AD Exploitation & Persistence

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

• Mark BloodHound and SharpHound Collection as done
  Guide 6 min read

  BloodHound and SharpHound Collection

  Focus on #SharpHound: Windows collection #Transfer the ZIP to your attack box #BloodHound.py: collection from Linux #nxc BloodHound collection #BloodyAD: targeted collection without ZIP #BloodHound Community Edition (CE) #Starting BloodHound CE #Collecting for CE #Uploading to CE #Loading and analysing in BloodHound
• Mark BloodHound Edge Reference as done
  Guide 31 min read

  BloodHound Edge Reference

  Focus on #Object Control Edges #GenericAll #GenericWrite #ForceChangePassword #WriteOwner #WriteDACL #AddKeyCredentialLink / Shadow Credentials (CE) #Session and Access Edges #HasSession #AdminTo #CanRDP / CanPSRemote / ExecuteDCOM #SQLAdmin #Replication Edges #DCSync / GetChanges + GetChangesAll / AllExtendedRights on Domain #Delegation Edges #AllowedToDelegate (Constrained Delegation) #AllowedToAct / RBCD (Resource-Based Constrained Delegation) #ADCS Edges (BloodHound CE) #BloodHound CE: Cypher Queries
• Mark Kerberoasting as done
  Guide 4 min read

  Kerberoasting

  Focus on #Find Kerberoastable accounts #Request TGS hashes #Crack the hashes #Targeted Kerberoasting via GenericWrite
• Mark AS-REP Roasting as done
  Guide 4 min read

  AS-REP Roasting

  Focus on #What is AS-REP Roasting? #Who can run AS-REP Roasting? #Find AS-REP Roastable accounts #Request the AS-REP hashes #With a domain login #Without a login #Crack the AS-REP hashes #Force AS-REP Roasting with GenericWrite #After the roast
• Mark DCSync and Domain Takeover as done
  Guide 4 min read

  DCSync and Domain Takeover

  Focus on #Prerequisites #Grant DCSync rights with BloodyAD #Perform DCSync #Using the dumped hashes #Get domain SID #Cleanup: remove DCSync rights
• Mark ACL Abuse Privilege Escalation as done
  Guide 5 min read

  ACL Abuse Privilege Escalation

  Focus on #GenericAll and GenericWrite: full object control #WriteOwner: take ownership then grant rights #WriteDACL: grant yourself DCSync rights #GenericWrite on computer: RBCD setup #Shadow Credentials: certificate-based takeover
• Mark Privileged Group Abuse as done
  Guide 4 min read

  Privileged Group Abuse

  Focus on #Account Operators #Exchange Windows Permissions #Print Operators
• Mark Golden Ticket and Silver Ticket Attacks as done
  Guide 4 min read

  Golden Ticket and Silver Ticket Attacks

  Focus on #Golden Ticket: What You Need #Getting the krbtgt Hash and Domain SID #Forging a Golden Ticket with Impacket #Forging a Golden Ticket with Mimikatz #Silver Ticket: What You Need #Forging a Silver Ticket with Impacket #Forging a Silver Ticket with Mimikatz #Service Name Substitution (AnySPN) #Ticket Lifetime
• Mark Credential Harvesting as done
  Guide 6 min read

  Credential Harvesting

  Focus on #LAPS passwords #gMSA passwords #NTDS.dit: full domain hash dump #LSASS: local credentials from memory #Credential search across the domain
• Mark Situational Awareness as done
  Guide 4 min read

  Situational Awareness

  Focus on #Confirm current access level #Domain and forest trusts #Active sessions and logged-in users #Domain controller discovery
• Mark Account and ACL Persistence as done
  Guide 4 min read

  Account and ACL Persistence

  Focus on #Backdoor domain account #DCSync rights as persistent backdoor #GenericAll on AdminSDHolder #Shadow Credentials as persistence
• Mark Golden and Silver Ticket Persistence as done
  Guide 4 min read

  Golden and Silver Ticket Persistence

  Focus on #Golden Ticket: domain-wide persistence #Silver Ticket: service-specific persistence #Diamond Ticket: harder to detect than Golden
• Mark DSRM and Skeleton Key as done
  Guide 4 min read

  DSRM and Skeleton Key

  Focus on #DSRM: Directory Services Restore Mode backdoor #Skeleton Key

Practice

Apply the module hands-on.