NTLM Relay, ADCS & SQL Server Trust

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

• Mark NTLM Relay Conditions as done
  Guide 3 min read

  NTLM Relay Conditions

  Focus on #SMB signing #LDAP signing and channel binding #WebDAV: relay over HTTP #Relay target summary
• Mark Coercion Attacks in Active Directory as done
  Guide 4 min read

  Coercion Attacks in Active Directory

  Focus on #AD coercion attack methods #Capture arriving hashes with Responder #PrinterBug: MS-RPRN coercion #PetitPotam: MS-EFSR coercion #Coercer: multi-protocol coercion
• Mark Coercer and PetitPotam — Active Directory Coercion Frameworks as done
  Guide 6 min read

  Coercer and PetitPotam — Active Directory Coercion Frameworks

  Focus on #Coercer: unified coercion framework #PetitPotam: MS-EFSRPC coercion #PrinterBug: MS-RPRN coercion #What to do with the coerced authentication #OPSEC
• Mark NTLM Relay in Active Directory as done
  Guide 5 min read

  NTLM Relay in Active Directory

  Focus on #Check signing requirements #NTLM relay setup #Relay to SMB: command execution #Relay to LDAP: RBCD and machine account creation #Relay to ADCS: certificate request
• Mark ADCS Misconfiguration Discovery as done
  Guide 7 min read

  ADCS Misconfiguration Discovery

  Focus on #Confirm ADCS is deployed #Certipy: full ADCS enumeration #ESC1: enrollee supplies subject #ESC4: write access on template #ESC8: NTLM relay to AD CS HTTP endpoint #ESC9: CT_FLAG_NO_SECURITY_EXTENSION #ESC10: weak certificate mapping
• Mark ADCS Exploitation: ESC1, ESC4, ESC6, ESC8 as done
  Guide 5 min read

  ADCS Exploitation: ESC1, ESC4, ESC6, ESC8

  Focus on #ESC1: certificate for arbitrary UPN #ESC4: modify template then exploit as ESC1 #ESC8: NTLM relay to AD CS web enrollment #ESC6: EDITF_ATTRIBUTESUBJECTALTNAME2
• Mark ESC8 — NTLM Relay to AD CS Web Enrollment as done
  Guide 4 min read

  ESC8 — NTLM Relay to AD CS Web Enrollment

  Focus on #Checking for ESC8 #Attack chain #Certipy relay (all-in-one) #Using the DC NT hash
• Mark RBCD – Resource-Based Constrained Delegation Abuse as done
  Guide 4 min read

  RBCD – Resource-Based Constrained Delegation Abuse

  Focus on #Step 1: Create a Controlled Machine Account #Step 2: Write the Delegation Attribute #Step 3: Get the Hash of Your Controlled Machine Account #Step 4: Request a Service Ticket via S4U #Step 5: Use the Ticket #Targeting a Domain Controller #From Windows with Rubeus
• Mark Pass-the-Certificate as done
  Guide 4 min read

  Pass-the-Certificate

  Focus on #Authenticate via PKINIT: get TGT or NT hash #Lateral movement with the obtained TGT #NTLM-restricted environments
• Mark MSSQL Credential Capture via Forced Authentication as done
  Guide 3 min read

  MSSQL Credential Capture via Forced Authentication

  Focus on #Start Responder #Trigger Outbound Authentication via xp_dirtree #Alternative: xp_fileexist #Crack the Captured Hash
• Mark Lateral Movement via MSSQL Linked Servers as done
  Guide 4 min read

  Lateral Movement via MSSQL Linked Servers

  Focus on #MSSQL linked server lateral movement: enumeration #Execute Queries on the Linked Server #Execute Stored Procedures on the Linked Server #Chain Through Multiple Linked Servers
• Mark MSSQL Privilege Escalation via Impersonation as done
  Guide 3 min read

  MSSQL Privilege Escalation via Impersonation

  Focus on #MSSQL impersonation privilege escalation: identify targets #Impersonate sa and Confirm Escalation #Database-Level Impersonation #TRUSTWORTHY Database Escalation to Sysadmin

Practice

Apply the module hands-on.