Personal WebsiteLinkedin

Attacktive Directory

Setup

Installing Impacket:

Whether you're on the Kali 2019.3 or Kali 2021.1, Impacket can be a pain to install correctly. Here's some instructions that may help you install it correctly!

⚠️Note: All of the tools mentioned in this task are installed on the AttackBox already. These steps are only required if you are setting up on your own VM. Impacket may also need you to use a python version >=3.7. In the AttackBox you can do this by running your command with python3.9 <your-command> .

First, you will need to clone the Impacket Github repo onto your box. The following command will clone Impacket into /opt/impacket:

git clone https://github.com/SecureAuthCorp/impacket.git /opt/impacket

After the repo is cloned, you will notice several install related files, requirements.txt, and setup.py. A commonly skipped file during the installation is setup.py, this actually installs Impacket onto your system so you can use it and not have to worry about any dependencies.

To install the Python requirements for Impacket:

pip3 install -r /opt/impacket/requirements.txt

Once the requirements have finished installing, we can then run the python setup install script:

cd /opt/impacket/ && python3 ./setup.py install

After that, Impacket should be correctly installed now and it should be ready to use!

If you are still having issues, you can try the following script and see if this works:

sudo git clone https://github.com/SecureAuthCorp/impacket.git /opt/impacket

sudo pip3 install -r /opt/impacket/requirements.txt

cd /opt/impacket/

sudo pip3 install .

sudo python3 setup.py install

Installing Bloodhound and Neo4j

Bloodhound is another tool that we'll be utilizing while attacking Attacktive Directory. We'll cover specifcs of the tool later, but for now, we need to install two packages with Apt, those being bloodhound and neo4j. You can install it with the following command:

apt install bloodhound neo4j

Now that it's done, you're ready to go!

Troubleshooting

If you are having issues installing Bloodhound and Neo4j, try issuing the following command:

apt update && apt upgrade

Welcome to Attacktive Directory

ℹ️Notes: Flags for each user account are available for submission. You can retrieve the flags for user accounts via RDP (Note: the login format is spookysec.local\User at the Window's login prompt) and Administrator via Evil-WinRM.

We start by adding the IP address of our machine to the /etc/hosts

Enumeration

Basic nmap scan to discover what we are working with:

From this scan we discover the Domain Name of the machine as well as the the full AD domain:

  • NetBIOS_Computer_Name: ATTACKTIVEDIREC

  • NetBIOS_Domain_Name: THM-AD

  • DNS_Domain_Name: spookysec.local

  • DNS_Computer_Name: AttacktiveDirectory.spookysec.local

Using Metasploit we can confirm the SMB version used:

The use of ".local" domains for Active Directory is discouraged primarily due to potential conflicts with multicast Domain Name System (mDNS) and name resolution services used in local networks. In the past, the ".local" extension was widely used for local networks and seemed like a convenient choice for Active Directory implementations. However, this led to issues when multicast Domain Name System (mDNS) resolution became more prevalent.

mDNS is used for name resolution on local networks without the need for a centralized DNS server. When a domain ends with ".local," it may interfere with mDNS requests and cause conflicts in name resolution, especially in mixed environments with non-Windows devices.

Another reason is that the ".local" suffix has been later reserved for use by Zeroconf and the mDNS standard. The Internet Engineering Task Force (IETF) recommended using registered top-level domains to ensure there are no conflicts with new standards and protocols.

Instead, it is recommended to use a valid top-level domain, such as "company.local" or "ad.company.com." This not only avoids potential name resolution conflicts but also aligns better with best practices and domain naming standards on the Internet. The Internet Engineering Task Force (IETF) reserves the use of the domain name label .local as a special-use domain name for hostnames in local area networks that can be resolved via the Multicast DNS name resolution protocol. Any DNS query for a name ending with the label local must be sent to the mDNS IPv4 link-local multicast address 224.0.0.251, or its IPv6 equivalent ff02::fb. A domain name ending in .local may be resolved concurrently via other mechanisms, for example, unicast DNS.

Enumerating SMB

Using enum4linux we are able to enumerate ports 139 and 445.

Enumerating Kerberos

A whole host of other services are running, including Kerberos. Kerberos is a key authentication service within Active Directory. With this port open, we can use a tool called Kerbrute (by Ronnie Flathers @ropnop) to brute force discovery of users, passwords and even password spray!

For this box, a modified User List and Password List will be used to cut down on time of enumeration of users and password hash cracking. It is NOT recommended to brute force credentials due to account lockout policies that we cannot enumerate on the domain controller.

Two notable accounts are discovered: svc-admin & backup:

Exploitation

After the enumeration of user accounts is finished, we can attempt to abuse a feature within Kerberos with an attack method called ASREPRoasting. ASReproasting occurs when a user account has the privilege 'Do not require Kerberos preauthentication' set. This means that the account does not need to provide valid identification before requesting a Kerberos Ticket on the specified user account.

We can try to use GetNPUsers.py to export their TGTs for cracking:

Now we can try to crack it using the password list provided in the challenge resources.

  1. Save the hash of TGT in a file:

  2. Find the method to use with hashcat based on our hash file format:

  3. Crack it: hashcat -m 18200 -a 0 hashes.asreproast passwordlist.txt

Enumeration (again)

With a user's account credentials we now have significantly more access within the domain. We can now attempt to enumerate any shares that the domain controller may be giving out.

We can use crackmapexec to map remote SMB shares:

Or other tools like smbmap:

smbmap has a beatiful feature with option -r to list recursively all the contents in shares!

or simply smbclient:

We find a very useful txt file:

Download the file locally:

Using Cyberchef Magic feature we can identify easily the encoding algorith used (is Base64) and also the decoded output:

The Magic operation attempts to detect various properties of the input data and suggests which operations could help to make more sense of it.

[email protected]:backup2517860

Privilege Escalation

Now that we have new user account credentials, we may have more privileges on the system than before. The username of the account "backup" gets us thinking.

❓What is this the backup account to?

Well, it is the backup account for the Domain Controller. This account has a unique permission that allows all Active Directory changes to be synced with this user account. This includes password hashes

Using Impacket tool called secretsdump.py:

PreviousWriteupsNextWindows PrivEsc Arena

Last updated