Sauna

IP : 10.10.10.175

Open Ports

PORT     STATE SERVICE
53/tcp   open  domain
80/tcp   open  http
88/tcp   open  kerberos-sec
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
389/tcp  open  ldap
445/tcp  open  microsoft-ds
464/tcp  open  kpasswd5
593/tcp  open  http-rpc-epmap
636/tcp  open  ldapssl
3268/tcp open  globalcatLDAP
3269/tcp open  globalcatLDAPssl

Obtaining Domain Name

ldapsearch

ldapsearch -x -H ldap://10.10.10.175 -s base namingcontexts

namingcontexts: DC=EGOTISTICAL-BANK,DC=LOCAL
namingcontexts: CN=Configuration,DC=EGOTISTICAL-BANK,DC=LOCAL
namingcontexts: CN=Schema,CN=Configuration,DC=EGOTISTICAL-BANK,DC=LOCAL
namingcontexts: DC=DomainDnsZones,DC=EGOTISTICAL-BANK,DC=LOCAL
namingcontexts: DC=ForestDnsZones,DC=EGOTISTICAL-BANK,DC=LOCAL

nmap

netexec (formerly crackmapexec)

dig

nslookup

nslookup

SERVER <IP_DNS> #Select dns server 127.0.0.1 #Reverse lookup of 127.0.0.1, maybe... <IP_MACHINE> #Reverse lookup of a machine, maybe...

Enumerating Domain Name

Filtering ldapsearch

Bruteforcing Valid Usernames :

  • it auth by : hey , do i need kerberos preauth ? yes = valid user

AS-REP

Typically, when you try to request authentication through Kerberos, first the requesting party has to authenticate itself to the DC. But there is an option, DONT_REQ_PREAUTH where the DC will just send the hash to an unauthenticated user. AS-REP Roasting is looking to see if any known users happen to have this option set.

basically send key to anyone that didnt set 2FA

hashes.aspreroast

Bruteforcing hash

ldapdomaindump (make sure ldap port open)

bloodhound-python + bloodhound

valid creds : fsmith : Thestrokes23 other users :

Loggin in usign winrm

Running winpeas

Flags

updating user list

Password Hunting

svc_loanmanager : Moneymakestheworldgoround!

In Active Directory (AD), the GetChanges and GetChangesAll operations are part of the replication process. They are not inherently malicious; instead, they are legitimate operations used by domain controllers to replicate changes between each other. However, in the context of security, these operations can be exploited in a technique called DCSync.

DCSync is an attack technique that takes advantage of the replication mechanisms in Active Directory. It allows an attacker to simulate the behavior of a domain controller (DC) and request password data for user accounts, including those with privileged access like domain administrators. The attacker does not need to compromise the account's password but instead requests and replicates the password hash.

Here's how DCSync works:

  1. Replication Request: An attacker with sufficient privileges (often a domain administrator or a user with the "Replicating Directory Changes" permission) uses the GetChanges or GetChangesAll operation to request changes from the Active Directory, simulating replication requests.

  2. Password Hash Retrieval: If the attacker requests changes related to user account password hashes, the DC will provide the information, including the NTLM hashes.

  3. Pass-the-Ticket or Pass-the-Hash: The attacker can then use the obtained password hashes for lateral movement within the network or privilege escalation.

POC :

Pass The Hash

PreviousTimelapseNextHTB Register Form

Last updated