Education

Scenario

In this scenario it is assumed you do not have credentials, but you do have either adjacent or routable access to an Active Directory Domain Controller and can access common ports/services such as: LDAP, LDAPS, SMB, NETBIOS, KERBEROS, DNS

Stage 1 – Recon & Enumeration

This assumes we have routable access to LDAP on a domain controller and well as DNS (likely on a private network (but don’t rule out someone not exposing this to the internet, that occurs sometimes!)

Stage 1 Goals

The primary goal of this stage is to:

  • Obtain a list of valid users (and ideally all other domain objects)
  • Attempt to gain at least one valid authentication to Active Directory Domain Services (via LDAP at minimum)
  • Once authenticated use AD Explorer (and other tools) to take a “snapshot” of the domain.
  • You will attempt to take an offline copy of SYSVOL

Process

Try and start with a stealthy approach, use “normal” system calls where possible. The primary target will be Domain Controllers, but we also must consider that we can target member servers for enumeration and exploitation (via RDP, SMB, WINRM etc.) (sorry the formatting broke here I will fix later it’s choccy egg day so much to do!)

  1. Enumerate DNS
    1. Find domain name.
    1. Find domain controllers (via dns)
  2. Enumerate Domain Services
    1. Connect to LDAP and enumerate the ROOTDSE
    1. Conduct OSINT and Recon on corporate internet assets and social media.
    1. Look at breach data for usernames and passwords.
    1. Use LDAPPing to enumerate valid usernames (LDAPNOMNOM)
      1. .\ldapnomnom-windows-amd64.exe -server 172.22.110.52 -input .\users.txt
    1. Attempt an LDAP NULL BIND (Be warned this is possibly going to trigger an alert)
    1. Another method of username enumeration is to use exchange to enumerate valid mailboxes (this may not be opsec safe)
    1. You can also try enumerating via Kerberos
      1. https://nmap.org/nsedoc/scripts/krb5-enum-users.html
    1. You can also try RID Enumeration (NULL SESSIONS)
      1. https://github.com/trustedsec/ridenum
    1. You can also try enumerating users via SMB (LSA or SAMR)
      1. https://nmap.org/nsedoc/scripts/smb-enum-users.html
      1. Try crackmapexec –users
    1. Lastly, we can try common usernames:
      1. Administrator (SID500)
      1. Itsupport
      1. Backup
      1. Svc_backup
      1. Printer
      1. Scanner
      1. Ldad
    1. Find users via other network services (e.g., RDP with NLA disabled)
    1. You may also find user credentials in devices such as Multi-Function Devices (like printers) where admin interfaces are not protected.
  3. Authenticate
    1. NULL Bind (see above)
    1. Credential Spray
      1. Breached credentials
      1. Company name
      1. Industry words
      1. Seasons/days etc.,
      1. Common weak passwords
    1. Password guess
    1. Dictionary attack
    1. If you are adjacent to domain members attempt to poison LLLMNR/mDNS and obtain both usernames and password hashes
    1. If you are adjacent, you may be able to relay (SMBRelay/MITMv6 etc.)
      1. SMB
      1. HTTP (WPAD/WEBDAV)
      1. Relay to ADCS (Relay to ADCS HTTP Endpoints)
      1. Relay to create a machine account (thanks Justin!)
    1. You may be able to coerce an authentication (phish someone with a link to your responder server etc.)
    1. You may be able to coerce authentication using petitpotam
    1. You may be able to use a known software vulnerability such as:
      1. ZeroLogon (CVE-2020-1472) (risky by default)
      1. Bluekeep (risky)
      1. EternalBlue (MS17-010) (May BSOD so I would say this is risky, I ask people before I run this, if you wanna skip forward you can always elevate to system on the target and run a shell back somewhere 😉 )
  4. Snapshot
    1. Now that we (hopefully) have either NULL BIND to LDAP or a valid set of credentials we want to take a snapshot of the directory service by using ADEXPLORER (or other similar tools).
    1. You will also want to consider taking a copy of SYSVOL

Tools

More to follow but I thought I would start here, writing all this stuff is hard, but easier to post some rather than wait for me to complete essays! Thanks to Justin for sanity checking.

Remember the number of variables with this stuff is HIGH. Not every network has a clear path, not every scope allows every method (e.g. lots exclude phishing) and that you can use assumed breach and fast forwards to make simulated progress to change the test perspective (these are all normal things).

Related articles

Copyright (c) Xservus Limited