🔪Bleeding Edge Vulnerabilities
NoPac (SamAccountName Spoofing)
Nopac or the Same_TheAdmin vulnerability is an emerging threat released at the end of 2021. The attack is made up of two CVEs: 2021-42278 and 2021-42287
These may allow the attacker intra-domain privilege escalation from any standard user to Domain Admin level access.
The flow of the attack can be seen here
NoPac uses a tool in Impacket to communicate with. upload a payload and issue a command from the attack host to the target DC.
Installation
Scanning for NoPac
We can use NoPac to check if the system is vulnerable, we use a standard domain user to attempt to gain a TGT from the target DC. If we see ms-DS-MachineAccountQuota = 10 we know it is vulnerable but if ms-DS-MachineAccountQuota = 0 the attack will fail because our user does not have the rights to add a new machine account.
Getting a Shell
Once we know the system is vulnerable, we can attempt to get a shell with SYSTEM-level privileges.
We should not that this could be considered "noisy" and may be blocked by AV programs
DCSync the Built-in Admin Account
If successful we will now have a .local.cache file on our host.
We can use the file to perform a pass-the-ticket and perform a DCSync attack
PrintNightmare
PrintNightmare is a vulnerability found in the Print Spooler service that runs on all Windows OSs. Many exploits have been created based on this to allow privilege escalation and remote code execution.
Install Exploit
Install cube0x0's Version of Impacket
We must make sure that we are using the correct version of Impacket,
Enumerating for MS-RPRN
We can use the below command to see if Print System Asynchronous Protocol and Print System Remote Protocol are exposed on the target. Once confirmed we can move onto the next step.
Generating a DLL Payload
We craft a DLL payload with msfvenom
Generate a Share with smbserver.py
We will host the payload in an SMB share
Setting us MSF multi/handler
Once the share is created and hosting our payload we can set up a listener to catch the reverse shell
Running the Exploit
We make sure to have \\<ip address of attack host>\ShareName\nameofpayload.dll in our command then we can finally run the exploit, if it is successful we will receive an elevated SYSTEM shell.
PetitPotam (MS-EFSRPC)
PetitPotam is an LSA spoofing vulnerability that was patched in 2021. The exploit allows an unauthenticated attacker to coerce a DC to authenticate against another host using NTLM over port 445 via the Local Security Authority Remote Protocol (LSARPC).
This allows an attacker to take over a Windows domain where Active Directory Certificate Server (AD CS) is in use.
In the attack, an auth request from the target DC is relayed to the CA host's Web Enrollment page and makes a Certificate Signing Request (CSR) for a new certificate. This certificate can be used with a tool such as Rubues or gettgtpkinit.py to request a TGT for the DC.
To find the location of the CA we can use a tool like https://github.com/zer1t0/certi.
Starting ntlmrelayx.py
We first start ntlmrelayx.py specifying the enrollment URL for the CA host.
Running PetitPotam
In another window, we can start PeitiPotam and pass in the attack host IP and DC IP.
Catching Base64 Encoded Certificate for DC01
If the login was successful we can try and obtain a base64 cert for the DC
Requesting a TGT
We can use the base64 cert with gettgtpkinit.py to request a TGT for the DC
Setting the KRB5CCNAME Env Variable
The TGT was saved as dc01.cache file which we can pass into the KRB5CCNAME env variable so our attack host used this file for Kerberos authentication attempts.
Using Domain Controller TGT to DCSync
We can use this TGT with secretsdump.py to perform a DCSync and retrieve one or all NTLM hashes for the domain
Confirming Admin Access to the DC
Submitting a TGS Request for Ourselves using getnthash.py
We can use the tool getnthash.py to request the NT hash for our target using Kerberos U2U to submit a TGS request with the Privileged Attribute Certificate (PAC).
Using DC NTLM Hash to DCSync
We can use the obtained hash to perform a DCSync
Requesting TGT with Rubeus
We could alternatively use the certificate we got earlier with Ruebus on the Windows attack host to request a TGT ticket and perform a PTT attack
Confirming the Ticket is in Memory
We can check to see if the ticket is in memory
Performing DCSysnc with Mimikatz
Finally, we can perform the attack with the PTT.
Last updated
Was this helpful?