⚙️Misconfigurations
Exchange Related Group Membership
In a default installation of Microsoft Exchange within an AD environment it will be given many privileges within the domain. The group Exchange Windows Permission is not listed as a protected group but members are given the ability to write a DACL to the domain object.
An attacker can use this to add accounts to this group via a DACAL misconfiguration.
More techniques can be found here
The Exchange Group Organization Management is another powerful group that can access the mailboxes of all domain users. Sysadmins are usually members of the group. If we can compromise an Exchange server it will often lead to Domain Admin privileges. We should also be aware that dumping creds will often lead to 100's of cleartext credentials or NTLM hashes!
PrivExchange
These attacks are flaws in the Exchange Server PushSubscription feature, which allows any domain user with a mailbox to force the Exchange server to authenticate to any host provided by the client over HTTP.
Printer Bug
A flaw in the MS-RPRN protocol (Print System Remote Protocol).
To leverage this flaw any domain user can connect to the spools named pipe with the RpcOpenPrinter methods and the RpcRemoteFindFirstPrinterChangeNotificationEx method and force the server to authenticate to any host provided by the client over SMB.
Enumerating for MS-PRN Printer Bug
We can use Get-SpoolStats from the SecurityAssesment tool to check for vulnerable machines
MS14-068
A flaw in Kerberos which can be leveraged with standard domain user creds to elevate privileges to Domain Admin. A Kerberos ticket contains information about a user, including the account name, ID, and group membership in the Privilege Attribute Certificate (PAC). The PAC is signed by the KDC using secret keys to validate that the PAC has not been tampered with after creation.
This allowed a forged PAC to be accepted by the KDC as legitimate. We can create a fake PAC, presenting a user as a member of the Domain Administrators or other privileged group. The tools such as the Python Kerberos Exploitation Kit (PyKEK) or the Impacket toolkit can be used to exploit this.
Sniffing LDAP Credentials
Many applications and printers store LDAP cred in their web admin console to connect to the domain. The consoles often have weak or default passwords and sometimes are even cleartext. Some applications have a test function that means we can gather credentials by changing the LDAP IP address to our attack host IP.
Enumerating DNS Records
We can use https://github.com/dirkjanm/adidnsdump to enumerate all DNS records in a domain using a valid user account. By default, all users can list the child objects of a DNS zone in an AD environment, the tool uses this to resolve al records in the zone and tries to find something useful for our engagement.
Using adidnsdump
Viewing the Contents of the records file
Using the -r option to Resolve Unknown Records
If we run the tool with the -r option it will attempt to resolve unknown records by performing an A query.
Password in Description Field
Sometimes sensitive information is found in the user account Description or Notes fields.
Finding Passwords in the Description Field
We can use PowerView to quickly search through large domains
PASSWD_NOTREQD Field
Some domain accounts may have the field passwd_notreqd set, if this is found it means the users could have a shorter password or no password set at all.
Checking for PASSWD_NOTREQD Setting
Credentials in SMB Shares and SYSVOL Scripts
It can be a treasure trove of data, especially in large organizations. It may also contain different batch scripts within the scripts directory. Sometimes we can find very old scripts containing disabled accounts or old passwords.
Example Discovering an Interesting Script
Group Policy Preferences (GPP) Passwords
When a new GPP is created in an.xml file is created in the SYSVOL share, which is also locally cached on endpoints that the Group Policy applies to. These file include
Map drives (drives.xml)
Create local users
Create printer config files (printers.xml)
Creating and updating services (services.xml)
Creating scheduled tasks (scheduledtasks.xml)
Changing local admin passwords.
They contain an array of config data and defined passwords.
The XML looks like the following
Decrypting the Password with gpp-decrypt
If we retrieve the cpassword value, we can decrypt it with gpp-decrypt
Locating GPP Passwords with CME
GPP password can located by searching the SYSVOL share or using tools like https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-GPPPassword.ps1 and CrackMapExec.
Using CME's gpp_autologin Module
We can also find password in files such a Registry.xml when autologon is configured via Group Policy.
AS-REP Roasting
Occurs when a user account has the privilege “Does not require Pre-Authentication” set. The account does not need to provide valid identification before requesting a ticket.
Viewing an Account with the Do not Require Kerberos Preauthentication Option
Enumerating for DONT_REQ_PREAUTH Value using Get-DomainUser
We can use PowerView to enumerate users with their UAC value set to DONT_REQ_PREAUTH
Retrieving AS-REP in Proper Format with Rubeus
With Rubeus we can try to obtain the ticket for the target account. If an attacker has GenericWrite or GenericAll permissions over an account, they can enable this attribute and obtain the AS-REP ticket for offline cracking to recover the account's password before disabling the attribute again.
Cracking the Hash with Hashcat
With the mode set to -m 18200 we can attempt to crack the hash
Retrieving the AS-REP Using Kerbrute
This tool will automatically retrieve the AS-REP for any users found that do not require Kerberos pre-auth.
Hunting for Users with Kerberos Pre-auth Not Required
With a valid list of users, we can use the below tool to hunt for all users with Kerberos pre-auth not required.
Group Policy Object (GPO) Abuse
Group Policy provides admins with many advanced settings that can be applied to both user and computer object in an AD environment. If we gain rights over a GPO via an ACL misconfiguration, we could leverage this for lateral movement, privilege escalation and even domain compromise.
GPO misconfigurations can be abused to perform the following attacks:
Adding additional rights to a user (such as SeDebugPrivilege, SeTakeOwnershipPrivilege, or SeImpersonatePrivilege)
Adding a local admin user to one or more hosts
Creating an immediate scheduled task to perform any number of actions
Enumerating GPO Names with PowerView
We can use PowerView to enumerate GPO information and get a listing of GPOs by name
Enumerating GPO Names with PowerShell
Enumerating Domain User GPO Rights
We can check if a user has any rights over a GPO, a good first check is to see if the entire Domain Users Group has any rights over one or more GPOs.
We should look out for permissions such as WriteProperty and WriteDacl, as we can leverage these to give ourselves full control over the GPO.
Converting GPO GUID to Name
We can get the display name of the GPO using the Get-GPO function
Last updated
Was this helpful?