Attacktive Directory
Enumeration
Nmap
As nmap output add spookysec.local to /etc/hosts
We can use enum4linux to enumerate SMB for Users, Shares, etc..., but this is along output and I didn't add in this section cause of there is not much interesting information.
Kerberos Enumeration
We can bruteforce the domain controller with usernames and password list that are already given for this room and download it. To enumerate this, we can use this tool.
After the enumeration of user accounts is finished, we can attempt to abuse a feature within Kerberos with an attack method called ASREPRoasting. ASReproasting occurs when a user account has the privilege "Does not require Pre-Authentication" set. This means that the account does not need to provide valid identification before requesting a Kerberos Ticket on the specified user account.
Impacket provides a tool called GetNPUsers.py which searches the domain, lets attack the admin, svc-admin ,
Privilege Escalation
Now we have credentials for smb server , svc-admin:management2005 ,
There is one interesting file which is called backup_credentials.txt in backup folder, Let's login and download it.
backup@spookysec.local:backup2517860
Now we have another account, let's use impacket tool which is call secretsdump.py to view all the password hashes this user can access.
We get administrator password hashes, you can crack this hash but we can use Pass The Hash method with evil-winrm and psexec.py tools.
Evil-Winrm
Psexec.py
Now we get Administrator access.
Last updated