10b: SubjectName mapping (CertificateMappingMethods)
• Mark Coercion Attacks in Active Directory as done
  Guide 4 min read

  Coercion Attacks in Active Directory

  Focus on #PrinterBug: MS-RPRN coercion #PetitPotam: MS-EFSR coercion #Coercer: multi-protocol coercion
• Mark Coercer and PetitPotam — Active Directory Coercion Frameworks as done
  Guide 6 min read

  Coercer and PetitPotam — Active Directory Coercion Frameworks

  Focus on #Coercer: unified coercion framework #PetitPotam: MS-EFSRPC coercion #PrinterBug: MS-RPRN coercion #NTLM relay #TGT theft via unconstrained delegation
• Mark NTLM Relay Conditions as done
  Guide 3 min read

  NTLM Relay Conditions

  Focus on #SMB signing #LDAP signing and channel binding #WebDAV: relay over HTTP #Relay target summary
• Mark NTLM Relay in Active Directory as done
  Guide 5 min read

  NTLM Relay in Active Directory

  Focus on #Check signing requirements #NTLM relay setup #Relay to SMB: command execution #Relay to LDAP: RBCD and machine account creation #Relay to ADCS: certificate request
• Mark ACL Abuse Privilege Escalation as done
  Guide 5 min read

  ACL Abuse Privilege Escalation

  Focus on #GenericAll and GenericWrite: full object control #WriteOwner: take ownership then grant rights #WriteDACL: grant yourself DCSync rights #GenericWrite on computer: RBCD setup #Shadow Credentials: certificate-based takeover
• Mark Shadow Credentials as done
  Guide 5 min read

  Shadow Credentials

  Focus on #Shadow credential on user account #Shadow credential on computer account
• Mark NoPac: sAMAccountName Spoofing as done
  Guide 4 min read

  NoPac: sAMAccountName Spoofing

  Focus on #Automated exploit: noPac.py #Manual exploit chain (impacket)
• Mark GPO Abuse as done
  Guide 3 min read

  GPO Abuse

  Focus on #Find writable GPOs and their scope #pyGPOAbuse: from Kali #New-GPOImmediateTask: from a Windows shell
• Mark Group Membership Exploitation as done
  Guide 4 min read

  Group Membership Exploitation

  Focus on #Add account to privileged group #DNSAdmins privilege escalation #Machine account creation
• Mark Privileged Group Abuse as done
  Guide 4 min read

  Privileged Group Abuse

  Focus on #Account Operators #Exchange Windows Permissions #Print Operators
• Mark DNSAdmins Privilege Escalation as done
  Guide 3 min read

  DNSAdmins Privilege Escalation

  Focus on #Confirm DNSAdmins membership #Create the malicious DLL #Configure the plugin and trigger
• Mark Backup Operators and Server Operators Abuse as done
  Guide 4 min read

  Backup Operators and Server Operators Abuse

  Focus on #Backup Operators: dump NTDS via nxc #Backup Operators: manual registry hive dump #Server Operators: service binary path hijack
• Mark DCSync and Domain Takeover as done
  Guide 4 min read

  DCSync and Domain Takeover

  Focus on #Grant DCSync rights with BloodyAD #Perform DCSync #Using the dumped hashes

Practice

Apply the module hands-on.